587 files changed, 4527 insertions, 5543 deletions

diff --git a/Documentation/crypto/api-intro.txt b/Documentation/crypto/api-intro.txt
index e41a79aa71ce..9b84b805ab75 100644
--- a/Documentation/crypto/api-intro.txt
+++ b/Documentation/crypto/api-intro.txt
@@ -60,7 +60,7 @@ Here's an example of how to use the API:
         desc.tfm = tfm;
         desc.flags = 0;
         
-        if (crypto_hash_digest(&desc, &sg, 2, result))
+        if (crypto_hash_digest(&desc, sg, 2, result))
                 fail();
         
         crypto_free_hash(tfm);
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index c3b1430cf603..0bc8b0b2e103 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -316,3 +316,11 @@ Why:	The option/code is
 Who:    Johannes Berg <johannes@sipsolutions.net>
 
 ---------------------------
+
+What:   i8xx_tco watchdog driver
+When:   in 2.6.22
+Why:    the i8xx_tco watchdog driver has been replaced by the iTCO_wdt
+        watchdog driver.
+Who:    Wim Van Sebroeck <wim@iguana.be>
+
+---------------------------
diff --git a/Documentation/gpio.txt b/Documentation/gpio.txt
index 576ce463cf44..989f1130f4f3 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio.txt
@@ -105,12 +105,15 @@ setting up a platform_device using the GPIO, is mark its direction:
 
         /* set as input or output, returning 0 or negative errno */
         int gpio_direction_input(unsigned gpio);
-        int gpio_direction_output(unsigned gpio);
+        int gpio_direction_output(unsigned gpio, int value);
 
 The return value is zero for success, else a negative errno.  It should
 be checked, since the get/set calls don't have error returns and since
 misconfiguration is possible.  (These calls could sleep.)
 
+For output GPIOs, the value provided becomes the initial output value.
+This helps avoid signal glitching during system startup.
+
 Setting the direction can fail if the GPIO number is invalid, or when
 that particular GPIO can't be used in that mode.  It's generally a bad
 idea to rely on boot firmware to have set the direction correctly, since
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 856c8b114e71..ef2ffded1392 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -138,6 +138,12 @@ and is between 256 and 4096 characters. It is defined in the file
 
                         See also Documentation/pm.txt, pci=noacpi
 
+        acpi_apic_instance=     [ACPI, IOAPIC]
+                        Format: <int>
+                        2: use 2nd APIC table, if available
+                        1,0: use 1st APIC table
+                        default: 2
+
         acpi_sleep=     [HW,ACPI] Sleep options
                         Format: { s3_bios, s3_mode }
                         See Documentation/power/video.txt
@@ -774,6 +780,9 @@ and is between 256 and 4096 characters. It is defined in the file
         lapic           [IA-32,APIC] Enable the local APIC even if BIOS
                         disabled it.
 
+        lapic_timer_c2_ok       [IA-32,x86-64,APIC] trust the local apic timer in
+                        C2 power state.
+
         lasi=           [HW,SCSI] PARISC LASI driver for the 53c700 chip
                         Format: addr:<io>,irq:<irq>
 
@@ -1117,6 +1126,8 @@ and is between 256 and 4096 characters. It is defined in the file
 
         nolapic         [IA-32,APIC] Do not enable or use the local APIC.
 
+        nolapic_timer   [IA-32,APIC] Do not use the local APIC timer.
+
         noltlbs         [PPC] Do not use large page/tlb entries for kernel
                         lowmem mapping on PPC40x.
 
diff --git a/Documentation/networking/ax25.txt b/Documentation/networking/ax25.txt
index 37c25b0925f0..8257dbf9be57 100644
--- a/Documentation/networking/ax25.txt
+++ b/Documentation/networking/ax25.txt
@@ -1,16 +1,10 @@
 To use the amateur radio protocols within Linux you will need to get a
-suitable copy of the AX.25 Utilities. More detailed information about these
-and associated programs can be found on http://zone.pspt.fi/~jsn/.
-
-For more information about the AX.25, NET/ROM and ROSE protocol stacks, see
-the AX25-HOWTO written by Terry Dawson <terry@perf.no.itg.telstra.com.au>
-who is also the AX.25 Utilities maintainer.
+suitable copy of the AX.25 Utilities. More detailed information about
+AX.25, NET/ROM and ROSE, associated programs and and utilities can be
+found on http://www.linux-ax25.org.
 
 There is an active mailing list for discussing Linux amateur radio matters
-called linux-hams. To subscribe to it, send a message to
+called linux-hams@vger.kernel.org. To subscribe to it, send a message to
 majordomo@vger.kernel.org with the words "subscribe linux-hams" in the body
-of the message, the subject field is ignored.
-
-Jonathan G4KLX
-
-g4klx@g4klx.demon.co.uk
+of the message, the subject field is ignored.  You don't need to be
+subscribed to post but of course that means you might miss an answer.
diff --git a/Documentation/power/pci.txt b/Documentation/power/pci.txt
index c750f9f2e76e..b6a3cbf7e846 100644
--- a/Documentation/power/pci.txt
+++ b/Documentation/power/pci.txt
@@ -102,31 +102,28 @@ pci_save_state
 --------------
 
 Usage:
-        pci_save_state(dev, buffer);
+        pci_save_state(struct pci_dev *dev);
 
 Description:
-        Save first 64 bytes of PCI config space. Buffer must be allocated by
-        caller.
+        Save first 64 bytes of PCI config space, along with any additional
+        PCI-Express or PCI-X information.
 
 
 pci_restore_state
 -----------------
 
 Usage:
-        pci_restore_state(dev, buffer);
+        pci_restore_state(struct pci_dev *dev);
 
 Description:
-        Restore previously saved config space. (First 64 bytes only);
-
-        If buffer is NULL, then restore what information we know about the
-        device from bootup: BARs and interrupt line.
+        Restore previously saved config space.
 
 
 pci_set_power_state
 -------------------
 
 Usage:
-        pci_set_power_state(dev, state);
+        pci_set_power_state(struct pci_dev *dev, pci_power_t state);
 
 Description:
         Transition device to low power state using PCI PM Capabilities
@@ -142,7 +139,7 @@ pci_enable_wake
 ---------------
 
 Usage:
-        pci_enable_wake(dev, state, enable);
+        pci_enable_wake(struct pci_dev *dev, pci_power_t state, int enable);
 
 Description:
         Enable device to generate PME# during low power state using PCI PM 
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index db398a6441c1..73e9a174b642 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -866,6 +866,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           basic         3-jack (default)
           hp            HP nx6320
           thinkpad      Lenovo Thinkpad T60/X60/Z60
+          toshiba       Toshiba U205
 
         AD1986A
           6stack        6-jack, separate surrounds (default)
@@ -906,7 +907,8 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           5stack        D945 5stack + SPDIF
           macmini       Intel Mac Mini
           macbook       Intel Mac Book
-          macbook-pro   Intel Mac Book Pro
+          macbook-pro-v1 Intel Mac Book Pro 1st generation
+          macbook-pro   Intel Mac Book Pro 2nd generation
 
         STAC9202/9250/9251
           ref           Reference board, base config
diff --git a/Documentation/sysrq.txt b/Documentation/sysrq.txt
index 452c0f152304..d43aa9d3c105 100644
--- a/Documentation/sysrq.txt
+++ b/Documentation/sysrq.txt
@@ -93,6 +93,8 @@ On all -  write a character to /proc/sysrq-trigger.  e.g.:
 
 'p'     - Will dump the current registers and flags to your console.
 
+'q'     - Will dump a list of all running timers.
+
 'r'     - Turns off keyboard raw mode and sets it to XLATE.
 
 's'     - Will attempt to sync all mounted filesystems.
diff --git a/MAINTAINERS b/MAINTAINERS
index 17555bba20af..8c8090e02d8e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1585,12 +1585,6 @@ L:	i2c@lm-sensors.org
 T:      quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/
 S:      Maintained
 
-I2O
-P:      Markus Lidel
-M:      markus.lidel@shadowconnect.com
-W:      http://i2o.shadowconnect.com/
-S:      Maintained
-
 i386 BOOT CODE
 P:      Riley H. Williams
 M:      Riley@Williams.Name
@@ -2928,9 +2922,12 @@ L:	linux-scsi@vger.kernel.org
 S:      Maintained
 
 SCTP PROTOCOL
+P:      Vlad Yasevich
+M:      vladislav.yasevich@hp.com
 P:      Sridhar Samudrala
 M:      sri@us.ibm.com
 L:      lksctp-developers@lists.sourceforge.net
+W:      http://lksctp.sourceforge.net
 S:      Supported
 
 SCx200 CPU SUPPORT
@@ -3066,11 +3063,10 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 
 SONY VAIO CONTROL DEVICE DRIVER
-P:      Stelian Pop
-M:      stelian@popies.net
 P:      Mattia Dongili
 M:      malattia@linux.it
-W:      http://popies.net/sonypi/
+L:      linux-acpi@vger.kernel.org
+W:      http://www.linux.it/~malattia/wiki/index.php/Sony_drivers
 S:      Maintained
 
 SOUND
@@ -3103,6 +3099,9 @@ TPM DEVICE DRIVER
 P:      Kylene Hall
 M:      kjhall@us.ibm.com
 W:      http://tpmdd.sourceforge.net
+P:      Marcel Selhorst
+M:      tpm@selhorst.net
+W:      http://www.prosec.rub.de/tpm/
 L:      tpmdd-devel@lists.sourceforge.net
 S:      Maintained
 
diff --git a/Makefile b/Makefile
index 6393738fe968..2f57f57d0100 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 21
-EXTRAVERSION = -rc3
-NAME = Homicidal Dwarf Hamster
+EXTRAVERSION = -rc5
+NAME = Nocturnal Monster Puppy
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/common/Kconfig b/arch/arm/common/Kconfig
index 5e34ca6d38b6..3e073467caca 100644
--- a/arch/arm/common/Kconfig
+++ b/arch/arm/common/Kconfig
@@ -28,6 +28,7 @@ config SHARP_PARAM
 
 config SHARPSL_PM
         bool
+        select APM_EMULATION
 
 config SHARP_SCOOP
         bool
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 03e37af315d7..0453dcc757b4 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -839,8 +839,11 @@ static int __init topology_init(void)
 {
         int cpu;
 
-        for_each_possible_cpu(cpu)
-                register_cpu(&per_cpu(cpu_data, cpu).cpu, cpu);
+        for_each_possible_cpu(cpu) {
+                struct cpuinfo_arm *cpuinfo = &per_cpu(cpu_data, cpu);
+                cpuinfo->cpu.hotpluggable = 1;
+                register_cpu(&cpuinfo->cpu, cpu);
+        }
 
         return 0;
 }
diff --git a/arch/arm/mach-at91/gpio.c b/arch/arm/mach-at91/gpio.c
index 44211a0af19a..ba4a1bb3ee40 100644
--- a/arch/arm/mach-at91/gpio.c
+++ b/arch/arm/mach-at91/gpio.c
@@ -215,13 +215,14 @@ int gpio_direction_input(unsigned pin)
 }
 EXPORT_SYMBOL(gpio_direction_input);
 
-int gpio_direction_output(unsigned pin)
+int gpio_direction_output(unsigned pin, int value)
 {
         void __iomem    *pio = pin_to_controller(pin);
         unsigned        mask = pin_to_mask(pin);
 
         if (!pio || !(__raw_readl(pio + PIO_PSR) & mask))
                 return -EINVAL;
+        __raw_writel(mask, pio + (value ? PIO_SODR : PIO_CODR));
         __raw_writel(mask, pio + PIO_OER);
         return 0;
 }
diff --git a/arch/arm/mach-imx/cpufreq.c b/arch/arm/mach-imx/cpufreq.c
index 4f66e90db74f..7e70e0b0b989 100644
--- a/arch/arm/mach-imx/cpufreq.c
+++ b/arch/arm/mach-imx/cpufreq.c
@@ -50,6 +50,7 @@
 #define CR_920T_ASYNC_MODE      0xC0000000
 
 static u32 mpctl0_at_boot;
+static u32 bclk_div_at_boot;
 
 static void imx_set_async_mode(void)
 {
@@ -82,13 +83,13 @@ static void imx_set_mpctl0(u32 mpctl0)
  * imx_compute_mpctl - compute new PLL parameters
  * @new_mpctl:  pointer to location assigned by new PLL control register value
  * @cur_mpctl:  current PLL control register parameters
+ * @f_ref:      reference source frequency Hz
  * @freq:       required frequency in Hz
  * @relation:   is one of %CPUFREQ_RELATION_L (supremum)
  *              and %CPUFREQ_RELATION_H (infimum)
  */
-long imx_compute_mpctl(u32 *new_mpctl, u32 cur_mpctl, unsigned long freq, int relation)
+long imx_compute_mpctl(u32 *new_mpctl, u32 cur_mpctl, u32 f_ref, unsigned long freq, int relation)
 {
-        u32 f_ref = (CSCR & CSCR_SYSTEM_SEL) ? 16000000 : (CLK32 * 512);
         u32 mfi;
         u32 mfn;
         u32 mfd;
@@ -182,7 +183,7 @@ static int imx_set_target(struct cpufreq_policy *policy,
         unsigned long flags;
         long freq;
         long sysclk;
-        unsigned int bclk_div = 1;
+        unsigned int bclk_div = bclk_div_at_boot;
 
         /*
          * Some governors do not respects CPU and policy lower limits
@@ -202,8 +203,8 @@ static int imx_set_target(struct cpufreq_policy *policy,
 
         sysclk = imx_get_system_clk();
 
-        if (freq > sysclk + 1000000) {
-                freq = imx_compute_mpctl(&mpctl0, mpctl0_at_boot, freq, relation);
+        if (freq > sysclk / bclk_div_at_boot + 1000000) {
+                freq = imx_compute_mpctl(&mpctl0, mpctl0_at_boot, CLK32 * 512, freq, relation);
                 if (freq < 0) {
                         printk(KERN_WARNING "imx: target frequency %ld Hz cannot be set\n", freq);
                         return -EINVAL;
@@ -217,6 +218,8 @@ static int imx_set_target(struct cpufreq_policy *policy,
 
                         if(bclk_div > 16)
                                 bclk_div = 16;
+                        if(bclk_div < bclk_div_at_boot)
+                                bclk_div = bclk_div_at_boot;
                 }
                 freq = (sysclk + bclk_div / 2) / bclk_div;
         }
@@ -285,7 +288,7 @@ static struct cpufreq_driver imx_driver = {
 
 static int __init imx_cpufreq_init(void)
 {
-
+        bclk_div_at_boot = __mfld2val(CSCR_BCLK_DIV, CSCR) + 1;
         mpctl0_at_boot = 0;
 
         if((CSCR & CSCR_MPEN) &&
diff --git a/arch/arm/mach-imx/generic.c b/arch/arm/mach-imx/generic.c
index b5aa49d00ca3..7a7fa51ec62c 100644
--- a/arch/arm/mach-imx/generic.c
+++ b/arch/arm/mach-imx/generic.c
@@ -102,7 +102,7 @@ EXPORT_SYMBOL(imx_gpio_mode);
  *  f = 2 * f_ref * --------------------
  *                        pd + 1
  */
-static unsigned int imx_decode_pll(unsigned int pll)
+static unsigned int imx_decode_pll(unsigned int pll, u32 f_ref)
 {
         unsigned long long ll;
         unsigned long quot;
@@ -111,7 +111,6 @@ static unsigned int imx_decode_pll(unsigned int pll)
         u32 mfn = pll & 0x3ff;
         u32 mfd = (pll >> 16) & 0x3ff;
         u32 pd =  (pll >> 26) & 0xf;
-        u32 f_ref = (CSCR & CSCR_SYSTEM_SEL) ? 16000000 : (CLK32 * 512);
 
         mfi = mfi <= 5 ? 5 : mfi;
 
@@ -124,13 +123,15 @@ static unsigned int imx_decode_pll(unsigned int pll)
 
 unsigned int imx_get_system_clk(void)
 {
-        return imx_decode_pll(SPCTL0);
+        u32 f_ref = (CSCR & CSCR_SYSTEM_SEL) ? 16000000 : (CLK32 * 512);
+
+        return imx_decode_pll(SPCTL0, f_ref);
 }
 EXPORT_SYMBOL(imx_get_system_clk);
 
 unsigned int imx_get_mcu_clk(void)
 {
-        return imx_decode_pll(MPCTL0);
+        return imx_decode_pll(MPCTL0, CLK32 * 512);
 }
 EXPORT_SYMBOL(imx_get_mcu_clk);
 
diff --git a/arch/arm/mach-iop32x/Kconfig b/arch/arm/mach-iop32x/Kconfig
index c072d94070da..9dd49cff21ff 100644
--- a/arch/arm/mach-iop32x/Kconfig
+++ b/arch/arm/mach-iop32x/Kconfig
@@ -4,6 +4,9 @@ menu "IOP32x Implementation Options"
 
 comment "IOP32x Platform Types"
 
+config MACH_EP80219
+        bool
+
 config MACH_GLANTANK
         bool "Enable support for the IO-Data GLAN Tank"
         help
@@ -19,6 +22,7 @@ config ARCH_IQ80321
 
 config ARCH_IQ31244
         bool "Enable support for EP80219/IQ31244"
+        select MACH_EP80219
         help
           Say Y here if you want to run your kernel on the Intel EP80219
           evaluation kit for the Intel 80219 processor (a IOP321 variant)
diff --git a/arch/arm/mach-iop32x/iq31244.c b/arch/arm/mach-iop32x/iq31244.c
index 571ac35bc2c7..60e74309a458 100644
--- a/arch/arm/mach-iop32x/iq31244.c
+++ b/arch/arm/mach-iop32x/iq31244.c
@@ -39,22 +39,35 @@
 #include <asm/arch/time.h>
 
 /*
- * The EP80219 and IQ31244 use the same machine ID.  To find out
- * which of the two we're running on, we look at the processor ID.
+ * Until March of 2007 iq31244 platforms and ep80219 platforms shared the
+ * same machine id, and the processor type was used to select board type.
+ * However this assumption breaks for an iq80219 board which is an iop219
+ * processor on an iq31244 board.  The force_ep80219 flag has been added
+ * for old boot loaders using the iq31244 machine id for an ep80219 platform.
  */
+static int force_ep80219;
+
 static int is_80219(void)
 {
         extern int processor_id;
         return !!((processor_id & 0xffffffe0) == 0x69052e20);
 }
 
+static int is_ep80219(void)
+{
+        if (machine_is_ep80219() || force_ep80219)
+                return 1;
+        else
+                return 0;
+}
+
 
 /*
  * EP80219/IQ31244 timer tick configuration.
  */
 static void __init iq31244_timer_init(void)
 {
-        if (is_80219()) {
+        if (is_ep80219()) {
                 /* 33.333 MHz crystal.  */
                 iop_init_time(200000000);
         } else {
@@ -165,12 +178,18 @@ static struct hw_pci iq31244_pci __initdata = {
 
 static int __init iq31244_pci_init(void)
 {
-        if (machine_is_iq31244()) {
+        if (is_ep80219())
+                pci_common_init(&ep80219_pci);
+        else if (machine_is_iq31244()) {
                 if (is_80219()) {
-                        pci_common_init(&ep80219_pci);
-                } else {
-                        pci_common_init(&iq31244_pci);
+                        printk("note: iq31244 board type has been selected\n");
+                        printk("note: to select ep80219 operation:\n");
+                        printk("\t1/ specify \"force_ep80219\" on the kernel"
+                                " command line\n");
+                        printk("\t2/ update boot loader to pass"
+                                " the ep80219 id: %d\n", MACH_TYPE_EP80219);
                 }
+                pci_common_init(&iq31244_pci);
         }
 
         return 0;
@@ -277,10 +296,18 @@ static void __init iq31244_init_machine(void)
         platform_device_register(&iq31244_flash_device);
         platform_device_register(&iq31244_serial_device);
 
-        if (is_80219())
+        if (is_ep80219())
                 pm_power_off = ep80219_power_off;
 }
 
+static int __init force_ep80219_setup(char *str)
+{
+        force_ep80219 = 1;
+        return 1;
+}
+
+__setup("force_ep80219", force_ep80219_setup);
+
 MACHINE_START(IQ31244, "Intel IQ31244")
         /* Maintainer: Intel Corp. */
         .phys_io        = IQ31244_UART,
@@ -291,3 +318,19 @@ MACHINE_START(IQ31244, "Intel IQ31244")
         .timer          = &iq31244_timer,
         .init_machine   = iq31244_init_machine,
 MACHINE_END
+
+/* There should have been an ep80219 machine identifier from the beginning.
+ * Boot roms older than March 2007 do not know the ep80219 machine id.  Pass
+ * "force_ep80219" on the kernel command line, otherwise iq31244 operation
+ * will be selected.
+ */
+MACHINE_START(EP80219, "Intel EP80219")
+        /* Maintainer: Intel Corp. */
+        .phys_io        = IQ31244_UART,
+        .io_pg_offst    = ((IQ31244_UART) >> 18) & 0xfffc,
+        .boot_params    = 0xa0000100,
+        .map_io         = iq31244_map_io,
+        .init_irq       = iop32x_init_irq,
+        .timer          = &iq31244_timer,
+        .init_machine   = iq31244_init_machine,
+MACHINE_END
diff --git a/arch/arm/mach-ns9xxx/mach-cc9p9360dev.c b/arch/arm/mach-ns9xxx/mach-cc9p9360dev.c
index a193dd931512..760c9d0db7c3 100644
--- a/arch/arm/mach-ns9xxx/mach-cc9p9360dev.c
+++ b/arch/arm/mach-ns9xxx/mach-cc9p9360dev.c
@@ -32,7 +32,7 @@ static void __init mach_cc9p9360dev_init_machine(void)
         board_a9m9750dev_init_machine();
 }
 
-MACHINE_START(CC9P9360DEV, "Connect Core 9P 9360 on an A9M9750 Devboard")
+MACHINE_START(CC9P9360DEV, "Digi ConnectCore 9P 9360 on an A9M9750 Devboard")
         .map_io = mach_cc9p9360dev_map_io,
         .init_irq = mach_cc9p9360dev_init_irq,
         .init_machine = mach_cc9p9360dev_init_machine,
diff --git a/arch/arm/mach-omap1/board-h2.c b/arch/arm/mach-omap1/board-h2.c
index 6e113078f7ab..ad519390dd58 100644
--- a/arch/arm/mach-omap1/board-h2.c
+++ b/arch/arm/mach-omap1/board-h2.c
@@ -27,6 +27,7 @@
 #include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
 #include <linux/input.h>
+#include <linux/workqueue.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
diff --git a/arch/arm/mach-omap2/clock.c b/arch/arm/mach-omap2/clock.c
index 0de201c3d50b..5170481afeab 100644
--- a/arch/arm/mach-omap2/clock.c
+++ b/arch/arm/mach-omap2/clock.c
@@ -27,6 +27,7 @@
 
 #include <asm/arch/clock.h>
 #include <asm/arch/sram.h>
+#include <asm/div64.h>
 
 #include "prcm-regs.h"
 #include "memory.h"
diff --git a/arch/arm/mach-omap2/clock.h b/arch/arm/mach-omap2/clock.h
index 8816f5a33a28..162978fd5359 100644
--- a/arch/arm/mach-omap2/clock.h
+++ b/arch/arm/mach-omap2/clock.h
@@ -1013,7 +1013,8 @@ static struct clk dss2_fck = {		/* Alt clk used in power management */
         .name           = "dss2_fck",
         .parent         = &sys_ck,              /* fixed at sys_ck or 48MHz */
         .flags          = CLOCK_IN_OMAP242X | CLOCK_IN_OMAP243X |
-                                RATE_CKCTL | CM_CORE_SEL1 | RATE_FIXED,
+                                RATE_CKCTL | CM_CORE_SEL1 | RATE_FIXED |
+                                DELAYED_APP,
         .enable_reg     = (void __iomem *)&CM_FCLKEN1_CORE,
         .enable_bit     = 1,
         .src_offset     = 13,
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index 7915a5a22865..72738771fb57 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -28,6 +28,7 @@
 #include <asm/hardware.h>
 #include <asm/irq.h>
 #include <asm/system.h>
+#include <asm/arch/pxa-regs.h>
 #include <asm/arch/irda.h>
 #include <asm/arch/mmc.h>
 #include <asm/arch/udc.h>
@@ -35,8 +36,6 @@
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 #include <asm/mach/irq.h>
-
-#include <asm/arch/pxa-regs.h>
 #include <asm/arch/tosa.h>
 
 #include <asm/hardware/scoop.h>
diff --git a/arch/arm/mach-s3c2410/mach-h1940.c b/arch/arm/mach-s3c2410/mach-h1940.c
index 01c60d0923cd..d052ab2d9377 100644
--- a/arch/arm/mach-s3c2410/mach-h1940.c
+++ b/arch/arm/mach-s3c2410/mach-h1940.c
@@ -202,7 +202,9 @@ static void __init h1940_map_io(void)
 
         /* setup PM */
 
+#ifdef CONFIG_PM_H1940
         memcpy(phys_to_virt(H1940_SUSPEND_RESUMEAT), h1940_pm_return, 1024);
+#endif
         s3c2410_pm_init();
 }
 
diff --git a/arch/arm/mach-s3c2440/mach-rx3715.c b/arch/arm/mach-s3c2440/mach-rx3715.c
index 480ccde63fb4..ae1d0a81fd6a 100644
--- a/arch/arm/mach-s3c2440/mach-rx3715.c
+++ b/arch/arm/mach-s3c2440/mach-rx3715.c
@@ -224,7 +224,9 @@ static void __init rx3715_init_irq(void)
 
 static void __init rx3715_init_machine(void)
 {
+#ifdef CONFIG_PM_H1940
         memcpy(phys_to_virt(H1940_SUSPEND_RESUMEAT), h1940_pm_return, 1024);
+#endif
         s3c2410_pm_init();
 
         s3c24xx_fb_set_platdata(&rx3715_lcdcfg);
diff --git a/arch/arm/mach-s3c2443/irq.c b/arch/arm/mach-s3c2443/irq.c
index 7a45b6dcb73e..756573595b88 100644
--- a/arch/arm/mach-s3c2443/irq.c
+++ b/arch/arm/mach-s3c2443/irq.c
@@ -137,7 +137,7 @@ static struct irq_chip s3c2443_irq_lcd = {
 
 static void s3c2443_irq_demux_dma(unsigned int irq, struct irq_desc *desc)
 {
-        s3c2443_irq_demux(IRQ_S3C2443_DMA1, 6);
+        s3c2443_irq_demux(IRQ_S3C2443_DMA0, 6);
 }
 
 #define INTMSK_DMA      (1UL << (IRQ_S3C2443_DMA - IRQ_EINT0))
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 192a5a26cf2b..9e13c8358ea7 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -27,6 +27,7 @@
 #include <asm/mach/map.h>
 #include <asm/mach/flash.h>
 #include <asm/irq.h>
+#include <asm/gpio.h>
 
 #include "generic.h"
 
@@ -153,7 +154,7 @@ int gpio_direction_input(unsigned gpio)
 
 EXPORT_SYMBOL(gpio_direction_input);
 
-int gpio_direction_output(unsigned gpio)
+int gpio_direction_output(unsigned gpio, int value)
 {
         unsigned long flags;
 
@@ -161,6 +162,7 @@ int gpio_direction_output(unsigned gpio)
                 return -EINVAL;
 
         local_irq_save(flags);
+        gpio_set_value(gpio, value);
         GPDR |= GPIO_GPIO(gpio);
         local_irq_restore(flags);
         return 0;
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index 9ba5654cde11..1eb99b814f5b 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -214,7 +214,7 @@ int gpio_direction_input(unsigned int gpio)
 }
 EXPORT_SYMBOL(gpio_direction_input);
 
-int gpio_direction_output(unsigned int gpio)
+int gpio_direction_output(unsigned int gpio, int value)
 {
         struct pio_device *pio;
         unsigned int pin;
@@ -223,6 +223,8 @@ int gpio_direction_output(unsigned int gpio)
         if (!pio)
                 return -ENODEV;
 
+        gpio_set_value(gpio, value);
+
         pin = gpio & 0x1f;
         pio_writel(pio, OER, 1 << pin);
 
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index 27e8453274e6..53d62373a524 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -220,7 +220,7 @@ config PARAVIRT
 
 config VMI
         bool "VMI Paravirt-ops support"
-        depends on PARAVIRT
+        depends on PARAVIRT && !COMPAT_VDSO
         help
           VMI provides a paravirtualized interface to the VMware ESX server
           (it could be used by other hypervisors in theory too, but is not
diff --git a/arch/i386/defconfig b/arch/i386/defconfig
index 5ae1e0bc8fd7..f4efd66e1ee5 100644
--- a/arch/i386/defconfig
+++ b/arch/i386/defconfig
@@ -1,10 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.20-git8
-# Tue Feb 13 11:25:18 2007
+# Linux kernel version: 2.6.21-rc3
+# Wed Mar  7 15:29:47 2007
 #
 CONFIG_X86_32=y
 CONFIG_GENERIC_TIME=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_SEMAPHORE_SLEEPERS=y
@@ -34,6 +37,7 @@ CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
@@ -44,6 +48,7 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -103,6 +108,9 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 # Processor type and features
 #
+# CONFIG_TICK_ONESHOT is not set
+# CONFIG_NO_HZ is not set
+# CONFIG_HIGH_RES_TIMERS is not set
 CONFIG_SMP=y
 # CONFIG_X86_PC is not set
 # CONFIG_X86_ELAN is not set
@@ -235,10 +243,8 @@ CONFIG_ACPI_PROCFS=y
 CONFIG_ACPI_AC=y
 CONFIG_ACPI_BATTERY=y
 CONFIG_ACPI_BUTTON=y
-# CONFIG_ACPI_HOTKEY is not set
 CONFIG_ACPI_FAN=y
 # CONFIG_ACPI_DOCK is not set
-# CONFIG_ACPI_BAY is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_THERMAL=y
 # CONFIG_ACPI_ASUS is not set
@@ -289,6 +295,7 @@ CONFIG_X86_POWERNOW_K8_ACPI=y
 # CONFIG_X86_CPUFREQ_NFORCE2 is not set
 # CONFIG_X86_LONGRUN is not set
 # CONFIG_X86_LONGHAUL is not set
+# CONFIG_X86_E_POWERSAVER is not set
 
 #
 # shared options
@@ -368,7 +375,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
-# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
 # CONFIG_INET_XFRM_MODE_BEET is not set
@@ -470,7 +477,13 @@ CONFIG_FW_LOADER=y
 #
 # Plug and Play support
 #
-# CONFIG_PNP is not set
+CONFIG_PNP=y
+# CONFIG_PNP_DEBUG is not set
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
 
 #
 # Block devices
@@ -490,7 +503,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
-CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -500,6 +512,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_IBM_ASM is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
+# CONFIG_SONY_LAPTOP is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
@@ -526,6 +539,7 @@ CONFIG_BLK_DEV_IDEACPI=y
 #
 CONFIG_IDE_GENERIC=y
 # CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
 CONFIG_BLK_DEV_IDEPCI=y
 # CONFIG_IDEPCI_SHARE_IRQ is not set
 # CONFIG_BLK_DEV_OFFBOARD is not set
@@ -679,6 +693,7 @@ CONFIG_SATA_VIA=y
 # CONFIG_SATA_VITESSE is not set
 # CONFIG_SATA_INIC162X is not set
 CONFIG_SATA_INTEL_COMBINED=y
+CONFIG_SATA_ACPI=y
 # CONFIG_PATA_ALI is not set
 # CONFIG_PATA_AMD is not set
 # CONFIG_PATA_ARTOP is not set
@@ -786,6 +801,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
+# CONFIG_NET_SB1000 is not set
 
 #
 # ARCnet devices
@@ -979,6 +995,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -1065,6 +1082,11 @@ CONFIG_HANGCHECK_TIMER=y
 # CONFIG_HWMON_VID is not set
 
 #
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1078,7 +1100,7 @@ CONFIG_HANGCHECK_TIMER=y
 #
 # Graphics support
 #
-CONFIG_FIRMWARE_EDID=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 # CONFIG_FB is not set
 
 #
@@ -1089,7 +1111,6 @@ CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=128
 CONFIG_VIDEO_SELECT=y
 CONFIG_DUMMY_CONSOLE=y
-# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -1238,6 +1259,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
+# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -1248,6 +1270,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1506,6 +1529,7 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
@@ -1525,6 +1549,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
+# CONFIG_FAULT_INJECTION is not set
 CONFIG_EARLY_PRINTK=y
 CONFIG_DEBUG_STACKOVERFLOW=y
 # CONFIG_DEBUG_STACK_USAGE is not set
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index 2383bcf18c5d..e88415282a6f 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -28,6 +28,7 @@
 #include <linux/clockchips.h>
 #include <linux/acpi_pmtmr.h>
 #include <linux/module.h>
+#include <linux/dmi.h>
 
 #include <asm/atomic.h>
 #include <asm/smp.h>
@@ -61,6 +62,11 @@ static int enable_local_apic __initdata = 0;
 
 /* Local APIC timer verification ok */
 static int local_apic_timer_verify_ok;
+/* Disable local APIC timer from the kernel commandline or via dmi quirk */
+static int local_apic_timer_disabled;
+/* Local APIC timer works in C2 */
+int local_apic_timer_c2_ok;
+EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
 
 /*
  * Debug level, exported for io_apic.c
@@ -266,6 +272,32 @@ static void __devinit setup_APIC_timer(void)
 }
 
 /*
+ * Detect systems with known broken BIOS implementations
+ */
+static int __init lapic_check_broken_bios(struct dmi_system_id *d)
+{
+        printk(KERN_NOTICE "%s detected: disabling lapic timer.\n",
+                       d->ident);
+        local_apic_timer_disabled = 1;
+        return 0;
+}
+
+static struct dmi_system_id __initdata broken_bios_dmi_table[] = {
+        {
+                /*
+                 * BIOS exports only C1 state, but uses deeper power
+                 * modes behind the kernels back.
+                 */
+                  .callback = lapic_check_broken_bios,
+                  .ident = "HP nx6325",
+                  .matches = {
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nx6325"),
+                  },
+         },
+         {}
+};
+
+/*
  * In this functions we calibrate APIC bus clocks to the external timer.
  *
  * We want to do the calibration only once since we want to have local timer
@@ -338,6 +370,23 @@ void __init setup_boot_APIC_clock(void)
         void (*real_handler)(struct clock_event_device *dev);
         unsigned long deltaj;
         long delta, deltapm;
+        int pm_referenced = 0;
+
+        /* Detect know broken systems */
+        dmi_check_system(broken_bios_dmi_table);
+
+        /*
+         * The local apic timer can be disabled via the kernel
+         * commandline or from the dmi quirk above. Register the lapic
+         * timer as a dummy clock event source on SMP systems, so the
+         * broadcast mechanism is used. On UP systems simply ignore it.
+         */
+        if (local_apic_timer_disabled) {
+                /* No broadcast on UP ! */
+                if (num_possible_cpus() > 1)
+                        setup_APIC_timer();
+                return;
+        }
 
         apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n"
                     "calibrating APIC timer ...\n");
@@ -357,7 +406,8 @@ void __init setup_boot_APIC_clock(void)
         /* Let the interrupts run */
         local_irq_enable();
 
-        while(lapic_cal_loops <= LAPIC_CAL_LOOPS);
+        while (lapic_cal_loops <= LAPIC_CAL_LOOPS)
+                cpu_relax();
 
         local_irq_disable();
 
@@ -394,6 +444,7 @@ void __init setup_boot_APIC_clock(void)
                                "%lu (%ld)\n", (unsigned long) res, delta);
                         delta = (long) res;
                 }
+                pm_referenced = 1;
         }
 
         /* Calculate the scaled math multiplication factor */
@@ -423,69 +474,43 @@ void __init setup_boot_APIC_clock(void)
                     calibration_result / (1000000 / HZ),
                     calibration_result % (1000000 / HZ));
 
-
-        apic_printk(APIC_VERBOSE, "... verify APIC timer\n");
-
-        /*
-         * Setup the apic timer manually
-         */
         local_apic_timer_verify_ok = 1;
-        levt->event_handler = lapic_cal_handler;
-        lapic_timer_setup(CLOCK_EVT_MODE_PERIODIC, levt);
-        lapic_cal_loops = -1;
 
-        /* Let the interrupts run */
-        local_irq_enable();
+        /* We trust the pm timer based calibration */
+        if (!pm_referenced) {
+                apic_printk(APIC_VERBOSE, "... verify APIC timer\n");
 
-        while(lapic_cal_loops <= LAPIC_CAL_LOOPS);
+                /*
+                 * Setup the apic timer manually
+                 */
+                levt->event_handler = lapic_cal_handler;
+                lapic_timer_setup(CLOCK_EVT_MODE_PERIODIC, levt);
+                lapic_cal_loops = -1;
 
-        local_irq_disable();
+                /* Let the interrupts run */
+                local_irq_enable();
 
-        /* Stop the lapic timer */
-        lapic_timer_setup(CLOCK_EVT_MODE_SHUTDOWN, levt);
+                while(lapic_cal_loops <= LAPIC_CAL_LOOPS)
+                        cpu_relax();
 
-        local_irq_enable();
+                local_irq_disable();
 
-        /* Jiffies delta */
-        deltaj = lapic_cal_j2 - lapic_cal_j1;
-        apic_printk(APIC_VERBOSE, "... jiffies delta = %lu\n", deltaj);
+                /* Stop the lapic timer */
+                lapic_timer_setup(CLOCK_EVT_MODE_SHUTDOWN, levt);
 
-        /* Check, if the PM timer is available */
-        deltapm = lapic_cal_pm2 - lapic_cal_pm1;
-        apic_printk(APIC_VERBOSE, "... PM timer delta = %ld\n", deltapm);
+                local_irq_enable();
 
-        local_apic_timer_verify_ok = 0;
+                /* Jiffies delta */
+                deltaj = lapic_cal_j2 - lapic_cal_j1;
+                apic_printk(APIC_VERBOSE, "... jiffies delta = %lu\n", deltaj);
 
-        if (deltapm) {
-                if (deltapm > (pm_100ms - pm_thresh) &&
-                    deltapm < (pm_100ms + pm_thresh)) {
-                        apic_printk(APIC_VERBOSE, "... PM timer result ok\n");
-                        /* Check, if the jiffies result is consistent */
-                        if (deltaj < LAPIC_CAL_LOOPS-2 ||
-                            deltaj > LAPIC_CAL_LOOPS+2) {
-                                /*
-                                 * Not sure, what we can do about this one.
-                                 * When high resultion timers are active
-                                 * and the lapic timer does not stop in C3
-                                 * we are fine. Otherwise more trouble might
-                                 * be waiting. -- tglx
-                                 */
-                                printk(KERN_WARNING "Global event device %s "
-                                       "has wrong frequency "
-                                       "(%lu ticks instead of %d)\n",
-                                       global_clock_event->name, deltaj,
-                                       LAPIC_CAL_LOOPS);
-                        }
-                        local_apic_timer_verify_ok = 1;
-                }
-        } else {
                 /* Check, if the jiffies result is consistent */
-                if (deltaj >= LAPIC_CAL_LOOPS-2 &&
-                    deltaj <= LAPIC_CAL_LOOPS+2) {
+                if (deltaj >= LAPIC_CAL_LOOPS-2 && deltaj <= LAPIC_CAL_LOOPS+2)
                         apic_printk(APIC_VERBOSE, "... jiffies result ok\n");
-                        local_apic_timer_verify_ok = 1;
-                }
-        }
+                else
+                        local_apic_timer_verify_ok = 0;
+        } else
+                local_irq_enable();
 
         if (!local_apic_timer_verify_ok) {
                 printk(KERN_WARNING
@@ -1203,6 +1228,20 @@ static int __init parse_nolapic(char *arg)
 }
 early_param("nolapic", parse_nolapic);
 
+static int __init parse_disable_lapic_timer(char *arg)
+{
+        local_apic_timer_disabled = 1;
+        return 0;
+}
+early_param("nolapic_timer", parse_disable_lapic_timer);
+
+static int __init parse_lapic_timer_c2_ok(char *arg)
+{
+        local_apic_timer_c2_ok = 1;
+        return 0;
+}
+early_param("lapic_timer_c2_ok", parse_lapic_timer_c2_ok);
+
 static int __init apic_set_verbosity(char *str)
 {
         if (strcmp("debug", str) == 0)
diff --git a/arch/i386/kernel/hpet.c b/arch/i386/kernel/hpet.c
index f3ab61ee7498..76afea67f691 100644
--- a/arch/i386/kernel/hpet.c
+++ b/arch/i386/kernel/hpet.c
@@ -197,7 +197,7 @@ static int hpet_next_event(unsigned long delta,
         cnt += delta;
         hpet_writel(cnt, HPET_T0_CMP);
 
-        return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0);
+        return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0) ? -ETIME : 0;
 }
 
 /*
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index e3d4b73bfdb0..4afe26e86260 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -28,3 +28,5 @@ EXPORT_SYMBOL(__read_lock_failed);
 #endif
 
 EXPORT_SYMBOL(csum_partial);
+
+EXPORT_SYMBOL(_proxy_pda);
diff --git a/arch/i386/kernel/i8253.c b/arch/i386/kernel/i8253.c
index 5cbb776b3089..10cef5ca8a5b 100644
--- a/arch/i386/kernel/i8253.c
+++ b/arch/i386/kernel/i8253.c
@@ -47,9 +47,17 @@ static void init_pit_timer(enum clock_event_mode mode,
                 outb(LATCH >> 8 , PIT_CH0);     /* MSB */
                 break;
 
-        case CLOCK_EVT_MODE_ONESHOT:
+        /*
+         * Avoid unnecessary state transitions, as it confuses
+         * Geode / Cyrix based boxen.
+         */
         case CLOCK_EVT_MODE_SHUTDOWN:
+                if (evt->mode == CLOCK_EVT_MODE_UNUSED)
+                        break;
         case CLOCK_EVT_MODE_UNUSED:
+                if (evt->mode == CLOCK_EVT_MODE_SHUTDOWN)
+                        break;
+        case CLOCK_EVT_MODE_ONESHOT:
                 /* One shot setup */
                 outb_p(0x38, PIT_MODE);
                 udelay(10);
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 821df34d2b3a..14702427b104 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -245,14 +245,6 @@ static int __init check_nmi_watchdog(void)
         unsigned int *prev_nmi_count;
         int cpu;
 
-        /* Enable NMI watchdog for newer systems.
-           Probably safe on most older systems too, but let's be careful.
-           IBM ThinkPads use INT10 inside SMM and that allows early NMI inside SMM
-           which hangs the system. Disable watchdog for all thinkpads */
-        if (nmi_watchdog == NMI_DEFAULT && dmi_get_year(DMI_BIOS_DATE) >= 2004 &&
-                !dmi_name_in_vendors("ThinkPad"))
-                nmi_watchdog = NMI_LOCAL_APIC;
-
         if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DEFAULT))
                 return 0;
 
diff --git a/arch/i386/kernel/tsc.c b/arch/i386/kernel/tsc.c
index 602660df455c..6cb8f5336732 100644
--- a/arch/i386/kernel/tsc.c
+++ b/arch/i386/kernel/tsc.c
@@ -18,6 +18,8 @@
 
 #include "mach_timer.h"
 
+static int tsc_enabled;
+
 /*
  * On some systems the TSC frequency does not
  * change with the cpu frequency. So we need
@@ -105,7 +107,7 @@ unsigned long long sched_clock(void)
         /*
          * Fall back to jiffies if there's no TSC available:
          */
-        if (unlikely(tsc_disable))
+        if (unlikely(!tsc_enabled))
                 /* No locking but a rare wrong value is not a big deal: */
                 return (jiffies_64 - INITIAL_JIFFIES) * (1000000000 / HZ);
 
@@ -283,6 +285,7 @@ void mark_tsc_unstable(void)
 {
         if (!tsc_unstable) {
                 tsc_unstable = 1;
+                tsc_enabled = 0;
                 /* Can be called before registration */
                 if (clocksource_tsc.mult)
                         clocksource_change_rating(&clocksource_tsc, 0);
@@ -383,7 +386,9 @@ void __init tsc_init(void)
         if (check_tsc_unstable()) {
                 clocksource_tsc.rating = 0;
                 clocksource_tsc.flags &= ~CLOCK_SOURCE_IS_CONTINUOUS;
-        }
+        } else
+                tsc_enabled = 1;
+
         clocksource_register(&clocksource_tsc);
 
         return;
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index fbf45fa08320..fb07a1aad225 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -23,7 +23,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/license.h>
 #include <linux/cpu.h>
 #include <linux/bootmem.h>
 #include <linux/mm.h>
@@ -48,7 +47,6 @@ typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
    (((VROMLONGFUNC *)(rom->func)) (arg))
 
 static struct vrom_header *vmi_rom;
-static int license_gplok;
 static int disable_pge;
 static int disable_pse;
 static int disable_sep;
@@ -629,13 +627,14 @@ static inline int __init check_vmi_rom(struct vrom_header *rom)
                 rom->api_version_maj, rom->api_version_min,
                 pci->rom_version_maj, pci->rom_version_min);
 
-        license_gplok = license_is_gpl_compatible(license);
-        if (!license_gplok) {
-                printk(KERN_WARNING "VMI: ROM license '%s' taints kernel... "
-                       "inlining disabled\n",
-                       license);
-                add_taint(TAINT_PROPRIETARY_MODULE);
-        }
+        /* Don't allow BSD/MIT here for now because we don't want to end up
+           with any binary only shim layers */
+        if (strcmp(license, "GPL") && strcmp(license, "GPL v2")) {
+                printk(KERN_WARNING "VMI: Non GPL license `%s' found for ROM. Not used.\n",
+                        license);
+                return 0;
+        }
+
         return 1;
 }
 
diff --git a/arch/i386/pci/common.c b/arch/i386/pci/common.c
index 1bb069372143..948436665385 100644
--- a/arch/i386/pci/common.c
+++ b/arch/i386/pci/common.c
@@ -193,6 +193,14 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
         },
         {
                 .callback = set_bf_sort,
+                .ident = "Dell PowerEdge R900",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R900"),
+                },
+        },
+        {
+                .callback = set_bf_sort,
                 .ident = "HP ProLiant BL20p G3",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "HP"),
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index d51f0f11f7f9..e19185d26554 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -13,6 +13,7 @@ config IA64
         bool
         select PCI if (!IA64_HP_SIM)
         select ACPI if (!IA64_HP_SIM)
+        select PM if (!IA64_HP_SIM)
         default y
         help
           The Itanium Processor Family is Intel's 64-bit successor to
diff --git a/arch/ia64/kernel/crash.c b/arch/ia64/kernel/crash.c
index 7d1bbb4403ba..80a94e707827 100644
--- a/arch/ia64/kernel/crash.c
+++ b/arch/ia64/kernel/crash.c
@@ -164,7 +164,7 @@ kdump_init_notifier(struct notifier_block *self, unsigned long val, void *data)
 
         nd = (struct ia64_mca_notify_die *)args->err;
         /* Reason code 1 means machine check rendezous*/
-        if ((val == DIE_INIT_MONARCH_ENTER || DIE_INIT_SLAVE_ENTER) &&
+        if ((val == DIE_INIT_MONARCH_ENTER || val == DIE_INIT_SLAVE_ENTER) &&
                  nd->sos->rv_rc == 1)
                 return NOTIFY_DONE;
 
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index 339e8a54c2f1..69b9bb3fd7c5 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -692,12 +692,15 @@ struct seq_operations cpuinfo_op = {
         .show =         show_cpuinfo
 };
 
-static char brandname[128];
+#define MAX_BRANDS      8
+static char brandname[MAX_BRANDS][128];
 
 static char * __cpuinit
 get_model_name(__u8 family, __u8 model)
 {
+        static int overflow;
         char brand[128];
+        int i;
 
         memcpy(brand, "Unknown", 8);
         if (ia64_pal_get_brand_info(brand)) {
@@ -709,12 +712,17 @@ get_model_name(__u8 family, __u8 model)
                         case 2: memcpy(brand, "Madison up to 9M cache", 23); break;
                 }
         }
-        if (brandname[0] == '\0')
-                return strcpy(brandname, brand);
-        else if (strcmp(brandname, brand) == 0)
-                return brandname;
-        else
-                return kstrdup(brand, GFP_KERNEL);
+        for (i = 0; i < MAX_BRANDS; i++)
+                if (strcmp(brandname[i], brand) == 0)
+                        return brandname[i];
+        for (i = 0; i < MAX_BRANDS; i++)
+                if (brandname[i][0] == '\0')
+                        return strcpy(brandname[i], brand);
+        if (overflow++ == 0)
+                printk(KERN_ERR
+                       "%s: Table overflow. Some processor model information will be missing\n",
+                       __FUNCTION__);
+        return "Unknown";
 }
 
 static void __cpuinit
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index fb0f4698f5d0..44ce5ed9444c 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -97,26 +97,6 @@ void show_mem(void)
 unsigned long bootmap_start;
 
 /**
- * find_max_pfn - adjust the maximum page number callback
- * @start: start of range
- * @end: end of range
- * @arg: address of pointer to global max_pfn variable
- *
- * Passed as a callback function to efi_memmap_walk() to determine the highest
- * available page frame number in the system.
- */
-int
-find_max_pfn (unsigned long start, unsigned long end, void *arg)
-{
-        unsigned long *max_pfnp = arg, pfn;
-
-        pfn = (PAGE_ALIGN(end - 1) - PAGE_OFFSET) >> PAGE_SHIFT;
-        if (pfn > *max_pfnp)
-                *max_pfnp = pfn;
-        return 0;
-}
-
-/**
  * find_bootmap_location - callback to find a memory area for the bootmap
  * @start: start of region
  * @end: end of region
@@ -177,9 +157,10 @@ find_memory (void)
         reserve_memory();
 
         /* first find highest page frame number */
-        max_pfn = 0;
-        efi_memmap_walk(find_max_pfn, &max_pfn);
-
+        min_low_pfn = ~0UL;
+        max_low_pfn = 0;
+        efi_memmap_walk(find_max_min_low_pfn, NULL);
+        max_pfn = max_low_pfn;
         /* how many bytes to cover all the pages */
         bootmap_size = bootmem_bootmap_pages(max_pfn) << PAGE_SHIFT;
 
@@ -189,7 +170,8 @@ find_memory (void)
         if (bootmap_start == ~0UL)
                 panic("Cannot find %ld bytes for bootmap\n", bootmap_size);
 
-        bootmap_size = init_bootmem(bootmap_start >> PAGE_SHIFT, max_pfn);
+        bootmap_size = init_bootmem_node(NODE_DATA(0),
+                        (bootmap_start >> PAGE_SHIFT), 0, max_pfn);
 
         /* Free all available memory, then mark bootmem-map as being in use. */
         efi_memmap_walk(filter_rsvd_memory, free_bootmem);
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index 11a2d8825d89..872da7a2accd 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -88,9 +88,6 @@ static int __init build_node_maps(unsigned long start, unsigned long len,
                 bdp->node_low_pfn = max(epfn, bdp->node_low_pfn);
         }
 
-        min_low_pfn = min(min_low_pfn, bdp->node_boot_start>>PAGE_SHIFT);
-        max_low_pfn = max(max_low_pfn, bdp->node_low_pfn);
-
         return 0;
 }
 
@@ -438,6 +435,7 @@ void __init find_memory(void)
         /* These actually end up getting called by call_pernode_memory() */
         efi_memmap_walk(filter_rsvd_memory, build_node_maps);
         efi_memmap_walk(filter_rsvd_memory, find_pernode_space);
+        efi_memmap_walk(find_max_min_low_pfn, NULL);
 
         for_each_online_node(node)
                 if (mem_data[node].bootmem_data.node_low_pfn) {
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index f225dd72968b..c8da621aab17 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -648,6 +648,22 @@ count_reserved_pages (u64 start, u64 end, void *arg)
         return 0;
 }
 
+int
+find_max_min_low_pfn (unsigned long start, unsigned long end, void *arg)
+{
+        unsigned long pfn_start, pfn_end;
+#ifdef CONFIG_FLATMEM
+        pfn_start = (PAGE_ALIGN(__pa(start))) >> PAGE_SHIFT;
+        pfn_end = (PAGE_ALIGN(__pa(end - 1))) >> PAGE_SHIFT;
+#else
+        pfn_start = GRANULEROUNDDOWN(__pa(start)) >> PAGE_SHIFT;
+        pfn_end = GRANULEROUNDUP(__pa(end - 1)) >> PAGE_SHIFT;
+#endif
+        min_low_pfn = min(min_low_pfn, pfn_start);
+        max_low_pfn = max(max_low_pfn, pfn_end);
+        return 0;
+}
+
 /*
  * Boot command-line option "nolwsys" can be used to disable the use of any light-weight
  * system call handler.  When this option is in effect, all fsyscalls will end up bubbling
diff --git a/arch/ia64/sn/kernel/io_init.c b/arch/ia64/sn/kernel/io_init.c
index 600be3ebae05..6b10e5d28488 100644
--- a/arch/ia64/sn/kernel/io_init.c
+++ b/arch/ia64/sn/kernel/io_init.c
@@ -247,10 +247,18 @@ sn_io_slot_fixup(struct pci_dev *dev)
                 addr = ((addr << 4) >> 4) | __IA64_UNCACHED_OFFSET;
                 dev->resource[idx].start = addr;
                 dev->resource[idx].end = addr + size;
+
+                /*
+                 * if it's already in the device structure, remove it before
+                 * inserting
+                 */
+                if (dev->resource[idx].parent && dev->resource[idx].parent->child)
+                        release_resource(&dev->resource[idx]);
+
                 if (dev->resource[idx].flags & IORESOURCE_IO)
-                        dev->resource[idx].parent = &ioport_resource;
+                        insert_resource(&ioport_resource, &dev->resource[idx]);
                 else
-                        dev->resource[idx].parent = &iomem_resource;
+                        insert_resource(&iomem_resource, &dev->resource[idx]);
                 /* If ROM, mark as shadowed in PROM */
                 if (idx == PCI_ROM_RESOURCE)
                         dev->resource[idx].flags |= IORESOURCE_ROM_BIOS_COPY;
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index bd5373d593e1..a9bed5ca2ed8 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -348,8 +348,7 @@ sn_scan_pcdp(void)
                         continue;       /* not PCI interconnect */
 
                 if (if_pci.translation & PCDP_PCI_TRANS_IOPORT)
-                        vga_console_iobase =
-                                if_pci.ioport_tra | __IA64_UNCACHED_OFFSET;
+                        vga_console_iobase = if_pci.ioport_tra;
 
                 if (if_pci.translation & PCDP_PCI_TRANS_MMIO)
                         vga_console_membase =
@@ -429,7 +428,8 @@ void __init sn_setup(char **cmdline_p)
          *      bus containing the VGA console.
          */
         if (vga_console_iobase) {
-                io_space[0].mmio_base = vga_console_iobase;
+                io_space[0].mmio_base =
+                        (unsigned long) ioremap(vga_console_iobase, 0);
                 io_space[0].sparse = 0;
         }
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index a1cd84f9b3bc..656f0ca52782 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -250,7 +250,7 @@ config LASAT
         select R5000_CPU_SCACHE
         select SYS_HAS_CPU_R5000
         select SYS_SUPPORTS_32BIT_KERNEL
-        select SYS_SUPPORTS_64BIT_KERNEL if EXPERIMENTAL
+        select SYS_SUPPORTS_64BIT_KERNEL if BROKEN
         select SYS_SUPPORTS_LITTLE_ENDIAN
         select GENERIC_HARDIRQS_NO__DO_IRQ
 
@@ -470,11 +470,6 @@ config MIPS_XXS1500
         select SOC_AU1500
         select SYS_SUPPORTS_LITTLE_ENDIAN
 
-config PNX8550_V2PCI
-        bool "Philips PNX8550 based Viper2-PCI board"
-        select PNX8550
-        select SYS_SUPPORTS_LITTLE_ENDIAN
-
 config PNX8550_JBS
         bool "Philips PNX8550 based JBS board"
         select PNX8550
@@ -547,6 +542,8 @@ config QEMU
         select SYS_SUPPORTS_LITTLE_ENDIAN
         select ARCH_SPARSEMEM_ENABLE
         select GENERIC_HARDIRQS_NO__DO_IRQ
+        select NR_CPUS_DEFAULT_1
+        select SYS_SUPPORTS_SMP
         help
           Qemu is a software emulator which among other architectures also
           can simulate a MIPS32 4Kc system.  This patch adds support for the
@@ -1564,6 +1561,7 @@ config MIPS_MT_SMP
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_SRS
         select MIPS_MT
+        select NR_CPUS_DEFAULT_2
         select SMP
         select SYS_SUPPORTS_SMP
         help
@@ -1578,7 +1576,6 @@ config MIPS_MT_SMTC
         select CPU_MIPSR2_IRQ_VI
         select CPU_MIPSR2_SRS
         select MIPS_MT
-        select NR_CPUS_DEFAULT_2
         select NR_CPUS_DEFAULT_8
         select SMP
         select SYS_SUPPORTS_SMP
@@ -1810,6 +1807,9 @@ config SMP
 config SYS_SUPPORTS_SMP
         bool
 
+config NR_CPUS_DEFAULT_1
+        bool
+
 config NR_CPUS_DEFAULT_2
         bool
 
@@ -1830,8 +1830,9 @@ config NR_CPUS_DEFAULT_64
 
 config NR_CPUS
         int "Maximum number of CPUs (2-64)"
-        range 2 64
+        range 1 64 if NR_CPUS_DEFAULT_1
         depends on SMP
+        default "1" if NR_CPUS_DEFAULT_1
         default "2" if NR_CPUS_DEFAULT_2
         default "4" if NR_CPUS_DEFAULT_4
         default "8" if NR_CPUS_DEFAULT_8
@@ -1842,10 +1843,13 @@ config NR_CPUS
           This allows you to specify the maximum number of CPUs which this
           kernel will support.  The maximum supported value is 32 for 32-bit
           kernel and 64 for 64-bit kernels; the minimum value which makes
-          sense is 2.
+          sense is 1 for Qemu (useful only for kernel debugging purposes)
+          and 2 for all others.
 
           This is purely to save memory - each supported CPU adds
-          approximately eight kilobytes to the kernel image.
+          approximately eight kilobytes to the kernel image.  For best
+          performance should round up your number of processors to the next
+          power of two.
 
 #
 # Timer Interrupt Frequency Configuration
diff --git a/arch/mips/configs/atlas_defconfig b/arch/mips/configs/atlas_defconfig
index 458894933a4c..39e251300c64 100644
--- a/arch/mips/configs/atlas_defconfig
+++ b/arch/mips/configs/atlas_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_ATLAS=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/bigsur_defconfig b/arch/mips/configs/bigsur_defconfig
index aa05e294ea62..4713a13211ce 100644
--- a/arch/mips/configs/bigsur_defconfig
+++ b/arch/mips/configs/bigsur_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/capcella_defconfig b/arch/mips/configs/capcella_defconfig
index b2594fa556f3..5e7ae56b1f3c 100644
--- a/arch/mips/configs/capcella_defconfig
+++ b/arch/mips/configs/capcella_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/cobalt_defconfig b/arch/mips/configs/cobalt_defconfig
index 9090a7aba6c1..ba593b510b76 100644
--- a/arch/mips/configs/cobalt_defconfig
+++ b/arch/mips/configs/cobalt_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_COBALT=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/db1000_defconfig b/arch/mips/configs/db1000_defconfig
index 4cb8cf4255a2..0db6a8b37301 100644
--- a/arch/mips/configs/db1000_defconfig
+++ b/arch/mips/configs/db1000_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_DB1000=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/db1100_defconfig b/arch/mips/configs/db1100_defconfig
index d86dedf27fc4..162add97c5ef 100644
--- a/arch/mips/configs/db1100_defconfig
+++ b/arch/mips/configs/db1100_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_DB1100=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/db1200_defconfig b/arch/mips/configs/db1200_defconfig
index c24b6008345e..82801ec43e6a 100644
--- a/arch/mips/configs/db1200_defconfig
+++ b/arch/mips/configs/db1200_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_DB1200=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/db1500_defconfig b/arch/mips/configs/db1500_defconfig
index baad2c5223ba..545f23094e13 100644
--- a/arch/mips/configs/db1500_defconfig
+++ b/arch/mips/configs/db1500_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_DB1500=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/db1550_defconfig b/arch/mips/configs/db1550_defconfig
index c29fdab0423a..5bd3b4328e57 100644
--- a/arch/mips/configs/db1550_defconfig
+++ b/arch/mips/configs/db1550_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_DB1550=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ddb5477_defconfig b/arch/mips/configs/ddb5477_defconfig
index f4b316d2cd70..5b502a2013fb 100644
--- a/arch/mips/configs/ddb5477_defconfig
+++ b/arch/mips/configs/ddb5477_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 CONFIG_DDB5477=y
diff --git a/arch/mips/configs/decstation_defconfig b/arch/mips/configs/decstation_defconfig
index 9c38e5c77761..4bbdab078ff1 100644
--- a/arch/mips/configs/decstation_defconfig
+++ b/arch/mips/configs/decstation_defconfig
@@ -39,7 +39,6 @@ CONFIG_MACH_DECSTATION=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/e55_defconfig b/arch/mips/configs/e55_defconfig
index 922af379aa41..b5714a6a5398 100644
--- a/arch/mips/configs/e55_defconfig
+++ b/arch/mips/configs/e55_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/emma2rh_defconfig b/arch/mips/configs/emma2rh_defconfig
index c0db8f14713d..3044579f171a 100644
--- a/arch/mips/configs/emma2rh_defconfig
+++ b/arch/mips/configs/emma2rh_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ev64120_defconfig b/arch/mips/configs/ev64120_defconfig
index ce088b36291d..c10e4e063226 100644
--- a/arch/mips/configs/ev64120_defconfig
+++ b/arch/mips/configs/ev64120_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_EV64120=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/excite_defconfig b/arch/mips/configs/excite_defconfig
index 82f204d080b7..460d7a26a8ba 100644
--- a/arch/mips/configs/excite_defconfig
+++ b/arch/mips/configs/excite_defconfig
@@ -40,7 +40,6 @@ CONFIG_BASLER_EXCITE=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ip22_defconfig b/arch/mips/configs/ip22_defconfig
index cb81f13bd45a..7ec618f3c8b9 100644
--- a/arch/mips/configs/ip22_defconfig
+++ b/arch/mips/configs/ip22_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index 46f6ac4083b9..9ddc3eff4793 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ip32_defconfig b/arch/mips/configs/ip32_defconfig
index d9e5000d5329..8fc18809d5ff 100644
--- a/arch/mips/configs/ip32_defconfig
+++ b/arch/mips/configs/ip32_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/jaguar-atx_defconfig b/arch/mips/configs/jaguar-atx_defconfig
index 57ef0c45a62b..083104daa2ca 100644
--- a/arch/mips/configs/jaguar-atx_defconfig
+++ b/arch/mips/configs/jaguar-atx_defconfig
@@ -39,7 +39,6 @@ CONFIG_MOMENCO_JAGUAR_ATX=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/jazz_defconfig b/arch/mips/configs/jazz_defconfig
index 21d979f8326c..9331cb0a19b1 100644
--- a/arch/mips/configs/jazz_defconfig
+++ b/arch/mips/configs/jazz_defconfig
@@ -39,7 +39,6 @@ CONFIG_MACH_JAZZ=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/jmr3927_defconfig b/arch/mips/configs/jmr3927_defconfig
index 98b9fbc042f4..21a094752dab 100644
--- a/arch/mips/configs/jmr3927_defconfig
+++ b/arch/mips/configs/jmr3927_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/lasat200_defconfig b/arch/mips/configs/lasat200_defconfig
index b3f767ff1c5a..fd4272c1458a 100644
--- a/arch/mips/configs/lasat200_defconfig
+++ b/arch/mips/configs/lasat200_defconfig
@@ -39,7 +39,6 @@ CONFIG_LASAT=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig
index a5f379d626d6..1f64d7632a03 100644
--- a/arch/mips/configs/malta_defconfig
+++ b/arch/mips/configs/malta_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_MALTA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/mipssim_defconfig b/arch/mips/configs/mipssim_defconfig
index 5ff53e184912..a2db5c201216 100644
--- a/arch/mips/configs/mipssim_defconfig
+++ b/arch/mips/configs/mipssim_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_SIM=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/mpc30x_defconfig b/arch/mips/configs/mpc30x_defconfig
index 750e6445c613..ad5c0bf87b2b 100644
--- a/arch/mips/configs/mpc30x_defconfig
+++ b/arch/mips/configs/mpc30x_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ocelot_3_defconfig b/arch/mips/configs/ocelot_3_defconfig
index 2febd0a7fba2..28547313ce13 100644
--- a/arch/mips/configs/ocelot_3_defconfig
+++ b/arch/mips/configs/ocelot_3_defconfig
@@ -39,7 +39,6 @@ CONFIG_MOMENCO_OCELOT_3=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ocelot_c_defconfig b/arch/mips/configs/ocelot_c_defconfig
index b8f457300bbf..82ff6fc0cd41 100644
--- a/arch/mips/configs/ocelot_c_defconfig
+++ b/arch/mips/configs/ocelot_c_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 CONFIG_MOMENCO_OCELOT_C=y
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ocelot_defconfig b/arch/mips/configs/ocelot_defconfig
index 8ade072271cd..15a027e00eec 100644
--- a/arch/mips/configs/ocelot_defconfig
+++ b/arch/mips/configs/ocelot_defconfig
@@ -39,7 +39,6 @@ CONFIG_MOMENCO_OCELOT=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/ocelot_g_defconfig b/arch/mips/configs/ocelot_g_defconfig
index d20a2216c11d..7078e6b3ea11 100644
--- a/arch/mips/configs/ocelot_g_defconfig
+++ b/arch/mips/configs/ocelot_g_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 CONFIG_MOMENCO_OCELOT_G=y
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/pb1100_defconfig b/arch/mips/configs/pb1100_defconfig
index 33fcc8133bc0..69678d99ae61 100644
--- a/arch/mips/configs/pb1100_defconfig
+++ b/arch/mips/configs/pb1100_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_PB1100=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/pb1500_defconfig b/arch/mips/configs/pb1500_defconfig
index e07c55dc8dc1..070672799dac 100644
--- a/arch/mips/configs/pb1500_defconfig
+++ b/arch/mips/configs/pb1500_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_PB1500=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/pb1550_defconfig b/arch/mips/configs/pb1550_defconfig
index df210dd22476..354e49b7a5f1 100644
--- a/arch/mips/configs/pb1550_defconfig
+++ b/arch/mips/configs/pb1550_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_PB1550=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/pnx8550-jbs_defconfig b/arch/mips/configs/pnx8550-jbs_defconfig
index 106a1641c0b5..fae16c5ec521 100644
--- a/arch/mips/configs/pnx8550-jbs_defconfig
+++ b/arch/mips/configs/pnx8550-jbs_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 CONFIG_PNX8550_JBS=y
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/pnx8550-stb810_defconfig b/arch/mips/configs/pnx8550-stb810_defconfig
index 8caa2cd1aa7c..cd821e52181d 100644
--- a/arch/mips/configs/pnx8550-stb810_defconfig
+++ b/arch/mips/configs/pnx8550-stb810_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 CONFIG_PNX8550_STB810=y
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/pnx8550-v2pci_defconfig b/arch/mips/configs/pnx8550-v2pci_defconfig
index 43f1becec2a4..3d6c2d743502 100644
--- a/arch/mips/configs/pnx8550-v2pci_defconfig
+++ b/arch/mips/configs/pnx8550-v2pci_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-CONFIG_PNX8550_V2PCI=y
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/qemu_defconfig b/arch/mips/configs/qemu_defconfig
index f68396d19f9a..8e8d03157954 100644
--- a/arch/mips/configs/qemu_defconfig
+++ b/arch/mips/configs/qemu_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/rbhma4500_defconfig b/arch/mips/configs/rbhma4500_defconfig
index a6a824fcc874..29e0df9f4be0 100644
--- a/arch/mips/configs/rbhma4500_defconfig
+++ b/arch/mips/configs/rbhma4500_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/rm200_defconfig b/arch/mips/configs/rm200_defconfig
index bee3702d501d..5593cde9f74c 100644
--- a/arch/mips/configs/rm200_defconfig
+++ b/arch/mips/configs/rm200_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/sb1250-swarm_defconfig b/arch/mips/configs/sb1250-swarm_defconfig
index 3c891ed10141..6c4f09a381e2 100644
--- a/arch/mips/configs/sb1250-swarm_defconfig
+++ b/arch/mips/configs/sb1250-swarm_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/sead_defconfig b/arch/mips/configs/sead_defconfig
index e31d964a053b..988b9cdef01f 100644
--- a/arch/mips/configs/sead_defconfig
+++ b/arch/mips/configs/sead_defconfig
@@ -39,7 +39,6 @@ CONFIG_MIPS_SEAD=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/tb0226_defconfig b/arch/mips/configs/tb0226_defconfig
index 5771c1aee76a..b5be8b74d896 100644
--- a/arch/mips/configs/tb0226_defconfig
+++ b/arch/mips/configs/tb0226_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/tb0229_defconfig b/arch/mips/configs/tb0229_defconfig
index a8eb4b182d34..1756d2bdf6b8 100644
--- a/arch/mips/configs/tb0229_defconfig
+++ b/arch/mips/configs/tb0229_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/tb0287_defconfig b/arch/mips/configs/tb0287_defconfig
index c58afa2eac6b..8bb6be4342b6 100644
--- a/arch/mips/configs/tb0287_defconfig
+++ b/arch/mips/configs/tb0287_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/workpad_defconfig b/arch/mips/configs/workpad_defconfig
index 2abbd6827720..8f019ffcc71b 100644
--- a/arch/mips/configs/workpad_defconfig
+++ b/arch/mips/configs/workpad_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/wrppmc_defconfig b/arch/mips/configs/wrppmc_defconfig
index 44b6b7c1fdb6..52b48c0715d3 100644
--- a/arch/mips/configs/wrppmc_defconfig
+++ b/arch/mips/configs/wrppmc_defconfig
@@ -39,7 +39,6 @@ CONFIG_WR_PPMC=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/configs/yosemite_defconfig b/arch/mips/configs/yosemite_defconfig
index f24e1c6fc484..6824606309e5 100644
--- a/arch/mips/configs/yosemite_defconfig
+++ b/arch/mips/configs/yosemite_defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/ddb5xxx/ddb5477/irq.c b/arch/mips/ddb5xxx/ddb5477/irq.c
index 2b23234a5b95..faa4a506bf82 100644
--- a/arch/mips/ddb5xxx/ddb5477/irq.c
+++ b/arch/mips/ddb5xxx/ddb5477/irq.c
@@ -194,7 +194,7 @@ static void vrc5477_irq_dispatch(void)
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_cause() & read_c0_status();
+        unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
 
         if (pending & STATUSF_IP7)
                 do_IRQ(CPU_IRQ_BASE + 7);
diff --git a/arch/mips/defconfig b/arch/mips/defconfig
index 8cb8f5919194..41211f8b7738 100644
--- a/arch/mips/defconfig
+++ b/arch/mips/defconfig
@@ -39,7 +39,6 @@ CONFIG_ZONE_DMA=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_DDB5477 is not set
diff --git a/arch/mips/emma2rh/markeins/irq.c b/arch/mips/emma2rh/markeins/irq.c
index e26630026375..6bcf6a06367a 100644
--- a/arch/mips/emma2rh/markeins/irq.c
+++ b/arch/mips/emma2rh/markeins/irq.c
@@ -115,7 +115,7 @@ void __init arch_init_irq(void)
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_status() & read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
 
         if (pending & STATUSF_IP7)
                 do_IRQ(CPU_IRQ_BASE + 7);
diff --git a/arch/mips/gt64120/ev64120/irq.c b/arch/mips/gt64120/ev64120/irq.c
index 04572b9c9642..64e4c80b6139 100644
--- a/arch/mips/gt64120/ev64120/irq.c
+++ b/arch/mips/gt64120/ev64120/irq.c
@@ -48,7 +48,7 @@
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_status() & read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
 
         if (pending & STATUSF_IP4)              /* int2 hardware line (timer) */
                 do_IRQ(4);
diff --git a/arch/mips/gt64120/wrppmc/irq.c b/arch/mips/gt64120/wrppmc/irq.c
index d3d96591780e..06177bf5b1d6 100644
--- a/arch/mips/gt64120/wrppmc/irq.c
+++ b/arch/mips/gt64120/wrppmc/irq.c
@@ -32,7 +32,7 @@
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_status() & read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
 
         if (pending & STATUSF_IP7)
                 do_IRQ(WRPPMC_MIPS_TIMER_IRQ);  /* CPU Compare/Count internal timer */
diff --git a/arch/mips/jazz/irq.c b/arch/mips/jazz/irq.c
index 295892e4ce53..015cf4bb51dd 100644
--- a/arch/mips/jazz/irq.c
+++ b/arch/mips/jazz/irq.c
@@ -122,7 +122,7 @@ static void ll_local_dev(void)
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
+        unsigned int pending = read_c0_cause() & read_c0_status();
 
         if (pending & IE_IRQ5)
                 write_c0_compare(0);
diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
index 46e421e14348..e8e0ffb9354d 100644
--- a/arch/mips/jazz/jazzdma.c
+++ b/arch/mips/jazz/jazzdma.c
@@ -67,7 +67,8 @@ void __init vdma_init(void)
          * aligned and should be uncached to avoid cache flushing after every
          * update.
          */
-        vdma_pagetable_start = alloc_bootmem_low_pages(VDMA_PGTBL_SIZE);
+        vdma_pagetable_start =
+                (unsigned long) alloc_bootmem_low_pages(VDMA_PGTBL_SIZE);
         if (!vdma_pagetable_start)
                 BUG();
         dma_cache_wback_inv(vdma_pagetable_start, VDMA_PGTBL_SIZE);
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index aacd4a005c5f..83843a229be7 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -181,13 +181,13 @@ NESTED(except_vec_vi, 0, sp)
          * during service by SMTC kernel, we also want to
          * pass the IM value to be cleared.
          */
-EXPORT(except_vec_vi_mori)
+FEXPORT(except_vec_vi_mori)
         ori     a0, $0, 0
 #endif /* CONFIG_MIPS_MT_SMTC */
-EXPORT(except_vec_vi_lui)
+FEXPORT(except_vec_vi_lui)
         lui     v0, 0           /* Patched */
         j       except_vec_vi_handler
-EXPORT(except_vec_vi_ori)
+FEXPORT(except_vec_vi_ori)
          ori    v0, 0           /* Patched */
         .set    pop
         END(except_vec_vi)
@@ -220,7 +220,17 @@ NESTED(except_vec_vi_handler, 0, sp)
         _ehb
 #endif /* CONFIG_MIPS_MT_SMTC */
         CLI
+#ifdef CONFIG_TRACE_IRQFLAGS
+        move    s0, v0
+#ifdef CONFIG_MIPS_MT_SMTC
+        move    s1, a0
+#endif
         TRACE_IRQS_OFF
+#ifdef CONFIG_MIPS_MT_SMTC
+        move    a0, s1
+#endif
+        move    v0, s0
+#endif
 
         LONG_L  s0, TI_REGS($28)
         LONG_S  sp, TI_REGS($28)
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 5929f883e46b..29eadd404fa5 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -70,6 +70,7 @@ static int sp_stopping = 0;
 #define MTSP_SYSCALL_GETTIME    (MTSP_SYSCALL_BASE + 7)
 #define MTSP_SYSCALL_PIPEFREQ   (MTSP_SYSCALL_BASE + 8)
 #define MTSP_SYSCALL_GETTOD     (MTSP_SYSCALL_BASE + 9)
+#define MTSP_SYSCALL_IOCTL     (MTSP_SYSCALL_BASE + 10)
 
 #define MTSP_O_RDONLY           0x0000
 #define MTSP_O_WRONLY           0x0001
@@ -110,7 +111,8 @@ struct apsp_table syscall_command_table[] = {
         { MTSP_SYSCALL_CLOSE, __NR_close },
         { MTSP_SYSCALL_READ, __NR_read },
         { MTSP_SYSCALL_WRITE, __NR_write },
-        { MTSP_SYSCALL_LSEEK32, __NR_lseek }
+        { MTSP_SYSCALL_LSEEK32, __NR_lseek },
+        { MTSP_SYSCALL_IOCTL, __NR_ioctl }
 };
 
 static int sp_syscall(int num, int arg0, int arg1, int arg2, int arg3)
@@ -189,6 +191,8 @@ void sp_work_handle_request(void)
         struct mtsp_syscall_generic generic;
         struct mtsp_syscall_ret ret;
         struct kspd_notifications *n;
+        unsigned long written;
+        mm_segment_t old_fs;
         struct timeval tv;
         struct timezone tz;
         int cmd;
@@ -199,7 +203,11 @@ void sp_work_handle_request(void)
 
         ret.retval = -1;
 
-        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall), 0)) {
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+
+        if (!rtlx_read(RTLX_CHANNEL_SYSIO, &sc, sizeof(struct mtsp_syscall))) {
+                set_fs(old_fs);
                 printk(KERN_ERR "Expected request but nothing to read\n");
                 return;
         }
@@ -207,7 +215,8 @@ void sp_work_handle_request(void)
         size = sc.size;
 
         if (size) {
-                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size, 0)) {
+                if (!rtlx_read(RTLX_CHANNEL_SYSIO, &generic, size)) {
+                        set_fs(old_fs);
                         printk(KERN_ERR "Expected request but nothing to read\n");
                         return;
                 }
@@ -280,8 +289,11 @@ void sp_work_handle_request(void)
         if (vpe_getuid(SP_VPE))
                 sp_setfsuidgid( 0, 0);
 
-        if ((rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(struct mtsp_syscall_ret), 0))
-            < sizeof(struct mtsp_syscall_ret))
+        old_fs = get_fs();
+        set_fs(KERNEL_DS);
+        written = rtlx_write(RTLX_CHANNEL_SYSIO, &ret, sizeof(ret));
+        set_fs(old_fs);
+        if (written < sizeof(ret))
                 printk("KSPD: sp_work_handle_request failed to send to SP\n");
 }
 
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 1df544c1f966..37849edd0645 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -311,6 +311,8 @@ asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
         return ret;
 }
 
+#ifdef CONFIG_SYSVIPC
+
 asmlinkage long
 sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 {
@@ -368,6 +370,16 @@ sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
         return err;
 }
 
+#else
+
+asmlinkage long
+sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
+{
+        return -ENOSYS;
+}
+
+#endif /* CONFIG_SYSVIPC */
+
 #ifdef CONFIG_MIPS32_N32
 asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
 {
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 656bde2e11b1..28c2e2e6af73 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -49,8 +49,7 @@ LEAF(resume)
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t1, CP0_STATUS
-        sw      t1, THREAD_STATUS(a0)
+        mfc0    t2, CP0_STATUS
         cpu_save_nonscratch a0
         sw      ra, THREAD_REG31(a0)
 
@@ -60,8 +59,8 @@ LEAF(resume)
         lw      t3, TASK_THREAD_INFO(a0)
         lw      t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t2, t0, t1
-        beqz    t2, 1f
+        and     t1, t0
+        beqz    t1, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -74,10 +73,13 @@ LEAF(resume)
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         sw      t0, ST_OFF(t3)
+        /* clear thread_struct CU1 bit */
+        and     t2, t1
 
         fpu_save_single a0, t0                  # clobbers t0
 
 1:
+        sw      t2, THREAD_STATUS(a0)
         /*
          * The order of restoring the registers takes care of the race
          * updating $28, $29 and kernelsp without disabling ints.
diff --git a/arch/mips/kernel/r4k_fpu.S b/arch/mips/kernel/r4k_fpu.S
index 59c1577ecbb3..dbd42adc52ed 100644
--- a/arch/mips/kernel/r4k_fpu.S
+++ b/arch/mips/kernel/r4k_fpu.S
@@ -114,14 +114,6 @@ LEAF(_save_fp_context32)
  */
 LEAF(_restore_fp_context)
         EX      lw t0, SC_FPC_CSR(a0)
-
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
-
 #ifdef CONFIG_64BIT
         EX      ldc1 $f1, SC_FPREGS+8(a0)
         EX      ldc1 $f3, SC_FPREGS+24(a0)
@@ -165,14 +157,6 @@ LEAF(_restore_fp_context)
 LEAF(_restore_fp_context32)
         /* Restore an o32 sigcontext.  */
         EX      lw t0, SC32_FPC_CSR(a0)
-
-        /* Fail if the CSR has exceptions pending */
-        srl     t1, t0, 5
-        and     t1, t0
-        andi    t1, 0x1f << 7
-        bnez    t1, fault
-         nop
-
         EX      ldc1 $f0, SC32_FPREGS+0(a0)
         EX      ldc1 $f2, SC32_FPREGS+16(a0)
         EX      ldc1 $f4, SC32_FPREGS+32(a0)
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index cc566cf12246..c7698fd9955c 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -48,8 +48,7 @@
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t1, CP0_STATUS
-        LONG_S  t1, THREAD_STATUS(a0)
+        mfc0    t2, CP0_STATUS
         cpu_save_nonscratch a0
         LONG_S  ra, THREAD_REG31(a0)
 
@@ -59,8 +58,8 @@
         PTR_L   t3, TASK_THREAD_INFO(a0)
         LONG_L  t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t2, t0, t1
-        beqz    t2, 1f
+        and     t1, t0
+        beqz    t1, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -73,10 +72,13 @@
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         LONG_S  t0, ST_OFF(t3)
+        /* clear thread_struct CU1 bit */
+        and     t2, t1
 
         fpu_save_double a0 t0 t1                # c0_status passed in t0
                                                 # clobbers t1
 1:
+        LONG_S  t2, THREAD_STATUS(a0)
 
         /*
          * The order of restoring the registers takes care of the race
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index e14ae09eda2b..e6e3047151a6 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -54,6 +54,7 @@ static struct chan_waitqueues {
         wait_queue_head_t rt_queue;
         wait_queue_head_t lx_queue;
         atomic_t in_open;
+        struct mutex mutex;
 } channel_wqs[RTLX_CHANNELS];
 
 static struct irqaction irq;
@@ -146,7 +147,7 @@ static void stopping(int vpe)
 
 int rtlx_open(int index, int can_sleep)
 {
-        volatile struct rtlx_info **p;
+        struct rtlx_info **p;
         struct rtlx_channel *chan;
         enum rtlx_state state;
         int ret = 0;
@@ -179,13 +180,24 @@ int rtlx_open(int index, int can_sleep)
                         }
                 }
 
+                smp_rmb();
                 if (*p == NULL) {
                         if (can_sleep) {
-                                __wait_event_interruptible(channel_wqs[index].lx_queue,
-                                                           *p != NULL,
-                                                           ret);
-                                if (ret)
+                                DEFINE_WAIT(wait);
+
+                                for (;;) {
+                                        prepare_to_wait(&channel_wqs[index].lx_queue, &wait, TASK_INTERRUPTIBLE);
+                                        smp_rmb();
+                                        if (*p != NULL)
+                                                break;
+                                        if (!signal_pending(current)) {
+                                                schedule();
+                                                continue;
+                                        }
+                                        ret = -ERESTARTSYS;
                                         goto out_fail;
+                                }
+                                finish_wait(&channel_wqs[index].lx_queue, &wait);
                         } else {
                                 printk(" *vpe_get_shared is NULL. "
                                        "Has an SP program been loaded?\n");
@@ -277,56 +289,52 @@ unsigned int rtlx_write_poll(int index)
         return write_spacefree(chan->rt_read, chan->rt_write, chan->buffer_size);
 }
 
-static inline void copy_to(void *dst, void *src, size_t count, int user)
-{
-        if (user)
-                copy_to_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-
-static inline void copy_from(void *dst, void *src, size_t count, int user)
+ssize_t rtlx_read(int index, void __user *buff, size_t count, int user)
 {
-        if (user)
-                copy_from_user(dst, src, count);
-        else
-                memcpy(dst, src, count);
-}
-
-ssize_t rtlx_read(int index, void *buff, size_t count, int user)
-{
-        size_t fl = 0L;
+        size_t lx_write, fl = 0L;
         struct rtlx_channel *lx;
+        unsigned long failed;
 
         if (rtlx == NULL)
                 return -ENOSYS;
 
         lx = &rtlx->channel[index];
 
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        lx_write = lx->lx_write;
+
         /* find out how much in total */
         count = min(count,
-                     (size_t)(lx->lx_write + lx->buffer_size - lx->lx_read)
+                     (size_t)(lx_write + lx->buffer_size - lx->lx_read)
                      % lx->buffer_size);
 
         /* then how much from the read pointer onwards */
-        fl = min( count, (size_t)lx->buffer_size - lx->lx_read);
+        fl = min(count, (size_t)lx->buffer_size - lx->lx_read);
 
-        copy_to(buff, &lx->lx_buffer[lx->lx_read], fl, user);
+        failed = copy_to_user(buff, lx->lx_buffer + lx->lx_read, fl);
+        if (failed)
+                goto out;
 
         /* and if there is anything left at the beginning of the buffer */
-        if ( count - fl )
-                copy_to (buff + fl, lx->lx_buffer, count - fl, user);
+        if (count - fl)
+                failed = copy_to_user(buff + fl, lx->lx_buffer, count - fl);
 
-        /* update the index */
-        lx->lx_read += count;
-        lx->lx_read %= lx->buffer_size;
+out:
+        count -= failed;
+
+        smp_wmb();
+        lx->lx_read = (lx->lx_read + count) % lx->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
 
         return count;
 }
 
-ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
+ssize_t rtlx_write(int index, const void __user *buffer, size_t count, int user)
 {
         struct rtlx_channel *rt;
+        size_t rt_read;
         size_t fl;
 
         if (rtlx == NULL)
@@ -334,24 +342,35 @@ ssize_t rtlx_write(int index, void *buffer, size_t count, int user)
 
         rt = &rtlx->channel[index];
 
+        mutex_lock(&channel_wqs[index].mutex);
+        smp_rmb();
+        rt_read = rt->rt_read;
+
         /* total number of bytes to copy */
         count = min(count,
-                    (size_t)write_spacefree(rt->rt_read, rt->rt_write,
-                                            rt->buffer_size));
+                    (size_t)write_spacefree(rt_read, rt->rt_write, rt->buffer_size));
 
         /* first bit from write pointer to the end of the buffer, or count */
         fl = min(count, (size_t) rt->buffer_size - rt->rt_write);
 
-        copy_from (&rt->rt_buffer[rt->rt_write], buffer, fl, user);
+        failed = copy_from_user(rt->rt_buffer + rt->rt_write, buffer, fl);
+        if (failed)
+                goto out;
 
         /* if there's any left copy to the beginning of the buffer */
-        if( count - fl )
-                copy_from (rt->rt_buffer, buffer + fl, count - fl, user);
+        if (count - fl) {
+                failed = copy_from_user(rt->rt_buffer, buffer + fl, count - fl);
+        }
+
+out:
+        count -= cailed;
 
-        rt->rt_write += count;
-        rt->rt_write %= rt->buffer_size;
+        smp_wmb();
+        rt->rt_write = (rt->rt_write + count) % rt->buffer_size;
+        smp_wmb();
+        mutex_unlock(&channel_wqs[index].mutex);
 
-        return(count);
+        return count;
 }
 
 
@@ -403,7 +422,7 @@ static ssize_t file_read(struct file *file, char __user * buffer, size_t count,
                 return 0;       // -EAGAIN makes cat whinge
         }
 
-        return rtlx_read(minor, buffer, count, 1);
+        return rtlx_read(minor, buffer, count);
 }
 
 static ssize_t file_write(struct file *file, const char __user * buffer,
@@ -429,7 +448,7 @@ static ssize_t file_write(struct file *file, const char __user * buffer,
                         return ret;
         }
 
-        return rtlx_write(minor, (void *)buffer, count, 1);
+        return rtlx_write(minor, buffer, count);
 }
 
 static const struct file_operations rtlx_fops = {
@@ -468,6 +487,7 @@ static int rtlx_module_init(void)
                 init_waitqueue_head(&channel_wqs[i].rt_queue);
                 init_waitqueue_head(&channel_wqs[i].lx_queue);
                 atomic_set(&channel_wqs[i].in_open, 0);
+                mutex_init(&channel_wqs[i].mutex);
 
                 dev = device_create(mt_class, NULL, MKDEV(major, i),
                                     "%s%d", module_name, i);
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index fdbdbdc65b54..297dfcb97524 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -31,4 +31,7 @@ extern void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
  */
 extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
 
+/* Check and clear pending FPU exceptions in saved CSR */
+extern int fpcsr_pending(unsigned int __user *fpcsr);
+
 #endif  /* __SIGNAL_COMMON_H */
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index f091786187a6..8c3c5a5789b0 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -82,6 +82,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         int err = 0;
         int i;
+        unsigned int used_math;
 
         err |= __put_user(regs->cp0_epc, &sc->sc_pc);
 
@@ -104,26 +105,53 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                 err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
         }
 
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
 
-        if (used_math()) {
+        if (used_math) {
                 /*
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                preempt_disable();
-
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
+                own_fpu(1);
+                enable_fp_in_kernel();
                 err |= save_fp_context(sc);
-
-                preempt_enable();
+                disable_fp_in_kernel();
         }
         return err;
 }
 
+int fpcsr_pending(unsigned int __user *fpcsr)
+{
+        int err, sig = 0;
+        unsigned int csr, enabled;
+
+        err = __get_user(csr, fpcsr);
+        enabled = FPU_CSR_UNI_X | ((csr & FPU_CSR_ALL_E) << 5);
+        /*
+         * If the signal handler set some FPU exceptions, clear it and
+         * send SIGFPE.
+         */
+        if (csr & enabled) {
+                csr &= ~enabled;
+                err |= __put_user(csr, fpcsr);
+                sig = SIGFPE;
+        }
+        return err ?: sig;
+}
+
+static int
+check_and_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, sig;
+
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= restore_fp_context(sc);
+        return err ?: sig;
+}
+
 int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         unsigned int used_math;
@@ -157,19 +185,18 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
         err |= __get_user(used_math, &sc->sc_used_math);
         conditional_used_math(used_math);
 
-        preempt_disable();
-
-        if (used_math()) {
+        if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu();
-                err |= restore_fp_context(sc);
+                own_fpu(0);
+                enable_fp_in_kernel();
+                if (!err)
+                        err = check_and_restore_fp_context(sc);
+                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
         }
 
-        preempt_enable();
-
         return err;
 }
 
@@ -332,6 +359,7 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct sigframe __user *frame;
         sigset_t blocked;
+        int sig;
 
         frame = (struct sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -345,8 +373,11 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->sf_sc))
+        sig = restore_sigcontext(&regs, &frame->sf_sc);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /*
          * Don't let your children do this ...
@@ -368,6 +399,7 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         struct rt_sigframe __user *frame;
         sigset_t set;
         stack_t st;
+        int sig;
 
         frame = (struct rt_sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -381,8 +413,11 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         if (__copy_from_user(&st, &frame->rs_uc.uc_stack, sizeof(st)))
                 goto badframe;
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 19bbef001959..151fd2f0893a 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -181,6 +181,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
 {
         int err = 0;
         int i;
+        u32 used_math;
 
         err |= __put_user(regs->cp0_epc, &sc->sc_pc);
 
@@ -200,26 +201,34 @@ static int setup_sigcontext32(struct pt_regs *regs,
                 err |= __put_user(mflo3(), &sc->sc_lo3);
         }
 
-        err |= __put_user(!!used_math(), &sc->sc_used_math);
+        used_math = !!used_math();
+        err |= __put_user(used_math, &sc->sc_used_math);
 
-        if (used_math()) {
+        if (used_math) {
                 /*
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                preempt_disable();
-
-                if (!is_fpu_owner()) {
-                        own_fpu();
-                        restore_fp(current);
-                }
+                own_fpu(1);
+                enable_fp_in_kernel();
                 err |= save_fp_context32(sc);
-
-                preempt_enable();
+                disable_fp_in_kernel();
         }
         return err;
 }
 
+static int
+check_and_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, sig;
+
+        err = sig = fpcsr_pending(&sc->sc_fpc_csr);
+        if (err > 0)
+                err = 0;
+        err |= restore_fp_context32(sc);
+        return err ?: sig;
+}
+
 static int restore_sigcontext32(struct pt_regs *regs,
                                 struct sigcontext32 __user *sc)
 {
@@ -250,19 +259,18 @@ static int restore_sigcontext32(struct pt_regs *regs,
         err |= __get_user(used_math, &sc->sc_used_math);
         conditional_used_math(used_math);
 
-        preempt_disable();
-
-        if (used_math()) {
+        if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu();
-                err |= restore_fp_context32(sc);
+                own_fpu(0);
+                enable_fp_in_kernel();
+                if (!err)
+                        err = check_and_restore_fp_context32(sc);
+                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
-                lose_fpu();
+                lose_fpu(0);
         }
 
-        preempt_enable();
-
         return err;
 }
 
@@ -508,6 +516,7 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
         struct sigframe32 __user *frame;
         sigset_t blocked;
+        int sig;
 
         frame = (struct sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -521,8 +530,11 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext32(&regs, &frame->sf_sc))
+        sig = restore_sigcontext32(&regs, &frame->sf_sc);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /*
          * Don't let your children do this ...
@@ -545,6 +557,7 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         sigset_t set;
         stack_t st;
         s32 sp;
+        int sig;
 
         frame = (struct rt_sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -558,8 +571,11 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ecf1f7ecaad9..a9202fa95987 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -127,6 +127,7 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         sigset_t set;
         stack_t st;
         s32 sp;
+        int sig;
 
         frame = (struct rt_sigframe_n32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -140,8 +141,11 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext))
+        sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
+        if (sig < 0)
                 goto badframe;
+        else if (sig)
+                force_sig(sig, current);
 
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 18f56a9dbcfa..7d76a85422b2 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -610,16 +610,6 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
         if (fcr31 & FPU_CSR_UNI_X) {
                 int sig;
 
-                preempt_disable();
-
-#ifdef CONFIG_PREEMPT
-                if (!is_fpu_owner()) {
-                        /* We might lose fpu before disabling preempt... */
-                        own_fpu();
-                        BUG_ON(!used_math());
-                        restore_fp(current);
-                }
-#endif
                 /*
                  * Unimplemented operation exception.  If we've got the full
                  * software emulator on-board, let's use it...
@@ -630,18 +620,12 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                  * register operands before invoking the emulator, which seems
                  * a bit extreme for what should be an infrequent event.
                  */
-                save_fp(current);
                 /* Ensure 'resume' not overwrite saved fp context again. */
-                lose_fpu();
-
-                preempt_enable();
+                lose_fpu(1);
 
                 /* Run the emulator */
                 sig = fpu_emulator_cop1Handler (regs, &current->thread.fpu, 1);
 
-                preempt_disable();
-
-                own_fpu();      /* Using the FPU again.  */
                 /*
                  * We can't allow the emulated instruction to leave any of
                  * the cause bit set in $fcr31.
@@ -649,9 +633,7 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31)
                 current->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
 
                 /* Restore the hardware register state */
-                restore_fp(current);
-
-                preempt_enable();
+                own_fpu(1);     /* Using the FPU again.  */
 
                 /* If something went wrong, signal */
                 if (sig)
@@ -775,12 +757,11 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 {
         unsigned int cpid;
 
-        die_if_kernel("do_cpu invoked from kernel context!", regs);
-
         cpid = (regs->cp0_cause >> CAUSEB_CE) & 3;
 
         switch (cpid) {
         case 0:
+                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 if (!cpu_has_llsc)
                         if (!simulate_llsc(regs))
                                 return;
@@ -791,21 +772,30 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                 break;
 
         case 1:
-                preempt_disable();
-
-                own_fpu();
-                if (used_math()) {      /* Using the FPU again.  */
-                        restore_fp(current);
-                } else {                        /* First time FPU user.  */
+                if (!test_thread_flag(TIF_ALLOW_FP_IN_KERNEL))
+                        die_if_kernel("do_cpu invoked from kernel context!",
+                                      regs);
+                if (used_math())        /* Using the FPU again.  */
+                        own_fpu(1);
+                else {                  /* First time FPU user.  */
                         init_fpu();
                         set_used_math();
                 }
 
-                if (cpu_has_fpu) {
-                        preempt_enable();
+                if (raw_cpu_has_fpu) {
+                        if (test_thread_flag(TIF_ALLOW_FP_IN_KERNEL)) {
+                                local_irq_disable();
+                                if (cpu_has_fpu)
+                                        regs->cp0_status |= ST0_CU1;
+                                /*
+                                 * We must return without enabling
+                                 * interrupts to ensure keep FPU
+                                 * ownership until resume.
+                                 */
+                                return;
+                        }
                 } else {
                         int sig;
-                        preempt_enable();
                         sig = fpu_emulator_cop1Handler(regs,
                                                 &current->thread.fpu, 0);
                         if (sig)
@@ -1259,26 +1249,26 @@ static inline void mips_srs_init(void)
 /*
  * This is used by native signal handling
  */
-asmlinkage int (*save_fp_context)(struct sigcontext *sc);
-asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
+asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
 
-extern asmlinkage int _save_fp_context(struct sigcontext *sc);
-extern asmlinkage int _restore_fp_context(struct sigcontext *sc);
+extern asmlinkage int _save_fp_context(struct sigcontext __user *sc);
+extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
 
-extern asmlinkage int fpu_emulator_save_context(struct sigcontext *sc);
-extern asmlinkage int fpu_emulator_restore_context(struct sigcontext *sc);
+extern asmlinkage int fpu_emulator_save_context(struct sigcontext __user *sc);
+extern asmlinkage int fpu_emulator_restore_context(struct sigcontext __user *sc);
 
 #ifdef CONFIG_SMP
-static int smp_save_fp_context(struct sigcontext *sc)
+static int smp_save_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
                ? _save_fp_context(sc)
                : fpu_emulator_save_context(sc);
 }
 
-static int smp_restore_fp_context(struct sigcontext *sc)
+static int smp_restore_fp_context(struct sigcontext __user *sc)
 {
-        return cpu_has_fpu
+        return raw_cpu_has_fpu
                ? _restore_fp_context(sc)
                : fpu_emulator_restore_context(sc);
 }
@@ -1306,14 +1296,14 @@ static inline void signal_init(void)
 /*
  * This is used by 32-bit signal stuff on the 64-bit kernel
  */
-asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
-asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
+asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 
-extern asmlinkage int _save_fp_context32(struct sigcontext32 *sc);
-extern asmlinkage int _restore_fp_context32(struct sigcontext32 *sc);
+extern asmlinkage int _save_fp_context32(struct sigcontext32 __user *sc);
+extern asmlinkage int _restore_fp_context32(struct sigcontext32 __user *sc);
 
-extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 *sc);
-extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 *sc);
+extern asmlinkage int fpu_emulator_save_context32(struct sigcontext32 __user *sc);
+extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 __user *sc);
 
 static inline void signal32_init(void)
 {
diff --git a/arch/mips/math-emu/kernel_linkage.c b/arch/mips/math-emu/kernel_linkage.c
index 5b3390f64917..ed49ef01ac53 100644
--- a/arch/mips/math-emu/kernel_linkage.c
+++ b/arch/mips/math-emu/kernel_linkage.c
@@ -51,7 +51,7 @@ void fpu_emulator_init_fpu(void)
  * with appropriate macros from uaccess.h
  */
 
-int fpu_emulator_save_context(struct sigcontext *sc)
+int fpu_emulator_save_context(struct sigcontext __user *sc)
 {
         int i;
         int err = 0;
@@ -65,7 +65,7 @@ int fpu_emulator_save_context(struct sigcontext *sc)
         return err;
 }
 
-int fpu_emulator_restore_context(struct sigcontext *sc)
+int fpu_emulator_restore_context(struct sigcontext __user *sc)
 {
         int i;
         int err = 0;
@@ -84,7 +84,7 @@ int fpu_emulator_restore_context(struct sigcontext *sc)
  * This is the o32 version
  */
 
-int fpu_emulator_save_context32(struct sigcontext32 *sc)
+int fpu_emulator_save_context32(struct sigcontext32 __user *sc)
 {
         int i;
         int err = 0;
@@ -98,7 +98,7 @@ int fpu_emulator_save_context32(struct sigcontext32 *sc)
         return err;
 }
 
-int fpu_emulator_restore_context32(struct sigcontext32 *sc)
+int fpu_emulator_restore_context32(struct sigcontext32 __user *sc)
 {
         int i;
         int err = 0;
diff --git a/arch/mips/mips-boards/generic/init.c b/arch/mips/mips-boards/generic/init.c
index 1acdf091c258..88e9c2a7a2f9 100644
--- a/arch/mips/mips-boards/generic/init.c
+++ b/arch/mips/mips-boards/generic/init.c
@@ -145,7 +145,7 @@ static void __init console_config(void)
         char parity = '\0', bits = '\0', flow = '\0';
         char *s;
 
-        if ((strstr(prom_getcmdline(), "console=ttyS")) == NULL) {
+        if ((strstr(prom_getcmdline(), "console=")) == NULL) {
                 s = prom_getenv("modetty0");
                 if (s) {
                         while (*s >= '0' && *s <= '9')
diff --git a/arch/mips/mm/c-r3k.c b/arch/mips/mm/c-r3k.c
index d1af42c2a52e..59868a1edf66 100644
--- a/arch/mips/mm/c-r3k.c
+++ b/arch/mips/mm/c-r3k.c
@@ -260,7 +260,7 @@ static void r3k_flush_cache_page(struct vm_area_struct *vma, unsigned long page,
 {
 }
 
-static void local_r3k_flush_data_cache_page(unsigned long addr)
+static void local_r3k_flush_data_cache_page(void *addr)
 {
 }
 
diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index 31819c58bffa..4e8f1b683376 100644
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -3,7 +3,8 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1994 - 2003 by Ralf Baechle
+ * Copyright (C) 1994 - 2003, 07 by Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 2007 MIPS Technologies, Inc.
  */
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -88,6 +89,19 @@ void __flush_dcache_page(struct page *page)
 
 EXPORT_SYMBOL(__flush_dcache_page);
 
+void __flush_anon_page(struct page *page, unsigned long vmaddr)
+{
+        if (pages_do_alias((unsigned long)page_address(page), vmaddr)) {
+                void *kaddr;
+
+                kaddr = kmap_coherent(page, vmaddr);
+                flush_data_cache_page((unsigned long)kaddr);
+                kunmap_coherent(kaddr);
+        }
+}
+
+EXPORT_SYMBOL(__flush_anon_page);
+
 void __update_cache(struct vm_area_struct *vma, unsigned long address,
         pte_t pte)
 {
diff --git a/arch/mips/mm/cerr-sb1.c b/arch/mips/mm/cerr-sb1.c
index 11a916629d3b..4c72e650f9b6 100644
--- a/arch/mips/mm/cerr-sb1.c
+++ b/arch/mips/mm/cerr-sb1.c
@@ -177,8 +177,8 @@ extern void check_bus_watcher(void);
 
 asmlinkage void sb1_cache_error(void)
 {
-        uint64_t cerr_dpa;
         uint32_t errctl, cerr_i, cerr_d, dpalo, dpahi, eepc, res;
+        unsigned long long cerr_dpa;
 
 #ifdef CONFIG_SIBYTE_BW_TRACE
         /* Freeze the trace buffer now */
@@ -329,8 +329,9 @@ static uint32_t extract_ic(unsigned short addr, int data)
 {
         unsigned short way;
         int valid;
-        uint64_t taglo, va, tlo_tmp;
         uint32_t taghi, taglolo, taglohi;
+        unsigned long long taglo, va;
+        uint64_t tlo_tmp;
         uint8_t lru;
         int res = 0;
 
@@ -484,8 +485,8 @@ static uint32_t extract_dc(unsigned short addr, int data)
 {
         int valid, way;
         unsigned char state;
-        uint64_t taglo, pa;
         uint32_t taghi, taglolo, taglohi;
+        unsigned long long taglo, pa;
         uint8_t ecc, lru;
         int res = 0;
 
@@ -535,8 +536,8 @@ static uint32_t extract_dc(unsigned short addr, int data)
                 }
 
                 if (data) {
-                        uint64_t datalo;
                         uint32_t datalohi, datalolo, datahi;
+                        unsigned long long datalo;
                         int offset;
                         char bad_ecc = 0;
 
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index f503d02e403b..f0eb29917d9a 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -19,6 +19,13 @@
 
 #include <dma-coherence.h>
 
+static inline unsigned long dma_addr_to_virt(dma_addr_t dma_addr)
+{
+        unsigned long addr = plat_dma_addr_to_phys(dma_addr);
+
+        return (unsigned long)phys_to_virt(addr);
+}
+
 /*
  * Warning on the terminology - Linux calls an uncached area coherent;
  * MIPS terminology calls memory areas with hardware maintained coherency
@@ -140,7 +147,7 @@ void dma_unmap_single(struct device *dev, dma_addr_t dma_addr, size_t size,
         enum dma_data_direction direction)
 {
         if (cpu_is_noncoherent_r10000(dev))
-                __dma_sync(plat_dma_addr_to_phys(dma_addr) + PAGE_OFFSET, size,
+                __dma_sync(dma_addr_to_virt(dma_addr), size,
                            direction);
 
         plat_unmap_dma_mem(dma_addr);
@@ -234,7 +241,7 @@ void dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
         if (cpu_is_noncoherent_r10000(dev)) {
                 unsigned long addr;
 
-                addr = PAGE_OFFSET + plat_dma_addr_to_phys(dma_handle);
+                addr = dma_addr_to_virt(dma_handle);
                 __dma_sync(addr, size, direction);
         }
 }
@@ -249,7 +256,7 @@ void dma_sync_single_for_device(struct device *dev, dma_addr_t dma_handle,
         if (!plat_device_is_coherent(dev)) {
                 unsigned long addr;
 
-                addr = PAGE_OFFSET + plat_dma_addr_to_phys(dma_handle);
+                addr = dma_addr_to_virt(dma_handle);
                 __dma_sync(addr, size, direction);
         }
 }
@@ -264,7 +271,7 @@ void dma_sync_single_range_for_cpu(struct device *dev, dma_addr_t dma_handle,
         if (cpu_is_noncoherent_r10000(dev)) {
                 unsigned long addr;
 
-                addr = PAGE_OFFSET + plat_dma_addr_to_phys(dma_handle);
+                addr = dma_addr_to_virt(dma_handle);
                 __dma_sync(addr + offset, size, direction);
         }
 }
@@ -279,7 +286,7 @@ void dma_sync_single_range_for_device(struct device *dev, dma_addr_t dma_handle,
         if (!plat_device_is_coherent(dev)) {
                 unsigned long addr;
 
-                addr = PAGE_OFFSET + plat_dma_addr_to_phys(dma_handle);
+                addr = dma_addr_to_virt(dma_handle);
                 __dma_sync(addr + offset, size, direction);
         }
 }
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index f08ae71c46ff..e9951c0e689f 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -123,7 +123,7 @@ static void __init kmap_coherent_init(void)
 static inline void kmap_coherent_init(void) {}
 #endif
 
-static inline void *kmap_coherent(struct page *page, unsigned long addr)
+void *kmap_coherent(struct page *page, unsigned long addr)
 {
         enum fixed_addresses idx;
         unsigned long vaddr, flags, entrylo;
@@ -177,7 +177,7 @@ static inline void *kmap_coherent(struct page *page, unsigned long addr)
 
 #define UNIQUE_ENTRYHI(idx) (CKSEG0 + ((idx) << (PAGE_SHIFT + 1)))
 
-static inline void kunmap_coherent(struct page *page)
+void kunmap_coherent(struct page *page)
 {
 #ifndef CONFIG_MIPS_MT_SMTC
         unsigned int wired;
@@ -377,7 +377,7 @@ void __init paging_init(void)
 #ifdef CONFIG_FLATMEM
         free_area_init(zones_size);
 #else
-        pfn = 0;
+        pfn = min_low_pfn;
         for (i = 0; i < MAX_NR_ZONES; i++)
                 for (j = 0; j < zones_size[i]; j++, pfn++)
                         if (!page_is_ram(pfn))
diff --git a/arch/mips/mm/pg-sb1.c b/arch/mips/mm/pg-sb1.c
index fc3c7878fb45..adb37d0a30ea 100644
--- a/arch/mips/mm/pg-sb1.c
+++ b/arch/mips/mm/pg-sb1.c
@@ -218,8 +218,7 @@ void sb1_dma_init(void)
         for (i = 0; i < DM_NUM_CHANNELS; i++) {
                 const u64 base_val = CPHYSADDR(&page_descr[i]) |
                                      V_DM_DSCR_BASE_RINGSZ(1);
-                volatile void *base_reg =
-                        IOADDR(A_DM_REGISTER(i, R_DM_DSCR_BASE));
+                void *base_reg = IOADDR(A_DM_REGISTER(i, R_DM_DSCR_BASE));
 
                 __raw_writeq(base_val, base_reg);
                 __raw_writeq(base_val | M_DM_DSCR_BASE_RESET, base_reg);
diff --git a/arch/mips/momentum/ocelot_c/irq.c b/arch/mips/momentum/ocelot_c/irq.c
index 40472f7944d7..844d566c9de3 100644
--- a/arch/mips/momentum/ocelot_c/irq.c
+++ b/arch/mips/momentum/ocelot_c/irq.c
@@ -64,7 +64,7 @@ extern void ll_cpci_irq(void);
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_cause() & read_c0_status();
+        unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
 
         if (pending & STATUSF_IP0)
                 do_IRQ(0);
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index 9d08608aaa51..69a8bcfe72b2 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -74,13 +74,13 @@ static inline void w_c0_ ## r ## n(unsigned int value)			\
 
 __define_perf_accessors(perfcntr, 0, 2)
 __define_perf_accessors(perfcntr, 1, 3)
-__define_perf_accessors(perfcntr, 2, 2)
-__define_perf_accessors(perfcntr, 3, 2)
+__define_perf_accessors(perfcntr, 2, 0)
+__define_perf_accessors(perfcntr, 3, 1)
 
 __define_perf_accessors(perfctrl, 0, 2)
 __define_perf_accessors(perfctrl, 1, 3)
-__define_perf_accessors(perfctrl, 2, 2)
-__define_perf_accessors(perfctrl, 3, 2)
+__define_perf_accessors(perfctrl, 2, 0)
+__define_perf_accessors(perfctrl, 3, 1)
 
 struct op_mips_model op_model_mipsxx_ops;
 
@@ -97,7 +97,6 @@ static void mipsxx_reg_setup(struct op_counter_config *ctr)
         int i;
 
         /* Compute the performance counter control word.  */
-        /* For now count kernel and user mode */
         for (i = 0; i < counters; i++) {
                 reg.control[i] = 0;
                 reg.counter[i] = 0;
@@ -234,9 +233,6 @@ static inline int n_counters(void)
                 counters = __n_counters();
         }
 
-#ifdef CONFIG_MIPS_MT_SMP
-        counters >> 1;
-#endif
         return counters;
 }
 
@@ -270,6 +266,10 @@ static int __init mipsxx_init(void)
 
         reset_counters(counters);
 
+#ifdef CONFIG_MIPS_MT_SMP
+        counters >>= 1;
+#endif
+
         op_model_mipsxx_ops.num_counters = counters;
         switch (current_cpu_data.cputype) {
         case CPU_20KC:
@@ -326,7 +326,11 @@ static int __init mipsxx_init(void)
 
 static void mipsxx_exit(void)
 {
-        reset_counters(op_model_mipsxx_ops.num_counters);
+        int counters = op_model_mipsxx_ops.num_counters;
+#ifdef CONFIG_MIPS_MT_SMP
+        counters <<= 1;
+#endif
+        reset_counters(counters);
 
         perf_irq = null_perf_irq;
 }
diff --git a/arch/mips/pci/pci-bcm1480.c b/arch/mips/pci/pci-bcm1480.c
index f6774f54cd3c..d7b9e1349f6d 100644
--- a/arch/mips/pci/pci-bcm1480.c
+++ b/arch/mips/pci/pci-bcm1480.c
@@ -216,7 +216,7 @@ static int __init bcm1480_pcibios_init(void)
         /*
          * See if the PCI bus has been configured by the firmware.
          */
-        reg = *((volatile uint64_t *) IOADDR(A_SCD_SYSTEM_CFG));
+        reg = __raw_readq(IOADDR(A_SCD_SYSTEM_CFG));
         if (!(reg & M_BCM1480_SYS_PCI_HOST)) {
                 bcm1480_bus_status |= PCI_DEVICE_MODE;
         } else {
diff --git a/arch/mips/pci/pci-sb1250.c b/arch/mips/pci/pci-sb1250.c
index 80f5e8c4bcd4..75c1246ced5f 100644
--- a/arch/mips/pci/pci-sb1250.c
+++ b/arch/mips/pci/pci-sb1250.c
@@ -228,7 +228,7 @@ static int __init sb1250_pcibios_init(void)
         /*
          * See if the PCI bus has been configured by the firmware.
          */
-        reg = *((volatile uint64_t *) IOADDR(A_SCD_SYSTEM_CFG));
+        reg = __raw_readq(IOADDR(A_SCD_SYSTEM_CFG));
         if (!(reg & M_SYS_PCI_HOST)) {
                 sb1250_bus_status |= PCI_DEVICE_MODE;
         } else {
diff --git a/arch/mips/philips/pnx8550/common/int.c b/arch/mips/philips/pnx8550/common/int.c
index d48665ebd33c..aad03429a5e3 100644
--- a/arch/mips/philips/pnx8550/common/int.c
+++ b/arch/mips/philips/pnx8550/common/int.c
@@ -83,16 +83,15 @@ static void timer_irqdispatch(int irq)
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_status() & read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
 
         if (pending & STATUSF_IP2)
                 hw0_irqdispatch(2);
         else if (pending & STATUSF_IP7) {
                 if (read_c0_config7() & 0x01c0)
                         timer_irqdispatch(7);
-        }
-
-        spurious_interrupt();
+        } else
+                spurious_interrupt();
 }
 
 static inline void modify_cp0_intmask(unsigned clr_mask, unsigned set_mask)
@@ -204,19 +203,7 @@ void __init arch_init_irq(void)
                  * Note, PCI INTA is active low on the bus, but inverted
                  * in the GIC, so to us it's active high.
                  */
-#ifdef CONFIG_PNX8550_V2PCI
-                if (gic_int_line == (PNX8550_INT_GPIO0 - PNX8550_INT_GIC_MIN)) {
-                        /* PCI INT through gpio 8, which is setup in
-                         * pnx8550_setup.c and routed to GPIO
-                         * Interrupt Level 0 (GPIO Connection 58).
-                         * Set it active low. */
-
-                        PNX8550_GIC_REQ(gic_int_line) = 0x1E020000;
-                } else
-#endif
-                {
-                        PNX8550_GIC_REQ(i - PNX8550_INT_GIC_MIN) = 0x1E000000;
-                }
+                PNX8550_GIC_REQ(i - PNX8550_INT_GIC_MIN) = 0x1E000000;
 
                 /* mask/priority is still 0 so we will not get any
                  * interrupts until it is unmasked */
diff --git a/arch/mips/qemu/q-smp.c b/arch/mips/qemu/q-smp.c
index 5a12354cd576..786bbfa214d1 100644
--- a/arch/mips/qemu/q-smp.c
+++ b/arch/mips/qemu/q-smp.c
@@ -46,3 +46,10 @@ void __init prom_prepare_cpus(unsigned int max_cpus)
 void prom_boot_secondary(int cpu, struct task_struct *idle)
 {
 }
+
+void __init plat_smp_setup(void)
+{
+}
+void __init plat_prepare_cpus(unsigned int max_cpus)
+{
+}
diff --git a/arch/mips/sgi-ip22/ip22-int.c b/arch/mips/sgi-ip22/ip22-int.c
index b454924aeb56..18348321795d 100644
--- a/arch/mips/sgi-ip22/ip22-int.c
+++ b/arch/mips/sgi-ip22/ip22-int.c
@@ -237,7 +237,7 @@ extern void indy_8254timer_irq(void);
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause();
 
         /*
          * First we check for r4k counter/timer IRQ.
diff --git a/arch/mips/sgi-ip32/ip32-irq.c b/arch/mips/sgi-ip32/ip32-irq.c
index 8c450d9e8696..fb9da9acf53f 100644
--- a/arch/mips/sgi-ip32/ip32-irq.c
+++ b/arch/mips/sgi-ip32/ip32-irq.c
@@ -454,7 +454,7 @@ static void ip32_irq5(void)
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause();
 
         if (likely(pending & IE_IRQ0))
                 ip32_irq0();
diff --git a/arch/mips/sibyte/bcm1480/smp.c b/arch/mips/sibyte/bcm1480/smp.c
index bf328277c775..6eac36d1b8c8 100644
--- a/arch/mips/sibyte/bcm1480/smp.c
+++ b/arch/mips/sibyte/bcm1480/smp.c
@@ -34,21 +34,21 @@ extern void smp_call_function_interrupt(void);
  * independent of board/firmware
  */
 
-static volatile void *mailbox_0_set_regs[] = {
+static void *mailbox_0_set_regs[] = {
         IOADDR(A_BCM1480_IMR_CPU0_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
         IOADDR(A_BCM1480_IMR_CPU1_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
         IOADDR(A_BCM1480_IMR_CPU2_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
         IOADDR(A_BCM1480_IMR_CPU3_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
 };
 
-static volatile void *mailbox_0_clear_regs[] = {
+static void *mailbox_0_clear_regs[] = {
         IOADDR(A_BCM1480_IMR_CPU0_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
         IOADDR(A_BCM1480_IMR_CPU1_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
         IOADDR(A_BCM1480_IMR_CPU2_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
         IOADDR(A_BCM1480_IMR_CPU3_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
 };
 
-static volatile void *mailbox_0_regs[] = {
+static void *mailbox_0_regs[] = {
         IOADDR(A_BCM1480_IMR_CPU0_BASE + R_BCM1480_IMR_MAILBOX_0_CPU),
         IOADDR(A_BCM1480_IMR_CPU1_BASE + R_BCM1480_IMR_MAILBOX_0_CPU),
         IOADDR(A_BCM1480_IMR_CPU2_BASE + R_BCM1480_IMR_MAILBOX_0_CPU),
diff --git a/arch/mips/sibyte/sb1250/irq.c b/arch/mips/sibyte/sb1250/irq.c
index 148239446e6e..0e6a13c0bd0e 100644
--- a/arch/mips/sibyte/sb1250/irq.c
+++ b/arch/mips/sibyte/sb1250/irq.c
@@ -421,7 +421,7 @@ asmlinkage void plat_irq_dispatch(void)
          * blasting the high 32 bits.
          */
 
-        pending = read_c0_cause() & read_c0_status();
+        pending = read_c0_cause() & read_c0_status() & ST0_IM;
 
 #ifdef CONFIG_SIBYTE_SB1250_PROF
         if (pending & CAUSEF_IP7) /* Cpu performance counter interrupt */
diff --git a/arch/mips/sibyte/swarm/setup.c b/arch/mips/sibyte/swarm/setup.c
index defa1f1452ad..83572d8f3e14 100644
--- a/arch/mips/sibyte/swarm/setup.c
+++ b/arch/mips/sibyte/swarm/setup.c
@@ -169,17 +169,19 @@ void __init plat_mem_setup(void)
 #define LEDS_PHYS MLEDS_PHYS
 #endif
 
-#define setled(index, c) \
-  ((unsigned char *)(IOADDR(LEDS_PHYS)+0x20))[(3-(index))<<3] = (c)
 void setleds(char *str)
 {
+        void *reg;
         int i;
+
         for (i = 0; i < 4; i++) {
-                if (!str[i]) {
-                        setled(i, ' ');
-                } else {
-                        setled(i, str[i]);
-                }
+                reg = IOADDR(LEDS_PHYS) + 0x20 + ((3 - i) << 3);
+
+                if (!str[i])
+                        writeb(' ', reg);
+                else
+                        writeb(str[i], reg);
         }
 }
-#endif
+
+#endif /* LEDS_PHYS */
diff --git a/arch/mips/sni/pcimt.c b/arch/mips/sni/pcimt.c
index 39e5b4abc555..8e8593b64f6a 100644
--- a/arch/mips/sni/pcimt.c
+++ b/arch/mips/sni/pcimt.c
@@ -333,7 +333,7 @@ static void pcimt_hwint3(void)
 
 static void sni_pcimt_hwint(void)
 {
-        u32 pending = (read_c0_cause() & read_c0_status());
+        u32 pending = read_c0_cause() & read_c0_status();
 
         if (pending & C_IRQ5)
                 do_IRQ (MIPS_CPU_IRQ_BASE + 7);
diff --git a/arch/mips/sni/pcit.c b/arch/mips/sni/pcit.c
index 8d6b3d5b13a1..1dfc3f00bbd3 100644
--- a/arch/mips/sni/pcit.c
+++ b/arch/mips/sni/pcit.c
@@ -271,7 +271,7 @@ static void pcit_hwint0(void)
 
 static void sni_pcit_hwint(void)
 {
-        u32 pending = (read_c0_cause() & read_c0_status());
+        u32 pending = read_c0_cause() & read_c0_status();
 
         if (pending & C_IRQ1)
                 pcit_hwint1();
@@ -285,7 +285,7 @@ static void sni_pcit_hwint(void)
 
 static void sni_pcit_hwint_cplus(void)
 {
-        u32 pending = (read_c0_cause() & read_c0_status());
+        u32 pending = read_c0_cause() & read_c0_status();
 
         if (pending & C_IRQ0)
                 pcit_hwint0();
diff --git a/arch/mips/tx4927/common/tx4927_irq.c b/arch/mips/tx4927/common/tx4927_irq.c
index e7f3e5b84dcf..3d25d010f3d5 100644
--- a/arch/mips/tx4927/common/tx4927_irq.c
+++ b/arch/mips/tx4927/common/tx4927_irq.c
@@ -416,7 +416,7 @@ static int tx4927_irq_nested(void)
 
 asmlinkage void plat_irq_dispatch(void)
 {
-        unsigned int pending = read_c0_status() & read_c0_cause();
+        unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
 
         if (pending & STATUSF_IP7)                      /* cpu timer */
                 do_IRQ(TX4927_IRQ_CPU_TIMER);
diff --git a/arch/powerpc/configs/cell_defconfig b/arch/powerpc/configs/cell_defconfig
index 24367319ce24..cf7e316ad4f6 100644
--- a/arch/powerpc/configs/cell_defconfig
+++ b/arch/powerpc/configs/cell_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.20-rc5
-# Mon Jan 22 22:12:56 2007
+# Linux kernel version: 2.6.21-rc3
+# Fri Mar  9 23:34:53 2007
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -61,6 +61,7 @@ CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
@@ -71,6 +72,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
 CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -133,6 +135,7 @@ CONFIG_PPC_MULTIPLATFORM=y
 # CONFIG_PPC_PSERIES is not set
 # CONFIG_PPC_ISERIES is not set
 # CONFIG_PPC_MPC52xx is not set
+# CONFIG_PPC_MPC5200 is not set
 # CONFIG_PPC_PMAC is not set
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_PASEMI is not set
@@ -140,8 +143,10 @@ CONFIG_PPC_CELL=y
 CONFIG_PPC_CELL_NATIVE=y
 CONFIG_PPC_IBM_CELL_BLADE=y
 CONFIG_PPC_PS3=y
+CONFIG_PPC_CELLEB=y
 CONFIG_PPC_NATIVE=y
 CONFIG_UDBG_RTAS_CONSOLE=y
+CONFIG_PPC_UDBG_BEAT=y
 # CONFIG_U3_DART is not set
 CONFIG_PPC_RTAS=y
 # CONFIG_RTAS_ERROR_LOGGING is not set
@@ -181,10 +186,13 @@ CONFIG_CBE_CPUFREQ=m
 #
 # PS3 Platform Options
 #
+# CONFIG_PS3_ADVANCED is not set
 CONFIG_PS3_HTAB_SIZE=20
 # CONFIG_PS3_DYNAMIC_DMA is not set
 CONFIG_PS3_USE_LPAR_ADDR=y
 CONFIG_PS3_VUART=y
+CONFIG_PS3_PS3AV=y
+CONFIG_PS3_SYS_MANAGER=y
 
 #
 # Kernel options
@@ -226,6 +234,7 @@ CONFIG_MEMORY_HOTPLUG_SPARSE=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
 CONFIG_RESOURCES_64BIT=y
+CONFIG_ZONE_DMA_FLAG=1
 CONFIG_ARCH_MEMORY_PROBE=y
 CONFIG_NODES_SPAN_OTHER_NODES=y
 CONFIG_PPC_64K_PAGES=y
@@ -239,6 +248,7 @@ CONFIG_ISA_DMA_API=y
 #
 # Bus options
 #
+CONFIG_ZONE_DMA=y
 CONFIG_GENERIC_ISA_DMA=y
 # CONFIG_MPIC_WEIRD is not set
 # CONFIG_PPC_I8259 is not set
@@ -274,6 +284,7 @@ CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
 # CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -340,6 +351,7 @@ CONFIG_NETFILTER_XT_TARGET_DSCP=m
 CONFIG_NETFILTER_XT_TARGET_MARK=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_MATCH_COMMENT=m
 CONFIG_NETFILTER_XT_MATCH_DCCP=m
 CONFIG_NETFILTER_XT_MATCH_DSCP=m
@@ -376,7 +388,6 @@ CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
 CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_TOS=m
 CONFIG_IP_NF_TARGET_ECN=m
@@ -444,6 +455,7 @@ CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
 
 #
@@ -464,6 +476,7 @@ CONFIG_FW_LOADER=y
 #
 # Plug and Play support
 #
+# CONFIG_PNPACPI is not set
 
 #
 # Block devices
@@ -483,7 +496,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=131072
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
-CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -537,6 +549,7 @@ CONFIG_BLK_DEV_AEC62XX=y
 # CONFIG_BLK_DEV_JMICRON is not set
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT8213 is not set
 # CONFIG_BLK_DEV_IT821X is not set
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
@@ -547,6 +560,8 @@ CONFIG_BLK_DEV_SIIMAGE=y
 # CONFIG_BLK_DEV_SLC90E66 is not set
 # CONFIG_BLK_DEV_TRM290 is not set
 # CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_BLK_DEV_TC86C001 is not set
+CONFIG_BLK_DEV_IDE_CELLEB=y
 # CONFIG_IDE_ARM is not set
 CONFIG_BLK_DEV_IDEDMA=y
 # CONFIG_IDEDMA_IVB is not set
@@ -557,7 +572,7 @@ CONFIG_IDEDMA_AUTO=y
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
-CONFIG_SCSI=m
+CONFIG_SCSI=y
 # CONFIG_SCSI_TGT is not set
 # CONFIG_SCSI_NETLINK is not set
 CONFIG_SCSI_PROC_FS=y
@@ -565,12 +580,12 @@ CONFIG_SCSI_PROC_FS=y
 #
 # SCSI support type (disk, tape, CD-ROM)
 #
-CONFIG_BLK_DEV_SD=m
+CONFIG_BLK_DEV_SD=y
 # CONFIG_CHR_DEV_ST is not set
 # CONFIG_CHR_DEV_OSST is not set
 CONFIG_BLK_DEV_SR=m
 # CONFIG_BLK_DEV_SR_VENDOR is not set
-CONFIG_CHR_DEV_SG=m
+CONFIG_CHR_DEV_SG=y
 # CONFIG_CHR_DEV_SCH is not set
 
 #
@@ -587,7 +602,7 @@ CONFIG_CHR_DEV_SG=m
 # CONFIG_SCSI_SPI_ATTRS is not set
 # CONFIG_SCSI_FC_ATTRS is not set
 # CONFIG_SCSI_ISCSI_ATTRS is not set
-# CONFIG_SCSI_SAS_ATTRS is not set
+CONFIG_SCSI_SAS_ATTRS=y
 # CONFIG_SCSI_SAS_LIBSAS is not set
 
 #
@@ -617,6 +632,7 @@ CONFIG_CHR_DEV_SG=m
 # CONFIG_SCSI_INIA100 is not set
 # CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
+# CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_QLA_ISCSI is not set
@@ -629,7 +645,60 @@ CONFIG_CHR_DEV_SG=m
 #
 # Serial ATA (prod) and Parallel ATA (experimental) drivers
 #
-# CONFIG_ATA is not set
+CONFIG_ATA=y
+# CONFIG_ATA_NONSTANDARD is not set
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_SVW is not set
+# CONFIG_ATA_PIIX is not set
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_SATA_QSTOR is not set
+CONFIG_SATA_PROMISE=y
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_SATA_INIC162X is not set
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_IT8213 is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_MARVELL is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SERVERWORKS is not set
+CONFIG_PATA_PDC2027X=m
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
+# CONFIG_PATA_SCC is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -655,10 +724,12 @@ CONFIG_DM_MULTIPATH=m
 #
 # Fusion MPT device support
 #
-# CONFIG_FUSION is not set
+CONFIG_FUSION=y
 # CONFIG_FUSION_SPI is not set
 # CONFIG_FUSION_FC is not set
-# CONFIG_FUSION_SAS is not set
+CONFIG_FUSION_SAS=y
+CONFIG_FUSION_MAX_SGE=128
+# CONFIG_FUSION_CTL is not set
 
 #
 # IEEE 1394 (FireWire) support
@@ -732,15 +803,18 @@ CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
 CONFIG_SPIDER_NET=y
 # CONFIG_QLA3XXX is not set
+# CONFIG_ATL1 is not set
 
 #
 # Ethernet (10000 Mbit)
 #
 # CONFIG_CHELSIO_T1 is not set
+# CONFIG_CHELSIO_T3 is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
 # CONFIG_MYRI10GE is not set
 # CONFIG_NETXEN_NIC is not set
+# CONFIG_PASEMI_MAC is not set
 
 #
 # Token Ring devices
@@ -853,16 +927,27 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_TXX9=y
+CONFIG_HAS_TXX9_SERIAL=y
+CONFIG_SERIAL_TXX9_NR_UARTS=2
+CONFIG_SERIAL_TXX9_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
+CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
 CONFIG_HVC_DRIVER=y
 CONFIG_HVC_RTAS=y
+# CONFIG_HVC_BEAT is not set
 
 #
 # IPMI
 #
-# CONFIG_IPMI_HANDLER is not set
+CONFIG_IPMI_HANDLER=m
+# CONFIG_IPMI_PANIC_EVENT is not set
+CONFIG_IPMI_DEVICE_INTERFACE=m
+CONFIG_IPMI_SI=m
+CONFIG_IPMI_WATCHDOG=m
+CONFIG_IPMI_POWEROFF=m
 
 #
 # Watchdog Cards
@@ -874,7 +959,7 @@ CONFIG_WATCHDOG=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_WATCHDOG_RTAS=y
+# CONFIG_WATCHDOG_RTAS is not set
 
 #
 # PCI-based Watchdog Cards
@@ -929,6 +1014,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PASEMI is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
 # CONFIG_I2C_SIS5595 is not set
@@ -973,6 +1059,11 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_HWMON_VID is not set
 
 #
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -986,7 +1077,7 @@ CONFIG_I2C_ALGOBIT=y
 #
 # Graphics support
 #
-CONFIG_FIRMWARE_EDID=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 # CONFIG_FB is not set
 # CONFIG_FB_IBM_GXT4500 is not set
 
@@ -995,7 +1086,6 @@ CONFIG_FIRMWARE_EDID=y
 #
 # CONFIG_VGA_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
-# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -1006,6 +1096,7 @@ CONFIG_DUMMY_CONSOLE=y
 # HID Devices
 #
 CONFIG_HID=m
+# CONFIG_HID_DEBUG is not set
 
 #
 # USB support
@@ -1020,9 +1111,7 @@ CONFIG_USB=m
 # Miscellaneous USB options
 #
 CONFIG_USB_DEVICEFS=y
-# CONFIG_USB_BANDWIDTH is not set
 # CONFIG_USB_DYNAMIC_MINORS is not set
-# CONFIG_USB_MULTITHREAD_PROBE is not set
 # CONFIG_USB_OTG is not set
 
 #
@@ -1032,9 +1121,15 @@ CONFIG_USB_EHCI_HCD=m
 # CONFIG_USB_EHCI_SPLIT_ISO is not set
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
 # CONFIG_USB_EHCI_TT_NEWSCHED is not set
+CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=m
-# CONFIG_USB_OHCI_BIG_ENDIAN is not set
+CONFIG_USB_OHCI_HCD_PPC_OF=y
+CONFIG_USB_OHCI_HCD_PPC_OF_BE=y
+# CONFIG_USB_OHCI_HCD_PPC_OF_LE is not set
+CONFIG_USB_OHCI_HCD_PCI=y
+CONFIG_USB_OHCI_BIG_ENDIAN_DESC=y
+CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
 CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_UHCI_HCD is not set
 # CONFIG_USB_SL811_HCD is not set
@@ -1088,6 +1183,7 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
+# CONFIG_USB_GTCO is not set
 
 #
 # USB Imaging devices
@@ -1125,6 +1221,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
+# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -1135,6 +1232,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1175,6 +1273,7 @@ CONFIG_INFINIBAND_MTHCA=m
 CONFIG_INFINIBAND_MTHCA_DEBUG=y
 # CONFIG_INFINIBAND_AMSO1100 is not set
 CONFIG_INFINIBAND_IPOIB=m
+# CONFIG_INFINIBAND_IPOIB_CM is not set
 CONFIG_INFINIBAND_IPOIB_DEBUG=y
 CONFIG_INFINIBAND_IPOIB_DEBUG_DATA=y
 # CONFIG_INFINIBAND_SRP is not set
@@ -1203,6 +1302,10 @@ CONFIG_INFINIBAND_IPOIB_DEBUG_DATA=y
 #
 
 #
+# Auxiliary Display support
+#
+
+#
 # Virtualization
 #
 
@@ -1395,7 +1498,8 @@ CONFIG_TEXTSEARCH_KMP=m
 CONFIG_TEXTSEARCH_BM=m
 CONFIG_TEXTSEARCH_FSM=m
 CONFIG_PLIST=y
-CONFIG_IOMAP_COPY=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
 
 #
 # Instrumentation Support
@@ -1414,15 +1518,16 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 # CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_SHIRQ is not set
 CONFIG_LOG_BUF_SHIFT=15
-CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_DETECT_SOFTLOCKUP is not set
 # CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_MUTEXES=y
-# CONFIG_DEBUG_RWSEMS is not set
 CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
@@ -1432,6 +1537,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_FAULT_INJECTION is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 CONFIG_DEBUGGER=y
@@ -1469,8 +1575,10 @@ CONFIG_CRYPTO_SHA1=m
 # CONFIG_CRYPTO_GF128MUL is not set
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_PCBC=m
 # CONFIG_CRYPTO_LRW is not set
 CONFIG_CRYPTO_DES=m
+# CONFIG_CRYPTO_FCRYPT is not set
 # CONFIG_CRYPTO_BLOWFISH is not set
 # CONFIG_CRYPTO_TWOFISH is not set
 # CONFIG_CRYPTO_SERPENT is not set
@@ -1484,6 +1592,7 @@ CONFIG_CRYPTO_DES=m
 CONFIG_CRYPTO_DEFLATE=m
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
 # CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_TEST is not set
 
 #
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index f3d4dd580dd6..e53b2988d1bf 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -465,8 +465,13 @@ void flush_thread(void)
 #ifdef CONFIG_PPC64
         struct thread_info *t = current_thread_info();
 
-        if (t->flags & _TIF_ABI_PENDING)
-                t->flags ^= (_TIF_ABI_PENDING | _TIF_32BIT);
+        if (test_ti_thread_flag(t, TIF_ABI_PENDING)) {
+                clear_ti_thread_flag(t, TIF_ABI_PENDING);
+                if (test_ti_thread_flag(t, TIF_32BIT))
+                        clear_ti_thread_flag(t, TIF_32BIT);
+                else
+                        set_ti_thread_flag(t, TIF_32BIT);
+        }
 #endif
 
         discard_lazy_cpu_state();
diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
index e738f93b42fe..a963f657222b 100644
--- a/arch/powerpc/kernel/udbg_16550.c
+++ b/arch/powerpc/kernel/udbg_16550.c
@@ -184,7 +184,7 @@ void udbg_pas_real_putc(char c)
 
 void udbg_init_pas_realmode(void)
 {
-        udbg_comport = (volatile struct NS16550 __iomem *)0xfcff03f8;
+        udbg_comport = (volatile struct NS16550 __iomem *)0xfcff03f8UL;
 
         udbg_putc = udbg_pas_real_putc;
         udbg_getc = NULL;
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index c0d2a694fa30..3c7fe2c65b5a 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -685,6 +685,9 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
                                        "non-cacheable mapping\n");
                                 psize = mmu_vmalloc_psize = MMU_PAGE_4K;
                         }
+#ifdef CONFIG_SPE_BASE
+                        spu_flush_all_slbs(mm);
+#endif
                 }
                 if (user_region) {
                         if (psize != get_paca()->context.user_psize) {
@@ -759,6 +762,9 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
                                 mmu_psize_defs[MMU_PAGE_4K].sllp;
                         get_paca()->context = mm->context;
                         slb_flush_and_rebolt();
+#ifdef CONFIG_SPE_BASE
+                        spu_flush_all_slbs(mm);
+#endif
                 }
         }
         if (mm->context.user_psize == MMU_PAGE_64K)
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 8c77c791f87e..f6ffaaa7a5bf 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -24,6 +24,7 @@
 #include <asm/machdep.h>
 #include <asm/cputable.h>
 #include <asm/tlb.h>
+#include <asm/spu.h>
 
 #include <linux/sysctl.h>
 
@@ -513,6 +514,9 @@ int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
         if ((addr + len) > 0x100000000UL)
                 err = open_high_hpage_areas(current->mm,
                                             HTLB_AREA_MASK(addr, len));
+#ifdef CONFIG_SPE_BASE
+        spu_flush_all_slbs(current->mm);
+#endif
         if (err) {
                 printk(KERN_DEBUG "prepare_hugepage_range(%lx, %lx)"
                        " failed (lowmask: 0x%04hx, highmask: 0x%04hx)\n",
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index c43999a10deb..eba7a2641dce 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -38,8 +38,61 @@
 const struct spu_management_ops *spu_management_ops;
 const struct spu_priv1_ops *spu_priv1_ops;
 
+static struct list_head spu_list[MAX_NUMNODES];
+static LIST_HEAD(spu_full_list);
+static DEFINE_MUTEX(spu_mutex);
+static spinlock_t spu_list_lock = SPIN_LOCK_UNLOCKED;
+
 EXPORT_SYMBOL_GPL(spu_priv1_ops);
 
+void spu_invalidate_slbs(struct spu *spu)
+{
+        struct spu_priv2 __iomem *priv2 = spu->priv2;
+
+        if (spu_mfc_sr1_get(spu) & MFC_STATE1_RELOCATE_MASK)
+                out_be64(&priv2->slb_invalidate_all_W, 0UL);
+}
+EXPORT_SYMBOL_GPL(spu_invalidate_slbs);
+
+/* This is called by the MM core when a segment size is changed, to
+ * request a flush of all the SPEs using a given mm
+ */
+void spu_flush_all_slbs(struct mm_struct *mm)
+{
+        struct spu *spu;
+        unsigned long flags;
+
+        spin_lock_irqsave(&spu_list_lock, flags);
+        list_for_each_entry(spu, &spu_full_list, full_list) {
+                if (spu->mm == mm)
+                        spu_invalidate_slbs(spu);
+        }
+        spin_unlock_irqrestore(&spu_list_lock, flags);
+}
+
+/* The hack below stinks... try to do something better one of
+ * these days... Does it even work properly with NR_CPUS == 1 ?
+ */
+static inline void mm_needs_global_tlbie(struct mm_struct *mm)
+{
+        int nr = (NR_CPUS > 1) ? NR_CPUS : NR_CPUS + 1;
+
+        /* Global TLBIE broadcast required with SPEs. */
+        __cpus_setall(&mm->cpu_vm_mask, nr);
+}
+
+void spu_associate_mm(struct spu *spu, struct mm_struct *mm)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&spu_list_lock, flags);
+        spu->mm = mm;
+        spin_unlock_irqrestore(&spu_list_lock, flags);
+        if (mm)
+                mm_needs_global_tlbie(mm);
+}
+EXPORT_SYMBOL_GPL(spu_associate_mm);
+
 static int __spu_trap_invalid_dma(struct spu *spu)
 {
         pr_debug("%s\n", __FUNCTION__);
@@ -74,6 +127,7 @@ static int __spu_trap_data_seg(struct spu *spu, unsigned long ea)
         struct spu_priv2 __iomem *priv2 = spu->priv2;
         struct mm_struct *mm = spu->mm;
         u64 esid, vsid, llp;
+        int psize;
 
         pr_debug("%s\n", __FUNCTION__);
 
@@ -90,22 +144,25 @@ static int __spu_trap_data_seg(struct spu *spu, unsigned long ea)
         case USER_REGION_ID:
 #ifdef CONFIG_HUGETLB_PAGE
                 if (in_hugepage_area(mm->context, ea))
-                        llp = mmu_psize_defs[mmu_huge_psize].sllp;
+                        psize = mmu_huge_psize;
                 else
 #endif
-                        llp = mmu_psize_defs[mmu_virtual_psize].sllp;
+                        psize = mm->context.user_psize;
                 vsid = (get_vsid(mm->context.id, ea) << SLB_VSID_SHIFT) |
-                                SLB_VSID_USER | llp;
+                                SLB_VSID_USER;
                 break;
         case VMALLOC_REGION_ID:
-                llp = mmu_psize_defs[mmu_virtual_psize].sllp;
+                if (ea < VMALLOC_END)
+                        psize = mmu_vmalloc_psize;
+                else
+                        psize = mmu_io_psize;
                 vsid = (get_kernel_vsid(ea) << SLB_VSID_SHIFT) |
-                        SLB_VSID_KERNEL | llp;
+                        SLB_VSID_KERNEL;
                 break;
         case KERNEL_REGION_ID:
-                llp = mmu_psize_defs[mmu_linear_psize].sllp;
+                psize = mmu_linear_psize;
                 vsid = (get_kernel_vsid(ea) << SLB_VSID_SHIFT) |
-                        SLB_VSID_KERNEL | llp;
+                        SLB_VSID_KERNEL;
                 break;
         default:
                 /* Future: support kernel segments so that drivers
@@ -114,9 +171,10 @@ static int __spu_trap_data_seg(struct spu *spu, unsigned long ea)
                 pr_debug("invalid region access at %016lx\n", ea);
                 return 1;
         }
+        llp = mmu_psize_defs[psize].sllp;
 
         out_be64(&priv2->slb_index_W, spu->slb_replace);
-        out_be64(&priv2->slb_vsid_RW, vsid);
+        out_be64(&priv2->slb_vsid_RW, vsid | llp);
         out_be64(&priv2->slb_esid_RW, esid);
 
         spu->slb_replace++;
@@ -330,10 +388,6 @@ static void spu_free_irqs(struct spu *spu)
                 free_irq(spu->irqs[2], spu);
 }
 
-static struct list_head spu_list[MAX_NUMNODES];
-static LIST_HEAD(spu_full_list);
-static DEFINE_MUTEX(spu_mutex);
-
 static void spu_init_channels(struct spu *spu)
 {
         static const struct {
@@ -593,6 +647,7 @@ static int __init create_spu(void *data)
         struct spu *spu;
         int ret;
         static int number;
+        unsigned long flags;
 
         ret = -ENOMEM;
         spu = kzalloc(sizeof (*spu), GFP_KERNEL);
@@ -620,8 +675,10 @@ static int __init create_spu(void *data)
                 goto out_free_irqs;
 
         mutex_lock(&spu_mutex);
+        spin_lock_irqsave(&spu_list_lock, flags);
         list_add(&spu->list, &spu_list[spu->node]);
         list_add(&spu->full_list, &spu_full_list);
+        spin_unlock_irqrestore(&spu_list_lock, flags);
         mutex_unlock(&spu_mutex);
 
         goto out;
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
index b00653d69c01..505266a568d4 100644
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -63,8 +63,8 @@ static ssize_t
 spufs_mem_read(struct file *file, char __user *buffer,
                                 size_t size, loff_t *pos)
 {
-        int ret;
         struct spu_context *ctx = file->private_data;
+        ssize_t ret;
 
         spu_acquire(ctx);
         ret = __spufs_mem_read(ctx, buffer, size, pos);
@@ -74,25 +74,29 @@ spufs_mem_read(struct file *file, char __user *buffer,
 
 static ssize_t
 spufs_mem_write(struct file *file, const char __user *buffer,
-                                        size_t size, loff_t *pos)
+                                        size_t size, loff_t *ppos)
 {
         struct spu_context *ctx = file->private_data;
         char *local_store;
+        loff_t pos = *ppos;
         int ret;
 
-        size = min_t(ssize_t, LS_SIZE - *pos, size);
-        if (size <= 0)
+        if (pos < 0)
+                return -EINVAL;
+        if (pos > LS_SIZE)
                 return -EFBIG;
-        *pos += size;
+        if (size > LS_SIZE - pos)
+                size = LS_SIZE - pos;
 
         spu_acquire(ctx);
-
         local_store = ctx->ops->get_ls(ctx);
-        ret = copy_from_user(local_store + *pos - size,
-                             buffer, size) ? -EFAULT : size;
-
+        ret = copy_from_user(local_store + pos, buffer, size);
         spu_release(ctx);
-        return ret;
+
+        if (ret)
+                return -EFAULT;
+        *ppos = pos + size;
+        return size;
 }
 
 static unsigned long spufs_mem_mmap_nopfn(struct vm_area_struct *vma,
diff --git a/arch/powerpc/platforms/cell/spufs/run.c b/arch/powerpc/platforms/cell/spufs/run.c
index 353a8fa07ab8..f95a611ca362 100644
--- a/arch/powerpc/platforms/cell/spufs/run.c
+++ b/arch/powerpc/platforms/cell/spufs/run.c
@@ -143,7 +143,7 @@ static inline int spu_run_init(struct spu_context *ctx, u32 * npc)
         int ret;
         unsigned long runcntl = SPU_RUNCNTL_RUNNABLE;
 
-        ret = spu_acquire_runnable(ctx, SPU_ACTIVATE_NOWAKE);
+        ret = spu_acquire_runnable(ctx, 0);
         if (ret)
                 return ret;
 
@@ -155,7 +155,7 @@ static inline int spu_run_init(struct spu_context *ctx, u32 * npc)
                         spu_release(ctx);
                         ret = spu_setup_isolated(ctx);
                         if (!ret)
-                                ret = spu_acquire_runnable(ctx, SPU_ACTIVATE_NOWAKE);
+                                ret = spu_acquire_runnable(ctx, 0);
                 }
 
                 /* if userspace has set the runcntrl register (eg, to issue an
diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c
index 2f25e68b4bac..39823cec0844 100644
--- a/arch/powerpc/platforms/cell/spufs/sched.c
+++ b/arch/powerpc/platforms/cell/spufs/sched.c
@@ -127,14 +127,6 @@ static void spu_remove_from_active_list(struct spu *spu)
         mutex_unlock(&spu_prio->active_mutex[node]);
 }
 
-static inline void mm_needs_global_tlbie(struct mm_struct *mm)
-{
-        int nr = (NR_CPUS > 1) ? NR_CPUS : NR_CPUS + 1;
-
-        /* Global TLBIE broadcast required with SPEs. */
-        __cpus_setall(&mm->cpu_vm_mask, nr);
-}
-
 static BLOCKING_NOTIFIER_HEAD(spu_switch_notifier);
 
 static void spu_switch_notify(struct spu *spu, struct spu_context *ctx)
@@ -167,8 +159,7 @@ static void spu_bind_context(struct spu *spu, struct spu_context *ctx)
         ctx->spu = spu;
         ctx->ops = &spu_hw_ops;
         spu->pid = current->pid;
-        spu->mm = ctx->owner;
-        mm_needs_global_tlbie(spu->mm);
+        spu_associate_mm(spu, ctx->owner);
         spu->ibox_callback = spufs_ibox_callback;
         spu->wbox_callback = spufs_wbox_callback;
         spu->stop_callback = spufs_stop_callback;
@@ -205,7 +196,7 @@ static void spu_unbind_context(struct spu *spu, struct spu_context *ctx)
         spu->stop_callback = NULL;
         spu->mfc_callback = NULL;
         spu->dma_callback = NULL;
-        spu->mm = NULL;
+        spu_associate_mm(spu, NULL);
         spu->pid = 0;
         ctx->ops = &spu_backing_ops;
         ctx->spu = NULL;
@@ -263,7 +254,6 @@ static void spu_prio_wait(struct spu_context *ctx)
 {
         DEFINE_WAIT(wait);
 
-        set_bit(SPU_SCHED_WAKE, &ctx->sched_flags);
         prepare_to_wait_exclusive(&ctx->stop_wq, &wait, TASK_INTERRUPTIBLE);
         if (!signal_pending(current)) {
                 mutex_unlock(&ctx->state_mutex);
@@ -272,7 +262,6 @@ static void spu_prio_wait(struct spu_context *ctx)
         }
         __set_current_state(TASK_RUNNING);
         remove_wait_queue(&ctx->stop_wq, &wait);
-        clear_bit(SPU_SCHED_WAKE, &ctx->sched_flags);
 }
 
 /**
@@ -292,7 +281,7 @@ static void spu_reschedule(struct spu *spu)
         best = sched_find_first_bit(spu_prio->bitmap);
         if (best < MAX_PRIO) {
                 struct spu_context *ctx = spu_grab_context(best);
-                if (ctx && test_bit(SPU_SCHED_WAKE, &ctx->sched_flags))
+                if (ctx)
                         wake_up(&ctx->stop_wq);
         }
         spin_unlock(&spu_prio->runq_lock);
@@ -414,8 +403,7 @@ int spu_activate(struct spu_context *ctx, unsigned long flags)
                 }
 
                 spu_add_to_rq(ctx);
-                if (!(flags & SPU_ACTIVATE_NOWAKE))
-                        spu_prio_wait(ctx);
+                spu_prio_wait(ctx);
                 spu_del_from_rq(ctx);
         } while (!signal_pending(current));
 
diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h
index 0c437891dfd5..5c4e47d69d79 100644
--- a/arch/powerpc/platforms/cell/spufs/spufs.h
+++ b/arch/powerpc/platforms/cell/spufs/spufs.h
@@ -41,7 +41,7 @@ struct spu_gang;
 
 /* ctx->sched_flags */
 enum {
-        SPU_SCHED_WAKE = 0,
+        SPU_SCHED_WAKE = 0, /* currently unused */
 };
 
 struct spu_context {
@@ -191,9 +191,7 @@ void spu_forget(struct spu_context *ctx);
 int spu_acquire_runnable(struct spu_context *ctx, unsigned long flags);
 void spu_acquire_saved(struct spu_context *ctx);
 int spu_acquire_exclusive(struct spu_context *ctx);
-enum {
-        SPU_ACTIVATE_NOWAKE = 1,
-};
+
 int spu_activate(struct spu_context *ctx, unsigned long flags);
 void spu_deactivate(struct spu_context *ctx);
 void spu_yield(struct spu_context *ctx);
diff --git a/arch/powerpc/platforms/cell/spufs/switch.c b/arch/powerpc/platforms/cell/spufs/switch.c
index c08981ff7fc6..fd91c73de34e 100644
--- a/arch/powerpc/platforms/cell/spufs/switch.c
+++ b/arch/powerpc/platforms/cell/spufs/switch.c
@@ -468,26 +468,6 @@ static inline void wait_purge_complete(struct spu_state *csa, struct spu *spu)
                          MFC_CNTL_PURGE_DMA_COMPLETE);
 }
 
-static inline void save_mfc_slbs(struct spu_state *csa, struct spu *spu)
-{
-        struct spu_priv2 __iomem *priv2 = spu->priv2;
-        int i;
-
-        /* Save, Step 29:
-         *     If MFC_SR1[R]='1', save SLBs in CSA.
-         */
-        if (spu_mfc_sr1_get(spu) & MFC_STATE1_RELOCATE_MASK) {
-                csa->priv2.slb_index_W = in_be64(&priv2->slb_index_W);
-                for (i = 0; i < 8; i++) {
-                        out_be64(&priv2->slb_index_W, i);
-                        eieio();
-                        csa->slb_esid_RW[i] = in_be64(&priv2->slb_esid_RW);
-                        csa->slb_vsid_RW[i] = in_be64(&priv2->slb_vsid_RW);
-                        eieio();
-                }
-        }
-}
-
 static inline void setup_mfc_sr1(struct spu_state *csa, struct spu *spu)
 {
         /* Save, Step 30:
@@ -708,20 +688,6 @@ static inline void resume_mfc_queue(struct spu_state *csa, struct spu *spu)
         out_be64(&priv2->mfc_control_RW, MFC_CNTL_RESUME_DMA_QUEUE);
 }
 
-static inline void invalidate_slbs(struct spu_state *csa, struct spu *spu)
-{
-        struct spu_priv2 __iomem *priv2 = spu->priv2;
-
-        /* Save, Step 45:
-         * Restore, Step 19:
-         *     If MFC_SR1[R]=1, write 0 to SLB_Invalidate_All.
-         */
-        if (spu_mfc_sr1_get(spu) & MFC_STATE1_RELOCATE_MASK) {
-                out_be64(&priv2->slb_invalidate_all_W, 0UL);
-                eieio();
-        }
-}
-
 static inline void get_kernel_slb(u64 ea, u64 slb[2])
 {
         u64 llp;
@@ -765,7 +731,7 @@ static inline void setup_mfc_slbs(struct spu_state *csa, struct spu *spu)
          *     MFC_SR1[R]=1 (in other words, assume that
          *     translation is desired by OS environment).
          */
-        invalidate_slbs(csa, spu);
+        spu_invalidate_slbs(spu);
         get_kernel_slb((unsigned long)&spu_save_code[0], code_slb);
         get_kernel_slb((unsigned long)csa->lscsa, lscsa_slb);
         load_mfc_slb(spu, code_slb, 0);
@@ -1718,27 +1684,6 @@ static inline void check_ppuint_mb_stat(struct spu_state *csa, struct spu *spu)
         }
 }
 
-static inline void restore_mfc_slbs(struct spu_state *csa, struct spu *spu)
-{
-        struct spu_priv2 __iomem *priv2 = spu->priv2;
-        int i;
-
-        /* Restore, Step 68:
-         *     If MFC_SR1[R]='1', restore SLBs from CSA.
-         */
-        if (csa->priv1.mfc_sr1_RW & MFC_STATE1_RELOCATE_MASK) {
-                for (i = 0; i < 8; i++) {
-                        out_be64(&priv2->slb_index_W, i);
-                        eieio();
-                        out_be64(&priv2->slb_esid_RW, csa->slb_esid_RW[i]);
-                        out_be64(&priv2->slb_vsid_RW, csa->slb_vsid_RW[i]);
-                        eieio();
-                }
-                out_be64(&priv2->slb_index_W, csa->priv2.slb_index_W);
-                eieio();
-        }
-}
-
 static inline void restore_mfc_sr1(struct spu_state *csa, struct spu *spu)
 {
         /* Restore, Step 69:
@@ -1875,7 +1820,6 @@ static void save_csa(struct spu_state *prev, struct spu *spu)
         set_mfc_tclass_id(prev, spu);   /* Step 26. */
         purge_mfc_queue(prev, spu);     /* Step 27. */
         wait_purge_complete(prev, spu); /* Step 28. */
-        save_mfc_slbs(prev, spu);       /* Step 29. */
         setup_mfc_sr1(prev, spu);       /* Step 30. */
         save_spu_npc(prev, spu);        /* Step 31. */
         save_spu_privcntl(prev, spu);   /* Step 32. */
@@ -1987,7 +1931,7 @@ static void harvest(struct spu_state *prev, struct spu *spu)
         reset_spu_privcntl(prev, spu);          /* Step 16. */
         reset_spu_lslr(prev, spu);              /* Step 17. */
         setup_mfc_sr1(prev, spu);               /* Step 18. */
-        invalidate_slbs(prev, spu);             /* Step 19. */
+        spu_invalidate_slbs(spu);               /* Step 19. */
         reset_ch_part1(prev, spu);              /* Step 20. */
         reset_ch_part2(prev, spu);              /* Step 21. */
         enable_interrupts(prev, spu);           /* Step 22. */
@@ -2055,7 +1999,7 @@ static void restore_csa(struct spu_state *next, struct spu *spu)
         restore_spu_mb(next, spu);              /* Step 65. */
         check_ppu_mb_stat(next, spu);           /* Step 66. */
         check_ppuint_mb_stat(next, spu);        /* Step 67. */
-        restore_mfc_slbs(next, spu);            /* Step 68. */
+        spu_invalidate_slbs(spu);               /* Modified Step 68. */
         restore_mfc_sr1(next, spu);             /* Step 69. */
         restore_other_spu_access(next, spu);    /* Step 70. */
         restore_spu_runcntl(next, spu);         /* Step 71. */
diff --git a/arch/powerpc/platforms/pasemi/iommu.c b/arch/powerpc/platforms/pasemi/iommu.c
index 459a53b7d24d..71dbf1a56e13 100644
--- a/arch/powerpc/platforms/pasemi/iommu.c
+++ b/arch/powerpc/platforms/pasemi/iommu.c
@@ -77,7 +77,7 @@
 #define IOBMAP_L2E_V            0x80000000
 #define IOBMAP_L2E_V_CACHED     0xc0000000
 
-static u32 *iob;
+static u32 __iomem *iob;
 static u32 iob_l1_emptyval;
 static u32 iob_l2_emptyval;
 static u32 *iob_l2_base;
diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c
index 42354de3f557..2014d2b44449 100644
--- a/arch/powerpc/platforms/ps3/mm.c
+++ b/arch/powerpc/platforms/ps3/mm.c
@@ -294,7 +294,7 @@ static int __init ps3_mm_add_memory(void)
         unsigned long nr_pages;
 
         if (!firmware_has_feature(FW_FEATURE_PS3_LV1))
-                return 0;
+                return -ENODEV;
 
         BUG_ON(!mem_init_done);
 
diff --git a/arch/powerpc/platforms/ps3/system-bus.c b/arch/powerpc/platforms/ps3/system-bus.c
index a9f7e4a39a2a..3c48cce98a5c 100644
--- a/arch/powerpc/platforms/ps3/system-bus.c
+++ b/arch/powerpc/platforms/ps3/system-bus.c
@@ -172,7 +172,7 @@ int __init ps3_system_bus_init(void)
         int result;
 
         if (!firmware_has_feature(FW_FEATURE_PS3_LV1))
-                return 0;
+                return -ENODEV;
 
         result = bus_register(&ps3_system_bus_type);
         BUG_ON(result);
diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
index 5c7e38789897..c1427b3634ec 100644
--- a/arch/powerpc/platforms/pseries/hvCall.S
+++ b/arch/powerpc/platforms/pseries/hvCall.S
@@ -30,9 +30,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_PURR);
         
 /*
  * postcall is performed immediately before function return which
- * allows liberal use of volatile registers.
+ * allows liberal use of volatile registers.  We branch around this
+ * in early init (eg when populating the MMU hashtable) by using an
+ * unconditional cpu feature.
  */
 #define HCALL_INST_POSTCALL                                     \
+BEGIN_FTR_SECTION;                                              \
+        b       1f;                                             \
+END_FTR_SECTION(0, 1);                                          \
         ld      r4,STK_PARM(r3)(r1);    /* validate opcode */   \
         cmpldi  cr7,r4,MAX_HCALL_OPCODE;                        \
         bgt-    cr7,1f;                                         \
@@ -123,6 +128,40 @@ _GLOBAL(plpar_hcall)
 
         blr                             /* return r3 = status */
 
+/*
+ * plpar_hcall_raw can be called in real mode. kexec/kdump need some
+ * hypervisor calls to be executed in real mode. So plpar_hcall_raw
+ * does not access the per cpu hypervisor call statistics variables,
+ * since these variables may not be present in the RMO region.
+ */
+_GLOBAL(plpar_hcall_raw)
+        HMT_MEDIUM
+
+        mfcr    r0
+        stw     r0,8(r1)
+
+        std     r4,STK_PARM(r4)(r1)     /* Save ret buffer */
+
+        mr      r4,r5
+        mr      r5,r6
+        mr      r6,r7
+        mr      r7,r8
+        mr      r8,r9
+        mr      r9,r10
+
+        HVSC                            /* invoke the hypervisor */
+
+        ld      r12,STK_PARM(r4)(r1)
+        std     r4,  0(r12)
+        std     r5,  8(r12)
+        std     r6, 16(r12)
+        std     r7, 24(r12)
+
+        lwz     r0,8(r1)
+        mtcrf   0xff,r0
+
+        blr                             /* return r3 = status */
+
 _GLOBAL(plpar_hcall9)
         HMT_MEDIUM
 
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 7496005566ef..843ee9643211 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -378,7 +378,7 @@ static void pSeries_lpar_hptab_clear(void)
 
         /* TODO: Use bulk call */
         for (i = 0; i < hpte_count; i++)
-                plpar_pte_remove(0, i, 0, &dummy1, &dummy2);
+                plpar_pte_remove_raw(0, i, 0, &dummy1, &dummy2);
 }
 
 /*
diff --git a/arch/powerpc/platforms/pseries/plpar_wrappers.h b/arch/powerpc/platforms/pseries/plpar_wrappers.h
index 3eb7b294d92f..2e4d10c9eea8 100644
--- a/arch/powerpc/platforms/pseries/plpar_wrappers.h
+++ b/arch/powerpc/platforms/pseries/plpar_wrappers.h
@@ -78,6 +78,22 @@ static inline long plpar_pte_remove(unsigned long flags, unsigned long ptex,
         return rc;
 }
 
+/* plpar_pte_remove_raw can be called in real mode. It calls plpar_hcall_raw */
+static inline long plpar_pte_remove_raw(unsigned long flags, unsigned long ptex,
+                unsigned long avpn, unsigned long *old_pteh_ret,
+                unsigned long *old_ptel_ret)
+{
+        long rc;
+        unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+
+        rc = plpar_hcall_raw(H_REMOVE, retbuf, flags, ptex, avpn);
+
+        *old_pteh_ret = retbuf[0];
+        *old_ptel_ret = retbuf[1];
+
+        return rc;
+}
+
 static inline long plpar_pte_read(unsigned long flags, unsigned long ptex,
                 unsigned long *old_pteh_ret, unsigned long *old_ptel_ret)
 {
diff --git a/arch/s390/appldata/appldata_mem.c b/arch/s390/appldata/appldata_mem.c
index 4ca615788702..697eb30a68a3 100644
--- a/arch/s390/appldata/appldata_mem.c
+++ b/arch/s390/appldata/appldata_mem.c
@@ -117,7 +117,10 @@ static void appldata_get_mem_data(void *data)
         mem_data->pgpgout    = ev[PGPGOUT] >> 1;
         mem_data->pswpin     = ev[PSWPIN];
         mem_data->pswpout    = ev[PSWPOUT];
-        mem_data->pgalloc    = ev[PGALLOC_NORMAL] + ev[PGALLOC_DMA];
+        mem_data->pgalloc    = ev[PGALLOC_NORMAL];
+#ifdef CONFIG_ZONE_DMA
+        mem_data->pgalloc    += ev[PGALLOC_DMA];
+#endif
         mem_data->pgfault    = ev[PGFAULT];
         mem_data->pgmajfault = ev[PGMAJFAULT];
 
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 97901296894e..32a69a18a796 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1665,3 +1665,20 @@ sys_getcpu_wrapper:
         llgtr   %r3,%r3                 # unsigned *
         llgtr   %r4,%r4                 # struct getcpu_cache *
         jg      sys_getcpu
+
+        .globl  compat_sys_epoll_pwait_wrapper
+compat_sys_epoll_pwait_wrapper:
+        lgfr    %r2,%r2                 # int
+        llgtr   %r3,%r3                 # struct compat_epoll_event *
+        lgfr    %r4,%r4                 # int
+        lgfr    %r5,%r5                 # int
+        llgtr   %r6,%r6                 # compat_sigset_t *
+        llgf    %r0,164(%r15)           # compat_size_t
+        stg     %r0,160(%r15)
+        jg      compat_sys_epoll_pwait
+
+        .globl  compat_sys_utimes_wrapper
+compat_sys_utimes_wrapper:
+        llgtr   %r2,%r2                 # char *
+        llgtr   %r3,%r3                 # struct compat_timeval *
+        jg      compat_sys_utimes
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index eca3fe595ff4..dca6eaf82c80 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -268,7 +268,7 @@ debug_info_alloc(char *name, int pages_per_area, int nr_areas, int buf_size,
         rc->level          = level;
         rc->buf_size       = buf_size;
         rc->entry_size     = sizeof(debug_entry_t) + buf_size;
-        strlcpy(rc->name, name, sizeof(rc->name)-1);
+        strlcpy(rc->name, name, sizeof(rc->name));
         memset(rc->views, 0, DEBUG_MAX_VIEWS * sizeof(struct debug_view *));
         memset(rc->debugfs_entries, 0 ,DEBUG_MAX_VIEWS *
                 sizeof(struct dentry*));
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index afca1c6f4d21..5e47936573f2 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -141,9 +141,9 @@ static noinline __init void detect_machine_type(void)
                 machine_flags |= 4;
 }
 
+#ifdef CONFIG_64BIT
 static noinline __init int memory_fast_detect(void)
 {
-
         unsigned long val0 = 0;
         unsigned long val1 = 0xc;
         int ret = -ENOSYS;
@@ -161,9 +161,15 @@ static noinline __init int memory_fast_detect(void)
         if (ret || val0 != val1)
                 return -ENOSYS;
 
-        memory_chunk[0].size = val0;
+        memory_chunk[0].size = val0 + 1;
         return 0;
 }
+#else
+static inline int memory_fast_detect(void)
+{
+        return -ENOSYS;
+}
+#endif
 
 #define ADDR2G  (1UL << 31)
 
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index d125a4ead08d..f731185bf2bd 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -839,7 +839,7 @@ static int __init reipl_ccw_init(void)
         }
         reipl_block_ccw->hdr.len = IPL_PARM_BLK_CCW_LEN;
         reipl_block_ccw->hdr.version = IPL_PARM_BLOCK_VERSION;
-        reipl_block_ccw->hdr.blk0_len = sizeof(reipl_block_ccw->ipl_info.ccw);
+        reipl_block_ccw->hdr.blk0_len = IPL_PARM_BLK0_CCW_LEN;
         reipl_block_ccw->hdr.pbt = DIAG308_IPL_TYPE_CCW;
         /* check if read scp info worked and set loadparm */
         if (SCCB_VALID)
@@ -880,8 +880,7 @@ static int __init reipl_fcp_init(void)
         } else {
                 reipl_block_fcp->hdr.len = IPL_PARM_BLK_FCP_LEN;
                 reipl_block_fcp->hdr.version = IPL_PARM_BLOCK_VERSION;
-                reipl_block_fcp->hdr.blk0_len =
-                        sizeof(reipl_block_fcp->ipl_info.fcp);
+                reipl_block_fcp->hdr.blk0_len = IPL_PARM_BLK0_FCP_LEN;
                 reipl_block_fcp->hdr.pbt = DIAG308_IPL_TYPE_FCP;
                 reipl_block_fcp->ipl_info.fcp.opt = DIAG308_IPL_OPT_IPL;
         }
@@ -930,7 +929,7 @@ static int __init dump_ccw_init(void)
         }
         dump_block_ccw->hdr.len = IPL_PARM_BLK_CCW_LEN;
         dump_block_ccw->hdr.version = IPL_PARM_BLOCK_VERSION;
-        dump_block_ccw->hdr.blk0_len = sizeof(reipl_block_ccw->ipl_info.ccw);
+        dump_block_ccw->hdr.blk0_len = IPL_PARM_BLK0_CCW_LEN;
         dump_block_ccw->hdr.pbt = DIAG308_IPL_TYPE_CCW;
         dump_capabilities |= IPL_TYPE_CCW;
         return 0;
@@ -954,7 +953,7 @@ static int __init dump_fcp_init(void)
         }
         dump_block_fcp->hdr.len = IPL_PARM_BLK_FCP_LEN;
         dump_block_fcp->hdr.version = IPL_PARM_BLOCK_VERSION;
-        dump_block_fcp->hdr.blk0_len = sizeof(dump_block_fcp->ipl_info.fcp);
+        dump_block_fcp->hdr.blk0_len = IPL_PARM_BLK0_FCP_LEN;
         dump_block_fcp->hdr.pbt = DIAG308_IPL_TYPE_FCP;
         dump_block_fcp->ipl_info.fcp.opt = DIAG308_IPL_OPT_DUMP;
         dump_capabilities |= IPL_TYPE_FCP;
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 8af549e95730..993f35381496 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -167,7 +167,7 @@ static int __kprobes swap_instruction(void *aref)
          * shall not cross any page boundaries (vmalloc area!) when writing
          * the new instruction.
          */
-        addr = (u32 *)ALIGN((unsigned long)args->ptr, 4);
+        addr = (u32 *)((unsigned long)args->ptr & -4UL);
         if ((unsigned long)args->ptr & 2)
                 instr = ((*addr) & 0xffff0000) | args->new;
         else
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index a52c44455bf0..c774f1069e10 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -320,4 +320,5 @@ SYSCALL(sys_tee,sys_tee,sys_tee_wrapper)
 SYSCALL(sys_vmsplice,sys_vmsplice,compat_sys_vmsplice_wrapper)
 NI_SYSCALL                                                      /* 310 sys_move_pages */
 SYSCALL(sys_getcpu,sys_getcpu,sys_getcpu_wrapper)
-SYSCALL(sys_epoll_pwait,sys_epoll_pwait,sys_ni_syscall)
+SYSCALL(sys_epoll_pwait,sys_epoll_pwait,compat_sys_epoll_pwait_wrapper)
+SYSCALL(sys_utimes,sys_utimes,compat_sys_utimes_wrapper)
diff --git a/arch/sh/drivers/pci/pci-auto.c b/arch/sh/drivers/pci/pci-auto.c
index ecf16344f94a..224e007736fb 100644
--- a/arch/sh/drivers/pci/pci-auto.c
+++ b/arch/sh/drivers/pci/pci-auto.c
@@ -214,6 +214,12 @@ retry:
                         continue;
                 }
 
+                if (bar_value < *lower_limit || (bar_value + bar_size) >= *upper_limit) {
+                        DBG(" unavailable -- skipping, value %x size %x\n",
+                                        bar_value, bar_size);
+                        continue;
+                }
+
 #ifdef CONFIG_PCI_AUTO_UPDATE_RESOURCES
                 /* Write it out and update our limit */
                 early_write_config_dword(hose, top_bus, current_bus, pci_devfn,
diff --git a/arch/sh/kernel/cpu/init.c b/arch/sh/kernel/cpu/init.c
index 4b339a640b13..726acfcb9b77 100644
--- a/arch/sh/kernel/cpu/init.c
+++ b/arch/sh/kernel/cpu/init.c
@@ -3,7 +3,7 @@
  *
  * CPU init code
  *
- * Copyright (C) 2002 - 2006  Paul Mundt
+ * Copyright (C) 2002 - 2007  Paul Mundt
  * Copyright (C) 2003  Richard Curnow
  *
  * This file is subject to the terms and conditions of the GNU General Public
@@ -48,8 +48,19 @@ static void __init cache_init(void)
 {
         unsigned long ccr, flags;
 
-        if (current_cpu_data.type == CPU_SH_NONE)
-                panic("Unknown CPU");
+        /* First setup the rest of the I-cache info */
+        current_cpu_data.icache.entry_mask = current_cpu_data.icache.way_incr -
+                                      current_cpu_data.icache.linesz;
+
+        current_cpu_data.icache.way_size = current_cpu_data.icache.sets *
+                                    current_cpu_data.icache.linesz;
+
+        /* And the D-cache too */
+        current_cpu_data.dcache.entry_mask = current_cpu_data.dcache.way_incr -
+                                      current_cpu_data.dcache.linesz;
+
+        current_cpu_data.dcache.way_size = current_cpu_data.dcache.sets *
+                                    current_cpu_data.dcache.linesz;
 
         jump_to_P2();
         ccr = ctrl_inl(CCR);
@@ -200,6 +211,9 @@ asmlinkage void __init sh_cpu_init(void)
         /* First, probe the CPU */
         detect_cpu_and_cache_system();
 
+        if (current_cpu_data.type == CPU_SH_NONE)
+                panic("Unknown CPU");
+
         /* Init the cache */
         cache_init();
 
diff --git a/arch/sh/kernel/cpu/sh2/entry.S b/arch/sh/kernel/cpu/sh2/entry.S
index 7f7d292f36ec..c16dc8fec489 100644
--- a/arch/sh/kernel/cpu/sh2/entry.S
+++ b/arch/sh/kernel/cpu/sh2/entry.S
@@ -165,6 +165,7 @@ ENTRY(exception_handler)
 
 interrupt_entry:
         mov     r9,r4
+        mov     r15,r5
         mov.l   6f,r9
         mov.l   7f,r8
         jmp     @r8
diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S
index c19205b0f2c0..f3e827f29a46 100644
--- a/arch/sh/kernel/cpu/sh3/entry.S
+++ b/arch/sh/kernel/cpu/sh3/entry.S
@@ -514,13 +514,16 @@ skip_save:
 
 interrupt_exception:
         mov.l   1f, r9
+        mov.l   2f, r4
+        mov.l   @r4, r4
         jmp     @r9
-         nop
+         mov    r15, r5
         rts
          nop
 
         .align 2
 1:      .long   do_IRQ
+2:      .long   INTEVT
 
         .align  2
 ENTRY(exception_none)
diff --git a/arch/sh/kernel/cpu/sh4/probe.c b/arch/sh/kernel/cpu/sh4/probe.c
index 9d28c88d2f9d..58950de2696d 100644
--- a/arch/sh/kernel/cpu/sh4/probe.c
+++ b/arch/sh/kernel/cpu/sh4/probe.c
@@ -195,13 +195,6 @@ int __init detect_cpu_and_cache_system(void)
 
         }
 
-        /* Setup the rest of the I-cache info */
-        current_cpu_data.icache.entry_mask = current_cpu_data.icache.way_incr -
-                                      current_cpu_data.icache.linesz;
-
-        current_cpu_data.icache.way_size = current_cpu_data.icache.sets *
-                                    current_cpu_data.icache.linesz;
-
         /* And the rest of the D-cache */
         if (current_cpu_data.dcache.ways > 1) {
                 size = sizes[(cvr >> 16) & 0xf];
@@ -209,12 +202,6 @@ int __init detect_cpu_and_cache_system(void)
                 current_cpu_data.dcache.sets            = (size >> 6);
         }
 
-        current_cpu_data.dcache.entry_mask = current_cpu_data.dcache.way_incr -
-                                      current_cpu_data.dcache.linesz;
-
-        current_cpu_data.dcache.way_size = current_cpu_data.dcache.sets *
-                                    current_cpu_data.dcache.linesz;
-
         /*
          * Setup the L2 cache desc
          *
diff --git a/arch/sh/kernel/irq.c b/arch/sh/kernel/irq.c
index 67be2b6e8cd1..9bdd8a00cd4a 100644
--- a/arch/sh/kernel/irq.c
+++ b/arch/sh/kernel/irq.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/kernel_stat.h>
 #include <linux/seq_file.h>
-#include <linux/io.h>
 #include <linux/irq.h>
 #include <asm/processor.h>
 #include <asm/uaccess.h>
@@ -82,13 +81,9 @@ static union irq_ctx *hardirq_ctx[NR_CPUS] __read_mostly;
 static union irq_ctx *softirq_ctx[NR_CPUS] __read_mostly;
 #endif
 
-asmlinkage int do_IRQ(unsigned long r4, unsigned long r5,
-                      unsigned long r6, unsigned long r7,
-                      struct pt_regs __regs)
+asmlinkage int do_IRQ(unsigned int irq, struct pt_regs *regs)
 {
-        struct pt_regs *regs = RELOC_HIDE(&__regs, 0);
         struct pt_regs *old_regs = set_irq_regs(regs);
-        int irq;
 #ifdef CONFIG_4KSTACKS
         union irq_ctx *curctx, *irqctx;
 #endif
@@ -111,13 +106,7 @@ asmlinkage int do_IRQ(unsigned long r4, unsigned long r5,
         }
 #endif
 
-#ifdef CONFIG_CPU_HAS_INTEVT
-        irq = evt2irq(ctrl_inl(INTEVT));
-#else
-        irq = r4;
-#endif
-
-        irq = irq_demux(irq);
+        irq = irq_demux(evt2irq(irq));
 
 #ifdef CONFIG_4KSTACKS
         curctx = (union irq_ctx *)current_thread_info();
diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
index 113bd48a89bd..fc874e63a499 100644
--- a/arch/sparc/kernel/process.c
+++ b/arch/sparc/kernel/process.c
@@ -348,7 +348,7 @@ void exit_thread(void)
 #ifndef CONFIG_SMP
         if(last_task_used_math == current) {
 #else
-        if(current_thread_info()->flags & _TIF_USEDFPU) {
+        if (test_thread_flag(TIF_USEDFPU)) {
 #endif
                 /* Keep process from leaving FPU in a bogon state. */
                 put_psr(get_psr() | PSR_EF);
@@ -357,7 +357,7 @@ void exit_thread(void)
 #ifndef CONFIG_SMP
                 last_task_used_math = NULL;
 #else
-                current_thread_info()->flags &= ~_TIF_USEDFPU;
+                clear_thread_flag(TIF_USEDFPU);
 #endif
         }
 }
@@ -371,7 +371,7 @@ void flush_thread(void)
 #ifndef CONFIG_SMP
         if(last_task_used_math == current) {
 #else
-        if(current_thread_info()->flags & _TIF_USEDFPU) {
+        if (test_thread_flag(TIF_USEDFPU)) {
 #endif
                 /* Clean the fpu. */
                 put_psr(get_psr() | PSR_EF);
@@ -380,7 +380,7 @@ void flush_thread(void)
 #ifndef CONFIG_SMP
                 last_task_used_math = NULL;
 #else
-                current_thread_info()->flags &= ~_TIF_USEDFPU;
+                clear_thread_flag(TIF_USEDFPU);
 #endif
         }
 
@@ -466,13 +466,13 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
 #ifndef CONFIG_SMP
         if(last_task_used_math == current) {
 #else
-        if(current_thread_info()->flags & _TIF_USEDFPU) {
+        if (test_thread_flag(TIF_USEDFPU)) {
 #endif
                 put_psr(get_psr() | PSR_EF);
                 fpsave(&p->thread.float_regs[0], &p->thread.fsr,
                        &p->thread.fpqueue[0], &p->thread.fpqdepth);
 #ifdef CONFIG_SMP
-                current_thread_info()->flags &= ~_TIF_USEDFPU;
+                clear_thread_flag(TIF_USEDFPU);
 #endif
         }
 
@@ -609,13 +609,13 @@ int dump_fpu (struct pt_regs * regs, elf_fpregset_t * fpregs)
                 return 1;
         }
 #ifdef CONFIG_SMP
-        if (current_thread_info()->flags & _TIF_USEDFPU) {
+        if (test_thread_flag(TIF_USEDFPU)) {
                 put_psr(get_psr() | PSR_EF);
                 fpsave(&current->thread.float_regs[0], &current->thread.fsr,
                        &current->thread.fpqueue[0], &current->thread.fpqdepth);
                 if (regs != NULL) {
                         regs->psr &= ~(PSR_EF);
-                        current_thread_info()->flags &= ~(_TIF_USEDFPU);
+                        clear_thread_flag(TIF_USEDFPU);
                 }
         }
 #else
diff --git a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S
index ea75ca569052..3a69778c8366 100644
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -78,7 +78,8 @@ sys_call_table:
 /*285*/ .long sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
 /*290*/ .long sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
 /*295*/ .long sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
-/*300*/ .long sys_set_robust_list, sys_get_robust_list, sys_migrate_pages
+/*300*/ .long sys_set_robust_list, sys_get_robust_list, sys_migrate_pages, sys_mbind, sys_get_mempolicy
+/*305*/ .long sys_set_mempolicy, sys_kexec_load, sys_move_pages, sys_getcpu, sys_epoll_pwait
 
 #ifdef CONFIG_SUNOS_EMUL
         /* Now the SunOS syscall table. */
@@ -192,5 +193,8 @@ sunos_sys_table:
         .long sunos_nosys, sunos_nosys, sunos_nosys
         .long sunos_nosys
 /*300*/ .long sunos_nosys, sunos_nosys, sunos_nosys
+        .long sunos_nosys, sunos_nosys, sunos_nosys
+        .long sunos_nosys, sunos_nosys, sunos_nosys
+        .long sunos_nosys
 
 #endif
diff --git a/arch/sparc/kernel/traps.c b/arch/sparc/kernel/traps.c
index 6a70d215fd04..527687afc1c4 100644
--- a/arch/sparc/kernel/traps.c
+++ b/arch/sparc/kernel/traps.c
@@ -259,7 +259,7 @@ void do_fpd_trap(struct pt_regs *regs, unsigned long pc, unsigned long npc,
         } else {
                 fpload(&current->thread.float_regs[0], &current->thread.fsr);
         }
-        current_thread_info()->flags |= _TIF_USEDFPU;
+        set_thread_flag(TIF_USEDFPU);
 #endif
 }
 
@@ -290,7 +290,7 @@ void do_fpe_trap(struct pt_regs *regs, unsigned long pc, unsigned long npc,
 #ifndef CONFIG_SMP
         if(!fpt) {
 #else
-        if(!(task_thread_info(fpt)->flags & _TIF_USEDFPU)) {
+        if (!test_tsk_thread_flag(fpt, TIF_USEDFPU)) {
 #endif
                 fpsave(&fake_regs[0], &fake_fsr, &fake_queue[0], &fake_depth);
                 regs->psr &= ~PSR_EF;
@@ -333,7 +333,7 @@ void do_fpe_trap(struct pt_regs *regs, unsigned long pc, unsigned long npc,
         /* nope, better SIGFPE the offending process... */
                
 #ifdef CONFIG_SMP
-        task_thread_info(fpt)->flags &= ~_TIF_USEDFPU;
+        clear_tsk_thread_flag(fpt, TIF_USEDFPU);
 #endif
         if(psr & PSR_PS) {
                 /* The first fsr store/load we tried trapped,
diff --git a/arch/sparc/mm/init.c b/arch/sparc/mm/init.c
index c85ddf312747..a532922e2e35 100644
--- a/arch/sparc/mm/init.c
+++ b/arch/sparc/mm/init.c
@@ -75,7 +75,7 @@ void show_mem(void)
         printk("Free swap:       %6ldkB\n",
                nr_swap_pages << (PAGE_SHIFT-10));
         printk("%ld pages of RAM\n", totalram_pages);
-        printk("%d free pages\n", nr_free_pages());
+        printk("%ld free pages\n", nr_free_pages());
 #if 0 /* undefined pgtable_cache_size, pgd_cache_size */
         printk("%ld pages in page table cache\n",pgtable_cache_size);
 #ifndef CONFIG_SMP
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index f75a686ba644..1a6348b565fb 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -136,18 +136,6 @@ config SMP
 
           If you don't know what to do here, say N.
 
-config PREEMPT
-        bool "Preemptible Kernel"
-        help
-          This option reduces the latency of the kernel when reacting to
-          real-time or interactive events by allowing a low priority process to
-          be preempted even if it is in kernel mode executing a system call.
-          This allows applications to run more reliably even when the system is
-          under load.
-
-          Say Y here if you are building a kernel for a desktop, embedded
-          or real-time system.  Say N if you are unsure.
-
 config NR_CPUS
         int "Maximum number of CPUs (2-64)"
         range 2 64
@@ -399,6 +387,8 @@ config SCHED_SMT
           when dealing with UltraSPARC cpus at a cost of slightly increased
           overhead in some places. If unsure say N here.
 
+source "kernel/Kconfig.preempt"
+
 config CMDLINE_BOOL
         bool "Default bootloader kernel arguments"
 
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index 860b8b60526c..120c9c33b7a6 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.21-rc2
-# Wed Feb 28 09:50:51 2007
+# Linux kernel version: 2.6.21-rc4
+# Sat Mar 17 14:18:44 2007
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -50,6 +50,7 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_IKCONFIG is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_RELAY=y
+# CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
@@ -108,7 +109,6 @@ CONFIG_GENERIC_HARDIRQS=y
 # General machine setup
 #
 # CONFIG_SMP is not set
-# CONFIG_PREEMPT is not set
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=m
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -165,6 +165,9 @@ CONFIG_BINFMT_ELF32=y
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=m
 CONFIG_SOLARIS_EMUL=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_PREEMPT is not set
 # CONFIG_CMDLINE_BOOL is not set
 
 #
@@ -340,7 +343,6 @@ CONFIG_BLK_DEV_NBD=m
 # CONFIG_BLK_DEV_SX8 is not set
 # CONFIG_BLK_DEV_UB is not set
 # CONFIG_BLK_DEV_RAM is not set
-# CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 CONFIG_CDROM_PKTCDVD_WCACHE=y
diff --git a/arch/sparc64/kernel/ktlb.S b/arch/sparc64/kernel/ktlb.S
index e492db845ea3..d4024ac0d619 100644
--- a/arch/sparc64/kernel/ktlb.S
+++ b/arch/sparc64/kernel/ktlb.S
@@ -138,9 +138,15 @@ kvmap_dtlb_4v:
         brgez,pn        %g4, kvmap_dtlb_nonlinear
          nop
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        /* Index through the base page size TSB even for linear
+         * mappings when using page allocation debugging.
+         */
+        KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
+#else
         /* Correct TAG_TARGET is already in %g6, check 4mb TSB.  */
         KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
-
+#endif
         /* TSB entry address left in %g1, lookup linear PTE.
          * Must preserve %g1 and %g6 (TAG).
          */
diff --git a/arch/sparc64/kernel/process.c b/arch/sparc64/kernel/process.c
index 7d75cd4eb297..b291060c25a6 100644
--- a/arch/sparc64/kernel/process.c
+++ b/arch/sparc64/kernel/process.c
@@ -413,8 +413,13 @@ void flush_thread(void)
         struct thread_info *t = current_thread_info();
         struct mm_struct *mm;
 
-        if (t->flags & _TIF_ABI_PENDING)
-                t->flags ^= (_TIF_ABI_PENDING | _TIF_32BIT);
+        if (test_ti_thread_flag(t, TIF_ABI_PENDING)) {
+                clear_ti_thread_flag(t, TIF_ABI_PENDING);
+                if (test_ti_thread_flag(t, TIF_32BIT))
+                        clear_ti_thread_flag(t, TIF_32BIT);
+                else
+                        set_ti_thread_flag(t, TIF_32BIT);
+        }
 
         mm = t->task->mm;
         if (mm)
diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
index 948b7d2d5874..aaeb5e06735c 100644
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -79,7 +79,8 @@ sys_call_table32:
         .word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
 /*290*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
         .word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
-/*300*/ .word compat_sys_set_robust_list, compat_sys_get_robust_list, compat_sys_migrate_pages
+/*300*/ .word compat_sys_set_robust_list, compat_sys_get_robust_list, compat_sys_migrate_pages, compat_sys_mbind, compat_sys_get_mempolicy
+        .word compat_sys_set_mempolicy, compat_sys_kexec_load, compat_sys_move_pages, sys_getcpu, compat_sys_epoll_pwait
 
 #endif /* CONFIG_COMPAT */
 
@@ -149,7 +150,8 @@ sys_call_table:
         .word sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
 /*290*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
         .word sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
-/*300*/ .word sys_set_robust_list, sys_get_robust_list, sys_migrate_pages
+/*300*/ .word sys_set_robust_list, sys_get_robust_list, sys_migrate_pages, sys_mbind, sys_get_mempolicy
+        .word sys_set_mempolicy, sys_kexec_load, sys_move_pages, sys_getcpu, sys_epoll_pwait
 
 #if defined(CONFIG_SUNOS_EMUL) || defined(CONFIG_SOLARIS_EMUL) || \
     defined(CONFIG_SOLARIS_EMUL_MODULE)
@@ -264,5 +266,8 @@ sunos_sys_table:
         .word sunos_nosys, sunos_nosys, sunos_nosys
         .word sunos_nosys
 /*300*/ .word sunos_nosys, sunos_nosys, sunos_nosys
+        .word sunos_nosys, sunos_nosys, sunos_nosys
+        .word sunos_nosys, sunos_nosys, sunos_nosys
+        .word sunos_nosys
 
 #endif
diff --git a/arch/sparc64/kernel/tsb.S b/arch/sparc64/kernel/tsb.S
index eedf94fa5664..10adb2fb8ffe 100644
--- a/arch/sparc64/kernel/tsb.S
+++ b/arch/sparc64/kernel/tsb.S
@@ -546,6 +546,7 @@ NGtsb_init:
         subcc           %o1, 0x100, %o1
         bne,pt          %xcc, 1b
          add            %o0, 0x100, %o0
+        membar          #Sync
         retl
          wr             %g2, 0x0, %asi
         .size           NGtsb_init, .-NGtsb_init
diff --git a/arch/sparc64/lib/NGbzero.S b/arch/sparc64/lib/NGbzero.S
index e86baece5cc8..f10e4529ee37 100644
--- a/arch/sparc64/lib/NGbzero.S
+++ b/arch/sparc64/lib/NGbzero.S
@@ -88,6 +88,7 @@ NGbzero_loop:
         bne,pt          %xcc, NGbzero_loop
          add            %o0, 64, %o0
 
+        membar          #Sync
         wr              %o4, 0x0, %asi
         brz,pn          %o1, NGbzero_done
 NGbzero_medium:
diff --git a/arch/sparc64/lib/NGmemcpy.S b/arch/sparc64/lib/NGmemcpy.S
index 8e522b3dc095..66063a9a66b8 100644
--- a/arch/sparc64/lib/NGmemcpy.S
+++ b/arch/sparc64/lib/NGmemcpy.S
@@ -247,6 +247,8 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         /* fall through */
 
 60:     
+        membar          #Sync
+
         /* %o2 contains any final bytes still needed to be copied
          * over. If anything is left, we copy it one byte at a time.
          */
diff --git a/arch/sparc64/lib/NGpage.S b/arch/sparc64/lib/NGpage.S
index 7d7c3bb8dcbf..8ce3a0c9c537 100644
--- a/arch/sparc64/lib/NGpage.S
+++ b/arch/sparc64/lib/NGpage.S
@@ -41,6 +41,7 @@ NGcopy_user_page:	/* %o0=dest, %o1=src, %o2=vaddr */
         subcc           %g7, 64, %g7
         bne,pt          %xcc, 1b
          add            %o0, 32, %o0
+        membar          #Sync
         retl
          nop
 
@@ -63,6 +64,7 @@ NGclear_user_page:	/* %o0=dest, %o1=vaddr */
         subcc           %g7, 64, %g7
         bne,pt          %xcc, 1b
          add            %o0, 32, %o0
+        membar          #Sync
         retl
          nop
 
diff --git a/arch/sparc64/mm/hugetlbpage.c b/arch/sparc64/mm/hugetlbpage.c
index 33fd0b265e70..00677b5e1d7d 100644
--- a/arch/sparc64/mm/hugetlbpage.c
+++ b/arch/sparc64/mm/hugetlbpage.c
@@ -248,6 +248,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
         if (!pte_present(*ptep) && pte_present(entry))
                 mm->context.huge_pte_count++;
 
+        addr &= HPAGE_MASK;
         for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
                 set_pte_at(mm, addr, ptep, entry);
                 ptep++;
@@ -266,6 +267,8 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
         if (pte_present(entry))
                 mm->context.huge_pte_count--;
 
+        addr &= HPAGE_MASK;
+
         for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
                 pte_clear(mm, addr, ptep);
                 addr += PAGE_SIZE;
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index b1a1ee0cc6bd..f146071a4b2a 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -59,8 +59,10 @@ unsigned long kern_linear_pte_xor[2] __read_mostly;
  */
 unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
 
+#ifndef CONFIG_DEBUG_PAGEALLOC
 /* A special kernel TSB for 4MB and 256MB linear mappings.  */
 struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
+#endif
 
 #define MAX_BANKS       32
 
@@ -1301,7 +1303,12 @@ static void __init tsb_phys_patch(void)
 }
 
 /* Don't mark as init, we give this to the Hypervisor.  */
-static struct hv_tsb_descr ktsb_descr[2];
+#ifndef CONFIG_DEBUG_PAGEALLOC
+#define NUM_KTSB_DESCR  2
+#else
+#define NUM_KTSB_DESCR  1
+#endif
+static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
 extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
 
 static void __init sun4v_ktsb_init(void)
@@ -1340,6 +1347,7 @@ static void __init sun4v_ktsb_init(void)
         ktsb_descr[0].tsb_base = ktsb_pa;
         ktsb_descr[0].resv = 0;
 
+#ifndef CONFIG_DEBUG_PAGEALLOC
         /* Second KTSB for 4MB/256MB mappings.  */
         ktsb_pa = (kern_base +
                    ((unsigned long)&swapper_4m_tsb[0] - KERNBASE));
@@ -1352,6 +1360,7 @@ static void __init sun4v_ktsb_init(void)
         ktsb_descr[1].ctx_idx = 0;
         ktsb_descr[1].tsb_base = ktsb_pa;
         ktsb_descr[1].resv = 0;
+#endif
 }
 
 void __cpuinit sun4v_ktsb_register(void)
@@ -1364,7 +1373,7 @@ void __cpuinit sun4v_ktsb_register(void)
         pa = kern_base + ((unsigned long)&ktsb_descr[0] - KERNBASE);
 
         func = HV_FAST_MMU_TSB_CTX0;
-        arg0 = 2;
+        arg0 = NUM_KTSB_DESCR;
         arg1 = pa;
         __asm__ __volatile__("ta        %6"
                              : "=&r" (func), "=&r" (arg0), "=&r" (arg1)
@@ -1393,7 +1402,9 @@ void __init paging_init(void)
 
         /* Invalidate both kernel TSBs.  */
         memset(swapper_tsb, 0x40, sizeof(swapper_tsb));
+#ifndef CONFIG_DEBUG_PAGEALLOC
         memset(swapper_4m_tsb, 0x40, sizeof(swapper_4m_tsb));
+#endif
 
         if (tlb_type == hypervisor)
                 sun4v_pgprot_init();
@@ -1725,8 +1736,13 @@ static void __init sun4u_pgprot_init(void)
         pg_iobits = (_PAGE_VALID | _PAGE_PRESENT_4U | __DIRTY_BITS_4U |
                      __ACCESS_BITS_4U | _PAGE_E_4U);
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4U) ^
+                0xfffff80000000000;
+#else
         kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4U) ^
                 0xfffff80000000000;
+#endif
         kern_linear_pte_xor[0] |= (_PAGE_CP_4U | _PAGE_CV_4U |
                                    _PAGE_P_4U | _PAGE_W_4U);
 
@@ -1769,13 +1785,23 @@ static void __init sun4v_pgprot_init(void)
         _PAGE_E = _PAGE_E_4V;
         _PAGE_CACHE = _PAGE_CACHE_4V;
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
+                0xfffff80000000000;
+#else
         kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4V) ^
                 0xfffff80000000000;
+#endif
         kern_linear_pte_xor[0] |= (_PAGE_CP_4V | _PAGE_CV_4V |
                                    _PAGE_P_4V | _PAGE_W_4V);
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
+                0xfffff80000000000;
+#else
         kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZ256MB_4V) ^
                 0xfffff80000000000;
+#endif
         kern_linear_pte_xor[1] |= (_PAGE_CP_4V | _PAGE_CV_4V |
                                    _PAGE_P_4V | _PAGE_W_4V);
 
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index b3a21ba77cd2..354cc6b70530 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -44,7 +44,7 @@ config LOCKDEP_SUPPORT
 
 config STACKTRACE_SUPPORT
         bool
-        default y
+        default n
 
 config GENERIC_CALIBRATE_DELAY
         bool
diff --git a/arch/um/include/sysdep-x86_64/ptrace.h b/arch/um/include/sysdep-x86_64/ptrace.h
index 66cb400c2c92..62403bd99661 100644
--- a/arch/um/include/sysdep-x86_64/ptrace.h
+++ b/arch/um/include/sysdep-x86_64/ptrace.h
@@ -104,10 +104,6 @@ union uml_pt_regs {
 #endif
 #ifdef UML_CONFIG_MODE_SKAS
         struct skas_regs {
-                /* x86_64 ptrace uses sizeof(user_regs_struct) as its register
-                 * file size, while i386 uses FRAME_SIZE.  Therefore, we need
-                 * to use UM_FRAME_SIZE here instead of HOST_FRAME_SIZE.
-                 */
                 unsigned long regs[MAX_REG_NR];
                 unsigned long fp[HOST_FP_SIZE];
                 struct faultinfo faultinfo;
diff --git a/arch/um/os-Linux/skas/mem.c b/arch/um/os-Linux/skas/mem.c
index b3c11cfa995a..9383e8751ae7 100644
--- a/arch/um/os-Linux/skas/mem.c
+++ b/arch/um/os-Linux/skas/mem.c
@@ -48,7 +48,7 @@ int multi_op_count = 0;
 static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr)
 {
         unsigned long regs[MAX_REG_NR];
-        int n;
+        int n, i;
         long ret, offset;
         unsigned long * data;
         unsigned long * syscall;
@@ -66,9 +66,13 @@ static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr)
                  (unsigned long) &__syscall_stub_start);
 
         n = ptrace_setregs(pid, regs);
-        if(n < 0)
+        if(n < 0){
+                printk("Registers - \n");
+                for(i = 0; i < MAX_REG_NR; i++)
+                        printk("\t%d\t0x%lx\n", i, regs[i]);
                 panic("do_syscall_stub : PTRACE_SETREGS failed, errno = %d\n",
-                      n);
+                      -n);
+        }
 
         wait_stub_done(pid, 0, "do_syscall_stub");
 
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index dda06789bcb0..0564422c155f 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -67,7 +67,7 @@ void wait_stub_done(int pid, int sig, char * fname)
 
         if((n < 0) || !WIFSTOPPED(status) ||
            (WSTOPSIG(status) != SIGUSR1 && WSTOPSIG(status) != SIGTRAP)){
-                unsigned long regs[HOST_FRAME_SIZE];
+                unsigned long regs[MAX_REG_NR];
 
                 if(ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
                         printk("Failed to get registers from stub, "
@@ -76,7 +76,7 @@ void wait_stub_done(int pid, int sig, char * fname)
                         int i;
 
                         printk("Stub registers -\n");
-                        for(i = 0; i < HOST_FRAME_SIZE; i++)
+                        for(i = 0; i < ARRAY_SIZE(regs); i++)
                                 printk("\t%d - %lx\n", i, regs[i]);
                 }
                 panic("%s : failed to wait for SIGUSR1/SIGTRAP, "
@@ -328,7 +328,7 @@ void userspace(union uml_pt_regs *regs)
 int copy_context_skas0(unsigned long new_stack, int pid)
 {
         int err;
-        unsigned long regs[HOST_FRAME_SIZE];
+        unsigned long regs[MAX_REG_NR];
         unsigned long fp_regs[HOST_FP_SIZE];
         unsigned long current_stack = current_stub_stack();
         struct stub_data *data = (struct stub_data *) current_stack;
diff --git a/arch/um/os-Linux/sys-i386/registers.c b/arch/um/os-Linux/sys-i386/registers.c
index 79cd93c8c5ed..84b44f9cd42a 100644
--- a/arch/um/os-Linux/sys-i386/registers.c
+++ b/arch/um/os-Linux/sys-i386/registers.c
@@ -15,7 +15,7 @@
 
 /* These are set once at boot time and not changed thereafter */
 
-static unsigned long exec_regs[HOST_FRAME_SIZE];
+static unsigned long exec_regs[MAX_REG_NR];
 static unsigned long exec_fp_regs[HOST_FP_SIZE];
 static unsigned long exec_fpx_regs[HOST_XFP_SIZE];
 static int have_fpx_regs = 1;
@@ -101,6 +101,7 @@ void init_registers(int pid)
 {
         int err;
 
+        memset(exec_regs, 0, sizeof(exec_regs));
         err = ptrace(PTRACE_GETREGS, pid, 0, exec_regs);
         if(err)
                 panic("check_ptrace : PTRACE_GETREGS failed, errno = %d",
@@ -124,7 +125,7 @@ void init_registers(int pid)
 
 void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
-        memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long));
+        memcpy(regs, exec_regs, sizeof(exec_regs));
         if(fp_regs != NULL)
                 memcpy(fp_regs, exec_fp_regs,
                        HOST_FP_SIZE * sizeof(unsigned long));
diff --git a/arch/um/os-Linux/sys-x86_64/registers.c b/arch/um/os-Linux/sys-x86_64/registers.c
index a2d7e0c603f7..e6fc2179d1bc 100644
--- a/arch/um/os-Linux/sys-x86_64/registers.c
+++ b/arch/um/os-Linux/sys-x86_64/registers.c
@@ -14,7 +14,7 @@
 
 /* These are set once at boot time and not changed thereafter */
 
-static unsigned long exec_regs[HOST_FRAME_SIZE];
+static unsigned long exec_regs[MAX_REG_NR];
 static unsigned long exec_fp_regs[HOST_FP_SIZE];
 
 void init_thread_registers(union uml_pt_regs *to)
@@ -72,7 +72,7 @@ void init_registers(int pid)
 
 void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
-        memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long));
+        memcpy(regs, exec_regs, sizeof(exec_regs));
         if(fp_regs != NULL)
                 memcpy(fp_regs, exec_fp_regs,
                        HOST_FP_SIZE * sizeof(unsigned long));
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index 813077fb1e5b..a9a4b85ca516 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -10,7 +10,7 @@ USER_OBJS := $(foreach file,$(USER_OBJS),$(obj)/$(file))
 $(USER_OBJS:.o=.%): \
         c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) $(CFLAGS_$(basetarget).o)
 $(USER_OBJS) : CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ \
-        -Dunix -D__unix__ -D__$(SUBARCH)__
+        -Dunix -D__unix__ -D__$(SUBARCH)__ $(CF)
 
 # These are like USER_OBJS but filter USER_CFLAGS through unprofile instead of
 # using it directly.
@@ -19,7 +19,7 @@ UNPROFILE_OBJS := $(foreach file,$(UNPROFILE_OBJS),$(obj)/$(file))
 $(UNPROFILE_OBJS:.o=.%): \
         c_flags = -Wp,-MD,$(depfile) $(call unprofile,$(USER_CFLAGS)) $(CFLAGS_$(basetarget).o)
 $(UNPROFILE_OBJS) : CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ \
-        -Dunix -D__unix__ -D__$(SUBARCH)__
+        -Dunix -D__unix__ -D__$(SUBARCH)__ $(CF)
 
 # The stubs and unmap.o can't try to call mcount or update basic block data
 define unprofile
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 293a4a4c609e..7a1e251e333d 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,11 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.20-git8
-# Tue Feb 13 11:25:16 2007
+# Linux kernel version: 2.6.21-rc3
+# Wed Mar  7 15:29:47 2007
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
 CONFIG_X86=y
+CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_ZONE_DMA32=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_STACKTRACE_SUPPORT=y
@@ -43,6 +45,7 @@ CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
@@ -53,6 +56,7 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -114,11 +118,11 @@ CONFIG_X86_PC=y
 # CONFIG_X86_VSMP is not set
 # CONFIG_MK8 is not set
 # CONFIG_MPSC is not set
-CONFIG_MCORE2=y
-# CONFIG_GENERIC_CPU is not set
-CONFIG_X86_L1_CACHE_BYTES=64
-CONFIG_X86_L1_CACHE_SHIFT=6
-CONFIG_X86_INTERNODE_CACHE_BYTES=64
+# CONFIG_MCORE2 is not set
+CONFIG_GENERIC_CPU=y
+CONFIG_X86_L1_CACHE_BYTES=128
+CONFIG_X86_L1_CACHE_SHIFT=7
+CONFIG_X86_INTERNODE_CACHE_BYTES=128
 CONFIG_X86_TSC=y
 CONFIG_X86_GOOD_APIC=y
 # CONFIG_MICROCODE is not set
@@ -207,10 +211,8 @@ CONFIG_ACPI_PROCFS=y
 CONFIG_ACPI_AC=y
 CONFIG_ACPI_BATTERY=y
 CONFIG_ACPI_BUTTON=y
-# CONFIG_ACPI_HOTKEY is not set
 CONFIG_ACPI_FAN=y
 # CONFIG_ACPI_DOCK is not set
-# CONFIG_ACPI_BAY is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
@@ -319,7 +321,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
-# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_TUNNEL=y
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_BEET is not set
@@ -421,7 +423,13 @@ CONFIG_FW_LOADER=y
 #
 # Plug and Play support
 #
-# CONFIG_PNP is not set
+CONFIG_PNP=y
+# CONFIG_PNP_DEBUG is not set
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
 
 #
 # Block devices
@@ -441,7 +449,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
-CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -451,6 +458,7 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_IBM_ASM is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
+# CONFIG_SONY_LAPTOP is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
@@ -477,6 +485,7 @@ CONFIG_BLK_DEV_IDEACPI=y
 #
 CONFIG_IDE_GENERIC=y
 # CONFIG_BLK_DEV_CMD640 is not set
+# CONFIG_BLK_DEV_IDEPNP is not set
 CONFIG_BLK_DEV_IDEPCI=y
 # CONFIG_IDEPCI_SHARE_IRQ is not set
 # CONFIG_BLK_DEV_OFFBOARD is not set
@@ -623,6 +632,7 @@ CONFIG_SATA_VIA=y
 # CONFIG_SATA_VITESSE is not set
 # CONFIG_SATA_INIC162X is not set
 CONFIG_SATA_INTEL_COMBINED=y
+CONFIG_SATA_ACPI=y
 # CONFIG_PATA_ALI is not set
 # CONFIG_PATA_AMD is not set
 # CONFIG_PATA_ARTOP is not set
@@ -726,6 +736,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
 CONFIG_TUN=y
+# CONFIG_NET_SB1000 is not set
 
 #
 # ARCnet devices
@@ -920,6 +931,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -1001,6 +1013,7 @@ CONFIG_I2C_ISA=m
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PASEMI is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
 # CONFIG_I2C_SIS5595 is not set
@@ -1047,6 +1060,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
 # CONFIG_SENSORS_ADM1031 is not set
 # CONFIG_SENSORS_ADM9240 is not set
 # CONFIG_SENSORS_K8TEMP is not set
@@ -1090,6 +1104,11 @@ CONFIG_SENSORS_SMSC47B397=m
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1103,7 +1122,7 @@ CONFIG_SENSORS_SMSC47B397=m
 #
 # Graphics support
 #
-# CONFIG_FIRMWARE_EDID is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 # CONFIG_FB is not set
 
 #
@@ -1114,7 +1133,6 @@ CONFIG_VGACON_SOFT_SCROLLBACK=y
 CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=256
 CONFIG_VIDEO_SELECT=y
 CONFIG_DUMMY_CONSOLE=y
-# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -1130,9 +1148,8 @@ CONFIG_SOUND=y
 # Open Sound System
 #
 CONFIG_SOUND_PRIME=y
-CONFIG_OBSOLETE_OSS=y
+# CONFIG_OBSOLETE_OSS is not set
 # CONFIG_SOUND_BT878 is not set
-# CONFIG_SOUND_ES1371 is not set
 CONFIG_SOUND_ICH=y
 # CONFIG_SOUND_TRIDENT is not set
 # CONFIG_SOUND_MSNDCLAS is not set
@@ -1263,6 +1280,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
+# CONFIG_USB_BERRY_CHARGE is not set
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
@@ -1273,6 +1291,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1538,6 +1557,7 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
@@ -1556,6 +1576,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
+# CONFIG_FAULT_INJECTION is not set
 # CONFIG_DEBUG_RODATA is not set
 # CONFIG_IOMMU_DEBUG is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
diff --git a/arch/x86_64/ia32/ia32entry.S b/arch/x86_64/ia32/ia32entry.S
index eda7a0d4dc15..796df6992f62 100644
--- a/arch/x86_64/ia32/ia32entry.S
+++ b/arch/x86_64/ia32/ia32entry.S
@@ -560,7 +560,7 @@ ia32_sys_call_table:
         .quad sys_sched_yield
         .quad sys_sched_get_priority_max
         .quad sys_sched_get_priority_min  /* 160 */
-        .quad sys_sched_rr_get_interval
+        .quad sys32_sched_rr_get_interval
         .quad compat_sys_nanosleep
         .quad sys_mremap
         .quad sys_setresuid16
diff --git a/arch/x86_64/kernel/acpi/sleep.c b/arch/x86_64/kernel/acpi/sleep.c
index 23178ce6c783..e1548fbe95ae 100644
--- a/arch/x86_64/kernel/acpi/sleep.c
+++ b/arch/x86_64/kernel/acpi/sleep.c
@@ -66,8 +66,10 @@ static void init_low_mapping(void)
 {
         pgd_t *slot0 = pgd_offset(current->mm, 0UL);
         low_ptr = *slot0;
+        /* FIXME: We're playing with the current task's page tables here, which
+         * is potentially dangerous on SMP systems.
+         */
         set_pgd(slot0, *pgd_offset(current->mm, PAGE_OFFSET));
-        WARN_ON(num_online_cpus() != 1);
         local_flush_tlb();
 }
 
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index 723417d924c0..bd3e45d47c37 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -47,6 +47,10 @@ int apic_calibrate_pmtmr __initdata;
 
 int disable_apic_timer __initdata;
 
+/* Local APIC timer works in C2? */
+int local_apic_timer_c2_ok;
+EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
+
 static struct resource *ioapic_resources;
 static struct resource lapic_resource = {
         .name = "Local APIC",
@@ -930,9 +934,17 @@ EXPORT_SYMBOL(switch_APIC_timer_to_ipi);
 
 void smp_send_timer_broadcast_ipi(void)
 {
+        int cpu = smp_processor_id();
         cpumask_t mask;
 
         cpus_and(mask, cpu_online_map, timer_interrupt_broadcast_ipi_mask);
+
+        if (cpu_isset(cpu, mask)) {
+                cpu_clear(cpu, mask);
+                add_pda(apic_timer_irqs, 1);
+                smp_local_timer_interrupt();
+        }
+
         if (!cpus_empty(mask)) {
                 send_IPI_mask(mask, LOCAL_TIMER_VECTOR);
         }
@@ -1192,6 +1204,13 @@ static __init int setup_nolapic(char *str)
 } 
 early_param("nolapic", setup_nolapic);
 
+static int __init parse_lapic_timer_c2_ok(char *arg)
+{
+        local_apic_timer_c2_ok = 1;
+        return 0;
+}
+early_param("lapic_timer_c2_ok", parse_lapic_timer_c2_ok);
+
 static __init int setup_noapictimer(char *str) 
 { 
         if (str[0] != ' ' && str[0] != 0)
diff --git a/arch/x86_64/kernel/cpufreq/Kconfig b/arch/x86_64/kernel/cpufreq/Kconfig
index ced15d06f0f3..40acb67fb882 100644
--- a/arch/x86_64/kernel/cpufreq/Kconfig
+++ b/arch/x86_64/kernel/cpufreq/Kconfig
@@ -75,6 +75,7 @@ config X86_ACPI_CPUFREQ_PROC_INTF
 config X86_P4_CLOCKMOD
         tristate "Intel Pentium 4 clock modulation"
         depends on EMBEDDED
+        select CPU_FREQ_TABLE
         help
           This adds the clock modulation driver for Intel Pentium 4 / XEON
           processors.  When enabled it will lower CPU temperature by skipping
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 4651fd22b213..a490fabfcf47 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -662,7 +662,7 @@ static int __init parse_memmap_opt(char *p)
 }
 early_param("memmap", parse_memmap_opt);
 
-void finish_e820_parsing(void)
+void __init finish_e820_parsing(void)
 {
         if (userdef) {
                 printk(KERN_INFO "user-defined physical RAM map:\n");
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index dec587b293bf..148c6bcf5bb4 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -16,7 +16,7 @@
 #include <asm/proto.h>
 #include <asm/dma.h>
 
-static void via_bugs(void)
+static void __init via_bugs(void)
 {
 #ifdef CONFIG_IOMMU
         if ((end_pfn > MAX_DMA32_PFN ||  force_iommu) &&
@@ -36,7 +36,7 @@ static int __init nvidia_hpet_check(struct acpi_table_header *header)
 }
 #endif
 
-static void nvidia_bugs(void)
+static void __init nvidia_bugs(void)
 {
 #ifdef CONFIG_ACPI
         /*
@@ -62,7 +62,7 @@ static void nvidia_bugs(void)
 
 }
 
-static void ati_bugs(void)
+static void __init ati_bugs(void)
 {
         if (timer_over_8254 == 1) {
                 timer_over_8254 = 0;
@@ -88,7 +88,7 @@ struct chipset {
         void (*f)(void);
 };
 
-static struct chipset early_qrk[] = {
+static struct __initdata chipset early_qrk[] = {
         { PCI_VENDOR_ID_NVIDIA, nvidia_bugs },
         { PCI_VENDOR_ID_VIA, via_bugs },
         { PCI_VENDOR_ID_ATI, ati_bugs },
diff --git a/arch/x86_64/kernel/mpparse.c b/arch/x86_64/kernel/mpparse.c
index 50dd8bef850e..455aa0b932f0 100644
--- a/arch/x86_64/kernel/mpparse.c
+++ b/arch/x86_64/kernel/mpparse.c
@@ -60,9 +60,9 @@ unsigned long mp_lapic_addr = 0;
 /* Processor that is doing the boot up */
 unsigned int boot_cpu_id = -1U;
 /* Internal processor count */
-unsigned int num_processors __initdata = 0;
+unsigned int num_processors __cpuinitdata = 0;
 
-unsigned disabled_cpus __initdata;
+unsigned disabled_cpus __cpuinitdata;
 
 /* Bitmask of physically existing CPUs */
 physid_mask_t phys_cpu_present_map = PHYSID_MASK_NONE;
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 486f4c61a948..82d9d85d5270 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -187,10 +187,7 @@ void nmi_watchdog_default(void)
 {
         if (nmi_watchdog != NMI_DEFAULT)
                 return;
-        if (nmi_known_cpu())
-                nmi_watchdog = NMI_LOCAL_APIC;
-        else
-                nmi_watchdog = NMI_IO_APIC;
+        nmi_watchdog = NMI_NONE;
 }
 
 static int endflag __initdata = 0;
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index 030eb3753358..2bac8c60ad61 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -675,7 +675,7 @@ void __init gart_iommu_init(void)
         dma_ops = &gart_dma_ops;
 } 
 
-void gart_parse_options(char *p)
+void __init gart_parse_options(char *p)
 {
         int arg;
 
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index cbbc6adc1a92..d8d5ccc245c8 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -382,14 +382,17 @@ void exit_thread(void)
 void flush_thread(void)
 {
         struct task_struct *tsk = current;
-        struct thread_info *t = current_thread_info();
 
-        if (t->flags & _TIF_ABI_PENDING) {
-                t->flags ^= (_TIF_ABI_PENDING | _TIF_IA32);
-                if (t->flags & _TIF_IA32)
+        if (test_tsk_thread_flag(tsk, TIF_ABI_PENDING)) {
+                clear_tsk_thread_flag(tsk, TIF_ABI_PENDING);
+                if (test_tsk_thread_flag(tsk, TIF_IA32)) {
+                        clear_tsk_thread_flag(tsk, TIF_IA32);
+                } else {
+                        set_tsk_thread_flag(tsk, TIF_IA32);
                         current_thread_info()->status |= TS_COMPAT;
+                }
         }
-        t->flags &= ~_TIF_DEBUG;
+        clear_tsk_thread_flag(tsk, TIF_DEBUG);
 
         tsk->thread.debugreg0 = 0;
         tsk->thread.debugreg1 = 0;
diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c
index 180ff919eaf9..b43c698cf7d3 100644
--- a/arch/x86_64/kernel/vsyscall.c
+++ b/arch/x86_64/kernel/vsyscall.c
@@ -112,7 +112,7 @@ static __always_inline void do_vgettimeofday(struct timeval * tv)
 
                 vread = __vsyscall_gtod_data.clock.vread;
                 if (unlikely(!__vsyscall_gtod_data.sysctl_enabled || !vread)) {
-                        gettimeofday(tv,0);
+                        gettimeofday(tv,NULL);
                         return;
                 }
                 now = vread();
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index 0dffae69f4ad..77c25b307635 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -59,3 +59,4 @@ EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(init_level4_pgt);
 EXPORT_SYMBOL(load_gs_index);
 
+EXPORT_SYMBOL(_proxy_pda);
diff --git a/block/elevator.c b/block/elevator.c
index 25f6ef28e3bb..96a00c822748 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -964,17 +964,18 @@ void elv_unregister_queue(struct request_queue *q)
 
 int elv_register(struct elevator_type *e)
 {
+        char *def = "";
         spin_lock_irq(&elv_list_lock);
         BUG_ON(elevator_find(e->elevator_name));
         list_add_tail(&e->list, &elv_list);
         spin_unlock_irq(&elv_list_lock);
 
-        printk(KERN_INFO "io scheduler %s registered", e->elevator_name);
         if (!strcmp(e->elevator_name, chosen_elevator) ||
                         (!*chosen_elevator &&
                          !strcmp(e->elevator_name, CONFIG_DEFAULT_IOSCHED)))
-                                printk(" (default)");
-        printk("\n");
+                                def = " (default)";
+
+        printk(KERN_INFO "io scheduler %s registered%s\n", e->elevator_name, def);
         return 0;
 }
 EXPORT_SYMBOL_GPL(elv_register);
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 38c293b987b7..3de06953ac33 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -1221,7 +1221,7 @@ void blk_recount_segments(request_queue_t *q, struct bio *bio)
                  * considered part of another segment, since that might
                  * change with the bounce page.
                  */
-                high = page_to_pfn(bv->bv_page) >= q->bounce_pfn;
+                high = page_to_pfn(bv->bv_page) > q->bounce_pfn;
                 if (high || highprv)
                         goto new_hw_segment;
                 if (cluster) {
@@ -3658,8 +3658,8 @@ int __init blk_dev_init(void)
         open_softirq(BLOCK_SOFTIRQ, blk_done_softirq, NULL);
         register_hotcpu_notifier(&blk_cpu_notifier);
 
-        blk_max_low_pfn = max_low_pfn;
-        blk_max_pfn = max_pfn;
+        blk_max_low_pfn = max_low_pfn - 1;
+        blk_max_pfn = max_pfn - 1;
 
         return 0;
 }
diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
index 35172d3f043b..a66423121773 100644
--- a/crypto/scatterwalk.c
+++ b/crypto/scatterwalk.c
@@ -91,6 +91,8 @@ void scatterwalk_copychunks(void *buf, struct scatter_walk *walk,
                 memcpy_dir(buf, vaddr, len_this_page, out);
                 scatterwalk_unmap(vaddr, out);
 
+                scatterwalk_advance(walk, nbytes);
+
                 if (nbytes == len_this_page)
                         break;
 
@@ -99,7 +101,5 @@ void scatterwalk_copychunks(void *buf, struct scatter_walk *walk,
 
                 scatterwalk_pagedone(walk, out, 1);
         }
-
-        scatterwalk_advance(walk, nbytes);
 }
 EXPORT_SYMBOL_GPL(scatterwalk_copychunks);
diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index f5e9da319ece..8eaa5aa210b0 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -768,7 +768,7 @@ static void test_deflate(void)
         tv = (void *)tvmem;
 
         tfm = crypto_alloc_comp("deflate", 0, CRYPTO_ALG_ASYNC);
-        if (tfm == NULL) {
+        if (IS_ERR(tfm)) {
                 printk("failed to load transform for deflate\n");
                 return;
         }
diff --git a/drivers/acpi/events/evmisc.c b/drivers/acpi/events/evmisc.c
index 8dcade63b04b..cae786ca8600 100644
--- a/drivers/acpi/events/evmisc.c
+++ b/drivers/acpi/events/evmisc.c
@@ -196,11 +196,15 @@ acpi_ev_queue_notify_request(struct acpi_namespace_node * node,
                 notify_info->notify.value = (u16) notify_value;
                 notify_info->notify.handler_obj = handler_obj;
 
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
 
                 acpi_ev_notify_dispatch(notify_info);
 
-                acpi_ex_reacquire_interpreter();
+                status = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+
         }
 
         if (!handler_obj) {
@@ -549,7 +553,7 @@ acpi_status acpi_ev_release_global_lock(void)
         acpi_gbl_global_lock_acquired = FALSE;
 
         /* Release the local GL mutex */
-        acpi_ev_global_lock_thread_id = 0;
+        acpi_ev_global_lock_thread_id = NULL;
         acpi_ev_global_lock_acquired = 0;
         acpi_os_release_mutex(acpi_gbl_global_lock_mutex);
         return_ACPI_STATUS(status);
diff --git a/drivers/acpi/events/evregion.c b/drivers/acpi/events/evregion.c
index e99f0c435a47..96b0e8431748 100644
--- a/drivers/acpi/events/evregion.c
+++ b/drivers/acpi/events/evregion.c
@@ -291,6 +291,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
                                u32 bit_width, acpi_integer * value)
 {
         acpi_status status;
+        acpi_status status2;
         acpi_adr_space_handler handler;
         acpi_adr_space_setup region_setup;
         union acpi_operand_object *handler_desc;
@@ -344,7 +345,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
                  * setup will potentially execute control methods
                  * (e.g., _REG method for this region)
                  */
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
 
                 status = region_setup(region_obj, ACPI_REGION_ACTIVATE,
                                       handler_desc->address_space.context,
@@ -352,7 +353,10 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
 
                 /* Re-enter the interpreter */
 
-                acpi_ex_reacquire_interpreter();
+                status2 = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status2)) {
+                        return_ACPI_STATUS(status2);
+                }
 
                 /* Check for failure of the Region Setup */
 
@@ -405,7 +409,7 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
                  * exit the interpreter because the handler *might* block -- we don't
                  * know what it will do, so we can't hold the lock on the intepreter.
                  */
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
         }
 
         /* Call the handler */
@@ -426,7 +430,10 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
                  * We just returned from a non-default handler, we must re-enter the
                  * interpreter
                  */
-                acpi_ex_reacquire_interpreter();
+                status2 = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status2)) {
+                        return_ACPI_STATUS(status2);
+                }
         }
 
         return_ACPI_STATUS(status);
diff --git a/drivers/acpi/events/evxface.c b/drivers/acpi/events/evxface.c
index 685a103a3587..a3379bafa676 100644
--- a/drivers/acpi/events/evxface.c
+++ b/drivers/acpi/events/evxface.c
@@ -768,9 +768,11 @@ acpi_status acpi_acquire_global_lock(u16 timeout, u32 * handle)
                 return (AE_BAD_PARAMETER);
         }
 
-        /* Must lock interpreter to prevent race conditions */
+        status = acpi_ex_enter_interpreter();
+        if (ACPI_FAILURE(status)) {
+                return (status);
+        }
 
-        acpi_ex_enter_interpreter();
         status = acpi_ev_acquire_global_lock(timeout);
         acpi_ex_exit_interpreter();
 
diff --git a/drivers/acpi/executer/excreate.c b/drivers/acpi/executer/excreate.c
index 7c38528a7e83..ae97812681a3 100644
--- a/drivers/acpi/executer/excreate.c
+++ b/drivers/acpi/executer/excreate.c
@@ -583,7 +583,10 @@ acpi_ex_create_method(u8 * aml_start,
          * Get the sync_level. If method is serialized, a mutex will be
          * created for this method when it is parsed.
          */
-        if (method_flags & AML_METHOD_SERIALIZED) {
+        if (acpi_gbl_all_methods_serialized) {
+                obj_desc->method.sync_level = 0;
+                obj_desc->method.method_flags |= AML_METHOD_SERIALIZED;
+        } else if (method_flags & AML_METHOD_SERIALIZED) {
                 /*
                  * ACPI 1.0: sync_level = 0
                  * ACPI 2.0: sync_level = sync_level in method declaration
diff --git a/drivers/acpi/executer/exsystem.c b/drivers/acpi/executer/exsystem.c
index 9460baff3032..b2edf620ba89 100644
--- a/drivers/acpi/executer/exsystem.c
+++ b/drivers/acpi/executer/exsystem.c
@@ -66,6 +66,7 @@ ACPI_MODULE_NAME("exsystem")
 acpi_status acpi_ex_system_wait_semaphore(acpi_semaphore semaphore, u16 timeout)
 {
         acpi_status status;
+        acpi_status status2;
 
         ACPI_FUNCTION_TRACE(ex_system_wait_semaphore);
 
@@ -78,7 +79,7 @@ acpi_status acpi_ex_system_wait_semaphore(acpi_semaphore semaphore, u16 timeout)
 
                 /* We must wait, so unlock the interpreter */
 
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
 
                 status = acpi_os_wait_semaphore(semaphore, 1, timeout);
 
@@ -88,7 +89,13 @@ acpi_status acpi_ex_system_wait_semaphore(acpi_semaphore semaphore, u16 timeout)
 
                 /* Reacquire the interpreter */
 
-                acpi_ex_reacquire_interpreter();
+                status2 = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status2)) {
+
+                        /* Report fatal error, could not acquire interpreter */
+
+                        return_ACPI_STATUS(status2);
+                }
         }
 
         return_ACPI_STATUS(status);
@@ -112,6 +119,7 @@ acpi_status acpi_ex_system_wait_semaphore(acpi_semaphore semaphore, u16 timeout)
 acpi_status acpi_ex_system_wait_mutex(acpi_mutex mutex, u16 timeout)
 {
         acpi_status status;
+        acpi_status status2;
 
         ACPI_FUNCTION_TRACE(ex_system_wait_mutex);
 
@@ -124,7 +132,7 @@ acpi_status acpi_ex_system_wait_mutex(acpi_mutex mutex, u16 timeout)
 
                 /* We must wait, so unlock the interpreter */
 
-                acpi_ex_relinquish_interpreter();
+                acpi_ex_exit_interpreter();
 
                 status = acpi_os_acquire_mutex(mutex, timeout);
 
@@ -134,7 +142,13 @@ acpi_status acpi_ex_system_wait_mutex(acpi_mutex mutex, u16 timeout)
 
                 /* Reacquire the interpreter */
 
-                acpi_ex_reacquire_interpreter();
+                status2 = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status2)) {
+
+                        /* Report fatal error, could not acquire interpreter */
+
+                        return_ACPI_STATUS(status2);
+                }
         }
 
         return_ACPI_STATUS(status);
@@ -195,18 +209,20 @@ acpi_status acpi_ex_system_do_stall(u32 how_long)
 
 acpi_status acpi_ex_system_do_suspend(acpi_integer how_long)
 {
+        acpi_status status;
+
         ACPI_FUNCTION_ENTRY();
 
         /* Since this thread will sleep, we must release the interpreter */
 
-        acpi_ex_relinquish_interpreter();
+        acpi_ex_exit_interpreter();
 
         acpi_os_sleep(how_long);
 
         /* And now we must get the interpreter again */
 
-        acpi_ex_reacquire_interpreter();
-        return (AE_OK);
+        status = acpi_ex_enter_interpreter();
+        return (status);
 }
 
 /*******************************************************************************
diff --git a/drivers/acpi/executer/exutils.c b/drivers/acpi/executer/exutils.c
index 6b0aeccbb69b..aea461f3a48c 100644
--- a/drivers/acpi/executer/exutils.c
+++ b/drivers/acpi/executer/exutils.c
@@ -76,15 +76,14 @@ static u32 acpi_ex_digits_needed(acpi_integer value, u32 base);
  *
  * PARAMETERS:  None
  *
- * RETURN:      None
+ * RETURN:      Status
  *
- * DESCRIPTION: Enter the interpreter execution region. Failure to enter
- *              the interpreter region is a fatal system error. Used in
- *              conjunction with exit_interpreter.
+ * DESCRIPTION: Enter the interpreter execution region.  Failure to enter
+ *              the interpreter region is a fatal system error
  *
  ******************************************************************************/
 
-void acpi_ex_enter_interpreter(void)
+acpi_status acpi_ex_enter_interpreter(void)
 {
         acpi_status status;
 
@@ -92,42 +91,10 @@ void acpi_ex_enter_interpreter(void)
 
         status = acpi_ut_acquire_mutex(ACPI_MTX_INTERPRETER);
         if (ACPI_FAILURE(status)) {
-                ACPI_ERROR((AE_INFO,
-                            "Could not acquire AML Interpreter mutex"));
+                ACPI_ERROR((AE_INFO, "Could not acquire interpreter mutex"));
         }
 
-        return_VOID;
-}
-
-/*******************************************************************************
- *
- * FUNCTION:    acpi_ex_reacquire_interpreter
- *
- * PARAMETERS:  None
- *
- * RETURN:      None
- *
- * DESCRIPTION: Reacquire the interpreter execution region from within the
- *              interpreter code. Failure to enter the interpreter region is a
- *              fatal system error. Used in  conjuction with
- *              relinquish_interpreter
- *
- ******************************************************************************/
-
-void acpi_ex_reacquire_interpreter(void)
-{
-        ACPI_FUNCTION_TRACE(ex_reacquire_interpreter);
-
-        /*
-         * If the global serialized flag is set, do not release the interpreter,
-         * since it was not actually released by acpi_ex_relinquish_interpreter.
-         * This forces the interpreter to be single threaded.
-         */
-        if (!acpi_gbl_all_methods_serialized) {
-                acpi_ex_enter_interpreter();
-        }
-
-        return_VOID;
+        return_ACPI_STATUS(status);
 }
 
 /*******************************************************************************
@@ -138,9 +105,17 @@ void acpi_ex_reacquire_interpreter(void)
  *
  * RETURN:      None
  *
- * DESCRIPTION: Exit the interpreter execution region. This is the top level
- *              routine used to exit the interpreter when all processing has
- *              been completed.
+ * DESCRIPTION: Exit the interpreter execution region
+ *
+ * Cases where the interpreter is unlocked:
+ *      1) Completion of the execution of a control method
+ *      2) Method blocked on a Sleep() AML opcode
+ *      3) Method blocked on an Acquire() AML opcode
+ *      4) Method blocked on a Wait() AML opcode
+ *      5) Method blocked to acquire the global lock
+ *      6) Method blocked to execute a serialized control method that is
+ *          already executing
+ *      7) About to invoke a user-installed opregion handler
  *
  ******************************************************************************/
 
@@ -152,46 +127,7 @@ void acpi_ex_exit_interpreter(void)
 
         status = acpi_ut_release_mutex(ACPI_MTX_INTERPRETER);
         if (ACPI_FAILURE(status)) {
-                ACPI_ERROR((AE_INFO,
-                            "Could not release AML Interpreter mutex"));
-        }
-
-        return_VOID;
-}
-
-/*******************************************************************************
- *
- * FUNCTION:    acpi_ex_relinquish_interpreter
- *
- * PARAMETERS:  None
- *
- * RETURN:      None
- *
- * DESCRIPTION: Exit the interpreter execution region, from within the
- *              interpreter - before attempting an operation that will possibly
- *              block the running thread.
- *
- * Cases where the interpreter is unlocked internally
- *      1) Method to be blocked on a Sleep() AML opcode
- *      2) Method to be blocked on an Acquire() AML opcode
- *      3) Method to be blocked on a Wait() AML opcode
- *      4) Method to be blocked to acquire the global lock
- *      5) Method to be blocked waiting to execute a serialized control method
- *          that is currently executing
- *      6) About to invoke a user-installed opregion handler
- *
- ******************************************************************************/
-
-void acpi_ex_relinquish_interpreter(void)
-{
-        ACPI_FUNCTION_TRACE(ex_relinquish_interpreter);
-
-        /*
-         * If the global serialized flag is set, do not release the interpreter.
-         * This forces the interpreter to be single threaded.
-         */
-        if (!acpi_gbl_all_methods_serialized) {
-                acpi_ex_exit_interpreter();
+                ACPI_ERROR((AE_INFO, "Could not release interpreter mutex"));
         }
 
         return_VOID;
@@ -205,8 +141,8 @@ void acpi_ex_relinquish_interpreter(void)
  *
  * RETURN:      none
  *
- * DESCRIPTION: Truncate an ACPI Integer to 32 bits if the execution mode is
- *              32-bit, as determined by the revision of the DSDT.
+ * DESCRIPTION: Truncate a number to 32-bits if the currently executing method
+ *              belongs to a 32-bit ACPI table.
  *
  ******************************************************************************/
 
diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
index 8fa93125fd4c..c84b1faba28c 100644
--- a/drivers/acpi/hardware/hwsleep.c
+++ b/drivers/acpi/hardware/hwsleep.c
@@ -300,6 +300,11 @@ acpi_status asmlinkage acpi_enter_sleep_state(u8 sleep_state)
         /*
          * 2) Enable all wakeup GPEs
          */
+        status = acpi_hw_disable_all_gpes();
+        if (ACPI_FAILURE(status)) {
+                return_ACPI_STATUS(status);
+        }
+
         acpi_gbl_system_awake_and_running = FALSE;
 
         status = acpi_hw_enable_all_wakeup_gpes();
diff --git a/drivers/acpi/ibm_acpi.c b/drivers/acpi/ibm_acpi.c
index 36901362fd24..dc1096608f43 100644
--- a/drivers/acpi/ibm_acpi.c
+++ b/drivers/acpi/ibm_acpi.c
@@ -2507,7 +2507,7 @@ static int __init setup_notify(struct ibm_struct *ibm)
         ret = acpi_bus_get_device(*ibm->handle, &ibm->device);
         if (ret < 0) {
                 printk(IBM_ERR "%s device not present\n", ibm->name);
-                return 0;
+                return -ENODEV;
         }
 
         acpi_driver_data(ibm->device) = ibm;
@@ -2516,8 +2516,13 @@ static int __init setup_notify(struct ibm_struct *ibm)
         status = acpi_install_notify_handler(*ibm->handle, ibm->type,
                                              dispatch_notify, ibm);
         if (ACPI_FAILURE(status)) {
-                printk(IBM_ERR "acpi_install_notify_handler(%s) failed: %d\n",
-                       ibm->name, status);
+                if (status == AE_ALREADY_EXISTS) {
+                        printk(IBM_NOTICE "another device driver is already handling %s events\n",
+                                ibm->name);
+                } else {
+                        printk(IBM_ERR "acpi_install_notify_handler(%s) failed: %d\n",
+                                ibm->name, status);
+                }
                 return -ENODEV;
         }
         ibm->notify_installed = 1;
@@ -2553,6 +2558,8 @@ static int __init register_driver(struct ibm_struct *ibm)
         return ret;
 }
 
+static void ibm_exit(struct ibm_struct *ibm);
+
 static int __init ibm_init(struct ibm_struct *ibm)
 {
         int ret;
@@ -2594,6 +2601,12 @@ static int __init ibm_init(struct ibm_struct *ibm)
 
         if (ibm->notify) {
                 ret = setup_notify(ibm);
+                if (ret == -ENODEV) {
+                        printk(IBM_NOTICE "disabling subdriver %s\n",
+                                ibm->name);
+                        ibm_exit(ibm);
+                        return 0;
+                }
                 if (ret < 0)
                         return ret;
         }
diff --git a/drivers/acpi/namespace/nseval.c b/drivers/acpi/namespace/nseval.c
index aa6370c67ec1..26fd0dd6953d 100644
--- a/drivers/acpi/namespace/nseval.c
+++ b/drivers/acpi/namespace/nseval.c
@@ -154,7 +154,11 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
                  * Execute the method via the interpreter. The interpreter is locked
                  * here before calling into the AML parser
                  */
-                acpi_ex_enter_interpreter();
+                status = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
+
                 status = acpi_ps_execute_method(info);
                 acpi_ex_exit_interpreter();
         } else {
@@ -178,7 +182,10 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
                  * resolution, we must lock it because we could access an opregion.
                  * The opregion access code assumes that the interpreter is locked.
                  */
-                acpi_ex_enter_interpreter();
+                status = acpi_ex_enter_interpreter();
+                if (ACPI_FAILURE(status)) {
+                        return_ACPI_STATUS(status);
+                }
 
                 /* Function has a strange interface */
 
diff --git a/drivers/acpi/namespace/nsinit.c b/drivers/acpi/namespace/nsinit.c
index 33db2241044e..c4ab615f77fe 100644
--- a/drivers/acpi/namespace/nsinit.c
+++ b/drivers/acpi/namespace/nsinit.c
@@ -214,7 +214,7 @@ acpi_ns_init_one_object(acpi_handle obj_handle,
                         u32 level, void *context, void **return_value)
 {
         acpi_object_type type;
-        acpi_status status = AE_OK;
+        acpi_status status;
         struct acpi_init_walk_info *info =
             (struct acpi_init_walk_info *)context;
         struct acpi_namespace_node *node =
@@ -268,7 +268,10 @@ acpi_ns_init_one_object(acpi_handle obj_handle,
         /*
          * Must lock the interpreter before executing AML code
          */
-        acpi_ex_enter_interpreter();
+        status = acpi_ex_enter_interpreter();
+        if (ACPI_FAILURE(status)) {
+                return (status);
+        }
 
         /*
          * Each of these types can contain executable AML code within the
diff --git a/drivers/acpi/namespace/nsxfeval.c b/drivers/acpi/namespace/nsxfeval.c
index 7ac6ace50059..8904d0fae6a2 100644
--- a/drivers/acpi/namespace/nsxfeval.c
+++ b/drivers/acpi/namespace/nsxfeval.c
@@ -170,6 +170,7 @@ acpi_evaluate_object(acpi_handle handle,
                      struct acpi_buffer *return_buffer)
 {
         acpi_status status;
+        acpi_status status2;
         struct acpi_evaluate_info *info;
         acpi_size buffer_space_needed;
         u32 i;
@@ -328,12 +329,14 @@ acpi_evaluate_object(acpi_handle handle,
                  * Delete the internal return object. NOTE: Interpreter must be
                  * locked to avoid race condition.
                  */
-                acpi_ex_enter_interpreter();
+                status2 = acpi_ex_enter_interpreter();
+                if (ACPI_SUCCESS(status2)) {
 
-                /* Remove one reference on the return object (should delete it) */
+                        /* Remove one reference on the return object (should delete it) */
 
-                acpi_ut_remove_reference(info->return_object);
-                acpi_ex_exit_interpreter();
+                        acpi_ut_remove_reference(info->return_object);
+                        acpi_ex_exit_interpreter();
+                }
         }
 
       cleanup:
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 60773005b8af..cdf78943af4d 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -268,6 +268,7 @@ static void acpi_timer_check_state(int state, struct acpi_processor *pr,
                                    struct acpi_processor_cx *cx)
 {
         struct acpi_processor_power *pwr = &pr->power;
+        u8 type = local_apic_timer_c2_ok ? ACPI_STATE_C3 : ACPI_STATE_C2;
 
         /*
          * Check, if one of the previous states already marked the lapic
@@ -276,7 +277,7 @@ static void acpi_timer_check_state(int state, struct acpi_processor *pr,
         if (pwr->timer_broadcast_on_state < state)
                 return;
 
-        if (cx->type >= ACPI_STATE_C2)
+        if (cx->type >= type)
                 pr->power.timer_broadcast_on_state = state;
 }
 
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index 849e2c361804..96792a6cc164 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -42,7 +42,9 @@ static char *mps_inti_flags_trigger[] = { "dfl", "edge", "res", "level" };
 
 static struct acpi_table_desc initial_tables[ACPI_MAX_TABLES] __initdata;
 
-void acpi_table_print_madt_entry(struct acpi_subtable_header * header)
+static int acpi_apic_instance __initdata = 2;
+
+void acpi_table_print_madt_entry(struct acpi_subtable_header *header)
 {
         if (!header)
                 return;
@@ -183,8 +185,10 @@ acpi_table_parse_entries(char *id,
         if (!handler)
                 return -EINVAL;
 
-        /* Locate the table (if exists). There should only be one. */
-        acpi_get_table(id, 0, &table_header);
+        if (strncmp(id, ACPI_SIG_MADT, 4) == 0)
+                acpi_get_table(id, acpi_apic_instance, &table_header);
+        else
+                acpi_get_table(id, 0, &table_header);
 
         if (!table_header) {
                 printk(KERN_WARNING PREFIX "%4.4s not present\n", id);
@@ -237,10 +241,15 @@ acpi_table_parse_madt(enum acpi_madt_type id,
 int __init acpi_table_parse(char *id, acpi_table_handler handler)
 {
         struct acpi_table_header *table = NULL;
+
         if (!handler)
                 return -EINVAL;
 
-        acpi_get_table(id, 0, &table);
+        if (strncmp(id, ACPI_SIG_MADT, 4) == 0)
+                acpi_get_table(id, acpi_apic_instance, &table);
+        else
+                acpi_get_table(id, 0, &table);
+
         if (table) {
                 handler(table);
                 return 0;
@@ -248,6 +257,31 @@ int __init acpi_table_parse(char *id, acpi_table_handler handler)
                 return 1;
 }
 
+/* 
+ * The BIOS is supposed to supply a single APIC/MADT,
+ * but some report two.  Provide a knob to use either.
+ * (don't you wish instance 0 and 1 were not the same?)
+ */
+static void __init check_multiple_madt(void)
+{
+        struct acpi_table_header *table = NULL;
+
+        acpi_get_table(ACPI_SIG_MADT, 2, &table);
+        if (table) {
+                printk(KERN_WARNING PREFIX
+                       "BIOS bug: multiple APIC/MADT found,"
+                       " using %d\n", acpi_apic_instance);
+                printk(KERN_WARNING PREFIX
+                       "If \"acpi_apic_instance=%d\" works better, "
+                       "notify linux-acpi@vger.kernel.org\n",
+                       acpi_apic_instance ? 0 : 2);
+
+        } else
+                acpi_apic_instance = 0;
+
+        return;
+}
+
 /*
  * acpi_table_init()
  *
@@ -257,9 +291,22 @@ int __init acpi_table_parse(char *id, acpi_table_handler handler)
  * result: sdt_entry[] is initialized
  */
 
-
 int __init acpi_table_init(void)
 {
         acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
+        check_multiple_madt();
+        return 0;
+}
+
+static int __init acpi_parse_apic_instance(char *str)
+{
+
+        acpi_apic_instance = simple_strtoul(str, NULL, 0);
+
+        printk(KERN_NOTICE PREFIX "Shall use APIC/MADT table %d\n",
+               acpi_apic_instance);
+
         return 0;
 }
+
+early_param("acpi_apic_instance", acpi_parse_apic_instance);
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index d16b5b0c8b76..7bdbe5a914d0 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -564,7 +564,7 @@ config PATA_IXP4XX_CF
 
 config PATA_SCC
         tristate "Toshiba's Cell Reference Set IDE support"
-        depends on PCI && PPC_IBM_CELL_BLADE
+        depends on PCI && PPC_CELLEB
         help
           This option enables support for the built-in IDE controller on
           Toshiba Cell Reference Board.
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3c1f8830ac8b..bf327d473ce9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -826,7 +826,7 @@ static u64 ata_id_n_sectors(const u16 *id)
 /**
  *      ata_id_to_dma_mode      -       Identify DMA mode from id block
  *      @dev: device to identify
- *      @mode: mode to assume if we cannot tell
+ *      @unknown: mode to assume if we cannot tell
  *
  *      Set up the timing values for the device based upon the identify
  *      reported values for the DMA mode. This function is used by drivers
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 7349c3dbf774..361953a50203 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1625,8 +1625,14 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
                 rc = prereset(ap);
                 if (rc) {
                         if (rc == -ENOENT) {
-                                ata_port_printk(ap, KERN_DEBUG, "port disabled. ignoring.\n");
+                                ata_port_printk(ap, KERN_DEBUG,
+                                                "port disabled. ignoring.\n");
                                 ap->eh_context.i.action &= ~ATA_EH_RESET_MASK;
+
+                                for (i = 0; i < ATA_MAX_DEVICES; i++)
+                                        classes[i] = ATA_DEV_NONE;
+
+                                rc = 0;
                         } else
                                 ata_port_printk(ap, KERN_ERR,
                                         "prereset failed (errno=%d)\n", rc);
diff --git a/drivers/ata/pata_cs5520.c b/drivers/ata/pata_cs5520.c
index 7ef834250a43..55cc293e7487 100644
--- a/drivers/ata/pata_cs5520.c
+++ b/drivers/ata/pata_cs5520.c
@@ -208,7 +208,7 @@ static struct ata_port_operations cs5520_port_ops = {
 static int __devinit cs5520_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 {
         u8 pcicfg;
-        void *iomap[5];
+        void __iomem *iomap[5];
         static struct ata_probe_ent probe[2];
         int ports = 0;
 
diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c
index 9a0523b5c947..c6f0e1927551 100644
--- a/drivers/ata/pata_ixp4xx_cf.c
+++ b/drivers/ata/pata_ixp4xx_cf.c
@@ -193,7 +193,7 @@ static __devinit int ixp4xx_pata_probe(struct platform_device *pdev)
 
         irq = platform_get_irq(pdev, 0);
         if (irq)
-                set_irq_type(irq, IRQT_HIGH);
+                set_irq_type(irq, IRQT_RISING);
 
         /* Setup expansion bus chip selects */
         *data->cs0_cfg = data->cs0_bits;
@@ -232,7 +232,6 @@ static __devexit int ixp4xx_pata_remove(struct platform_device *dev)
         struct ata_host *host = platform_get_drvdata(dev);
 
         ata_host_detach(host);
-        platform_set_drvdata(dev, NULL);
 
         return 0;
 }
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index f5d88729ca79..882c36eaf293 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -329,7 +329,7 @@ mpc52xx_ata_init_one(struct device *dev, struct mpc52xx_ata_priv *priv)
         ae->dev = dev;
         ae->irq = priv->ata_irq;
 
-        aio->cmd_addr           = 0;    /* Don't have a classic reg block */
+        aio->cmd_addr           = NULL; /* Don't have a classic reg block */
         aio->altstatus_addr     = &priv->ata_regs->tf_control;
         aio->ctl_addr           = &priv->ata_regs->tf_control;
         aio->data_addr          = &priv->ata_regs->tf_data;
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index 3193a603d1a1..1e21688bfcf2 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -672,10 +672,6 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 return rc;
 
-        rc = pci_request_regions(pdev, DRV_NAME);
-        if (rc)
-                return rc;
-
         rc = pcim_iomap_regions(pdev, 0x3f, DRV_NAME);
         if (rc)
                 return rc;
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 75d961599651..5614df8c1ce2 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -346,6 +346,7 @@ static const struct pci_device_id sil24_pci_tbl[] = {
         { PCI_VDEVICE(CMD, 0x3124), BID_SIL3124 },
         { PCI_VDEVICE(INTEL, 0x3124), BID_SIL3124 },
         { PCI_VDEVICE(CMD, 0x3132), BID_SIL3132 },
+        { PCI_VDEVICE(CMD, 0x0242), BID_SIL3132 },
         { PCI_VDEVICE(CMD, 0x3131), BID_SIL3131 },
         { PCI_VDEVICE(CMD, 0x3531), BID_SIL3131 },
 
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index 1879e0cd56aa..a787f0d4a5ba 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -354,7 +354,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENOMEM;
 
         if (!(probe_ent->port_flags & SIS_FLAG_CFGSCR)) {
-                void *mmio;
+                void __iomem *mmio;
 
                 mmio = pcim_iomap(pdev, SIS_SCR_PCI_BAR, 0);
                 if (!mmio)
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 0d7091e2077f..2ad2527cf5b3 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -1177,7 +1177,7 @@ static void __devinit eprom_get_esi(struct atm_dev *dev)
 /*--------------------------------- entries ---------------------------------*/
 
 
-static int __init zatm_init(struct atm_dev *dev)
+static int __devinit zatm_init(struct atm_dev *dev)
 {
         struct zatm_dev *zatm_dev;
         struct pci_dev *pci_dev;
@@ -1256,7 +1256,7 @@ static int __init zatm_init(struct atm_dev *dev)
 }
 
 
-static int __init zatm_start(struct atm_dev *dev)
+static int __devinit zatm_start(struct atm_dev *dev)
 {
         struct zatm_dev *zatm_dev = ZATM_DEV(dev);
         struct pci_dev *pdev = zatm_dev->pci_dev;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index f191afe62b4d..ad0f4a2f25c4 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -407,6 +407,35 @@ void device_remove_bin_file(struct device *dev, struct bin_attribute *attr)
 }
 EXPORT_SYMBOL_GPL(device_remove_bin_file);
 
+/**
+ * device_schedule_callback - helper to schedule a callback for a device
+ * @dev: device.
+ * @func: callback function to invoke later.
+ *
+ * Attribute methods must not unregister themselves or their parent device
+ * (which would amount to the same thing).  Attempts to do so will deadlock,
+ * since unregistration is mutually exclusive with driver callbacks.
+ *
+ * Instead methods can call this routine, which will attempt to allocate
+ * and schedule a workqueue request to call back @func with @dev as its
+ * argument in the workqueue's process context.  @dev will be pinned until
+ * @func returns.
+ *
+ * Returns 0 if the request was submitted, -ENOMEM if storage could not
+ * be allocated.
+ *
+ * NOTE: This routine won't work if CONFIG_SYSFS isn't set!  It uses an
+ * underlying sysfs routine (since it is intended for use by attribute
+ * methods), and if sysfs isn't available you'll get nothing but -ENOSYS.
+ */
+int device_schedule_callback(struct device *dev,
+                void (*func)(struct device *))
+{
+        return sysfs_schedule_callback(&dev->kobj,
+                        (void (*)(void *)) func, dev);
+}
+EXPORT_SYMBOL_GPL(device_schedule_callback);
+
 static void klist_children_get(struct klist_node *n)
 {
         struct device *dev = container_of(n, struct device, knode_parent);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 0c716ee905d7..072e18e6d76d 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1439,7 +1439,7 @@ static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
 
                 if (return_code == IO_OK) {
                         listlength =
-                                be32_to_cpu(*(__u32 *) ld_buff->LUNListLength);
+                                be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
                 } else {        /* reading number of logical volumes failed */
                         printk(KERN_WARNING "cciss: report logical volume"
                                " command failed\n");
@@ -1961,8 +1961,8 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
                                 ctlr, buf, sizeof(ReadCapdata_struct),
                                         1, logvol, 0, NULL, TYPE_CMD);
         if (return_code == IO_OK) {
-                *total_size = be32_to_cpu(*(__u32 *) buf->total_size);
-                *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
+                *total_size = be32_to_cpu(*(__be32 *) buf->total_size);
+                *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
         } else {                /* read capacity command failed */
                 printk(KERN_WARNING "cciss: read capacity failed\n");
                 *total_size = 0;
@@ -1997,8 +1997,8 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
                                 1, logvol, 0, NULL, TYPE_CMD);
         }
         if (return_code == IO_OK) {
-                *total_size = be64_to_cpu(*(__u64 *) buf->total_size);
-                *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
+                *total_size = be64_to_cpu(*(__be64 *) buf->total_size);
+                *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
         } else {                /* read capacity command failed */
                 printk(KERN_WARNING "cciss: read capacity failed\n");
                 *total_size = 0;
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 99e2c8ce1cc4..31e01488eb51 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -663,11 +663,11 @@ static enum action pd_identify(struct pd_unit *disk)
                 return Fail;
         pi_read_block(disk->pi, pd_scratch, 512);
         disk->can_lba = pd_scratch[99] & 2;
-        disk->sectors = le16_to_cpu(*(u16 *) (pd_scratch + 12));
-        disk->heads = le16_to_cpu(*(u16 *) (pd_scratch + 6));
-        disk->cylinders = le16_to_cpu(*(u16 *) (pd_scratch + 2));
+        disk->sectors = le16_to_cpu(*(__le16 *) (pd_scratch + 12));
+        disk->heads = le16_to_cpu(*(__le16 *) (pd_scratch + 6));
+        disk->cylinders = le16_to_cpu(*(__le16 *) (pd_scratch + 2));
         if (disk->can_lba)
-                disk->capacity = le32_to_cpu(*(u32 *) (pd_scratch + 120));
+                disk->capacity = le32_to_cpu(*(__le32 *) (pd_scratch + 120));
         else
                 disk->capacity = disk->sectors * disk->heads * disk->cylinders;
 
diff --git a/drivers/char/generic_serial.c b/drivers/char/generic_serial.c
index 337bbcdcf13d..8ea02755b1c9 100644
--- a/drivers/char/generic_serial.c
+++ b/drivers/char/generic_serial.c
@@ -710,12 +710,6 @@ void gs_close(struct tty_struct * tty, struct file * filp)
 }
 
 
-static unsigned int     gs_baudrates[] = {
-  0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
-  9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600
-};
-
-
 void gs_set_termios (struct tty_struct * tty, 
                      struct ktermios * old_termios)
 {
@@ -771,7 +765,6 @@ void gs_set_termios (struct tty_struct * tty,
 
         baudrate = tty_get_baud_rate(tty);
 
-        baudrate = gs_baudrates[baudrate];
         if ((tiosp->c_cflag & CBAUD) == B38400) {
                 if (     (port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
                         baudrate = 57600;
diff --git a/drivers/char/lcd.c b/drivers/char/lcd.c
index 5f4fdcf7c96e..1f0962616ee5 100644
--- a/drivers/char/lcd.c
+++ b/drivers/char/lcd.c
@@ -11,9 +11,6 @@
  *       March 2001: Ported from 2.0.34  by Liam Davies
  *
  */
-
-#define RTC_IO_EXTENT   0x10    /*Only really two ports, but... */
-
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/miscdevice.h>
@@ -32,8 +29,6 @@
 
 #include "lcd.h"
 
-static DEFINE_SPINLOCK(lcd_lock);
-
 static int lcd_ioctl(struct inode *inode, struct file *file,
                      unsigned int cmd, unsigned long arg);
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index e45326856680..7a32df594907 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1376,6 +1376,8 @@ static void do_tty_hangup(struct work_struct *work)
         read_unlock(&tasklist_lock);
 
         tty->flags = 0;
+        put_pid(tty->session);
+        put_pid(tty->pgrp);
         tty->session = NULL;
         tty->pgrp = NULL;
         tty->ctrl_status = 0;
@@ -3841,6 +3843,9 @@ static struct pid *__proc_set_tty(struct task_struct *tsk, struct tty_struct *tt
 {
         struct pid *old_pgrp;
         if (tty) {
+                /* We should not have a session or pgrp to here but.... */
+                put_pid(tty->session);
+                put_pid(tty->pgrp);
                 tty->session = get_pid(task_session(tsk));
                 tty->pgrp = get_pid(task_pgrp(tsk));
         }
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index c3f8e383933b..1bbb45b937fd 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -724,6 +724,7 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
                 return -ENOMEM;
             memset(vc, 0, sizeof(*vc));
             vc_cons[currcons].d = vc;
+            INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
             visual_init(vc, currcons, 1);
             if (!*vc->vc_uni_pagedir_loc)
                 con_set_default_unimap(vc);
@@ -2185,10 +2186,28 @@ static void console_callback(struct work_struct *ignored)
         release_console_sem();
 }
 
-void set_console(int nr)
+int set_console(int nr)
 {
+        struct vc_data *vc = vc_cons[fg_console].d;
+
+        if (!vc_cons_allocated(nr) || vt_dont_switch ||
+                (vc->vt_mode.mode == VT_AUTO && vc->vc_mode == KD_GRAPHICS)) {
+
+                /*
+                 * Console switch will fail in console_callback() or
+                 * change_console() so there is no point scheduling
+                 * the callback
+                 *
+                 * Existing set_console() users don't check the return
+                 * value so this shouldn't break anything
+                 */
+                return -EINVAL;
+        }
+
         want_console = nr;
         schedule_console_callback();
+
+        return 0;
 }
 
 struct tty_driver *console_driver;
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 3a5d301e783b..1fa2da8f4fbe 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -34,7 +34,7 @@
 #include <linux/kbd_diacr.h>
 #include <linux/selection.h>
 
-static char vt_dont_switch;
+char vt_dont_switch;
 extern struct tty_driver *console_driver;
 
 #define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count)
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index ea09d0c974ea..e812aa129e28 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -301,6 +301,7 @@ config I6300ESB_WDT
 config I8XX_TCO
         tristate "Intel i8xx TCO Timer/Watchdog"
         depends on WATCHDOG && (X86 || IA64) && PCI
+        default n
         ---help---
           Hardware driver for the TCO timer built into the Intel 82801
           I/O Controller Hub family.  The TCO (Total Cost of Ownership)
diff --git a/drivers/char/watchdog/machzwd.c b/drivers/char/watchdog/machzwd.c
index 4a328ba0d262..76c7fa37fa6c 100644
--- a/drivers/char/watchdog/machzwd.c
+++ b/drivers/char/watchdog/machzwd.c
@@ -314,21 +314,21 @@ static int zf_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 {
         void __user *argp = (void __user *)arg;
         int __user *p = argp;
-        switch(cmd){
-                case WDIOC_GETSUPPORT:
-                        if (copy_to_user(argp, &zf_info, sizeof(zf_info)))
-                                return -EFAULT;
-                        break;
+        switch (cmd) {
+        case WDIOC_GETSUPPORT:
+                if (copy_to_user(argp, &zf_info, sizeof(zf_info)))
+                        return -EFAULT;
+                break;
 
-                case WDIOC_GETSTATUS:
-                        return put_user(0, p);
+        case WDIOC_GETSTATUS:
+                return put_user(0, p);
 
-                case WDIOC_KEEPALIVE:
-                        zf_ping(0);
-                        break;
+        case WDIOC_KEEPALIVE:
+                zf_ping(0);
+                break;
 
-                default:
-                        return -ENOTTY;
+        default:
+                return -ENOTTY;
         }
 
         return 0;
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index d42060ede930..5ac309ee7f05 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -90,7 +90,7 @@ __setup("acpi_pm_good", acpi_pm_good_setup);
 static inline void acpi_pm_need_workaround(void)
 {
         clocksource_acpi_pm.read = acpi_pm_read_slow;
-        clocksource_acpi_pm.rating = 110;
+        clocksource_acpi_pm.rating = 120;
 }
 
 /*
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index f52facc570f5..3162010900c9 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1015,6 +1015,10 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
 {
         unsigned int cpu = sys_dev->id;
         int retval;
+
+        if (cpu_is_offline(cpu))
+                return 0;
+
         if (unlikely(lock_policy_rwsem_write(cpu)))
                 BUG();
 
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 15278044295c..322ee2984e3d 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -176,6 +176,7 @@ void dma_chan_cleanup(struct kref *kref)
         chan->client = NULL;
         kref_put(&chan->device->refcount, dma_async_device_cleanup);
 }
+EXPORT_SYMBOL(dma_chan_cleanup);
 
 static void dma_chan_free_rcu(struct rcu_head *rcu)
 {
@@ -261,6 +262,7 @@ struct dma_client *dma_async_client_register(dma_event_callback event_callback)
 
         return client;
 }
+EXPORT_SYMBOL(dma_async_client_register);
 
 /**
  * dma_async_client_unregister - unregister a client and free the &dma_client
@@ -287,6 +289,7 @@ void dma_async_client_unregister(struct dma_client *client)
         kfree(client);
         dma_chans_rebalance();
 }
+EXPORT_SYMBOL(dma_async_client_unregister);
 
 /**
  * dma_async_client_chan_request - request DMA channels
@@ -304,6 +307,7 @@ void dma_async_client_chan_request(struct dma_client *client,
         client->chans_desired = number;
         dma_chans_rebalance();
 }
+EXPORT_SYMBOL(dma_async_client_chan_request);
 
 /**
  * dma_async_device_register - registers DMA devices found
@@ -346,6 +350,7 @@ int dma_async_device_register(struct dma_device *device)
 
         return 0;
 }
+EXPORT_SYMBOL(dma_async_device_register);
 
 /**
  * dma_async_device_cleanup - function called when all references are released
@@ -390,23 +395,12 @@ void dma_async_device_unregister(struct dma_device *device)
         kref_put(&device->refcount, dma_async_device_cleanup);
         wait_for_completion(&device->done);
 }
+EXPORT_SYMBOL(dma_async_device_unregister);
 
 static int __init dma_bus_init(void)
 {
         mutex_init(&dma_list_mutex);
         return class_register(&dma_devclass);
 }
-
 subsys_initcall(dma_bus_init);
 
-EXPORT_SYMBOL(dma_async_client_register);
-EXPORT_SYMBOL(dma_async_client_unregister);
-EXPORT_SYMBOL(dma_async_client_chan_request);
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_buf);
-EXPORT_SYMBOL(dma_async_memcpy_buf_to_pg);
-EXPORT_SYMBOL(dma_async_memcpy_pg_to_pg);
-EXPORT_SYMBOL(dma_async_memcpy_complete);
-EXPORT_SYMBOL(dma_async_memcpy_issue_pending);
-EXPORT_SYMBOL(dma_async_device_register);
-EXPORT_SYMBOL(dma_async_device_unregister);
-EXPORT_SYMBOL(dma_chan_cleanup);
diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
index 9e913629ef39..74edb1d0110f 100644
--- a/drivers/eisa/pci_eisa.c
+++ b/drivers/eisa/pci_eisa.c
@@ -19,8 +19,8 @@
 /* There is only *one* pci_eisa device per machine, right ? */
 static struct eisa_root_device pci_eisa_root;
 
-static int __devinit pci_eisa_init (struct pci_dev *pdev,
-                                    const struct pci_device_id *ent)
+static int __init pci_eisa_init(struct pci_dev *pdev,
+                                const struct pci_device_id *ent)
 {
         int rc;
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f4ee1afe488f..67f3347afcf3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -26,6 +26,7 @@
 #include <asm/byteorder.h>
 #include <linux/input.h>
 #include <linux/wait.h>
+#include <linux/vmalloc.h>
 
 #include <linux/hid.h>
 #include <linux/hiddev.h>
@@ -654,12 +655,13 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
         memcpy(device->rdesc, start, size);
         device->rsize = size;
 
-        if (!(parser = kzalloc(sizeof(struct hid_parser), GFP_KERNEL))) {
+        if (!(parser = vmalloc(sizeof(struct hid_parser)))) {
                 kfree(device->rdesc);
                 kfree(device->collection);
                 kfree(device);
                 return NULL;
         }
+        memset(parser, 0, sizeof(struct hid_parser));
         parser->device = device;
 
         end = start + size;
@@ -668,7 +670,7 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                 if (item.format != HID_ITEM_FORMAT_SHORT) {
                         dbg("unexpected long global item");
                         hid_free_device(device);
-                        kfree(parser);
+                        vfree(parser);
                         return NULL;
                 }
 
@@ -676,7 +678,7 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                         dbg("item %u %u %u %u parsing failed\n",
                                 item.format, (unsigned)item.size, (unsigned)item.type, (unsigned)item.tag);
                         hid_free_device(device);
-                        kfree(parser);
+                        vfree(parser);
                         return NULL;
                 }
 
@@ -684,23 +686,23 @@ struct hid_device *hid_parse_report(__u8 *start, unsigned size)
                         if (parser->collection_stack_ptr) {
                                 dbg("unbalanced collection at end of report description");
                                 hid_free_device(device);
-                                kfree(parser);
+                                vfree(parser);
                                 return NULL;
                         }
                         if (parser->local.delimiter_depth) {
                                 dbg("unbalanced delimiter at end of report description");
                                 hid_free_device(device);
-                                kfree(parser);
+                                vfree(parser);
                                 return NULL;
                         }
-                        kfree(parser);
+                        vfree(parser);
                         return device;
                 }
         }
 
         dbg("item fetching failed at offset %d\n", (int)(end - start));
         hid_free_device(device);
-        kfree(parser);
+        vfree(parser);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(hid_parse_report);
@@ -753,8 +755,7 @@ static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
 
         report += offset >> 3;  /* adjust byte index */
         offset &= 7;            /* now only need bit offset into one byte */
-        x = get_unaligned((u64 *) report);
-        x = le64_to_cpu(x);
+        x = le64_to_cpu(get_unaligned((__le64 *) report));
         x = (x >> offset) & ((1ULL << n) - 1);  /* extract bit field */
         return (u32) x;
 }
@@ -769,7 +770,7 @@ static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
  */
 static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u32 value)
 {
-        u64 x;
+        __le64 x;
         u64 m = (1ULL << n) - 1;
 
         WARN_ON(n > 32);
@@ -780,10 +781,10 @@ static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u3
         report += offset >> 3;
         offset &= 7;
 
-        x = get_unaligned((u64 *)report);
+        x = get_unaligned((__le64 *)report);
         x &= cpu_to_le64(~(m << offset));
         x |= cpu_to_le64(((u64) value) << offset);
-        put_unaligned(x, (u64 *) report);
+        put_unaligned(x, (__le64 *) report);
 }
 
 /*
@@ -873,10 +874,6 @@ static void hid_output_field(struct hid_field *field, __u8 *data)
         unsigned size = field->report_size;
         unsigned n;
 
-        /* make sure the unused bits in the last byte are zeros */
-        if (count > 0 && size > 0)
-                data[(offset+count*size-1)/8] = 0;
-
         for (n = 0; n < count; n++) {
                 if (field->logical_minimum < 0) /* signed values */
                         implement(data, offset + n * size, size, s32ton(field->value[n], size));
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index c3d4856fb618..6d105a1d41b1 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -527,6 +527,7 @@ config SENSORS_W83792D
 config SENSORS_W83793
         tristate "Winbond W83793"
         depends on HWMON && I2C && EXPERIMENTAL
+        select HWMON_VID
         help
           If you say yes here you get support for the Winbond W83793
           hardware monitoring chip.
diff --git a/drivers/i2c/busses/i2c-amd8111.c b/drivers/i2c/busses/i2c-amd8111.c
index e15f9e37716a..0c70f8293341 100644
--- a/drivers/i2c/busses/i2c-amd8111.c
+++ b/drivers/i2c/busses/i2c-amd8111.c
@@ -254,7 +254,8 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr,
                         break;
 
                 case I2C_SMBUS_BLOCK_PROC_CALL:
-                        len = min_t(u8, data->block[0], 31);
+                        len = min_t(u8, data->block[0],
+                                    I2C_SMBUS_BLOCK_MAX - 1);
                         amd_ec_write(smbus, AMD_SMB_CMD, command);
                         amd_ec_write(smbus, AMD_SMB_BCNT, len);
                         for (i = 0; i < len; i++)
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 6569a36985bd..a320e7d82c1f 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -97,6 +97,7 @@ static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
                                   int command, int hwpec);
 
 static unsigned long i801_smba;
+static unsigned char i801_original_hstcfg;
 static struct pci_driver i801_driver;
 static struct pci_dev *I801_dev;
 static int isich4;
@@ -510,6 +511,7 @@ static int __devinit i801_probe(struct pci_dev *dev, const struct pci_device_id
         }
 
         pci_read_config_byte(I801_dev, SMBHSTCFG, &temp);
+        i801_original_hstcfg = temp;
         temp &= ~SMBHSTCFG_I2C_EN;      /* SMBus timing */
         if (!(temp & SMBHSTCFG_HST_EN)) {
                 dev_info(&dev->dev, "Enabling SMBus device\n");
@@ -543,6 +545,7 @@ exit:
 static void __devexit i801_remove(struct pci_dev *dev)
 {
         i2c_del_adapter(&i801_adapter);
+        pci_write_config_byte(I801_dev, SMBHSTCFG, i801_original_hstcfg);
         pci_release_region(dev, SMBBAR);
         /*
          * do not call pci_disable_device(dev) since it can cause hard hangs on
@@ -550,11 +553,33 @@ static void __devexit i801_remove(struct pci_dev *dev)
          */
 }
 
+#ifdef CONFIG_PM
+static int i801_suspend(struct pci_dev *dev, pm_message_t mesg)
+{
+        pci_save_state(dev);
+        pci_write_config_byte(dev, SMBHSTCFG, i801_original_hstcfg);
+        pci_set_power_state(dev, pci_choose_state(dev, mesg));
+        return 0;
+}
+
+static int i801_resume(struct pci_dev *dev)
+{
+        pci_set_power_state(dev, PCI_D0);
+        pci_restore_state(dev);
+        return pci_enable_device(dev);
+}
+#else
+#define i801_suspend NULL
+#define i801_resume NULL
+#endif
+
 static struct pci_driver i801_driver = {
         .name           = "i801_smbus",
         .id_table       = i801_ids,
         .probe          = i801_probe,
         .remove         = __devexit_p(i801_remove),
+        .suspend        = i801_suspend,
+        .resume         = i801_resume,
 };
 
 static int __init i2c_i801_init(void)
diff --git a/drivers/i2c/chips/ds1374.c b/drivers/i2c/chips/ds1374.c
index 15edf40828b4..8a2ff0c114d9 100644
--- a/drivers/i2c/chips/ds1374.c
+++ b/drivers/i2c/chips/ds1374.c
@@ -207,6 +207,10 @@ static int ds1374_probe(struct i2c_adapter *adap, int addr, int kind)
         client->driver = &ds1374_driver;
 
         ds1374_workqueue = create_singlethread_workqueue("ds1374");
+        if (!ds1374_workqueue) {
+                kfree(client);
+                return -ENOMEM; /* most expected reason */
+        }
 
         if ((rc = i2c_attach_client(client)) != 0) {
                 kfree(client);
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 5d134bb75ba1..ca2e4f830c39 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -103,8 +103,10 @@ config BLK_DEV_IDE_SATA
         ---help---
           There are two drivers for Serial ATA controllers.
 
-          The main driver, "libata", exists inside the SCSI subsystem
-          and supports most modern SATA controllers.
+          The main driver, "libata", uses the SCSI subsystem
+          and supports most modern SATA controllers. In order to use it
+          you may take a look at "Serial ATA (prod) and Parallel ATA
+          (experimental) drivers".
 
           The IDE driver (which you are currently configuring) supports
           a few first-generation SATA controllers.
@@ -434,24 +436,8 @@ config BLK_DEV_IDEDMA_FORCED
 
           Generally say N here.
 
-config IDEDMA_PCI_AUTO
-        bool "Use PCI DMA by default when available"
-        ---help---
-          Prior to kernel version 2.1.112, Linux used to automatically use
-          DMA for IDE drives and chipsets which support it. Due to concerns
-          about a couple of cases where buggy hardware may have caused damage,
-          the default is now to NOT use DMA automatically. To revert to the
-          previous behaviour, say Y to this question.
-
-          If you suspect your hardware is at all flakey, say N here.
-          Do NOT email the IDE kernel people regarding this issue!
-
-          It is normally safe to answer Y to this question unless your
-          motherboard uses a VIA VP2 chipset, in which case you should say N.
-
 config IDEDMA_ONLYDISK
         bool "Enable DMA only for disks "
-        depends on IDEDMA_PCI_AUTO
         help
           This is used if you know your ATAPI Devices are going to fail DMA
           Transfers.
@@ -769,6 +755,14 @@ config BLK_DEV_TC86C001
         help
         This driver adds support for Toshiba TC86C001 GOKU-S chip.
 
+config BLK_DEV_CELLEB
+        tristate "Toshiba's Cell Reference Set IDE support"
+        depends on PPC_CELLEB
+        help
+          This driver provides support for the built-in IDE controller on
+          Toshiba Cell Reference Board.
+          If unsure, say Y.
+
 endif
 
 config BLK_DEV_IDE_PMAC
@@ -800,14 +794,6 @@ config BLK_DEV_IDEDMA_PMAC
           to transfer data to and from memory.  Saying Y is safe and improves
           performance.
 
-config BLK_DEV_IDE_CELLEB
-        bool "Toshiba's Cell Reference Set IDE support"
-        depends on PPC_CELLEB
-        help
-          This driver provides support for the built-in IDE controller on
-          Toshiba Cell Reference Board.
-          If unsure, say Y.
-
 config BLK_DEV_IDE_SWARM
         tristate "IDE for Sibyte evaluation boards"
         depends on SIBYTE_SB1xxx_SOC
@@ -851,19 +837,6 @@ config BLK_DEV_IDEDMA_ICS
           Say Y here if you want to add DMA (Direct Memory Access) support to
           the ICS IDE driver.
 
-config IDEDMA_ICS_AUTO
-        bool "Use ICS DMA by default"
-        depends on BLK_DEV_IDEDMA_ICS
-        help
-          Prior to kernel version 2.1.112, Linux used to automatically use
-          DMA for IDE drives and chipsets which support it. Due to concerns
-          about a couple of cases where buggy hardware may have caused damage,
-          the default is now to NOT use DMA automatically. To revert to the
-          previous behaviour, say Y to this question.
-
-          If you suspect your hardware is at all flakey, say N here.
-          Do NOT email the IDE kernel people regarding this issue!
-
 config BLK_DEV_IDE_RAPIDE
         tristate "RapIDE interface support"
         depends on ARM && ARCH_ACORN
@@ -1086,9 +1059,6 @@ config IDEDMA_IVB
 
           It is normally safe to answer Y; however, the default is N.
 
-config IDEDMA_AUTO
-        def_bool IDEDMA_PCI_AUTO || IDEDMA_ICS_AUTO
-
 endif
 
 config BLK_DEV_HD_ONLY
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index 28feedfbd21d..d9f029e8ff74 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -37,7 +37,6 @@ ide-core-$(CONFIG_BLK_DEV_Q40IDE)	+= legacy/q40ide.o
 # built-in only drivers from ppc/
 ide-core-$(CONFIG_BLK_DEV_MPC8xx_IDE)   += ppc/mpc8xx.o
 ide-core-$(CONFIG_BLK_DEV_IDE_PMAC)     += ppc/pmac.o
-ide-core-$(CONFIG_BLK_DEV_IDE_CELLEB)   += ppc/scc_pata.o
 
 # built-in only drivers from h8300/
 ide-core-$(CONFIG_H8300)                += h8300/ide-h8300.o
diff --git a/drivers/ide/arm/icside.c b/drivers/ide/arm/icside.c
index 40e5c66b81ce..e2953fc1fafb 100644
--- a/drivers/ide/arm/icside.c
+++ b/drivers/ide/arm/icside.c
@@ -196,11 +196,6 @@ static void icside_maskproc(ide_drive_t *drive, int mask)
 }
 
 #ifdef CONFIG_BLK_DEV_IDEDMA_ICS
-
-#ifndef CONFIG_IDEDMA_ICS_AUTO
-#warning CONFIG_IDEDMA_ICS_AUTO=n support is obsolete, and will be removed soon.
-#endif
-
 /*
  * SG-DMA support.
  *
@@ -474,12 +469,6 @@ static int icside_dma_lostirq(ide_drive_t *drive)
 
 static void icside_dma_init(ide_hwif_t *hwif)
 {
-        int autodma = 0;
-
-#ifdef CONFIG_IDEDMA_ICS_AUTO
-        autodma = 1;
-#endif
-
         printk("    %s: SG-DMA", hwif->name);
 
         hwif->atapi_dma         = 1;
@@ -489,7 +478,7 @@ static void icside_dma_init(ide_hwif_t *hwif)
         hwif->dmatable_cpu      = NULL;
         hwif->dmatable_dma      = 0;
         hwif->speedproc         = icside_set_speed;
-        hwif->autodma           = autodma;
+        hwif->autodma           = 1;
 
         hwif->ide_dma_check     = icside_dma_check;
         hwif->dma_host_off      = icside_dma_host_off;
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index 08e7cd043bcc..fd213088b06b 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -767,7 +767,7 @@ int ide_set_dma(ide_drive_t *drive)
         switch(rc) {
         case -1: /* DMA needs to be disabled */
                 hwif->dma_off_quietly(drive);
-                return 0;
+                return -1;
         case  0: /* DMA needs to be enabled */
                 return hwif->ide_dma_on(drive);
         case  1: /* DMA setting cannot be changed */
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index c193553f6fe7..0e0280076fcd 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -519,21 +519,24 @@ static ide_startstop_t ide_ata_error(ide_drive_t *drive, struct request *rq, u8
         if ((stat & DRQ_STAT) && rq_data_dir(rq) == READ && hwif->err_stops_fifo == 0)
                 try_to_flush_leftover_data(drive);
 
+        if (rq->errors >= ERROR_MAX || blk_noretry_request(rq)) {
+                ide_kill_rq(drive, rq);
+                return ide_stopped;
+        }
+
         if (hwif->INB(IDE_STATUS_REG) & (BUSY_STAT|DRQ_STAT))
-                /* force an abort */
-                hwif->OUTB(WIN_IDLEIMMEDIATE, IDE_COMMAND_REG);
+                rq->errors |= ERROR_RESET;
 
-        if (rq->errors >= ERROR_MAX || blk_noretry_request(rq))
-                ide_kill_rq(drive, rq);
-        else {
-                if ((rq->errors & ERROR_RESET) == ERROR_RESET) {
-                        ++rq->errors;
-                        return ide_do_reset(drive);
-                }
-                if ((rq->errors & ERROR_RECAL) == ERROR_RECAL)
-                        drive->special.b.recalibrate = 1;
+        if ((rq->errors & ERROR_RESET) == ERROR_RESET) {
                 ++rq->errors;
+                return ide_do_reset(drive);
         }
+
+        if ((rq->errors & ERROR_RECAL) == ERROR_RECAL)
+                drive->special.b.recalibrate = 1;
+
+        ++rq->errors;
+
         return ide_stopped;
 }
 
@@ -1025,6 +1028,13 @@ static ide_startstop_t start_request (ide_drive_t *drive, struct request *rq)
         if (!drive->special.all) {
                 ide_driver_t *drv;
 
+                /*
+                 * We reset the drive so we need to issue a SETFEATURES.
+                 * Do it _after_ do_special() restored device parameters.
+                 */
+                if (drive->current_speed == 0xff)
+                        ide_config_drive_speed(drive, drive->desired_speed);
+
                 if (rq->cmd_type == REQ_TYPE_ATA_CMD ||
                     rq->cmd_type == REQ_TYPE_ATA_TASK ||
                     rq->cmd_type == REQ_TYPE_ATA_TASKFILE)
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index bd513f5a2323..1ee53a551c3a 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -583,8 +583,12 @@ u8 eighty_ninty_three (ide_drive_t *drive)
         if(!(drive->id->hw_config & 0x4000))
                 return 0;
 #endif /* CONFIG_IDEDMA_IVB */
-        if (!(drive->id->hw_config & 0x2000))
-                return 0;
+        /*
+         * FIXME:
+         * - change master/slave IDENTIFY order
+         * - force bit13 (80c cable present) check
+         *   (unless the slave device is pre-ATA3)
+         */
         return 1;
 }
 
@@ -1090,6 +1094,9 @@ static void pre_reset(ide_drive_t *drive)
         if (HWIF(drive)->pre_reset != NULL)
                 HWIF(drive)->pre_reset(drive);
 
+        if (drive->current_speed != 0xff)
+                drive->desired_speed = drive->current_speed;
+        drive->current_speed = 0xff;
 }
 
 /*
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index dfbd74458522..a6f098fda884 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -177,11 +177,7 @@ DECLARE_MUTEX(ide_cfg_sem);
 static int ide_scan_direction; /* THIS was formerly 2.2.x pci=reverse */
 #endif
 
-#ifdef CONFIG_IDEDMA_AUTO
 int noautodma = 0;
-#else
-int noautodma = 1;
-#endif
 
 EXPORT_SYMBOL(noautodma);
 
@@ -1128,17 +1124,40 @@ static int set_io_32bit(ide_drive_t *drive, int arg)
 static int set_using_dma (ide_drive_t *drive, int arg)
 {
 #ifdef CONFIG_BLK_DEV_IDEDMA
+        ide_hwif_t *hwif = drive->hwif;
+        int err = -EPERM;
+
         if (!drive->id || !(drive->id->capability & 1))
-                return -EPERM;
-        if (HWIF(drive)->ide_dma_check == NULL)
-                return -EPERM;
+                goto out;
+
+        if (hwif->ide_dma_check == NULL)
+                goto out;
+
+        err = -EBUSY;
+        if (ide_spin_wait_hwgroup(drive))
+                goto out;
+        /*
+         * set ->busy flag, unlock and let it ride
+         */
+        hwif->hwgroup->busy = 1;
+        spin_unlock_irq(&ide_lock);
+
+        err = 0;
+
         if (arg) {
-                if (ide_set_dma(drive))
-                        return -EIO;
-                if (HWIF(drive)->ide_dma_on(drive)) return -EIO;
+                if (ide_set_dma(drive) || hwif->ide_dma_on(drive))
+                        err = -EIO;
         } else
                 ide_dma_off(drive);
-        return 0;
+
+        /*
+         * lock, clear ->busy flag and unlock before leaving
+         */
+        spin_lock_irq(&ide_lock);
+        hwif->hwgroup->busy = 0;
+        spin_unlock_irq(&ide_lock);
+out:
+        return err;
 #else
         return -EPERM;
 #endif
diff --git a/drivers/ide/mips/au1xxx-ide.c b/drivers/ide/mips/au1xxx-ide.c
index b2dc028dc8ca..d54d9fe92a7d 100644
--- a/drivers/ide/mips/au1xxx-ide.c
+++ b/drivers/ide/mips/au1xxx-ide.c
@@ -639,6 +639,7 @@ static int au_ide_probe(struct device *dev)
         _auide_hwif *ahwif = &auide_hwif;
         ide_hwif_t *hwif;
         struct resource *res;
+        hw_regs_t *hw;
         int ret = 0;
 
 #if defined(CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA)
@@ -681,7 +682,7 @@ static int au_ide_probe(struct device *dev)
         /* FIXME:  This might possibly break PCMCIA IDE devices */
 
         hwif                            = &ide_hwifs[pdev->id];
-        hw_regs_t *hw                   = &hwif->hw;
+        hw                              = &hwif->hw;
         hwif->irq = hw->irq             = ahwif->irq;
         hwif->chipset                   = ide_au1xxx;
 
diff --git a/drivers/ide/pci/Makefile b/drivers/ide/pci/Makefile
index 6591ff4753cb..95d1ea8f1f14 100644
--- a/drivers/ide/pci/Makefile
+++ b/drivers/ide/pci/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_BLK_DEV_AEC62XX)		+= aec62xx.o
 obj-$(CONFIG_BLK_DEV_ALI15X3)           += alim15x3.o
 obj-$(CONFIG_BLK_DEV_AMD74XX)           += amd74xx.o
 obj-$(CONFIG_BLK_DEV_ATIIXP)            += atiixp.o
+obj-$(CONFIG_BLK_DEV_CELLEB)            += scc_pata.o
 obj-$(CONFIG_BLK_DEV_CMD64X)            += cmd64x.o
 obj-$(CONFIG_BLK_DEV_CS5520)            += cs5520.o
 obj-$(CONFIG_BLK_DEV_CS5530)            += cs5530.o
diff --git a/drivers/ide/pci/cmd64x.c b/drivers/ide/pci/cmd64x.c
index b0d4825c56a9..561197f7b5bb 100644
--- a/drivers/ide/pci/cmd64x.c
+++ b/drivers/ide/pci/cmd64x.c
@@ -1,6 +1,6 @@
 /* $Id: cmd64x.c,v 1.21 2000/01/30 23:23:16
  *
- * linux/drivers/ide/pci/cmd64x.c               Version 1.41    Feb 3, 2007
+ * linux/drivers/ide/pci/cmd64x.c               Version 1.42    Feb 8, 2007
  *
  * cmd64x.c: Enable interrupts at initialization time on Ultra/PCI machines.
  *           Note, this driver is not used at all on other systems because
@@ -189,6 +189,11 @@ static int cmd64x_get_info (char *buffer, char **addr, off_t offset, int count)
 
 #endif  /* defined(DISPLAY_CMD64X_TIMINGS) && defined(CONFIG_PROC_FS) */
 
+static u8 quantize_timing(int timing, int quant)
+{
+        return (timing + quant - 1) / quant;
+}
+
 /*
  * This routine writes the prepared setup/active/recovery counts
  * for a drive into the cmd646 chipset registers to active them.
@@ -268,47 +273,37 @@ static void program_drive_counts (ide_drive_t *drive, int setup_count, int activ
  */
 static u8 cmd64x_tune_pio (ide_drive_t *drive, u8 mode_wanted)
 {
-        int setup_time, active_time, recovery_time;
-        int clock_time, pio_mode, cycle_time;
-        u8 recovery_count2, cycle_count;
-        int setup_count, active_count, recovery_count;
-        int bus_speed = system_bus_clock();
-        ide_pio_data_t  d;
+        int setup_time, active_time, cycle_time;
+        u8  cycle_count, setup_count, active_count, recovery_count;
+        u8  pio_mode;
+        int clock_time = 1000 / system_bus_clock();
+        ide_pio_data_t pio;
 
-        pio_mode = ide_get_best_pio_mode(drive, mode_wanted, 5, &d);
-        cycle_time = d.cycle_time;
+        pio_mode = ide_get_best_pio_mode(drive, mode_wanted, 5, &pio);
+        cycle_time = pio.cycle_time;
 
-        /*
-         * I copied all this complicated stuff from cmd640.c and made a few
-         * minor changes.  For now I am just going to pray that it is correct.
-         */
         setup_time  = ide_pio_timings[pio_mode].setup_time;
         active_time = ide_pio_timings[pio_mode].active_time;
-        recovery_time = cycle_time - (setup_time + active_time);
-        clock_time = 1000 / bus_speed;
-        cycle_count = (cycle_time + clock_time - 1) / clock_time;
-
-        setup_count = (setup_time + clock_time - 1) / clock_time;
 
-        active_count = (active_time + clock_time - 1) / clock_time;
+        setup_count  = quantize_timing( setup_time, clock_time);
+        cycle_count  = quantize_timing( cycle_time, clock_time);
+        active_count = quantize_timing(active_time, clock_time);
 
-        recovery_count = (recovery_time + clock_time - 1) / clock_time;
-        recovery_count2 = cycle_count - (setup_count + active_count);
-        if (recovery_count2 > recovery_count)
-                recovery_count = recovery_count2;
+        recovery_count = cycle_count - active_count;
+        /* program_drive_counts() takes care of zero recovery cycles */
         if (recovery_count > 16) {
                 active_count += recovery_count - 16;
                 recovery_count = 16;
         }
         if (active_count > 16)
-                active_count = 16; /* maximum allowed by cmd646 */
+                active_count = 16; /* maximum allowed by cmd64x */
 
         program_drive_counts (drive, setup_count, active_count, recovery_count);
 
         cmdprintk("%s: PIO mode wanted %d, selected %d (%dns)%s, "
                 "clocks=%d/%d/%d\n",
                 drive->name, mode_wanted, pio_mode, cycle_time,
-                d.overridden ? " (overriding vendor mode)" : "",
+                pio.overridden ? " (overriding vendor mode)" : "",
                 setup_count, active_count, recovery_count);
 
         return pio_mode;
diff --git a/drivers/ide/pci/jmicron.c b/drivers/ide/pci/jmicron.c
index 53f25500c22b..be4fc96c29e0 100644
--- a/drivers/ide/pci/jmicron.c
+++ b/drivers/ide/pci/jmicron.c
@@ -240,12 +240,31 @@ static int __devinit jmicron_init_one(struct pci_dev *dev, const struct pci_devi
         return 0;
 }
 
+/* If libata is configured, jmicron PCI quirk will configure it such
+ * that the SATA ports are in AHCI function while the PATA ports are
+ * in a separate IDE function.  In such cases, match device class and
+ * attach only to IDE.  If libata isn't configured, keep the old
+ * behavior for backward compatibility.
+ */
+#if defined(CONFIG_ATA) || defined(CONFIG_ATA_MODULE)
+#define JMB_CLASS       PCI_CLASS_STORAGE_IDE << 8
+#define JMB_CLASS_MASK  0xffff00
+#else
+#define JMB_CLASS       0
+#define JMB_CLASS_MASK  0
+#endif
+
 static struct pci_device_id jmicron_pci_tbl[] = {
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 1},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
-        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 0},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 1},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 2},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 3},
+        { PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368,
+          PCI_ANY_ID, PCI_ANY_ID, JMB_CLASS, JMB_CLASS_MASK, 4},
         { 0, },
 };
 
diff --git a/drivers/ide/pci/pdc202xx_new.c b/drivers/ide/pci/pdc202xx_new.c
index 6ceb25bc5a7b..ace98929cc3d 100644
--- a/drivers/ide/pci/pdc202xx_new.c
+++ b/drivers/ide/pci/pdc202xx_new.c
@@ -255,7 +255,7 @@ static int config_chipset_for_dma(ide_drive_t *drive)
                 printk(KERN_WARNING "%s reduced to Ultra33 mode.\n", drive->name);
         }
 
-        if (drive->media != ide_disk)
+        if (drive->media != ide_disk && drive->media != ide_cdrom)
                 return 0;
 
         if (id->capability & 4) {
@@ -545,6 +545,7 @@ static void __devinit init_hwif_pdc202new(ide_hwif_t *hwif)
 
         hwif->drives[0].autotune = hwif->drives[1].autotune = 1;
 
+        hwif->atapi_dma  = 1;
         hwif->ultra_mask = 0x7f;
         hwif->mwdma_mask = 0x07;
 
diff --git a/drivers/ide/ppc/scc_pata.c b/drivers/ide/pci/scc_pata.c
index f84bf791f72e..f84bf791f72e 100644
--- a/drivers/ide/ppc/scc_pata.c
+++ b/drivers/ide/pci/scc_pata.c
diff --git a/drivers/ide/setup-pci.c b/drivers/ide/setup-pci.c
index a52c80fe7d3e..118fb3205ca8 100644
--- a/drivers/ide/setup-pci.c
+++ b/drivers/ide/setup-pci.c
@@ -505,11 +505,6 @@ static void ide_hwif_setup_dma(struct pci_dev *dev, ide_pci_device_t *d, ide_hwi
                 }
         }
 }
-
-#ifndef CONFIG_IDEDMA_PCI_AUTO
-#warning CONFIG_IDEDMA_PCI_AUTO=n support is obsolete, and will be removed soon.
-#endif
-
 #endif /* CONFIG_BLK_DEV_IDEDMA_PCI*/
 
 /**
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index a95313521985..03e44b337eb0 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -584,7 +584,10 @@ static void ether1394_add_host (struct hpsb_host *host)
         }
 
         SET_MODULE_OWNER(dev);
+#if 0
+        /* FIXME - Is this the correct parent device anyway? */
         SET_NETDEV_DEV(dev, &host->device);
+#endif
 
         priv = netdev_priv(dev);
 
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index f2774ae906bf..24e0df04f7db 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -545,11 +545,14 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
                 php = to_iwch_pd(pd);
         if (mr_rereg_mask & IB_MR_REREG_ACCESS)
                 mh.attr.perms = iwch_ib_to_tpt_access(acc);
-        if (mr_rereg_mask & IB_MR_REREG_TRANS)
+        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
                 ret = build_phys_page_list(buffer_list, num_phys_buf,
                                            iova_start,
                                            &total_size, &npages,
                                            &shift, &page_list);
+                if (ret)
+                        return ret;
+        }
 
         ret = iwch_reregister_mem(rhp, php, &mh, shift, page_list, npages);
         kfree(page_list);
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 20f36bf8b2b6..f284be1c9166 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -66,7 +66,9 @@
 static void queue_comp_task(struct ehca_cq *__cq);
 
 static struct ehca_comp_pool* pool;
+#ifdef CONFIG_HOTPLUG_CPU
 static struct notifier_block comp_pool_callback_nb;
+#endif
 
 static inline void comp_event_callback(struct ehca_cq *cq)
 {
@@ -733,6 +735,7 @@ static void take_over_work(struct ehca_comp_pool *pool,
 
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 static int comp_pool_callback(struct notifier_block *nfb,
                               unsigned long action,
                               void *hcpu)
@@ -775,6 +778,7 @@ static int comp_pool_callback(struct notifier_block *nfb,
 
         return NOTIFY_OK;
 }
+#endif
 
 int ehca_create_comp_pool(void)
 {
@@ -805,9 +809,11 @@ int ehca_create_comp_pool(void)
                 }
         }
 
+#ifdef CONFIG_HOTPLUG_CPU
         comp_pool_callback_nb.notifier_call = comp_pool_callback;
         comp_pool_callback_nb.priority =0;
         register_cpu_notifier(&comp_pool_callback_nb);
+#endif
 
         printk(KERN_INFO "eHCA scaling code enabled\n");
 
@@ -821,7 +827,9 @@ void ehca_destroy_comp_pool(void)
         if (!ehca_scaling_code)
                 return;
 
+#ifdef CONFIG_HOTPLUG_CPU
         unregister_cpu_notifier(&comp_pool_callback_nb);
+#endif
 
         for (i = 0; i < NR_CPUS; i++) {
                 if (cpu_online(i))
diff --git a/drivers/infiniband/hw/ipath/ipath_dma.c b/drivers/infiniband/hw/ipath/ipath_dma.c
index f6f949040825..f87f003e3ef8 100644
--- a/drivers/infiniband/hw/ipath/ipath_dma.c
+++ b/drivers/infiniband/hw/ipath/ipath_dma.c
@@ -167,7 +167,7 @@ static void *ipath_dma_alloc_coherent(struct ib_device *dev, size_t size,
 }
 
 static void ipath_dma_free_coherent(struct ib_device *dev, size_t size,
-                                    void *cpu_addr, dma_addr_t dma_handle)
+                                    void *cpu_addr, u64 dma_handle)
 {
         free_pages((unsigned long) cpu_addr, get_order(size));
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index 5b40a846ff95..ed55979bfd34 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -451,12 +451,18 @@ bail:
         return ret;
 }
 
-static void remove_file(struct dentry *parent, char *name)
+static int remove_file(struct dentry *parent, char *name)
 {
         struct dentry *tmp;
+        int ret;
 
         tmp = lookup_one_len(name, parent, strlen(name));
 
+        if (IS_ERR(tmp)) {
+                ret = PTR_ERR(tmp);
+                goto bail;
+        }
+
         spin_lock(&dcache_lock);
         spin_lock(&tmp->d_lock);
         if (!(d_unhashed(tmp) && tmp->d_inode)) {
@@ -469,6 +475,14 @@ static void remove_file(struct dentry *parent, char *name)
                 spin_unlock(&tmp->d_lock);
                 spin_unlock(&dcache_lock);
         }
+
+        ret = 0;
+bail:
+        /*
+         * We don't expect clients to care about the return value, but
+         * it's there if they need it.
+         */
+        return ret;
 }
 
 static int remove_device_files(struct super_block *sb,
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 3484e8ba24a4..e70492db74f6 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -452,7 +452,7 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
                            skb->len, tx->mtu);
                 ++priv->stats.tx_dropped;
                 ++priv->stats.tx_errors;
-                ipoib_cm_skb_too_long(dev, skb, tx->mtu - INFINIBAND_ALEN);
+                ipoib_cm_skb_too_long(dev, skb, tx->mtu - IPOIB_ENCAP_LEN);
                 return;
         }
 
@@ -1095,7 +1095,7 @@ static void ipoib_cm_stale_task(struct work_struct *work)
                 /* List if sorted by LRU, start from tail,
                  * stop when we see a recently used entry */
                 p = list_entry(priv->cm.passive_ids.prev, typeof(*p), list);
-                if (time_after_eq(jiffies, p->jiffies + IPOIB_CM_RX_TIMEOUT))
+                if (time_before_eq(jiffies, p->jiffies + IPOIB_CM_RX_TIMEOUT))
                         break;
                 list_del_init(&p->list);
                 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index f2aa923ddbea..ba0ee5cf2ad7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -328,9 +328,9 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
         struct ipoib_tx_buf *tx_req;
         u64 addr;
 
-        if (unlikely(skb->len > priv->mcast_mtu + INFINIBAND_ALEN)) {
+        if (unlikely(skb->len > priv->mcast_mtu + IPOIB_ENCAP_LEN)) {
                 ipoib_warn(priv, "packet len %d (> %d) too long to send, dropping\n",
-                           skb->len, priv->mcast_mtu + INFINIBAND_ALEN);
+                           skb->len, priv->mcast_mtu + IPOIB_ENCAP_LEN);
                 ++priv->stats.tx_dropped;
                 ++priv->stats.tx_errors;
                 ipoib_cm_skb_too_long(dev, skb, priv->mcast_mtu);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index f9dbc6f68145..f2a40ae8e7d0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -380,7 +380,7 @@ static void path_rec_completion(int status,
         struct net_device *dev = path->dev;
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_ah *ah = NULL;
-        struct ipoib_neigh *neigh;
+        struct ipoib_neigh *neigh, *tn;
         struct sk_buff_head skqueue;
         struct sk_buff *skb;
         unsigned long flags;
@@ -418,7 +418,7 @@ static void path_rec_completion(int status,
                 while ((skb = __skb_dequeue(&path->queue)))
                         __skb_queue_tail(&skqueue, skb);
 
-                list_for_each_entry(neigh, &path->neigh_list, list) {
+                list_for_each_entry_safe(neigh, tn, &path->neigh_list, list) {
                         kref_get(&path->ah->ref);
                         neigh->ah = path->ah;
                         memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
@@ -814,7 +814,7 @@ static void ipoib_set_mcast_list(struct net_device *dev)
         queue_work(ipoib_workqueue, &priv->restart_task);
 }
 
-static void ipoib_neigh_destructor(struct neighbour *n)
+static void ipoib_neigh_cleanup(struct neighbour *n)
 {
         struct ipoib_neigh *neigh;
         struct ipoib_dev_priv *priv = netdev_priv(n->dev);
@@ -822,7 +822,7 @@ static void ipoib_neigh_destructor(struct neighbour *n)
         struct ipoib_ah *ah = NULL;
 
         ipoib_dbg(priv,
-                  "neigh_destructor for %06x " IPOIB_GID_FMT "\n",
+                  "neigh_cleanup for %06x " IPOIB_GID_FMT "\n",
                   IPOIB_QPN(n->ha),
                   IPOIB_GID_RAW_ARG(n->ha + 4));
 
@@ -874,7 +874,7 @@ void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh)
 
 static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms)
 {
-        parms->neigh_destructor = ipoib_neigh_destructor;
+        parms->neigh_cleanup = ipoib_neigh_cleanup;
 
         return 0;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 56c87a81bb67..54fbead4de01 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -644,6 +644,9 @@ static int ipoib_mcast_leave(struct net_device *dev, struct ipoib_mcast *mcast)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         int ret = 0;
 
+        if (test_and_clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
+                ib_sa_free_multicast(mcast->mc);
+
         if (test_and_clear_bit(IPOIB_MCAST_FLAG_ATTACHED, &mcast->flags)) {
                 ipoib_dbg_mcast(priv, "leaving MGID " IPOIB_GID_FMT "\n",
                                 IPOIB_GID_ARG(mcast->mcmember.mgid));
@@ -655,9 +658,6 @@ static int ipoib_mcast_leave(struct net_device *dev, struct ipoib_mcast *mcast)
                         ipoib_warn(priv, "ipoib_mcast_detach failed (result = %d)\n", ret);
         }
 
-        if (test_and_clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags))
-                ib_sa_free_multicast(mcast->mc);
-
         return 0;
 }
 
diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c
index 9df9e3548cf1..c547a6665052 100644
--- a/drivers/isdn/hisax/isar.c
+++ b/drivers/isdn/hisax/isar.c
@@ -440,7 +440,7 @@ isar_bh(struct work_struct *work)
 {
         struct BCState *bcs = container_of(work, struct BCState, tqueue);
 
-        BChannel_bh(bcs);
+        BChannel_bh(work);
         if (test_and_clear_bit(B_LL_NOCARRIER, &bcs->event))
                 ll_deliver_faxstat(bcs, ISDN_FAX_CLASS1_NOCARR);
         if (test_and_clear_bit(B_LL_CONNECT, &bcs->event))
diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
index a163bca38973..dc7a8c78cbf9 100644
--- a/drivers/kvm/kvm_main.c
+++ b/drivers/kvm/kvm_main.c
@@ -2464,7 +2464,7 @@ int kvm_init_arch(struct kvm_arch_ops *ops, struct module *module)
 
         r = kvm_arch_ops->hardware_setup();
         if (r < 0)
-            return r;
+                goto out;
 
         on_each_cpu(kvm_arch_ops->hardware_enable, NULL, 0, 1);
         r = register_cpu_notifier(&kvm_cpu_notifier);
@@ -2500,6 +2500,8 @@ out_free_2:
 out_free_1:
         on_each_cpu(kvm_arch_ops->hardware_disable, NULL, 0, 1);
         kvm_arch_ops->hardware_unsetup();
+out:
+        kvm_arch_ops = NULL;
         return r;
 }
 
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index a1a93368f314..e85b4c7c36f7 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -131,7 +131,7 @@ static int dbg = 1;
         (((address) >> PT32_LEVEL_SHIFT(level)) & ((1 << PT32_LEVEL_BITS) - 1))
 
 
-#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & PAGE_MASK)
+#define PT64_BASE_ADDR_MASK (((1ULL << 52) - 1) & ~(u64)(PAGE_SIZE-1))
 #define PT64_DIR_BASE_ADDR_MASK \
         (PT64_BASE_ADDR_MASK & ~((1ULL << (PAGE_SHIFT + PT64_LEVEL_BITS)) - 1))
 
@@ -406,8 +406,8 @@ static void rmap_write_protect(struct kvm_vcpu *vcpu, u64 gfn)
                         spte = desc->shadow_ptes[0];
                 }
                 BUG_ON(!spte);
-                BUG_ON((*spte & PT64_BASE_ADDR_MASK) !=
-                       page_to_pfn(page) << PAGE_SHIFT);
+                BUG_ON((*spte & PT64_BASE_ADDR_MASK) >> PAGE_SHIFT
+                       != page_to_pfn(page));
                 BUG_ON(!(*spte & PT_PRESENT_MASK));
                 BUG_ON(!(*spte & PT_WRITABLE_MASK));
                 rmap_printk("rmap_write_protect: spte %p %llx\n", spte, *spte);
@@ -1093,22 +1093,40 @@ out:
         return r;
 }
 
+static void mmu_pre_write_zap_pte(struct kvm_vcpu *vcpu,
+                                  struct kvm_mmu_page *page,
+                                  u64 *spte)
+{
+        u64 pte;
+        struct kvm_mmu_page *child;
+
+        pte = *spte;
+        if (is_present_pte(pte)) {
+                if (page->role.level == PT_PAGE_TABLE_LEVEL)
+                        rmap_remove(vcpu, spte);
+                else {
+                        child = page_header(pte & PT64_BASE_ADDR_MASK);
+                        mmu_page_remove_parent_pte(vcpu, child, spte);
+                }
+        }
+        *spte = 0;
+}
+
 void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)
 {
         gfn_t gfn = gpa >> PAGE_SHIFT;
         struct kvm_mmu_page *page;
-        struct kvm_mmu_page *child;
         struct hlist_node *node, *n;
         struct hlist_head *bucket;
         unsigned index;
         u64 *spte;
-        u64 pte;
         unsigned offset = offset_in_page(gpa);
         unsigned pte_size;
         unsigned page_offset;
         unsigned misaligned;
         int level;
         int flooded = 0;
+        int npte;
 
         pgprintk("%s: gpa %llx bytes %d\n", __FUNCTION__, gpa, bytes);
         if (gfn == vcpu->last_pt_write_gfn) {
@@ -1144,22 +1162,26 @@ void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)
                 }
                 page_offset = offset;
                 level = page->role.level;
+                npte = 1;
                 if (page->role.glevels == PT32_ROOT_LEVEL) {
-                        page_offset <<= 1;          /* 32->64 */
+                        page_offset <<= 1;      /* 32->64 */
+                        /*
+                         * A 32-bit pde maps 4MB while the shadow pdes map
+                         * only 2MB.  So we need to double the offset again
+                         * and zap two pdes instead of one.
+                         */
+                        if (level == PT32_ROOT_LEVEL) {
+                                page_offset <<= 1;
+                                npte = 2;
+                        }
                         page_offset &= ~PAGE_MASK;
                 }
                 spte = __va(page->page_hpa);
                 spte += page_offset / sizeof(*spte);
-                pte = *spte;
-                if (is_present_pte(pte)) {
-                        if (level == PT_PAGE_TABLE_LEVEL)
-                                rmap_remove(vcpu, spte);
-                        else {
-                                child = page_header(pte & PT64_BASE_ADDR_MASK);
-                                mmu_page_remove_parent_pte(vcpu, child, spte);
-                        }
+                while (npte--) {
+                        mmu_pre_write_zap_pte(vcpu, page, spte);
+                        ++spte;
                 }
-                *spte = 0;
         }
 }
 
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index c07178e61122..fbbf9d6b299f 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -371,10 +371,10 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 *pdata)
                 data = vmcs_read32(GUEST_SYSENTER_CS);
                 break;
         case MSR_IA32_SYSENTER_EIP:
-                data = vmcs_read32(GUEST_SYSENTER_EIP);
+                data = vmcs_readl(GUEST_SYSENTER_EIP);
                 break;
         case MSR_IA32_SYSENTER_ESP:
-                data = vmcs_read32(GUEST_SYSENTER_ESP);
+                data = vmcs_readl(GUEST_SYSENTER_ESP);
                 break;
         default:
                 msr = find_msr_entry(vcpu, msr_index);
@@ -412,10 +412,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
                 vmcs_write32(GUEST_SYSENTER_CS, data);
                 break;
         case MSR_IA32_SYSENTER_EIP:
-                vmcs_write32(GUEST_SYSENTER_EIP, data);
+                vmcs_writel(GUEST_SYSENTER_EIP, data);
                 break;
         case MSR_IA32_SYSENTER_ESP:
-                vmcs_write32(GUEST_SYSENTER_ESP, data);
+                vmcs_writel(GUEST_SYSENTER_ESP, data);
                 break;
         case MSR_IA32_TIME_STAMP_COUNTER:
                 guest_write_tsc(data);
@@ -618,7 +618,7 @@ static void fix_pmode_dataseg(int seg, struct kvm_save_segment *save)
 {
         struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
 
-        if (vmcs_readl(sf->base) == save->base) {
+        if (vmcs_readl(sf->base) == save->base && (save->base & AR_S_MASK)) {
                 vmcs_write16(sf->selector, save->selector);
                 vmcs_writel(sf->base, save->base);
                 vmcs_write32(sf->limit, save->limit);
@@ -1888,6 +1888,27 @@ again:
                 [cr2]"i"(offsetof(struct kvm_vcpu, cr2))
               : "cc", "memory" );
 
+        /*
+         * Reload segment selectors ASAP. (it's needed for a functional
+         * kernel: x86 relies on having __KERNEL_PDA in %fs and x86_64
+         * relies on having 0 in %gs for the CPU PDA to work.)
+         */
+        if (fs_gs_ldt_reload_needed) {
+                load_ldt(ldt_sel);
+                load_fs(fs_sel);
+                /*
+                 * If we have to reload gs, we must take care to
+                 * preserve our gs base.
+                 */
+                local_irq_disable();
+                load_gs(gs_sel);
+#ifdef CONFIG_X86_64
+                wrmsrl(MSR_GS_BASE, vmcs_readl(HOST_GS_BASE));
+#endif
+                local_irq_enable();
+
+                reload_tss();
+        }
         ++kvm_stat.exits;
 
         save_msrs(vcpu->guest_msrs, NR_BAD_MSRS);
@@ -1905,22 +1926,6 @@ again:
                 kvm_run->exit_reason = vmcs_read32(VM_INSTRUCTION_ERROR);
                 r = 0;
         } else {
-                if (fs_gs_ldt_reload_needed) {
-                        load_ldt(ldt_sel);
-                        load_fs(fs_sel);
-                        /*
-                         * If we have to reload gs, we must take care to
-                         * preserve our gs base.
-                         */
-                        local_irq_disable();
-                        load_gs(gs_sel);
-#ifdef CONFIG_X86_64
-                        wrmsrl(MSR_GS_BASE, vmcs_readl(HOST_GS_BASE));
-#endif
-                        local_irq_enable();
-
-                        reload_tss();
-                }
                 /*
                  * Profile KVM exit RIPs:
                  */
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index c625ddb8833d..d5ecd2d53046 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -188,7 +188,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
         for (i=0; i < cnt-1 ; i++) {
                 sector_t sz = 0;
                 int j;
-                for (j=i; i<cnt-1 && sz < min_spacing ; j++)
+                for (j = i; j < cnt - 1 && sz < min_spacing; j++)
                         sz += conf->disks[j].size;
                 if (sz >= min_spacing && sz < conf->hash_spacing)
                         conf->hash_spacing = sz;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6c06e825cff5..2a9b6a07e3a2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1318,6 +1318,7 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
         char b[BDEVNAME_SIZE];
         struct kobject *ko;
         char *s;
+        int err;
 
         if (rdev->mddev) {
                 MD_BUG();
@@ -1352,20 +1353,29 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
         while ( (s=strchr(rdev->kobj.k_name, '/')) != NULL)
                 *s = '!';
                         
-        list_add(&rdev->same_set, &mddev->disks);
         rdev->mddev = mddev;
         printk(KERN_INFO "md: bind<%s>\n", b);
 
         rdev->kobj.parent = &mddev->kobj;
-        kobject_add(&rdev->kobj);
+        if ((err = kobject_add(&rdev->kobj)))
+                goto fail;
 
         if (rdev->bdev->bd_part)
                 ko = &rdev->bdev->bd_part->kobj;
         else
                 ko = &rdev->bdev->bd_disk->kobj;
-        sysfs_create_link(&rdev->kobj, ko, "block");
+        if ((err = sysfs_create_link(&rdev->kobj, ko, "block"))) {
+                kobject_del(&rdev->kobj);
+                goto fail;
+        }
+        list_add(&rdev->same_set, &mddev->disks);
         bd_claim_by_disk(rdev->bdev, rdev, mddev->gendisk);
         return 0;
+
+ fail:
+        printk(KERN_WARNING "md: failed to register dev-%s for %s\n",
+               b, mdname(mddev));
+        return err;
 }
 
 static void unbind_rdev_from_array(mdk_rdev_t * rdev)
@@ -2966,7 +2976,9 @@ static struct kobject *md_probe(dev_t dev, int *part, void *data)
         mddev->kobj.k_name = NULL;
         snprintf(mddev->kobj.name, KOBJ_NAME_LEN, "%s", "md");
         mddev->kobj.ktype = &md_ktype;
-        kobject_register(&mddev->kobj);
+        if (kobject_register(&mddev->kobj))
+                printk(KERN_WARNING "md: cannot register %s/md - name in use\n",
+                       disk->disk_name);
         return NULL;
 }
 
@@ -3144,9 +3156,12 @@ static int do_md_run(mddev_t * mddev)
                 bitmap_destroy(mddev);
                 return err;
         }
-        if (mddev->pers->sync_request)
-                sysfs_create_group(&mddev->kobj, &md_redundancy_group);
-        else if (mddev->ro == 2) /* auto-readonly not meaningful */
+        if (mddev->pers->sync_request) {
+                if (sysfs_create_group(&mddev->kobj, &md_redundancy_group))
+                        printk(KERN_WARNING
+                               "md: cannot register extra attributes for %s\n",
+                               mdname(mddev));
+        } else if (mddev->ro == 2) /* auto-readonly not meaningful */
                 mddev->ro = 0;
 
         atomic_set(&mddev->writes_pending,0);
@@ -3160,7 +3175,9 @@ static int do_md_run(mddev_t * mddev)
                 if (rdev->raid_disk >= 0) {
                         char nm[20];
                         sprintf(nm, "rd%d", rdev->raid_disk);
-                        sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
+                        if (sysfs_create_link(&mddev->kobj, &rdev->kobj, nm))
+                                printk("md: cannot register %s for %s\n",
+                                       nm, mdname(mddev));
                 }
         
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
@@ -3325,6 +3342,7 @@ static int do_md_stop(mddev_t * mddev, int mode)
                         mddev->queue->merge_bvec_fn = NULL;
                         mddev->queue->unplug_fn = NULL;
                         mddev->queue->issue_flush_fn = NULL;
+                        mddev->queue->backing_dev_info.congested_fn = NULL;
                         if (mddev->pers->sync_request)
                                 sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
 
@@ -5385,8 +5403,12 @@ static int remove_and_add_spares(mddev_t *mddev)
                                 if (mddev->pers->hot_add_disk(mddev,rdev)) {
                                         char nm[20];
                                         sprintf(nm, "rd%d", rdev->raid_disk);
-                                        sysfs_create_link(&mddev->kobj,
-                                                          &rdev->kobj, nm);
+                                        if (sysfs_create_link(&mddev->kobj,
+                                                              &rdev->kobj, nm))
+                                                printk(KERN_WARNING
+                                                       "md: cannot register "
+                                                       "%s for %s\n",
+                                                       nm, mdname(mddev));
                                         spares++;
                                         md_new_event(mddev);
                                 } else
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 54a1ad5eef42..8d59914f2057 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3642,12 +3642,15 @@ static int run(mddev_t *mddev)
         }
 
         /* Ok, everything is just fine now */
-        sysfs_create_group(&mddev->kobj, &raid5_attrs_group);
+        if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group))
+                printk(KERN_WARNING
+                       "raid5: failed to create sysfs attributes for %s\n",
+                       mdname(mddev));
 
         mddev->queue->unplug_fn = raid5_unplug_device;
         mddev->queue->issue_flush_fn = raid5_issue_flush;
-        mddev->queue->backing_dev_info.congested_fn = raid5_congested;
         mddev->queue->backing_dev_info.congested_data = mddev;
+        mddev->queue->backing_dev_info.congested_fn = raid5_congested;
 
         mddev->array_size =  mddev->size * (conf->previous_raid_disks -
                                             conf->max_degraded);
@@ -3678,6 +3681,7 @@ static int stop(mddev_t *mddev)
         mddev->thread = NULL;
         shrink_stripes(conf);
         kfree(conf->stripe_hashtbl);
+        mddev->queue->backing_dev_info.congested_fn = NULL;
         blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
         sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
         kfree(conf->disks);
@@ -3950,7 +3954,12 @@ static int raid5_start_reshape(mddev_t *mddev)
                                 added_devices++;
                                 rdev->recovery_offset = 0;
                                 sprintf(nm, "rd%d", rdev->raid_disk);
-                                sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
+                                if (sysfs_create_link(&mddev->kobj,
+                                                      &rdev->kobj, nm))
+                                        printk(KERN_WARNING
+                                               "raid5: failed to create "
+                                               " link %s for %s\n",
+                                               nm, mdname(mddev));
                         } else
                                 break;
                 }
@@ -4104,6 +4113,10 @@ static struct mdk_personality raid4_personality =
         .spare_active   = raid5_spare_active,
         .sync_request   = sync_request,
         .resize         = raid5_resize,
+#ifdef CONFIG_MD_RAID5_RESHAPE
+        .check_reshape  = raid5_check_reshape,
+        .start_reshape  = raid5_start_reshape,
+#endif
         .quiesce        = raid5_quiesce,
 };
 
diff --git a/drivers/media/common/ir-functions.c b/drivers/media/common/ir-functions.c
index cbf7c0564889..fcb194135627 100644
--- a/drivers/media/common/ir-functions.c
+++ b/drivers/media/common/ir-functions.c
@@ -310,13 +310,15 @@ void ir_rc5_timer_end(unsigned long data)
                     tv.tv_usec - ir->base_time.tv_usec;
         }
 
-        /* Allow some timmer jitter (RC5 is ~24ms anyway so this is ok) */
+        /* signal we're ready to start a new code */
+        ir->active = 0;
+
+        /* Allow some timer jitter (RC5 is ~24ms anyway so this is ok) */
         if (gap < 28000) {
                 dprintk(1, "ir-common: spurious timer_end\n");
                 return;
         }
 
-        ir->active = 0;
         if (ir->last_bit < 20) {
                 /* ignore spurious codes (caused by light/other remotes) */
                 dprintk(1, "ir-common: short code: %x\n", ir->code);
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index fc77de45ca4d..a5c0e1a3e6d1 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -180,8 +180,7 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
         struct dvb_device *dvbdev = file->private_data;
         struct dmxdev *dmxdev = dvbdev->priv;
 
-        if (mutex_lock_interruptible(&dmxdev->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dmxdev->mutex);
 
         if ((file->f_flags & O_ACCMODE) == O_WRONLY) {
                 dmxdev->demux->disconnect_frontend(dmxdev->demux);
@@ -673,13 +672,8 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
 static int dvb_dmxdev_filter_free(struct dmxdev *dmxdev,
                                   struct dmxdev_filter *dmxdevfilter)
 {
-        if (mutex_lock_interruptible(&dmxdev->mutex))
-                return -ERESTARTSYS;
-
-        if (mutex_lock_interruptible(&dmxdevfilter->mutex)) {
-                mutex_unlock(&dmxdev->mutex);
-                return -ERESTARTSYS;
-        }
+        mutex_lock(&dmxdev->mutex);
+        mutex_lock(&dmxdevfilter->mutex);
 
         dvb_dmxdev_filter_stop(dmxdevfilter);
         dvb_dmxdev_filter_reset(dmxdevfilter);
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index fcff5eab21a3..6d8d1c3df863 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -673,8 +673,7 @@ static int dmx_ts_feed_stop_filtering(struct dmx_ts_feed *ts_feed)
         struct dvb_demux *demux = feed->demux;
         int ret;
 
-        if (mutex_lock_interruptible(&demux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&demux->mutex);
 
         if (feed->state < DMX_STATE_GO) {
                 mutex_unlock(&demux->mutex);
@@ -748,8 +747,7 @@ static int dvbdmx_release_ts_feed(struct dmx_demux *dmx,
         struct dvb_demux *demux = (struct dvb_demux *)dmx;
         struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed;
 
-        if (mutex_lock_interruptible(&demux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&demux->mutex);
 
         if (feed->state == DMX_STATE_FREE) {
                 mutex_unlock(&demux->mutex);
@@ -916,8 +914,7 @@ static int dmx_section_feed_stop_filtering(struct dmx_section_feed *feed)
         struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
         int ret;
 
-        if (mutex_lock_interruptible(&dvbdmx->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdmx->mutex);
 
         if (!dvbdmx->stop_feed) {
                 mutex_unlock(&dvbdmx->mutex);
@@ -942,8 +939,7 @@ static int dmx_section_feed_release_filter(struct dmx_section_feed *feed,
         struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
         struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
 
-        if (mutex_lock_interruptible(&dvbdmx->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdmx->mutex);
 
         if (dvbdmxfilter->feed != dvbdmxfeed) {
                 mutex_unlock(&dvbdmx->mutex);
@@ -1016,8 +1012,7 @@ static int dvbdmx_release_section_feed(struct dmx_demux *demux,
         struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
         struct dvb_demux *dvbdmx = (struct dvb_demux *)demux;
 
-        if (mutex_lock_interruptible(&dvbdmx->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdmx->mutex);
 
         if (dvbdmxfeed->state == DMX_STATE_FREE) {
                 mutex_unlock(&dvbdmx->mutex);
@@ -1126,8 +1121,7 @@ static int dvbdmx_connect_frontend(struct dmx_demux *demux,
         if (demux->frontend)
                 return -EINVAL;
 
-        if (mutex_lock_interruptible(&dvbdemux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdemux->mutex);
 
         demux->frontend = frontend;
         mutex_unlock(&dvbdemux->mutex);
@@ -1138,8 +1132,7 @@ static int dvbdmx_disconnect_frontend(struct dmx_demux *demux)
 {
         struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
 
-        if (mutex_lock_interruptible(&dvbdemux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdemux->mutex);
 
         demux->frontend = NULL;
         mutex_unlock(&dvbdemux->mutex);
diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
index 490337b5ee3e..14a372a0fe8b 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.c
+++ b/drivers/media/dvb/dvb-core/dvbdev.c
@@ -203,8 +203,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
 
         int id;
 
-        if (mutex_lock_interruptible(&dvbdev_register_lock))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdev_register_lock);
 
         if ((id = dvbdev_get_free_id (adap, type)) < 0){
                 mutex_unlock(&dvbdev_register_lock);
@@ -294,8 +293,7 @@ int dvb_register_adapter(struct dvb_adapter *adap, const char *name, struct modu
 {
         int num;
 
-        if (mutex_lock_interruptible(&dvbdev_register_lock))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdev_register_lock);
 
         if ((num = dvbdev_get_free_adapter_num ()) < 0) {
                 mutex_unlock(&dvbdev_register_lock);
@@ -323,8 +321,7 @@ EXPORT_SYMBOL(dvb_register_adapter);
 
 int dvb_unregister_adapter(struct dvb_adapter *adap)
 {
-        if (mutex_lock_interruptible(&dvbdev_register_lock))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdev_register_lock);
         list_del (&adap->list_head);
         mutex_unlock(&dvbdev_register_lock);
         return 0;
diff --git a/drivers/media/dvb/frontends/isl6421.c b/drivers/media/dvb/frontends/isl6421.c
index ef319369ec26..c967148a5945 100644
--- a/drivers/media/dvb/frontends/isl6421.c
+++ b/drivers/media/dvb/frontends/isl6421.c
@@ -122,6 +122,7 @@ struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter
         /* detect if it is present or not */
         if (isl6421_set_voltage(fe, SEC_VOLTAGE_OFF)) {
                 kfree(isl6421);
+                fe->sec_priv = NULL;
                 return NULL;
         }
 
diff --git a/drivers/media/dvb/frontends/nxt200x.c b/drivers/media/dvb/frontends/nxt200x.c
index 87c286ee6a00..b809f83d9563 100644
--- a/drivers/media/dvb/frontends/nxt200x.c
+++ b/drivers/media/dvb/frontends/nxt200x.c
@@ -562,7 +562,7 @@ static int nxt200x_setup_frontend_parameters (struct dvb_frontend* fe,
 
                         /* set input */
                         if (state->config->set_pll_input)
-                                state->config->set_pll_input(buf, 1);
+                                state->config->set_pll_input(buf+1, 1);
                         break;
                 case VSB_8:
                         /* Set non-punctured clock for VSB */
@@ -571,7 +571,7 @@ static int nxt200x_setup_frontend_parameters (struct dvb_frontend* fe,
 
                         /* set input */
                         if (state->config->set_pll_input)
-                                state->config->set_pll_input(buf, 0);
+                                state->config->set_pll_input(buf+1, 0);
                         break;
                 default:
                         return -EINVAL;
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index 920b63f8cf05..af66a5d5ecd8 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -3,7 +3,7 @@
 #
 
 menu "Radio Adapters"
-        depends on VIDEO_DEV!=n
+        depends on VIDEO_DEV
 
 config RADIO_CADET
         tristate "ADS Cadet AM/FM Tuner"
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index 2fb9fe6a1ae7..ba1af3c8525e 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -780,18 +780,16 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
         return 0;
 }
 
-static int msp_suspend(struct device * dev, pm_message_t state)
+static int msp_suspend(struct i2c_client *client, pm_message_t state)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
 
         v4l_dbg(1, msp_debug, client, "suspend\n");
         msp_reset(client);
         return 0;
 }
 
-static int msp_resume(struct device * dev)
+static int msp_resume(struct i2c_client *client)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
 
         v4l_dbg(1, msp_debug, client, "resume\n");
         msp_wake_thread(client);
@@ -825,7 +823,7 @@ static int msp_attach(struct i2c_adapter *adapter, int address, int kind)
         if (msp_reset(client) == -1) {
                 v4l_dbg(1, msp_debug, client, "msp3400 not found\n");
                 kfree(client);
-                return -1;
+                return 0;
         }
 
         state = kmalloc(sizeof(*state), GFP_KERNEL);
@@ -859,7 +857,7 @@ static int msp_attach(struct i2c_adapter *adapter, int address, int kind)
                 v4l_dbg(1, msp_debug, client, "not an msp3400 (cannot read chip version)\n");
                 kfree(state);
                 kfree(client);
-                return -1;
+                return 0;
         }
 
         msp_set_audio(client);
@@ -996,11 +994,11 @@ static struct i2c_driver i2c_driver = {
         .id             = I2C_DRIVERID_MSP3400,
         .attach_adapter = msp_probe,
         .detach_client  = msp_detach,
+        .suspend = msp_suspend,
+        .resume  = msp_resume,
         .command        = msp_command,
         .driver = {
                 .name    = "msp3400",
-                .suspend = msp_suspend,
-                .resume  = msp_resume,
         },
 };
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index 1ff5138e4bb6..9916cf32494d 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -1248,10 +1248,10 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw)
         ret |= pvr2_write_register(hdw, 0xaa18, 0x00840000); /*unknown*/
         LOCK_TAKE(hdw->ctl_lock); do {
                 hdw->cmd_buffer[0] = FX2CMD_FWPOST1;
-                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,1,0,0);
+                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,1,NULL,0);
                 hdw->cmd_buffer[0] = FX2CMD_MEMSEL;
                 hdw->cmd_buffer[1] = 0;
-                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,0,0);
+                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,NULL,0);
         } while (0); LOCK_GIVE(hdw->ctl_lock);
 
         if (ret) {
@@ -1320,7 +1320,7 @@ int pvr2_upload_firmware2(struct pvr2_hdw *hdw)
         LOCK_TAKE(hdw->ctl_lock); do {
                 hdw->cmd_buffer[0] = FX2CMD_MEMSEL;
                 hdw->cmd_buffer[1] = 0;
-                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,0,0);
+                ret |= pvr2_send_request(hdw,hdw->cmd_buffer,2,NULL,0);
         } while (0); LOCK_GIVE(hdw->ctl_lock);
 
         if (ret) {
diff --git a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
index 5313d342666e..25d3830b482a 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
@@ -808,11 +808,11 @@ static void pvr2_v4l2_destroy_no_lock(struct pvr2_v4l2 *vp)
 {
         if (vp->dev_video) {
                 pvr2_v4l2_dev_destroy(vp->dev_video);
-                vp->dev_video = 0;
+                vp->dev_video = NULL;
         }
         if (vp->dev_radio) {
                 pvr2_v4l2_dev_destroy(vp->dev_radio);
-                vp->dev_radio = 0;
+                vp->dev_radio = NULL;
         }
 
         pvr2_trace(PVR2_TRACE_STRUCT,"Destroying pvr2_v4l2 id=%p",vp);
@@ -1138,7 +1138,7 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
 {
         int mindevnum;
         int unit_number;
-        int *nr_ptr = 0;
+        int *nr_ptr = NULL;
         dip->v4lp = vp;
 
 
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index 7735b6758921..4d5bbd859de1 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -961,7 +961,7 @@ static void saa711x_set_v4lstd(struct i2c_client *client, v4l2_std_id std)
                         reg |= 0x10;
                 } else if (std == V4L2_STD_NTSC_M_JP) {
                         reg |= 0x40;
-                } else if (std == V4L2_STD_SECAM) {
+                } else if (std & V4L2_STD_SECAM) {
                         reg |= 0x50;
                 }
                 saa711x_write(client, R_0E_CHROMA_CNTL_1, reg);
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index 7be73e3763de..15dbc6bf42a7 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -804,9 +804,8 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
         return 0;
 }
 
-static int tuner_suspend(struct device *dev, pm_message_t state)
+static int tuner_suspend(struct i2c_client *c, pm_message_t state)
 {
-        struct i2c_client *c = container_of (dev, struct i2c_client, dev);
         struct tuner *t = i2c_get_clientdata (c);
 
         tuner_dbg ("suspend\n");
@@ -814,9 +813,8 @@ static int tuner_suspend(struct device *dev, pm_message_t state)
         return 0;
 }
 
-static int tuner_resume(struct device *dev)
+static int tuner_resume(struct i2c_client *c)
 {
-        struct i2c_client *c = container_of (dev, struct i2c_client, dev);
         struct tuner *t = i2c_get_clientdata (c);
 
         tuner_dbg ("resume\n");
@@ -837,10 +835,10 @@ static struct i2c_driver driver = {
         .attach_adapter = tuner_probe,
         .detach_client = tuner_detach,
         .command = tuner_command,
+        .suspend = tuner_suspend,
+        .resume  = tuner_resume,
         .driver = {
                 .name    = "tuner",
-                .suspend = tuner_suspend,
-                .resume  = tuner_resume,
         },
 };
 static struct i2c_client client_template = {
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index da9859f2caf2..b17c4b2bc9ef 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -390,13 +390,6 @@ static int i2o_block_prep_req_fn(struct request_queue *q, struct request *req)
                 return BLKPREP_KILL;
         }
 
-        /* request is already processed by us, so return */
-        if (blk_special_request(req)) {
-                osm_debug("REQ_SPECIAL already set!\n");
-                req->cmd_flags |= REQ_DONTPREP;
-                return BLKPREP_OK;
-        }
-
         /* connect the i2o_block_request to the request */
         if (!req->special) {
                 ireq = i2o_block_request_alloc();
@@ -408,11 +401,8 @@ static int i2o_block_prep_req_fn(struct request_queue *q, struct request *req)
                 ireq->i2o_blk_dev = i2o_blk_dev;
                 req->special = ireq;
                 ireq->req = req;
-        } else
-                ireq = req->special;
-
+        }
         /* do not come back here */
-        req->cmd_type = REQ_TYPE_SPECIAL;
         req->cmd_flags |= REQ_DONTPREP;
 
         return BLKPREP_OK;
diff --git a/drivers/mmc/imxmmc.c b/drivers/mmc/imxmmc.c
index b060d4bfba29..0de5c9e94e74 100644
--- a/drivers/mmc/imxmmc.c
+++ b/drivers/mmc/imxmmc.c
@@ -569,10 +569,12 @@ static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
 
         if(host->dma_dir == DMA_FROM_DEVICE) {
                 imxmci_busy_wait_for_status(host, &stat,
-                                STATUS_APPL_BUFF_FF | STATUS_DATA_TRANS_DONE,
+                                STATUS_APPL_BUFF_FF | STATUS_DATA_TRANS_DONE |
+                                STATUS_TIME_OUT_READ,
                                 50, "imxmci_cpu_driven_data read");
 
                 while((stat & (STATUS_APPL_BUFF_FF |  STATUS_DATA_TRANS_DONE)) &&
+                      !(stat & STATUS_TIME_OUT_READ) &&
                       (host->data_cnt < 512)) {
 
                         udelay(20);     /* required for clocks < 8MHz*/
@@ -602,6 +604,12 @@ static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
                 if(host->dma_size & 0x1ff)
                         stat &= ~STATUS_CRC_READ_ERR;
 
+                if(stat & STATUS_TIME_OUT_READ) {
+                        dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data read timeout STATUS = 0x%x\n",
+                                stat);
+                        trans_done = -1;
+                }
+
         } else {
                 imxmci_busy_wait_for_status(host, &stat,
                                 STATUS_APPL_BUFF_FE,
@@ -709,6 +717,9 @@ static void imxmci_tasklet_fnc(unsigned long data)
                  */
                 stat |= host->status_reg;
 
+                if(test_bit(IMXMCI_PEND_CPU_DATA_b, &host->pending_events))
+                        stat &= ~STATUS_CRC_READ_ERR;
+
                 if(test_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events)) {
                         imxmci_busy_wait_for_status(host, &stat,
                                         STATUS_END_CMD_RESP | STATUS_ERR_MASK,
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 5ff0922e628c..c3f9f599f134 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2372,22 +2372,23 @@ config CHELSIO_T1_NAPI
           when the driver is receiving lots of packets from the card.
 
 config CHELSIO_T3
-        tristate "Chelsio Communications T3 10Gb Ethernet support"
-        depends on PCI
-        help
-          This driver supports Chelsio T3-based gigabit and 10Gb Ethernet
-          adapters.
+        tristate "Chelsio Communications T3 10Gb Ethernet support"
+        depends on PCI
+        select FW_LOADER
+        help
+          This driver supports Chelsio T3-based gigabit and 10Gb Ethernet
+          adapters.
 
-          For general information about Chelsio and our products, visit
-          our website at <http://www.chelsio.com>.
+          For general information about Chelsio and our products, visit
+          our website at <http://www.chelsio.com>.
 
-          For customer support, please visit our customer support page at
-          <http://www.chelsio.com/support.htm>.
+          For customer support, please visit our customer support page at
+          <http://www.chelsio.com/support.htm>.
 
-          Please send feedback to <linux-bugs@chelsio.com>.
+          Please send feedback to <linux-bugs@chelsio.com>.
 
-          To compile this driver as a module, choose M here: the module
-          will be called cxgb3.
+          To compile this driver as a module, choose M here: the module
+          will be called cxgb3.
 
 config EHEA
         tristate "eHEA Ethernet support"
diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index 88d4f70035bb..dee3638ad744 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -1328,7 +1328,7 @@ static int atl1_tx_csum(struct atl1_adapter *adapter, struct sk_buff *skb,
 
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
                 cso = skb->h.raw - skb->data;
-                css = (skb->h.raw + skb->csum) - skb->data;
+                css = (skb->h.raw + skb->csum_offset) - skb->data;
                 if (unlikely(cso & 0x1)) {
                         printk(KERN_DEBUG "%s: payload offset != even number\n",
                                 atl1_driver_name);
@@ -1562,7 +1562,7 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         /* mss will be nonzero if we're doing segment offload (TSO/GSO) */
         mss = skb_shinfo(skb)->gso_size;
         if (mss) {
-                if (skb->protocol == ntohs(ETH_P_IP)) {
+                if (skb->protocol == htons(ETH_P_IP)) {
                         proto_hdr_len = ((skb->h.raw - skb->data) +
                                          (skb->h.th->doff << 2));
                         if (unlikely(proto_hdr_len > len)) {
diff --git a/drivers/net/cxgb3/common.h b/drivers/net/cxgb3/common.h
index e23deeb7d06d..85e5543cfb57 100644
--- a/drivers/net/cxgb3/common.h
+++ b/drivers/net/cxgb3/common.h
@@ -260,6 +260,10 @@ struct mac_stats {
         unsigned long serdes_signal_loss;
         unsigned long xaui_pcs_ctc_err;
         unsigned long xaui_pcs_align_change;
+
+        unsigned long num_toggled; /* # times toggled TxEn due to stuck TX */
+        unsigned long num_resets;  /* # times reset due to stuck TX */
+
 };
 
 struct tp_mib_stats {
@@ -400,6 +404,12 @@ struct adapter_params {
         unsigned int rev;       /* chip revision */
 };
 
+enum {                                      /* chip revisions */
+        T3_REV_A  = 0,
+        T3_REV_B  = 2,
+        T3_REV_B2 = 3,
+};
+
 struct trace_params {
         u32 sip;
         u32 sip_mask;
@@ -465,6 +475,10 @@ struct cmac {
         struct adapter *adapter;
         unsigned int offset;
         unsigned int nucast;    /* # of address filters for unicast MACs */
+        unsigned int tcnt;
+        unsigned int xcnt;
+        unsigned int toggle_cnt;
+        unsigned int txen;
         struct mac_stats stats;
 };
 
@@ -666,6 +680,7 @@ int t3_mac_set_address(struct cmac *mac, unsigned int idx, u8 addr[6]);
 int t3_mac_set_num_ucast(struct cmac *mac, int n);
 const struct mac_stats *t3_mac_update_stats(struct cmac *mac);
 int t3_mac_set_speed_duplex_fc(struct cmac *mac, int speed, int duplex, int fc);
+int t3b2_mac_watchdog_task(struct cmac *mac);
 
 void t3_mc5_prep(struct adapter *adapter, struct mc5 *mc5, int mode);
 int t3_mc5_init(struct mc5 *mc5, unsigned int nservers, unsigned int nfilters,
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 7ff834e45d6b..d55383610559 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -42,6 +42,7 @@
 #include <linux/workqueue.h>
 #include <linux/proc_fs.h>
 #include <linux/rtnetlink.h>
+#include <linux/firmware.h>
 #include <asm/uaccess.h>
 
 #include "common.h"
@@ -707,6 +708,28 @@ static void bind_qsets(struct adapter *adap)
         }
 }
 
+#define FW_FNAME "t3fw-%d.%d.bin"
+
+static int upgrade_fw(struct adapter *adap)
+{
+        int ret;
+        char buf[64];
+        const struct firmware *fw;
+        struct device *dev = &adap->pdev->dev;
+
+        snprintf(buf, sizeof(buf), FW_FNAME, FW_VERSION_MAJOR,
+                 FW_VERSION_MINOR);
+        ret = request_firmware(&fw, buf, dev);
+        if (ret < 0) {
+                dev_err(dev, "could not upgrade firmware: unable to load %s\n",
+                        buf);
+                return ret;
+        }
+        ret = t3_load_fw(adap, fw->data, fw->size);
+        release_firmware(fw);
+        return ret;
+}
+
 /**
  *      cxgb_up - enable the adapter
  *      @adapter: adapter being enabled
@@ -723,6 +746,8 @@ static int cxgb_up(struct adapter *adap)
 
         if (!(adap->flags & FULL_INIT_DONE)) {
                 err = t3_check_fw_version(adap);
+                if (err == -EINVAL)
+                        err = upgrade_fw(adap);
                 if (err)
                         goto out;
 
@@ -1031,7 +1056,11 @@ static char stats_strings[][ETH_GSTRING_LEN] = {
         "VLANinsertions     ",
         "TxCsumOffload      ",
         "RxCsumGood         ",
-        "RxDrops            "
+        "RxDrops            ",
+
+        "CheckTXEnToggled   ",
+        "CheckResets        ",
+
 };
 
 static int get_stats_count(struct net_device *dev)
@@ -1145,6 +1174,9 @@ static void get_stats(struct net_device *dev, struct ethtool_stats *stats,
         *data++ = collect_sge_port_stats(adapter, pi, SGE_PSTAT_TX_CSUM);
         *data++ = collect_sge_port_stats(adapter, pi, SGE_PSTAT_RX_CSUM_GOOD);
         *data++ = s->rx_cong_drops;
+
+        *data++ = s->num_toggled;
+        *data++ = s->num_resets;
 }
 
 static inline void reg_block_dump(struct adapter *ap, void *buf,
@@ -1362,23 +1394,27 @@ static int set_rx_csum(struct net_device *dev, u32 data)
 
 static void get_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
 {
-        struct adapter *adapter = dev->priv;
+        const struct adapter *adapter = dev->priv;
+        const struct port_info *pi = netdev_priv(dev);
+        const struct qset_params *q = &adapter->params.sge.qset[pi->first_qset];
 
         e->rx_max_pending = MAX_RX_BUFFERS;
         e->rx_mini_max_pending = 0;
         e->rx_jumbo_max_pending = MAX_RX_JUMBO_BUFFERS;
         e->tx_max_pending = MAX_TXQ_ENTRIES;
 
-        e->rx_pending = adapter->params.sge.qset[0].fl_size;
-        e->rx_mini_pending = adapter->params.sge.qset[0].rspq_size;
-        e->rx_jumbo_pending = adapter->params.sge.qset[0].jumbo_size;
-        e->tx_pending = adapter->params.sge.qset[0].txq_size[0];
+        e->rx_pending = q->fl_size;
+        e->rx_mini_pending = q->rspq_size;
+        e->rx_jumbo_pending = q->jumbo_size;
+        e->tx_pending = q->txq_size[0];
 }
 
 static int set_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
 {
         int i;
+        struct qset_params *q;
         struct adapter *adapter = dev->priv;
+        const struct port_info *pi = netdev_priv(dev);
 
         if (e->rx_pending > MAX_RX_BUFFERS ||
             e->rx_jumbo_pending > MAX_RX_JUMBO_BUFFERS ||
@@ -1393,9 +1429,8 @@ static int set_sge_param(struct net_device *dev, struct ethtool_ringparam *e)
         if (adapter->flags & FULL_INIT_DONE)
                 return -EBUSY;
 
-        for (i = 0; i < SGE_QSETS; ++i) {
-                struct qset_params *q = &adapter->params.sge.qset[i];
-
+        q = &adapter->params.sge.qset[pi->first_qset];
+        for (i = 0; i < pi->nqsets; ++i, ++q) {
                 q->rspq_size = e->rx_mini_pending;
                 q->fl_size = e->rx_pending;
                 q->jumbo_size = e->rx_jumbo_pending;
@@ -2067,6 +2102,40 @@ static void check_link_status(struct adapter *adapter)
         }
 }
 
+static void check_t3b2_mac(struct adapter *adapter)
+{
+        int i;
+
+        rtnl_lock();                      /* synchronize with ifdown */
+        for_each_port(adapter, i) {
+                struct net_device *dev = adapter->port[i];
+                struct port_info *p = netdev_priv(dev);
+                int status;
+
+                if (!netif_running(dev))
+                        continue;
+
+                status = 0;
+                if (netif_running(dev))
+                        status = t3b2_mac_watchdog_task(&p->mac);
+                if (status == 1)
+                        p->mac.stats.num_toggled++;
+                else if (status == 2) {
+                        struct cmac *mac = &p->mac;
+
+                        t3_mac_set_mtu(mac, dev->mtu);
+                        t3_mac_set_address(mac, 0, dev->dev_addr);
+                        cxgb_set_rxmode(dev);
+                        t3_link_start(&p->phy, mac, &p->link_config);
+                        t3_mac_enable(mac, MAC_DIRECTION_RX | MAC_DIRECTION_TX);
+                        t3_port_intr_enable(adapter, p->port_id);
+                        p->mac.stats.num_resets++;
+                }
+        }
+        rtnl_unlock();
+}
+
+
 static void t3_adap_check_task(struct work_struct *work)
 {
         struct adapter *adapter = container_of(work, struct adapter,
@@ -2087,6 +2156,9 @@ static void t3_adap_check_task(struct work_struct *work)
                 adapter->check_task_cnt = 0;
         }
 
+        if (p->rev == T3_REV_B2)
+                check_t3b2_mac(adapter);
+
         /* Schedule the next check update if any port is active. */
         spin_lock(&adapter->work_lock);
         if (adapter->open_device_map & PORT_MASK)
diff --git a/drivers/net/cxgb3/regs.h b/drivers/net/cxgb3/regs.h
index b56c5f52bcdc..b38629a244d0 100644
--- a/drivers/net/cxgb3/regs.h
+++ b/drivers/net/cxgb3/regs.h
@@ -1206,6 +1206,14 @@
 
 #define A_TP_RX_TRC_KEY0 0x120
 
+#define A_TP_TX_DROP_CNT_CH0 0x12d
+
+#define S_TXDROPCNTCH0RCVD    0
+#define M_TXDROPCNTCH0RCVD    0xffff
+#define V_TXDROPCNTCH0RCVD(x) ((x) << S_TXDROPCNTCH0RCVD)
+#define G_TXDROPCNTCH0RCVD(x) (((x) >> S_TXDROPCNTCH0RCVD) & \
+                               M_TXDROPCNTCH0RCVD)
+
 #define A_ULPRX_CTL 0x500
 
 #define S_ROUND_ROBIN    4
@@ -1834,6 +1842,8 @@
 #define V_TXPAUSEEN(x) ((x) << S_TXPAUSEEN)
 #define F_TXPAUSEEN    V_TXPAUSEEN(1U)
 
+#define A_XGM_TX_PAUSE_QUANTA 0x808
+
 #define A_XGM_RX_CTRL 0x80c
 
 #define S_RXEN    0
@@ -1920,6 +1930,11 @@
 
 #define A_XGM_TXFIFO_CFG 0x888
 
+#define S_TXIPG    13
+#define M_TXIPG    0xff
+#define V_TXIPG(x) ((x) << S_TXIPG)
+#define G_TXIPG(x) (((x) >> S_TXIPG) & M_TXIPG)
+
 #define S_TXFIFOTHRESH    4
 #define M_TXFIFOTHRESH    0x1ff
 
@@ -2190,6 +2205,13 @@
 
 #define A_XGM_RX_MAX_PKT_SIZE_ERR_CNT 0x9a4
 
+#define A_XGM_TX_SPI4_SOP_EOP_CNT 0x9a8
+
+#define S_TXSPI4SOPCNT    16
+#define M_TXSPI4SOPCNT    0xffff
+#define V_TXSPI4SOPCNT(x) ((x) << S_TXSPI4SOPCNT)
+#define G_TXSPI4SOPCNT(x) (((x) >> S_TXSPI4SOPCNT) & M_TXSPI4SOPCNT)
+
 #define A_XGM_RX_SPI4_SOP_EOP_CNT 0x9ac
 
 #define XGMAC0_1_BASE_ADDR 0xa00
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index eaa7a2e89a30..791ed6dc1943 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -681,7 +681,8 @@ enum {
         SF_ERASE_SECTOR = 0xd8, /* erase sector */
 
         FW_FLASH_BOOT_ADDR = 0x70000,   /* start address of FW in flash */
-        FW_VERS_ADDR = 0x77ffc  /* flash address holding FW version */
+        FW_VERS_ADDR = 0x77ffc,    /* flash address holding FW version */
+        FW_MIN_SIZE = 8            /* at least version and csum */
 };
 
 /**
@@ -935,7 +936,7 @@ int t3_load_fw(struct adapter *adapter, const u8 *fw_data, unsigned int size)
         const u32 *p = (const u32 *)fw_data;
         int ret, addr, fw_sector = FW_FLASH_BOOT_ADDR >> 16;
 
-        if (size & 3)
+        if ((size & 3) || size < FW_MIN_SIZE)
                 return -EINVAL;
         if (size > FW_VERS_ADDR + 8 - FW_FLASH_BOOT_ADDR)
                 return -EFBIG;
@@ -3243,15 +3244,17 @@ void early_hw_init(struct adapter *adapter, const struct adapter_info *ai)
 }
 
 /*
- * Reset the adapter.  PCIe cards lose their config space during reset, PCI-X
+ * Reset the adapter. 
+ * Older PCIe cards lose their config space during reset, PCI-X
  * ones don't.
  */
 int t3_reset_adapter(struct adapter *adapter)
 {
-        int i;
+        int i, save_and_restore_pcie = 
+            adapter->params.rev < T3_REV_B2 && is_pcie(adapter);
         uint16_t devid = 0;
 
-        if (is_pcie(adapter))
+        if (save_and_restore_pcie)
                 pci_save_state(adapter->pdev);
         t3_write_reg(adapter, A_PL_RST, F_CRSTWRM | F_CRSTWRMMODE);
 
@@ -3269,7 +3272,7 @@ int t3_reset_adapter(struct adapter *adapter)
         if (devid != 0x1425)
                 return -1;
 
-        if (is_pcie(adapter))
+        if (save_and_restore_pcie)
                 pci_restore_state(adapter->pdev);
         return 0;
 }
diff --git a/drivers/net/cxgb3/xgmac.c b/drivers/net/cxgb3/xgmac.c
index 907a272ae32d..2b42c13ba8e0 100644
--- a/drivers/net/cxgb3/xgmac.c
+++ b/drivers/net/cxgb3/xgmac.c
@@ -124,9 +124,6 @@ int t3_mac_reset(struct cmac *mac)
                         xaui_serdes_reset(mac);
         }
 
-        if (adap->params.rev > 0)
-                t3_write_reg(adap, A_XGM_PAUSE_TIMER + oft, 0xf000);
-
         val = F_MAC_RESET_;
         if (is_10G(adap))
                 val |= F_PCS_RESET_;
@@ -145,6 +142,58 @@ int t3_mac_reset(struct cmac *mac)
         return 0;
 }
 
+int t3b2_mac_reset(struct cmac *mac)
+{
+        struct adapter *adap = mac->adapter;
+        unsigned int oft = mac->offset;
+        u32 val;
+
+        if (!macidx(mac)) 
+                t3_set_reg_field(adap, A_MPS_CFG, F_PORT0ACTIVE, 0);
+        else
+                t3_set_reg_field(adap, A_MPS_CFG, F_PORT1ACTIVE, 0);
+
+        t3_write_reg(adap, A_XGM_RESET_CTRL + oft, F_MAC_RESET_);
+        t3_read_reg(adap, A_XGM_RESET_CTRL + oft);    /* flush */
+
+        msleep(10);
+
+        /* Check for xgm Rx fifo empty */
+        if (t3_wait_op_done(adap, A_XGM_RX_MAX_PKT_SIZE_ERR_CNT + oft,
+                            0x80000000, 1, 5, 2)) {
+                CH_ERR(adap, "MAC %d Rx fifo drain failed\n",
+                       macidx(mac));
+                return -1;
+        }
+
+        t3_write_reg(adap, A_XGM_RESET_CTRL + oft, 0);
+        t3_read_reg(adap, A_XGM_RESET_CTRL + oft);    /* flush */
+
+        val = F_MAC_RESET_;
+        if (is_10G(adap))
+                val |= F_PCS_RESET_;
+        else if (uses_xaui(adap))
+                val |= F_PCS_RESET_ | F_XG2G_RESET_;
+        else
+                val |= F_RGMII_RESET_ | F_XG2G_RESET_;
+        t3_write_reg(adap, A_XGM_RESET_CTRL + oft, val);
+        t3_read_reg(adap, A_XGM_RESET_CTRL + oft);  /* flush */
+        if ((val & F_PCS_RESET_) && adap->params.rev) {
+                msleep(1);
+                t3b_pcs_reset(mac);
+        }
+        t3_write_reg(adap, A_XGM_RX_CFG + oft, 
+                     F_DISPAUSEFRAMES | F_EN1536BFRAMES |
+                     F_RMFCS | F_ENJUMBO | F_ENHASHMCAST);
+
+        if (!macidx(mac)) 
+                t3_set_reg_field(adap, A_MPS_CFG, 0, F_PORT0ACTIVE);
+        else
+                t3_set_reg_field(adap, A_MPS_CFG, 0, F_PORT1ACTIVE);
+
+        return 0;
+}
+
 /*
  * Set the exact match register 'idx' to recognize the given Ethernet address.
  */
@@ -251,9 +300,11 @@ int t3_mac_set_mtu(struct cmac *mac, unsigned int mtu)
          * Adjust the PAUSE frame watermarks.  We always set the LWM, and the
          * HWM only if flow-control is enabled.
          */
-        hwm = max(MAC_RXFIFO_SIZE - 3 * mtu, MAC_RXFIFO_SIZE / 2U);
-        hwm = min(hwm, 3 * MAC_RXFIFO_SIZE / 4 + 1024);
-        lwm = hwm - 1024;
+        hwm = max_t(unsigned int, MAC_RXFIFO_SIZE - 3 * mtu, 
+                    MAC_RXFIFO_SIZE * 38 / 100);
+        hwm = min(hwm, MAC_RXFIFO_SIZE - 8192);
+        lwm = min(3 * (int)mtu, MAC_RXFIFO_SIZE / 4);
+
         v = t3_read_reg(adap, A_XGM_RXFIFO_CFG + mac->offset);
         v &= ~V_RXFIFOPAUSELWM(M_RXFIFOPAUSELWM);
         v |= V_RXFIFOPAUSELWM(lwm / 8);
@@ -270,7 +321,15 @@ int t3_mac_set_mtu(struct cmac *mac, unsigned int mtu)
         thres = mtu > thres ? (mtu - thres + 7) / 8 : 0;
         thres = max(thres, 8U); /* need at least 8 */
         t3_set_reg_field(adap, A_XGM_TXFIFO_CFG + mac->offset,
-                         V_TXFIFOTHRESH(M_TXFIFOTHRESH), V_TXFIFOTHRESH(thres));
+                         V_TXFIFOTHRESH(M_TXFIFOTHRESH) | V_TXIPG(M_TXIPG),
+                         V_TXFIFOTHRESH(thres) | V_TXIPG(1));
+
+        if (adap->params.rev > 0)
+                t3_write_reg(adap, A_XGM_PAUSE_TIMER + mac->offset,
+                             (hwm - lwm) * 4 / 8);
+        t3_write_reg(adap, A_XGM_TX_PAUSE_QUANTA + mac->offset,
+                     MAC_RXFIFO_SIZE * 4 * 8 / 512);
+
         return 0;
 }
 
@@ -298,12 +357,6 @@ int t3_mac_set_speed_duplex_fc(struct cmac *mac, int speed, int duplex, int fc)
                                  V_PORTSPEED(M_PORTSPEED), val);
         }
 
-        val = t3_read_reg(adap, A_XGM_RXFIFO_CFG + oft);
-        val &= ~V_RXFIFOPAUSEHWM(M_RXFIFOPAUSEHWM);
-        if (fc & PAUSE_TX)
-                val |= V_RXFIFOPAUSEHWM(G_RXFIFOPAUSELWM(val) + 128);   /* +1KB */
-        t3_write_reg(adap, A_XGM_RXFIFO_CFG + oft, val);
-
         t3_set_reg_field(adap, A_XGM_TX_CFG + oft, F_TXPAUSEEN,
                          (fc & PAUSE_RX) ? F_TXPAUSEEN : 0);
         return 0;
@@ -318,9 +371,17 @@ int t3_mac_enable(struct cmac *mac, int which)
         if (which & MAC_DIRECTION_TX) {
                 t3_write_reg(adap, A_XGM_TX_CTRL + oft, F_TXEN);
                 t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CFG_CH0 + idx);
-                t3_write_reg(adap, A_TP_PIO_DATA, 0xbf000001);
+                t3_write_reg(adap, A_TP_PIO_DATA, 0xc0ede401);
                 t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_MODE);
                 t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 1 << idx);
+
+                t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CNT_CH0 + idx);
+                mac->tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
+                                                            A_TP_PIO_DATA)));
+                mac->xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_TX_SPI4_SOP_EOP_CNT)));
+                mac->txen = F_TXEN;
+                mac->toggle_cnt = 0;
         }
         if (which & MAC_DIRECTION_RX)
                 t3_write_reg(adap, A_XGM_RX_CTRL + oft, F_RXEN);
@@ -337,13 +398,50 @@ int t3_mac_disable(struct cmac *mac, int which)
                 t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CFG_CH0 + idx);
                 t3_write_reg(adap, A_TP_PIO_DATA, 0xc000001f);
                 t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_MODE);
-                t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 0);
+                t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 1 << idx);
+                mac->txen = 0;
         }
         if (which & MAC_DIRECTION_RX)
                 t3_write_reg(adap, A_XGM_RX_CTRL + mac->offset, 0);
         return 0;
 }
 
+int t3b2_mac_watchdog_task(struct cmac *mac)
+{
+        struct adapter *adap = mac->adapter;
+        unsigned int tcnt, xcnt;
+        int status;
+
+        t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CNT_CH0 + macidx(mac));
+        tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap, A_TP_PIO_DATA)));
+        xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap, 
+                                           A_XGM_TX_SPI4_SOP_EOP_CNT +
+                                           mac->offset)));
+
+        if (tcnt != mac->tcnt && xcnt == 0 && mac->xcnt == 0) {
+                if (mac->toggle_cnt > 4) {
+                        t3b2_mac_reset(mac);
+                        mac->toggle_cnt = 0;
+                        status = 2;
+                } else {
+                        t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
+                        t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);
+                        t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset,
+                                     mac->txen);
+                        t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);
+                        mac->toggle_cnt++;
+                        status = 1;
+                }       
+        } else {
+                mac->toggle_cnt = 0;
+                status = 0;
+        }
+        mac->tcnt = tcnt;
+        mac->xcnt = xcnt;
+
+        return status;
+}
+
 /*
  * This function is called periodically to accumulate the current values of the
  * RMON counters into the port statistics.  Since the packet counters are only
@@ -375,6 +473,11 @@ const struct mac_stats *t3_mac_update_stats(struct cmac *mac)
         RMON_UPDATE(mac, rx_too_long, RX_OVERSIZE_FRAMES);
         mac->stats.rx_too_long += RMON_READ(mac, A_XGM_RX_MAX_PKT_SIZE_ERR_CNT);
 
+        v = RMON_READ(mac, A_XGM_RX_MAX_PKT_SIZE_ERR_CNT);
+        if (mac->adapter->params.rev == T3_REV_B2)
+                v &= 0x7fffffff;
+        mac->stats.rx_too_long += v;
+
         RMON_UPDATE(mac, rx_frames_64, RX_64B_FRAMES);
         RMON_UPDATE(mac, rx_frames_65_127, RX_65_127B_FRAMES);
         RMON_UPDATE(mac, rx_frames_128_255, RX_128_255B_FRAMES);
diff --git a/drivers/net/ewrk3.c b/drivers/net/ewrk3.c
index c8c41f0a47d6..714ea1176ec7 100644
--- a/drivers/net/ewrk3.c
+++ b/drivers/net/ewrk3.c
@@ -414,10 +414,9 @@ ewrk3_hw_init(struct net_device *dev, u_long iobase)
         icr &= 0x70;
         outb(icr, EWRK3_ICR);   /* Disable all the IRQs */
 
-        if (nicsr == (CSR_TXD | CSR_RXD))
+        if (nicsr != (CSR_TXD | CSR_RXD))
                 return -ENXIO;
 
-
         /* Check that the EEPROM is alive and well and not living on Pluto... */
         for (chksum = 0, i = 0; i < EEPROM_MAX; i += 2) {
                 union {
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 340ee99652eb..1d510bdc9b84 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1057,6 +1057,8 @@ static int stir421x_fw_upload(struct irda_usb_cb *self,
 
                 if (ret < 0)
                         break;
+
+                mdelay(10);
         }
 
         kfree(patch_block);
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 1ee27c360a4b..c9f55bc57edb 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1516,9 +1516,23 @@ static int mv643xx_eth_shared_remove(struct platform_device *pdev)
         return 0;
 }
 
+static void mv643xx_eth_shutdown(struct platform_device *pdev)
+{
+        struct net_device *dev = platform_get_drvdata(pdev);
+        struct mv643xx_private *mp = netdev_priv(dev);
+        unsigned int port_num = mp->port_num;
+
+        /* Mask all interrupts on ethernet port */
+        mv_write(MV643XX_ETH_INTERRUPT_MASK_REG(port_num), 0);
+        mv_read (MV643XX_ETH_INTERRUPT_MASK_REG(port_num));
+
+        eth_port_reset(port_num);
+}
+
 static struct platform_driver mv643xx_eth_driver = {
         .probe = mv643xx_eth_probe,
         .remove = mv643xx_eth_remove,
+        .shutdown = mv643xx_eth_shutdown,
         .driver = {
                 .name = MV643XX_ETH_NAME,
         },
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index ac02b3b60f92..b05b20ef8c0a 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -71,7 +71,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
 
-#define MYRI10GE_VERSION_STR "1.2.0"
+#define MYRI10GE_VERSION_STR "1.3.0-1.226"
 
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -234,7 +234,7 @@ static int myri10ge_msi = 1;	/* enable msi by default */
 module_param(myri10ge_msi, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(myri10ge_msi, "Enable Message Signalled Interrupts\n");
 
-static int myri10ge_intr_coal_delay = 25;
+static int myri10ge_intr_coal_delay = 75;
 module_param(myri10ge_intr_coal_delay, int, S_IRUGO);
 MODULE_PARM_DESC(myri10ge_intr_coal_delay, "Interrupt coalescing delay\n");
 
@@ -279,7 +279,7 @@ static int myri10ge_fill_thresh = 256;
 module_param(myri10ge_fill_thresh, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(myri10ge_fill_thresh, "Number of empty rx slots allowed\n");
 
-static int myri10ge_wcfifo = 1;
+static int myri10ge_wcfifo = 0;
 module_param(myri10ge_wcfifo, int, S_IRUGO);
 MODULE_PARM_DESC(myri10ge_wcfifo, "Enable WC Fifo when WC is enabled\n");
 
@@ -905,6 +905,14 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
                     (rx->page_offset + bytes <= MYRI10GE_ALLOC_SIZE)) {
                         /* we can use part of previous page */
                         get_page(rx->page);
+#if MYRI10GE_ALLOC_SIZE > 4096
+                        /* Firmware cannot cross 4K boundary.. */
+                        if ((rx->page_offset >> 12) !=
+                            ((rx->page_offset + bytes - 1) >> 12)) {
+                                rx->page_offset =
+                                    (rx->page_offset + bytes) & ~4095;
+                        }
+#endif
                 } else {
                         /* we need a new page */
                         page =
@@ -2483,6 +2491,8 @@ static void myri10ge_enable_ecrc(struct myri10ge_priv *mgp)
 
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE23 0x25f7
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE47 0x25fa
+#define PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_FIRST 0x140
+#define PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_LAST 0x142
 
 static void myri10ge_select_firmware(struct myri10ge_priv *mgp)
 {
@@ -2514,6 +2524,12 @@ static void myri10ge_select_firmware(struct myri10ge_priv *mgp)
                            ((bridge->vendor == PCI_VENDOR_ID_SERVERWORKS
                              && bridge->device ==
                              PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE)
+                            /* ServerWorks HT2100 */
+                            || (bridge->vendor == PCI_VENDOR_ID_SERVERWORKS
+                                && bridge->device >=
+                                PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_FIRST
+                                && bridge->device <=
+                                PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_LAST)
                             /* All Intel E5000 PCIE ports */
                             || (bridge->vendor == PCI_VENDOR_ID_INTEL
                                 && bridge->device >=
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index c6172a77a6d7..349b96a3ec4c 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -1712,7 +1712,7 @@ static void init_registers(struct net_device *dev)
 
         /* Enable interrupts by setting the interrupt mask. */
         writel(DEFAULT_INTR, ioaddr + IntrMask);
-        writel(1, ioaddr + IntrEnable);
+        natsemi_irq_enable(dev);
 
         writel(RxOn | TxOn, ioaddr + ChipCmd);
         writel(StatsClear, ioaddr + StatsCtrl); /* Clear Stats */
@@ -2119,28 +2119,35 @@ static irqreturn_t intr_handler(int irq, void *dev_instance)
         struct netdev_private *np = netdev_priv(dev);
         void __iomem * ioaddr = ns_ioaddr(dev);
 
-        if (np->hands_off)
+        /* Reading IntrStatus automatically acknowledges so don't do
+         * that while interrupts are disabled, (for example, while a
+         * poll is scheduled).  */
+        if (np->hands_off || !readl(ioaddr + IntrEnable))
                 return IRQ_NONE;
 
-        /* Reading automatically acknowledges. */
         np->intr_status = readl(ioaddr + IntrStatus);
 
+        if (!np->intr_status)
+                return IRQ_NONE;
+
         if (netif_msg_intr(np))
                 printk(KERN_DEBUG
                        "%s: Interrupt, status %#08x, mask %#08x.\n",
                        dev->name, np->intr_status,
                        readl(ioaddr + IntrMask));
 
-        if (!np->intr_status)
-                return IRQ_NONE;
-
         prefetch(&np->rx_skbuff[np->cur_rx % RX_RING_SIZE]);
 
         if (netif_rx_schedule_prep(dev)) {
                 /* Disable interrupts and register for poll */
                 natsemi_irq_disable(dev);
                 __netif_rx_schedule(dev);
-        }
+        } else
+                printk(KERN_WARNING
+                       "%s: Ignoring interrupt, status %#08x, mask %#08x.\n",
+                       dev->name, np->intr_status,
+                       readl(ioaddr + IntrMask));
+
         return IRQ_HANDLED;
 }
 
@@ -2156,6 +2163,20 @@ static int natsemi_poll(struct net_device *dev, int *budget)
         int work_done = 0;
 
         do {
+                if (netif_msg_intr(np))
+                        printk(KERN_DEBUG
+                               "%s: Poll, status %#08x, mask %#08x.\n",
+                               dev->name, np->intr_status,
+                               readl(ioaddr + IntrMask));
+
+                /* netdev_rx() may read IntrStatus again if the RX state
+                 * machine falls over so do it first. */
+                if (np->intr_status &
+                    (IntrRxDone | IntrRxIntr | RxStatusFIFOOver |
+                     IntrRxErr | IntrRxOverrun)) {
+                        netdev_rx(dev, &work_done, work_to_do);
+                }
+
                 if (np->intr_status &
                     (IntrTxDone | IntrTxIntr | IntrTxIdle | IntrTxErr)) {
                         spin_lock(&np->lock);
@@ -2167,12 +2188,6 @@ static int natsemi_poll(struct net_device *dev, int *budget)
                 if (np->intr_status & IntrAbnormalSummary)
                         netdev_error(dev, np->intr_status);
 
-                if (np->intr_status &
-                    (IntrRxDone | IntrRxIntr | RxStatusFIFOOver |
-                     IntrRxErr | IntrRxOverrun)) {
-                        netdev_rx(dev, &work_done, work_to_do);
-                }
-
                 *budget -= work_done;
                 dev->quota -= work_done;
 
@@ -2399,19 +2414,8 @@ static struct net_device_stats *get_stats(struct net_device *dev)
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void natsemi_poll_controller(struct net_device *dev)
 {
-        struct netdev_private *np = netdev_priv(dev);
-
         disable_irq(dev->irq);
-
-        /*
-         * A real interrupt might have already reached us at this point
-         * but NAPI might still haven't called us back.  As the interrupt
-         * status register is cleared by reading, we should prevent an
-         * interrupt loss in this case...
-         */
-        if (!np->intr_status)
-                intr_handler(dev->irq, dev);
-
+        intr_handler(dev->irq, dev);
         enable_irq(dev->irq);
 }
 #endif
@@ -3071,7 +3075,7 @@ static void enable_wol_mode(struct net_device *dev, int enable_intr)
                  * Could be used to send a netlink message.
                  */
                 writel(WOLPkt | LinkChange, ioaddr + IntrMask);
-                writel(1, ioaddr + IntrEnable);
+                natsemi_irq_enable(dev);
         }
 }
 
@@ -3202,7 +3206,7 @@ static int natsemi_suspend (struct pci_dev *pdev, pm_message_t state)
                 disable_irq(dev->irq);
                 spin_lock_irq(&np->lock);
 
-                writel(0, ioaddr + IntrEnable);
+                natsemi_irq_disable(dev);
                 np->hands_off = 1;
                 natsemi_stop_rxtx(dev);
                 netif_stop_queue(dev);
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 81742e4e5610..dd8ce35332fe 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -232,6 +232,7 @@ enum {
 #define MPORT_SINGLE_FUNCTION_MODE 0x1111
 
 extern unsigned long long netxen_dma_mask;
+extern unsigned long last_schedule_time;
 
 /*
  * NetXen host-peg signal message structure
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index 986ef98db229..ee1b5a24cbe7 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -462,6 +462,7 @@ netxen_nic_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
                 }
                 printk(KERN_INFO "%s: flash unlocked. \n", 
                         netxen_nic_driver_name);
+                last_schedule_time = jiffies;
                 ret = netxen_flash_erase_secondary(adapter);
                 if (ret != FLASH_SUCCESS) {
                         printk(KERN_ERR "%s: Flash erase failed.\n", 
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 1be55702557d..6537574a9cda 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -822,7 +822,10 @@ int netxen_nic_set_mtu_xgb(struct netxen_port *port, int new_mtu)
 {
         struct netxen_adapter *adapter = port->adapter;
         new_mtu += NETXEN_NIU_HDRSIZE + NETXEN_NIU_TLRSIZE;
-        netxen_nic_write_w0(adapter, NETXEN_NIU_XGE_MAX_FRAME_SIZE, new_mtu);
+        if (port->portnum == 0)
+            netxen_nic_write_w0(adapter, NETXEN_NIU_XGE_MAX_FRAME_SIZE, new_mtu);
+        else if (port->portnum == 1)
+            netxen_nic_write_w0(adapter, NETXEN_NIU_XG1_MAX_FRAME_SIZE, new_mtu);
         return 0;
 }
 
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 586d32b676af..229aa1c4fb79 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -42,6 +42,8 @@ struct crb_addr_pair {
         u32 data;
 };
 
+unsigned long last_schedule_time;
+
 #define NETXEN_MAX_CRB_XFORM 60
 static unsigned int crb_addr_xform[NETXEN_MAX_CRB_XFORM];
 #define NETXEN_ADDR_ERROR (0xffffffff)
@@ -404,9 +406,14 @@ static inline int do_rom_fast_write(struct netxen_adapter *adapter, int addr,
 static inline int
 do_rom_fast_read(struct netxen_adapter *adapter, int addr, int *valp)
 {
+        if (jiffies > (last_schedule_time + (8 * HZ))) {
+                last_schedule_time = jiffies;
+                schedule();
+        }
+
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ADDRESS, addr);
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 3);
-        udelay(70);             /* prevent bursting on CRB */
+        udelay(100);            /* prevent bursting on CRB */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_INSTR_OPCODE, 0xb);
         if (netxen_wait_rom_done(adapter)) {
@@ -415,7 +422,7 @@ do_rom_fast_read(struct netxen_adapter *adapter, int addr, int *valp)
         }
         /* reset abyte_cnt and dummy_byte_cnt */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 0);
-        udelay(70);             /* prevent bursting on CRB */
+        udelay(100);            /* prevent bursting on CRB */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
 
         *valp = netxen_nic_reg_read(adapter, NETXEN_ROMUSB_ROM_RDATA);
diff --git a/drivers/net/pci-skeleton.c b/drivers/net/pci-skeleton.c
index 00ca0fdb837b..6ca4e4fa6b88 100644
--- a/drivers/net/pci-skeleton.c
+++ b/drivers/net/pci-skeleton.c
@@ -710,8 +710,8 @@ match:
                 tp->chipset,
                 rtl_chip_info[tp->chipset].name);
 
-        i = register_netdev (dev);
-        if (i)
+        rc = register_netdev (dev);
+        if (rc)
                 goto err_out_unmap;
 
         DPRINTK ("EXIT, returning 0\n");
diff --git a/drivers/net/pcmcia/ibmtr_cs.c b/drivers/net/pcmcia/ibmtr_cs.c
index a956a51d284f..1060154ae750 100644
--- a/drivers/net/pcmcia/ibmtr_cs.c
+++ b/drivers/net/pcmcia/ibmtr_cs.c
@@ -138,7 +138,7 @@ static const struct ethtool_ops netdev_ethtool_ops = {
 
 ======================================================================*/
 
-static int ibmtr_attach(struct pcmcia_device *link)
+static int __devinit ibmtr_attach(struct pcmcia_device *link)
 {
     ibmtr_dev_t *info;
     struct net_device *dev;
@@ -217,7 +217,7 @@ static void ibmtr_detach(struct pcmcia_device *link)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static int ibmtr_config(struct pcmcia_device *link)
+static int __devinit ibmtr_config(struct pcmcia_device *link)
 {
     ibmtr_dev_t *info = link->priv;
     struct net_device *dev = info->dev;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 11b575f89856..ef58e4128782 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2544,6 +2544,9 @@ static void ppp_destroy_interface(struct ppp *ppp)
         ppp->active_filter = NULL;
 #endif /* CONFIG_PPP_FILTER */
 
+        if (ppp->xmit_pending)
+                kfree_skb(ppp->xmit_pending);
+
         kfree(ppp);
 }
 
diff --git a/drivers/net/saa9730.c b/drivers/net/saa9730.c
index b269513cde45..143958f1ef0a 100644
--- a/drivers/net/saa9730.c
+++ b/drivers/net/saa9730.c
@@ -64,37 +64,37 @@ static unsigned int pci_irq_line;
 
 static void evm_saa9730_enable_lan_int(struct lan_saa9730_private *lp)
 {
-        outl(readl(&lp->evm_saa9730_regs->InterruptBlock1) | EVM_LAN_INT,
-             &lp->evm_saa9730_regs->InterruptBlock1);
-        outl(readl(&lp->evm_saa9730_regs->InterruptStatus1) | EVM_LAN_INT,
-             &lp->evm_saa9730_regs->InterruptStatus1);
-        outl(readl(&lp->evm_saa9730_regs->InterruptEnable1) | EVM_LAN_INT |
-             EVM_MASTER_EN, &lp->evm_saa9730_regs->InterruptEnable1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptBlock1) | EVM_LAN_INT,
+               &lp->evm_saa9730_regs->InterruptBlock1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptStatus1) | EVM_LAN_INT,
+               &lp->evm_saa9730_regs->InterruptStatus1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptEnable1) | EVM_LAN_INT |
+               EVM_MASTER_EN, &lp->evm_saa9730_regs->InterruptEnable1);
 }
 
 static void evm_saa9730_disable_lan_int(struct lan_saa9730_private *lp)
 {
-        outl(readl(&lp->evm_saa9730_regs->InterruptBlock1) & ~EVM_LAN_INT,
-             &lp->evm_saa9730_regs->InterruptBlock1);
-        outl(readl(&lp->evm_saa9730_regs->InterruptEnable1) & ~EVM_LAN_INT,
-             &lp->evm_saa9730_regs->InterruptEnable1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptBlock1) & ~EVM_LAN_INT,
+               &lp->evm_saa9730_regs->InterruptBlock1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptEnable1) & ~EVM_LAN_INT,
+               &lp->evm_saa9730_regs->InterruptEnable1);
 }
 
 static void evm_saa9730_clear_lan_int(struct lan_saa9730_private *lp)
 {
-        outl(EVM_LAN_INT, &lp->evm_saa9730_regs->InterruptStatus1);
+        writel(EVM_LAN_INT, &lp->evm_saa9730_regs->InterruptStatus1);
 }
 
 static void evm_saa9730_block_lan_int(struct lan_saa9730_private *lp)
 {
-        outl(readl(&lp->evm_saa9730_regs->InterruptBlock1) & ~EVM_LAN_INT,
-             &lp->evm_saa9730_regs->InterruptBlock1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptBlock1) & ~EVM_LAN_INT,
+               &lp->evm_saa9730_regs->InterruptBlock1);
 }
 
 static void evm_saa9730_unblock_lan_int(struct lan_saa9730_private *lp)
 {
-        outl(readl(&lp->evm_saa9730_regs->InterruptBlock1) | EVM_LAN_INT,
-             &lp->evm_saa9730_regs->InterruptBlock1);
+        writel(readl(&lp->evm_saa9730_regs->InterruptBlock1) | EVM_LAN_INT,
+               &lp->evm_saa9730_regs->InterruptBlock1);
 }
 
 static void __attribute_used__ show_saa9730_regs(struct lan_saa9730_private *lp)
@@ -147,7 +147,7 @@ static void __attribute_used__ show_saa9730_regs(struct lan_saa9730_private *lp)
         printk("lp->lan_saa9730_regs->RxStatus = %x\n",
                readl(&lp->lan_saa9730_regs->RxStatus));
         for (i = 0; i < LAN_SAA9730_CAM_DWORDS; i++) {
-                outl(i, &lp->lan_saa9730_regs->CamAddress);
+                writel(i, &lp->lan_saa9730_regs->CamAddress);
                 printk("lp->lan_saa9730_regs->CamData = %x\n",
                        readl(&lp->lan_saa9730_regs->CamData));
         }
@@ -288,28 +288,27 @@ static int lan_saa9730_allocate_buffers(struct pci_dev *pdev,
          * Set rx buffer A and rx buffer B to point to the first two buffer
          * spaces.
          */
-        outl(lp->dma_addr + rxoffset,
-             &lp->lan_saa9730_regs->RxBuffA);
-        outl(lp->dma_addr + rxoffset +
-             LAN_SAA9730_PACKET_SIZE * LAN_SAA9730_RCV_Q_SIZE,
-             &lp->lan_saa9730_regs->RxBuffB);
+        writel(lp->dma_addr + rxoffset, &lp->lan_saa9730_regs->RxBuffA);
+        writel(lp->dma_addr + rxoffset +
+               LAN_SAA9730_PACKET_SIZE * LAN_SAA9730_RCV_Q_SIZE,
+               &lp->lan_saa9730_regs->RxBuffB);
 
         /*
          * Set txm_buf_a and txm_buf_b to point to the first two buffer
          * space
          */
-        outl(lp->dma_addr + txoffset,
-             &lp->lan_saa9730_regs->TxBuffA);
-        outl(lp->dma_addr + txoffset +
-             LAN_SAA9730_PACKET_SIZE * LAN_SAA9730_TXM_Q_SIZE,
-             &lp->lan_saa9730_regs->TxBuffB);
+        writel(lp->dma_addr + txoffset,
+               &lp->lan_saa9730_regs->TxBuffA);
+        writel(lp->dma_addr + txoffset +
+               LAN_SAA9730_PACKET_SIZE * LAN_SAA9730_TXM_Q_SIZE,
+               &lp->lan_saa9730_regs->TxBuffB);
 
         /* Set packet number */
-        outl((lp->DmaRcvPackets << PK_COUNT_RX_A_SHF) |
-             (lp->DmaRcvPackets << PK_COUNT_RX_B_SHF) |
-             (lp->DmaTxmPackets << PK_COUNT_TX_A_SHF) |
-             (lp->DmaTxmPackets << PK_COUNT_TX_B_SHF),
-             &lp->lan_saa9730_regs->PacketCount);
+        writel((lp->DmaRcvPackets << PK_COUNT_RX_A_SHF) |
+               (lp->DmaRcvPackets << PK_COUNT_RX_B_SHF) |
+               (lp->DmaTxmPackets << PK_COUNT_TX_A_SHF) |
+               (lp->DmaTxmPackets << PK_COUNT_TX_B_SHF),
+               &lp->lan_saa9730_regs->PacketCount);
 
         return 0;
 
@@ -326,10 +325,10 @@ static int lan_saa9730_cam_load(struct lan_saa9730_private *lp)
 
         for (i = 0; i < LAN_SAA9730_CAM_DWORDS; i++) {
                 /* First set address to where data is written */
-                outl(i, &lp->lan_saa9730_regs->CamAddress);
-                outl((NetworkAddress[0] << 24) | (NetworkAddress[1] << 16)
-                     | (NetworkAddress[2] << 8) | NetworkAddress[3],
-                     &lp->lan_saa9730_regs->CamData);
+                writel(i, &lp->lan_saa9730_regs->CamAddress);
+                writel((NetworkAddress[0] << 24) | (NetworkAddress[1] << 16) |
+                       (NetworkAddress[2] << 8) | NetworkAddress[3],
+                       &lp->lan_saa9730_regs->CamData);
                 NetworkAddress += 4;
         }
         return 0;
@@ -365,8 +364,8 @@ static int lan_saa9730_mii_init(struct lan_saa9730_private *lp)
         }
 
         /* Now set the control and address register. */
-        outl(MD_CA_BUSY | PHY_STATUS | PHY_ADDRESS << MD_CA_PHY_SHF,
-             &lp->lan_saa9730_regs->StationMgmtCtl);
+        writel(MD_CA_BUSY | PHY_STATUS | PHY_ADDRESS << MD_CA_PHY_SHF,
+               &lp->lan_saa9730_regs->StationMgmtCtl);
 
         /* check link status, spin here till station is not busy */
         i = 0;
@@ -391,23 +390,23 @@ static int lan_saa9730_mii_init(struct lan_saa9730_private *lp)
                 /* Link is down, reset the PHY first. */
 
                 /* set PHY address = 'CONTROL' */
-                outl(PHY_ADDRESS << MD_CA_PHY_SHF | MD_CA_WR | PHY_CONTROL,
-                     &lp->lan_saa9730_regs->StationMgmtCtl);
+                writel(PHY_ADDRESS << MD_CA_PHY_SHF | MD_CA_WR | PHY_CONTROL,
+                       &lp->lan_saa9730_regs->StationMgmtCtl);
 
                 /* Wait for 1 ms. */
                 mdelay(1);
 
                 /* set 'CONTROL' = force reset and renegotiate */
-                outl(PHY_CONTROL_RESET | PHY_CONTROL_AUTO_NEG |
-                     PHY_CONTROL_RESTART_AUTO_NEG,
-                     &lp->lan_saa9730_regs->StationMgmtData);
+                writel(PHY_CONTROL_RESET | PHY_CONTROL_AUTO_NEG |
+                       PHY_CONTROL_RESTART_AUTO_NEG,
+                       &lp->lan_saa9730_regs->StationMgmtData);
 
                 /* Wait for 50 ms. */
                 mdelay(50);
 
                 /* set 'BUSY' to start operation */
-                outl(MD_CA_BUSY | PHY_ADDRESS << MD_CA_PHY_SHF | MD_CA_WR |
-                     PHY_CONTROL, &lp->lan_saa9730_regs->StationMgmtCtl);
+                writel(MD_CA_BUSY | PHY_ADDRESS << MD_CA_PHY_SHF | MD_CA_WR |
+                       PHY_CONTROL, &lp->lan_saa9730_regs->StationMgmtCtl);
 
                 /* await completion */
                 i = 0;
@@ -427,9 +426,9 @@ static int lan_saa9730_mii_init(struct lan_saa9730_private *lp)
 
                 for (l = 0; l < 2; l++) {
                         /* set PHY address = 'STATUS' */
-                        outl(MD_CA_BUSY | PHY_ADDRESS << MD_CA_PHY_SHF |
-                             PHY_STATUS,
-                             &lp->lan_saa9730_regs->StationMgmtCtl);
+                        writel(MD_CA_BUSY | PHY_ADDRESS << MD_CA_PHY_SHF |
+                               PHY_STATUS,
+                               &lp->lan_saa9730_regs->StationMgmtCtl);
 
                         /* await completion */
                         i = 0;
@@ -462,35 +461,35 @@ static int lan_saa9730_mii_init(struct lan_saa9730_private *lp)
 static int lan_saa9730_control_init(struct lan_saa9730_private *lp)
 {
         /* Initialize DMA control register. */
-        outl((LANMB_ANY << DMA_CTL_MAX_XFER_SHF) |
-             (LANEND_LITTLE << DMA_CTL_ENDIAN_SHF) |
-             (LAN_SAA9730_RCV_Q_INT_THRESHOLD << DMA_CTL_RX_INT_COUNT_SHF)
-             | DMA_CTL_RX_INT_TO_EN | DMA_CTL_RX_INT_EN |
-             DMA_CTL_MAC_RX_INT_EN | DMA_CTL_MAC_TX_INT_EN,
-             &lp->lan_saa9730_regs->LanDmaCtl);
+        writel((LANMB_ANY << DMA_CTL_MAX_XFER_SHF) |
+               (LANEND_LITTLE << DMA_CTL_ENDIAN_SHF) |
+               (LAN_SAA9730_RCV_Q_INT_THRESHOLD << DMA_CTL_RX_INT_COUNT_SHF)
+               | DMA_CTL_RX_INT_TO_EN | DMA_CTL_RX_INT_EN |
+               DMA_CTL_MAC_RX_INT_EN | DMA_CTL_MAC_TX_INT_EN,
+               &lp->lan_saa9730_regs->LanDmaCtl);
 
         /* Initial MAC control register. */
-        outl((MACCM_MII << MAC_CONTROL_CONN_SHF) | MAC_CONTROL_FULL_DUP,
-             &lp->lan_saa9730_regs->MacCtl);
+        writel((MACCM_MII << MAC_CONTROL_CONN_SHF) | MAC_CONTROL_FULL_DUP,
+               &lp->lan_saa9730_regs->MacCtl);
 
         /* Initialize CAM control register. */
-        outl(CAM_CONTROL_COMP_EN | CAM_CONTROL_BROAD_ACC,
-             &lp->lan_saa9730_regs->CamCtl);
+        writel(CAM_CONTROL_COMP_EN | CAM_CONTROL_BROAD_ACC,
+               &lp->lan_saa9730_regs->CamCtl);
 
         /*
          * Initialize CAM enable register, only turn on first entry, should
          * contain own addr.
          */
-        outl(0x0001, &lp->lan_saa9730_regs->CamEnable);
+        writel(0x0001, &lp->lan_saa9730_regs->CamEnable);
 
         /* Initialize Tx control register */
-        outl(TX_CTL_EN_COMP, &lp->lan_saa9730_regs->TxCtl);
+        writel(TX_CTL_EN_COMP, &lp->lan_saa9730_regs->TxCtl);
 
         /* Initialize Rcv control register */
-        outl(RX_CTL_STRIP_CRC, &lp->lan_saa9730_regs->RxCtl);
+        writel(RX_CTL_STRIP_CRC, &lp->lan_saa9730_regs->RxCtl);
 
         /* Reset DMA engine */
-        outl(DMA_TEST_SW_RESET, &lp->lan_saa9730_regs->DmaTest);
+        writel(DMA_TEST_SW_RESET, &lp->lan_saa9730_regs->DmaTest);
 
         return 0;
 }
@@ -500,14 +499,14 @@ static int lan_saa9730_stop(struct lan_saa9730_private *lp)
         int i;
 
         /* Stop DMA first */
-        outl(readl(&lp->lan_saa9730_regs->LanDmaCtl) &
-             ~(DMA_CTL_EN_TX_DMA | DMA_CTL_EN_RX_DMA),
-             &lp->lan_saa9730_regs->LanDmaCtl);
+        writel(readl(&lp->lan_saa9730_regs->LanDmaCtl) &
+               ~(DMA_CTL_EN_TX_DMA | DMA_CTL_EN_RX_DMA),
+               &lp->lan_saa9730_regs->LanDmaCtl);
 
         /* Set the SW Reset bits in DMA and MAC control registers */
-        outl(DMA_TEST_SW_RESET, &lp->lan_saa9730_regs->DmaTest);
-        outl(readl(&lp->lan_saa9730_regs->MacCtl) | MAC_CONTROL_RESET,
-             &lp->lan_saa9730_regs->MacCtl);
+        writel(DMA_TEST_SW_RESET, &lp->lan_saa9730_regs->DmaTest);
+        writel(readl(&lp->lan_saa9730_regs->MacCtl) | MAC_CONTROL_RESET,
+               &lp->lan_saa9730_regs->MacCtl);
 
         /*
          * Wait for MAC reset to have finished. The reset bit is auto cleared
@@ -532,8 +531,8 @@ static int lan_saa9730_dma_init(struct lan_saa9730_private *lp)
         /* Stop lan controller. */
         lan_saa9730_stop(lp);
 
-        outl(LAN_SAA9730_DEFAULT_TIME_OUT_CNT,
-             &lp->lan_saa9730_regs->Timeout);
+        writel(LAN_SAA9730_DEFAULT_TIME_OUT_CNT,
+               &lp->lan_saa9730_regs->Timeout);
 
         return 0;
 }
@@ -552,19 +551,19 @@ static int lan_saa9730_start(struct lan_saa9730_private *lp)
         lp->PendingTxmPacketIndex = 0;
         lp->PendingTxmBufferIndex = 0;
 
-        outl(readl(&lp->lan_saa9730_regs->LanDmaCtl) | DMA_CTL_EN_TX_DMA |
-             DMA_CTL_EN_RX_DMA, &lp->lan_saa9730_regs->LanDmaCtl);
+        writel(readl(&lp->lan_saa9730_regs->LanDmaCtl) | DMA_CTL_EN_TX_DMA |
+               DMA_CTL_EN_RX_DMA, &lp->lan_saa9730_regs->LanDmaCtl);
 
         /* For Tx, turn on MAC then DMA */
-        outl(readl(&lp->lan_saa9730_regs->TxCtl) | TX_CTL_TX_EN,
-             &lp->lan_saa9730_regs->TxCtl);
+        writel(readl(&lp->lan_saa9730_regs->TxCtl) | TX_CTL_TX_EN,
+               &lp->lan_saa9730_regs->TxCtl);
 
         /* For Rx, turn on DMA then MAC */
-        outl(readl(&lp->lan_saa9730_regs->RxCtl) | RX_CTL_RX_EN,
-             &lp->lan_saa9730_regs->RxCtl);
+        writel(readl(&lp->lan_saa9730_regs->RxCtl) | RX_CTL_RX_EN,
+               &lp->lan_saa9730_regs->RxCtl);
 
         /* Set Ok2Use to let hardware own the buffers.  */
-        outl(OK2USE_RX_A | OK2USE_RX_B, &lp->lan_saa9730_regs->Ok2Use);
+        writel(OK2USE_RX_A | OK2USE_RX_B, &lp->lan_saa9730_regs->Ok2Use);
 
         return 0;
 }
@@ -587,7 +586,7 @@ static int lan_saa9730_tx(struct net_device *dev)
                 printk("lan_saa9730_tx interrupt\n");
 
         /* Clear interrupt. */
-        outl(DMA_STATUS_MAC_TX_INT, &lp->lan_saa9730_regs->DmaStatus);
+        writel(DMA_STATUS_MAC_TX_INT, &lp->lan_saa9730_regs->DmaStatus);
 
         while (1) {
                 pPacket = lp->TxmBuffer[lp->PendingTxmBufferIndex]
@@ -660,8 +659,8 @@ static int lan_saa9730_rx(struct net_device *dev)
                 printk("lan_saa9730_rx interrupt\n");
 
         /* Clear receive interrupts. */
-        outl(DMA_STATUS_MAC_RX_INT | DMA_STATUS_RX_INT |
-             DMA_STATUS_RX_TO_INT, &lp->lan_saa9730_regs->DmaStatus);
+        writel(DMA_STATUS_MAC_RX_INT | DMA_STATUS_RX_INT |
+               DMA_STATUS_RX_TO_INT, &lp->lan_saa9730_regs->DmaStatus);
 
         /* Address next packet */
         BufferIndex = lp->NextRcvBufferIndex;
@@ -725,8 +724,8 @@ static int lan_saa9730_rx(struct net_device *dev)
                 *pPacket = cpu_to_le32(RXSF_READY << RX_STAT_CTL_OWNER_SHF);
 
                 /* Make sure A or B is available to hardware as appropriate. */
-                outl(BufferIndex ? OK2USE_RX_B : OK2USE_RX_A,
-                     &lp->lan_saa9730_regs->Ok2Use);
+                writel(BufferIndex ? OK2USE_RX_B : OK2USE_RX_A,
+                       &lp->lan_saa9730_regs->Ok2Use);
 
                 /* Go to next packet in sequence. */
                 lp->NextRcvPacketIndex++;
@@ -844,8 +843,8 @@ static int lan_saa9730_write(struct lan_saa9730_private *lp,
                             (len << TX_STAT_CTL_LENGTH_SHF));
 
         /* Make sure A or B is available to hardware as appropriate. */
-        outl(BufferIndex ? OK2USE_TX_B : OK2USE_TX_A,
-             &lp->lan_saa9730_regs->Ok2Use);
+        writel(BufferIndex ? OK2USE_TX_B : OK2USE_TX_A,
+               &lp->lan_saa9730_regs->Ok2Use);
 
         return 0;
 }
@@ -938,15 +937,15 @@ static void lan_saa9730_set_multicast(struct net_device *dev)
 
         if (dev->flags & IFF_PROMISC) {
                 /* accept all packets */
-                outl(CAM_CONTROL_COMP_EN | CAM_CONTROL_STATION_ACC |
-                     CAM_CONTROL_GROUP_ACC | CAM_CONTROL_BROAD_ACC,
-                     &lp->lan_saa9730_regs->CamCtl);
+                writel(CAM_CONTROL_COMP_EN | CAM_CONTROL_STATION_ACC |
+                       CAM_CONTROL_GROUP_ACC | CAM_CONTROL_BROAD_ACC,
+                       &lp->lan_saa9730_regs->CamCtl);
         } else {
                 if (dev->flags & IFF_ALLMULTI) {
                         /* accept all multicast packets */
-                        outl(CAM_CONTROL_COMP_EN | CAM_CONTROL_GROUP_ACC |
-                             CAM_CONTROL_BROAD_ACC,
-                             &lp->lan_saa9730_regs->CamCtl);
+                        writel(CAM_CONTROL_COMP_EN | CAM_CONTROL_GROUP_ACC |
+                               CAM_CONTROL_BROAD_ACC,
+                               &lp->lan_saa9730_regs->CamCtl);
                 } else {
                         /*
                          * Will handle the multicast stuff later. -carstenl
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 1eae16b72b4b..103c3174ab54 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -243,7 +243,7 @@ struct sbmac_softc {
          * Controller-specific things
          */
 
-        volatile void __iomem *sbm_base;          /* MAC's base address */
+        void __iomem            *sbm_base;          /* MAC's base address */
         sbmac_state_t    sbm_state;         /* current state */
 
         volatile void __iomem   *sbm_macenable; /* MAC Enable Register */
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index eea75a401b0c..39c6677dff5e 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -105,7 +105,8 @@ static const int txqaddr[] = { Q_XA1, Q_XA2 };
 static const int rxqaddr[] = { Q_R1, Q_R2 };
 static const u32 rxirqmask[] = { IS_R1_F, IS_R2_F };
 static const u32 txirqmask[] = { IS_XA1_F, IS_XA2_F };
-static const u32 irqmask[] = { IS_R1_F|IS_XA1_F, IS_R2_F|IS_XA2_F };
+static const u32 napimask[] = { IS_R1_F|IS_XA1_F, IS_R2_F|IS_XA2_F };
+static const u32 portmask[] = { IS_PORT_1, IS_PORT_2 };
 
 static int skge_get_regs_len(struct net_device *dev)
 {
@@ -671,7 +672,7 @@ static void skge_led(struct skge_port *skge, enum led_mode mode)
         struct skge_hw *hw = skge->hw;
         int port = skge->port;
 
-        mutex_lock(&hw->phy_mutex);
+        spin_lock_bh(&hw->phy_lock);
         if (hw->chip_id == CHIP_ID_GENESIS) {
                 switch (mode) {
                 case LED_MODE_OFF:
@@ -742,7 +743,7 @@ static void skge_led(struct skge_port *skge, enum led_mode mode)
                                      PHY_M_LED_MO_RX(MO_LED_ON));
                 }
         }
-        mutex_unlock(&hw->phy_mutex);
+        spin_unlock_bh(&hw->phy_lock);
 }
 
 /* blink LED's for finding board */
@@ -1316,7 +1317,7 @@ static void xm_phy_init(struct skge_port *skge)
         xm_phy_write(hw, port, PHY_XMAC_CTRL, ctrl);
 
         /* Poll PHY for status changes */
-        schedule_delayed_work(&skge->link_thread, LINK_HZ);
+        mod_timer(&skge->link_timer, jiffies + LINK_HZ);
 }
 
 static void xm_check_link(struct net_device *dev)
@@ -1391,10 +1392,9 @@ static void xm_check_link(struct net_device *dev)
  * Since internal PHY is wired to a level triggered pin, can't
  * get an interrupt when carrier is detected.
  */
-static void xm_link_timer(struct work_struct *work)
+static void xm_link_timer(unsigned long arg)
 {
-        struct skge_port *skge =
-                container_of(work, struct skge_port, link_thread.work);
+        struct skge_port *skge = (struct skge_port *) arg;
         struct net_device *dev = skge->netdev;
         struct skge_hw *hw = skge->hw;
         int port = skge->port;
@@ -1414,13 +1414,13 @@ static void xm_link_timer(struct work_struct *work)
                         goto nochange;
         }
 
-        mutex_lock(&hw->phy_mutex);
+        spin_lock(&hw->phy_lock);
         xm_check_link(dev);
-        mutex_unlock(&hw->phy_mutex);
+        spin_unlock(&hw->phy_lock);
 
 nochange:
         if (netif_running(dev))
-                schedule_delayed_work(&skge->link_thread, LINK_HZ);
+                mod_timer(&skge->link_timer, jiffies + LINK_HZ);
 }
 
 static void genesis_mac_init(struct skge_hw *hw, int port)
@@ -2323,7 +2323,7 @@ static void skge_phy_reset(struct skge_port *skge)
         netif_stop_queue(skge->netdev);
         netif_carrier_off(skge->netdev);
 
-        mutex_lock(&hw->phy_mutex);
+        spin_lock_bh(&hw->phy_lock);
         if (hw->chip_id == CHIP_ID_GENESIS) {
                 genesis_reset(hw, port);
                 genesis_mac_init(hw, port);
@@ -2331,7 +2331,7 @@ static void skge_phy_reset(struct skge_port *skge)
                 yukon_reset(hw, port);
                 yukon_init(hw, port);
         }
-        mutex_unlock(&hw->phy_mutex);
+        spin_unlock_bh(&hw->phy_lock);
 
         dev->set_multicast_list(dev);
 }
@@ -2354,12 +2354,12 @@ static int skge_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 /* fallthru */
         case SIOCGMIIREG: {
                 u16 val = 0;
-                mutex_lock(&hw->phy_mutex);
+                spin_lock_bh(&hw->phy_lock);
                 if (hw->chip_id == CHIP_ID_GENESIS)
                         err = __xm_phy_read(hw, skge->port, data->reg_num & 0x1f, &val);
                 else
                         err = __gm_phy_read(hw, skge->port, data->reg_num & 0x1f, &val);
-                mutex_unlock(&hw->phy_mutex);
+                spin_unlock_bh(&hw->phy_lock);
                 data->val_out = val;
                 break;
         }
@@ -2368,14 +2368,14 @@ static int skge_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
-                mutex_lock(&hw->phy_mutex);
+                spin_lock_bh(&hw->phy_lock);
                 if (hw->chip_id == CHIP_ID_GENESIS)
                         err = xm_phy_write(hw, skge->port, data->reg_num & 0x1f,
                                    data->val_in);
                 else
                         err = gm_phy_write(hw, skge->port, data->reg_num & 0x1f,
                                    data->val_in);
-                mutex_unlock(&hw->phy_mutex);
+                spin_unlock_bh(&hw->phy_lock);
                 break;
         }
         return err;
@@ -2481,12 +2481,12 @@ static int skge_up(struct net_device *dev)
                 goto free_rx_ring;
 
         /* Initialize MAC */
-        mutex_lock(&hw->phy_mutex);
+        spin_lock_bh(&hw->phy_lock);
         if (hw->chip_id == CHIP_ID_GENESIS)
                 genesis_mac_init(hw, port);
         else
                 yukon_mac_init(hw, port);
-        mutex_unlock(&hw->phy_mutex);
+        spin_unlock_bh(&hw->phy_lock);
 
         /* Configure RAMbuffers */
         chunk = hw->ram_size / ((hw->ports + 1)*2);
@@ -2504,6 +2504,11 @@ static int skge_up(struct net_device *dev)
         skge_write8(hw, Q_ADDR(rxqaddr[port], Q_CSR), CSR_START | CSR_IRQ_CL_F);
         skge_led(skge, LED_MODE_ON);
 
+        spin_lock_irq(&hw->hw_lock);
+        hw->intr_mask |= portmask[port];
+        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
+
         netif_poll_enable(dev);
         return 0;
 
@@ -2531,7 +2536,14 @@ static int skge_down(struct net_device *dev)
 
         netif_stop_queue(dev);
         if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC)
-                cancel_delayed_work(&skge->link_thread);
+                del_timer_sync(&skge->link_timer);
+
+        netif_poll_disable(dev);
+
+        spin_lock_irq(&hw->hw_lock);
+        hw->intr_mask &= ~portmask[port];
+        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG), LED_OFF);
         if (hw->chip_id == CHIP_ID_GENESIS)
@@ -2575,8 +2587,10 @@ static int skge_down(struct net_device *dev)
 
         skge_led(skge, LED_MODE_OFF);
 
-        netif_poll_disable(dev);
+        netif_tx_lock_bh(dev);
         skge_tx_clean(dev);
+        netif_tx_unlock_bh(dev);
+
         skge_rx_clean(skge);
 
         kfree(skge->rx_ring.start);
@@ -2721,7 +2735,6 @@ static void skge_tx_clean(struct net_device *dev)
         struct skge_port *skge = netdev_priv(dev);
         struct skge_element *e;
 
-        netif_tx_lock_bh(dev);
         for (e = skge->tx_ring.to_clean; e != skge->tx_ring.to_use; e = e->next) {
                 struct skge_tx_desc *td = e->desc;
                 skge_tx_free(skge, e, td->control);
@@ -2730,7 +2743,6 @@ static void skge_tx_clean(struct net_device *dev)
 
         skge->tx_ring.to_clean = e;
         netif_wake_queue(dev);
-        netif_tx_unlock_bh(dev);
 }
 
 static void skge_tx_timeout(struct net_device *dev)
@@ -3049,7 +3061,7 @@ static int skge_poll(struct net_device *dev, int *budget)
 
         spin_lock_irqsave(&hw->hw_lock, flags);
         __netif_rx_complete(dev);
-        hw->intr_mask |= irqmask[skge->port];
+        hw->intr_mask |= napimask[skge->port];
         skge_write32(hw, B0_IMSK, hw->intr_mask);
         skge_read32(hw, B0_IMSK);
         spin_unlock_irqrestore(&hw->hw_lock, flags);
@@ -3160,28 +3172,29 @@ static void skge_error_irq(struct skge_hw *hw)
 }
 
 /*
- * Interrupt from PHY are handled in work queue
+ * Interrupt from PHY are handled in tasklet (softirq)
  * because accessing phy registers requires spin wait which might
  * cause excess interrupt latency.
  */
-static void skge_extirq(struct work_struct *work)
+static void skge_extirq(unsigned long arg)
 {
-        struct skge_hw *hw = container_of(work, struct skge_hw, phy_work);
+        struct skge_hw *hw = (struct skge_hw *) arg;
         int port;
 
-        mutex_lock(&hw->phy_mutex);
         for (port = 0; port < hw->ports; port++) {
                 struct net_device *dev = hw->dev[port];
-                struct skge_port *skge = netdev_priv(dev);
 
                 if (netif_running(dev)) {
+                        struct skge_port *skge = netdev_priv(dev);
+
+                        spin_lock(&hw->phy_lock);
                         if (hw->chip_id != CHIP_ID_GENESIS)
                                 yukon_phy_intr(skge);
                         else if (hw->phy_type == SK_PHY_BCOM)
                                 bcom_phy_intr(skge);
+                        spin_unlock(&hw->phy_lock);
                 }
         }
-        mutex_unlock(&hw->phy_mutex);
 
         spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= IS_EXT_REG;
@@ -3206,7 +3219,7 @@ static irqreturn_t skge_intr(int irq, void *dev_id)
         status &= hw->intr_mask;
         if (status & IS_EXT_REG) {
                 hw->intr_mask &= ~IS_EXT_REG;
-                schedule_work(&hw->phy_work);
+                tasklet_schedule(&hw->phy_task);
         }
 
         if (status & (IS_XA1_F|IS_R1_F)) {
@@ -3275,24 +3288,35 @@ static int skge_set_mac_address(struct net_device *dev, void *p)
         struct skge_hw *hw = skge->hw;
         unsigned port = skge->port;
         const struct sockaddr *addr = p;
+        u16 ctrl;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
-        mutex_lock(&hw->phy_mutex);
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
-        memcpy_toio(hw->regs + B2_MAC_1 + port*8,
-                    dev->dev_addr, ETH_ALEN);
-        memcpy_toio(hw->regs + B2_MAC_2 + port*8,
-                    dev->dev_addr, ETH_ALEN);
 
-        if (hw->chip_id == CHIP_ID_GENESIS)
-                xm_outaddr(hw, port, XM_SA, dev->dev_addr);
-        else {
-                gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
-                gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
+        if (!netif_running(dev)) {
+                memcpy_toio(hw->regs + B2_MAC_1 + port*8, dev->dev_addr, ETH_ALEN);
+                memcpy_toio(hw->regs + B2_MAC_2 + port*8, dev->dev_addr, ETH_ALEN);
+        } else {
+                /* disable Rx */
+                spin_lock_bh(&hw->phy_lock);
+                ctrl = gma_read16(hw, port, GM_GP_CTRL);
+                gma_write16(hw, port, GM_GP_CTRL, ctrl & ~GM_GPCR_RX_ENA);
+
+                memcpy_toio(hw->regs + B2_MAC_1 + port*8, dev->dev_addr, ETH_ALEN);
+                memcpy_toio(hw->regs + B2_MAC_2 + port*8, dev->dev_addr, ETH_ALEN);
+
+                if (hw->chip_id == CHIP_ID_GENESIS)
+                        xm_outaddr(hw, port, XM_SA, dev->dev_addr);
+                else {
+                        gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
+                        gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
+                }
+
+                gma_write16(hw, port, GM_GP_CTRL, ctrl);
+                spin_unlock_bh(&hw->phy_lock);
         }
-        mutex_unlock(&hw->phy_mutex);
 
         return 0;
 }
@@ -3407,10 +3431,9 @@ static int skge_reset(struct skge_hw *hw)
         else
                 hw->ram_size = t8 * 4096;
 
-        hw->intr_mask = IS_HW_ERR | IS_PORT_1;
-        if (hw->ports > 1)
-                hw->intr_mask |= IS_PORT_2;
+        hw->intr_mask = IS_HW_ERR;
 
+        /* Use PHY IRQ for all but fiber based Genesis board */
         if (!(hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC))
                 hw->intr_mask |= IS_EXT_REG;
 
@@ -3478,14 +3501,12 @@ static int skge_reset(struct skge_hw *hw)
 
         skge_write32(hw, B0_IMSK, hw->intr_mask);
 
-        mutex_lock(&hw->phy_mutex);
         for (i = 0; i < hw->ports; i++) {
                 if (hw->chip_id == CHIP_ID_GENESIS)
                         genesis_reset(hw, i);
                 else
                         yukon_reset(hw, i);
         }
-        mutex_unlock(&hw->phy_mutex);
 
         return 0;
 }
@@ -3533,6 +3554,7 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
         skge->netdev = dev;
         skge->hw = hw;
         skge->msg_enable = netif_msg_init(debug, default_msg);
+
         skge->tx_ring.count = DEFAULT_TX_RING_SIZE;
         skge->rx_ring.count = DEFAULT_RX_RING_SIZE;
 
@@ -3549,7 +3571,7 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
         skge->port = port;
 
         /* Only used for Genesis XMAC */
-        INIT_DELAYED_WORK(&skge->link_thread, xm_link_timer);
+        setup_timer(&skge->link_timer, xm_link_timer, (unsigned long) skge);
 
         if (hw->chip_id != CHIP_ID_GENESIS) {
                 dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
@@ -3631,9 +3653,9 @@ static int __devinit skge_probe(struct pci_dev *pdev,
         }
 
         hw->pdev = pdev;
-        mutex_init(&hw->phy_mutex);
-        INIT_WORK(&hw->phy_work, skge_extirq);
         spin_lock_init(&hw->hw_lock);
+        spin_lock_init(&hw->phy_lock);
+        tasklet_init(&hw->phy_task, &skge_extirq, (unsigned long) hw);
 
         hw->regs = ioremap_nocache(pci_resource_start(pdev, 0), 0x4000);
         if (!hw->regs) {
@@ -3719,6 +3741,8 @@ static void __devexit skge_remove(struct pci_dev *pdev)
         dev0 = hw->dev[0];
         unregister_netdev(dev0);
 
+        tasklet_disable(&hw->phy_task);
+
         spin_lock_irq(&hw->hw_lock);
         hw->intr_mask = 0;
         skge_write32(hw, B0_IMSK, 0);
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index e9354dfa7e9a..86467ae74d45 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -2424,8 +2424,8 @@ struct skge_hw {
         u32                  ram_size;
         u32                  ram_offset;
         u16                  phy_addr;
-        struct work_struct   phy_work;
-        struct mutex         phy_mutex;
+        spinlock_t           phy_lock;
+        struct tasklet_struct phy_task;
 };
 
 enum pause_control {
@@ -2457,7 +2457,7 @@ struct skge_port {
 
         struct net_device_stats net_stats;
 
-        struct delayed_work  link_thread;
+        struct timer_list    link_timer;
         enum pause_control   flow_control;
         enum pause_status    flow_status;
         u8                   rx_csum;
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 616be8d0fa85..08ea61db46fe 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2530,6 +2530,35 @@ static struct net_device_stats *gem_get_stats(struct net_device *dev)
         return &gp->net_stats;
 }
 
+static int gem_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *macaddr = (struct sockaddr *) addr;
+        struct gem *gp = dev->priv;
+        unsigned char *e = &dev->dev_addr[0];
+
+        if (!is_valid_ether_addr(macaddr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        if (!netif_running(dev) || !netif_device_present(dev)) {
+                /* We'll just catch it later when the
+                 * device is up'd or resumed.
+                 */
+                memcpy(dev->dev_addr, macaddr->sa_data, dev->addr_len);
+                return 0;
+        }
+
+        mutex_lock(&gp->pm_mutex);
+        memcpy(dev->dev_addr, macaddr->sa_data, dev->addr_len);
+        if (gp->running) {
+                writel((e[4] << 8) | e[5], gp->regs + MAC_ADDR0);
+                writel((e[2] << 8) | e[3], gp->regs + MAC_ADDR1);
+                writel((e[0] << 8) | e[1], gp->regs + MAC_ADDR2);
+        }
+        mutex_unlock(&gp->pm_mutex);
+
+        return 0;
+}
+
 static void gem_set_multicast(struct net_device *dev)
 {
         struct gem *gp = dev->priv;
@@ -3122,6 +3151,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
         dev->change_mtu = gem_change_mtu;
         dev->irq = pdev->irq;
         dev->dma = 0;
+        dev->set_mac_address = gem_set_mac_address;
 #ifdef CONFIG_NET_POLL_CONTROLLER
         dev->poll_controller = gem_poll_controller;
 #endif
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 8c8f9f4d47a5..0acee9f324e9 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.74"
-#define DRV_MODULE_RELDATE      "February 20, 2007"
+#define DRV_MODULE_VERSION      "3.75"
+#define DRV_MODULE_RELDATE      "March 23, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -3568,32 +3568,34 @@ static irqreturn_t tg3_interrupt(int irq, void *dev_id)
          * Reading the PCI State register will confirm whether the
          * interrupt is ours and will flush the status block.
          */
-        if ((sblk->status & SD_STATUS_UPDATED) ||
-            !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
-                /*
-                 * Writing any value to intr-mbox-0 clears PCI INTA# and
-                 * chip-internal interrupt pending events.
-                 * Writing non-zero to intr-mbox-0 additional tells the
-                 * NIC to stop sending us irqs, engaging "in-intr-handler"
-                 * event coalescing.
-                 */
-                tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                             0x00000001);
-                if (tg3_irq_sync(tp))
+        if (unlikely(!(sblk->status & SD_STATUS_UPDATED))) {
+                if ((tp->tg3_flags & TG3_FLAG_CHIP_RESETTING) ||
+                    (tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
+                        handled = 0;
                         goto out;
-                sblk->status &= ~SD_STATUS_UPDATED;
-                if (likely(tg3_has_work(tp))) {
-                        prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
-                        netif_rx_schedule(dev);         /* schedule NAPI poll */
-                } else {
-                        /* No work, shared interrupt perhaps?  re-enable
-                         * interrupts, and flush that PCI write
-                         */
-                        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                                0x00000000);
                 }
-        } else {        /* shared interrupt */
-                handled = 0;
+        }
+
+        /*
+         * Writing any value to intr-mbox-0 clears PCI INTA# and
+         * chip-internal interrupt pending events.
+         * Writing non-zero to intr-mbox-0 additional tells the
+         * NIC to stop sending us irqs, engaging "in-intr-handler"
+         * event coalescing.
+         */
+        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+        if (tg3_irq_sync(tp))
+                goto out;
+        sblk->status &= ~SD_STATUS_UPDATED;
+        if (likely(tg3_has_work(tp))) {
+                prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
+                netif_rx_schedule(dev);         /* schedule NAPI poll */
+        } else {
+                /* No work, shared interrupt perhaps?  re-enable
+                 * interrupts, and flush that PCI write
+                 */
+                tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                               0x00000000);
         }
 out:
         return IRQ_RETVAL(handled);
@@ -3611,31 +3613,33 @@ static irqreturn_t tg3_interrupt_tagged(int irq, void *dev_id)
          * Reading the PCI State register will confirm whether the
          * interrupt is ours and will flush the status block.
          */
-        if ((sblk->status_tag != tp->last_tag) ||
-            !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
-                /*
-                 * writing any value to intr-mbox-0 clears PCI INTA# and
-                 * chip-internal interrupt pending events.
-                 * writing non-zero to intr-mbox-0 additional tells the
-                 * NIC to stop sending us irqs, engaging "in-intr-handler"
-                 * event coalescing.
-                 */
-                tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                             0x00000001);
-                if (tg3_irq_sync(tp))
+        if (unlikely(sblk->status_tag == tp->last_tag)) {
+                if ((tp->tg3_flags & TG3_FLAG_CHIP_RESETTING) ||
+                    (tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
+                        handled = 0;
                         goto out;
-                if (netif_rx_schedule_prep(dev)) {
-                        prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
-                        /* Update last_tag to mark that this status has been
-                         * seen. Because interrupt may be shared, we may be
-                         * racing with tg3_poll(), so only update last_tag
-                         * if tg3_poll() is not scheduled.
-                         */
-                        tp->last_tag = sblk->status_tag;
-                        __netif_rx_schedule(dev);
                 }
-        } else {        /* shared interrupt */
-                handled = 0;
+        }
+
+        /*
+         * writing any value to intr-mbox-0 clears PCI INTA# and
+         * chip-internal interrupt pending events.
+         * writing non-zero to intr-mbox-0 additional tells the
+         * NIC to stop sending us irqs, engaging "in-intr-handler"
+         * event coalescing.
+         */
+        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+        if (tg3_irq_sync(tp))
+                goto out;
+        if (netif_rx_schedule_prep(dev)) {
+                prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
+                /* Update last_tag to mark that this status has been
+                 * seen. Because interrupt may be shared, we may be
+                 * racing with tg3_poll(), so only update last_tag
+                 * if tg3_poll() is not scheduled.
+                 */
+                tp->last_tag = sblk->status_tag;
+                __netif_rx_schedule(dev);
         }
 out:
         return IRQ_RETVAL(handled);
@@ -4823,6 +4827,19 @@ static int tg3_chip_reset(struct tg3 *tp)
         if (write_op == tg3_write_flush_reg32)
                 tp->write32 = tg3_write32;
 
+        /* Prevent the irq handler from reading or writing PCI registers
+         * during chip reset when the memory enable bit in the PCI command
+         * register may be cleared.  The chip does not generate interrupt
+         * at this time, but the irq handler may still be called due to irq
+         * sharing or irqpoll.
+         */
+        tp->tg3_flags |= TG3_FLAG_CHIP_RESETTING;
+        tp->hw_status->status = 0;
+        tp->hw_status->status_tag = 0;
+        tp->last_tag = 0;
+        smp_mb();
+        synchronize_irq(tp->pdev->irq);
+
         /* do the reset */
         val = GRC_MISC_CFG_CORECLK_RESET;
 
@@ -4904,6 +4921,8 @@ static int tg3_chip_reset(struct tg3 *tp)
 
         pci_restore_state(tp->pdev);
 
+        tp->tg3_flags &= ~TG3_FLAG_CHIP_RESETTING;
+
         /* Make sure PCI-X relaxed ordering bit is clear. */
         pci_read_config_dword(tp->pdev, TG3PCI_X_CAPS, &val);
         val &= ~PCIX_CAPS_RELAXED_ORDERING;
@@ -6321,8 +6340,6 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                       RDMAC_MODE_ADDROFLOW_ENAB | RDMAC_MODE_FIFOOFLOW_ENAB |
                       RDMAC_MODE_FIFOURUN_ENAB | RDMAC_MODE_FIFOOREAD_ENAB |
                       RDMAC_MODE_LNGREAD_ENAB);
-        if (tp->tg3_flags & TG3_FLAG_SPLIT_MODE)
-                rdmac_mode |= RDMAC_MODE_SPLIT_ENABLE;
 
         /* If statement applies to 5705 and 5750 PCI devices only */
         if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705 &&
@@ -6495,9 +6512,6 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
                         val &= ~(PCIX_CAPS_SPLIT_MASK | PCIX_CAPS_BURST_MASK);
                         val |= (PCIX_CAPS_MAX_BURST_CPIOB << PCIX_CAPS_BURST_SHIFT);
-                        if (tp->tg3_flags & TG3_FLAG_SPLIT_MODE)
-                                val |= (tp->split_mode_max_reqs <<
-                                        PCIX_CAPS_SPLIT_SHIFT);
                 }
                 tw32(TG3PCI_X_CAPS, val);
         }
@@ -10863,14 +10877,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         grc_misc_cfg = tr32(GRC_MISC_CFG);
         grc_misc_cfg &= GRC_MISC_CFG_BOARD_ID_MASK;
 
-        /* Broadcom's driver says that CIOBE multisplit has a bug */
-#if 0
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 &&
-            grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5704CIOBE) {
-                tp->tg3_flags |= TG3_FLAG_SPLIT_MODE;
-                tp->split_mode_max_reqs = SPLIT_MODE_5704_MAX_REQ;
-        }
-#endif
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705 &&
             (grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5788 ||
              grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5788M))
@@ -11968,14 +11974,12 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                        i == 5 ? '\n' : ':');
 
         printk(KERN_INFO "%s: RXcsums[%d] LinkChgREG[%d] "
-               "MIirq[%d] ASF[%d] Split[%d] WireSpeed[%d] "
-               "TSOcap[%d] \n",
+               "MIirq[%d] ASF[%d] WireSpeed[%d] TSOcap[%d]\n",
                dev->name,
                (tp->tg3_flags & TG3_FLAG_RX_CHECKSUMS) != 0,
                (tp->tg3_flags & TG3_FLAG_USE_LINKCHG_REG) != 0,
                (tp->tg3_flags & TG3_FLAG_USE_MI_INTERRUPT) != 0,
                (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0,
-               (tp->tg3_flags & TG3_FLAG_SPLIT_MODE) != 0,
                (tp->tg3_flags2 & TG3_FLG2_NO_ETH_WIRE_SPEED) == 0,
                (tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE) != 0);
         printk(KERN_INFO "%s: dma_rwctrl[%08x] dma_mask[%d-bit]\n",
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 086892d8c1f1..d515ed23841b 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2223,7 +2223,7 @@ struct tg3 {
 #define TG3_FLAG_40BIT_DMA_BUG          0x08000000
 #define TG3_FLAG_BROKEN_CHECKSUMS       0x10000000
 #define TG3_FLAG_GOT_SERDES_FLOWCTL     0x20000000
-#define TG3_FLAG_SPLIT_MODE             0x40000000
+#define TG3_FLAG_CHIP_RESETTING         0x40000000
 #define TG3_FLAG_INIT_COMPLETE          0x80000000
         u32                             tg3_flags2;
 #define TG3_FLG2_RESTART_TIMER          0x00000001
@@ -2262,9 +2262,6 @@ struct tg3 {
 #define TG3_FLG2_NO_FWARE_REPORTED      0x40000000
 #define TG3_FLG2_PHY_ADJUST_TRIM        0x80000000
 
-        u32                             split_mode_max_reqs;
-#define SPLIT_MODE_5704_MAX_REQ         3
-
         struct timer_list               timer;
         u16                             timer_counter;
         u16                             timer_multiplier;
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 36202e94ee91..01d55315ee8c 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -346,7 +346,7 @@ static void ibmtr_cleanup_card(struct net_device *dev)
  *      which references it.
  ****************************************************************************/
 
-static int __init ibmtr_probe(struct net_device *dev)
+static int __devinit ibmtr_probe(struct net_device *dev)
 {
         int i;
         int base_addr = dev->base_addr;
@@ -366,7 +366,7 @@ static int __init ibmtr_probe(struct net_device *dev)
         return -ENODEV;
 }
 
-int __init ibmtr_probe_card(struct net_device *dev)
+int __devinit ibmtr_probe_card(struct net_device *dev)
 {
         int err = ibmtr_probe(dev);
         if (!err) {
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index 24a29c99ba94..9aeac76184f3 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -190,13 +190,13 @@
 
 /* Structure/enum declaration ------------------------------- */
 struct tx_desc {
-        u32 tdes0, tdes1, tdes2, tdes3; /* Data for the card */
+        __le32 tdes0, tdes1, tdes2, tdes3; /* Data for the card */
         char *tx_buf_ptr;               /* Data for us */
         struct tx_desc *next_tx_desc;
 } __attribute__(( aligned(32) ));
 
 struct rx_desc {
-        u32 rdes0, rdes1, rdes2, rdes3; /* Data for the card */
+        __le32 rdes0, rdes1, rdes2, rdes3; /* Data for the card */
         struct sk_buff *rx_skb_ptr;     /* Data for us */
         struct rx_desc *next_rx_desc;
 } __attribute__(( aligned(32) ));
@@ -458,7 +458,7 @@ static int __devinit dmfe_init_one (struct pci_dev *pdev,
 
         /* read 64 word srom data */
         for (i = 0; i < 64; i++)
-                ((u16 *) db->srom)[i] =
+                ((__le16 *) db->srom)[i] =
                         cpu_to_le16(read_srom_word(db->ioaddr, i));
 
         /* Set Node address */
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index dab88b958d6e..639e1e6913bf 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3607,7 +3607,6 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (bd == ugeth->confBd[txQ]) {
                 if (!netif_queue_stopped(dev))
                         netif_stop_queue(dev);
-                return NETDEV_TX_BUSY;
         }
 
         ugeth->txBd[txQ] = bd;
@@ -3623,7 +3622,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         spin_unlock_irq(&ugeth->lock);
 
-        return NETDEV_TX_OK;
+        return 0;
 }
 
 static int ucc_geth_rx(struct ucc_geth_private *ugeth, u8 rxQ, int rx_work_limit)
diff --git a/drivers/net/wan/lmc/lmc_media.h b/drivers/net/wan/lmc/lmc_media.h
deleted file mode 100644
index ddcc00403563..000000000000
--- a/drivers/net/wan/lmc/lmc_media.h
+++ /dev/null
@@ -1,65 +0,0 @@
-#ifndef _LMC_MEDIA_H_
-#define _LMC_MEDIA_H_
-
-lmc_media_t lmc_ds3_media = {
-  lmc_ds3_init,                 /* special media init stuff */
-  lmc_ds3_default,              /* reset to default state */
-  lmc_ds3_set_status,           /* reset status to state provided */
-  lmc_dummy_set_1,              /* set clock source */
-  lmc_dummy_set2_1,             /* set line speed */
-  lmc_ds3_set_100ft,            /* set cable length */
-  lmc_ds3_set_scram,            /* set scrambler */
-  lmc_ds3_get_link_status,      /* get link status */
-  lmc_dummy_set_1,              /* set link status */
-  lmc_ds3_set_crc_length,       /* set CRC length */
-  lmc_dummy_set_1,              /* set T1 or E1 circuit type */
-  lmc_ds3_watchdog
-};
-
-lmc_media_t lmc_hssi_media = {
-  lmc_hssi_init,                /* special media init stuff */
-  lmc_hssi_default,             /* reset to default state */
-  lmc_hssi_set_status,          /* reset status to state provided */
-  lmc_hssi_set_clock,           /* set clock source */
-  lmc_dummy_set2_1,             /* set line speed */
-  lmc_dummy_set_1,              /* set cable length */
-  lmc_dummy_set_1,              /* set scrambler */
-  lmc_hssi_get_link_status,     /* get link status */
-  lmc_hssi_set_link_status,     /* set link status */
-  lmc_hssi_set_crc_length,      /* set CRC length */
-  lmc_dummy_set_1,              /* set T1 or E1 circuit type */
-  lmc_hssi_watchdog
-};
-
-lmc_media_t lmc_ssi_media = { lmc_ssi_init,     /* special media init stuff */
-  lmc_ssi_default,              /* reset to default state */
-  lmc_ssi_set_status,           /* reset status to state provided */
-  lmc_ssi_set_clock,            /* set clock source */
-  lmc_ssi_set_speed,            /* set line speed */
-  lmc_dummy_set_1,              /* set cable length */
-  lmc_dummy_set_1,              /* set scrambler */
-  lmc_ssi_get_link_status,      /* get link status */
-  lmc_ssi_set_link_status,      /* set link status */
-  lmc_ssi_set_crc_length,       /* set CRC length */
-  lmc_dummy_set_1,              /* set T1 or E1 circuit type */
-  lmc_ssi_watchdog
-};
-
-lmc_media_t lmc_t1_media = {
-  lmc_t1_init,                  /* special media init stuff */
-  lmc_t1_default,               /* reset to default state */
-  lmc_t1_set_status,            /* reset status to state provided */
-  lmc_t1_set_clock,             /* set clock source */
-  lmc_dummy_set2_1,             /* set line speed */
-  lmc_dummy_set_1,              /* set cable length */
-  lmc_dummy_set_1,              /* set scrambler */
-  lmc_t1_get_link_status,       /* get link status */
-  lmc_dummy_set_1,              /* set link status */
-  lmc_t1_set_crc_length,        /* set CRC length */
-  lmc_t1_set_circuit_type,      /* set T1 or E1 circuit type */
-  lmc_t1_watchdog
-};
-
-
-#endif
-
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index a8c2bfe26c27..2ada76a93cb6 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2852,7 +2852,7 @@ static struct net_device *_init_airo_card( unsigned short irq, int port,
         if (rc) {
                 airo_print_err(dev->name, "register interrupt %d failed, rc %d",
                                 irq, rc);
-                goto err_out_unlink;
+                goto err_out_nets;
         }
         if (!is_pcmcia) {
                 if (!request_region( dev->base_addr, 64, dev->name )) {
@@ -2935,6 +2935,8 @@ err_out_res:
                 release_region( dev->base_addr, 64 );
 err_out_irq:
         free_irq(dev->irq, dev);
+err_out_nets:
+        airo_networks_free(ai);
 err_out_unlink:
         del_airo_dev(dev);
 err_out_thr:
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_radio.c b/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
index 32beb91b7164..ee1e7a2afc08 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
@@ -882,10 +882,10 @@ static void _stack_save(u32 *_stackptr, size_t *stackidx,
 {
         u32 *stackptr = &(_stackptr[*stackidx]);
 
-        assert((offset & 0xF000) == 0x0000);
-        assert((id & 0xF0) == 0x00);
+        assert((offset & 0xE000) == 0x0000);
+        assert((id & 0xF8) == 0x00);
         *stackptr = offset;
-        *stackptr |= ((u32)id) << 12;
+        *stackptr |= ((u32)id) << 13;
         *stackptr |= ((u32)value) << 16;
         (*stackidx)++;
         assert(*stackidx < BCM43xx_INTERFSTACK_SIZE);
@@ -896,12 +896,12 @@ static u16 _stack_restore(u32 *stackptr,
 {
         size_t i;
 
-        assert((offset & 0xF000) == 0x0000);
-        assert((id & 0xF0) == 0x00);
+        assert((offset & 0xE000) == 0x0000);
+        assert((id & 0xF8) == 0x00);
         for (i = 0; i < BCM43xx_INTERFSTACK_SIZE; i++, stackptr++) {
-                if ((*stackptr & 0x00000FFF) != offset)
+                if ((*stackptr & 0x00001FFF) != offset)
                         continue;
-                if (((*stackptr & 0x0000F000) >> 12) != id)
+                if (((*stackptr & 0x00007000) >> 13) != id)
                         continue;
                 return ((*stackptr & 0xFFFF0000) >> 16);
         }
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 01869b1782e4..ad33e0159514 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -100,6 +100,7 @@ static void msi_set_mask_bit(unsigned int irq, int flag)
                 BUG();
                 break;
         }
+        entry->msi_attrib.masked = !!flag;
 }
 
 void read_msi_msg(unsigned int irq, struct msi_msg *msg)
@@ -179,6 +180,7 @@ void write_msi_msg(unsigned int irq, struct msi_msg *msg)
         default:
                 BUG();
         }
+        entry->msg = *msg;
 }
 
 void mask_msi_irq(unsigned int irq)
@@ -225,164 +227,60 @@ static struct msi_desc* alloc_msi_entry(void)
 }
 
 #ifdef CONFIG_PM
-static int __pci_save_msi_state(struct pci_dev *dev)
-{
-        int pos, i = 0;
-        u16 control;
-        struct pci_cap_saved_state *save_state;
-        u32 *cap;
-
-        if (!dev->msi_enabled)
-                return 0;
-
-        pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
-        if (pos <= 0)
-                return 0;
-
-        save_state = kzalloc(sizeof(struct pci_cap_saved_state) + sizeof(u32) * 5,
-                GFP_KERNEL);
-        if (!save_state) {
-                printk(KERN_ERR "Out of memory in pci_save_msi_state\n");
-                return -ENOMEM;
-        }
-        cap = &save_state->data[0];
-
-        pci_read_config_dword(dev, pos, &cap[i++]);
-        control = cap[0] >> 16;
-        pci_read_config_dword(dev, pos + PCI_MSI_ADDRESS_LO, &cap[i++]);
-        if (control & PCI_MSI_FLAGS_64BIT) {
-                pci_read_config_dword(dev, pos + PCI_MSI_ADDRESS_HI, &cap[i++]);
-                pci_read_config_dword(dev, pos + PCI_MSI_DATA_64, &cap[i++]);
-        } else
-                pci_read_config_dword(dev, pos + PCI_MSI_DATA_32, &cap[i++]);
-        if (control & PCI_MSI_FLAGS_MASKBIT)
-                pci_read_config_dword(dev, pos + PCI_MSI_MASK_BIT, &cap[i++]);
-        save_state->cap_nr = PCI_CAP_ID_MSI;
-        pci_add_saved_cap(dev, save_state);
-        return 0;
-}
-
 static void __pci_restore_msi_state(struct pci_dev *dev)
 {
-        int i = 0, pos;
+        int pos;
         u16 control;
-        struct pci_cap_saved_state *save_state;
-        u32 *cap;
+        struct msi_desc *entry;
 
         if (!dev->msi_enabled)
                 return;
 
-        save_state = pci_find_saved_cap(dev, PCI_CAP_ID_MSI);
-        pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
-        if (!save_state || pos <= 0)
-                return;
-        cap = &save_state->data[0];
+        entry = get_irq_msi(dev->irq);
+        pos = entry->msi_attrib.pos;
 
         pci_intx(dev, 0);               /* disable intx */
-        control = cap[i++] >> 16;
         msi_set_enable(dev, 0);
-        pci_write_config_dword(dev, pos + PCI_MSI_ADDRESS_LO, cap[i++]);
-        if (control & PCI_MSI_FLAGS_64BIT) {
-                pci_write_config_dword(dev, pos + PCI_MSI_ADDRESS_HI, cap[i++]);
-                pci_write_config_dword(dev, pos + PCI_MSI_DATA_64, cap[i++]);
-        } else
-                pci_write_config_dword(dev, pos + PCI_MSI_DATA_32, cap[i++]);
-        if (control & PCI_MSI_FLAGS_MASKBIT)
-                pci_write_config_dword(dev, pos + PCI_MSI_MASK_BIT, cap[i++]);
+        write_msi_msg(dev->irq, &entry->msg);
+        if (entry->msi_attrib.maskbit)
+                msi_set_mask_bit(dev->irq, entry->msi_attrib.masked);
+
+        pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &control);
+        control &= ~(PCI_MSI_FLAGS_QSIZE | PCI_MSI_FLAGS_ENABLE);
+        if (entry->msi_attrib.maskbit || !entry->msi_attrib.masked)
+                control |= PCI_MSI_FLAGS_ENABLE;
         pci_write_config_word(dev, pos + PCI_MSI_FLAGS, control);
-        pci_remove_saved_cap(save_state);
-        kfree(save_state);
-}
-
-static int __pci_save_msix_state(struct pci_dev *dev)
-{
-        int pos;
-        int irq, head, tail = 0;
-        u16 control;
-        struct pci_cap_saved_state *save_state;
-
-        if (!dev->msix_enabled)
-                return 0;
-
-        pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
-        if (pos <= 0)
-                return 0;
-
-        /* save the capability */
-        pci_read_config_word(dev, msi_control_reg(pos), &control);
-        save_state = kzalloc(sizeof(struct pci_cap_saved_state) + sizeof(u16),
-                GFP_KERNEL);
-        if (!save_state) {
-                printk(KERN_ERR "Out of memory in pci_save_msix_state\n");
-                return -ENOMEM;
-        }
-        *((u16 *)&save_state->data[0]) = control;
-
-        /* save the table */
-        irq = head = dev->first_msi_irq;
-        while (head != tail) {
-                struct msi_desc *entry;
-
-                entry = get_irq_msi(irq);
-                read_msi_msg(irq, &entry->msg_save);
-
-                tail = entry->link.tail;
-                irq = tail;
-        }
-
-        save_state->cap_nr = PCI_CAP_ID_MSIX;
-        pci_add_saved_cap(dev, save_state);
-        return 0;
-}
-
-int pci_save_msi_state(struct pci_dev *dev)
-{
-        int rc;
-
-        rc = __pci_save_msi_state(dev);
-        if (rc)
-                return rc;
-
-        rc = __pci_save_msix_state(dev);
-
-        return rc;
 }
 
 static void __pci_restore_msix_state(struct pci_dev *dev)
 {
-        u16 save;
         int pos;
         int irq, head, tail = 0;
         struct msi_desc *entry;
-        struct pci_cap_saved_state *save_state;
+        u16 control;
 
         if (!dev->msix_enabled)
                 return;
 
-        save_state = pci_find_saved_cap(dev, PCI_CAP_ID_MSIX);
-        if (!save_state)
-                return;
-        save = *((u16 *)&save_state->data[0]);
-        pci_remove_saved_cap(save_state);
-        kfree(save_state);
-
-        pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
-        if (pos <= 0)
-                return;
-
         /* route the table */
         pci_intx(dev, 0);               /* disable intx */
         msix_set_enable(dev, 0);
         irq = head = dev->first_msi_irq;
+        entry = get_irq_msi(irq);
+        pos = entry->msi_attrib.pos;
         while (head != tail) {
                 entry = get_irq_msi(irq);
-                write_msi_msg(irq, &entry->msg_save);
+                write_msi_msg(irq, &entry->msg);
+                msi_set_mask_bit(irq, entry->msi_attrib.masked);
 
                 tail = entry->link.tail;
                 irq = tail;
         }
 
-        pci_write_config_word(dev, msi_control_reg(pos), save);
+        pci_read_config_word(dev, pos + PCI_MSIX_FLAGS, &control);
+        control &= ~PCI_MSIX_FLAGS_MASKALL;
+        control |= PCI_MSIX_FLAGS_ENABLE;
+        pci_write_config_word(dev, pos + PCI_MSIX_FLAGS, control);
 }
 
 void pci_restore_msi_state(struct pci_dev *dev)
@@ -420,6 +318,7 @@ static int msi_capability_init(struct pci_dev *dev)
         entry->msi_attrib.is_64 = is_64bit_address(control);
         entry->msi_attrib.entry_nr = 0;
         entry->msi_attrib.maskbit = is_mask_bit_support(control);
+        entry->msi_attrib.masked = 1;
         entry->msi_attrib.default_irq = dev->irq;       /* Save IOAPIC IRQ */
         entry->msi_attrib.pos = pos;
         if (is_mask_bit_support(control)) {
@@ -507,6 +406,7 @@ static int msix_capability_init(struct pci_dev *dev,
                 entry->msi_attrib.is_64 = 1;
                 entry->msi_attrib.entry_nr = j;
                 entry->msi_attrib.maskbit = 1;
+                entry->msi_attrib.masked = 1;
                 entry->msi_attrib.default_irq = dev->irq;
                 entry->msi_attrib.pos = pos;
                 entry->dev = dev;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a32db0628157..d3eab057b2d3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -551,7 +551,9 @@ static int pci_save_pcie_state(struct pci_dev *dev)
         if (pos <= 0)
                 return 0;
 
-        save_state = kzalloc(sizeof(*save_state) + sizeof(u16) * 4, GFP_KERNEL);
+        save_state = pci_find_saved_cap(dev, PCI_CAP_ID_EXP);
+        if (!save_state)
+                save_state = kzalloc(sizeof(*save_state) + sizeof(u16) * 4, GFP_KERNEL);
         if (!save_state) {
                 dev_err(&dev->dev, "Out of memory in pci_save_pcie_state\n");
                 return -ENOMEM;
@@ -582,8 +584,6 @@ static void pci_restore_pcie_state(struct pci_dev *dev)
         pci_write_config_word(dev, pos + PCI_EXP_LNKCTL, cap[i++]);
         pci_write_config_word(dev, pos + PCI_EXP_SLTCTL, cap[i++]);
         pci_write_config_word(dev, pos + PCI_EXP_RTCTL, cap[i++]);
-        pci_remove_saved_cap(save_state);
-        kfree(save_state);
 }
 
 
@@ -597,7 +597,9 @@ static int pci_save_pcix_state(struct pci_dev *dev)
         if (pos <= 0)
                 return 0;
 
-        save_state = kzalloc(sizeof(*save_state) + sizeof(u16), GFP_KERNEL);
+        save_state = pci_find_saved_cap(dev, PCI_CAP_ID_EXP);
+        if (!save_state)
+                save_state = kzalloc(sizeof(*save_state) + sizeof(u16), GFP_KERNEL);
         if (!save_state) {
                 dev_err(&dev->dev, "Out of memory in pci_save_pcie_state\n");
                 return -ENOMEM;
@@ -622,8 +624,6 @@ static void pci_restore_pcix_state(struct pci_dev *dev)
         cap = (u16 *)&save_state->data[0];
 
         pci_write_config_word(dev, pos + PCI_X_CMD, cap[i++]);
-        pci_remove_saved_cap(save_state);
-        kfree(save_state);
 }
 
 
@@ -638,8 +638,6 @@ pci_save_state(struct pci_dev *dev)
         /* XXX: 100% dword access ok here? */
         for (i = 0; i < 16; i++)
                 pci_read_config_dword(dev, i * 4,&dev->saved_config_space[i]);
-        if ((i = pci_save_msi_state(dev)) != 0)
-                return i;
         if ((i = pci_save_pcie_state(dev)) != 0)
                 return i;
         if ((i = pci_save_pcix_state(dev)) != 0)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index ae7a975995a5..62ea04c8af64 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -52,10 +52,8 @@ static inline void pci_no_msi(void) { }
 #endif
 
 #if defined(CONFIG_PCI_MSI) && defined(CONFIG_PM)
-int pci_save_msi_state(struct pci_dev *dev);
 void pci_restore_msi_state(struct pci_dev *dev);
 #else
-static inline int pci_save_msi_state(struct pci_dev *dev) { return 0; }
 static inline void pci_restore_msi_state(struct pci_dev *dev) {}
 #endif
 
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 0be5a0b30725..df383645e366 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -93,7 +93,7 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
         if (!dev->irq && dev->pin) {
                 printk(KERN_WARNING 
                 "%s->Dev[%04x:%04x] has invalid IRQ. Check vendor BIOS\n", 
-                __FUNCTION__, dev->device, dev->vendor);
+                __FUNCTION__, dev->vendor, dev->device);
         }
         if (pcie_port_device_register(dev)) {
                 pci_disable_device(dev);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 7f94fc098cd3..65d6f23ead41 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -963,6 +963,13 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_ho
  * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it 
  * becomes necessary to do this tweak in two steps -- I've chosen the Host
  * bridge as trigger.
+ *
+ * Note that we used to unhide the SMBus that way on Toshiba laptops
+ * (Satellite A40 and Tecra M2) but then found that the thermal management
+ * was done by SMM code, which could cause unsynchronized concurrent
+ * accesses to the SMBus registers, with potentially bad effects. Thus you
+ * should be very careful when adding new entries: if SMM is accessing the
+ * Intel SMBus, this is a very good reason to leave it hidden.
  */
 static int asus_hides_smbus;
 
@@ -1040,17 +1047,6 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
                         case 0x099c: /* HP Compaq nx6110 */
                                 asus_hides_smbus = 1;
                         }
-        } else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_TOSHIBA)) {
-                if (dev->device == PCI_DEVICE_ID_INTEL_82855GM_HB)
-                        switch(dev->subsystem_device) {
-                        case 0x0001: /* Toshiba Satellite A40 */
-                                asus_hides_smbus = 1;
-                        }
-                else if (dev->device == PCI_DEVICE_ID_INTEL_82855PM_HB)
-                        switch(dev->subsystem_device) {
-                        case 0x0001: /* Toshiba Tecra M2 */
-                                asus_hides_smbus = 1;
-                        }
        } else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG)) {
                if (dev->device ==  PCI_DEVICE_ID_INTEL_82855PM_HB)
                        switch(dev->subsystem_device) {
diff --git a/drivers/pcmcia/au1000_generic.c b/drivers/pcmcia/au1000_generic.c
index 551bde5d9430..b693367d38cd 100644
--- a/drivers/pcmcia/au1000_generic.c
+++ b/drivers/pcmcia/au1000_generic.c
@@ -372,7 +372,7 @@ int au1x00_pcmcia_socket_probe(struct device *dev, struct pcmcia_low_level *ops,
                 skt->socket.resource_ops = &pccard_static_ops;
                 skt->socket.ops = &au1x00_pcmcia_operations;
                 skt->socket.owner = ops->owner;
-                skt->socket.dev.dev = dev;
+                skt->socket.dev.parent = dev;
 
                 init_timer(&skt->poll_timer);
                 skt->poll_timer.function = au1x00_pcmcia_poll_event;
diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
index 5026b345cb30..57e6ab1004d0 100644
--- a/drivers/pnp/manager.c
+++ b/drivers/pnp/manager.c
@@ -451,7 +451,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
                 return -EINVAL;
 
         if(!pnp_can_configure(dev)) {
-                pnp_info("Device %s does not support resource configuration.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support resource configuration.", dev->dev.bus_id);
                 return -ENODEV;
         }
 
@@ -482,7 +482,7 @@ int pnp_auto_config_dev(struct pnp_dev *dev)
 int pnp_start_dev(struct pnp_dev *dev)
 {
         if (!pnp_can_write(dev)) {
-                pnp_info("Device %s does not support activation.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support activation.", dev->dev.bus_id);
                 return -EINVAL;
         }
 
@@ -506,7 +506,7 @@ int pnp_start_dev(struct pnp_dev *dev)
 int pnp_stop_dev(struct pnp_dev *dev)
 {
         if (!pnp_can_disable(dev)) {
-                pnp_info("Device %s does not support disabling.", dev->dev.bus_id);
+                pnp_dbg("Device %s does not support disabling.", dev->dev.bus_id);
                 return -EINVAL;
         }
         if (dev->protocol->disable(dev)<0) {
diff --git a/drivers/ps3/ps3av.c b/drivers/ps3/ps3av.c
index 1926b4d3e1f4..d21e04ccb021 100644
--- a/drivers/ps3/ps3av.c
+++ b/drivers/ps3/ps3av.c
@@ -24,6 +24,8 @@
 #include <linux/reboot.h>
 #include <linux/kernel.h>
 #include <linux/ioctl.h>
+
+#include <asm/firmware.h>
 #include <asm/lv1call.h>
 #include <asm/ps3av.h>
 #include <asm/ps3.h>
@@ -947,7 +949,12 @@ static struct ps3_vuart_port_driver ps3av_driver = {
 
 static int ps3av_module_init(void)
 {
-        int error = ps3_vuart_port_driver_register(&ps3av_driver);
+        int error;
+
+        if (!firmware_has_feature(FW_FEATURE_PS3_LV1))
+                return -ENODEV;
+
+        error = ps3_vuart_port_driver_register(&ps3av_driver);
         if (error) {
                 printk(KERN_ERR
                        "%s: ps3_vuart_port_driver_register failed %d\n",
diff --git a/drivers/ps3/ps3av_cmd.c b/drivers/ps3/ps3av_cmd.c
index 21c97c80aa2e..bc70e81f8cb0 100644
--- a/drivers/ps3/ps3av_cmd.c
+++ b/drivers/ps3/ps3av_cmd.c
@@ -485,12 +485,12 @@ static u8 ps3av_cnv_mclk(u32 fs)
 
 static const u32 ps3av_ns_table[][5] = {
                                         /*   D1,    D2,    D3,    D4,    D5 */
-        [PS3AV_CMD_AUDIO_FS_44K-BASE]   {  6272,  6272, 17836, 17836,  8918 },
-        [PS3AV_CMD_AUDIO_FS_48K-BASE]   {  6144,  6144, 11648, 11648,  5824 },
-        [PS3AV_CMD_AUDIO_FS_88K-BASE]   { 12544, 12544, 35672, 35672, 17836 },
-        [PS3AV_CMD_AUDIO_FS_96K-BASE]   { 12288, 12288, 23296, 23296, 11648 },
-        [PS3AV_CMD_AUDIO_FS_176K-BASE]  { 25088, 25088, 71344, 71344, 35672 },
-        [PS3AV_CMD_AUDIO_FS_192K-BASE]  { 24576, 24576, 46592, 46592, 23296 }
+        [PS3AV_CMD_AUDIO_FS_44K-BASE] = {  6272,  6272, 17836, 17836,  8918 },
+        [PS3AV_CMD_AUDIO_FS_48K-BASE] = {  6144,  6144, 11648, 11648,  5824 },
+        [PS3AV_CMD_AUDIO_FS_88K-BASE] = { 12544, 12544, 35672, 35672, 17836 },
+        [PS3AV_CMD_AUDIO_FS_96K-BASE] = { 12288, 12288, 23296, 23296, 11648 },
+        [PS3AV_CMD_AUDIO_FS_176K-BASE] =        { 25088, 25088, 71344, 71344, 35672 },
+        [PS3AV_CMD_AUDIO_FS_192K-BASE] =        { 24576, 24576, 46592, 46592, 23296 }
 };
 
 static void ps3av_cnv_ns(u8 *ns, u32 fs, u32 video_vid)
@@ -543,9 +543,10 @@ static void ps3av_cnv_ns(u8 *ns, u32 fs, u32 video_vid)
 
 #undef BASE
 
-static u8 ps3av_cnv_enable(u32 source, u8 *enable)
+static u8 ps3av_cnv_enable(u32 source, const u8 *enable)
 {
-        u8 *p, ret = 0;
+        const u8 *p;
+        u8 ret = 0;
 
         if (source == PS3AV_CMD_AUDIO_SOURCE_SPDIF) {
                 ret = 0x03;
@@ -559,9 +560,10 @@ static u8 ps3av_cnv_enable(u32 source, u8 *enable)
         return ret;
 }
 
-static u8 ps3av_cnv_fifomap(u8 *map)
+static u8 ps3av_cnv_fifomap(const u8 *map)
 {
-        u8 *p, ret = 0;
+        const u8 *p;
+        u8 ret = 0;
 
         p = map;
         ret = p[0] + (p[1] << 2) + (p[2] << 4) + (p[3] << 6);
@@ -615,7 +617,7 @@ static void ps3av_cnv_info(struct ps3av_audio_info_frame *info,
         info->pb5.lsv = mode->audio_downmix_level;
 }
 
-static void ps3av_cnv_chstat(u8 *chstat, u8 *cs_info)
+static void ps3av_cnv_chstat(u8 *chstat, const u8 *cs_info)
 {
         memcpy(chstat, cs_info, 5);
 }
diff --git a/drivers/ps3/sys-manager.c b/drivers/ps3/sys-manager.c
index 0fc30be8b81e..3aa2b0dcc369 100644
--- a/drivers/ps3/sys-manager.c
+++ b/drivers/ps3/sys-manager.c
@@ -22,7 +22,10 @@
 #include <linux/module.h>
 #include <linux/workqueue.h>
 #include <linux/reboot.h>
+
+#include <asm/firmware.h>
 #include <asm/ps3.h>
+
 #include "vuart.h"
 
 MODULE_AUTHOR("Sony Corporation");
@@ -598,6 +601,9 @@ static struct ps3_vuart_port_driver ps3_sys_manager = {
 
 static int __init ps3_sys_manager_init(void)
 {
+        if (!firmware_has_feature(FW_FEATURE_PS3_LV1))
+                return -ENODEV;
+
         return ps3_vuart_port_driver_register(&ps3_sys_manager);
 }
 
diff --git a/drivers/ps3/vuart.c b/drivers/ps3/vuart.c
index 746298107d6f..6c12744eeb9d 100644
--- a/drivers/ps3/vuart.c
+++ b/drivers/ps3/vuart.c
@@ -952,7 +952,7 @@ fail_alloc_irq:
         kfree(dev->priv);
         dev->priv = NULL;
 fail_alloc:
-        vuart_bus_priv.devices[port_number] = 0;
+        vuart_bus_priv.devices[port_number] = NULL;
 fail_match:
         up(&vuart_bus_priv.probe_mutex);
         dev_dbg(&dev->core, "%s:%d failed\n", __func__, __LINE__);
@@ -978,7 +978,7 @@ static int ps3_vuart_remove(struct device *_dev)
                 dev_dbg(&dev->core, "%s:%d: %s no remove method\n", __func__,
                         __LINE__, dev->core.bus_id);
 
-        vuart_bus_priv.devices[dev->priv->port_number] = 0;
+        vuart_bus_priv.devices[dev->priv->port_number] = NULL;
 
         if (--vuart_bus_priv.use_count == 0) {
                 BUG();
@@ -1031,7 +1031,7 @@ int __init ps3_vuart_bus_init(void)
         pr_debug("%s:%d:\n", __func__, __LINE__);
 
         if (!firmware_has_feature(FW_FEATURE_PS3_LV1))
-                return 0;
+                return -ENODEV;
 
         init_MUTEX(&vuart_bus_priv.probe_mutex);
         result = bus_register(&ps3_vuart_bus);
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index ab782bb46ac1..e810e4a44ed4 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -65,7 +65,7 @@ static const u8 DASD_DIAG_CMS1[] = { 0xc3, 0xd4, 0xe2, 0xf1 };/* EBCDIC CMS1 */
  * resulting condition code and DIAG return code. */
 static inline int dia250(void *iob, int cmd)
 {
-        register unsigned long reg0 asm ("0") = (unsigned long) iob;
+        register unsigned long reg2 asm ("2") = (unsigned long) iob;
         typedef union {
                 struct dasd_diag_init_io init_io;
                 struct dasd_diag_rw_io rw_io;
@@ -74,15 +74,15 @@ static inline int dia250(void *iob, int cmd)
 
         rc = 3;
         asm volatile(
-                "       diag    0,%2,0x250\n"
+                "       diag    2,%2,0x250\n"
                 "0:     ipm     %0\n"
                 "       srl     %0,28\n"
-                "       or      %0,1\n"
+                "       or      %0,3\n"
                 "1:\n"
                 EX_TABLE(0b,1b)
                 : "+d" (rc), "=m" (*(addr_type *) iob)
-                : "d" (cmd), "d" (reg0), "m" (*(addr_type *) iob)
-                : "1", "cc");
+                : "d" (cmd), "d" (reg2), "m" (*(addr_type *) iob)
+                : "3", "cc");
         return rc;
 }
 
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index d48e3ca4752c..5aeb68e732b0 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -71,19 +71,31 @@ __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
  * Provide an 'ungroup' attribute so the user can remove group devices no
  * longer needed or accidentially created. Saves memory :)
  */
+static void ccwgroup_ungroup_callback(struct device *dev)
+{
+        struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
+
+        __ccwgroup_remove_symlinks(gdev);
+        device_unregister(dev);
+}
+
 static ssize_t
 ccwgroup_ungroup_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct ccwgroup_device *gdev;
+        int rc;
 
         gdev = to_ccwgroupdev(dev);
 
         if (gdev->state != CCWGROUP_OFFLINE)
                 return -EINVAL;
 
-        __ccwgroup_remove_symlinks(gdev);
-        device_unregister(dev);
-
+        /* Note that we cannot unregister the device from one of its
+         * attribute methods, so we have to use this roundabout approach.
+         */
+        rc = device_schedule_callback(dev, ccwgroup_ungroup_callback);
+        if (rc)
+                count = rc;
         return count;
 }
 
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 6b1caea622ea..25d99bd28089 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -263,7 +263,11 @@ ccw_device_accumulate_irb(struct ccw_device *cdev, struct irb *irb)
                 cdev_irb->scsw.cpa = irb->scsw.cpa;
         /* Accumulate device status, but not the device busy flag. */
         cdev_irb->scsw.dstat &= ~DEV_STAT_BUSY;
-        cdev_irb->scsw.dstat |= irb->scsw.dstat;
+        /* dstat is not always valid. */
+        if (irb->scsw.stctl &
+            (SCSW_STCTL_PRIM_STATUS | SCSW_STCTL_SEC_STATUS
+             | SCSW_STCTL_INTER_STATUS | SCSW_STCTL_ALERT_STATUS))
+                cdev_irb->scsw.dstat |= irb->scsw.dstat;
         /* Accumulate subchannel status. */
         cdev_irb->scsw.cstat |= irb->scsw.cstat;
         /* Copy residual count if it is valid. */
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 5b1e3ff26c0b..05fac0733f3d 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -210,9 +210,11 @@ again:
                 goto again;
         }
         if (rc < 0) {
-                QDIO_DBF_TEXT3(1,trace,"sqberr");
-                sprintf(dbf_text,"%2x,%2x,%d,%d",tmp_cnt,*cnt,ccq,q_no);
-                QDIO_DBF_TEXT3(1,trace,dbf_text);
+                QDIO_DBF_TEXT3(1,trace,"sqberr");
+                sprintf(dbf_text,"%2x,%2x",tmp_cnt,*cnt);
+                QDIO_DBF_TEXT3(1,trace,dbf_text);
+                sprintf(dbf_text,"%d,%d",ccq,q_no);
+                QDIO_DBF_TEXT3(1,trace,dbf_text);
                 q->handler(q->cdev,QDIO_STATUS_ACTIVATE_CHECK_CONDITION|
                                 QDIO_STATUS_LOOK_FOR_ERROR,
                                 0, 0, 0, -1, -1, q->int_parm);
@@ -1250,7 +1252,6 @@ qdio_is_inbound_q_done(struct qdio_q *q)
         if (!no_used) {
                 QDIO_DBF_TEXT4(0,trace,"inqisdnA");
                 QDIO_DBF_HEX4(0,trace,&q,sizeof(void*));
-                QDIO_DBF_TEXT4(0,trace,dbf_text);
                 return 1;
         }
         if (irq->is_qebsm) {
@@ -3371,10 +3372,15 @@ qdio_do_qdio_fill_input(struct qdio_q *q, unsigned int qidx,
                         unsigned int count, struct qdio_buffer *buffers)
 {
         struct qdio_irq *irq = (struct qdio_irq *) q->irq_ptr;
+        int tmp = 0;
+
         qidx &= (QDIO_MAX_BUFFERS_PER_Q - 1);
         if (irq->is_qebsm) {
-                while (count)
-                        set_slsb(q, &qidx, SLSB_CU_INPUT_EMPTY, &count);
+                while (count) {
+                        tmp = set_slsb(q, &qidx, SLSB_CU_INPUT_EMPTY, &count);
+                        if (!tmp)
+                                return;
+                }
                 return;
         }
         for (;;) {
@@ -3390,11 +3396,15 @@ qdio_do_qdio_fill_output(struct qdio_q *q, unsigned int qidx,
                          unsigned int count, struct qdio_buffer *buffers)
 {
         struct qdio_irq *irq = (struct qdio_irq *) q->irq_ptr;
+        int tmp = 0;
 
         qidx &= (QDIO_MAX_BUFFERS_PER_Q - 1);
         if (irq->is_qebsm) {
-                while (count)
-                        set_slsb(q, &qidx, SLSB_CU_OUTPUT_PRIMED, &count);
+                while (count) {
+                        tmp = set_slsb(q, &qidx, SLSB_CU_OUTPUT_PRIMED, &count);
+                        if (!tmp)
+                                return;
+                }
                 return;
         }
 
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index c7d1355237b6..bf37cdf43fae 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -65,6 +65,8 @@ module_param_named(poll_thread, ap_thread_flag, int, 0000);
 MODULE_PARM_DESC(poll_thread, "Turn on/off poll thread, default is 1 (on).");
 
 static struct device *ap_root_device = NULL;
+static DEFINE_SPINLOCK(ap_device_lock);
+static LIST_HEAD(ap_device_list);
 
 /**
  * Workqueue & timer for bus rescan.
@@ -457,6 +459,9 @@ static int ap_device_probe(struct device *dev)
         int rc;
 
         ap_dev->drv = ap_drv;
+        spin_lock_bh(&ap_device_lock);
+        list_add(&ap_dev->list, &ap_device_list);
+        spin_unlock_bh(&ap_device_lock);
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
         return rc;
 }
@@ -497,6 +502,12 @@ static int ap_device_remove(struct device *dev)
         ap_flush_queue(ap_dev);
         if (ap_drv->remove)
                 ap_drv->remove(ap_dev);
+        spin_lock_bh(&ap_device_lock);
+        list_del_init(&ap_dev->list);
+        spin_unlock_bh(&ap_device_lock);
+        spin_lock_bh(&ap_dev->lock);
+        atomic_sub(ap_dev->queue_count, &ap_poll_requests);
+        spin_unlock_bh(&ap_dev->lock);
         return 0;
 }
 
@@ -749,10 +760,16 @@ static void ap_scan_bus(struct work_struct *unused)
                                       (void *)(unsigned long)qid,
                                       __ap_scan_bus);
                 rc = ap_query_queue(qid, &queue_depth, &device_type);
-                if (dev && rc) {
-                        put_device(dev);
-                        device_unregister(dev);
-                        continue;
+                if (dev) {
+                        ap_dev = to_ap_dev(dev);
+                        spin_lock_bh(&ap_dev->lock);
+                        if (rc || ap_dev->unregistered) {
+                                spin_unlock_bh(&ap_dev->lock);
+                                put_device(dev);
+                                device_unregister(dev);
+                                continue;
+                        } else
+                                spin_unlock_bh(&ap_dev->lock);
                 }
                 if (dev) {
                         put_device(dev);
@@ -772,6 +789,7 @@ static void ap_scan_bus(struct work_struct *unused)
                 spin_lock_init(&ap_dev->lock);
                 INIT_LIST_HEAD(&ap_dev->pendingq);
                 INIT_LIST_HEAD(&ap_dev->requestq);
+                INIT_LIST_HEAD(&ap_dev->list);
                 if (device_type == 0)
                         ap_probe_device_type(ap_dev);
                 else
@@ -852,6 +870,7 @@ static int ap_poll_read(struct ap_device *ap_dev, unsigned long *flags)
         case AP_RESPONSE_NO_PENDING_REPLY:
                 if (status.queue_empty) {
                         /* The card shouldn't forget requests but who knows. */
+                        atomic_sub(ap_dev->queue_count, &ap_poll_requests);
                         ap_dev->queue_count = 0;
                         list_splice_init(&ap_dev->pendingq, &ap_dev->requestq);
                         ap_dev->requestq_count += ap_dev->pendingq_count;
@@ -985,7 +1004,7 @@ void ap_queue_message(struct ap_device *ap_dev, struct ap_message *ap_msg)
                         ap_dev->unregistered = 1;
         } else {
                 ap_dev->drv->receive(ap_dev, ap_msg, ERR_PTR(-ENODEV));
-                rc = 0;
+                rc = -ENODEV;
         }
         spin_unlock_bh(&ap_dev->lock);
         if (rc == -ENODEV)
@@ -1033,31 +1052,29 @@ static void ap_poll_timeout(unsigned long unused)
  * polling until bit 2^0 of the control flags is not set. If bit 2^1
  * of the control flags has been set arm the poll timer.
  */
-static int __ap_poll_all(struct device *dev, void *data)
+static int __ap_poll_all(struct ap_device *ap_dev, unsigned long *flags)
 {
-        struct ap_device *ap_dev = to_ap_dev(dev);
-        int rc;
-
         spin_lock(&ap_dev->lock);
         if (!ap_dev->unregistered) {
-                rc = ap_poll_queue(to_ap_dev(dev), (unsigned long *) data);
-                if (rc)
+                if (ap_poll_queue(ap_dev, flags))
                         ap_dev->unregistered = 1;
-        } else
-                rc = 0;
+        }
         spin_unlock(&ap_dev->lock);
-        if (rc)
-                device_unregister(&ap_dev->device);
         return 0;
 }
 
 static void ap_poll_all(unsigned long dummy)
 {
         unsigned long flags;
+        struct ap_device *ap_dev;
 
         do {
                 flags = 0;
-                bus_for_each_dev(&ap_bus_type, NULL, &flags, __ap_poll_all);
+                spin_lock(&ap_device_lock);
+                list_for_each_entry(ap_dev, &ap_device_list, list) {
+                        __ap_poll_all(ap_dev, &flags);
+                }
+                spin_unlock(&ap_device_lock);
         } while (flags & 1);
         if (flags & 2)
                 ap_schedule_poll_timer();
@@ -1075,6 +1092,7 @@ static int ap_poll_thread(void *data)
         DECLARE_WAITQUEUE(wait, current);
         unsigned long flags;
         int requests;
+        struct ap_device *ap_dev;
 
         set_user_nice(current, 19);
         while (1) {
@@ -1092,10 +1110,12 @@ static int ap_poll_thread(void *data)
                 set_current_state(TASK_RUNNING);
                 remove_wait_queue(&ap_poll_wait, &wait);
 
-                local_bh_disable();
                 flags = 0;
-                bus_for_each_dev(&ap_bus_type, NULL, &flags, __ap_poll_all);
-                local_bh_enable();
+                spin_lock_bh(&ap_device_lock);
+                list_for_each_entry(ap_dev, &ap_device_list, list) {
+                        __ap_poll_all(ap_dev, &flags);
+                }
+                spin_unlock_bh(&ap_device_lock);
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&ap_poll_wait, &wait);
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 83b69c01cd6e..008559ea742b 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -106,6 +106,7 @@ struct ap_device {
         struct device device;
         struct ap_driver *drv;          /* Pointer to AP device driver. */
         spinlock_t lock;                /* Per device lock. */
+        struct list_head list;          /* private list of all AP devices. */
 
         ap_qid_t qid;                   /* AP queue id. */
         int queue_depth;                /* AP queue depth.*/
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 99761391f340..e3625a47a596 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -298,14 +298,14 @@ static long zcrypt_rsa_modexpo(struct ica_rsa_modexpo *mex)
                 get_device(&zdev->ap_dev->device);
                 zdev->request_count++;
                 __zcrypt_decrease_preference(zdev);
-                spin_unlock_bh(&zcrypt_device_lock);
                 if (try_module_get(zdev->ap_dev->drv->driver.owner)) {
+                        spin_unlock_bh(&zcrypt_device_lock);
                         rc = zdev->ops->rsa_modexpo(zdev, mex);
+                        spin_lock_bh(&zcrypt_device_lock);
                         module_put(zdev->ap_dev->drv->driver.owner);
                 }
                 else
                         rc = -EAGAIN;
-                spin_lock_bh(&zcrypt_device_lock);
                 zdev->request_count--;
                 __zcrypt_increase_preference(zdev);
                 put_device(&zdev->ap_dev->device);
@@ -373,14 +373,14 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
                 get_device(&zdev->ap_dev->device);
                 zdev->request_count++;
                 __zcrypt_decrease_preference(zdev);
-                spin_unlock_bh(&zcrypt_device_lock);
                 if (try_module_get(zdev->ap_dev->drv->driver.owner)) {
+                        spin_unlock_bh(&zcrypt_device_lock);
                         rc = zdev->ops->rsa_modexpo_crt(zdev, crt);
+                        spin_lock_bh(&zcrypt_device_lock);
                         module_put(zdev->ap_dev->drv->driver.owner);
                 }
                 else
                         rc = -EAGAIN;
-                spin_lock_bh(&zcrypt_device_lock);
                 zdev->request_count--;
                 __zcrypt_increase_preference(zdev);
                 put_device(&zdev->ap_dev->device);
@@ -408,14 +408,14 @@ static long zcrypt_send_cprb(struct ica_xcRB *xcRB)
                 get_device(&zdev->ap_dev->device);
                 zdev->request_count++;
                 __zcrypt_decrease_preference(zdev);
-                spin_unlock_bh(&zcrypt_device_lock);
                 if (try_module_get(zdev->ap_dev->drv->driver.owner)) {
+                        spin_unlock_bh(&zcrypt_device_lock);
                         rc = zdev->ops->send_cprb(zdev, xcRB);
+                        spin_lock_bh(&zcrypt_device_lock);
                         module_put(zdev->ap_dev->drv->driver.owner);
                 }
                 else
                         rc = -EAGAIN;
-                spin_lock_bh(&zcrypt_device_lock);
                 zdev->request_count--;
                 __zcrypt_increase_preference(zdev);
                 put_device(&zdev->ap_dev->device);
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index e95c281f1e36..84b108d7c7fd 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -873,7 +873,7 @@ qeth_realloc_headroom(struct qeth_card *card, struct sk_buff *skb, int size)
 }
 
 static inline struct sk_buff *
-qeth_pskb_unshare(struct sk_buff *skb, int pri)
+qeth_pskb_unshare(struct sk_buff *skb, gfp_t pri)
 {
         struct sk_buff *nskb;
         if (!skb_cloned(skb))
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index c275dcac3f18..939de0de18bc 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -452,10 +452,22 @@ store_rescan_field (struct device *dev, struct device_attribute *attr, const cha
 }
 static DEVICE_ATTR(rescan, S_IWUSR, NULL, store_rescan_field);
 
+static void sdev_store_delete_callback(struct device *dev)
+{
+        scsi_remove_device(to_scsi_device(dev));
+}
+
 static ssize_t sdev_store_delete(struct device *dev, struct device_attribute *attr, const char *buf,
                                  size_t count)
 {
-        scsi_remove_device(to_scsi_device(dev));
+        int rc;
+
+        /* An attribute cannot be unregistered by one of its own methods,
+         * so we have to use this roundabout approach.
+         */
+        rc = device_schedule_callback(dev, sdev_store_delete_callback);
+        if (rc)
+                count = rc;
         return count;
 };
 static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index cde5db44abf6..301c8c0be9d7 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -340,6 +340,9 @@ static const struct pnp_device_id pnp_dev_table[] = {
         {       "FUJ02B8",              0 },
         {       "FUJ02B9",              0 },
         {       "FUJ02BC",              0 },
+        /* Fujitsu Wacom Tablet PC devices */
+        {       "FUJ02E5",              0       },
+        {       "FUJ02E6",              0       },
         /* Rockwell's (PORALiNK) 33600 INT PNP */
         {       "WCI0003",              0       },
         /* Unkown PnP modems */
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index c53b69610a51..46c40bbc4bc6 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -17,6 +17,9 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  */
+#if defined(CONFIG_SERIAL_SH_SCI_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
+#define SUPPORT_SYSRQ
+#endif
 
 #undef DEBUG
 
@@ -49,11 +52,6 @@
 #endif
 
 #include <asm/sci.h>
-
-#if defined(CONFIG_SERIAL_SH_SCI_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
-#define SUPPORT_SYSRQ
-#endif
-
 #include "sh-sci.h"
 
 struct sci_port {
@@ -645,6 +643,9 @@ static inline int sci_handle_breaks(struct uart_port *port)
         struct tty_struct *tty = port->info->tty;
         struct sci_port *s = &sci_ports[port->line];
 
+        if (uart_handle_break(port))
+                return 0;
+
         if (!s->break_flag && status & SCxSR_BRK(port)) {
 #if defined(CONFIG_CPU_SH3)
                 /* Debounce break */
diff --git a/drivers/spi/at25.c b/drivers/spi/at25.c
index 48e4f48e779f..8efa07e8b8c2 100644
--- a/drivers/spi/at25.c
+++ b/drivers/spi/at25.c
@@ -291,7 +291,7 @@ static int at25_probe(struct spi_device *spi)
          */
         sr = spi_w8r8(spi, AT25_RDSR);
         if (sr < 0 || sr & AT25_SR_nRDY) {
-                dev_dbg(&at25->spi->dev, "rdsr --> %d (%02x)\n", sr, sr);
+                dev_dbg(&spi->dev, "rdsr --> %d (%02x)\n", sr, sr);
                 err = -ENXIO;
                 goto fail;
         }
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 6fa260d1a9be..66e7bc985797 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -425,7 +425,7 @@ static int atmel_spi_setup(struct spi_device *spi)
                 if (ret)
                         return ret;
                 spi->controller_state = (void *)npcs_pin;
-                gpio_direction_output(npcs_pin);
+                gpio_direction_output(npcs_pin, !(spi->mode & SPI_CS_HIGH));
         }
 
         dev_dbg(&spi->dev,
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 2328128728be..6657331eed93 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -189,8 +189,8 @@ static DECLARE_MUTEX(board_lock);
  * this is exported so that for example a USB or parport based adapter
  * driver could add devices (which it would learn about out-of-band).
  */
-struct spi_device *__init_or_module
-spi_new_device(struct spi_master *master, struct spi_board_info *chip)
+struct spi_device *spi_new_device(struct spi_master *master,
+                                  struct spi_board_info *chip)
 {
         struct spi_device       *proxy;
         struct device           *dev = master->cdev.dev;
@@ -352,8 +352,7 @@ static struct class spi_master_class = {
  * the master's methods before calling spi_register_master(); and (after errors
  * adding the device) calling spi_master_put() to prevent a memory leak.
  */
-struct spi_master * __init_or_module
-spi_alloc_master(struct device *dev, unsigned size)
+struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
 {
         struct spi_master       *master;
 
@@ -392,8 +391,7 @@ EXPORT_SYMBOL_GPL(spi_alloc_master);
  * After a successful return, the caller is responsible for calling
  * spi_unregister_master().
  */
-int __init_or_module
-spi_register_master(struct spi_master *master)
+int spi_register_master(struct spi_master *master)
 {
         static atomic_t         dyn_bus_id = ATOMIC_INIT((1<<16) - 1);
         struct device           *dev = master->cdev.dev;
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index 24a330d82395..88425e1af4d3 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -302,10 +302,6 @@ static void bitbang_work(struct work_struct *work)
                 setup_transfer = NULL;
 
                 list_for_each_entry (t, &m->transfers, transfer_list) {
-                        if (bitbang->shutdown) {
-                                status = -ESHUTDOWN;
-                                break;
-                        }
 
                         /* override or restore speed and wordsize */
                         if (t->speed_hz || t->bits_per_word) {
@@ -410,8 +406,6 @@ int spi_bitbang_transfer(struct spi_device *spi, struct spi_message *m)
         m->status = -EINPROGRESS;
 
         bitbang = spi_master_get_devdata(spi->master);
-        if (bitbang->shutdown)
-                return -ESHUTDOWN;
 
         spin_lock_irqsave(&bitbang->lock, flags);
         if (!spi->max_speed_hz)
@@ -507,28 +501,12 @@ EXPORT_SYMBOL_GPL(spi_bitbang_start);
  */
 int spi_bitbang_stop(struct spi_bitbang *bitbang)
 {
-        unsigned        limit = 500;
-
-        spin_lock_irq(&bitbang->lock);
-        bitbang->shutdown = 0;
-        while (!list_empty(&bitbang->queue) && limit--) {
-                spin_unlock_irq(&bitbang->lock);
+        spi_unregister_master(bitbang->master);
 
-                dev_dbg(bitbang->master->cdev.dev, "wait for queue\n");
-                msleep(10);
-
-                spin_lock_irq(&bitbang->lock);
-        }
-        spin_unlock_irq(&bitbang->lock);
-        if (!list_empty(&bitbang->queue)) {
-                dev_err(bitbang->master->cdev.dev, "queue didn't empty\n");
-                return -EBUSY;
-        }
+        WARN_ON(!list_empty(&bitbang->queue));
 
         destroy_workqueue(bitbang->workqueue);
 
-        spi_unregister_master(bitbang->master);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_stop);
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 651379c51ae6..220abce63e4a 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -41,7 +41,7 @@ struct s3c24xx_spi {
         int                      len;
         int                      count;
 
-        int                     (*set_cs)(struct s3c2410_spi_info *spi,
+        void                    (*set_cs)(struct s3c2410_spi_info *spi,
                                           int cs, int pol);
 
         /* data buffers */
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 63e50a1f1396..6584cf00f7f3 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -202,6 +202,7 @@ struct quirk_printer_struct {
 
 #define USBLP_QUIRK_BIDIR       0x1     /* reports bidir but requires unidirectional mode (no INs/reads) */
 #define USBLP_QUIRK_USB_INIT    0x2     /* needs vendor USB init string */
+#define USBLP_QUIRK_BAD_CLASS   0x4     /* descriptor uses vendor-specific Class or SubClass */
 
 static const struct quirk_printer_struct quirk_printers[] = {
         { 0x03f0, 0x0004, USBLP_QUIRK_BIDIR }, /* HP DeskJet 895C */
@@ -218,6 +219,7 @@ static const struct quirk_printer_struct quirk_printers[] = {
         { 0x0409, 0xf0be, USBLP_QUIRK_BIDIR }, /* NEC Picty920 (HP OEM) */
         { 0x0409, 0xf1be, USBLP_QUIRK_BIDIR }, /* NEC Picty800 (HP OEM) */
         { 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
+        { 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
         { 0, 0 }
 };
 
@@ -1048,7 +1050,8 @@ static int usblp_select_alts(struct usblp *usblp)
                 ifd = &if_alt->altsetting[i];
 
                 if (ifd->desc.bInterfaceClass != 7 || ifd->desc.bInterfaceSubClass != 1)
-                        continue;
+                        if (!(usblp->quirks & USBLP_QUIRK_BAD_CLASS))
+                                continue;
 
                 if (ifd->desc.bInterfaceProtocol < USBLP_FIRST_PROTOCOL ||
                     ifd->desc.bInterfaceProtocol > USBLP_LAST_PROTOCOL)
@@ -1232,6 +1235,7 @@ static struct usb_device_id usblp_ids [] = {
         { USB_INTERFACE_INFO(7, 1, 1) },
         { USB_INTERFACE_INFO(7, 1, 2) },
         { USB_INTERFACE_INFO(7, 1, 3) },
+        { USB_DEVICE(0x04b8, 0x0202) }, /* Seiko Epson Receipt Printer M129C */
         { }                                             /* Terminating entry */
 };
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0e5c646cb4f6..f08ec85a6d64 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -30,7 +30,8 @@
 static const struct usb_device_id usb_quirk_list[] = {
         /* HP 5300/5370C scanner */
         { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
-
+        /* Seiko Epson Corp - Perfection 1670 */
+        { USB_DEVICE(0x04b8, 0x011f), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
         /* Elsa MicroLink 56k (V.250) */
         { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
 
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 8f9a2b615422..b394e63894d2 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -296,6 +296,15 @@ omap_free_request(struct usb_ep *ep, struct usb_request *_req)
 
 /*-------------------------------------------------------------------------*/
 
+/*
+ * dma-coherent memory allocation (for dma-capable endpoints)
+ *
+ * NOTE: the dma_*_coherent() API calls suck.  Most implementations are
+ * (a) page-oriented, so small buffers lose big; and (b) asymmetric with
+ * respect to calls with irqs disabled:  alloc is safe, free is not.
+ * We currently work around (b), but not (a).
+ */
+
 static void *
 omap_alloc_buffer(
         struct usb_ep   *_ep,
@@ -307,6 +316,9 @@ omap_alloc_buffer(
         void            *retval;
         struct omap_ep  *ep;
 
+        if (!_ep)
+                return NULL;
+
         ep = container_of(_ep, struct omap_ep, ep);
         if (use_dma && ep->has_dma) {
                 static int      warned;
@@ -326,6 +338,35 @@ omap_alloc_buffer(
         return retval;
 }
 
+static DEFINE_SPINLOCK(buflock);
+static LIST_HEAD(buffers);
+
+struct free_record {
+        struct list_head        list;
+        struct device           *dev;
+        unsigned                bytes;
+        dma_addr_t              dma;
+};
+
+static void do_free(unsigned long ignored)
+{
+        spin_lock_irq(&buflock);
+        while (!list_empty(&buffers)) {
+                struct free_record      *buf;
+
+                buf = list_entry(buffers.next, struct free_record, list);
+                list_del(&buf->list);
+                spin_unlock_irq(&buflock);
+
+                dma_free_coherent(buf->dev, buf->bytes, buf, buf->dma);
+
+                spin_lock_irq(&buflock);
+        }
+        spin_unlock_irq(&buflock);
+}
+
+static DECLARE_TASKLET(deferred_free, do_free, 0);
+
 static void omap_free_buffer(
         struct usb_ep   *_ep,
         void            *buf,
@@ -333,13 +374,29 @@ static void omap_free_buffer(
         unsigned        bytes
 )
 {
-        struct omap_ep  *ep;
+        if (!_ep) {
+                WARN_ON(1);
+                return;
+        }
 
-        ep = container_of(_ep, struct omap_ep, ep);
-        if (use_dma && _ep && ep->has_dma)
-                dma_free_coherent(ep->udc->gadget.dev.parent, bytes, buf, dma);
-        else
-                kfree (buf);
+        /* free memory into the right allocator */
+        if (dma != DMA_ADDR_INVALID) {
+                struct omap_ep          *ep;
+                struct free_record      *rec = buf;
+                unsigned long           flags;
+
+                ep = container_of(_ep, struct omap_ep, ep);
+
+                rec->dev = ep->udc->gadget.dev.parent;
+                rec->bytes = bytes;
+                rec->dma = dma;
+
+                spin_lock_irqsave(&buflock, flags);
+                list_add_tail(&rec->list, &buffers);
+                tasklet_schedule(&deferred_free);
+                spin_unlock_irqrestore(&buflock, flags);
+        } else
+                kfree(buf);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1691,12 +1748,38 @@ ep0out_status_stage:
                         udc->ep0_pending = 0;
                         break;
                 case USB_REQ_GET_STATUS:
+                        /* USB_ENDPOINT_HALT status? */
+                        if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
+                                goto intf_status;
+
+                        /* ep0 never stalls */
+                        if (!(w_index & 0xf))
+                                goto zero_status;
+
+                        /* only active endpoints count */
+                        ep = &udc->ep[w_index & 0xf];
+                        if (w_index & USB_DIR_IN)
+                                ep += 16;
+                        if (!ep->desc)
+                                goto do_stall;
+
+                        /* iso never stalls */
+                        if (ep->bmAttributes == USB_ENDPOINT_XFER_ISOC)
+                                goto zero_status;
+
+                        /* FIXME don't assume non-halted endpoints!! */
+                        ERR("%s status, can't report\n", ep->ep.name);
+                        goto do_stall;
+
+intf_status:
                         /* return interface status.  if we were pedantic,
                          * we'd detect non-existent interfaces, and stall.
                          */
                         if (u.r.bRequestType
                                         != (USB_DIR_IN|USB_RECIP_INTERFACE))
                                 goto delegate;
+
+zero_status:
                         /* return two zero bytes */
                         UDC_EP_NUM_REG = UDC_EP_SEL|UDC_EP_DIR;
                         UDC_DATA_REG = 0;
@@ -2068,7 +2151,7 @@ static irqreturn_t omap_udc_iso_irq(int irq, void *_dev)
 
 /*-------------------------------------------------------------------------*/
 
-static inline int machine_needs_vbus_session(void)
+static inline int machine_without_vbus_sense(void)
 {
         return (machine_is_omap_innovator()
                 || machine_is_omap_osk()
@@ -2156,7 +2239,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         /* boards that don't have VBUS sensing can't autogate 48MHz;
          * can't enter deep sleep while a gadget driver is active.
          */
-        if (machine_needs_vbus_session())
+        if (machine_without_vbus_sense())
                 omap_vbus_session(&udc->gadget, 1);
 
 done:
@@ -2179,7 +2262,7 @@ int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
         if (udc->dc_clk != NULL)
                 omap_udc_enable_clock(1);
 
-        if (machine_needs_vbus_session())
+        if (machine_without_vbus_sense())
                 omap_vbus_session(&udc->gadget, 0);
 
         if (udc->transceiver)
@@ -2822,7 +2905,7 @@ static int __init omap_udc_probe(struct platform_device *pdev)
                 hmc = HMC_1510;
                 type = "(unknown)";
 
-                if (machine_is_omap_innovator() || machine_is_sx1()) {
+                if (machine_without_vbus_sense()) {
                         /* just set up software VBUS detect, and then
                          * later rig it so we always report VBUS.
                          * FIXME without really sensing VBUS, we can't
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index 8d24d3dc0a61..1497371583b9 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -145,7 +145,8 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
         return out - buf;
 }
 
-static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
+static int uhci_show_qh(struct uhci_hcd *uhci,
+                struct uhci_qh *qh, char *buf, int len, int space)
 {
         char *out = buf;
         int i, nurbs;
@@ -190,6 +191,9 @@ static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
 
         if (list_empty(&qh->queue)) {
                 out += sprintf(out, "%*s  queue is empty\n", space, "");
+                if (qh == uhci->skel_async_qh)
+                        out += uhci_show_td(uhci->term_td, out,
+                                        len - (out - buf), 0);
         } else {
                 struct urb_priv *urbp = list_entry(qh->queue.next,
                                 struct urb_priv, node);
@@ -343,6 +347,7 @@ static int uhci_sprint_schedule(struct uhci_hcd *uhci, char *buf, int len)
         struct list_head *tmp, *head;
         int nframes, nerrs;
         __le32 link;
+        __le32 fsbr_link;
 
         static const char * const qh_names[] = {
                 "unlink", "iso", "int128", "int64", "int32", "int16",
@@ -424,21 +429,22 @@ check_link:
 
         out += sprintf(out, "Skeleton QHs\n");
 
+        fsbr_link = 0;
         for (i = 0; i < UHCI_NUM_SKELQH; ++i) {
                 int cnt = 0;
-                __le32 fsbr_link = 0;
 
                 qh = uhci->skelqh[i];
                 out += sprintf(out, "- skel_%s_qh\n", qh_names[i]); \
-                out += uhci_show_qh(qh, out, len - (out - buf), 4);
+                out += uhci_show_qh(uhci, qh, out, len - (out - buf), 4);
 
                 /* Last QH is the Terminating QH, it's different */
                 if (i == SKEL_TERM) {
                         if (qh_element(qh) != LINK_TO_TD(uhci->term_td))
                                 out += sprintf(out, "    skel_term_qh element is not set to term_td!\n");
-                        if (link == LINK_TO_QH(uhci->skel_term_qh))
-                                goto check_qh_link;
-                        continue;
+                        link = fsbr_link;
+                        if (!link)
+                                link = LINK_TO_QH(uhci->skel_term_qh);
+                        goto check_qh_link;
                 }
 
                 head = &qh->node;
@@ -448,7 +454,7 @@ check_link:
                         qh = list_entry(tmp, struct uhci_qh, node);
                         tmp = tmp->next;
                         if (++cnt <= 10)
-                                out += uhci_show_qh(qh, out,
+                                out += uhci_show_qh(uhci, qh, out,
                                                 len - (out - buf), 4);
                         if (!fsbr_link && qh->skel >= SKEL_FSBR)
                                 fsbr_link = LINK_TO_QH(qh);
@@ -463,8 +469,6 @@ check_link:
                         link = LINK_TO_QH(uhci->skel_async_qh);
                 else if (!uhci->fsbr_is_on)
                         ;
-                else if (fsbr_link)
-                        link = fsbr_link;
                 else
                         link = LINK_TO_QH(uhci->skel_term_qh);
 check_qh_link:
@@ -573,8 +577,8 @@ static const struct file_operations uhci_debug_operations = {
 static inline void lprintk(char *buf)
 {}
 
-static inline int uhci_show_qh(struct uhci_qh *qh, char *buf,
-                int len, int space)
+static inline int uhci_show_qh(struct uhci_hcd *uhci,
+                struct uhci_qh *qh, char *buf, int len, int space)
 {
         return 0;
 }
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 44da4334f1d6..d22da26ff167 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -632,7 +632,8 @@ static int uhci_start(struct usb_hcd *hcd)
          */
         for (i = SKEL_ISO + 1; i < SKEL_ASYNC; ++i)
                 uhci->skelqh[i]->link = LINK_TO_QH(uhci->skel_async_qh);
-        uhci->skel_async_qh->link = uhci->skel_term_qh->link = UHCI_PTR_TERM;
+        uhci->skel_async_qh->link = UHCI_PTR_TERM;
+        uhci->skel_term_qh->link = LINK_TO_QH(uhci->skel_term_qh);
 
         /* This dummy TD is to work around a bug in Intel PIIX controllers */
         uhci_fill_td(uhci->term_td, 0, uhci_explen(0) |
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index f4ebdb3e488f..19a0cc02b9a2 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -45,43 +45,27 @@ static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
  */
 static void uhci_fsbr_on(struct uhci_hcd *uhci)
 {
-        struct uhci_qh *fsbr_qh, *lqh, *tqh;
+        struct uhci_qh *lqh;
 
+        /* The terminating skeleton QH always points back to the first
+         * FSBR QH.  Make the last async QH point to the terminating
+         * skeleton QH. */
         uhci->fsbr_is_on = 1;
         lqh = list_entry(uhci->skel_async_qh->node.prev,
                         struct uhci_qh, node);
-
-        /* Find the first FSBR QH.  Linear search through the list is
-         * acceptable because normally FSBR gets turned on as soon as
-         * one QH needs it. */
-        fsbr_qh = NULL;
-        list_for_each_entry_reverse(tqh, &uhci->skel_async_qh->node, node) {
-                if (tqh->skel < SKEL_FSBR)
-                        break;
-                fsbr_qh = tqh;
-        }
-
-        /* No FSBR QH means we must insert the terminating skeleton QH */
-        if (!fsbr_qh) {
-                uhci->skel_term_qh->link = LINK_TO_QH(uhci->skel_term_qh);
-                wmb();
-                lqh->link = uhci->skel_term_qh->link;
-
-        /* Otherwise loop the last QH to the first FSBR QH */
-        } else
-                lqh->link = LINK_TO_QH(fsbr_qh);
+        lqh->link = LINK_TO_QH(uhci->skel_term_qh);
 }
 
 static void uhci_fsbr_off(struct uhci_hcd *uhci)
 {
         struct uhci_qh *lqh;
 
+        /* Remove the link from the last async QH to the terminating
+         * skeleton QH. */
         uhci->fsbr_is_on = 0;
         lqh = list_entry(uhci->skel_async_qh->node.prev,
                         struct uhci_qh, node);
-
-        /* End the async list normally and unlink the terminating QH */
-        lqh->link = uhci->skel_term_qh->link = UHCI_PTR_TERM;
+        lqh->link = UHCI_PTR_TERM;
 }
 
 static void uhci_add_fsbr(struct uhci_hcd *uhci, struct urb *urb)
@@ -464,9 +448,8 @@ static void link_interrupt(struct uhci_hcd *uhci, struct uhci_qh *qh)
  */
 static void link_async(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct uhci_qh *pqh, *lqh;
+        struct uhci_qh *pqh;
         __le32 link_to_new_qh;
-        __le32 *extra_link = &link_to_new_qh;
 
         /* Find the predecessor QH for our new one and insert it in the list.
          * The list of QHs is expected to be short, so linear search won't
@@ -476,31 +459,17 @@ static void link_async(struct uhci_hcd *uhci, struct uhci_qh *qh)
                         break;
         }
         list_add(&qh->node, &pqh->node);
-        qh->link = pqh->link;
-
-        link_to_new_qh = LINK_TO_QH(qh);
-
-        /* If this is now the first FSBR QH, take special action */
-        if (uhci->fsbr_is_on && pqh->skel < SKEL_FSBR &&
-                        qh->skel >= SKEL_FSBR) {
-                lqh = list_entry(uhci->skel_async_qh->node.prev,
-                                struct uhci_qh, node);
-
-                /* If the new QH is also the last one, we must unlink
-                 * the terminating skeleton QH and make the new QH point
-                 * back to itself. */
-                if (qh == lqh) {
-                        qh->link = link_to_new_qh;
-                        extra_link = &uhci->skel_term_qh->link;
-
-                /* Otherwise the last QH must point to the new QH */
-                } else
-                        extra_link = &lqh->link;
-        }
 
         /* Link it into the schedule */
+        qh->link = pqh->link;
         wmb();
-        *extra_link = pqh->link = link_to_new_qh;
+        link_to_new_qh = LINK_TO_QH(qh);
+        pqh->link = link_to_new_qh;
+
+        /* If this is now the first FSBR QH, link the terminating skeleton
+         * QH to it. */
+        if (pqh->skel < SKEL_FSBR && qh->skel >= SKEL_FSBR)
+                uhci->skel_term_qh->link = link_to_new_qh;
 }
 
 /*
@@ -561,31 +530,16 @@ static void unlink_interrupt(struct uhci_hcd *uhci, struct uhci_qh *qh)
  */
 static void unlink_async(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct uhci_qh *pqh, *lqh;
+        struct uhci_qh *pqh;
         __le32 link_to_next_qh = qh->link;
 
         pqh = list_entry(qh->node.prev, struct uhci_qh, node);
-
-        /* If this is the first FSBQ QH, take special action */
-        if (uhci->fsbr_is_on && pqh->skel < SKEL_FSBR &&
-                        qh->skel >= SKEL_FSBR) {
-                lqh = list_entry(uhci->skel_async_qh->node.prev,
-                                struct uhci_qh, node);
-
-                /* If this QH is also the last one, we must link in
-                 * the terminating skeleton QH. */
-                if (qh == lqh) {
-                        link_to_next_qh = LINK_TO_QH(uhci->skel_term_qh);
-                        uhci->skel_term_qh->link = link_to_next_qh;
-                        wmb();
-                        qh->link = link_to_next_qh;
-
-                /* Otherwise the last QH must point to the new first FSBR QH */
-                } else
-                        lqh->link = link_to_next_qh;
-        }
-
         pqh->link = link_to_next_qh;
+
+        /* If this was the old first FSBR QH, link the terminating skeleton
+         * QH to the next (new first FSBR) QH. */
+        if (pqh->skel < SKEL_FSBR && qh->skel >= SKEL_FSBR)
+                uhci->skel_term_qh->link = link_to_next_qh;
         mb();
 }
 
@@ -1217,7 +1171,7 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
 
                                 if (debug > 1 && errbuf) {
                                         /* Print the chain for debugging */
-                                        uhci_show_qh(urbp->qh, errbuf,
+                                        uhci_show_qh(uhci, urbp->qh, errbuf,
                                                         ERRBUF_LEN, 0);
                                         lprintk(errbuf);
                                 }
diff --git a/drivers/usb/misc/berry_charge.c b/drivers/usb/misc/berry_charge.c
index 60893c6c8221..b15f2fd8dab4 100644
--- a/drivers/usb/misc/berry_charge.c
+++ b/drivers/usb/misc/berry_charge.c
@@ -69,7 +69,7 @@ static int magic_charge(struct usb_device *udev)
                 return retval;
         }
 
-        dbg(&udev->dev, "Sending first magic command\n");
+        dbg(&udev->dev, "Sending second magic command\n");
         retval = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                                  0xa2, 0x40, 0, 1, dummy_buffer, 0, 100);
         if (retval != 0) {
diff --git a/drivers/usb/net/dm9601.c b/drivers/usb/net/dm9601.c
index c0bc52be5e10..5130cc7eb314 100644
--- a/drivers/usb/net/dm9601.c
+++ b/drivers/usb/net/dm9601.c
@@ -578,6 +578,14 @@ static const struct usb_device_id products[] = {
          USB_DEVICE(0x0a46, 0x9601),    /* Davicom USB-100 */
          .driver_info = (unsigned long)&dm9601_info,
          },
+        {
+         USB_DEVICE(0x0a46, 0x6688),    /* ZT6688 USB NIC */
+         .driver_info = (unsigned long)&dm9601_info,
+         },
+        {
+         USB_DEVICE(0x0a46, 0x0268),    /* ShanTou ST268 USB NIC */
+         .driver_info = (unsigned long)&dm9601_info,
+         },
         {},                     // END
 };
 
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 310a8b5f5906..39a498362594 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -18,11 +18,6 @@
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
-        { USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
-        { USB_DEVICE(0x1410, 0x1130) }, /* Novatel Wireless S720 CDMA/EV-DO */
-        { USB_DEVICE(0x1410, 0x2110) }, /* Novatel Wireless U720 CDMA/EV-DO */
-        { USB_DEVICE(0x1410, 0x1430) }, /* Novatel Merlin XU870 HSDPA/3G */
-        { USB_DEVICE(0x1410, 0x1100) }, /* ExpressCard34 Qualcomm 3G CDMA */
         { USB_DEVICE(0x413c, 0x8115) }, /* Dell Wireless HSDPA 5500 */
         { },
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1633a0fd48e8..8ff9d54b21e6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -879,6 +879,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                 break;
         case FT232BM: /* FT232BM chip */
         case FT2232C: /* FT2232C chip */
+        case FT232RL:
                 if (baud <= 3000000) {
                         div_value = ftdi_232bm_baud_to_divisor(baud);
                 } else {
@@ -1021,9 +1022,12 @@ static void ftdi_determine_type(struct usb_serial_port *port)
                 /* (It might be a BM because of the iSerialNumber bug,
                  * but it will still work as an AM device.) */
                 priv->chip_type = FT8U232AM;
-        } else {
+        } else if (version < 0x600) {
                 /* Assume its an FT232BM (or FT245BM) */
                 priv->chip_type = FT232BM;
+        } else {
+                /* Assume its an FT232R  */
+                priv->chip_type = FT232RL;
         }
         info("Detected %s", ftdi_chip_name[priv->chip_type]);
 }
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 53baeec8f265..4f8282ad7720 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -20,13 +20,14 @@
 #include <linux/usb/serial.h>
 #include <asm/uaccess.h>
 
-static int generic_probe(struct usb_interface *interface,
-                         const struct usb_device_id *id);
-
 
 static int debug;
 
 #ifdef CONFIG_USB_SERIAL_GENERIC
+
+static int generic_probe(struct usb_interface *interface,
+                         const struct usb_device_id *id);
+
 static __u16 vendor  = 0x05f9;
 static __u16 product = 0xffff;
 
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 2d588fb82573..19bf403f9db2 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1628,6 +1628,7 @@ static struct usb_serial_driver moschip7720_2port_driver = {
         .chars_in_buffer        = mos7720_chars_in_buffer,
         .break_ctl              = mos7720_break,
         .read_bulk_callback     = mos7720_bulk_in_callback,
+        .read_int_callback      = mos7720_interrupt_callback,
 };
 
 static int __init moschip7720_init(void)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index db92a7fb1f7c..e178e6f40319 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -109,7 +109,6 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define HUAWEI_PRODUCT_E220                     0x1003
 
 #define NOVATELWIRELESS_VENDOR_ID               0x1410
-#define NOVATELWIRELESS_PRODUCT_U740            0x1400
 
 #define ANYDATA_VENDOR_ID                       0x16d5
 #define ANYDATA_PRODUCT_ID                      0x6501
@@ -152,7 +151,19 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_ETNA_KOI_NETWORK) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E220) },
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1100) }, /* Novatel Merlin XS620/S640 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1110) }, /* Novatel Merlin S620 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1120) }, /* Novatel Merlin EX720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1130) }, /* Novatel Merlin S720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1400) }, /* Novatel U730 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1410) }, /* Novatel U740 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1420) }, /* Novatel EU870 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1430) }, /* Novatel Merlin XU870 HSDPA/3G */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x1430) }, /* Novatel XU870 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2100) }, /* Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2110) }, /* Novatel Merlin ES620 / Merlin ES720 / Ovation U720 */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2130) }, /* Novatel Merlin ES620 SM Bus */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, 0x2410) }, /* Novatel EU740 */
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ID) },
         { } /* Terminating entry */
 };
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 8511352251f3..7639022cdf84 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -138,6 +138,11 @@ static void destroy_serial(struct kref *kref)
 
         dbg("%s - %s", __FUNCTION__, serial->type->description);
 
+        serial->type->shutdown(serial);
+
+        /* return the minor range that this device had */
+        return_serial(serial);
+
         for (i = 0; i < serial->num_ports; ++i)
                 serial->port[i]->open_count = 0;
 
@@ -148,12 +153,6 @@ static void destroy_serial(struct kref *kref)
                         serial->port[i] = NULL;
                 }
 
-        if (serial->type->shutdown)
-                serial->type->shutdown(serial);
-
-        /* return the minor range that this device had */
-        return_serial(serial);
-
         /* If this is a "fake" port, we have to clean it up here, as it will
          * not get cleaned up in port_release() as it was never registered with
          * the driver core */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 2dd31e3f5107..e13637dfb642 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1411,6 +1411,16 @@ UNUSUAL_DEV(  0x22b8, 0x3010, 0x0001, 0x0001,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ),
 
+/*
+ * Patch by Pete Zaitcev <zaitcev@redhat.com>
+ * Report by Mark Patton. Red Hat bz#208928.
+ */
+UNUSUAL_DEV(  0x22b8, 0x4810, 0x0001, 0x0001,
+                "Motorola",
+                "RAZR V3i",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
+
 /* Reported by Radovan Garabik <garabik@kassiopeia.juls.savba.sk> */
 UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
                 "MPIO",
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 7f5a59836818..e4f0dd00ae85 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1320,7 +1320,7 @@ config FB_AU1100
 
 config FB_AU1200
         bool "Au1200 LCD Driver"
-        depends on FB && MIPS && SOC_AU1200
+        depends on (FB = y) && MIPS && SOC_AU1200
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -1470,7 +1470,7 @@ config FB_G364
 
 config FB_68328
         bool "Motorola 68328 native frame buffer support"
-        depends on FB && (M68328 || M68EZ328 || M68VZ328)
+        depends on (FB = y) && (M68328 || M68EZ328 || M68VZ328)
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -1616,7 +1616,7 @@ config FB_IBM_GXT4500
 
 config FB_PS3
         bool "PS3 GPU framebuffer driver"
-        depends on FB && PS3_PS3AV
+        depends on (FB = y) && PS3_PS3AV
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/backlight/locomolcd.c b/drivers/video/backlight/locomolcd.c
index d1312477813e..6b488b8a7eee 100644
--- a/drivers/video/backlight/locomolcd.c
+++ b/drivers/video/backlight/locomolcd.c
@@ -199,8 +199,8 @@ static int locomolcd_remove(struct locomo_dev *dev)
 {
         unsigned long flags;
 
-        locomobl_data.brightness = 0;
-        locomobl_data.power = 0;
+        locomolcd_bl_device->props.brightness = 0;
+        locomolcd_bl_device->props.power = 0;
         locomolcd_set_intensity(locomolcd_bl_device);
 
         backlight_device_unregister(locomolcd_bl_device);
diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
index 702269357861..836ab4df0ef2 100644
--- a/drivers/video/backlight/progear_bl.c
+++ b/drivers/video/backlight/progear_bl.c
@@ -65,13 +65,13 @@ static int progearbl_probe(struct platform_device *pdev)
         u8 temp;
         struct backlight_device *progear_backlight_device;
 
-        pmu_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M7101, 0);
+        pmu_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M7101, NULL);
         if (!pmu_dev) {
                 printk("ALI M7101 PMU not found.\n");
                 return -ENODEV;
         }
 
-        sb_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M1533, 0);
+        sb_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M1533, NULL);
         if (!sb_dev) {
                 printk("ALI 1533 SB not found.\n");
                 pci_dev_put(pmu_dev);
diff --git a/drivers/video/bw2.c b/drivers/video/bw2.c
index 9bb6257d6918..b0b2e40bbd9f 100644
--- a/drivers/video/bw2.c
+++ b/drivers/video/bw2.c
@@ -186,8 +186,7 @@ static int bw2_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
  *  Initialisation
  */
 
-static void
-bw2_init_fix(struct fb_info *info, int linebytes)
+static void __devinit bw2_init_fix(struct fb_info *info, int linebytes)
 {
         strlcpy(info->fix.id, "bwtwo", sizeof(info->fix.id));
 
@@ -199,43 +198,44 @@ bw2_init_fix(struct fb_info *info, int linebytes)
         info->fix.accel = FB_ACCEL_SUN_BWTWO;
 }
 
-static u8 bw2regs_1600[] __initdata = {
+static u8 bw2regs_1600[] __devinitdata = {
         0x14, 0x8b,     0x15, 0x28,     0x16, 0x03,     0x17, 0x13,
         0x18, 0x7b,     0x19, 0x05,     0x1a, 0x34,     0x1b, 0x2e,
         0x1c, 0x00,     0x1d, 0x0a,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x21,     0
 };
 
-static u8 bw2regs_ecl[] __initdata = {
+static u8 bw2regs_ecl[] __devinitdata = {
         0x14, 0x65,     0x15, 0x1e,     0x16, 0x04,     0x17, 0x0c,
         0x18, 0x5e,     0x19, 0x03,     0x1a, 0xa7,     0x1b, 0x23,
         0x1c, 0x00,     0x1d, 0x08,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x20,     0
 };
 
-static u8 bw2regs_analog[] __initdata = {
+static u8 bw2regs_analog[] __devinitdata = {
         0x14, 0xbb,     0x15, 0x2b,     0x16, 0x03,     0x17, 0x13,
         0x18, 0xb0,     0x19, 0x03,     0x1a, 0xa6,     0x1b, 0x22,
         0x1c, 0x01,     0x1d, 0x05,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x20,     0
 };
 
-static u8 bw2regs_76hz[] __initdata = {
+static u8 bw2regs_76hz[] __devinitdata = {
         0x14, 0xb7,     0x15, 0x27,     0x16, 0x03,     0x17, 0x0f,
         0x18, 0xae,     0x19, 0x03,     0x1a, 0xae,     0x1b, 0x2a,
         0x1c, 0x01,     0x1d, 0x09,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x24,     0
 };
 
-static u8 bw2regs_66hz[] __initdata = {
+static u8 bw2regs_66hz[] __devinitdata = {
         0x14, 0xbb,     0x15, 0x2b,     0x16, 0x04,     0x17, 0x14,
         0x18, 0xae,     0x19, 0x03,     0x1a, 0xa8,     0x1b, 0x24,
         0x1c, 0x01,     0x1d, 0x05,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x20,     0
 };
 
-static void bw2_do_default_mode(struct bw2_par *par, struct fb_info *info,
-                                int *linebytes)
+static void __devinit bw2_do_default_mode(struct bw2_par *par,
+                                          struct fb_info *info,
+                                          int *linebytes)
 {
         u8 status, mon;
         u8 *p;
diff --git a/drivers/video/cg14.c b/drivers/video/cg14.c
index ec6a51a5822d..b071bb632b97 100644
--- a/drivers/video/cg14.c
+++ b/drivers/video/cg14.c
@@ -354,7 +354,8 @@ static int cg14_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
  *  Initialisation
  */
 
-static void cg14_init_fix(struct fb_info *info, int linebytes, struct device_node *dp)
+static void __devinit cg14_init_fix(struct fb_info *info, int linebytes,
+                                    struct device_node *dp)
 {
         const char *name = dp->name;
 
@@ -368,7 +369,7 @@ static void cg14_init_fix(struct fb_info *info, int linebytes, struct device_nod
         info->fix.accel = FB_ACCEL_SUN_CG14;
 }
 
-static struct sbus_mmap_map __cg14_mmap_map[CG14_MMAP_ENTRIES] __initdata = {
+static struct sbus_mmap_map __cg14_mmap_map[CG14_MMAP_ENTRIES] __devinitdata = {
         {
                 .voff   = CG14_REGS,
                 .poff   = 0x80000000,
diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
index 1d1c7c624d7f..d7ece8d17a2c 100644
--- a/drivers/video/riva/fbdev.c
+++ b/drivers/video/riva/fbdev.c
@@ -285,8 +285,6 @@ static const struct riva_regs reg_template = {
 #define MAX_LEVEL 0x534
 #define LEVEL_STEP ((MAX_LEVEL - MIN_LEVEL) / FB_BACKLIGHT_MAX)
 
-static struct backlight_properties riva_bl_data;
-
 static int riva_bl_get_level_brightness(struct riva_par *par,
                 int level)
 {
@@ -372,7 +370,7 @@ static void riva_bl_init(struct riva_par *par)
                 FB_BACKLIGHT_MAX);
 
         bd->props.max_brightness = FB_BACKLIGHT_LEVELS - 1;
-        bd->props.brightness = riva_bl_data.max_brightness;
+        bd->props.brightness = bd->props.max_brightness;
         bd->props.power = FB_BLANK_UNBLANK;
         backlight_update_status(bd);
 
diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
index 98919a6975f0..3091b20124b4 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/s3fb.c
@@ -1000,11 +1000,12 @@ err_enable_device:
 static void __devexit s3_pci_remove(struct pci_dev *dev)
 {
         struct fb_info *info = pci_get_drvdata(dev);
-        struct s3fb_info *par = info->par;
 
         if (info) {
 
 #ifdef CONFIG_MTRR
+                struct s3fb_info *par = info->par;
+
                 if (par->mtrr_reg >= 0) {
                         mtrr_del(par->mtrr_reg, 0, 0);
                         par->mtrr_reg = -1;
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 4afa30522fdb..0166ec2ccf32 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -384,6 +384,19 @@ SavageSetup2DEngine(struct savagefb_par  *par)
         BCI_SEND(0);
         BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD2);
         BCI_SEND(GlobalBitmapDescriptor);
+
+        /*
+         * I don't know why, sending this twice fixes the intial black screen,
+         * prevents X from crashing at least in Toshiba laptops with SavageIX.
+         * --Tony
+         */
+        par->bci_ptr = 0;
+        par->SavageWaitFifo(par, 4);
+
+        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD1);
+        BCI_SEND(0);
+        BCI_SEND(BCI_CMD_SETREG | (1 << 16) | BCI_GBD2);
+        BCI_SEND(GlobalBitmapDescriptor);
 }
 
 static void savagefb_set_clip(struct fb_info *info)
@@ -496,7 +509,7 @@ static int common_calc_clock(long freq, int min_m, int min_n1, int max_n1,
 #ifdef SAVAGEFB_DEBUG
 /* This function is used to debug, it prints out the contents of s3 regs */
 
-static void SavagePrintRegs(void)
+static void SavagePrintRegs(struct savagefb_par *par)
 {
         unsigned char i;
         int vgaCRIndex = 0x3d4;
@@ -1525,7 +1538,7 @@ static int savagefb_set_par(struct fb_info *info)
         savagefb_set_fix(info);
         savagefb_set_clip(info);
 
-        SavagePrintRegs();
+        SavagePrintRegs(par);
         return 0;
 }
 
@@ -2155,7 +2168,6 @@ static int __devinit savagefb_probe(struct pci_dev* dev,
         int video_len;
 
         DBG("savagefb_probe");
-        SavagePrintRegs();
 
         info = framebuffer_alloc(sizeof(struct savagefb_par), &dev->dev);
         if (!info)
diff --git a/drivers/video/sstfb.c b/drivers/video/sstfb.c
index 59cd1e750f30..62fa5500361d 100644
--- a/drivers/video/sstfb.c
+++ b/drivers/video/sstfb.c
@@ -257,6 +257,7 @@ static void __sst_dac_write(u8 __iomem *vbase, u8 reg, u8 val)
         r_dprintk("sst_dac_write(%#x, %#x)\n", reg, val);
         reg &= 0x07;
         __sst_write(vbase, DAC_DATA,(((u32)reg << 8)) | (u32)val);
+        __sst_wait_idle(vbase);
 }
 
 /* indexed access to ti/att dacs */
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 8ada4c5c5d70..6a82d39dc498 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -40,7 +40,6 @@
 extern struct file_system_type v9fs_fs_type;
 extern const struct address_space_operations v9fs_addr_operations;
 extern const struct file_operations v9fs_file_operations;
-extern const struct file_operations v9fs_cached_file_operations;
 extern const struct file_operations v9fs_dir_operations;
 extern struct dentry_operations v9fs_dentry_operations;
 extern struct dentry_operations v9fs_cached_dentry_operations;
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 653dfa5b2531..c7b677253843 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -42,6 +42,8 @@
 #include "v9fs_vfs.h"
 #include "fid.h"
 
+static const struct file_operations v9fs_cached_file_operations;
+
 /**
  * v9fs_file_open - open a file (or directory)
  * @inode: inode to be opened
@@ -245,7 +247,7 @@ v9fs_file_write(struct file *filp, const char __user * data,
         return total;
 }
 
-const struct file_operations v9fs_cached_file_operations = {
+static const struct file_operations v9fs_cached_file_operations = {
         .llseek = generic_file_llseek,
         .read = do_sync_read,
         .aio_read = generic_file_aio_read,
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 51db1182b27e..a2fceba7ef8e 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -507,7 +507,7 @@ out:
 #define INTERPRETER_ELF 2
 
 #ifndef STACK_RND_MASK
-#define STACK_RND_MASK 0x7ff            /* with 4K pages 8MB of VA */
+#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))     /* 8MB of VA */
 #endif
 
 static unsigned long randomize_stack_top(unsigned long stack_top)
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 5810aa1339fd..47d6d49d1fb9 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -179,6 +179,8 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm,
         int executable_stack;
         int retval, i;
 
+        kdebug("____ LOAD %d ____", current->pid);
+
         memset(&exec_params, 0, sizeof(exec_params));
         memset(&interp_params, 0, sizeof(interp_params));
 
@@ -941,8 +943,11 @@ static int elf_fdpic_map_file_constdisp_on_uclinux(
 
                 if (mm) {
                         if (phdr->p_flags & PF_X) {
-                                mm->start_code = seg->addr;
-                                mm->end_code = seg->addr + phdr->p_memsz;
+                                if (!mm->start_code) {
+                                        mm->start_code = seg->addr;
+                                        mm->end_code = seg->addr +
+                                                phdr->p_memsz;
+                                }
                         } else if (!mm->start_data) {
                                 mm->start_data = seg->addr;
 #ifndef CONFIG_MMU
@@ -1123,8 +1128,10 @@ static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
 
                 if (mm) {
                         if (phdr->p_flags & PF_X) {
-                                mm->start_code = maddr;
-                                mm->end_code = maddr + phdr->p_memsz;
+                                if (!mm->start_code) {
+                                        mm->start_code = maddr;
+                                        mm->end_code = maddr + phdr->p_memsz;
+                                }
                         } else if (!mm->start_data) {
                                 mm->start_data = maddr;
                                 mm->end_data = maddr + phdr->p_memsz;
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 6247628bdaed..5d1f4873d701 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -4,6 +4,12 @@ Fix mtime bouncing around from local idea of last write times to remote time.
 Fix hang (in i_size_read) when simultaneous size update of same remote file
 on smp system corrupts sequence number. Do not reread unnecessarily partial page
 (which we are about to overwrite anyway) when writing out file opened rw.
+When DOS attribute of file on non-Unix server's file changes on the server side
+from read-only back to read-write, reflect this change in default file mode
+(we had been leaving a file's mode read-only until the inode were reloaded).
+Allow setting of attribute back to ATTR_NORMAL (removing readonly dos attribute
+when archive dos attribute not set and we are changing mode back to writeable
+on server which does not support the Unix Extensions).
 
 Version 1.47
 ------------
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 0efdf35aab2c..4d8948e8762c 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -220,7 +220,7 @@
  */
 #define CIFS_NO_HANDLE        0xFFFF
 
-#define NO_CHANGE_64          0xFFFFFFFFFFFFFFFFULL
+#define NO_CHANGE_64          cpu_to_le64(0xFFFFFFFFFFFFFFFFULL)
 #define NO_CHANGE_32          0xFFFFFFFFUL
 
 /* IPC$ in ASCII */
@@ -1887,7 +1887,13 @@ typedef struct {
                                                       calls including posix open
                                                       and posix unlink */ 
 #ifdef CONFIG_CIFS_POSIX
-#define CIFS_UNIX_CAP_MASK              0x0000003b
+/* Can not set pathnames cap yet until we send new posix create SMB since
+   otherwise server can treat such handles opened with older ntcreatex
+   (by a new client which knows how to send posix path ops)
+   as non-posix handles (can affect write behavior with byte range locks.
+   We can add back in POSIX_PATH_OPS cap when Posix Create/Mkdir finished */
+/* #define CIFS_UNIX_CAP_MASK              0x0000003b */
+#define CIFS_UNIX_CAP_MASK              0x0000001b 
 #else 
 #define CIFS_UNIX_CAP_MASK              0x00000013
 #endif /* CONFIG_CIFS_POSIX */
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 86b9dbbd8441..f414526e476a 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -494,6 +494,12 @@ int cifs_get_inode_info(struct inode **pinode,
                            mode e.g. 555 */
                         if (cifsInfo->cifsAttrs & ATTR_READONLY)
                                 inode->i_mode &= ~(S_IWUGO);
+                        else if ((inode->i_mode & S_IWUGO) == 0)
+                                /* the ATTR_READONLY flag may have been */
+                                /* changed on server -- set any w bits  */
+                                /* allowed by mnt_file_mode             */
+                                inode->i_mode |= (S_IWUGO &
+                                                  cifs_sb->mnt_file_mode);
                 /* BB add code here -
                    validate if device or weird share or device type? */
                 }
@@ -1190,6 +1196,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
         struct cifsFileInfo *open_file = NULL;
         FILE_BASIC_INFO time_buf;
         int set_time = FALSE;
+        int set_dosattr = FALSE;
         __u64 mode = 0xFFFFFFFFFFFFFFFFULL;
         __u64 uid = 0xFFFFFFFFFFFFFFFFULL;
         __u64 gid = 0xFFFFFFFFFFFFFFFFULL;
@@ -1326,15 +1333,23 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
         else if (attrs->ia_valid & ATTR_MODE) {
                 rc = 0;
                 if ((mode & S_IWUGO) == 0) /* not writeable */ {
-                        if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0)
+                        if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
+                                set_dosattr = TRUE;
                                 time_buf.Attributes =
                                         cpu_to_le32(cifsInode->cifsAttrs |
                                                     ATTR_READONLY);
+                        }
                 } else if ((mode & S_IWUGO) == S_IWUGO) {
-                        if (cifsInode->cifsAttrs & ATTR_READONLY)
+                        if (cifsInode->cifsAttrs & ATTR_READONLY) {
+                                set_dosattr = TRUE;
                                 time_buf.Attributes =
                                         cpu_to_le32(cifsInode->cifsAttrs &
                                                     (~ATTR_READONLY));
+                                /* Windows ignores set to zero */
+                                if(time_buf.Attributes == 0)
+                                        time_buf.Attributes |= 
+                                                cpu_to_le32(ATTR_NORMAL);
+                        }
                 }
                 /* BB to be implemented -
                    via Windows security descriptors or streams */
@@ -1372,7 +1387,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
         } else
                 time_buf.ChangeTime = 0;
 
-        if (set_time || time_buf.Attributes) {
+        if (set_time || set_dosattr) {
                 time_buf.CreationTime = 0;      /* do not change */
                 /* In the future we should experiment - try setting timestamps
                    via Handle (SetFileInfo) instead of by path */
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 44cfb528797d..2a374d5215ab 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -219,6 +219,10 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
                 tmp_inode->i_mode |= S_IFREG;
                 if (attr & ATTR_READONLY)
                         tmp_inode->i_mode &= ~(S_IWUGO);
+                else if ((tmp_inode->i_mode & S_IWUGO) == 0)
+                        /* the ATTR_READONLY flag may have been changed on   */
+                        /* server -- set any w bits allowed by mnt_file_mode */
+                        tmp_inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
         } /* could add code here - to validate if device or weird share type? */
 
         /* can not fill in nlink here as in qpathinfo version and Unx search */
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 34750d5e4ff2..5e6e37e58f36 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1141,25 +1141,22 @@ int configfs_register_subsystem(struct configfs_subsystem *subsys)
 
         err = -ENOMEM;
         dentry = d_alloc(configfs_sb->s_root, &name);
-        if (!dentry)
-                goto out_release;
-
-        d_add(dentry, NULL);
+        if (dentry) {
+                d_add(dentry, NULL);
 
-        err = configfs_attach_group(sd->s_element, &group->cg_item,
-                                    dentry);
-        if (!err)
-                dentry = NULL;
-        else
-                d_delete(dentry);
+                err = configfs_attach_group(sd->s_element, &group->cg_item,
+                                            dentry);
+                if (err) {
+                        d_delete(dentry);
+                        dput(dentry);
+                }
+        }
 
         mutex_unlock(&configfs_sb->s_root->d_inode->i_mutex);
 
-        if (dentry) {
-            dput(dentry);
-out_release:
-            unlink_group(group);
-            configfs_release_fs();
+        if (err) {
+                unlink_group(group);
+                configfs_release_fs();
         }
 
         return err;
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index 329efcd3d8c9..cb20b964419f 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -78,18 +78,13 @@ struct kmem_cache *ecryptfs_dentry_info_cache;
  */
 static void ecryptfs_d_release(struct dentry *dentry)
 {
-        struct dentry *lower_dentry;
-
-        lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        if (ecryptfs_dentry_to_private(dentry))
+        if (ecryptfs_dentry_to_private(dentry)) {
+                if (ecryptfs_dentry_to_lower(dentry)) {
+                        mntput(ecryptfs_dentry_to_lower_mnt(dentry));
+                        dput(ecryptfs_dentry_to_lower(dentry));
+                }
                 kmem_cache_free(ecryptfs_dentry_info_cache,
                                 ecryptfs_dentry_to_private(dentry));
-        if (lower_dentry) {
-                struct vfsmount *lower_mnt =
-                        ecryptfs_dentry_to_lower_mnt(dentry);
-
-                mntput(lower_mnt);
-                dput(lower_dentry);
         }
         return;
 }
diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
index 12f7dda1232c..f58cbb26323e 100644
--- a/fs/ext3/xattr.c
+++ b/fs/ext3/xattr.c
@@ -495,7 +495,8 @@ ext3_xattr_release_block(handle_t *handle, struct inode *inode,
                 BHDR(bh)->h_refcount = cpu_to_le32(
                                 le32_to_cpu(BHDR(bh)->h_refcount) - 1);
                 error = ext3_journal_dirty_metadata(handle, bh);
-                handle->h_sync = 1;
+                if (IS_SYNC(inode))
+                        handle->h_sync = 1;
                 DQUOT_FREE_BLOCK(inode, 1);
                 ea_bdebug(bh, "refcount now=%d; releasing",
                           le32_to_cpu(BHDR(bh)->h_refcount));
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index af53c02f473b..93d046c85f52 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -429,7 +429,8 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
         int err;
 
         /* Flush out writes to the server in order to update c/mtime */
-        nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
+        if (S_ISREG(inode->i_mode))
+                nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
 
         /*
          * We may force a getattr if the user cares about atime.
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index bb516a2cfbaf..f1eae44b9a1a 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -151,10 +151,10 @@ int __init register_nfs_fs(void)
         if (ret < 0)
                 goto error_0;
 
-#ifdef CONFIG_NFS_V4
         ret = nfs_register_sysctl();
         if (ret < 0)
                 goto error_1;
+#ifdef CONFIG_NFS_V4
         ret = register_filesystem(&nfs4_fs_type);
         if (ret < 0)
                 goto error_2;
@@ -165,9 +165,9 @@ int __init register_nfs_fs(void)
 #ifdef CONFIG_NFS_V4
 error_2:
         nfs_unregister_sysctl();
+#endif
 error_1:
         unregister_filesystem(&nfs_fs_type);
-#endif
 error_0:
         return ret;
 }
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index fcdcafbb3293..b62481dabae9 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -50,6 +50,14 @@ static ctl_table nfs_cb_sysctls[] = {
                 .proc_handler   = &proc_dointvec_jiffies,
                 .strategy       = &sysctl_jiffies,
         },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "nfs_congestion_kb",
+                .data           = &nfs_congestion_kb,
+                .maxlen         = sizeof(nfs_congestion_kb),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index febdade91670..2867e6b7096f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -12,6 +12,7 @@
 #include <linux/pagemap.h>
 #include <linux/file.h>
 #include <linux/writeback.h>
+#include <linux/swap.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/nfs_fs.h>
@@ -38,7 +39,6 @@ static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                             struct page *,
                                             unsigned int, unsigned int);
 static void nfs_mark_request_dirty(struct nfs_page *req);
-static int nfs_wait_on_write_congestion(struct address_space *, int);
 static long nfs_flush_mapping(struct address_space *mapping, struct writeback_control *wbc, int how);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
@@ -48,8 +48,6 @@ static struct kmem_cache *nfs_wdata_cachep;
 static mempool_t *nfs_wdata_mempool;
 static mempool_t *nfs_commit_mempool;
 
-static DECLARE_WAIT_QUEUE_HEAD(nfs_write_congestion);
-
 struct nfs_write_data *nfs_commit_alloc(void)
 {
         struct nfs_write_data *p = mempool_alloc(nfs_commit_mempool, GFP_NOFS);
@@ -211,6 +209,40 @@ static int wb_priority(struct writeback_control *wbc)
 }
 
 /*
+ * NFS congestion control
+ */
+
+int nfs_congestion_kb;
+
+#define NFS_CONGESTION_ON_THRESH        (nfs_congestion_kb >> (PAGE_SHIFT-10))
+#define NFS_CONGESTION_OFF_THRESH       \
+        (NFS_CONGESTION_ON_THRESH - (NFS_CONGESTION_ON_THRESH >> 2))
+
+static void nfs_set_page_writeback(struct page *page)
+{
+        if (!test_set_page_writeback(page)) {
+                struct inode *inode = page->mapping->host;
+                struct nfs_server *nfss = NFS_SERVER(inode);
+
+                if (atomic_inc_return(&nfss->writeback) >
+                                NFS_CONGESTION_ON_THRESH)
+                        set_bdi_congested(&nfss->backing_dev_info, WRITE);
+        }
+}
+
+static void nfs_end_page_writeback(struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        struct nfs_server *nfss = NFS_SERVER(inode);
+
+        end_page_writeback(page);
+        if (atomic_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH) {
+                clear_bdi_congested(&nfss->backing_dev_info, WRITE);
+                congestion_end(WRITE);
+        }
+}
+
+/*
  * Find an associated nfs write request, and prepare to flush it out
  * Returns 1 if there was no write request, or if the request was
  * already tagged by nfs_set_page_dirty.Returns 0 if the request
@@ -247,7 +279,7 @@ static int nfs_page_mark_flush(struct page *page)
         spin_unlock(req_lock);
         if (test_and_set_bit(PG_FLUSHING, &req->wb_flags) == 0) {
                 nfs_mark_request_dirty(req);
-                set_page_writeback(page);
+                nfs_set_page_writeback(page);
         }
         ret = test_bit(PG_NEED_FLUSH, &req->wb_flags);
         nfs_unlock_request(req);
@@ -302,13 +334,8 @@ int nfs_writepage(struct page *page, struct writeback_control *wbc)
         return err; 
 }
 
-/*
- * Note: causes nfs_update_request() to block on the assumption
- *       that the writeback is generated due to memory pressure.
- */
 int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
 {
-        struct backing_dev_info *bdi = mapping->backing_dev_info;
         struct inode *inode = mapping->host;
         int err;
 
@@ -317,20 +344,12 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
         err = generic_writepages(mapping, wbc);
         if (err)
                 return err;
-        while (test_and_set_bit(BDI_write_congested, &bdi->state) != 0) {
-                if (wbc->nonblocking)
-                        return 0;
-                nfs_wait_on_write_congestion(mapping, 0);
-        }
         err = nfs_flush_mapping(mapping, wbc, wb_priority(wbc));
         if (err < 0)
                 goto out;
         nfs_add_stats(inode, NFSIOS_WRITEPAGES, err);
         err = 0;
 out:
-        clear_bit(BDI_write_congested, &bdi->state);
-        wake_up_all(&nfs_write_congestion);
-        congestion_end(WRITE);
         return err;
 }
 
@@ -360,7 +379,7 @@ static int nfs_inode_add_request(struct inode *inode, struct nfs_page *req)
 }
 
 /*
- * Insert a write request into an inode
+ * Remove a write request from an inode
  */
 static void nfs_inode_remove_request(struct nfs_page *req)
 {
@@ -531,10 +550,10 @@ static inline int nfs_scan_commit(struct inode *inode, struct list_head *dst, un
 }
 #endif
 
-static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
+static int nfs_wait_on_write_congestion(struct address_space *mapping)
 {
+        struct inode *inode = mapping->host;
         struct backing_dev_info *bdi = mapping->backing_dev_info;
-        DEFINE_WAIT(wait);
         int ret = 0;
 
         might_sleep();
@@ -542,31 +561,23 @@ static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
         if (!bdi_write_congested(bdi))
                 return 0;
 
-        nfs_inc_stats(mapping->host, NFSIOS_CONGESTIONWAIT);
+        nfs_inc_stats(inode, NFSIOS_CONGESTIONWAIT);
 
-        if (intr) {
-                struct rpc_clnt *clnt = NFS_CLIENT(mapping->host);
+        do {
+                struct rpc_clnt *clnt = NFS_CLIENT(inode);
                 sigset_t oldset;
 
                 rpc_clnt_sigmask(clnt, &oldset);
-                prepare_to_wait(&nfs_write_congestion, &wait, TASK_INTERRUPTIBLE);
-                if (bdi_write_congested(bdi)) {
-                        if (signalled())
-                                ret = -ERESTARTSYS;
-                        else
-                                schedule();
-                }
+                ret = congestion_wait_interruptible(WRITE, HZ/10);
                 rpc_clnt_sigunmask(clnt, &oldset);
-        } else {
-                prepare_to_wait(&nfs_write_congestion, &wait, TASK_UNINTERRUPTIBLE);
-                if (bdi_write_congested(bdi))
-                        schedule();
-        }
-        finish_wait(&nfs_write_congestion, &wait);
+                if (ret == -ERESTARTSYS)
+                        break;
+                ret = 0;
+        } while (bdi_write_congested(bdi));
+
         return ret;
 }
 
-
 /*
  * Try to update any existing write request, or create one if there is none.
  * In order to match, the request's credentials must match those of
@@ -577,14 +588,15 @@ static int nfs_wait_on_write_congestion(struct address_space *mapping, int intr)
 static struct nfs_page * nfs_update_request(struct nfs_open_context* ctx,
                 struct page *page, unsigned int offset, unsigned int bytes)
 {
-        struct inode *inode = page->mapping->host;
+        struct address_space *mapping = page->mapping;
+        struct inode *inode = mapping->host;
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_page         *req, *new = NULL;
         unsigned long           rqend, end;
 
         end = offset + bytes;
 
-        if (nfs_wait_on_write_congestion(page->mapping, NFS_SERVER(inode)->flags & NFS_MOUNT_INTR))
+        if (nfs_wait_on_write_congestion(mapping))
                 return ERR_PTR(-ERESTARTSYS);
         for (;;) {
                 /* Loop over all inode entries and see if we find
@@ -727,7 +739,7 @@ int nfs_updatepage(struct file *file, struct page *page,
 
 static void nfs_writepage_release(struct nfs_page *req)
 {
-        end_page_writeback(req->wb_page);
+        nfs_end_page_writeback(req->wb_page);
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
         if (!PageError(req->wb_page)) {
@@ -1042,12 +1054,12 @@ static void nfs_writeback_done_full(struct rpc_task *task, void *calldata)
                 if (task->tk_status < 0) {
                         nfs_set_pageerror(page);
                         req->wb_context->error = task->tk_status;
-                        end_page_writeback(page);
+                        nfs_end_page_writeback(page);
                         nfs_inode_remove_request(req);
                         dprintk(", error = %d\n", task->tk_status);
                         goto next;
                 }
-                end_page_writeback(page);
+                nfs_end_page_writeback(page);
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
                 if (data->args.stable != NFS_UNSTABLE || data->verf.committed == NFS_FILE_SYNC) {
@@ -1514,6 +1526,26 @@ int __init nfs_init_writepagecache(void)
         if (nfs_commit_mempool == NULL)
                 return -ENOMEM;
 
+        /*
+         * NFS congestion size, scale with available memory.
+         *
+         *  64MB:    8192k
+         * 128MB:   11585k
+         * 256MB:   16384k
+         * 512MB:   23170k
+         *   1GB:   32768k
+         *   2GB:   46340k
+         *   4GB:   65536k
+         *   8GB:   92681k
+         *  16GB:  131072k
+         *
+         * This allows larger machines to have larger/more transfers.
+         * Limit the default to 256M
+         */
+        nfs_congestion_kb = (16*int_sqrt(totalram_pages)) << (PAGE_SHIFT-10);
+        if (nfs_congestion_kb > 256*1024)
+                nfs_congestion_kb = 256*1024;
+
         return 0;
 }
 
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 6f677988c71d..7e4bb0af24d7 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -859,8 +859,8 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
 #define NFS3_ENTRY_BAGGAGE      (2 + 1 + 2 + 1)
 #define NFS3_ENTRYPLUS_BAGGAGE  (1 + 21 + 1 + (NFS3_FHSIZE >> 2))
 static int
-encode_entry(struct readdir_cd *ccd, const char *name,
-             int namlen, off_t offset, ino_t ino, unsigned int d_type, int plus)
+encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
+             loff_t offset, ino_t ino, unsigned int d_type, int plus)
 {
         struct nfsd3_readdirres *cd = container_of(ccd, struct nfsd3_readdirres,
                                                         common);
@@ -880,7 +880,7 @@ encode_entry(struct readdir_cd *ccd, const char *name,
                         *cd->offset1 = htonl(offset64 & 0xffffffff);
                         cd->offset1 = NULL;
                 } else {
-                        xdr_encode_hyper(cd->offset, (u64) offset);
+                        xdr_encode_hyper(cd->offset, offset64);
                 }
         }
 
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 832673b14587..673a53c014a3 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -228,7 +228,7 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
         struct posix_acl_summary pas;
         unsigned short deny;
         int eflag = ((flags & NFS4_ACL_TYPE_DEFAULT) ?
-                                        NFS4_INHERITANCE_FLAGS : 0);
+                NFS4_INHERITANCE_FLAGS | NFS4_ACE_INHERIT_ONLY_ACE : 0);
 
         BUG_ON(pacl->a_count < 3);
         summarize_posix_acl(pacl, &pas);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 9e4067999209..af360705e551 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -750,9 +750,8 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 status = nfserr_clid_inuse;
                 if (!cmp_creds(&conf->cl_cred, &rqstp->rq_cred)
                                 || conf->cl_addr != sin->sin_addr.s_addr) {
-                        printk("NFSD: setclientid: string in use by client"
-                        "(clientid %08x/%08x)\n",
-                        conf->cl_clientid.cl_boot, conf->cl_clientid.cl_id);
+                        dprintk("NFSD: setclientid: string in use by client"
+                                "at %u.%u.%u.%u\n", NIPQUAD(conf->cl_addr));
                         goto out;
                 }
         }
@@ -3261,7 +3260,6 @@ __nfs4_state_shutdown(void)
                 unhash_delegation(dp);
         }
 
-        cancel_delayed_work(&laundromat_work);
         nfsd4_shutdown_recdir();
         nfs4_init = 0;
 }
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index c2660cbfcd96..8d995bcef806 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -17,7 +17,6 @@
 #include <linux/stat.h>
 #include <linux/dcache.h>
 #include <linux/mount.h>
-#include <asm/pgtable.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/svc.h>
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 93628b02ef5d..875c11443817 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -614,6 +614,27 @@ static void ocfs2_dio_end_io(struct kiocb *iocb,
         ocfs2_rw_unlock(inode, 0);
 }
 
+/*
+ * ocfs2_invalidatepage() and ocfs2_releasepage() are shamelessly stolen
+ * from ext3.  PageChecked() bits have been removed as OCFS2 does not
+ * do journalled data.
+ */
+static void ocfs2_invalidatepage(struct page *page, unsigned long offset)
+{
+        journal_t *journal = OCFS2_SB(page->mapping->host->i_sb)->journal->j_journal;
+
+        journal_invalidatepage(journal, page, offset);
+}
+
+static int ocfs2_releasepage(struct page *page, gfp_t wait)
+{
+        journal_t *journal = OCFS2_SB(page->mapping->host->i_sb)->journal->j_journal;
+
+        if (!page_has_buffers(page))
+                return 0;
+        return journal_try_to_free_buffers(journal, page, wait);
+}
+
 static ssize_t ocfs2_direct_IO(int rw,
                                struct kiocb *iocb,
                                const struct iovec *iov,
@@ -661,5 +682,8 @@ const struct address_space_operations ocfs2_aops = {
         .commit_write   = ocfs2_commit_write,
         .bmap           = ocfs2_bmap,
         .sync_page      = block_sync_page,
-        .direct_IO      = ocfs2_direct_IO
+        .direct_IO      = ocfs2_direct_IO,
+        .invalidatepage = ocfs2_invalidatepage,
+        .releasepage    = ocfs2_releasepage,
+        .migratepage    = buffer_migrate_page,
 };
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 5a9779bb9236..eba282da500e 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -1234,6 +1234,7 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
                                      const char *page,
                                      size_t count)
 {
+        struct task_struct *hb_task;
         long fd;
         int sectsize;
         char *p = (char *)page;
@@ -1319,20 +1320,28 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
          */
         atomic_set(&reg->hr_steady_iterations, O2HB_LIVE_THRESHOLD + 1);
 
-        reg->hr_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
-                                   reg->hr_item.ci_name);
-        if (IS_ERR(reg->hr_task)) {
-                ret = PTR_ERR(reg->hr_task);
+        hb_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
+                              reg->hr_item.ci_name);
+        if (IS_ERR(hb_task)) {
+                ret = PTR_ERR(hb_task);
                 mlog_errno(ret);
-                reg->hr_task = NULL;
                 goto out;
         }
 
+        spin_lock(&o2hb_live_lock);
+        reg->hr_task = hb_task;
+        spin_unlock(&o2hb_live_lock);
+
         ret = wait_event_interruptible(o2hb_steady_queue,
                                 atomic_read(&reg->hr_steady_iterations) == 0);
         if (ret) {
-                kthread_stop(reg->hr_task);
+                spin_lock(&o2hb_live_lock);
+                hb_task = reg->hr_task;
                 reg->hr_task = NULL;
+                spin_unlock(&o2hb_live_lock);
+
+                if (hb_task)
+                        kthread_stop(hb_task);
                 goto out;
         }
 
@@ -1354,10 +1363,17 @@ out:
 static ssize_t o2hb_region_pid_read(struct o2hb_region *reg,
                                       char *page)
 {
-        if (!reg->hr_task)
+        pid_t pid = 0;
+
+        spin_lock(&o2hb_live_lock);
+        if (reg->hr_task)
+                pid = reg->hr_task->pid;
+        spin_unlock(&o2hb_live_lock);
+
+        if (!pid)
                 return 0;
 
-        return sprintf(page, "%u\n", reg->hr_task->pid);
+        return sprintf(page, "%u\n", pid);
 }
 
 struct o2hb_region_attribute {
@@ -1495,13 +1511,17 @@ out:
 static void o2hb_heartbeat_group_drop_item(struct config_group *group,
                                            struct config_item *item)
 {
+        struct task_struct *hb_task;
         struct o2hb_region *reg = to_o2hb_region(item);
 
         /* stop the thread when the user removes the region dir */
-        if (reg->hr_task) {
-                kthread_stop(reg->hr_task);
-                reg->hr_task = NULL;
-        }
+        spin_lock(&o2hb_live_lock);
+        hb_task = reg->hr_task;
+        reg->hr_task = NULL;
+        spin_unlock(&o2hb_live_lock);
+
+        if (hb_task)
+                kthread_stop(hb_task);
 
         config_item_put(item);
 }
@@ -1682,7 +1702,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(o2hb_register_callback);
 
-int o2hb_unregister_callback(struct o2hb_callback_func *hc)
+void o2hb_unregister_callback(struct o2hb_callback_func *hc)
 {
         BUG_ON(hc->hc_magic != O2HB_CB_MAGIC);
 
@@ -1690,15 +1710,13 @@ int o2hb_unregister_callback(struct o2hb_callback_func *hc)
              __builtin_return_address(0), hc);
 
         if (list_empty(&hc->hc_item))
-                return 0;
+                return;
 
         down_write(&o2hb_callback_sem);
 
         list_del_init(&hc->hc_item);
 
         up_write(&o2hb_callback_sem);
-
-        return 0;
 }
 EXPORT_SYMBOL_GPL(o2hb_unregister_callback);
 
diff --git a/fs/ocfs2/cluster/heartbeat.h b/fs/ocfs2/cluster/heartbeat.h
index cac6223206a9..cc6d40b39771 100644
--- a/fs/ocfs2/cluster/heartbeat.h
+++ b/fs/ocfs2/cluster/heartbeat.h
@@ -70,7 +70,7 @@ void o2hb_setup_callback(struct o2hb_callback_func *hc,
                          void *data,
                          int priority);
 int o2hb_register_callback(struct o2hb_callback_func *hc);
-int o2hb_unregister_callback(struct o2hb_callback_func *hc);
+void o2hb_unregister_callback(struct o2hb_callback_func *hc);
 void o2hb_fill_node_map(unsigned long *map,
                         unsigned bytes);
 void o2hb_init(void);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 1718215fc018..69caf3e12fea 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1638,17 +1638,8 @@ static void o2net_hb_node_up_cb(struct o2nm_node *node, int node_num,
 
 void o2net_unregister_hb_callbacks(void)
 {
-        int ret;
-
-        ret = o2hb_unregister_callback(&o2net_hb_up);
-        if (ret < 0)
-                mlog(ML_ERROR, "Status return %d unregistering heartbeat up "
-                     "callback!\n", ret);
-
-        ret = o2hb_unregister_callback(&o2net_hb_down);
-        if (ret < 0)
-                mlog(ML_ERROR, "Status return %d unregistering heartbeat down "
-                     "callback!\n", ret);
+        o2hb_unregister_callback(&o2net_hb_up);
+        o2hb_unregister_callback(&o2net_hb_down);
 }
 
 int o2net_register_hb_callbacks(void)
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 77e4e6169a0d..9229e04362f6 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2730,14 +2730,17 @@ int dlm_empty_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
         int ret;
         int lock_dropped = 0;
 
+        spin_lock(&res->spinlock);
         if (res->owner != dlm->node_num) {
                 if (!__dlm_lockres_unused(res)) {
                         mlog(ML_ERROR, "%s:%.*s: this node is not master, "
                              "trying to free this but locks remain\n",
                              dlm->name, res->lockname.len, res->lockname.name);
                 }
+                spin_unlock(&res->spinlock);
                 goto leave;
         }
+        spin_unlock(&res->spinlock);
 
         /* Wheee! Migrate lockres here! Will sleep so drop spinlock. */
         spin_unlock(&dlm->spinlock);
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 8ffa0916eb86..6421a8fae1de 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -265,8 +265,10 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
                 /* This may drop and reacquire the dlm spinlock if it
                  * has to do migration. */
                 mlog(0, "calling dlm_purge_lockres!\n");
+                dlm_lockres_get(lockres);
                 if (dlm_purge_lockres(dlm, lockres))
                         BUG();
+                dlm_lockres_put(lockres);
                 mlog(0, "DONE calling dlm_purge_lockres!\n");
 
                 /* Avoid adding any scheduling latencies */
diff --git a/fs/ocfs2/heartbeat.c b/fs/ocfs2/heartbeat.c
index 8fc52d6d0ce7..b25ef63781ba 100644
--- a/fs/ocfs2/heartbeat.c
+++ b/fs/ocfs2/heartbeat.c
@@ -164,8 +164,10 @@ int ocfs2_register_hb_callbacks(struct ocfs2_super *osb)
         }
 
         status = o2hb_register_callback(&osb->osb_hb_up);
-        if (status < 0)
+        if (status < 0) {
                 mlog_errno(status);
+                o2hb_unregister_callback(&osb->osb_hb_down);
+        }
 
 bail:
         return status;
@@ -173,18 +175,11 @@ bail:
 
 void ocfs2_clear_hb_callbacks(struct ocfs2_super *osb)
 {
-        int status;
-
         if (ocfs2_mount_local(osb))
                 return;
 
-        status = o2hb_unregister_callback(&osb->osb_hb_down);
-        if (status < 0)
-                mlog_errno(status);
-
-        status = o2hb_unregister_callback(&osb->osb_hb_up);
-        if (status < 0)
-                mlog_errno(status);
+        o2hb_unregister_callback(&osb->osb_hb_down);
+        o2hb_unregister_callback(&osb->osb_hb_up);
 }
 
 void ocfs2_stop_heartbeat(struct ocfs2_super *osb)
diff --git a/fs/partitions/Kconfig b/fs/partitions/Kconfig
index 74552c60b671..6e8bb66fe619 100644
--- a/fs/partitions/Kconfig
+++ b/fs/partitions/Kconfig
@@ -235,5 +235,4 @@ config EFI_PARTITION
         select CRC32
         help
           Say Y here if you would like to use hard disks under Linux which
-          were partitioned using EFI GPT.  Presently only useful on the
-          IA-64 platform.
+          were partitioned using EFI GPT.
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index e46d237b10f9..8a7d0035ad7a 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -541,7 +541,7 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
         if (!get_capacity(disk) || !(state = check_partition(disk, bdev)))
                 return 0;
         if (IS_ERR(state))      /* I/O error reading the partition table */
-                return PTR_ERR(state);
+                return -EIO;
         for (p = 1; p < state->limit; p++) {
                 sector_t size = state->parts[p].size;
                 sector_t from = state->parts[p].from;
diff --git a/fs/proc/Makefile b/fs/proc/Makefile
index a6b3a8f878f0..bce38e3f06cb 100644
--- a/fs/proc/Makefile
+++ b/fs/proc/Makefile
@@ -8,8 +8,9 @@ proc-y			:= nommu.o task_nommu.o
 proc-$(CONFIG_MMU)      := mmu.o task_mmu.o
 
 proc-y       += inode.o root.o base.o generic.o array.o \
-                proc_tty.o proc_misc.o proc_sysctl.o
+                proc_tty.o proc_misc.o
 
+proc-$(CONFIG_PROC_SYSCTL)      += proc_sysctl.o
 proc-$(CONFIG_PROC_KCORE)       += kcore.o
 proc-$(CONFIG_PROC_VMCORE)      += vmcore.o
 proc-$(CONFIG_PROC_DEVICETREE)  += proc_devtree.o
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 01f7769da8e6..989af5e55d1b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1558,29 +1558,20 @@ static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
                                   size_t count, loff_t *ppos)
 {
         struct inode * inode = file->f_path.dentry->d_inode;
-        unsigned long page;
+        char *p = NULL;
         ssize_t length;
         struct task_struct *task = get_proc_task(inode);
 
-        length = -ESRCH;
         if (!task)
-                goto out_no_task;
-
-        if (count > PAGE_SIZE)
-                count = PAGE_SIZE;
-        length = -ENOMEM;
-        if (!(page = __get_free_page(GFP_KERNEL)))
-                goto out;
+                return -ESRCH;
 
         length = security_getprocattr(task,
                                       (char*)file->f_path.dentry->d_name.name,
-                                      (void*)page, count);
-        if (length >= 0)
-                length = simple_read_from_buffer(buf, count, ppos, (char *)page, length);
-        free_page(page);
-out:
+                                      &p);
         put_task_struct(task);
-out_no_task:
+        if (length > 0)
+                length = simple_read_from_buffer(buf, count, ppos, p, length);
+        kfree(p);
         return length;
 }
 
diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index 42261dbdf60f..723f7c667661 100644
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -181,6 +181,7 @@ static int smb_setup_request(struct smb_request *req)
         req->rq_errno = 0;
         req->rq_fragment = 0;
         kfree(req->rq_trans2buffer);
+        req->rq_trans2buffer = NULL;
 
         return 0;
 }
diff --git a/fs/splice.c b/fs/splice.c
index 2fca6ebf4cc2..07f6556add0a 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -576,76 +576,21 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
         if (this_len + offset > PAGE_CACHE_SIZE)
                 this_len = PAGE_CACHE_SIZE - offset;
 
-        /*
-         * Reuse buf page, if SPLICE_F_MOVE is set and we are doing a full
-         * page.
-         */
-        if ((sd->flags & SPLICE_F_MOVE) && this_len == PAGE_CACHE_SIZE) {
-                /*
-                 * If steal succeeds, buf->page is now pruned from the
-                 * pagecache and we can reuse it. The page will also be
-                 * locked on successful return.
-                 */
-                if (buf->ops->steal(pipe, buf))
-                        goto find_page;
-
-                page = buf->page;
-                if (add_to_page_cache(page, mapping, index, GFP_KERNEL)) {
-                        unlock_page(page);
-                        goto find_page;
-                }
-
-                page_cache_get(page);
-
-                if (!(buf->flags & PIPE_BUF_FLAG_LRU))
-                        lru_cache_add(page);
-        } else {
 find_page:
-                page = find_lock_page(mapping, index);
-                if (!page) {
-                        ret = -ENOMEM;
-                        page = page_cache_alloc_cold(mapping);
-                        if (unlikely(!page))
-                                goto out_ret;
-
-                        /*
-                         * This will also lock the page
-                         */
-                        ret = add_to_page_cache_lru(page, mapping, index,
-                                                    GFP_KERNEL);
-                        if (unlikely(ret))
-                                goto out;
-                }
+        page = find_lock_page(mapping, index);
+        if (!page) {
+                ret = -ENOMEM;
+                page = page_cache_alloc_cold(mapping);
+                if (unlikely(!page))
+                        goto out_ret;
 
                 /*
-                 * We get here with the page locked. If the page is also
-                 * uptodate, we don't need to do more. If it isn't, we
-                 * may need to bring it in if we are not going to overwrite
-                 * the full page.
+                 * This will also lock the page
                  */
-                if (!PageUptodate(page)) {
-                        if (this_len < PAGE_CACHE_SIZE) {
-                                ret = mapping->a_ops->readpage(file, page);
-                                if (unlikely(ret))
-                                        goto out;
-
-                                lock_page(page);
-
-                                if (!PageUptodate(page)) {
-                                        /*
-                                         * Page got invalidated, repeat.
-                                         */
-                                        if (!page->mapping) {
-                                                unlock_page(page);
-                                                page_cache_release(page);
-                                                goto find_page;
-                                        }
-                                        ret = -EIO;
-                                        goto out;
-                                }
-                        } else
-                                SetPageUptodate(page);
-                }
+                ret = add_to_page_cache_lru(page, mapping, index,
+                                            GFP_KERNEL);
+                if (unlikely(ret))
+                        goto out;
         }
 
         ret = mapping->a_ops->prepare_write(file, page, offset, offset+this_len);
@@ -706,9 +651,9 @@ out_ret:
  * key here is the 'actor' worker passed in that actually moves the data
  * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
  */
-static ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
-                                  struct file *out, loff_t *ppos, size_t len,
-                                  unsigned int flags, splice_actor *actor)
+ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
+                           struct file *out, loff_t *ppos, size_t len,
+                           unsigned int flags, splice_actor *actor)
 {
         int ret, do_wakeup, err;
         struct splice_desc sd;
@@ -802,6 +747,7 @@ static ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
 
         return ret;
 }
+EXPORT_SYMBOL(__splice_from_pipe);
 
 ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                          loff_t *ppos, size_t len, unsigned int flags,
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 8d4d839a9d88..fc4633378dc0 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -168,12 +168,12 @@ sysfs_read_file(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         ssize_t retval = 0;
 
         down(&buffer->sem);
-        if (buffer->orphaned) {
-                retval = -ENODEV;
-                goto out;
-        }
         if (buffer->needs_read_fill) {
-                if ((retval = fill_read_buffer(file->f_path.dentry,buffer)))
+                if (buffer->orphaned)
+                        retval = -ENODEV;
+                else
+                        retval = fill_read_buffer(file->f_path.dentry,buffer);
+                if (retval)
                         goto out;
         }
         pr_debug("%s: count = %zd, ppos = %lld, buf = %s\n",
@@ -629,6 +629,60 @@ void sysfs_remove_file_from_group(struct kobject *kobj,
 }
 EXPORT_SYMBOL_GPL(sysfs_remove_file_from_group);
 
+struct sysfs_schedule_callback_struct {
+        struct kobject          *kobj;
+        void                    (*func)(void *);
+        void                    *data;
+        struct work_struct      work;
+};
+
+static void sysfs_schedule_callback_work(struct work_struct *work)
+{
+        struct sysfs_schedule_callback_struct *ss = container_of(work,
+                        struct sysfs_schedule_callback_struct, work);
+
+        (ss->func)(ss->data);
+        kobject_put(ss->kobj);
+        kfree(ss);
+}
+
+/**
+ * sysfs_schedule_callback - helper to schedule a callback for a kobject
+ * @kobj: object we're acting for.
+ * @func: callback function to invoke later.
+ * @data: argument to pass to @func.
+ *
+ * sysfs attribute methods must not unregister themselves or their parent
+ * kobject (which would amount to the same thing).  Attempts to do so will
+ * deadlock, since unregistration is mutually exclusive with driver
+ * callbacks.
+ *
+ * Instead methods can call this routine, which will attempt to allocate
+ * and schedule a workqueue request to call back @func with @data as its
+ * argument in the workqueue's process context.  @kobj will be pinned
+ * until @func returns.
+ *
+ * Returns 0 if the request was submitted, -ENOMEM if storage could not
+ * be allocated.
+ */
+int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
+                void *data)
+{
+        struct sysfs_schedule_callback_struct *ss;
+
+        ss = kmalloc(sizeof(*ss), GFP_KERNEL);
+        if (!ss)
+                return -ENOMEM;
+        kobject_get(kobj);
+        ss->kobj = kobj;
+        ss->func = func;
+        ss->data = data;
+        INIT_WORK(&ss->work, sysfs_schedule_callback_work);
+        schedule_work(&ss->work);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(sysfs_schedule_callback);
+
 
 EXPORT_SYMBOL_GPL(sysfs_create_file);
 EXPORT_SYMBOL_GPL(sysfs_remove_file);
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index ccb7d722c558..4de5c6b89918 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -222,13 +222,17 @@ const unsigned char * sysfs_get_name(struct sysfs_dirent *sd)
 
 static inline void orphan_all_buffers(struct inode *node)
 {
-        struct sysfs_buffer_collection *set = node->i_private;
+        struct sysfs_buffer_collection *set;
         struct sysfs_buffer *buf;
 
         mutex_lock_nested(&node->i_mutex, I_MUTEX_CHILD);
-        if (node->i_private) {
-                list_for_each_entry(buf, &set->associates, associates)
+        set = node->i_private;
+        if (set) {
+                list_for_each_entry(buf, &set->associates, associates) {
+                        down(&buf->sem);
                         buf->orphaned = 1;
+                        up(&buf->sem);
+                }
         }
         mutex_unlock(&node->i_mutex);
 }
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index bcc44084e004..841ac25fd950 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -244,62 +244,87 @@ failed:
  * We can come here from ufs_writepage or ufs_prepare_write,
  * locked_page is argument of these functions, so we already lock it.
  */
-static void ufs_change_blocknr(struct inode *inode, unsigned int beg,
-                               unsigned int count, unsigned int oldb,
-                               unsigned int newb, struct page *locked_page)
+static void ufs_change_blocknr(struct inode *inode, sector_t beg,
+                               unsigned int count, sector_t oldb,
+                               sector_t newb, struct page *locked_page)
 {
-        const unsigned mask = (1 << (PAGE_CACHE_SHIFT - inode->i_blkbits)) - 1;
+        const unsigned blks_per_page =
+                1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        const unsigned mask = blks_per_page - 1;
         struct address_space * const mapping = inode->i_mapping;
-        pgoff_t index, cur_index;
-        unsigned end, pos, j;
+        pgoff_t index, cur_index, last_index;
+        unsigned pos, j, lblock;
+        sector_t end, i;
         struct page *page;
         struct buffer_head *head, *bh;
 
-        UFSD("ENTER, ino %lu, count %u, oldb %u, newb %u\n",
-              inode->i_ino, count, oldb, newb);
+        UFSD("ENTER, ino %lu, count %u, oldb %llu, newb %llu\n",
+              inode->i_ino, count,
+             (unsigned long long)oldb, (unsigned long long)newb);
 
         BUG_ON(!locked_page);
         BUG_ON(!PageLocked(locked_page));
 
         cur_index = locked_page->index;
-
-        for (end = count + beg; beg < end; beg = (beg | mask) + 1) {
-                index = beg >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        end = count + beg;
+        last_index = end >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        for (i = beg; i < end; i = (i | mask) + 1) {
+                index = i >> (PAGE_CACHE_SHIFT - inode->i_blkbits);
 
                 if (likely(cur_index != index)) {
                         page = ufs_get_locked_page(mapping, index);
-                        if (!page || IS_ERR(page)) /* it was truncated or EIO */
+                        if (!page)/* it was truncated */
+                                continue;
+                        if (IS_ERR(page)) {/* or EIO */
+                                ufs_error(inode->i_sb, __FUNCTION__,
+                                          "read of page %llu failed\n",
+                                          (unsigned long long)index);
                                 continue;
+                        }
                 } else
                         page = locked_page;
 
                 head = page_buffers(page);
                 bh = head;
-                pos = beg & mask;
+                pos = i & mask;
                 for (j = 0; j < pos; ++j)
                         bh = bh->b_this_page;
-                j = 0;
+
+
+                if (unlikely(index == last_index))
+                        lblock = end & mask;
+                else
+                        lblock = blks_per_page;
+
                 do {
-                        if (buffer_mapped(bh)) {
-                                pos = bh->b_blocknr - oldb;
-                                if (pos < count) {
-                                        UFSD(" change from %llu to %llu\n",
-                                             (unsigned long long)pos + oldb,
-                                             (unsigned long long)pos + newb);
-                                        bh->b_blocknr = newb + pos;
-                                        unmap_underlying_metadata(bh->b_bdev,
-                                                                  bh->b_blocknr);
-                                        mark_buffer_dirty(bh);
-                                        ++j;
+                        if (j >= lblock)
+                                break;
+                        pos = (i - beg) + j;
+
+                        if (!buffer_mapped(bh))
+                                        map_bh(bh, inode->i_sb, oldb + pos);
+                        if (!buffer_uptodate(bh)) {
+                                ll_rw_block(READ, 1, &bh);
+                                wait_on_buffer(bh);
+                                if (!buffer_uptodate(bh)) {
+                                        ufs_error(inode->i_sb, __FUNCTION__,
+                                                  "read of block failed\n");
+                                        break;
                                 }
                         }
 
+                        UFSD(" change from %llu to %llu, pos %u\n",
+                             (unsigned long long)pos + oldb,
+                             (unsigned long long)pos + newb, pos);
+
+                        bh->b_blocknr = newb + pos;
+                        unmap_underlying_metadata(bh->b_bdev,
+                                                  bh->b_blocknr);
+                        mark_buffer_dirty(bh);
+                        ++j;
                         bh = bh->b_this_page;
                 } while (bh != head);
 
-                if (j)
-                        set_page_dirty(page);
-
                 if (likely(cur_index != index))
                         ufs_put_locked_page(page);
         }
@@ -457,8 +482,9 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
         if (result) {
                 ufs_clear_frags(inode, result + oldcount, newcount - oldcount,
                                 locked_page != NULL);
-                ufs_change_blocknr(inode, fragment - oldcount, oldcount, tmp,
-                                   result, locked_page);
+                ufs_change_blocknr(inode, fragment - oldcount, oldcount,
+                                   uspi->s_sbbase + tmp,
+                                   uspi->s_sbbase + result, locked_page);
                 ufs_cpu_to_data_ptr(sb, p, result);
                 *err = 0;
                 UFS_I(inode)->i_lastfrag = max_t(u32, UFS_I(inode)->i_lastfrag, fragment + count);
diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
index b868878009b6..c28a8b6f2feb 100644
--- a/fs/ufs/ialloc.c
+++ b/fs/ufs/ialloc.c
@@ -343,9 +343,8 @@ cg_found:
                 lock_buffer(bh);
                 ufs2_inode = (struct ufs2_inode *)bh->b_data;
                 ufs2_inode += ufs_inotofsbo(inode->i_ino);
-                ufs2_inode->ui_birthtime.tv_sec =
-                        cpu_to_fs32(sb, CURRENT_TIME_SEC.tv_sec);
-                ufs2_inode->ui_birthtime.tv_usec = 0;
+                ufs2_inode->ui_birthtime = cpu_to_fs64(sb, CURRENT_TIME.tv_sec);
+                ufs2_inode->ui_birthnsec = cpu_to_fs32(sb, CURRENT_TIME.tv_nsec);
                 mark_buffer_dirty(bh);
                 unlock_buffer(bh);
                 if (sb->s_flags & MS_SYNCHRONOUS)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index fb34ad03e224..013d7afe7cde 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -212,7 +212,7 @@ repeat:
                         brelse (result);
                         goto repeat;
                 } else {
-                        *phys = tmp + blockoff;
+                        *phys = uspi->s_sbbase + tmp + blockoff;
                         return NULL;
                 }
         }
@@ -282,9 +282,9 @@ repeat:
         }
 
         if (!phys) {
-                result = sb_getblk(sb, tmp + blockoff);
+                result = sb_getblk(sb, uspi->s_sbbase + tmp + blockoff);
         } else {
-                *phys = tmp + blockoff;
+                *phys = uspi->s_sbbase + tmp + blockoff;
                 result = NULL;
                 *err = 0;
                 *new = 1;
@@ -368,7 +368,7 @@ repeat:
                         brelse (result);
                         goto repeat;
                 } else {
-                        *phys = tmp + blockoff;
+                        *phys = uspi->s_sbbase + tmp + blockoff;
                         goto out;
                 }
         }
@@ -389,9 +389,9 @@ repeat:
 
 
         if (!phys) {
-                result = sb_getblk(sb, tmp + blockoff);
+                result = sb_getblk(sb, uspi->s_sbbase + tmp + blockoff);
         } else {
-                *phys = tmp + blockoff;
+                *phys = uspi->s_sbbase + tmp + blockoff;
                 *new = 1;
         }
 
@@ -668,12 +668,12 @@ static void ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
         inode->i_gid = fs32_to_cpu(sb, ufs2_inode->ui_gid);
 
         inode->i_size = fs64_to_cpu(sb, ufs2_inode->ui_size);
-        inode->i_atime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_atime.tv_sec);
-        inode->i_ctime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_ctime.tv_sec);
-        inode->i_mtime.tv_sec = fs32_to_cpu(sb, ufs2_inode->ui_mtime.tv_sec);
-        inode->i_mtime.tv_nsec = 0;
-        inode->i_atime.tv_nsec = 0;
-        inode->i_ctime.tv_nsec = 0;
+        inode->i_atime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_atime);
+        inode->i_ctime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_ctime);
+        inode->i_mtime.tv_sec = fs64_to_cpu(sb, ufs2_inode->ui_mtime);
+        inode->i_atime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_atimensec);
+        inode->i_ctime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_ctimensec);
+        inode->i_mtime.tv_nsec = fs32_to_cpu(sb, ufs2_inode->ui_mtimensec);
         inode->i_blocks = fs64_to_cpu(sb, ufs2_inode->ui_blocks);
         inode->i_generation = fs32_to_cpu(sb, ufs2_inode->ui_gen);
         ufsi->i_flags = fs32_to_cpu(sb, ufs2_inode->ui_flags);
@@ -803,12 +803,12 @@ static void ufs2_update_inode(struct inode *inode, struct ufs2_inode *ufs_inode)
         ufs_inode->ui_gid = cpu_to_fs32(sb, inode->i_gid);
 
         ufs_inode->ui_size = cpu_to_fs64(sb, inode->i_size);
-        ufs_inode->ui_atime.tv_sec = cpu_to_fs32(sb, inode->i_atime.tv_sec);
-        ufs_inode->ui_atime.tv_usec = 0;
-        ufs_inode->ui_ctime.tv_sec = cpu_to_fs32(sb, inode->i_ctime.tv_sec);
-        ufs_inode->ui_ctime.tv_usec = 0;
-        ufs_inode->ui_mtime.tv_sec = cpu_to_fs32(sb, inode->i_mtime.tv_sec);
-        ufs_inode->ui_mtime.tv_usec = 0;
+        ufs_inode->ui_atime = cpu_to_fs64(sb, inode->i_atime.tv_sec);
+        ufs_inode->ui_atimensec = cpu_to_fs32(sb, inode->i_atime.tv_nsec);
+        ufs_inode->ui_ctime = cpu_to_fs64(sb, inode->i_ctime.tv_sec);
+        ufs_inode->ui_ctimensec = cpu_to_fs32(sb, inode->i_ctime.tv_nsec);
+        ufs_inode->ui_mtime = cpu_to_fs64(sb, inode->i_mtime.tv_sec);
+        ufs_inode->ui_mtimensec = cpu_to_fs32(sb, inode->i_mtime.tv_nsec);
 
         ufs_inode->ui_blocks = cpu_to_fs64(sb, inode->i_blocks);
         ufs_inode->ui_flags = cpu_to_fs32(sb, ufsi->i_flags);
diff --git a/fs/ufs/truncate.c b/fs/ufs/truncate.c
index 749581fa7729..79c54c85fb58 100644
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -74,7 +74,7 @@ static int ufs_trunc_direct(struct inode *inode)
         unsigned i, tmp;
         int retry;
         
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
 
         sb = inode->i_sb;
         uspi = UFS_SB(sb)->s_uspi;
@@ -96,8 +96,8 @@ static int ufs_trunc_direct(struct inode *inode)
                 block2 = ufs_fragstoblks (frag3);
         }
 
-        UFSD("frag1 %llu, frag2 %llu, block1 %llu, block2 %llu, frag3 %llu,"
-             " frag4 %llu\n",
+        UFSD("ino %lu, frag1 %llu, frag2 %llu, block1 %llu, block2 %llu,"
+             " frag3 %llu, frag4 %llu\n", inode->i_ino,
              (unsigned long long)frag1, (unsigned long long)frag2,
              (unsigned long long)block1, (unsigned long long)block2,
              (unsigned long long)frag3, (unsigned long long)frag4);
@@ -163,7 +163,7 @@ next1:
         mark_inode_dirty(inode);
  next3:
 
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         return retry;
 }
 
@@ -248,7 +248,7 @@ static int ufs_trunc_indirect(struct inode *inode, u64 offset, void *p)
         }
         ubh_brelse (ind_ubh);
         
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         
         return retry;
 }
@@ -262,7 +262,7 @@ static int ufs_trunc_dindirect(struct inode *inode, u64 offset, void *p)
         void *dind;
         int retry = 0;
         
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
         
         sb = inode->i_sb;
         uspi = UFS_SB(sb)->s_uspi;
@@ -312,7 +312,7 @@ static int ufs_trunc_dindirect(struct inode *inode, u64 offset, void *p)
         }
         ubh_brelse (dind_bh);
         
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         
         return retry;
 }
@@ -327,7 +327,7 @@ static int ufs_trunc_tindirect(struct inode *inode)
         void *tind, *p;
         int retry;
         
-        UFSD("ENTER\n");
+        UFSD("ENTER: ino %lu\n", inode->i_ino);
 
         retry = 0;
         
@@ -348,7 +348,7 @@ static int ufs_trunc_tindirect(struct inode *inode)
         }
 
         for (i = tindirect_block ; i < uspi->s_apb ; i++) {
-                tind = ubh_get_addr32 (tind_bh, i);
+                tind = ubh_get_data_ptr(uspi, tind_bh, i);
                 retry |= ufs_trunc_dindirect(inode, UFS_NDADDR + 
                         uspi->s_apb + ((i + 1) << uspi->s_2apbshift), tind);
                 ubh_mark_buffer_dirty(tind_bh);
@@ -372,19 +372,21 @@ static int ufs_trunc_tindirect(struct inode *inode)
         }
         ubh_brelse (tind_bh);
         
-        UFSD("EXIT\n");
+        UFSD("EXIT: ino %lu\n", inode->i_ino);
         return retry;
 }
 
 static int ufs_alloc_lastblock(struct inode *inode)
 {
         int err = 0;
+        struct super_block *sb = inode->i_sb;
         struct address_space *mapping = inode->i_mapping;
-        struct ufs_sb_private_info *uspi = UFS_SB(inode->i_sb)->s_uspi;
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
         unsigned i, end;
         sector_t lastfrag;
         struct page *lastpage;
         struct buffer_head *bh;
+        u64 phys64;
 
         lastfrag = (i_size_read(inode) + uspi->s_fsize - 1) >> uspi->s_fshift;
 
@@ -424,6 +426,20 @@ static int ufs_alloc_lastblock(struct inode *inode)
                set_page_dirty(lastpage);
        }
 
+       if (lastfrag >= UFS_IND_FRAGMENT) {
+               end = uspi->s_fpb - ufs_fragnum(lastfrag) - 1;
+               phys64 = bh->b_blocknr + 1;
+               for (i = 0; i < end; ++i) {
+                       bh = sb_getblk(sb, i + phys64);
+                       lock_buffer(bh);
+                       memset(bh->b_data, 0, sb->s_blocksize);
+                       set_buffer_uptodate(bh);
+                       mark_buffer_dirty(bh);
+                       unlock_buffer(bh);
+                       sync_dirty_buffer(bh);
+                       brelse(bh);
+               }
+       }
 out_unlock:
        ufs_put_locked_page(lastpage);
 out:
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index e2bea6a661f0..69e9e80735d2 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -1829,11 +1829,11 @@ xfs_buf_init(void)
         if (!xfs_buf_zone)
                 goto out_free_trace_buf;
 
-        xfslogd_workqueue = create_freezeable_workqueue("xfslogd");
+        xfslogd_workqueue = create_workqueue("xfslogd");
         if (!xfslogd_workqueue)
                 goto out_free_buf_zone;
 
-        xfsdatad_workqueue = create_freezeable_workqueue("xfsdatad");
+        xfsdatad_workqueue = create_workqueue("xfsdatad");
         if (!xfsdatad_workqueue)
                 goto out_destroy_xfslogd_workqueue;
 
diff --git a/include/acpi/acinterp.h b/include/acpi/acinterp.h
index 73967c8152d3..440983019993 100644
--- a/include/acpi/acinterp.h
+++ b/include/acpi/acinterp.h
@@ -446,14 +446,10 @@ acpi_ex_copy_integer_to_buffer_field(union acpi_operand_object *source_desc,
 /*
  * exutils - interpreter/scanner utilities
  */
-void acpi_ex_enter_interpreter(void);
+acpi_status acpi_ex_enter_interpreter(void);
 
 void acpi_ex_exit_interpreter(void);
 
-void acpi_ex_reacquire_interpreter(void);
-
-void acpi_ex_relinquish_interpreter(void);
-
 void acpi_ex_truncate_for32bit_table(union acpi_operand_object *obj_desc);
 
 u8 acpi_ex_acquire_global_lock(u32 rule);
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index 72a6e2c3a536..56bf492e7acc 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -344,7 +344,7 @@ typedef u32 acpi_integer;
 
 /* 64-bit integers */
 
-typedef u64 acpi_integer;
+typedef unsigned long long              acpi_integer;
 #define ACPI_INTEGER_MAX                ACPI_UINT64_MAX
 #define ACPI_INTEGER_BIT_SIZE           64
 #define ACPI_MAX_DECIMAL_DIGITS         20      /* 2^64 = 18,446,744,073,709,551,616 */
diff --git a/include/asm-arm/arch-at91/gpio.h b/include/asm-arm/arch-at91/gpio.h
index 98ad2114f43a..0a241e2fb672 100644
--- a/include/asm-arm/arch-at91/gpio.h
+++ b/include/asm-arm/arch-at91/gpio.h
@@ -223,7 +223,7 @@ static inline void gpio_free(unsigned gpio)
 }
 
 extern int gpio_direction_input(unsigned gpio);
-extern int gpio_direction_output(unsigned gpio);
+extern int gpio_direction_output(unsigned gpio, int value);
 
 static inline int gpio_get_value(unsigned gpio)
 {
diff --git a/include/asm-arm/arch-ixp4xx/ixp4xx-regs.h b/include/asm-arm/arch-ixp4xx/ixp4xx-regs.h
index 9444958bec1e..ed35e5c94f40 100644
--- a/include/asm-arm/arch-ixp4xx/ixp4xx-regs.h
+++ b/include/asm-arm/arch-ixp4xx/ixp4xx-regs.h
@@ -144,9 +144,9 @@
 #define IXP4XX_INTC_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0x3000)
 #define IXP4XX_GPIO_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0x4000)
 #define IXP4XX_TIMER_BASE_VIRT          (IXP4XX_PERIPHERAL_BASE_VIRT + 0x5000)
-#define IXP4XX_NPEA_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_PHYS + 0x6000)
-#define IXP4XX_NPEB_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_PHYS + 0x7000)
-#define IXP4XX_NPEC_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_PHYS + 0x8000)
+#define IXP4XX_NPEA_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0x6000)
+#define IXP4XX_NPEB_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0x7000)
+#define IXP4XX_NPEC_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0x8000)
 #define IXP4XX_EthB_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0x9000)
 #define IXP4XX_EthC_BASE_VIRT           (IXP4XX_PERIPHERAL_BASE_VIRT + 0xA000)
 #define IXP4XX_USB_BASE_VIRT            (IXP4XX_PERIPHERAL_BASE_VIRT + 0xB000)
diff --git a/include/asm-arm/arch-lh7a40x/entry-macro.S b/include/asm-arm/arch-lh7a40x/entry-macro.S
index 502700604e00..ffe397250f0c 100644
--- a/include/asm-arm/arch-lh7a40x/entry-macro.S
+++ b/include/asm-arm/arch-lh7a40x/entry-macro.S
@@ -86,6 +86,12 @@ branch_irq_lh7a400: b 1000f
                 .macro  disable_fiq
                 .endm
 
+                .macro  get_irqnr_preamble, base, tmp
+                .endm
+
+                .macro  arch_ret_to_user, tmp1, tmp2
+                .endm
+
                 .macro  get_irqnr_and_base, irqnr, irqstat, base, tmp
                 mov     \irqnr, #0
                 mov     \base, #io_p2v(0x80000000)      @ APB registers
@@ -105,6 +111,12 @@ branch_irq_lh7a400: b 1000f
                 .macro  disable_fiq
                 .endm
 
+                .macro  get_irqnr_preamble, base, tmp
+                .endm
+
+                .macro  arch_ret_to_user, tmp1, tmp2
+                .endm
+
                 .macro  get_irqnr_and_base, irqnr, irqstat, base, tmp
                 mov     \irqnr, #0                      @ VIC1 irq base
                 mov     \base, #io_p2v(0x80000000)      @ APB registers
diff --git a/include/asm-arm/arch-ns9xxx/clock.h b/include/asm-arm/arch-ns9xxx/clock.h
index 4371a485db47..a7c5ab3d9011 100644
--- a/include/asm-arm/arch-ns9xxx/clock.h
+++ b/include/asm-arm/arch-ns9xxx/clock.h
@@ -11,6 +11,7 @@
 #ifndef __ASM_ARCH_CLOCK_H
 #define __ASM_ARCH_CLOCK_H
 
+static inline u32 ns9xxx_systemclock(void) __attribute__((const));
 static inline u32 ns9xxx_systemclock(void)
 {
         /*
@@ -19,17 +20,20 @@ static inline u32 ns9xxx_systemclock(void)
         return 353894400;
 }
 
-static inline const u32 ns9xxx_cpuclock(void)
+static inline u32 ns9xxx_cpuclock(void) __attribute__((const));
+static inline u32 ns9xxx_cpuclock(void)
 {
         return ns9xxx_systemclock() / 2;
 }
 
-static inline const u32 ns9xxx_ahbclock(void)
+static inline u32 ns9xxx_ahbclock(void) __attribute__((const));
+static inline u32 ns9xxx_ahbclock(void)
 {
         return ns9xxx_systemclock() / 4;
 }
 
-static inline const u32 ns9xxx_bbusclock(void)
+static inline u32 ns9xxx_bbusclock(void) __attribute__((const));
+static inline u32 ns9xxx_bbusclock(void)
 {
         return ns9xxx_systemclock() / 8;
 }
diff --git a/include/asm-arm/arch-omap/gpio.h b/include/asm-arm/arch-omap/gpio.h
index 3762a6ae6a7f..590917efc94a 100644
--- a/include/asm-arm/arch-omap/gpio.h
+++ b/include/asm-arm/arch-omap/gpio.h
@@ -113,8 +113,9 @@ static inline int gpio_direction_input(unsigned gpio)
         return __gpio_set_direction(gpio, 1);
 }
 
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
+        omap_set_gpio_dataout(gpio, value);
         return __gpio_set_direction(gpio, 0);
 }
 
diff --git a/include/asm-arm/arch-pxa/gpio.h b/include/asm-arm/arch-pxa/gpio.h
index 3d348a351157..aeba24347f8e 100644
--- a/include/asm-arm/arch-pxa/gpio.h
+++ b/include/asm-arm/arch-pxa/gpio.h
@@ -43,9 +43,9 @@ static inline int gpio_direction_input(unsigned gpio)
         return pxa_gpio_mode(gpio | GPIO_IN);
 }
 
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
-        return pxa_gpio_mode(gpio | GPIO_OUT);
+        return pxa_gpio_mode(gpio | GPIO_OUT | (value ? 0 : GPIO_DFLT_LOW));
 }
 
 static inline int __gpio_get_value(unsigned gpio)
diff --git a/include/asm-arm/arch-pxa/pxa-regs.h b/include/asm-arm/arch-pxa/pxa-regs.h
index aec835b6f057..139c9d954818 100644
--- a/include/asm-arm/arch-pxa/pxa-regs.h
+++ b/include/asm-arm/arch-pxa/pxa-regs.h
@@ -1476,7 +1476,7 @@
 #define GPIO112_MMCCMD_MD       (112 | GPIO_ALT_FN_1_OUT)
 #define GPIO113_I2S_SYSCLK_MD   (113 | GPIO_ALT_FN_1_OUT)
 #define GPIO113_AC97_RESET_N_MD (113 | GPIO_ALT_FN_2_OUT)
-#define GPIO117_I2CSCL_MD       (117 | GPIO_ALT_FN_1_OUT)
+#define GPIO117_I2CSCL_MD       (117 | GPIO_ALT_FN_1_IN)
 #define GPIO118_I2CSDA_MD       (118 | GPIO_ALT_FN_1_IN)
 
 /*
diff --git a/include/asm-arm/arch-s3c2410/gpio.h b/include/asm-arm/arch-s3c2410/gpio.h
index d47ae453f8ca..7583895fd336 100644
--- a/include/asm-arm/arch-s3c2410/gpio.h
+++ b/include/asm-arm/arch-s3c2410/gpio.h
@@ -44,9 +44,11 @@ static inline int gpio_direction_input(unsigned gpio)
         return 0;
 }
 
-static inline int gpio_direction_output(unsigned gpio)
+static inline int gpio_direction_output(unsigned gpio, int value)
 {
         s3c2410_gpio_cfgpin(gpio, S3C2410_GPIO_OUTPUT);
+        /* REVISIT can we write the value first, to avoid glitching? */
+        s3c2410_gpio_setpin(gpio, value);
         return 0;
 }
 
diff --git a/include/asm-arm/arch-sa1100/gpio.h b/include/asm-arm/arch-sa1100/gpio.h
index da7575b0e5d0..e7a9d26e22a8 100644
--- a/include/asm-arm/arch-sa1100/gpio.h
+++ b/include/asm-arm/arch-sa1100/gpio.h
@@ -38,7 +38,7 @@ static inline void gpio_free(unsigned gpio)
 }
 
 extern int gpio_direction_input(unsigned gpio);
-extern int gpio_direction_output(unsigned gpio);
+extern int gpio_direction_output(unsigned gpio, int value);
 
 
 static inline int gpio_get_value(unsigned gpio)
diff --git a/include/asm-arm/atomic.h b/include/asm-arm/atomic.h
index ea88aa6bfc78..f266c2795124 100644
--- a/include/asm-arm/atomic.h
+++ b/include/asm-arm/atomic.h
@@ -103,9 +103,9 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
         unsigned long tmp, tmp2;
 
         __asm__ __volatile__("@ atomic_clear_mask\n"
-"1:     ldrex   %0, %2\n"
+"1:     ldrex   %0, [%2]\n"
 "       bic     %0, %0, %3\n"
-"       strex   %1, %0, %2\n"
+"       strex   %1, %0, [%2]\n"
 "       teq     %1, #0\n"
 "       bne     1b"
         : "=&r" (tmp), "=&r" (tmp2)
diff --git a/include/asm-avr32/arch-at32ap/gpio.h b/include/asm-avr32/arch-at32ap/gpio.h
index fcb756bdaa8e..80a21aa9ae77 100644
--- a/include/asm-avr32/arch-at32ap/gpio.h
+++ b/include/asm-avr32/arch-at32ap/gpio.h
@@ -10,7 +10,7 @@ int __must_check gpio_request(unsigned int gpio, const char *label);
 void gpio_free(unsigned int gpio);
 
 int gpio_direction_input(unsigned int gpio);
-int gpio_direction_output(unsigned int gpio);
+int gpio_direction_output(unsigned int gpio, int value);
 int gpio_get_value(unsigned int gpio);
 void gpio_set_value(unsigned int gpio, int value);
 
diff --git a/include/asm-i386/apic.h b/include/asm-i386/apic.h
index cc6b1652249a..a19810a08ae9 100644
--- a/include/asm-i386/apic.h
+++ b/include/asm-i386/apic.h
@@ -117,6 +117,7 @@ extern void enable_NMI_through_LVT0 (void * dummy);
 #define ARCH_APICTIMER_STOPS_ON_C3      1
 
 extern int timer_over_8254;
+extern int local_apic_timer_c2_ok;
 
 #else /* !CONFIG_X86_LOCAL_APIC */
 static inline void lapic_shutdown(void) { }
diff --git a/include/asm-i386/elf.h b/include/asm-i386/elf.h
index 8d33c9bb7c1c..952b3ee3c9bb 100644
--- a/include/asm-i386/elf.h
+++ b/include/asm-i386/elf.h
@@ -88,16 +88,16 @@ typedef struct user_fxsr_struct elf_fpxregset_t;
         pr_reg[4] = regs->edi;                          \
         pr_reg[5] = regs->ebp;                          \
         pr_reg[6] = regs->eax;                          \
-        pr_reg[7] = regs->xds;                          \
-        pr_reg[8] = regs->xes;                          \
-        pr_reg[9] = regs->xfs;                          \
+        pr_reg[7] = regs->xds & 0xffff;                 \
+        pr_reg[8] = regs->xes & 0xffff;                 \
+        pr_reg[9] = regs->xfs & 0xffff;                 \
         savesegment(gs,pr_reg[10]);                     \
         pr_reg[11] = regs->orig_eax;                    \
         pr_reg[12] = regs->eip;                         \
-        pr_reg[13] = regs->xcs;                         \
+        pr_reg[13] = regs->xcs & 0xffff;                \
         pr_reg[14] = regs->eflags;                      \
         pr_reg[15] = regs->esp;                         \
-        pr_reg[16] = regs->xss;
+        pr_reg[16] = regs->xss & 0xffff;
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
diff --git a/include/asm-i386/nmi.h b/include/asm-i386/nmi.h
index 64544cb85d6a..b04333ea6f31 100644
--- a/include/asm-i386/nmi.h
+++ b/include/asm-i386/nmi.h
@@ -33,7 +33,7 @@ extern int nmi_watchdog_tick (struct pt_regs * regs, unsigned reason);
 
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
-#define NMI_DEFAULT     0
+#define NMI_DEFAULT     -1
 #define NMI_NONE        0
 #define NMI_IO_APIC     1
 #define NMI_LOCAL_APIC  2
diff --git a/include/asm-i386/paravirt.h b/include/asm-i386/paravirt.h
index f8319cae2ac5..46dc34ca887a 100644
--- a/include/asm-i386/paravirt.h
+++ b/include/asm-i386/paravirt.h
@@ -130,7 +130,7 @@ struct paravirt_ops
         void (*flush_tlb_kernel)(void);
         void (*flush_tlb_single)(u32 addr);
 
-        void (fastcall *map_pt_hook)(int type, pte_t *va, u32 pfn);
+        void (*map_pt_hook)(int type, pte_t *va, u32 pfn);
 
         void (*alloc_pt)(u32 pfn);
         void (*alloc_pd)(u32 pfn);
diff --git a/include/asm-i386/sync_bitops.h b/include/asm-i386/sync_bitops.h
index c94d51c993ee..7d72351bea75 100644
--- a/include/asm-i386/sync_bitops.h
+++ b/include/asm-i386/sync_bitops.h
@@ -130,7 +130,7 @@ static inline int sync_test_and_change_bit(int nr, volatile unsigned long* addr)
         return oldbit;
 }
 
-static __always_inline int sync_const_test_bit(int nr, const volatile unsigned long *addr)
+static __always_inline int sync_constant_test_bit(int nr, const volatile unsigned long *addr)
 {
         return ((1UL << (nr & 31)) &
                 (((const volatile unsigned int *)addr)[nr >> 5])) != 0;
diff --git a/include/asm-i386/termbits.h b/include/asm-i386/termbits.h
index 12baf1d6343f..2e6237693814 100644
--- a/include/asm-i386/termbits.h
+++ b/include/asm-i386/termbits.h
@@ -144,7 +144,7 @@ struct ktermios {
 #define  B3000000 0010015
 #define  B3500000 0010016
 #define  B4000000 0010017
-#define CIBAUD    002003600000  /* input baud rate (not used) */
+#define CIBAUD    002003600000
 #define CMSPAR    010000000000          /* mark or space (stick) parity */
 #define CRTSCTS   020000000000          /* flow control */
 
diff --git a/include/asm-i386/vmi_time.h b/include/asm-i386/vmi_time.h
index 94d0a12a4114..c3a1fcf66c96 100644
--- a/include/asm-i386/vmi_time.h
+++ b/include/asm-i386/vmi_time.h
@@ -54,7 +54,7 @@ extern unsigned long vmi_cpu_khz(void);
 
 #ifdef CONFIG_X86_LOCAL_APIC
 extern void __init vmi_timer_setup_boot_alarm(void);
-extern void __init vmi_timer_setup_secondary_alarm(void);
+extern void __devinit vmi_timer_setup_secondary_alarm(void);
 extern void apic_vmi_timer_interrupt(void);
 #endif
 
diff --git a/include/asm-ia64/machvec.h b/include/asm-ia64/machvec.h
index 3c96ac19154e..ca33eb181ff2 100644
--- a/include/asm-ia64/machvec.h
+++ b/include/asm-ia64/machvec.h
@@ -168,6 +168,7 @@ extern void machvec_tlb_migrate_finish (struct mm_struct *);
 #  define platform_setup_msi_irq        ia64_mv.setup_msi_irq
 #  define platform_teardown_msi_irq     ia64_mv.teardown_msi_irq
 #  define platform_pci_fixup_bus        ia64_mv.pci_fixup_bus
+#  define platform_kernel_launch_event  ia64_mv.kernel_launch_event
 # endif
 
 /* __attribute__((__aligned__(16))) is required to make size of the
@@ -269,6 +270,7 @@ struct ia64_machine_vector {
         platform_setup_msi_irq,                 \
         platform_teardown_msi_irq,              \
         platform_pci_fixup_bus,                 \
+        platform_kernel_launch_event            \
 }
 
 extern struct ia64_machine_vector ia64_mv;
diff --git a/include/asm-ia64/meminit.h b/include/asm-ia64/meminit.h
index 21ec5f3d23de..3a62878e84f3 100644
--- a/include/asm-ia64/meminit.h
+++ b/include/asm-ia64/meminit.h
@@ -36,6 +36,7 @@ extern void reserve_memory (void);
 extern void find_initrd (void);
 extern int filter_rsvd_memory (unsigned long start, unsigned long end, void *arg);
 extern void efi_memmap_init(unsigned long *, unsigned long *);
+extern int find_max_min_low_pfn (unsigned long , unsigned long, void *);
 
 extern unsigned long vmcore_find_descriptor_size(unsigned long address);
 extern int reserve_elfcorehdr(unsigned long *start, unsigned long *end);
diff --git a/include/asm-m32r/dma-mapping.h b/include/asm-m32r/dma-mapping.h
index a7fa0302bda7..f9b58ebba361 100644
--- a/include/asm-m32r/dma-mapping.h
+++ b/include/asm-m32r/dma-mapping.h
@@ -1,23 +1,6 @@
 #ifndef _ASM_M32R_DMA_MAPPING_H
 #define _ASM_M32R_DMA_MAPPING_H
 
-/*
- * NOTE: Do not include <asm-generic/dma-mapping.h>
- * Because it requires PCI stuffs, but current M32R don't provide these.
- */
-
-static inline void *
-dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
-                   gfp_t flag)
-{
-        return (void *)NULL;
-}
-
-static inline void
-dma_free_coherent(struct device *dev, size_t size, void *cpu_addr,
-                    dma_addr_t dma_handle)
-{
-        return;
-}
+#include <asm-generic/dma-mapping-broken.h>
 
 #endif /* _ASM_M32R_DMA_MAPPING_H */
diff --git a/include/asm-m68k/dma-mapping.h b/include/asm-m68k/dma-mapping.h
index 00259ed6fc95..a26cdeb46a57 100644
--- a/include/asm-m68k/dma-mapping.h
+++ b/include/asm-m68k/dma-mapping.h
@@ -32,7 +32,7 @@ extern void dma_free_coherent(struct device *, size_t,
                               void *, dma_addr_t);
 
 static inline void *dma_alloc_noncoherent(struct device *dev, size_t size,
-                                          dma_addr_t *handle, int flag)
+                                          dma_addr_t *handle, gfp_t flag)
 {
         return dma_alloc_coherent(dev, size, handle, flag);
 }
diff --git a/include/asm-m68k/mc146818rtc.h b/include/asm-m68k/mc146818rtc.h
index 11fe12ddb913..9f70a01f73dc 100644
--- a/include/asm-m68k/mc146818rtc.h
+++ b/include/asm-m68k/mc146818rtc.h
@@ -11,6 +11,7 @@
 #include <asm/atarihw.h>
 
 #define RTC_PORT(x)     (TT_RTC_BAS + 2*(x))
+#define RTC_ALWAYS_BCD  0
 
 #define CMOS_READ(addr) ({ \
 atari_outb_p((addr),RTC_PORT(0)); \
diff --git a/include/asm-mips/atomic.h b/include/asm-mips/atomic.h
index 8578869a8bcf..1ac50b6c47ad 100644
--- a/include/asm-mips/atomic.h
+++ b/include/asm-mips/atomic.h
@@ -79,9 +79,9 @@ static __inline__ void atomic_add(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter += i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -124,9 +124,9 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter -= i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -173,11 +173,11 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result += i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -225,11 +225,11 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -293,12 +293,12 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 if (result >= 0)
                         v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -454,9 +454,9 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter += i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -499,9 +499,9 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 v->counter -= i;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -548,11 +548,11 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result += i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -600,11 +600,11 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
@@ -668,12 +668,12 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 result = v->counter;
                 result -= i;
                 if (result >= 0)
                         v->counter = result;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 
         smp_mb();
diff --git a/include/asm-mips/bitops.h b/include/asm-mips/bitops.h
index 8959da245cfb..d995413e11fd 100644
--- a/include/asm-mips/bitops.h
+++ b/include/asm-mips/bitops.h
@@ -100,9 +100,9 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 *a |= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -165,9 +165,9 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 *a &= ~mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -220,9 +220,9 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 *a ^= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
         }
 }
 
@@ -287,10 +287,10 @@ static inline int test_and_set_bit(unsigned long nr,
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = (mask & *a) != 0;
                 *a |= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
 
                 return retval;
         }
@@ -381,10 +381,10 @@ static inline int test_and_clear_bit(unsigned long nr,
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = (mask & *a) != 0;
                 *a &= ~mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
 
                 return retval;
         }
@@ -452,10 +452,10 @@ static inline int test_and_change_bit(unsigned long nr,
 
                 a += nr >> SZLONG_LOG;
                 mask = 1UL << bit;
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = (mask & *a) != 0;
                 *a ^= mask;
-                local_irq_restore(flags);
+                raw_local_irq_restore(flags);
 
                 return retval;
         }
diff --git a/include/asm-mips/cacheflush.h b/include/asm-mips/cacheflush.h
index 0ddada3bb0b6..28d907d4347a 100644
--- a/include/asm-mips/cacheflush.h
+++ b/include/asm-mips/cacheflush.h
@@ -48,6 +48,15 @@ static inline void flush_dcache_page(struct page *page)
 #define flush_dcache_mmap_lock(mapping)         do { } while (0)
 #define flush_dcache_mmap_unlock(mapping)       do { } while (0)
 
+#define ARCH_HAS_FLUSH_ANON_PAGE
+extern void __flush_anon_page(struct page *, unsigned long);
+static inline void flush_anon_page(struct vm_area_struct *vma,
+        struct page *page, unsigned long vmaddr)
+{
+        if (cpu_has_dc_aliases && PageAnon(page))
+                __flush_anon_page(page, vmaddr);
+}
+
 static inline void flush_icache_page(struct vm_area_struct *vma,
         struct page *page)
 {
@@ -86,4 +95,7 @@ extern void (*flush_data_cache_page)(unsigned long addr);
 /* Run kernel code uncached, useful for cache probing functions. */
 unsigned long __init run_uncached(void *func);
 
+extern void *kmap_coherent(struct page *page, unsigned long addr);
+extern void kunmap_coherent(struct page *page);
+
 #endif /* _ASM_CACHEFLUSH_H */
diff --git a/include/asm-mips/cpu-features.h b/include/asm-mips/cpu-features.h
index eadca266f159..5e4bed123b48 100644
--- a/include/asm-mips/cpu-features.h
+++ b/include/asm-mips/cpu-features.h
@@ -40,6 +40,9 @@
 #endif
 #ifndef cpu_has_fpu
 #define cpu_has_fpu             (current_cpu_data.options & MIPS_CPU_FPU)
+#define raw_cpu_has_fpu         (raw_current_cpu_data.options & MIPS_CPU_FPU)
+#else
+#define raw_cpu_has_fpu         cpu_has_fpu
 #endif
 #ifndef cpu_has_32fpr
 #define cpu_has_32fpr           (cpu_data[0].options & MIPS_CPU_32FPR)
diff --git a/include/asm-mips/cpu-info.h b/include/asm-mips/cpu-info.h
index 610d0cdeaa9e..22fe8453fcc7 100644
--- a/include/asm-mips/cpu-info.h
+++ b/include/asm-mips/cpu-info.h
@@ -87,6 +87,7 @@ struct cpuinfo_mips {
 
 extern struct cpuinfo_mips cpu_data[];
 #define current_cpu_data cpu_data[smp_processor_id()]
+#define raw_current_cpu_data cpu_data[raw_smp_processor_id()]
 
 extern void cpu_probe(void);
 extern void cpu_report(void);
diff --git a/include/asm-mips/delay.h b/include/asm-mips/delay.h
index ea77050f8e3a..223d156efb9f 100644
--- a/include/asm-mips/delay.h
+++ b/include/asm-mips/delay.h
@@ -79,7 +79,7 @@ static inline void __udelay(unsigned long usecs, unsigned long lpj)
         __delay(usecs);
 }
 
-#define __udelay_val cpu_data[smp_processor_id()].udelay_val
+#define __udelay_val cpu_data[raw_smp_processor_id()].udelay_val
 
 #define udelay(usecs) __udelay((usecs),__udelay_val)
 
diff --git a/include/asm-mips/fpu.h b/include/asm-mips/fpu.h
index efef843b93f0..4e12d1f9534f 100644
--- a/include/asm-mips/fpu.h
+++ b/include/asm-mips/fpu.h
@@ -27,11 +27,11 @@
 struct sigcontext;
 struct sigcontext32;
 
-extern asmlinkage int (*save_fp_context)(struct sigcontext *sc);
-extern asmlinkage int (*restore_fp_context)(struct sigcontext *sc);
+extern asmlinkage int (*save_fp_context)(struct sigcontext __user *sc);
+extern asmlinkage int (*restore_fp_context)(struct sigcontext __user *sc);
 
-extern asmlinkage int (*save_fp_context32)(struct sigcontext32 *sc);
-extern asmlinkage int (*restore_fp_context32)(struct sigcontext32 *sc);
+extern asmlinkage int (*save_fp_context32)(struct sigcontext32 __user *sc);
+extern asmlinkage int (*restore_fp_context32)(struct sigcontext32 __user *sc);
 
 extern void fpu_emulator_init_fpu(void);
 extern void _init_fpu(void);
@@ -68,6 +68,8 @@ do {									\
         /* We don't care about the c0 hazard here  */                   \
 } while (0)
 
+#define __fpu_enabled() (read_c0_status() & ST0_CU1)
+
 #define enable_fpu()                                                    \
 do {                                                                    \
         if (cpu_has_fpu)                                                \
@@ -93,31 +95,47 @@ static inline int is_fpu_owner(void)
         return cpu_has_fpu && __is_fpu_owner();
 }
 
-static inline void own_fpu(void)
+static inline void __own_fpu(void)
 {
-        if (cpu_has_fpu) {
-                __enable_fpu();
-                KSTK_STATUS(current) |= ST0_CU1;
-                set_thread_flag(TIF_USEDFPU);
+        __enable_fpu();
+        KSTK_STATUS(current) |= ST0_CU1;
+        set_thread_flag(TIF_USEDFPU);
+}
+
+static inline void own_fpu(int restore)
+{
+        preempt_disable();
+        if (cpu_has_fpu && !__is_fpu_owner()) {
+                __own_fpu();
+                if (restore)
+                        _restore_fp(current);
         }
+        preempt_enable();
 }
 
-static inline void lose_fpu(void)
+static inline void lose_fpu(int save)
 {
-        if (cpu_has_fpu) {
+        preempt_disable();
+        if (is_fpu_owner()) {
+                if (save)
+                        _save_fp(current);
                 KSTK_STATUS(current) &= ~ST0_CU1;
                 clear_thread_flag(TIF_USEDFPU);
                 __disable_fpu();
         }
+        preempt_enable();
 }
 
 static inline void init_fpu(void)
 {
+        preempt_disable();
         if (cpu_has_fpu) {
+                __own_fpu();
                 _init_fpu();
         } else {
                 fpu_emulator_init_fpu();
         }
+        preempt_enable();
 }
 
 static inline void save_fp(struct task_struct *tsk)
@@ -144,4 +162,18 @@ static inline fpureg_t *get_fpu_regs(struct task_struct *tsk)
         return tsk->thread.fpu.fpr;
 }
 
+static inline void enable_fp_in_kernel(void)
+{
+        set_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
+        /* make sure CU1 and FPU ownership are consistent */
+        if (!__is_fpu_owner() && __fpu_enabled())
+                __disable_fpu();
+}
+
+static inline void disable_fp_in_kernel(void)
+{
+        BUG_ON(!__is_fpu_owner() && __fpu_enabled());
+        clear_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
+}
+
 #endif /* _ASM_FPU_H */
diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
index 50073157a617..e50c77e69cb5 100644
--- a/include/asm-mips/hazards.h
+++ b/include/asm-mips/hazards.h
@@ -52,6 +52,7 @@ ASMMACRO(tlb_probe_hazard,
          _ehb
         )
 ASMMACRO(irq_enable_hazard,
+         _ehb
         )
 ASMMACRO(irq_disable_hazard,
         _ehb
diff --git a/include/asm-mips/mach-au1x00/au1xxx_ide.h b/include/asm-mips/mach-au1x00/au1xxx_ide.h
index e9fa252f8a3f..8fcae21adbd5 100644
--- a/include/asm-mips/mach-au1x00/au1xxx_ide.h
+++ b/include/asm-mips/mach-au1x00/au1xxx_ide.h
@@ -141,40 +141,6 @@ static int auide_ddma_init( _auide_hwif *auide );
 static void auide_setup_ports(hw_regs_t *hw, _auide_hwif *ahwif);
 int __init auide_probe(void);
 
-#ifdef CONFIG_PM
-        int au1200ide_pm_callback( au1xxx_power_dev_t *dev,
-                                   au1xxx_request_t request, void *data);
-        static int au1xxxide_pm_standby( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_sleep( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_resume( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_getstatus( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_access( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_idle( au1xxx_power_dev_t *dev );
-        static int au1xxxide_pm_cleanup( au1xxx_power_dev_t *dev );
-#endif
-
-
-/*
- * Multi-Word DMA + DbDMA functions
- */
-#ifdef CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA
-        static int auide_build_sglist(ide_drive_t *drive,  struct request *rq);
-        static int auide_build_dmatable(ide_drive_t *drive);
-        static int auide_dma_end(ide_drive_t *drive);
-        ide_startstop_t auide_dma_intr (ide_drive_t *drive);
-        static void auide_dma_exec_cmd(ide_drive_t *drive, u8 command);
-        static int auide_dma_setup(ide_drive_t *drive);
-        static int auide_dma_check(ide_drive_t *drive);
-        static int auide_dma_test_irq(ide_drive_t *drive);
-        static int auide_dma_host_off(ide_drive_t *drive);
-        static int auide_dma_host_on(ide_drive_t *drive);
-        static int auide_dma_lostirq(ide_drive_t *drive);
-        static int auide_dma_on(ide_drive_t *drive);
-        static void auide_ddma_tx_callback(int irq, void *param);
-        static void auide_ddma_rx_callback(int irq, void *param);
-        static int auide_dma_off_quietly(ide_drive_t *drive);
-#endif /* end CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA */
-
 /*******************************************************************************
 * PIO Mode timing calculation :                                                *
 *                                                                              *
diff --git a/include/asm-mips/mach-ip27/dma-coherence.h b/include/asm-mips/mach-ip27/dma-coherence.h
index 659816e200d4..3fdbbf68e952 100644
--- a/include/asm-mips/mach-ip27/dma-coherence.h
+++ b/include/asm-mips/mach-ip27/dma-coherence.h
@@ -18,7 +18,8 @@
 
 struct device;
 
-static dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
+        size_t size)
 {
         dma_addr_t pa = dev_to_baddr(dev, virt_to_phys(addr));
 
@@ -37,7 +38,7 @@ static unsigned long plat_dma_addr_to_phys(dma_addr_t dma_addr)
         return dma_addr & (0xffUL << 56);
 }
 
-static void plat_unmap_dma_mem(dma_addr_t dma_addr)
+static inline void plat_unmap_dma_mem(dma_addr_t dma_addr)
 {
 }
 
diff --git a/include/asm-mips/mach-ip32/dma-coherence.h b/include/asm-mips/mach-ip32/dma-coherence.h
index 950be17bbb86..c3f9a6a20eb0 100644
--- a/include/asm-mips/mach-ip32/dma-coherence.h
+++ b/include/asm-mips/mach-ip32/dma-coherence.h
@@ -26,7 +26,8 @@ struct device;
 
 #define RAM_OFFSET_MASK 0x3fffffffUL
 
-static dma_addr_t plat_map_dma_mem(struct device *dev, void *addr, size_t size)
+static inline dma_addr_t plat_map_dma_mem(struct device *dev, void *addr,
+        size_t size)
 {
         dma_addr_t pa = virt_to_phys(addr) & RAM_OFFSET_MASK;
 
@@ -59,7 +60,7 @@ static unsigned long plat_dma_addr_to_phys(dma_addr_t dma_addr)
         return addr;
 }
 
-static void plat_unmap_dma_mem(dma_addr_t dma_addr)
+static inline void plat_unmap_dma_mem(dma_addr_t dma_addr)
 {
 }
 
diff --git a/include/asm-mips/pgtable-64.h b/include/asm-mips/pgtable-64.h
index a5b18710b6a4..49f5a1a2dfcd 100644
--- a/include/asm-mips/pgtable-64.h
+++ b/include/asm-mips/pgtable-64.h
@@ -199,7 +199,7 @@ static inline unsigned long pud_page_vaddr(pud_t pud)
 {
         return pud_val(pud);
 }
-#define pud_phys(pud)           (pud_val(pud) - PAGE_OFFSET)
+#define pud_phys(pud)           virt_to_phys((void *)pud_val(pud))
 #define pud_page(pud)           (pfn_to_page(pud_phys(pud) >> PAGE_SHIFT))
 
 /* Find an entry in the second-level page table.. */
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index 3fcfd7979de5..0d3295f57a95 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -75,7 +75,7 @@ extern void paging_init(void);
  * Conversion functions: convert a page and protection to a page entry,
  * and a page entry and page directory to the page they refer to.
  */
-#define pmd_phys(pmd)           (pmd_val(pmd) - PAGE_OFFSET)
+#define pmd_phys(pmd)           virt_to_phys((void *)pmd_val(pmd))
 #define pmd_page(pmd)           (pfn_to_page(pmd_phys(pmd) >> PAGE_SHIFT))
 #define pmd_page_vaddr(pmd)     pmd_val(pmd)
 
diff --git a/include/asm-mips/rtlx.h b/include/asm-mips/rtlx.h
index 59162f74a798..65778c890a62 100644
--- a/include/asm-mips/rtlx.h
+++ b/include/asm-mips/rtlx.h
@@ -23,8 +23,8 @@
 
 extern int rtlx_open(int index, int can_sleep);
 extern int rtlx_release(int index);
-extern ssize_t rtlx_read(int index, void *buff, size_t count, int user);
-extern ssize_t rtlx_write(int index, void *buffer, size_t count, int user);
+extern ssize_t rtlx_read(int index, void __user *buff, size_t count);
+extern ssize_t rtlx_write(int index, const void __user *buffer, size_t count);
 extern unsigned int rtlx_read_poll(int index, int can_sleep);
 extern unsigned int rtlx_write_poll(int index);
 
diff --git a/include/asm-mips/sgiarcs.h b/include/asm-mips/sgiarcs.h
index ddb859d05257..439bce7daa3a 100644
--- a/include/asm-mips/sgiarcs.h
+++ b/include/asm-mips/sgiarcs.h
@@ -459,7 +459,7 @@ struct linux_smonblock {
         register signed int __a2 __asm__("$5") = (int) (long) (a2);     \
         register signed int __a3 __asm__("$6") = (int) (long) (a3);     \
         register signed int __a4 __asm__("$7") = (int) (long) (a4);     \
-        register signed int __a5 = (a5);                                \
+        register signed int __a5 = (int) (long) (a5);                   \
         long __vec = (long) romvec->dest;                               \
         __asm__ __volatile__(                                           \
         "dsubu\t$29, 32\n\t"                                            \
diff --git a/include/asm-mips/sibyte/sb1250.h b/include/asm-mips/sibyte/sb1250.h
index dfb29e13bce0..494aa65dcfbd 100644
--- a/include/asm-mips/sibyte/sb1250.h
+++ b/include/asm-mips/sibyte/sb1250.h
@@ -67,6 +67,6 @@ extern void bcm1480_smp_finish(void);
 
 #endif
 
-#define IOADDR(a) ((volatile void __iomem *)(IO_BASE + (a)))
+#define IOADDR(a) ((void __iomem *)(IO_BASE + (a)))
 
 #endif
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index 597a3743f6a1..290887077e44 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -121,10 +121,10 @@ static inline unsigned long __xchg_u32(volatile int * m, unsigned int val)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 *m = val;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
@@ -169,10 +169,10 @@ static inline __u64 __xchg_u64(volatile __u64 * m, __u64 val)
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 *m = val;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
@@ -250,11 +250,11 @@ static inline unsigned long __cmpxchg_u32(volatile int * m, unsigned long old,
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 if (retval == old)
                         *m = new;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
@@ -304,11 +304,11 @@ static inline unsigned long __cmpxchg_u64(volatile int * m, unsigned long old,
         } else {
                 unsigned long flags;
 
-                local_irq_save(flags);
+                raw_local_irq_save(flags);
                 retval = *m;
                 if (retval == old)
                         *m = new;
-                local_irq_restore(flags);       /* implies memory barrier  */
+                raw_local_irq_restore(flags);   /* implies memory barrier  */
         }
 
         smp_mb();
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index fbcda8204473..6cf05f4a4e7e 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -119,6 +119,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
 #define TIF_FREEZE              19
+#define TIF_ALLOW_FP_IN_KERNEL  20
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
 
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
diff --git a/include/asm-powerpc/floppy.h b/include/asm-powerpc/floppy.h
index a0f14eea1da5..afa700ded877 100644
--- a/include/asm-powerpc/floppy.h
+++ b/include/asm-powerpc/floppy.h
@@ -178,7 +178,7 @@ static struct fd_dma_ops virt_dma_ops =
         ._dma_setup = vdma_dma_setup
 };
 
-static int fd_request_dma()
+static int fd_request_dma(void)
 {
         if (can_use_virtual_dma & 1) {
                 fd_ops = &virt_dma_ops;
diff --git a/include/asm-powerpc/hvcall.h b/include/asm-powerpc/hvcall.h
index 60977806d2f4..62efd9d7a43d 100644
--- a/include/asm-powerpc/hvcall.h
+++ b/include/asm-powerpc/hvcall.h
@@ -237,6 +237,20 @@ long plpar_hcall_norets(unsigned long opcode, ...);
 long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...);
 
 /**
+ * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats
+ * @opcode: The hypervisor call to make.
+ * @retbuf: Buffer to store up to 4 return arguments in.
+ *
+ * This call supports up to 6 arguments and 4 return arguments. Use
+ * PLPAR_HCALL_BUFSIZE to size the return argument buffer.
+ *
+ * Used when phyp interface needs to be called in real mode. Similar to
+ * plpar_hcall, but plpar_hcall_raw works in real mode and does not
+ * calculate hypervisor call statistics.
+ */
+long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...);
+
+/**
  * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments
  * @opcode: The hypervisor call to make.
  * @retbuf: Buffer to store up to 9 return arguments in.
diff --git a/include/asm-powerpc/spu.h b/include/asm-powerpc/spu.h
index 0f9f2dd24a79..31d5054be20f 100644
--- a/include/asm-powerpc/spu.h
+++ b/include/asm-powerpc/spu.h
@@ -165,6 +165,13 @@ int spu_irq_class_0_bottom(struct spu *spu);
 int spu_irq_class_1_bottom(struct spu *spu);
 void spu_irq_setaffinity(struct spu *spu, int cpu);
 
+extern void spu_invalidate_slbs(struct spu *spu);
+extern void spu_associate_mm(struct spu *spu, struct mm_struct *mm);
+
+/* Calls from the memory management to the SPU */
+struct mm_struct;
+extern void spu_flush_all_slbs(struct mm_struct *mm);
+
 /* system callbacks from the SPU */
 struct spu_syscall_block {
         u64 nr_ret;
diff --git a/include/asm-powerpc/spu_csa.h b/include/asm-powerpc/spu_csa.h
index bdbf906a767f..8aad0619eb8e 100644
--- a/include/asm-powerpc/spu_csa.h
+++ b/include/asm-powerpc/spu_csa.h
@@ -221,8 +221,6 @@ struct spu_priv2_collapsed {
  * @spu_chnlcnt_RW: Array of saved channel counts.
  * @spu_chnldata_RW: Array of saved channel data.
  * @suspend_time: Time stamp when decrementer disabled.
- * @slb_esid_RW: Array of saved SLB esid entries.
- * @slb_vsid_RW: Array of saved SLB vsid entries.
  *
  * Structure representing the whole of the SPU
  * context save area (CSA).  This struct contains
@@ -245,8 +243,6 @@ struct spu_state {
         u32 spu_mailbox_data[4];
         u32 pu_mailbox_data[1];
         unsigned long suspend_time;
-        u64 slb_esid_RW[8];
-        u64 slb_vsid_RW[8];
         spinlock_t register_lock;
 };
 
diff --git a/include/asm-powerpc/systbl.h b/include/asm-powerpc/systbl.h
index 418e5c7e972c..8d853c554631 100644
--- a/include/asm-powerpc/systbl.h
+++ b/include/asm-powerpc/systbl.h
@@ -304,5 +304,6 @@ SYSCALL_SPU(fchmodat)
 SYSCALL_SPU(faccessat)
 COMPAT_SYS_SPU(get_robust_list)
 COMPAT_SYS_SPU(set_robust_list)
-COMPAT_SYS(move_pages)
+COMPAT_SYS_SPU(move_pages)
 SYSCALL_SPU(getcpu)
+COMPAT_SYS(epoll_pwait)
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index 0ae954e3d258..2baedbe54e13 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -324,10 +324,12 @@
 #define __NR_get_robust_list    299
 #define __NR_set_robust_list    300
 #define __NR_move_pages         301
+#define __NR_getcpu             302
+#define __NR_epoll_pwait        303
 
 #ifdef __KERNEL__
 
-#define __NR_syscalls           302
+#define __NR_syscalls           304
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/include/asm-s390/checksum.h b/include/asm-s390/checksum.h
index 0a3cd7ec8451..d5a8e7c1477c 100644
--- a/include/asm-s390/checksum.h
+++ b/include/asm-s390/checksum.h
@@ -121,50 +121,21 @@ csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
                    unsigned short len, unsigned short proto,
                    __wsum sum)
 {
-#ifndef __s390x__
-        asm volatile(
-                "       alr     %0,%1\n" /* sum += saddr */
-                "       brc     12,0f\n"
-                "       ahi     %0,1\n"  /* add carry */
-                "0:"
-                : "+&d" (sum) : "d" (saddr) : "cc");
-        asm volatile(
-                "       alr     %0,%1\n" /* sum += daddr */
-                "       brc     12,1f\n"
-                "       ahi     %0,1\n"  /* add carry */
-                "1:"
-                : "+&d" (sum) : "d" (daddr) : "cc");
-        asm volatile(
-                "       alr     %0,%1\n" /* sum += len + proto */
-                "       brc     12,2f\n"
-                "       ahi     %0,1\n"  /* add carry */
-                "2:"
-                : "+&d" (sum)
-                : "d" (len + proto)
-                : "cc");
-#else /* __s390x__ */
-        asm volatile(
-                "       lgfr    %0,%0\n"
-                "       algr    %0,%1\n"  /* sum += saddr */
-                "       brc     12,0f\n"
-                "       aghi    %0,1\n"   /* add carry */
-                "0:     algr    %0,%2\n"  /* sum += daddr */
-                "       brc     12,1f\n"
-                "       aghi    %0,1\n"   /* add carry */
-                "1:     algfr   %0,%3\n"  /* sum += len + proto */
-                "       brc     12,2f\n"
-                "       aghi    %0,1\n"   /* add carry */
-                "2:     srlg    0,%0,32\n"
-                "       alr     %0,0\n"   /* fold to 32 bits */
-                "       brc     12,3f\n"
-                "       ahi     %0,1\n"   /* add carry */
-                "3:     llgfr   %0,%0"
-                : "+&d" (sum)
-                : "d" (saddr), "d" (daddr),
-                  "d" (len + proto)
-                : "cc", "0");
-#endif /* __s390x__ */
-        return sum;
+        __u32 csum = (__force __u32)sum;
+
+        csum += (__force __u32)saddr;
+        if (csum < (__force __u32)saddr)
+                csum++;
+
+        csum += (__force __u32)daddr;
+        if (csum < (__force __u32)daddr)
+                csum++;
+
+        csum += len + proto;
+        if (csum < len + proto)
+                csum++;
+
+        return (__force __wsum)csum;
 }
 
 /*
diff --git a/include/asm-s390/ipl.h b/include/asm-s390/ipl.h
index 660f78271a93..0eb64083480a 100644
--- a/include/asm-s390/ipl.h
+++ b/include/asm-s390/ipl.h
@@ -14,9 +14,13 @@
 #define IPL_PARM_BLK_FCP_LEN (sizeof(struct ipl_list_hdr) + \
                               sizeof(struct ipl_block_fcp))
 
+#define IPL_PARM_BLK0_FCP_LEN (sizeof(struct ipl_block_fcp) + 8)
+
 #define IPL_PARM_BLK_CCW_LEN (sizeof(struct ipl_list_hdr) + \
                               sizeof(struct ipl_block_ccw))
 
+#define IPL_PARM_BLK0_CCW_LEN (sizeof(struct ipl_block_ccw) + 8)
+
 #define IPL_MAX_SUPPORTED_VERSION (0)
 
 #define IPL_PARMBLOCK_START     ((struct ipl_parameter_block *) \
@@ -58,6 +62,7 @@ struct ipl_block_ccw {
         u8  vm_flags;
         u8  reserved3[3];
         u32 vm_parm_len;
+        u8  reserved4[80];
 } __attribute__((packed));
 
 struct ipl_parameter_block {
diff --git a/include/asm-s390/unistd.h b/include/asm-s390/unistd.h
index fb6fef97d739..5c6f00d62df8 100644
--- a/include/asm-s390/unistd.h
+++ b/include/asm-s390/unistd.h
@@ -250,8 +250,9 @@
 /* Number 310 is reserved for new sys_move_pages */
 #define __NR_getcpu             311
 #define __NR_epoll_pwait        312
+#define __NR_utimes             313
 
-#define NR_syscalls 313
+#define NR_syscalls 314
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/include/asm-sh/ioctls.h b/include/asm-sh/ioctls.h
index 9d84a2d445a2..35805df010a0 100644
--- a/include/asm-sh/ioctls.h
+++ b/include/asm-sh/ioctls.h
@@ -16,17 +16,17 @@
 #define TCSETSW         0x5403
 #define TCSETSF         0x5404
 
-#define TCGETA          _IOR('t', 23, struct termio)
-#define TCSETA          _IOW('t', 24, struct termio)
-#define TCSETAW         _IOW('t', 25, struct termio)
-#define TCSETAF         _IOW('t', 28, struct termio)
+#define TCGETA          0x80127417      /* _IOR('t', 23, struct termio) */
+#define TCSETA          0x40127418      /* _IOW('t', 24, struct termio) */
+#define TCSETAW         0x40127419      /* _IOW('t', 25, struct termio) */
+#define TCSETAF         0x4012741C      /* _IOW('t', 28, struct termio) */
 
 #define TCSBRK          _IO('t', 29)
 #define TCXONC          _IO('t', 30)
 #define TCFLSH          _IO('t', 31)
 
-#define TIOCSWINSZ      _IOW('t', 103, struct winsize)
-#define TIOCGWINSZ      _IOR('t', 104, struct winsize)
+#define TIOCSWINSZ      0x40087467      /* _IOW('t', 103, struct winsize) */
+#define TIOCGWINSZ      0x80087468      /* _IOR('t', 104, struct winsize) */
 #define TIOCSTART       _IO('t', 110)           /* start output, like ^Q */
 #define TIOCSTOP        _IO('t', 111)           /* stop output, like ^S */
 #define TIOCOUTQ        _IOR('t', 115, int)     /* output queue size */
@@ -59,8 +59,8 @@
 #define TIOCSSOFTCAR    _IOW('T', 26, unsigned int) /* 0x541A */
 #define TIOCLINUX       _IOW('T', 28, char) /* 0x541C */
 #define TIOCCONS        _IO('T', 29) /* 0x541D */
-#define TIOCGSERIAL     _IOR('T', 30, struct serial_struct) /* 0x541E */
-#define TIOCSSERIAL     _IOW('T', 31, struct serial_struct) /* 0x541F */
+#define TIOCGSERIAL     0x803C541E      /* _IOR('T', 30, struct serial_struct) 0x541E */
+#define TIOCSSERIAL     0x403C541F      /* _IOW('T', 31, struct serial_struct) 0x541F */
 #define TIOCPKT         _IOW('T', 32, int) /* 0x5420 */
 # define TIOCPKT_DATA            0
 # define TIOCPKT_FLUSHREAD       1
@@ -86,12 +86,12 @@
 #define TIOCSERSWILD    _IOW('T', 85,  int) /* 0x5455 */
 #define TIOCGLCKTRMIOS  0x5456
 #define TIOCSLCKTRMIOS  0x5457
-#define TIOCSERGSTRUCT  _IOR('T', 88, struct async_struct) /* 0x5458 */ /* For debugging only */
+#define TIOCSERGSTRUCT  0x80d85458      /* _IOR('T', 88, struct async_struct) 0x5458 */ /* For debugging only */
 #define TIOCSERGETLSR   _IOR('T', 89, unsigned int) /* 0x5459 */ /* Get line status register */
   /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
 # define TIOCSER_TEMT    0x01   /* Transmitter physically empty */
-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* 0x545A */ /* Get multiport config  */
-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* 0x545B */ /* Set multiport config */
+#define TIOCSERGETMULTI 0x80A8545A      /* _IOR('T', 90, struct serial_multiport_struct) 0x545A */ /* Get multiport config */
+#define TIOCSERSETMULTI 0x40A8545B      /* _IOW('T', 91, struct serial_multiport_struct) 0x545B */ /* Set multiport config */
 
 #define TIOCMIWAIT      _IO('T', 92) /* 0x545C */       /* wait for a change on serial input line(s) */
 #define TIOCGICOUNT     0x545D  /* read serial port inline interrupt counts */
diff --git a/include/asm-sh/irq.h b/include/asm-sh/irq.h
index 8ccf7ae593ef..afe188f0ad5f 100644
--- a/include/asm-sh/irq.h
+++ b/include/asm-sh/irq.h
@@ -94,8 +94,13 @@
 /*
  * Convert back and forth between INTEVT and IRQ values.
  */
+#ifdef CONFIG_CPU_HAS_INTEVT
 #define evt2irq(evt)            (((evt) >> 5) - 16)
 #define irq2evt(irq)            (((irq) + 16) << 5)
+#else
+#define evt2irq(evt)            (evt)
+#define irq2evt(irq)            (irq)
+#endif
 
 /*
  * Simple Mask Register Support
diff --git a/include/asm-sh/unistd.h b/include/asm-sh/unistd.h
index 17f527bfd455..49be50a36b77 100644
--- a/include/asm-sh/unistd.h
+++ b/include/asm-sh/unistd.h
@@ -233,6 +233,7 @@
 #define __NR_fcntl64            221
 /* 223 is unused */
 #define __NR_gettid             224
+#define __NR_readahead          225
 #define __NR_setxattr           226
 #define __NR_lsetxattr          227
 #define __NR_fsetxattr          228
diff --git a/include/asm-sparc/dma-mapping.h b/include/asm-sparc/dma-mapping.h
index 6db83dc93cb7..f3a641e6b2c8 100644
--- a/include/asm-sparc/dma-mapping.h
+++ b/include/asm-sparc/dma-mapping.h
@@ -5,20 +5,7 @@
 #ifdef CONFIG_PCI
 #include <asm-generic/dma-mapping.h>
 #else
-
-static inline void *dma_alloc_coherent(struct device *dev, size_t size,
-                         dma_addr_t *dma_handle, gfp_t flag)
-{
-        BUG();
-        return NULL;
-}
-
-static inline void dma_free_coherent(struct device *dev, size_t size,
-                       void *vaddr, dma_addr_t dma_handle)
-{
-        BUG();
-}
-
+#include <asm-generic/dma-mapping-broken.h>
 #endif /* PCI */
 
 #endif /* _ASM_SPARC_DMA_MAPPING_H */
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index d5b2f8053b3b..e43ed1d63a9d 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -319,16 +319,17 @@
 #define __NR_set_robust_list    300
 #define __NR_get_robust_list    301
 #define __NR_migrate_pages      302
+#define __NR_mbind              303
+#define __NR_get_mempolicy      304
+#define __NR_set_mempolicy      305
+#define __NR_kexec_load         306
+#define __NR_move_pages         307
+#define __NR_getcpu             308
+#define __NR_epoll_pwait        309
 
-#define NR_SYSCALLS             303
+#define NR_SYSCALLS             310
 
 #ifdef __KERNEL__
-/* WARNING: You MAY NOT add syscall numbers larger than 302, since
- *          all of the syscall tables in the Sparc kernel are
- *          sized to have 302 entries (starting at zero).  Therefore
- *          find a free slot in the 0-302 range.
- */
-
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
@@ -345,7 +346,6 @@
 #define __ARCH_WANT_SYS_GETPGRP
 #define __ARCH_WANT_SYS_LLSEEK
 #define __ARCH_WANT_SYS_NICE
-#define __ARCH_WANT_SYS_OLD_GETRLIMIT
 #define __ARCH_WANT_SYS_OLDUMOUNT
 #define __ARCH_WANT_SYS_SIGPENDING
 #define __ARCH_WANT_SYS_SIGPROCMASK
diff --git a/include/asm-sparc64/tsb.h b/include/asm-sparc64/tsb.h
index e82612cd9f33..ab55ffcb7bf4 100644
--- a/include/asm-sparc64/tsb.h
+++ b/include/asm-sparc64/tsb.h
@@ -264,6 +264,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
         be,a,pt         %xcc, OK_LABEL; \
          mov            REG4, REG1;
 
+#ifndef CONFIG_DEBUG_PAGEALLOC
         /* This version uses a trick, the TAG is already (VADDR >> 22) so
          * we can make use of that for the index computation.
          */
@@ -277,5 +278,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
         cmp             REG3, TAG; \
         be,a,pt         %xcc, OK_LABEL; \
          mov            REG4, REG1;
+#endif
 
 #endif /* !(_SPARC64_TSB_H) */
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index 47047536f261..e2dcb87e0c62 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -321,17 +321,17 @@
 #define __NR_set_robust_list    300
 #define __NR_get_robust_list    301
 #define __NR_migrate_pages      302
+#define __NR_mbind              303
+#define __NR_get_mempolicy      304
+#define __NR_set_mempolicy      305
+#define __NR_kexec_load         306
+#define __NR_move_pages         307
+#define __NR_getcpu             308
+#define __NR_epoll_pwait        309
 
-#define NR_SYSCALLS             303
+#define NR_SYSCALLS             310
 
 #ifdef __KERNEL__
-
-/* WARNING: You MAY NOT add syscall numbers larger than 302, since
- *          all of the syscall tables in the Sparc kernel are
- *          sized to have 302 entries (starting at zero).  Therefore
- *          find a free slot in the 0-302 range.
- */
-
 /* sysconf options, for SunOS compatibility */
 #define   _SC_ARG_MAX             1
 #define   _SC_CHILD_MAX           2
@@ -359,7 +359,6 @@
 #define __ARCH_WANT_SYS_GETPGRP
 #define __ARCH_WANT_SYS_LLSEEK
 #define __ARCH_WANT_SYS_NICE
-#define __ARCH_WANT_SYS_OLD_GETRLIMIT
 #define __ARCH_WANT_SYS_OLDUMOUNT
 #define __ARCH_WANT_SYS_SIGPENDING
 #define __ARCH_WANT_SYS_SIGPROCMASK
diff --git a/include/asm-um/common.lds.S b/include/asm-um/common.lds.S
index f0454516dd31..b16222b42821 100644
--- a/include/asm-um/common.lds.S
+++ b/include/asm-um/common.lds.S
@@ -15,6 +15,7 @@
   PROVIDE (_unprotected_end = .);
 
   . = ALIGN(4096);
+  .note : { *(note.*) }
   __start___ex_table = .;
   __ex_table : { *(__ex_table) }
   __stop___ex_table = .;
diff --git a/include/asm-x86_64/apic.h b/include/asm-x86_64/apic.h
index e81d0f289f0b..7cfb39cbd918 100644
--- a/include/asm-x86_64/apic.h
+++ b/include/asm-x86_64/apic.h
@@ -102,5 +102,6 @@ void switch_ipi_to_APIC_timer(void *cpumask);
 #define ARCH_APICTIMER_STOPS_ON_C3      1
 
 extern unsigned boot_cpu_id;
+extern int local_apic_timer_c2_ok;
 
 #endif /* __ASM_APIC_H */
diff --git a/include/asm-x86_64/nmi.h b/include/asm-x86_64/nmi.h
index ceb3d8dac33d..72375e7d32a8 100644
--- a/include/asm-x86_64/nmi.h
+++ b/include/asm-x86_64/nmi.h
@@ -64,7 +64,7 @@ extern int setup_nmi_watchdog(char *);
 
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
-#define NMI_DEFAULT     0
+#define NMI_DEFAULT     -1
 #define NMI_NONE        0
 #define NMI_IO_APIC     1
 #define NMI_LOCAL_APIC  2
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index f54f3abf93ce..b6e65a699f2a 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -99,7 +99,7 @@ extern int force_iommu, no_iommu;
 extern int iommu_detected;
 #ifdef CONFIG_IOMMU
 extern void gart_iommu_init(void);
-extern void gart_parse_options(char *);
+extern void __init gart_parse_options(char *);
 extern void iommu_hole_init(void);
 extern int fallback_aper_order;
 extern int fallback_aper_force;
diff --git a/include/asm-x86_64/smp.h b/include/asm-x86_64/smp.h
index e17b9ec42e98..de592a408c07 100644
--- a/include/asm-x86_64/smp.h
+++ b/include/asm-x86_64/smp.h
@@ -7,6 +7,7 @@
 #include <linux/threads.h>
 #include <linux/cpumask.h>
 #include <linux/bitops.h>
+#include <linux/init.h>
 extern int disable_apic;
 
 #include <asm/fixmap.h>
@@ -68,7 +69,7 @@ extern int __cpu_disable(void);
 extern void __cpu_die(unsigned int cpu);
 extern void prefill_possible_map(void);
 extern unsigned num_processors;
-extern unsigned disabled_cpus;
+extern unsigned __cpuinitdata disabled_cpus;
 
 #define NO_PROC_ID              0xFF            /* No processor magic marker */
 
diff --git a/include/asm-x86_64/uaccess.h b/include/asm-x86_64/uaccess.h
index 1981f70fcad1..9df30b939c4e 100644
--- a/include/asm-x86_64/uaccess.h
+++ b/include/asm-x86_64/uaccess.h
@@ -373,12 +373,12 @@ extern long __copy_user_nocache(void *dst, const void __user *src, unsigned size
 static inline int __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
 {
         might_sleep();
-        return __copy_user_nocache(dst, (__force void *)src, size, 1);
+        return __copy_user_nocache(dst, src, size, 1);
 }
 
 static inline int __copy_from_user_inatomic_nocache(void *dst, const void __user *src, unsigned size)
 {
-        return __copy_user_nocache(dst, (__force void *)src, size, 0);
+        return __copy_user_nocache(dst, src, size, 0);
 }
 
 #endif /* __X86_64_UACCESS_H */
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 7011d6255593..f2542c24b328 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -93,6 +93,7 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
 void clear_bdi_congested(struct backing_dev_info *bdi, int rw);
 void set_bdi_congested(struct backing_dev_info *bdi, int rw);
 long congestion_wait(int rw, long timeout);
+long congestion_wait_interruptible(int rw, long timeout);
 void congestion_end(int rw);
 
 #define bdi_cap_writeback_dirty(bdi) \
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 2275f2748708..81c07cd18643 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -108,7 +108,7 @@ static inline void *alloc_remap(int nid, unsigned long size)
 #endif /* CONFIG_HAVE_ARCH_ALLOC_REMAP */
 
 extern unsigned long __meminitdata nr_kernel_pages;
-extern unsigned long nr_all_pages;
+extern unsigned long __meminitdata nr_all_pages;
 
 extern void *alloc_large_system_hash(const char *tablename,
                                      unsigned long bucketsize,
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index aca66984aafd..3b6949b41745 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -15,8 +15,8 @@
 # define __acquire(x)   __context__(x,1)
 # define __release(x)   __context__(x,-1)
 # define __cond_lock(x,c)       ((c) ? ({ __acquire(x); 1; }) : 0)
-extern void __chk_user_ptr(void __user *);
-extern void __chk_io_ptr(void __iomem *);
+extern void __chk_user_ptr(const void __user *);
+extern void __chk_io_ptr(const void __iomem *);
 #else
 # define __user
 # define __kernel
diff --git a/include/linux/device.h b/include/linux/device.h
index 39a3199a826d..caad9bba9652 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -353,6 +353,8 @@ extern int __must_check device_create_bin_file(struct device *dev,
                                                struct bin_attribute *attr);
 extern void device_remove_bin_file(struct device *dev,
                                    struct bin_attribute *attr);
+extern int device_schedule_callback(struct device *dev,
+                void (*func)(struct device *));
 
 /* device resource management */
 typedef void (*dr_release_t)(struct device *dev, void *res);
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
index 84cfa8bbdc36..d2a96cbf4f0e 100644
--- a/include/linux/eventpoll.h
+++ b/include/linux/eventpoll.h
@@ -31,12 +31,19 @@
 /* 
  * On x86-64 make the 64bit structure have the same alignment as the
  * 32bit structure. This makes 32bit emulation easier.
+ *
+ * UML/x86_64 needs the same packing as x86_64 - UML + UML_X86 +
+ * 64_BIT adds up to UML/x86_64.
  */
 #ifdef __x86_64__
 #define EPOLL_PACKED __attribute__((packed))
 #else
+#if defined(CONFIG_UML) && defined(CONFIG_UML_X86) && defined(CONFIG_64BIT)
+#define EPOLL_PACKED __attribute__((packed))
+#else
 #define EPOLL_PACKED
 #endif
+#endif
 
 struct epoll_event {
         __u32 events;
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 34f2676b3c62..58564a199862 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -615,6 +615,7 @@ typedef struct ide_drive_s {
         u8      init_speed;     /* transfer rate set at boot */
         u8      pio_speed;      /* unused by core, used by some drivers for fallback from DMA */
         u8      current_speed;  /* current transfer rate set */
+        u8      desired_speed;  /* desired transfer rate set */
         u8      dn;             /* now wide spread use */
         u8      wcache;         /* status of write cache */
         u8      acoustic;       /* acoustic management */
diff --git a/include/linux/ipc.h b/include/linux/ipc.h
index 636094c29b16..6da6772c19ff 100644
--- a/include/linux/ipc.h
+++ b/include/linux/ipc.h
@@ -92,19 +92,16 @@ extern struct ipc_namespace init_ipc_ns;
 
 #ifdef CONFIG_SYSVIPC
 #define INIT_IPC_NS(ns)         .ns             = &init_ipc_ns,
+extern int copy_ipcs(unsigned long flags, struct task_struct *tsk);
 #else
 #define INIT_IPC_NS(ns)
+static inline int copy_ipcs(unsigned long flags, struct task_struct *tsk)
+{ return 0; }
 #endif
 
 #ifdef CONFIG_IPC_NS
 extern void free_ipc_ns(struct kref *kref);
-extern int copy_ipcs(unsigned long flags, struct task_struct *tsk);
 extern int unshare_ipcs(unsigned long flags, struct ipc_namespace **ns);
-#else
-static inline int copy_ipcs(unsigned long flags, struct task_struct *tsk)
-{
-        return 0;
-}
 #endif
 
 static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns)
diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
index 06c58c423fe1..506ad20c18f8 100644
--- a/include/linux/kbd_kern.h
+++ b/include/linux/kbd_kern.h
@@ -75,7 +75,7 @@ extern int do_poke_blanked_console;
 
 extern void (*kbd_ledfunc)(unsigned int led);
 
-extern void set_console(int nr);
+extern int set_console(int nr);
 extern void schedule_console_callback(void);
 
 static inline void set_leds(void)
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index c68c7ac6b232..248305bb9a18 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -57,7 +57,11 @@ typedef union {
 } ktime_t;
 
 #define KTIME_MAX                       ((s64)~((u64)1 << 63))
-#define KTIME_SEC_MAX                   (KTIME_MAX / NSEC_PER_SEC)
+#if (BITS_PER_LONG == 64)
+# define KTIME_SEC_MAX                  (KTIME_MAX / NSEC_PER_SEC)
+#else
+# define KTIME_SEC_MAX                  LONG_MAX
+#endif
 
 /*
  * ktime_t definitions when using the 64-bit scalar representation:
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 06fe93a3e916..14c937d345cb 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -245,7 +245,7 @@ extern void lock_release(struct lockdep_map *lock, int nested,
 
 # define INIT_LOCKDEP                           .lockdep_recursion = 0,
 
-#define lockdep_depth(tsk)      ((tsk)->lockdep_depth)
+#define lockdep_depth(tsk)      (debug_locks ? (tsk)->lockdep_depth : 0)
 
 #else /* !LOCKDEP */
 
diff --git a/include/linux/msi.h b/include/linux/msi.h
index 74c8a2ecc9dd..e38fe6822cb4 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -17,7 +17,7 @@ struct msi_desc {
         struct {
                 __u8    type    : 5;    /* {0: unused, 5h:MSI, 11h:MSI-X} */
                 __u8    maskbit : 1;    /* mask-pending bit supported ?   */
-                __u8    unused  : 1;
+                __u8    masked  : 1;
                 __u8    is_64   : 1;    /* Address size: 0=32bit 1=64bit  */
                 __u8    pos;            /* Location of the msi capability */
                 __u16   entry_nr;       /* specific enabled entry         */
@@ -32,10 +32,8 @@ struct msi_desc {
         void __iomem *mask_base;
         struct pci_dev *dev;
 
-#ifdef CONFIG_PM
-        /* PM save area for MSIX address/data */
-        struct msi_msg msg_save;
-#endif
+        /* Last set MSI message */
+        struct msi_msg msg;
 };
 
 /*
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 47aaa2c66738..e9ae0c6e2c62 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -415,6 +415,7 @@ extern void nfs_complete_unlink(struct dentry *);
 /*
  * linux/fs/nfs/write.c
  */
+extern int  nfs_congestion_kb;
 extern int  nfs_writepage(struct page *page, struct writeback_control *wbc);
 extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 95796e6924f1..c95d5e642548 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -82,6 +82,7 @@ struct nfs_server {
         struct rpc_clnt *       client_acl;     /* ACL RPC client handle */
         struct nfs_iostats *    io_stats;       /* I/O statistics */
         struct backing_dev_info backing_dev_info;
+        atomic_t                writeback;      /* number of writeback pages */
         int                     flags;          /* various flags */
         unsigned int            caps;           /* server capabilities */
         unsigned int            rsize;          /* read size */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 78417e421b4c..481ea0663f19 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -209,11 +209,6 @@ static inline void pci_add_saved_cap(struct pci_dev *pci_dev,
         hlist_add_head(&new_cap->next, &pci_dev->saved_cap_space);
 }
 
-static inline void pci_remove_saved_cap(struct pci_cap_saved_state *cap)
-{
-        hlist_del(&cap->next);
-}
-
 /*
  *  For PCI devices, the region numbers are assigned this way:
  *
diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
index f09cce2357ff..495d368390e0 100644
--- a/include/linux/pci_regs.h
+++ b/include/linux/pci_regs.h
@@ -296,6 +296,7 @@
 #define PCI_MSIX_FLAGS          2
 #define  PCI_MSIX_FLAGS_QSIZE   0x7FF
 #define  PCI_MSIX_FLAGS_ENABLE  (1 << 15)
+#define  PCI_MSIX_FLAGS_MASKALL (1 << 14)
 #define PCI_MSIX_FLAGS_BIRMASK  (7 << 0)
 #define PCI_MSIX_FLAGS_BITMASK  (1 << 0)
 
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 2e19478e9e84..8bcbc54e1b48 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -99,4 +99,8 @@ extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
                                 loff_t *, size_t, unsigned int,
                                 splice_actor *);
 
+extern ssize_t __splice_from_pipe(struct pipe_inode_info *, struct file *,
+                                  loff_t *, size_t, unsigned int,
+                                  splice_actor *);
+
 #endif
diff --git a/include/linux/security.h b/include/linux/security.h
index 7f88d97575fd..47e82c120f9a 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1324,7 +1324,7 @@ struct security_operations {
 
         void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
 
-        int (*getprocattr)(struct task_struct *p, char *name, void *value, size_t size);
+        int (*getprocattr)(struct task_struct *p, char *name, char **value);
         int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);
         int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
         void (*release_secctx)(char *secdata, u32 seclen);
@@ -2092,9 +2092,9 @@ static inline void security_d_instantiate (struct dentry *dentry, struct inode *
         security_ops->d_instantiate (dentry, inode);
 }
 
-static inline int security_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
+static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
 {
-        return security_ops->getprocattr(p, name, value, size);
+        return security_ops->getprocattr(p, name, value);
 }
 
 static inline int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
@@ -2749,7 +2749,7 @@ static inline int security_sem_semop (struct sem_array * sma,
 static inline void security_d_instantiate (struct dentry *dentry, struct inode *inode)
 { }
 
-static inline int security_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
+static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
 {
         return -EINVAL;
 }
diff --git a/include/linux/spi/spi_bitbang.h b/include/linux/spi/spi_bitbang.h
index 2e8c048b9b80..9dbca629dcfb 100644
--- a/include/linux/spi/spi_bitbang.h
+++ b/include/linux/spi/spi_bitbang.h
@@ -25,7 +25,6 @@ struct spi_bitbang {
         spinlock_t              lock;
         struct list_head        queue;
         u8                      busy;
-        u8                      shutdown;
         u8                      use_dma;
 
         struct spi_master       *master;
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index 523405e1e1f6..fea9a6b3fb7b 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -11,6 +11,7 @@
 #define _SYSFS_H_
 
 #include <linux/compiler.h>
+#include <linux/errno.h>
 #include <linux/list.h>
 #include <asm/atomic.h>
 
@@ -78,6 +79,9 @@ struct sysfs_ops {
 
 #ifdef CONFIG_SYSFS
 
+extern int sysfs_schedule_callback(struct kobject *kobj,
+                void (*func)(void *), void *data);
+
 extern int __must_check
 sysfs_create_dir(struct kobject *, struct dentry *);
 
@@ -132,6 +136,12 @@ extern int __must_check sysfs_init(void);
 
 #else /* CONFIG_SYSFS */
 
+static inline int sysfs_schedule_callback(struct kobject *kobj,
+                void (*func)(void *), void *data)
+{
+        return -ENOSYS;
+}
+
 static inline int sysfs_create_dir(struct kobject * k, struct dentry *shadow)
 {
         return 0;
diff --git a/include/linux/ufs_fs.h b/include/linux/ufs_fs.h
index dc2e9fe69418..daeba22b7656 100644
--- a/include/linux/ufs_fs.h
+++ b/include/linux/ufs_fs.h
@@ -649,10 +649,10 @@ struct ufs2_inode {
         __fs32     ui_blksize;     /*  12: Inode blocksize. */
         __fs64     ui_size;        /*  16: File byte count. */
         __fs64     ui_blocks;      /*  24: Bytes actually held. */
-        struct ufs_timeval   ui_atime;       /*  32: Last access time. */
-        struct ufs_timeval   ui_mtime;       /*  40: Last modified time. */
-        struct ufs_timeval   ui_ctime;       /*  48: Last inode change time. */
-        struct ufs_timeval   ui_birthtime;   /*  56: Inode creation time. */
+        __fs64   ui_atime;       /*  32: Last access time. */
+        __fs64   ui_mtime;       /*  40: Last modified time. */
+        __fs64   ui_ctime;       /*  48: Last inode change time. */
+        __fs64   ui_birthtime;   /*  56: Inode creation time. */
         __fs32     ui_mtimensec;   /*  64: Last modified time. */
         __fs32     ui_atimensec;   /*  68: Last access time. */
         __fs32     ui_ctimensec;   /*  72: Last inode change time. */
diff --git a/include/linux/utsname.h b/include/linux/utsname.h
index a4555fe3754c..e10267d402c5 100644
--- a/include/linux/utsname.h
+++ b/include/linux/utsname.h
@@ -70,6 +70,8 @@ static inline int unshare_utsname(unsigned long unshare_flags,
 
 static inline int copy_utsname(int flags, struct task_struct *tsk)
 {
+        if (flags & CLONE_NEWUTS)
+                return -EINVAL;
         return 0;
 }
 static inline void put_uts_ns(struct uts_namespace *ns)
diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
index 37a1a41f5b65..e0db669998f3 100644
--- a/include/linux/vt_kern.h
+++ b/include/linux/vt_kern.h
@@ -83,6 +83,7 @@ void reset_vc(struct vc_data *vc);
 #define CON_BUF_SIZE (CONFIG_BASE_SMALL ? 256 : PAGE_SIZE)
 extern char con_buf[CON_BUF_SIZE];
 extern struct semaphore con_buf_sem;
+extern char vt_dont_switch;
 
 struct vt_spawn_console {
         spinlock_t lock;
diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
index 83fe2e3d1e25..50e33b0e9349 100644
--- a/include/media/saa7146_vv.h
+++ b/include/media/saa7146_vv.h
@@ -239,7 +239,8 @@ void saa7146_res_free(struct saa7146_fh *fh, unsigned int bits);
 #define SAA7146_HPS_SYNC_PORT_B         0x01
 
 /* some memory sizes */
-#define SAA7146_CLIPPING_MEM    (14*PAGE_SIZE)
+/* max. 16 clipping rectangles */
+#define SAA7146_CLIPPING_MEM    (16 * 4 * sizeof(u32))
 
 /* some defines for the various clipping-modes */
 #define SAA7146_CLIPPING_RECT           0x4
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index bc3c26494c3d..d585ea9fa97d 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -34,6 +34,7 @@ struct fib_rules_ops
         int                     family;
         struct list_head        list;
         int                     rule_size;
+        int                     addr_size;
 
         int                     (*action)(struct fib_rule *,
                                           struct flowi *, int,
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 9eda572a2a65..cf355a3c2ad5 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -58,6 +58,7 @@ struct fib6_node
         __u16                   fn_bit;         /* bit key */
         __u16                   fn_flags;
         __u32                   fn_sernum;
+        struct rt6_info         *rr_ptr;
 };
 
 #ifndef CONFIG_IPV6_SUBTREES
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 3725b93c52f3..ad7fe1121412 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -36,7 +36,7 @@ struct neigh_parms
         struct net_device *dev;
         struct neigh_parms *next;
         int     (*neigh_setup)(struct neighbour *);
-        void    (*neigh_destructor)(struct neighbour *);
+        void    (*neigh_cleanup)(struct neighbour *);
         struct neigh_table *tbl;
 
         void    *sysctl_table;
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 31a8e88f1a74..f431acf3dcea 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1002,6 +1002,7 @@ void sctp_transport_update_rto(struct sctp_transport *, __u32);
 void sctp_transport_raise_cwnd(struct sctp_transport *, __u32, __u32);
 void sctp_transport_lower_cwnd(struct sctp_transport *, sctp_lower_cwnd_t);
 unsigned long sctp_transport_timeout(struct sctp_transport *);
+void sctp_transport_reset(struct sctp_transport *);
 
 
 /* This is the structure we use to queue packets as they come into
diff --git a/include/net/sctp/ulpqueue.h b/include/net/sctp/ulpqueue.h
index a43c8788b650..ab26ab3adae1 100644
--- a/include/net/sctp/ulpqueue.h
+++ b/include/net/sctp/ulpqueue.h
@@ -59,6 +59,7 @@ struct sctp_ulpq {
 /* Prototypes. */
 struct sctp_ulpq *sctp_ulpq_init(struct sctp_ulpq *,
                                  struct sctp_association *);
+void sctp_ulpq_flush(struct sctp_ulpq *ulpq);
 void sctp_ulpq_free(struct sctp_ulpq *);
 
 /* Add a new DATA chunk for processing. */
diff --git a/include/sound/version.h b/include/sound/version.h
index 5f7275000102..42a18cc95f38 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
 #define CONFIG_SND_VERSION "1.0.14rc3"
-#define CONFIG_SND_DATE " (Tue Mar 06 13:10:00 2007 UTC)"
+#define CONFIG_SND_DATE " (Wed Mar 14 07:25:50 2007 UTC)"
diff --git a/ipc/util.c b/ipc/util.c
index 08a647965b9e..0b652387d169 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -144,6 +144,13 @@ void free_ipc_ns(struct kref *kref)
         shm_exit_ns(ns);
         kfree(ns);
 }
+#else
+int copy_ipcs(unsigned long flags, struct task_struct *tsk)
+{
+        if (flags & CLONE_NEWIPC)
+                return -EINVAL;
+        return 0;
+}
 #endif
 
 /**
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 359955800dd2..628c7ac590a0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -739,28 +739,26 @@ static inline void audit_free_context(struct audit_context *context)
 void audit_log_task_context(struct audit_buffer *ab)
 {
         char *ctx = NULL;
-        ssize_t len = 0;
+        unsigned len;
+        int error;
+        u32 sid;
+
+        selinux_get_task_sid(current, &sid);
+        if (!sid)
+                return;
 
-        len = security_getprocattr(current, "current", NULL, 0);
-        if (len < 0) {
-                if (len != -EINVAL)
+        error = selinux_sid_to_string(sid, &ctx, &len);
+        if (error) {
+                if (error != -EINVAL)
                         goto error_path;
                 return;
         }
 
-        ctx = kmalloc(len, GFP_KERNEL);
-        if (!ctx)
-                goto error_path;
-
-        len = security_getprocattr(current, "current", ctx, len);
-        if (len < 0 )
-                goto error_path;
-
         audit_log_format(ab, " subj=%s", ctx);
+        kfree(ctx);
         return;
 
 error_path:
-        kfree(ctx);
         audit_panic("error in audit_log_task_context");
         return;
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index d154cc786489..6af959c034d8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -933,8 +933,8 @@ asmlinkage long sys_set_tid_address(int __user *tidptr)
 
 static inline void rt_mutex_init_task(struct task_struct *p)
 {
-#ifdef CONFIG_RT_MUTEXES
         spin_lock_init(&p->pi_lock);
+#ifdef CONFIG_RT_MUTEXES
         plist_head_init(&p->pi_waiters, &p->pi_lock);
         p->pi_blocked_on = NULL;
 #endif
diff --git a/kernel/futex.c b/kernel/futex.c
index e749e7df14b1..5a270b5e3f95 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -565,6 +565,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
         if (!pi_state)
                 return -EINVAL;
 
+        spin_lock(&pi_state->pi_mutex.wait_lock);
         new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
         /*
@@ -604,6 +605,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
         pi_state->owner = new_owner;
         spin_unlock_irq(&new_owner->pi_lock);
 
+        spin_unlock(&pi_state->pi_mutex.wait_lock);
         rt_mutex_unlock(&pi_state->pi_mutex);
 
         return 0;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ec4cb9f3e3b7..6a7938a0d513 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -135,7 +135,7 @@ EXPORT_SYMBOL_GPL(ktime_get_ts);
 static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 {
         ktime_t xtim, tomono;
-        struct timespec xts;
+        struct timespec xts, tom;
         unsigned long seq;
 
         do {
@@ -145,10 +145,11 @@ static void hrtimer_get_softirq_time(struct hrtimer_cpu_base *base)
 #else
                 xts = xtime;
 #endif
+                tom = wall_to_monotonic;
         } while (read_seqretry(&xtime_lock, seq));
 
         xtim = timespec_to_ktime(xts);
-        tomono = timespec_to_ktime(wall_to_monotonic);
+        tomono = timespec_to_ktime(tom);
         base->clock_base[CLOCK_REALTIME].softirq_time = xtim;
         base->clock_base[CLOCK_MONOTONIC].softirq_time =
                 ktime_add(xtim, tomono);
@@ -644,6 +645,12 @@ hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
                 orun++;
         }
         timer->expires = ktime_add(timer->expires, interval);
+        /*
+         * Make sure, that the result did not wrap with a very large
+         * interval.
+         */
+        if (timer->expires.tv64 < 0)
+                timer->expires = ktime_set(KTIME_SEC_MAX, 0);
 
         return orun;
 }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 8dc24c92dc6d..7065a687ac54 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -2742,6 +2742,10 @@ void debug_show_all_locks(void)
         int count = 10;
         int unlock = 1;
 
+        if (unlikely(!debug_locks)) {
+                printk("INFO: lockdep is turned off.\n");
+                return;
+        }
         printk("\nShowing all locks held in the system:\n");
 
         /*
@@ -2785,6 +2789,10 @@ EXPORT_SYMBOL_GPL(debug_show_all_locks);
 
 void debug_show_held_locks(struct task_struct *task)
 {
+        if (unlikely(!debug_locks)) {
+                printk("INFO: lockdep is turned off.\n");
+                return;
+        }
         lockdep_print_held_locks(task);
 }
 
diff --git a/kernel/power/console.c b/kernel/power/console.c
index 623786d44159..89bcf4973ee5 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -27,7 +27,15 @@ int pm_prepare_console(void)
                 return 1;
         }
 
-        set_console(SUSPEND_CONSOLE);
+        if (set_console(SUSPEND_CONSOLE)) {
+                /*
+                 * We're unable to switch to the SUSPEND_CONSOLE.
+                 * Let the calling function know so it can decide
+                 * what to do.
+                 */
+                release_console_sem();
+                return 1;
+        }
         release_console_sem();
 
         if (vt_waitactive(SUSPEND_CONSOLE)) {
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index 406b20adb27a..aec19b063e3f 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -240,12 +240,6 @@ static int software_resume(void)
                 goto Done;
         }
 
-        error = platform_prepare();
-        if (error) {
-                swsusp_free();
-                goto Thaw;
-        }
-
         pr_debug("PM: Reading swsusp image.\n");
 
         error = swsusp_read();
@@ -268,7 +262,6 @@ static int software_resume(void)
         enable_nonboot_cpus();
  Free:
         swsusp_free();
-        platform_finish();
         device_resume();
         resume_console();
  Thaw:
diff --git a/kernel/power/user.c b/kernel/power/user.c
index dd09efe7df54..7cf6713b2325 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -368,9 +368,12 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 if (error) {
                         printk(KERN_ERR "Failed to suspend some devices.\n");
                 } else {
-                        /* Enter S3, system is already frozen */
-                        suspend_enter(PM_SUSPEND_MEM);
-
+                        error = disable_nonboot_cpus();
+                        if (!error) {
+                                /* Enter S3, system is already frozen */
+                                suspend_enter(PM_SUSPEND_MEM);
+                                enable_nonboot_cpus();
+                        }
                         /* Wake up devices */
                         device_resume();
                 }
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 67932ea78c17..76212b2a99de 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -274,72 +274,3 @@ void clockevents_notify(unsigned long reason, void *arg)
 }
 EXPORT_SYMBOL_GPL(clockevents_notify);
 
-#ifdef CONFIG_SYSFS
-
-/**
- * clockevents_show_registered - sysfs interface for listing clockevents
- * @dev:        unused
- * @buf:        char buffer to be filled with clock events list
- *
- * Provides sysfs interface for listing registered clock event devices
- */
-static ssize_t clockevents_show_registered(struct sys_device *dev, char *buf)
-{
-        struct list_head *tmp;
-        char *p = buf;
-        int cpu;
-
-        spin_lock(&clockevents_lock);
-
-        list_for_each(tmp, &clockevent_devices) {
-                struct clock_event_device *ce;
-
-                ce = list_entry(tmp, struct clock_event_device, list);
-                p += sprintf(p, "%-20s F:%04x M:%d", ce->name,
-                             ce->features, ce->mode);
-                p += sprintf(p, " C:");
-                if (!cpus_equal(ce->cpumask, cpu_possible_map)) {
-                        for_each_cpu_mask(cpu, ce->cpumask)
-                                p += sprintf(p, " %d", cpu);
-                } else {
-                        /*
-                         * FIXME: Add the cpu which is handling this sucker
-                         */
-                }
-                p += sprintf(p, "\n");
-        }
-
-        spin_unlock(&clockevents_lock);
-
-        return p - buf;
-}
-
-/*
- * Sysfs setup bits:
- */
-static SYSDEV_ATTR(registered, 0600,
-                   clockevents_show_registered, NULL);
-
-static struct sysdev_class clockevents_sysclass = {
-        set_kset_name("clockevents"),
-};
-
-static struct sys_device clockevents_sys_device = {
-        .id     = 0,
-        .cls    = &clockevents_sysclass,
-};
-
-static int __init clockevents_sysfs_init(void)
-{
-        int error = sysdev_class_register(&clockevents_sysclass);
-
-        if (!error)
-                error = sysdev_register(&clockevents_sys_device);
-        if (!error)
-                error = sysdev_create_file(
-                                &clockevents_sys_device,
-                                &attr_registered);
-        return error;
-}
-device_initcall(clockevents_sysfs_init);
-#endif
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 5b0e46b56fd0..fe5c7db24247 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -151,7 +151,8 @@ static void clocksource_check_watchdog(struct clocksource *cs)
                         watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
                         add_timer(&watchdog_timer);
                 }
-        } else if (cs->flags & CLOCK_SOURCE_IS_CONTINUOUS) {
+        } else {
+                if (cs->flags & CLOCK_SOURCE_IS_CONTINUOUS)
                         cs->flags |= CLOCK_SOURCE_VALID_FOR_HRES;
 
                 if (!watchdog || cs->rating > watchdog->rating) {
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index eb12509e00bd..cb25649c6f50 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -32,7 +32,7 @@ static u64 tick_length, tick_length_base;
 /* TIME_ERROR prevents overwriting the CMOS clock */
 static int time_state = TIME_OK;        /* clock synchronization status */
 int time_status = STA_UNSYNC;           /* clock status bits            */
-static long time_offset;                /* time adjustment (ns)         */
+static s64 time_offset;         /* time adjustment (ns)         */
 static long time_constant = 2;          /* pll time constant            */
 long time_maxerror = NTP_PHASE_LIMIT;   /* maximum error (us)           */
 long time_esterror = NTP_PHASE_LIMIT;   /* estimated error (us)         */
@@ -196,7 +196,7 @@ void __attribute__ ((weak)) notify_arch_cmos_timer(void)
  */
 int do_adjtimex(struct timex *txc)
 {
-        long ltemp, mtemp, save_adjust;
+        long mtemp, save_adjust, rem;
         s64 freq_adj, temp64;
         int result;
 
@@ -277,14 +277,14 @@ int do_adjtimex(struct timex *txc)
                     time_adjust = txc->offset;
                 }
                 else if (time_status & STA_PLL) {
-                    ltemp = txc->offset * NSEC_PER_USEC;
+                    time_offset = txc->offset * NSEC_PER_USEC;
 
                     /*
                      * Scale the phase adjustment and
                      * clamp to the operating range.
                      */
-                    time_offset = min(ltemp, MAXPHASE * NSEC_PER_USEC);
-                    time_offset = max(time_offset, -MAXPHASE * NSEC_PER_USEC);
+                    time_offset = min(time_offset, (s64)MAXPHASE * NSEC_PER_USEC);
+                    time_offset = max(time_offset, (s64)-MAXPHASE * NSEC_PER_USEC);
 
                     /*
                      * Select whether the frequency is to be controlled
@@ -297,11 +297,11 @@ int do_adjtimex(struct timex *txc)
                     mtemp = xtime.tv_sec - time_reftime;
                     time_reftime = xtime.tv_sec;
 
-                    freq_adj = (s64)time_offset * mtemp;
+                    freq_adj = time_offset * mtemp;
                     freq_adj = shift_right(freq_adj, time_constant * 2 +
                                            (SHIFT_PLL + 2) * 2 - SHIFT_NSEC);
                     if (mtemp >= MINSEC && (time_status & STA_FLL || mtemp > MAXSEC)) {
-                        temp64 = (s64)time_offset << (SHIFT_NSEC - SHIFT_FLL);
+                        temp64 = time_offset << (SHIFT_NSEC - SHIFT_FLL);
                         if (time_offset < 0) {
                             temp64 = -temp64;
                             do_div(temp64, mtemp);
@@ -314,8 +314,10 @@ int do_adjtimex(struct timex *txc)
                     freq_adj += time_freq;
                     freq_adj = min(freq_adj, (s64)MAXFREQ_NSEC);
                     time_freq = max(freq_adj, (s64)-MAXFREQ_NSEC);
-                    time_offset = (time_offset / NTP_INTERVAL_FREQ)
-                                        << SHIFT_UPDATE;
+                    time_offset = div_long_long_rem_signed(time_offset,
+                                                           NTP_INTERVAL_FREQ,
+                                                           &rem);
+                    time_offset <<= SHIFT_UPDATE;
                 } /* STA_PLL */
             } /* txc->modes & ADJ_OFFSET */
             if (txc->modes & ADJ_TICK)
@@ -328,12 +330,12 @@ leave:	if ((time_status & (STA_UNSYNC|STA_CLOCKERR)) != 0)
                 result = TIME_ERROR;
 
         if ((txc->modes & ADJ_OFFSET_SINGLESHOT) == ADJ_OFFSET_SINGLESHOT)
-            txc->offset    = save_adjust;
+                txc->offset = save_adjust;
         else
-            txc->offset    = shift_right(time_offset, SHIFT_UPDATE)
-                                * NTP_INTERVAL_FREQ / 1000;
-        txc->freq          = (time_freq / NSEC_PER_USEC)
-                                << (SHIFT_USEC - SHIFT_NSEC);
+                txc->offset = ((long)shift_right(time_offset, SHIFT_UPDATE)) *
+                                NTP_INTERVAL_FREQ / 1000;
+        txc->freq          = (time_freq / NSEC_PER_USEC) <<
+                                (SHIFT_USEC - SHIFT_NSEC);
         txc->maxerror      = time_maxerror;
         txc->esterror      = time_esterror;
         txc->status        = time_status;
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 5567745470f7..eadfce2fff74 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -307,12 +307,19 @@ int tick_resume_broadcast(void)
         spin_lock_irqsave(&tick_broadcast_lock, flags);
 
         bc = tick_broadcast_device.evtdev;
-        if (bc) {
-                if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC &&
-                    !cpus_empty(tick_broadcast_mask))
-                        tick_broadcast_start_periodic(bc);
 
-                broadcast = cpu_isset(smp_processor_id(), tick_broadcast_mask);
+        if (bc) {
+                switch (tick_broadcast_device.mode) {
+                case TICKDEV_MODE_PERIODIC:
+                        if(!cpus_empty(tick_broadcast_mask))
+                                tick_broadcast_start_periodic(bc);
+                        broadcast = cpu_isset(smp_processor_id(),
+                                              tick_broadcast_mask);
+                        break;
+                case TICKDEV_MODE_ONESHOT:
+                        broadcast = tick_resume_broadcast_oneshot(bc);
+                        break;
+                }
         }
         spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 
@@ -347,6 +354,16 @@ static int tick_broadcast_set_event(ktime_t expires, int force)
         }
 }
 
+int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+{
+        clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+
+        if(!cpus_empty(tick_broadcast_oneshot_mask))
+                tick_broadcast_set_event(ktime_get(), 1);
+
+        return cpu_isset(smp_processor_id(), tick_broadcast_oneshot_mask);
+}
+
 /*
  * Reprogram the broadcast device:
  *
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 43ba1bdec14c..bfda3f7f0716 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -298,18 +298,17 @@ static void tick_shutdown(unsigned int *cpup)
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
-static void tick_suspend_periodic(void)
+static void tick_suspend(void)
 {
         struct tick_device *td = &__get_cpu_var(tick_cpu_device);
         unsigned long flags;
 
         spin_lock_irqsave(&tick_device_lock, flags);
-        if (td->mode == TICKDEV_MODE_PERIODIC)
-                clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
+        clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
-static void tick_resume_periodic(void)
+static void tick_resume(void)
 {
         struct tick_device *td = &__get_cpu_var(tick_cpu_device);
         unsigned long flags;
@@ -317,6 +316,8 @@ static void tick_resume_periodic(void)
         spin_lock_irqsave(&tick_device_lock, flags);
         if (td->mode == TICKDEV_MODE_PERIODIC)
                 tick_setup_periodic(td->evtdev, 0);
+        else
+                tick_resume_oneshot();
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
@@ -348,13 +349,13 @@ static int tick_notify(struct notifier_block *nb, unsigned long reason,
                 break;
 
         case CLOCK_EVT_NOTIFY_SUSPEND:
-                tick_suspend_periodic();
+                tick_suspend();
                 tick_suspend_broadcast();
                 break;
 
         case CLOCK_EVT_NOTIFY_RESUME:
                 if (!tick_resume_broadcast())
-                        tick_resume_periodic();
+                        tick_resume();
                 break;
 
         default:
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 75890efd24ff..c9d203bde518 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -19,12 +19,13 @@ extern void tick_setup_oneshot(struct clock_event_device *newdev,
 extern int tick_program_event(ktime_t expires, int force);
 extern void tick_oneshot_notify(void);
 extern int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *));
-
+extern void tick_resume_oneshot(void);
 # ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
 extern void tick_broadcast_setup_oneshot(struct clock_event_device *bc);
 extern void tick_broadcast_oneshot_control(unsigned long reason);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
+extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 # else /* BROADCAST */
 static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
@@ -43,6 +44,10 @@ void tick_setup_oneshot(struct clock_event_device *newdev,
 {
         BUG();
 }
+static inline void tick_resume_oneshot(void)
+{
+        BUG();
+}
 static inline int tick_program_event(ktime_t expires, int force)
 {
         return 0;
@@ -54,6 +59,10 @@ static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 }
 static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
+static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+{
+        return 0;
+}
 #endif /* !TICK_ONESHOT */
 
 /*
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index 2e8b7ff863cc..f6997ab0c3c9 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -41,6 +41,18 @@ int tick_program_event(ktime_t expires, int force)
 }
 
 /**
+ * tick_resume_onshot - resume oneshot mode
+ */
+void tick_resume_oneshot(void)
+{
+        struct tick_device *td = &__get_cpu_var(tick_cpu_device);
+        struct clock_event_device *dev = td->evtdev;
+
+        clockevents_set_mode(dev, CLOCK_EVT_MODE_ONESHOT);
+        tick_program_event(ktime_get(), 1);
+}
+
+/**
  * tick_setup_oneshot - setup the event device for oneshot mode (hres or nohz)
  */
 void tick_setup_oneshot(struct clock_event_device *newdev,
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index f82c635c3d5c..59df5e8555a8 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -194,9 +194,9 @@ print_tickdevice(struct seq_file *m, struct tick_device *td)
                 return;
         }
         SEQ_printf(m, "%s\n", dev->name);
-        SEQ_printf(m, " max_delta_ns:   %ld\n", dev->max_delta_ns);
-        SEQ_printf(m, " min_delta_ns:   %ld\n", dev->min_delta_ns);
-        SEQ_printf(m, " mult:           %ld\n", dev->mult);
+        SEQ_printf(m, " max_delta_ns:   %lu\n", dev->max_delta_ns);
+        SEQ_printf(m, " min_delta_ns:   %lu\n", dev->min_delta_ns);
+        SEQ_printf(m, " mult:           %lu\n", dev->mult);
         SEQ_printf(m, " shift:          %d\n", dev->shift);
         SEQ_printf(m, " mode:           %d\n", dev->mode);
         SEQ_printf(m, " next_event:     %Ld nsecs\n",
diff --git a/kernel/timer.c b/kernel/timer.c
index 797cccb86431..440048acaea1 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -695,15 +695,28 @@ static unsigned long cmp_next_hrtimer_event(unsigned long now,
 {
         ktime_t hr_delta = hrtimer_get_next_event();
         struct timespec tsdelta;
+        unsigned long delta;
 
         if (hr_delta.tv64 == KTIME_MAX)
                 return expires;
 
-        if (hr_delta.tv64 <= TICK_NSEC)
-                return now;
+        /*
+         * Expired timer available, let it expire in the next tick
+         */
+        if (hr_delta.tv64 <= 0)
+                return now + 1;
 
         tsdelta = ktime_to_timespec(hr_delta);
-        now += timespec_to_jiffies(&tsdelta);
+        delta = timespec_to_jiffies(&tsdelta);
+        /*
+         * Take rounding errors in to account and make sure, that it
+         * expires in the next tick. Otherwise we go into an endless
+         * ping pong due to tick_nohz_stop_sched_tick() retriggering
+         * the timer softirq
+         */
+        if (delta < 1)
+                delta = 1;
+        now += delta;
         if (time_before(now, expires))
                 return now;
         return expires;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index f50a2811f9dc..e5de3781d3fe 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -55,6 +55,22 @@ long congestion_wait(int rw, long timeout)
 }
 EXPORT_SYMBOL(congestion_wait);
 
+long congestion_wait_interruptible(int rw, long timeout)
+{
+        long ret;
+        DEFINE_WAIT(wait);
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        prepare_to_wait(wqh, &wait, TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                ret = -ERESTARTSYS;
+        else
+                ret = io_schedule_timeout(timeout);
+        finish_wait(wqh, &wait);
+        return ret;
+}
+EXPORT_SYMBOL(congestion_wait_interruptible);
+
 /**
  * congestion_end - wake up sleepers on a congested backing_dev_info
  * @rw: READ or WRITE
diff --git a/mm/bounce.c b/mm/bounce.c
index 643efbe82402..ad401fc57440 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -204,7 +204,7 @@ static void __blk_queue_bounce(request_queue_t *q, struct bio **bio_orig,
                 /*
                  * is destination page below bounce pfn?
                  */
-                if (page_to_pfn(page) < q->bounce_pfn)
+                if (page_to_pfn(page) <= q->bounce_pfn)
                         continue;
 
                 /*
diff --git a/mm/filemap.c b/mm/filemap.c
index d1060b8d3cd6..5dfc093ceb3d 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2379,7 +2379,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
         struct file *file = iocb->ki_filp;
         struct address_space *mapping = file->f_mapping;
         ssize_t retval;
-        size_t write_len = 0;
+        size_t write_len;
+        pgoff_t end = 0; /* silence gcc */
 
         /*
          * If it's a write, unmap all mmappings of the file up-front.  This
@@ -2388,23 +2389,46 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
          */
         if (rw == WRITE) {
                 write_len = iov_length(iov, nr_segs);
+                end = (offset + write_len - 1) >> PAGE_CACHE_SHIFT;
                 if (mapping_mapped(mapping))
                         unmap_mapping_range(mapping, offset, write_len, 0);
         }
 
         retval = filemap_write_and_wait(mapping);
-        if (retval == 0) {
-                retval = mapping->a_ops->direct_IO(rw, iocb, iov,
-                                                offset, nr_segs);
-                if (rw == WRITE && mapping->nrpages) {
-                        pgoff_t end = (offset + write_len - 1)
-                                                >> PAGE_CACHE_SHIFT;
-                        int err = invalidate_inode_pages2_range(mapping,
+        if (retval)
+                goto out;
+
+        /*
+         * After a write we want buffered reads to be sure to go to disk to get
+         * the new data.  We invalidate clean cached page from the region we're
+         * about to write.  We do this *before* the write so that we can return
+         * -EIO without clobbering -EIOCBQUEUED from ->direct_IO().
+         */
+        if (rw == WRITE && mapping->nrpages) {
+                retval = invalidate_inode_pages2_range(mapping,
                                         offset >> PAGE_CACHE_SHIFT, end);
-                        if (err)
-                                retval = err;
-                }
+                if (retval)
+                        goto out;
         }
+
+        retval = mapping->a_ops->direct_IO(rw, iocb, iov, offset, nr_segs);
+        if (retval)
+                goto out;
+
+        /*
+         * Finally, try again to invalidate clean pages which might have been
+         * faulted in by get_user_pages() if the source of the write was an
+         * mmap()ed region of the file we're writing.  That's a pretty crazy
+         * thing to do, so we don't support it 100%.  If this invalidation
+         * fails and we have -EIOCBQUEUED we ignore the failure.
+         */
+        if (rw == WRITE && mapping->nrpages) {
+                int err = invalidate_inode_pages2_range(mapping,
+                                              offset >> PAGE_CACHE_SHIFT, end);
+                if (err && retval >= 0)
+                        retval = err;
+        }
+out:
         return retval;
 }
 
diff --git a/mm/madvise.c b/mm/madvise.c
index 4e196155a0c3..77916e9fc52b 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -155,11 +155,14 @@ static long madvise_dontneed(struct vm_area_struct * vma,
  * Other filesystems return -ENOSYS.
  */
 static long madvise_remove(struct vm_area_struct *vma,
+                                struct vm_area_struct **prev,
                                 unsigned long start, unsigned long end)
 {
         struct address_space *mapping;
         loff_t offset, endoff;
 
+        *prev = vma;
+
         if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
                 return -EINVAL;
 
@@ -199,7 +202,7 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
                 error = madvise_behavior(vma, prev, start, end, behavior);
                 break;
         case MADV_REMOVE:
-                error = madvise_remove(vma, start, end);
+                error = madvise_remove(vma, prev, start, end);
                 break;
 
         case MADV_WILLNEED:
diff --git a/mm/nommu.c b/mm/nommu.c
index 23fb033e596d..cbbc13774819 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -826,6 +826,11 @@ unsigned long do_mmap_pgoff(struct file *file,
                 unsigned long pglen = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
                 unsigned long vmpglen;
 
+                /* suppress VMA sharing for shared regions */
+                if (vm_flags & VM_SHARED &&
+                    capabilities & BDI_CAP_MAP_DIRECT)
+                        goto dont_share_VMAs;
+
                 for (rb = rb_first(&nommu_vma_tree); rb; rb = rb_next(rb)) {
                         vma = rb_entry(rb, struct vm_area_struct, vm_rb);
 
@@ -859,6 +864,7 @@ unsigned long do_mmap_pgoff(struct file *file,
                         goto shared;
                 }
 
+        dont_share_VMAs:
                 vma = NULL;
 
                 /* obtain the address at which to make a shared mapping
@@ -1193,6 +1199,28 @@ void unmap_mapping_range(struct address_space *mapping,
 EXPORT_SYMBOL(unmap_mapping_range);
 
 /*
+ * ask for an unmapped area at which to create a mapping on a file
+ */
+unsigned long get_unmapped_area(struct file *file, unsigned long addr,
+                                unsigned long len, unsigned long pgoff,
+                                unsigned long flags)
+{
+        unsigned long (*get_area)(struct file *, unsigned long, unsigned long,
+                                  unsigned long, unsigned long);
+
+        get_area = current->mm->get_unmapped_area;
+        if (file && file->f_op && file->f_op->get_unmapped_area)
+                get_area = file->f_op->get_unmapped_area;
+
+        if (!get_area)
+                return -ENOSYS;
+
+        return get_area(file, addr, len, pgoff, flags);
+}
+
+EXPORT_SYMBOL(get_unmapped_area);
+
+/*
  * Check that a process has enough memory to allocate a new virtual
  * mapping. 0 means there is enough memory for the allocation to
  * succeed and -ENOMEM implies there is not.
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b278b8d60eee..2f3916986abf 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -320,7 +320,7 @@ static int oom_kill_task(struct task_struct *p)
          * Don't kill the process if any threads are set to OOM_DISABLE
          */
         do_each_thread(g, q) {
-                if (q->mm == mm && p->oomkilladj == OOM_DISABLE)
+                if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
                         return 1;
         } while_each_thread(g, q);
 
diff --git a/net/atm/clip.c b/net/atm/clip.c
index ebb5d0ce8b6f..8c3825816085 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -261,14 +261,6 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         spin_unlock_irqrestore(&PRIV(dev)->xoff_lock, flags);
 }
 
-static void clip_neigh_destroy(struct neighbour *neigh)
-{
-        DPRINTK("clip_neigh_destroy (neigh %p)\n", neigh);
-        if (NEIGH2ENTRY(neigh)->vccs)
-                printk(KERN_CRIT "clip_neigh_destroy: vccs != NULL !!!\n");
-        NEIGH2ENTRY(neigh)->vccs = (void *) NEIGHBOR_DEAD;
-}
-
 static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
         DPRINTK("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
@@ -342,7 +334,6 @@ static struct neigh_table clip_tbl = {
         /* parameters are copied from ARP ... */
         .parms = {
                 .tbl                    = &clip_tbl,
-                .neigh_destructor       = clip_neigh_destroy,
                 .base_reachable_time    = 30 * HZ,
                 .retrans_time           = 1 * HZ,
                 .gc_staletime           = 60 * HZ,
diff --git a/net/ax25/Kconfig b/net/ax25/Kconfig
index a8993a041724..43dd86fca4d3 100644
--- a/net/ax25/Kconfig
+++ b/net/ax25/Kconfig
@@ -1,30 +1,27 @@
 #
 # Amateur Radio protocols and AX.25 device configuration
 #
-# 19971130      Now in an own category to make correct compilation of the
-#               AX.25 stuff easier...
-#               Joerg Reuter DL1BKE <jreuter@yaina.de>
-# 19980129      Moved to net/ax25/Config.in, sourcing device drivers.
 
 menuconfig HAMRADIO
         depends on NET
         bool "Amateur Radio support"
         help
           If you want to connect your Linux box to an amateur radio, answer Y
-          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html> and
-          the AX25-HOWTO, available from <http://www.tldp.org/docs.html#howto>.
+          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html>
+          and more specifically about AX.25 on Linux
+          <http://www.linux-ax25.org/>.
 
           Note that the answer to this question won't directly affect the
           kernel: saying N will just cause the configurator to skip all
           the questions about amateur radio.
 
 comment "Packet Radio protocols"
-        depends on HAMRADIO && NET
+        depends on HAMRADIO
 
 config AX25
         tristate "Amateur Radio AX.25 Level 2 protocol"
-        depends on HAMRADIO && NET
-        ---help---
+        depends on HAMRADIO
+        help
           This is the protocol used for computer communication over amateur
           radio. It is either used by itself for point-to-point links, or to
           carry other protocols such as tcp/ip. To use it, you need a device
@@ -52,6 +49,7 @@ config AX25
 
 config AX25_DAMA_SLAVE
         bool "AX.25 DAMA Slave support"
+        default y
         depends on AX25
         help
           DAMA is a mechanism to prevent collisions when doing AX.25
@@ -59,23 +57,38 @@ config AX25_DAMA_SLAVE
           from clients (called "slaves") and redistributes it to other slaves.
           If you say Y here, your Linux box will act as a DAMA slave; this is
           transparent in that you don't have to do any special DAMA
-          configuration. (Linux cannot yet act as a DAMA server.) If unsure,
-          say N.
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be enabled at runtime.  For more about DAMA see
+          <http://www.linux-ax25.org>.  If unsure, say Y.
+
+# placeholder until implemented
+config AX25_DAMA_MASTER
+        bool 'AX.25 DAMA Master support'
+        depends on AX25_DAMA_SLAVE && BROKEN
+        help
+          DAMA is a mechanism to prevent collisions when doing AX.25
+          networking. A DAMA server (called "master") accepts incoming traffic
+          from clients (called "slaves") and redistributes it to other slaves.
+          If you say Y here, your Linux box will act as a DAMA master; this is
+          transparent in that you don't have to do any special DAMA
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be explicitly enabled, so if unsure, say Y.
 
-#        bool '    AX.25 DAMA Master support' CONFIG_AX25_DAMA_MASTER
 config NETROM
         tristate "Amateur Radio NET/ROM protocol"
         depends on AX25
-        ---help---
+        help
           NET/ROM is a network layer protocol on top of AX.25 useful for
           routing.
 
           A comprehensive listing of all the software for Linux amateur radio
           users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>. You also might want to
-          check out the file <file:Documentation/networking/ax25.txt>. More
-          information about digital amateur radio in general is on the WWW at
+          contained in the Linux Ham Wiki, available from
+          <http://www.linux-ax25.org>. You also might want to check out the
+          file <file:Documentation/networking/ax25.txt>. More information about
+          digital amateur radio in general is on the WWW at
           <http://www.tapr.org/tapr/html/pkthome.html>.
 
           To compile this driver as a module, choose M here: the
@@ -84,27 +97,25 @@ config NETROM
 config ROSE
         tristate "Amateur Radio X.25 PLP (Rose)"
         depends on AX25
-        ---help---
+        help
           The Packet Layer Protocol (PLP) is a way to route packets over X.25
           connections in general and amateur radio AX.25 connections in
           particular, essentially an alternative to NET/ROM.
 
           A comprehensive listing of all the software for Linux amateur radio
           users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>.  You also might want to
-          check out the file <file:Documentation/networking/ax25.txt>. More
-          information about digital amateur radio in general is on the WWW at
+          contained in the Linux Ham Wiki, available from
+          <http://www.linux-ax25.org>.  You also might want to check out the
+          file <file:Documentation/networking/ax25.txt>. More information about
+          digital amateur radio in general is on the WWW at
           <http://www.tapr.org/tapr/html/pkthome.html>.
 
           To compile this driver as a module, choose M here: the
           module will be called rose.
 
-
 menu "AX.25 network device drivers"
-        depends on HAMRADIO && NET && AX25!=n
+        depends on HAMRADIO && AX25
 
 source "drivers/net/hamradio/Kconfig"
 
 endmenu
-
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 4c914df5fd06..ecfe8da1ce6b 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -319,7 +319,7 @@ static int __hidp_send_ctrl_message(struct hidp_session *session,
         return 0;
 }
 
-static int inline hidp_send_ctrl_message(struct hidp_session *session,
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
                         unsigned char hdr, unsigned char *data, int size)
 {
         int err;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index def2e403f932..8d566c13cc73 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -197,8 +197,8 @@ struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br,
 
         rcu_read_lock();
         fdb = __br_fdb_get(br, addr);
-        if (fdb)
-                atomic_inc(&fdb->use_count);
+        if (fdb && !atomic_inc_not_zero(&fdb->use_count))
+                fdb = NULL;
         rcu_read_unlock();
         return fdb;
 }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 7712d76f06ba..5439a3c46c3e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -61,7 +61,7 @@ static int brnf_filter_vlan_tagged __read_mostly = 1;
 #define brnf_filter_vlan_tagged 1
 #endif
 
-static __be16 inline vlan_proto(const struct sk_buff *skb)
+static inline __be16 vlan_proto(const struct sk_buff *skb)
 {
         return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index cf71614dae93..5984b55311a1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1750,10 +1750,10 @@ static int ing_filter(struct sk_buff *skb)
 
                 skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS);
 
-                spin_lock(&dev->ingress_lock);
+                spin_lock(&dev->queue_lock);
                 if ((q = dev->qdisc_ingress) != NULL)
                         result = q->enqueue(skb, q);
-                spin_unlock(&dev->ingress_lock);
+                spin_unlock(&dev->queue_lock);
 
         }
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 215f1bff048f..d011819a8058 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -152,6 +152,28 @@ out:
 
 EXPORT_SYMBOL_GPL(fib_rules_lookup);
 
+static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
+                            struct fib_rules_ops *ops)
+{
+        int err = -EINVAL;
+
+        if (frh->src_len)
+                if (tb[FRA_SRC] == NULL ||
+                    frh->src_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_SRC]) != ops->addr_size)
+                        goto errout;
+
+        if (frh->dst_len)
+                if (tb[FRA_DST] == NULL ||
+                    frh->dst_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_DST]) != ops->addr_size)
+                        goto errout;
+
+        err = 0;
+errout:
+        return err;
+}
+
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
         struct fib_rule_hdr *frh = nlmsg_data(nlh);
@@ -173,6 +195,10 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 goto errout;
 
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
+
         rule = kzalloc(ops->rule_size, GFP_KERNEL);
         if (rule == NULL) {
                 err = -ENOMEM;
@@ -260,6 +286,10 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 goto errout;
 
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
+
         list_for_each_entry(rule, ops->rules_list, list) {
                 if (frh->action && (frh->action != rule->action))
                         continue;
@@ -374,7 +404,7 @@ int fib_rules_dump(struct sk_buff *skb, struct netlink_callback *cb, int family)
                 return -EAFNOSUPPORT;
 
         rcu_read_lock();
-        list_for_each_entry(rule, ops->rules_list, list) {
+        list_for_each_entry_rcu(rule, ops->rules_list, list) {
                 if (idx < cb->args[0])
                         goto skip;
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 3183142c6044..cfc60019cf92 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -140,6 +140,8 @@ static int neigh_forced_gc(struct neigh_table *tbl)
                                 n->dead = 1;
                                 shrunk  = 1;
                                 write_unlock(&n->lock);
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                 neigh_release(n);
                                 continue;
                         }
@@ -211,6 +213,8 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
                                 NEIGH_PRINTK2("neigh %p is stray.\n", n);
                         }
                         write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                         neigh_release(n);
                 }
         }
@@ -582,9 +586,6 @@ void neigh_destroy(struct neighbour *neigh)
                         kfree(hh);
         }
 
-        if (neigh->parms->neigh_destructor)
-                (neigh->parms->neigh_destructor)(neigh);
-
         skb_queue_purge(&neigh->arp_queue);
 
         dev_put(neigh->dev);
@@ -675,6 +676,8 @@ static void neigh_periodic_timer(unsigned long arg)
                         *np = n->next;
                         n->dead = 1;
                         write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                         neigh_release(n);
                         continue;
                 }
@@ -2088,8 +2091,11 @@ void __neigh_for_each_release(struct neigh_table *tbl,
                         } else
                                 np = &n->next;
                         write_unlock(&n->lock);
-                        if (release)
+                        if (release) {
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                 neigh_release(n);
+                        }
                 }
         }
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 820761f9eeef..702fa8f08747 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -463,6 +463,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         memcpy(n->cb, skb->cb, sizeof(skb->cb));
         C(len);
         C(data_len);
+        C(mac_len);
         C(csum);
         C(local_df);
         n->cloned = 1;
diff --git a/net/core/sock.c b/net/core/sock.c
index 8d65d6478dcd..27c4f62382bd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -808,7 +808,7 @@ lenout:
  *
  * (We also register the sk_lock with the lock validator.)
  */
-static void inline sock_lock_init(struct sock *sk)
+static inline void sock_lock_init(struct sock *sk)
 {
         sock_lock_init_class_and_name(sk,
                         af_family_slock_key_strings[sk->sk_family],
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index a0e7cd183a5d..e33a9edb4036 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -191,7 +191,6 @@ extern void dccp_send_sync(struct sock *sk, const u64 seq,
                            const enum dccp_pkt_type pkt_type);
 
 extern void dccp_write_xmit(struct sock *sk, int block);
-extern void dccp_write_xmit_timer(unsigned long data);
 extern void dccp_write_space(struct sock *sk);
 
 extern void dccp_init_xmit_timers(struct sock *sk);
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index b038a0a3ad40..0197a41c256a 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -262,7 +262,7 @@ out:
 }
 
 /* Transmit-delay timer: used by the CCIDs to delay actual send time */
-void dccp_write_xmit_timer(unsigned long data)
+static void dccp_write_xmit_timer(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
         struct dccp_sock *dp = dccp_sk(sk);
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 3cbfddc98430..82d58a977e6f 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -63,7 +63,7 @@ static struct
 {
         int error;
         u8 scope;
-} dn_fib_props[RTA_MAX+1] = {
+} dn_fib_props[RTN_MAX+1] = {
         [RTN_UNSPEC] =      { .error = 0,       .scope = RT_SCOPE_NOWHERE },
         [RTN_UNICAST] =     { .error = 0,       .scope = RT_SCOPE_UNIVERSE },
         [RTN_LOCAL] =       { .error = 0,       .scope = RT_SCOPE_HOST },
@@ -276,6 +276,9 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
         struct dn_fib_info *ofi;
         int nhs = 1;
 
+        if (r->rtm_type > RTN_MAX)
+                goto err_inval;
+
         if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
                 goto err_inval;
 
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index b6c98ac93dc8..5e86dd542302 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -109,8 +109,6 @@ errout:
 
 static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U16 },
-        [FRA_DST]       = { .type = NLA_U16 },
 };
 
 static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
@@ -133,7 +131,7 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
 
-        if (frh->src_len > 16 || frh->dst_len > 16 || frh->tos)
+        if (frh->tos)
                 goto  errout;
 
         if (rule->table == RT_TABLE_UNSPEC) {
@@ -150,10 +148,10 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 r->src = nla_get_le16(tb[FRA_SRC]);
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 r->dst = nla_get_le16(tb[FRA_DST]);
 
         r->src_len = frh->src_len;
@@ -176,10 +174,10 @@ static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->dst_len && (r->dst_len != frh->dst_len))
                 return 0;
 
-        if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC])))
+        if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST])))
+        if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -249,6 +247,7 @@ int dn_fib_dump_rules(struct sk_buff *skb, struct netlink_callback *cb)
 static struct fib_rules_ops dn_fib_rules_ops = {
         .family         = AF_DECnet,
         .rule_size      = sizeof(struct dn_fib_rule),
+        .addr_size      = sizeof(u16),
         .action         = dn_fib_rule_action,
         .match          = dn_fib_rule_match,
         .configure      = dn_fib_rule_configure,
diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index a64be6cdf078..6ef766ef9618 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -38,7 +38,7 @@ config IEEE80211_CRYPT_WEP
         Include software based cipher suites in support of IEEE
         802.11's WEP.  This is needed for WEP as well as 802.1x.
 
-        This can be compiled as a modules and it will be called
+        This can be compiled as a module and it will be called
         "ieee80211_crypt_wep".
 
 config IEEE80211_CRYPT_CCMP
@@ -51,7 +51,7 @@ config IEEE80211_CRYPT_CCMP
         (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with CCMP enabled
         networks.
 
-        This can be compiled as a modules and it will be called
+        This can be compiled as a module and it will be called
         "ieee80211_crypt_ccmp".
 
 config IEEE80211_CRYPT_TKIP
@@ -66,7 +66,7 @@ config IEEE80211_CRYPT_TKIP
         (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
         networks.
 
-        This can be compiled as a modules and it will be called
+        This can be compiled as a module and it will be called
         "ieee80211_crypt_tkip".
 
 source "net/ieee80211/softmac/Kconfig"
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index c976dd7e9758..2ce5b693a8bd 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1933,6 +1933,11 @@ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
                                                  &cipso_ptr[6],
                                                  secattr);
                 break;
+        case CIPSO_V4_TAG_RANGE:
+                ret_val = cipso_v4_parsetag_rng(doi_def,
+                                                &cipso_ptr[6],
+                                                secattr);
+                break;
         }
 
 skbuff_getattr_return:
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 1fba6439fc57..fc920f63452b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -493,6 +493,11 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
         cfg->fc_nlinfo.nlh = nlh;
 
+        if (cfg->fc_type > RTN_MAX) {
+                err = -EINVAL;
+                goto errout;
+        }
+
         nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
                 switch (attr->nla_type) {
                 case RTA_DST:
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index b837c33e0404..c660c074c76c 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -171,8 +171,6 @@ static struct fib_table *fib_empty_table(void)
 
 static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U32 },
-        [FRA_DST]       = { .type = NLA_U32 },
         [FRA_FLOW]      = { .type = NLA_U32 },
 };
 
@@ -183,8 +181,7 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib4_rule *rule4 = (struct fib4_rule *) rule;
 
-        if (frh->src_len > 32 || frh->dst_len > 32 ||
-            (frh->tos & ~IPTOS_TOS_MASK))
+        if (frh->tos & ~IPTOS_TOS_MASK)
                 goto errout;
 
         if (rule->table == RT_TABLE_UNSPEC) {
@@ -201,10 +198,10 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 rule4->src = nla_get_be32(tb[FRA_SRC]);
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 rule4->dst = nla_get_be32(tb[FRA_DST]);
 
 #ifdef CONFIG_NET_CLS_ROUTE
@@ -242,10 +239,10 @@ static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
                 return 0;
 #endif
 
-        if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC])))
+        if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST])))
+        if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -309,6 +306,7 @@ static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib4_rules_ops = {
         .family         = AF_INET,
         .rule_size      = sizeof(struct fib4_rule),
+        .addr_size      = sizeof(u32),
         .action         = fib4_rule_action,
         .match          = fib4_rule_match,
         .configure      = fib4_rule_configure,
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 2f1fdae6efa6..3dad12ee76c3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -89,7 +89,7 @@ static const struct
 {
         int     error;
         u8      scope;
-} fib_props[RTA_MAX + 1] = {
+} fib_props[RTN_MAX + 1] = {
         {
                 .error  = 0,
                 .scope  = RT_SCOPE_NOWHERE,
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 72b3036bbc09..214c34732e84 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1123,6 +1123,9 @@ err:
         return fa_head;
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
@@ -1527,7 +1530,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
         t->revision++;
         t->size--;
 
-        preempt_disable();
         tp = NODE_PARENT(n);
         tnode_free((struct tnode *) n);
 
@@ -1537,11 +1539,13 @@ static int trie_leaf_remove(struct trie *t, t_key key)
                 rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
         } else
                 rcu_assign_pointer(t->trie, NULL);
-        preempt_enable();
 
         return 1;
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
@@ -1720,6 +1724,9 @@ up:
         return NULL; /* Ready. Root of trie */
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1c6a084b5fb7..8cedb2a2c9df 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1255,9 +1255,9 @@ out:
  */
 void ip_mc_rejoin_group(struct ip_mc_list *im)
 {
+#ifdef CONFIG_IP_MULTICAST
         struct in_device *in_dev = im->interface;
 
-#ifdef CONFIG_IP_MULTICAST
         if (im->multiaddr == IGMP_ALL_HOSTS)
                 return;
 
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index adf25f9f70e1..6bcfdf6dfcc9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -253,14 +253,17 @@ ip_nat_local_fn(unsigned int hooknum,
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if (ct->tuplehash[dir].tuple.dst.ip !=
-                    ct->tuplehash[!dir].tuple.src.ip
-#ifdef CONFIG_XFRM
-                    || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[!dir].tuple.src.u.all
-#endif
-                    )
+                    ct->tuplehash[!dir].tuple.src.ip) {
                         if (ip_route_me_harder(pskb, RTN_UNSPEC))
                                 ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (ip_xfrm_me_harder(pskb))
+                                ret = NF_DROP;
+#endif
+
         }
         return ret;
 }
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index e4d3ef17d45b..15aa3db8cb33 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -245,14 +245,16 @@ nf_nat_local_fn(unsigned int hooknum,
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if (ct->tuplehash[dir].tuple.dst.u3.ip !=
-                    ct->tuplehash[!dir].tuple.src.u3.ip
-#ifdef CONFIG_XFRM
-                    || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[!dir].tuple.src.u.all
-#endif
-                    )
+                    ct->tuplehash[!dir].tuple.src.u3.ip) {
                         if (ip_route_me_harder(pskb, RTN_UNSPEC))
                                 ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (ip_xfrm_me_harder(pskb))
+                                ret = NF_DROP;
+#endif
         }
         return ret;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 74c4d103ebc2..3834b10b5115 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2458,11 +2458,18 @@ void __init tcp_init(void)
                 sysctl_max_syn_backlog = 128;
         }
 
-        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
-        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
-        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+        /* Set the pressure threshold to be a fraction of global memory that
+         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
+         * memory, with a floor of 128 pages.
+         */
+        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = max(limit, 128UL);
+        sysctl_tcp_mem[0] = limit / 4 * 3;
+        sysctl_tcp_mem[1] = limit;
         sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
 
+        /* Set per-socket limits to no more than 1/128 the pressure threshold */
         limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
         max_share = min(4UL*1024*1024, limit);
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7fee6b27320..1b616992d916 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -804,7 +804,7 @@ struct ipv6_saddr_score {
 #define IPV6_SADDR_SCORE_LABEL          0x0020
 #define IPV6_SADDR_SCORE_PRIVACY        0x0040
 
-static int inline ipv6_saddr_preferred(int type)
+static inline int ipv6_saddr_preferred(int type)
 {
         if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
                     IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
@@ -813,7 +813,7 @@ static int inline ipv6_saddr_preferred(int type)
 }
 
 /* static matching label */
-static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
+static inline int ipv6_saddr_label(const struct in6_addr *addr, int type)
 {
  /*
   *     prefix (longest match)  label
@@ -3318,7 +3318,7 @@ errout:
                 rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
 
-static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
+static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
                                 __s32 *array, int bytes)
 {
         BUG_ON(bytes < (DEVCONF_MAX * 4));
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0862809ffcf7..ea3035b4e3e8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
-        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
-        if (frh->src_len > 128 || frh->dst_len > 128)
-                goto errout;
-
         if (rule->action == FR_ACT_TO_TBL) {
                 if (rule->table == RT6_TABLE_UNSPEC)
                         goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
                            sizeof(struct in6_addr));
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                            sizeof(struct in6_addr));
 
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->tos && (rule6->tclass != frh->tos))
                 return 0;
 
-        if (tb[FRA_SRC] &&
+        if (frh->src_len &&
             nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
                 return 0;
 
-        if (tb[FRA_DST] &&
+        if (frh->dst_len &&
             nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                 return 0;
 
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib6_rules_ops = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
+        .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
         .match                  = fib6_rule_match,
         .configure              = fib6_rule_configure,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f4d7be77eb0f..268f476ef3db 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -658,6 +658,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 ins = &iter->u.dst.rt6_next;
         }
 
+        /* Reset round-robin state, if necessary */
+        if (ins == &fn->leaf)
+                fn->rr_ptr = NULL;
+
         /*
          *      insert node
          */
@@ -1109,6 +1113,10 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         rt6_stats.fib_rt_entries--;
         rt6_stats.fib_discarded_routes++;
 
+        /* Reset round-robin state, if necessary */
+        if (fn->rr_ptr == rt)
+                fn->rr_ptr = NULL;
+
         /* Adjust walkers */
         read_lock(&fib6_walker_lock);
         FOR_WALKERS(w) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0e1f4b2cd3dd..3931b33b25e8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -308,7 +308,7 @@ static inline void rt6_probe(struct rt6_info *rt)
 /*
  * Default Router Selection (RFC 2461 6.3.6)
  */
-static int inline rt6_check_dev(struct rt6_info *rt, int oif)
+static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
         struct net_device *dev = rt->rt6i_dev;
         int ret = 0;
@@ -328,7 +328,7 @@ static int inline rt6_check_dev(struct rt6_info *rt, int oif)
         return ret;
 }
 
-static int inline rt6_check_neigh(struct rt6_info *rt)
+static inline int rt6_check_neigh(struct rt6_info *rt)
 {
         struct neighbour *neigh = rt->rt6i_nexthop;
         int m = 0;
@@ -363,55 +363,76 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         return m;
 }
 
-static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
-                                   int strict)
+static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+                                   int *mpri, struct rt6_info *match)
 {
-        struct rt6_info *match = NULL, *last = NULL;
-        struct rt6_info *rt, *rt0 = *head;
-        u32 metric;
+        int m;
+
+        if (rt6_check_expired(rt))
+                goto out;
+
+        m = rt6_score_route(rt, oif, strict);
+        if (m < 0)
+                goto out;
+
+        if (m > *mpri) {
+                if (strict & RT6_LOOKUP_F_REACHABLE)
+                        rt6_probe(match);
+                *mpri = m;
+                match = rt;
+        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
+                rt6_probe(rt);
+        }
+
+out:
+        return match;
+}
+
+static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *rr_head,
+                                     u32 metric, int oif, int strict)
+{
+        struct rt6_info *rt, *match;
         int mpri = -1;
 
-        RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n",
-                  __FUNCTION__, head, head ? *head : NULL, oif);
+        match = NULL;
+        for (rt = rr_head; rt && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
+        for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
 
-        for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
-             rt = rt->u.dst.rt6_next) {
-                int m;
+        return match;
+}
 
-                if (rt6_check_expired(rt))
-                        continue;
+static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+{
+        struct rt6_info *match, *rt0;
 
-                last = rt;
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __FUNCTION__, fn->leaf, oif);
 
-                m = rt6_score_route(rt, oif, strict);
-                if (m < 0)
-                        continue;
+        rt0 = fn->rr_ptr;
+        if (!rt0)
+                fn->rr_ptr = rt0 = fn->leaf;
 
-                if (m > mpri) {
-                        if (strict & RT6_LOOKUP_F_REACHABLE)
-                                rt6_probe(match);
-                        match = rt;
-                        mpri = m;
-                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                        rt6_probe(rt);
-                }
-        }
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
 
         if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE) &&
-            last && last != rt0) {
+            (strict & RT6_LOOKUP_F_REACHABLE)) {
+                struct rt6_info *next = rt0->u.dst.rt6_next;
+
                 /* no entries matched; do round-robin */
-                static DEFINE_SPINLOCK(lock);
-                spin_lock(&lock);
-                *head = rt0->u.dst.rt6_next;
-                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
-                last->u.dst.rt6_next = rt0;
-                spin_unlock(&lock);
+                if (!next || next->rt6i_metric != rt0->rt6i_metric)
+                        next = fn->leaf;
+
+                if (next != rt0)
+                        fn->rr_ptr = next;
         }
 
-        RT6_TRACE("%s() => %p, score=%d\n",
-                  __FUNCTION__, match, mpri);
+        RT6_TRACE("%s() => %p\n",
+                  __FUNCTION__, match);
 
         return (match ? match : &ip6_null_entry);
 }
@@ -657,7 +678,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
+        rt = rt6_select(fn, fl->iif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -752,7 +773,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
+        rt = rt6_select(fn, fl->oif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f57a9baa6b27..92f99927d12d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->opt = NULL;
+        newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index ee4b84a33ff4..93c42232aa39 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -58,7 +58,7 @@ static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
 
-static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
         unsigned h;
 
@@ -70,7 +70,7 @@ static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
         return h;
 }
 
-static unsigned inline xfrm6_tunnel_spi_hash_byspi(u32 spi)
+static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
 {
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index 873ae189e37a..bc2e15ce7004 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -419,7 +419,7 @@ typedef struct irnet_socket
   u32                   raccm;          /* to please pppd - dummy) */
   unsigned int          flags;          /* PPP flags (compression, ...) */
   unsigned int          rbits;          /* Unused receive flags ??? */
-
+  struct work_struct disconnect_work;   /* Process context disconnection */
   /* ------------------------ IrTTP part ------------------------ */
   /* We create a pseudo "socket" over the IrDA tranport */
   unsigned long         ttp_open;       /* Set when IrTTP is ready */
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index c378e668af0c..a4f1439ffdd8 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -10,6 +10,27 @@
 
 #include "irnet_irda.h"         /* Private header */
 
+/*
+ * PPP disconnect work: we need to make sure we're in
+ * process context when calling ppp_unregister_channel().
+ */
+static void irnet_ppp_disconnect(struct work_struct *work)
+{
+        irnet_socket * self =
+                container_of(work, irnet_socket, disconnect_work);
+
+        if (self == NULL)
+                return;
+        /*
+         * If we were connected, cleanup & close the PPP
+         * channel, which will kill pppd (hangup) and the rest.
+         */
+        if (self->ppp_open && !self->ttp_open && !self->ttp_connect) {
+                ppp_unregister_channel(&self->chan);
+                self->ppp_open = 0;
+        }
+}
+
 /************************* CONTROL CHANNEL *************************/
 /*
  * When ppp is not active, /dev/irnet act as a control channel.
@@ -499,6 +520,8 @@ irda_irnet_create(irnet_socket *	self)
 #endif /* DISCOVERY_NOMASK */
   self->tx_flow = FLOW_START;   /* Flow control from IrTTP */
 
+  INIT_WORK(&self->disconnect_work, irnet_ppp_disconnect);
+
   DEXIT(IRDA_SOCK_TRACE, "\n");
   return(0);
 }
@@ -1134,15 +1157,8 @@ irnet_disconnect_indication(void *	instance,
     {
       if(test_open)
         {
-#ifdef MISSING_PPP_API
-          /* ppp_unregister_channel() wants a user context, which we
-           * are guaranteed to NOT have here. What are we supposed
-           * to do here ? Jean II */
-          /* If we were connected, cleanup & close the PPP channel,
-           * which will kill pppd (hangup) and the rest */
-          ppp_unregister_channel(&self->chan);
-          self->ppp_open = 0;
-#endif
+          /* ppp_unregister_channel() wants a user context. */
+          schedule_work(&self->disconnect_work);
         }
       else
         {
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index a7486b3bddcb..da3f2bc1b6f6 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1455,6 +1455,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
 
         /* Not everything should be copied */
         new->notify.instance = instance;
+        spin_lock_init(&new->lock);
         init_timer(&new->todo_timer);
 
         skb_queue_head_init(&new->rx_queue);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 253fce3ad2d3..54698af6d0af 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -275,6 +275,7 @@ config NF_CT_NETLINK
         tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
         depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
         depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+        depends on NF_NAT=n || NF_NAT
         help
           This option enables support for a netlink-based userspace interface
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 8c34f1ca6c8c..f92d5310847b 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -700,23 +700,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
         unsigned char cause, diagnostic;
         struct net_device *dev;
         ax25_uid_assoc *user;
-        int n;
-
-        if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
-                sock->state = SS_CONNECTED;
-                return 0;       /* Connect completed during a ERESTARTSYS event */
-        }
-
-        if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
-                sock->state = SS_UNCONNECTED;
-                return -ECONNREFUSED;
-        }
-
-        if (sk->sk_state == TCP_ESTABLISHED)
-                return -EISCONN;        /* No reconnect on a seqpacket socket */
-
-        sk->sk_state   = TCP_CLOSE;
-        sock->state = SS_UNCONNECTED;
+        int n, err = 0;
 
         if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
                 return -EINVAL;
@@ -734,24 +718,53 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
         if ((rose->source_ndigis + addr->srose_ndigis) > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
+        lock_sock(sk);
+
+        if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
+                /* Connect completed during a ERESTARTSYS event */
+                sock->state = SS_CONNECTED;
+                goto out_release;
+        }
+
+        if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
+                sock->state = SS_UNCONNECTED;
+                err = -ECONNREFUSED;
+                goto out_release;
+        }
+
+        if (sk->sk_state == TCP_ESTABLISHED) {
+                /* No reconnect on a seqpacket socket */
+                err = -EISCONN;
+                goto out_release;
+        }
+
+        sk->sk_state   = TCP_CLOSE;
+        sock->state = SS_UNCONNECTED;
+
         rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
                                          &diagnostic);
         if (!rose->neighbour)
                 return -ENETUNREACH;
 
         rose->lci = rose_new_lci(rose->neighbour);
-        if (!rose->lci)
-                return -ENETUNREACH;
+        if (!rose->lci) {
+                err = -ENETUNREACH;
+                goto out_release;
+        }
 
         if (sock_flag(sk, SOCK_ZAPPED)) {       /* Must bind first - autobinding in this may or may not work */
                 sock_reset_flag(sk, SOCK_ZAPPED);
 
-                if ((dev = rose_dev_first()) == NULL)
-                        return -ENETUNREACH;
+                if ((dev = rose_dev_first()) == NULL) {
+                        err = -ENETUNREACH;
+                        goto out_release;
+                }
 
                 user = ax25_findbyuid(current->euid);
-                if (!user)
-                        return -EINVAL;
+                if (!user) {
+                        err = -EINVAL;
+                        goto out_release;
+                }
 
                 memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
                 rose->source_call = user->call;
@@ -789,8 +802,10 @@ rose_try_next_neigh:
         rose_start_t1timer(sk);
 
         /* Now the loop */
-        if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
-                return -EINPROGRESS;
+        if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
+                err = -EINPROGRESS;
+                goto out_release;
+        }
 
         /*
          * A Connect Ack with Choke or timeout or failed routing will go to
@@ -805,8 +820,10 @@ rose_try_next_neigh:
                         set_current_state(TASK_INTERRUPTIBLE);
                         if (sk->sk_state != TCP_SYN_SENT)
                                 break;
+                        release_sock(sk);
                         if (!signal_pending(tsk)) {
                                 schedule();
+                                lock_sock(sk);
                                 continue;
                         }
                         current->state = TASK_RUNNING;
@@ -822,14 +839,19 @@ rose_try_next_neigh:
                 rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, &diagnostic);
                 if (rose->neighbour)
                         goto rose_try_next_neigh;
-        /* No more neighbour */
+
+                /* No more neighbours */
                 sock->state = SS_UNCONNECTED;
-                return sock_error(sk);  /* Always set at this point */
+                err = sock_error(sk);   /* Always set at this point */
+                goto out_release;
         }
 
         sock->state = SS_CONNECTED;
 
-        return 0;
+out_release:
+        release_sock(sk);
+
+        return err;
 }
 
 static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
@@ -877,6 +899,8 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
                         lock_sock(sk);
                         continue;
                 }
+                current->state = TASK_RUNNING;
+                remove_wait_queue(sk->sk_sleep, &wait);
                 return -ERESTARTSYS;
         }
         current->state = TASK_RUNNING;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index fad08e521c24..70fe36eb66a2 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
 
 static int basic_init(struct tcf_proto *tp)
 {
+        struct basic_head *head;
+
+        head = kzalloc(sizeof(*head), GFP_KERNEL);
+        if (head == NULL)
+                return -ENOBUFS;
+        INIT_LIST_HEAD(&head->flist);
+        tp->root = head;
         return 0;
 }
 
@@ -176,15 +183,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
         }
 
         err = -ENOBUFS;
-        if (head == NULL) {
-                head = kzalloc(sizeof(*head), GFP_KERNEL);
-                if (head == NULL)
-                        goto errout;
-
-                INIT_LIST_HEAD(&head->flist);
-                tp->root = head;
-        }
-
         f = kzalloc(sizeof(*f), GFP_KERNEL);
         if (f == NULL)
                 goto errout;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index e85df07d8ce7..abc47cc48ad0 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -93,7 +93,7 @@ void route4_reset_fastmap(struct net_device *dev, struct route4_head *head, u32
         spin_unlock_bh(&dev->queue_lock);
 }
 
-static void __inline__
+static inline void
 route4_set_fastmap(struct route4_head *head, u32 id, int iif,
                    struct route4_filter *f)
 {
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index fa82b73c965b..78d2ddb5ca18 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1046,6 +1046,9 @@ void sctp_assoc_update(struct sctp_association *asoc,
                 trans = list_entry(pos, struct sctp_transport, transports);
                 if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
                         sctp_assoc_del_peer(asoc, &trans->ipaddr);
+
+                if (asoc->state >= SCTP_STATE_ESTABLISHED)
+                        sctp_transport_reset(trans);
         }
 
         /* If the case is A (association restart), use
@@ -1063,6 +1066,18 @@ void sctp_assoc_update(struct sctp_association *asoc,
                  */
                 sctp_ssnmap_clear(asoc->ssnmap);
 
+                /* Flush the ULP reassembly and ordered queue.
+                 * Any data there will now be stale and will
+                 * cause problems.
+                 */
+                sctp_ulpq_flush(&asoc->ulpq);
+
+                /* reset the overall association error count so
+                 * that the restarted association doesn't get torn
+                 * down on the next retransmission timer.
+                 */
+                asoc->overall_error_count = 0;
+
         } else {
                 /* Add any peer addresses from the new association. */
                 list_for_each(pos, &new->peer.transport_addr_list) {
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 70c39eac0581..e9097cf614ba 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4342,8 +4342,24 @@ sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
                                         void *arg,
                                         sctp_cmd_seq_t *commands)
 {
-        return sctp_sf_heartbeat(ep, asoc, type, (struct sctp_transport *)arg,
-                                 commands);
+        if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
+                                      (struct sctp_transport *)arg, commands))
+                return SCTP_DISPOSITION_NOMEM;
+
+        /*
+         * RFC 2960 (bis), section 8.3
+         *
+         *    D) Request an on-demand HEARTBEAT on a specific destination
+         *    transport address of a given association.
+         *
+         *    The endpoint should increment the respective error  counter of
+         *    the destination transport address each time a HEARTBEAT is sent
+         *    to that address and not acknowledged within one RTO.
+         *
+         */
+        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
+                        SCTP_TRANSPORT(arg));
+        return SCTP_DISPOSITION_CONSUME;
 }
 
 /*
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index a596f5308cb1..4d8c2ab864fc 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -526,3 +526,35 @@ unsigned long sctp_transport_timeout(struct sctp_transport *t)
         timeout += jiffies;
         return timeout;
 }
+
+/* Reset transport variables to their initial values */
+void sctp_transport_reset(struct sctp_transport *t)
+{
+        struct sctp_association *asoc = t->asoc;
+
+        /* RFC 2960 (bis), Section 5.2.4
+         * All the congestion control parameters (e.g., cwnd, ssthresh)
+         * related to this peer MUST be reset to their initial values
+         * (see Section 6.2.1)
+         */
+        t->cwnd = min(4*asoc->pathmtu, max_t(__u32, 2*asoc->pathmtu, 4380));
+        t->ssthresh = asoc->peer.i.a_rwnd;
+        t->rto = asoc->rto_initial;
+        t->rtt = 0;
+        t->srtt = 0;
+        t->rttvar = 0;
+
+        /* Reset these additional varibles so that we have a clean
+         * slate.
+         */
+        t->partial_bytes_acked = 0;
+        t->flight_size = 0;
+        t->error_count = 0;
+        t->rto_pending = 0;
+
+        /* Initialize the state information for SFR-CACC */
+        t->cacc.changeover_active = 0;
+        t->cacc.cycling_changeover = 0;
+        t->cacc.next_tsn_at_change = 0;
+        t->cacc.cacc_saw_newack = 0;
+}
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index f4759a9bdaee..bfb197e37da3 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -73,7 +73,7 @@ struct sctp_ulpq *sctp_ulpq_init(struct sctp_ulpq *ulpq,
 
 
 /* Flush the reassembly and ordering queues.  */
-static void sctp_ulpq_flush(struct sctp_ulpq *ulpq)
+void sctp_ulpq_flush(struct sctp_ulpq *ulpq)
 {
         struct sk_buff *skb;
         struct sctp_ulpevent *event;
diff --git a/net/socket.c b/net/socket.c
index 9566e57ac7f5..ea8f81abc45c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
 
         err = sock_attach_fd(newsock, newfile);
         if (err < 0)
-                goto out_fd;
+                goto out_fd_simple;
 
         err = security_socket_accept(sock, newsock);
         if (err)
@@ -1414,6 +1414,11 @@ out_put:
         fput_light(sock->file, fput_needed);
 out:
         return err;
+out_fd_simple:
+        sock_release(newsock);
+        put_filp(newfile);
+        put_unused_fd(newfd);
+        goto out_put;
 out_fd:
         fput(newfile);
         put_unused_fd(newfd);
diff --git a/net/wanrouter/af_wanpipe.c b/net/wanrouter/af_wanpipe.c
deleted file mode 100644
index 41d7e32be70d..000000000000
--- a/net/wanrouter/af_wanpipe.c
+++ /dev/null
@@ -1,2600 +0,0 @@
-/*****************************************************************************
-* af_wanpipe.c  WANPIPE(tm) Secure Socket Layer.
-*
-* Author:       Nenad Corbic    <ncorbic@sangoma.com>
-*
-* Copyright:    (c) 2000 Sangoma Technologies Inc.
-*
-*               This program is free software; you can redistribute it and/or
-*               modify it under the terms of the GNU General Public License
-*               as published by the Free Software Foundation; either version
-*               2 of the License, or (at your option) any later version.
-* ============================================================================
-* Due Credit:
-*               Wanpipe socket layer is based on Packet and
-*               the X25 socket layers. The above sockets were
-*               used for the specific use of Sangoma Technologies
-*               API programs.
-*               Packet socket Authors: Ross Biro, Fred N. van Kempen and
-*                                      Alan Cox.
-*               X25 socket Author: Jonathan Naylor.
-* ============================================================================
-* Mar 15, 2002  Arnaldo C. Melo  o Use wp_sk()->num, as it isnt anymore in sock
-* Apr 25, 2000  Nenad Corbic     o Added the ability to send zero length packets.
-* Mar 13, 2000  Nenad Corbic     o Added a tx buffer check via ioctl call.
-* Mar 06, 2000  Nenad Corbic     o Fixed the corrupt sock lcn problem.
-*                                  Server and client application can run
-*                                  simultaneously without conflicts.
-* Feb 29, 2000  Nenad Corbic     o Added support for PVC protocols, such as
-*                                  CHDLC, Frame Relay and HDLC API.
-* Jan 17, 2000  Nenad Corbic     o Initial version, based on AF_PACKET socket.
-*                                  X25API support only.
-*
-******************************************************************************/
-
-#include <linux/types.h>
-#include <linux/sched.h>
-#include <linux/mm.h>
-#include <linux/capability.h>
-#include <linux/fcntl.h>
-#include <linux/socket.h>
-#include <linux/in.h>
-#include <linux/inet.h>
-#include <linux/netdevice.h>
-#include <linux/poll.h>
-#include <linux/wireless.h>
-#include <linux/kmod.h>
-#include <net/ip.h>
-#include <net/protocol.h>
-#include <linux/skbuff.h>
-#include <net/sock.h>
-#include <linux/errno.h>
-#include <linux/timer.h>
-#include <asm/system.h>
-#include <asm/uaccess.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/if_wanpipe.h>
-#include <linux/pkt_sched.h>
-#include <linux/tcp_states.h>
-#include <linux/if_wanpipe_common.h>
-
-#ifdef CONFIG_INET
-#include <net/inet_common.h>
-#endif
-
-#define SLOW_BACKOFF 0.1*HZ
-#define FAST_BACKOFF 0.01*HZ
-
-//#define PRINT_DEBUG
-#ifdef PRINT_DEBUG
-        #define DBG_PRINTK(format, a...) printk(format, ## a)
-#else
-        #define DBG_PRINTK(format, a...)
-#endif
-
-
-/* SECURE SOCKET IMPLEMENTATION
- *
- *   TRANSMIT:
- *
- *      When the user sends a packet via send() system call
- *      the wanpipe_sendmsg() function is executed.
- *
- *      Each packet is enqueud into sk->sk_write_queue transmit
- *      queue. When the packet is enqueued, a delayed transmit
- *      timer is triggerd which acts as a Bottom Half hander.
- *
- *      wanpipe_delay_transmit() function (BH), dequeues packets
- *      from the sk->sk_write_queue transmit queue and sends it
- *      to the deriver via dev->hard_start_xmit(skb, dev) function.
- *      Note, this function is actual a function pointer of if_send()
- *      routine in the wanpipe driver.
- *
- *      X25API GUARANTEED DELIVERY:
- *
- *         In order to provide 100% guaranteed packet delivery,
- *         an atomic 'packet_sent' counter is implemented.  Counter
- *         is incremented for each packet enqueued
- *         into sk->sk_write_queue.  Counter is decremented each
- *         time wanpipe_delayed_transmit() function successfuly
- *         passes the packet to the driver. Before each send(), a poll
- *         routine checks the sock resources The maximum value of
- *         packet sent counter is 1, thus if one packet is queued, the
- *         application will block until that packet is passed to the
- *         driver.
- *
- *   RECEIVE:
- *
- *      Wanpipe device drivers call the socket bottom half
- *      function, wanpipe_rcv() to queue the incoming packets
- *      into an AF_WANPIPE socket queue.  Based on wanpipe_rcv()
- *      return code, the driver knows whether the packet was
- *      successfully queued.  If the socket queue is full,
- *      protocol flow control is used by the driver, if any,
- *      to slow down the traffic until the sock queue is free.
- *
- *      Every time a packet arrives into a socket queue the
- *      socket wakes up processes which are waiting to receive
- *      data.
- *
- *      If the socket queue is full, the driver sets a block
- *      bit which signals the socket to kick the wanpipe driver
- *      bottom half hander when the socket queue is partialy
- *      empty. wanpipe_recvmsg() function performs this action.
- *
- *      In case of x25api, packets will never be dropped, since
- *      flow control is available.
- *
- *      In case of streaming protocols like CHDLC, packets will
- *      be dropped but the statistics will be generated.
- */
-
-
-/* The code below is used to test memory leaks. It prints out
- * a message every time kmalloc and kfree system calls get executed.
- * If the calls match there is no leak :)
- */
-
-/***********FOR DEBUGGING PURPOSES*********************************************
-#define KMEM_SAFETYZONE 8
-
-static void * dbg_kmalloc(unsigned int size, int prio, int line) {
-        void * v = kmalloc(size,prio);
-        printk(KERN_INFO "line %d  kmalloc(%d,%d) = %p\n",line,size,prio,v);
-        return v;
-}
-static void dbg_kfree(void * v, int line) {
-        printk(KERN_INFO "line %d  kfree(%p)\n",line,v);
-        kfree(v);
-}
-
-#define kmalloc(x,y) dbg_kmalloc(x,y,__LINE__)
-#define kfree(x) dbg_kfree(x,__LINE__)
-******************************************************************************/
-
-
-/* List of all wanpipe sockets. */
-HLIST_HEAD(wanpipe_sklist);
-static DEFINE_RWLOCK(wanpipe_sklist_lock);
-
-atomic_t wanpipe_socks_nr;
-static unsigned long wanpipe_tx_critical;
-
-#if 0
-/* Private wanpipe socket structures. */
-struct wanpipe_opt
-{
-        void   *mbox;           /* Mail box  */
-        void   *card;           /* Card bouded to */
-        struct net_device *dev; /* Bounded device */
-        unsigned short lcn;     /* Binded LCN */
-        unsigned char  svc;     /* 0=pvc, 1=svc */
-        unsigned char  timer;   /* flag for delayed transmit*/
-        struct timer_list tx_timer;
-        unsigned poll_cnt;
-        unsigned char force;    /* Used to force sock release */
-        atomic_t packet_sent;
-};
-#endif
-
-static int sk_count;
-extern const struct proto_ops wanpipe_ops;
-static unsigned long find_free_critical;
-
-static void wanpipe_unlink_driver(struct sock *sk);
-static void wanpipe_link_driver(struct net_device *dev, struct sock *sk);
-static void wanpipe_wakeup_driver(struct sock *sk);
-static int execute_command(struct sock *, unsigned char, unsigned int);
-static int check_dev(struct net_device *dev, sdla_t *card);
-struct net_device *wanpipe_find_free_dev(sdla_t *card);
-static void wanpipe_unlink_card (struct sock *);
-static int wanpipe_link_card (struct sock *);
-static struct sock *wanpipe_make_new(struct sock *);
-static struct sock *wanpipe_alloc_socket(void);
-static inline int get_atomic_device(struct net_device *dev);
-static int wanpipe_exec_cmd(struct sock *, int, unsigned int);
-static int get_ioctl_cmd (struct sock *, void *);
-static int set_ioctl_cmd (struct sock *, void *);
-static void release_device(struct net_device *dev);
-static void wanpipe_kill_sock_timer (unsigned long data);
-static void wanpipe_kill_sock_irq (struct sock *);
-static void wanpipe_kill_sock_accept (struct sock *);
-static int wanpipe_do_bind(struct sock *sk, struct net_device *dev,
-                           int protocol);
-struct sock * get_newsk_from_skb (struct sk_buff *);
-static int wanpipe_debug (struct sock *, void *);
-static void wanpipe_delayed_transmit (unsigned long data);
-static void release_driver(struct sock *);
-static void start_cleanup_timer (struct sock *);
-static void check_write_queue(struct sock *);
-static int check_driver_busy (struct sock *);
-
-/*============================================================
- * wanpipe_rcv
- *
- *      Wanpipe socket bottom half handler.  This function
- *      is called by the WANPIPE device drivers to queue a
- *      incoming packet into the socket receive queue.
- *      Once the packet is queued, all processes waiting to
- *      read are woken up.
- *
- *      During socket bind, this function is bounded into
- *      WANPIPE driver private.
- *===========================================================*/
-
-static int wanpipe_rcv(struct sk_buff *skb, struct net_device *dev,
-                       struct sock *sk)
-{
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)skb->cb;
-        wanpipe_common_t *chan = dev->priv;
-        /*
-         *      When we registered the protocol we saved the socket in the data
-         *      field for just this event.
-         */
-
-        skb->dev = dev;
-
-        sll->sll_family = AF_WANPIPE;
-        sll->sll_hatype = dev->type;
-        sll->sll_protocol = skb->protocol;
-        sll->sll_pkttype = skb->pkt_type;
-        sll->sll_ifindex = dev->ifindex;
-        sll->sll_halen = 0;
-
-        if (dev->hard_header_parse)
-                sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
-
-        /*
-         * WAN_PACKET_DATA : Data which should be passed up the receive queue.
-         * WAN_PACKET_ASYC : Asynchronous data like place call, which should
-         *                   be passed up the listening sock.
-         * WAN_PACKET_ERR  : Asynchronous data like clear call or restart
-         *                   which should go into an error queue.
-         */
-        switch (skb->pkt_type){
-
-                case WAN_PACKET_DATA:
-                        if (sock_queue_rcv_skb(sk,skb)<0){
-                                return -ENOMEM;
-                        }
-                        break;
-                case WAN_PACKET_CMD:
-                        sk->sk_state = chan->state;
-                        /* Bug fix: update Mar6.
-                         * Do not set the sock lcn number here, since
-                         * cmd is not guaranteed to be executed on the
-                         * board, thus Lcn could be wrong */
-                        sk->sk_data_ready(sk, skb->len);
-                        kfree_skb(skb);
-                        break;
-                case WAN_PACKET_ERR:
-                        sk->sk_state = chan->state;
-                        if (sock_queue_err_skb(sk,skb)<0){
-                                return -ENOMEM;
-                        }
-                        break;
-                default:
-                        printk(KERN_INFO "wansock: BH Illegal Packet Type Dropping\n");
-                        kfree_skb(skb);
-                        break;
-        }
-
-//??????????????????????
-//      if (sk->sk_state == WANSOCK_DISCONNECTED){
-//              if (sk->sk_zapped) {
-//                      //printk(KERN_INFO "wansock: Disconnected, killing early\n");
-//                      wanpipe_unlink_driver(sk);
-//                      sk->sk_bound_dev_if = 0;
-//              }
-//      }
-
-        return 0;
-}
-
-/*============================================================
- * wanpipe_listen_rcv
- *
- *      Wanpipe LISTEN socket bottom half handler.  This function
- *      is called by the WANPIPE device drivers to queue an
- *      incoming call into the socket listening queue.
- *      Once the packet is queued, the waiting accept() process
- *      is woken up.
- *
- *      During socket bind, this function is bounded into
- *      WANPIPE driver private.
- *
- *      IMPORTANT NOTE:
- *          The accept call() is waiting for an skb packet
- *          which contains a pointer to a device structure.
- *
- *          When we do a bind to a device structre, we
- *          bind a newly created socket into "chan->sk".  Thus,
- *          when accept receives the skb packet, it will know
- *          from which dev it came form, and in turn it will know
- *          the address of the new sock.
- *
- *      NOTE: This function gets called from driver ISR.
- *===========================================================*/
-
-static int wanpipe_listen_rcv (struct sk_buff *skb,  struct sock *sk)
-{
-        wanpipe_opt *wp = wp_sk(sk), *newwp;
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)skb->cb;
-        struct sock *newsk;
-        struct net_device *dev;
-        sdla_t *card;
-        mbox_cmd_t *mbox_ptr;
-        wanpipe_common_t *chan;
-
-        /* Find a free device, if none found, all svc's are busy
-         */
-
-        card = (sdla_t*)wp->card;
-        if (!card){
-                printk(KERN_INFO "wansock: LISTEN ERROR, No Card\n");
-                return -ENODEV;
-        }
-
-        dev = wanpipe_find_free_dev(card);
-        if (!dev){
-                printk(KERN_INFO "wansock: LISTEN ERROR, No Free Device\n");
-                return -ENODEV;
-        }
-
-        chan=dev->priv;
-        chan->state = WANSOCK_CONNECTING;
-
-        /* Allocate a new sock, which accept will bind
-         * and pass up to the user
-         */
-        if ((newsk = wanpipe_make_new(sk)) == NULL){
-                release_device(dev);
-                return -ENOMEM;
-        }
-
-
-        /* Initialize the new sock structure
-         */
-        newsk->sk_bound_dev_if = dev->ifindex;
-        newwp = wp_sk(newsk);
-        newwp->card = wp->card;
-
-        /* Insert the sock into the main wanpipe
-         * sock list.
-         */
-        atomic_inc(&wanpipe_socks_nr);
-
-        /* Allocate and fill in the new Mail Box. Then
-         * bind the mail box to the sock. It will be
-         * used by the ioctl call to read call information
-         * and to execute commands.
-         */
-        if ((mbox_ptr = kzalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL) {
-                wanpipe_kill_sock_irq (newsk);
-                release_device(dev);
-                return -ENOMEM;
-        }
-        memcpy(mbox_ptr,skb->data,skb->len);
-
-        /* Register the lcn on which incoming call came
-         * from. Thus, if we have to clear it, we know
-         * which lcn to clear
-         */
-
-        newwp->lcn = mbox_ptr->cmd.lcn;
-        newwp->mbox = (void *)mbox_ptr;
-
-        DBG_PRINTK(KERN_INFO "NEWSOCK : Device %s, bind to lcn %i\n",
-                        dev->name,mbox_ptr->cmd.lcn);
-
-        chan->lcn = mbox_ptr->cmd.lcn;
-        card->u.x.svc_to_dev_map[(chan->lcn%MAX_X25_LCN)] = dev;
-
-        sock_reset_flag(newsk, SOCK_ZAPPED);
-        newwp->num = htons(X25_PROT);
-
-        if (wanpipe_do_bind(newsk, dev, newwp->num)) {
-                wanpipe_kill_sock_irq (newsk);
-                release_device(dev);
-                return -EINVAL;
-        }
-        newsk->sk_state = WANSOCK_CONNECTING;
-
-
-        /* Fill in the standard sock address info */
-
-        sll->sll_family = AF_WANPIPE;
-        sll->sll_hatype = dev->type;
-        sll->sll_protocol = skb->protocol;
-        sll->sll_pkttype = skb->pkt_type;
-        sll->sll_ifindex = dev->ifindex;
-        sll->sll_halen = 0;
-
-        skb->dev = dev;
-        sk->sk_ack_backlog++;
-
-        /* We must do this manually, since the sock_queue_rcv_skb()
-         * function sets the skb->dev to NULL.  However, we use
-         * the dev field in the accept function.*/
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf) {
-
-                wanpipe_unlink_driver(newsk);
-                wanpipe_kill_sock_irq (newsk);
-                --sk->sk_ack_backlog;
-                return -ENOMEM;
-        }
-
-        skb_set_owner_r(skb, sk);
-        skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
-
-        return 0;
-}
-
-
-
-/*============================================================
- * wanpipe_make_new
- *
- *      Create a new sock, and allocate a wanpipe private
- *      structure to it. Also, copy the important data
- *      from the original sock to the new sock.
- *
- *      This function is used by wanpipe_listen_rcv() listen
- *      bottom half handler.  A copy of the listening sock
- *      is created using this function.
- *
- *===========================================================*/
-
-static struct sock *wanpipe_make_new(struct sock *osk)
-{
-        struct sock *sk;
-
-        if (osk->sk_type != SOCK_RAW)
-                return NULL;
-
-        if ((sk = wanpipe_alloc_socket()) == NULL)
-                return NULL;
-
-        sk->sk_type     = osk->sk_type;
-        sk->sk_socket   = osk->sk_socket;
-        sk->sk_priority = osk->sk_priority;
-        sk->sk_protocol = osk->sk_protocol;
-        wp_sk(sk)->num  = wp_sk(osk)->num;
-        sk->sk_rcvbuf   = osk->sk_rcvbuf;
-        sk->sk_sndbuf   = osk->sk_sndbuf;
-        sk->sk_state    = WANSOCK_CONNECTING;
-        sk->sk_sleep    = osk->sk_sleep;
-
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
-
-        return sk;
-}
-
-/*
- * FIXME: wanpipe_opt has to include a sock in its definition and stop using
- * sk_protinfo, but this code is not even compilable now, so lets leave it for
- * later.
- */
-static struct proto wanpipe_proto = {
-        .name     = "WANPIPE",
-        .owner    = THIS_MODULE,
-        .obj_size = sizeof(struct sock),
-};
-
-/*============================================================
- * wanpipe_make_new
- *
- *      Allocate memory for the a new sock, and sock
- *      private data.
- *
- *      Increment the module use count.
- *
- *      This function is used by wanpipe_create() and
- *      wanpipe_make_new() functions.
- *
- *===========================================================*/
-
-static struct sock *wanpipe_alloc_socket(void)
-{
-        struct sock *sk;
-        struct wanpipe_opt *wan_opt;
-
-        if ((sk = sk_alloc(PF_WANPIPE, GFP_ATOMIC, &wanpipe_proto, 1)) == NULL)
-                return NULL;
-
-        if ((wan_opt = kzalloc(sizeof(struct wanpipe_opt), GFP_ATOMIC)) == NULL) {
-                sk_free(sk);
-                return NULL;
-        }
-
-        wp_sk(sk) = wan_opt;
-
-        /* Use timer to send data to the driver. This will act
-         * as a BH handler for sendmsg functions */
-        init_timer(&wan_opt->tx_timer);
-        wan_opt->tx_timer.data     = (unsigned long)sk;
-        wan_opt->tx_timer.function = wanpipe_delayed_transmit;
-
-        sock_init_data(NULL, sk);
-        return sk;
-}
-
-
-/*============================================================
- * wanpipe_sendmsg
- *
- *      This function implements a sendto() system call,
- *      for AF_WANPIPE socket family.
- *      During socket bind() sk->sk_bound_dev_if is initialized
- *      to a correct network device. This number is used
- *      to find a network device to which the packet should
- *      be passed to.
- *
- *      Each packet is queued into sk->sk_write_queue and
- *      delayed transmit bottom half handler is marked for
- *      execution.
- *
- *      A socket must be in WANSOCK_CONNECTED state before
- *      a packet is queued into sk->sk_write_queue.
- *===========================================================*/
-
-static int wanpipe_sendmsg(struct kiocb *iocb, struct socket *sock,
-                           struct msghdr *msg, int len)
-{
-        wanpipe_opt *wp;
-        struct sock *sk = sock->sk;
-        struct wan_sockaddr_ll *saddr=(struct wan_sockaddr_ll *)msg->msg_name;
-        struct sk_buff *skb;
-        struct net_device *dev;
-        unsigned short proto;
-        unsigned char *addr;
-        int ifindex, err, reserve = 0;
-
-
-        if (!sock_flag(sk, SOCK_ZAPPED))
-                return -ENETDOWN;
-
-        if (sk->sk_state != WANSOCK_CONNECTED)
-                return -ENOTCONN;
-
-        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
-                return(-EINVAL);
-
-        /* it was <=, now one can send
-         * zero length packets */
-        if (len < sizeof(x25api_hdr_t))
-                return -EINVAL;
-
-        wp = wp_sk(sk);
-
-        if (saddr == NULL) {
-                ifindex = sk->sk_bound_dev_if;
-                proto   = wp->num;
-                addr    = NULL;
-
-        }else{
-                if (msg->msg_namelen < sizeof(struct wan_sockaddr_ll)){
-                        return -EINVAL;
-                }
-
-                ifindex = sk->sk_bound_dev_if;
-                proto   = saddr->sll_protocol;
-                addr    = saddr->sll_addr;
-        }
-
-        dev = dev_get_by_index(ifindex);
-        if (dev == NULL){
-                printk(KERN_INFO "wansock: Send failed, dev index: %i\n",ifindex);
-                return -ENXIO;
-        }
-        dev_put(dev);
-
-        if (sock->type == SOCK_RAW)
-                reserve = dev->hard_header_len;
-
-        if (len > dev->mtu+reserve){
-                return -EMSGSIZE;
-        }
-
-        skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
-                                msg->msg_flags & MSG_DONTWAIT, &err);
-
-        if (skb==NULL){
-                goto out_unlock;
-        }
-
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb->nh.raw = skb->data;
-
-        /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
-        if (err){
-                goto out_free;
-        }
-
-        if (dev->hard_header) {
-                int res;
-                err = -EINVAL;
-                res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
-                if (res<0){
-                        goto out_free;
-                }
-        }
-
-        skb->protocol = proto;
-        skb->dev = dev;
-        skb->priority = sk->sk_priority;
-        skb->pkt_type = WAN_PACKET_DATA;
-
-        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
-                goto out_free;
-
-        if (atomic_read(&sk->sk_wmem_alloc) + skb->truesize >
-            (unsigned int)sk->sk_sndbuf){
-                kfree_skb(skb);
-                return -ENOBUFS;
-        }
-
-        skb_queue_tail(&sk->sk_write_queue,skb);
-        atomic_inc(&wp->packet_sent);
-
-        if (!(test_and_set_bit(0, &wp->timer)))
-                mod_timer(&wp->tx_timer, jiffies + 1);
-
-        return(len);
-
-out_free:
-        kfree_skb(skb);
-out_unlock:
-        return err;
-}
-
-/*============================================================
- * wanpipe_delayed_tarnsmit
- *
- *      Transmit bottom half handler. It dequeues packets
- *      from sk->sk_write_queue and passes them to the
- *      driver.  If the driver is busy, the packet is
- *      re-enqueued.
- *
- *      Packet Sent counter is decremented on successful
- *      transmission.
- *===========================================================*/
-
-
-static void wanpipe_delayed_transmit (unsigned long data)
-{
-        struct sock *sk=(struct sock *)data;
-        struct sk_buff *skb;
-        wanpipe_opt *wp = wp_sk(sk);
-        struct net_device *dev = wp->dev;
-        sdla_t *card = (sdla_t*)wp->card;
-
-        if (!card || !dev){
-                clear_bit(0, &wp->timer);
-                DBG_PRINTK(KERN_INFO "wansock: Transmit delay, no dev or card\n");
-                return;
-        }
-
-        if (sk->sk_state != WANSOCK_CONNECTED || !sock_flag(sk, SOCK_ZAPPED)) {
-                clear_bit(0, &wp->timer);
-                DBG_PRINTK(KERN_INFO "wansock: Tx Timer, State not CONNECTED\n");
-                return;
-        }
-
-        /* If driver is executing command, we must offload
-         * the board by not sending data. Otherwise a
-         * pending command will never get a free buffer
-         * to execute */
-        if (atomic_read(&card->u.x.command_busy)){
-                wp->tx_timer.expires = jiffies + SLOW_BACKOFF;
-                add_timer(&wp->tx_timer);
-                DBG_PRINTK(KERN_INFO "wansock: Tx Timer, command bys BACKOFF\n");
-                return;
-        }
-
-
-        if (test_and_set_bit(0,&wanpipe_tx_critical)){
-                printk(KERN_INFO "WanSock: Tx timer critical %s\n",dev->name);
-                wp->tx_timer.expires = jiffies + SLOW_BACKOFF;
-                add_timer(&wp->tx_timer);
-                return;
-        }
-
-        /* Check for a packet in the fifo and send */
-        if ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL){
-
-                if (dev->hard_start_xmit(skb, dev) != 0){
-
-                        /* Driver failed to transmit, re-enqueue
-                         * the packet and retry again later */
-                        skb_queue_head(&sk->sk_write_queue,skb);
-                        clear_bit(0,&wanpipe_tx_critical);
-                        return;
-                }else{
-
-                        /* Packet Sent successful. Check for more packets
-                         * if more packets, re-trigger the transmit routine
-                         * other wise exit
-                         */
-                        atomic_dec(&wp->packet_sent);
-
-                        if (skb_peek(&sk->sk_write_queue) == NULL) {
-                                /* If there is nothing to send, kick
-                                 * the poll routine, which will trigger
-                                 * the application to send more data */
-                                sk->sk_data_ready(sk, 0);
-                                clear_bit(0, &wp->timer);
-                        }else{
-                                /* Reschedule as fast as possible */
-                                wp->tx_timer.expires = jiffies + 1;
-                                add_timer(&wp->tx_timer);
-                        }
-                }
-        }
-        clear_bit(0,&wanpipe_tx_critical);
-}
-
-/*============================================================
- * execute_command
- *
- *      Execute x25api commands.  The atomic variable
- *      chan->command is used to indicate to the driver that
- *      command is pending for execution.  The acutal command
- *      structure is placed into a sock mbox structure
- *      (wp_sk(sk)->mbox).
- *
- *      The sock private structure, mbox is
- *      used as shared memory between sock and the driver.
- *      Driver uses the sock mbox to execute the command
- *      and return the result.
- *
- *      For all command except PLACE CALL, the function
- *      waits for the result.  PLACE CALL can be ether
- *      blocking or nonblocking. The user sets this option
- *      via ioctl call.
- *===========================================================*/
-
-
-static int execute_command(struct sock *sk,  unsigned char cmd, unsigned int flags)
-{
-        wanpipe_opt *wp = wp_sk(sk);
-        struct net_device *dev;
-        wanpipe_common_t *chan=NULL;
-        int err=0;
-        DECLARE_WAITQUEUE(wait, current);
-
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (dev == NULL){
-                printk(KERN_INFO "wansock: Exec failed no dev %i\n",
-                        sk->sk_bound_dev_if);
-                return -ENODEV;
-        }
-        dev_put(dev);
-
-        if ((chan=dev->priv) == NULL){
-                printk(KERN_INFO "wansock: Exec cmd failed no priv area\n");
-                return -ENODEV;
-        }
-
-        if (atomic_read(&chan->command)){
-                printk(KERN_INFO "wansock: ERROR: Command already running %x, %s\n",
-                        atomic_read(&chan->command),dev->name);
-                return -EINVAL;
-        }
-
-        if (!wp->mbox) {
-                printk(KERN_INFO "wansock: In execute without MBOX\n");
-                return -EINVAL;
-        }
-
-        ((mbox_cmd_t*)wp->mbox)->cmd.command = cmd;
-        ((mbox_cmd_t*)wp->mbox)->cmd.lcn     = wp->lcn;
-        ((mbox_cmd_t*)wp->mbox)->cmd.result  = 0x7F;
-
-
-        if (flags & O_NONBLOCK){
-                cmd |= 0x80;
-                atomic_set(&chan->command, cmd);
-        }else{
-                atomic_set(&chan->command, cmd);
-        }
-
-        add_wait_queue(sk->sk_sleep,&wait);
-        current->state = TASK_INTERRUPTIBLE;
-        for (;;){
-                if (((mbox_cmd_t*)wp->mbox)->cmd.result != 0x7F) {
-                        err = 0;
-                        break;
-                }
-                if (signal_pending(current)) {
-                        err = -ERESTARTSYS;
-                        break;
-                }
-                schedule();
-        }
-        current->state = TASK_RUNNING;
-        remove_wait_queue(sk->sk_sleep,&wait);
-
-        return err;
-}
-
-/*============================================================
- * wanpipe_destroy_timer
- *
- *      Used by wanpipe_release, to delay release of
- *      the socket.
- *===========================================================*/
-
-static void wanpipe_destroy_timer(unsigned long data)
-{
-        struct sock *sk=(struct sock *)data;
-        wanpipe_opt *wp = wp_sk(sk);
-
-        if ((!atomic_read(&sk->sk_wmem_alloc) &&
-             !atomic_read(&sk->sk_rmem_alloc)) ||
-            (++wp->force == 5)) {
-
-                if (atomic_read(&sk->sk_wmem_alloc) ||
-                    atomic_read(&sk->sk_rmem_alloc))
-                        printk(KERN_INFO "wansock: Warning, Packet Discarded due to sock shutdown!\n");
-
-                kfree(wp);
-                wp_sk(sk) = NULL;
-
-                if (atomic_read(&sk->sk_refcnt) != 1) {
-                        atomic_set(&sk->sk_refcnt, 1);
-                        DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i ! :delay.\n",
-                                        atomic_read(&sk->sk_refcnt));
-                }
-                sock_put(sk);
-                atomic_dec(&wanpipe_socks_nr);
-                return;
-        }
-
-        sk->sk_timer.expires = jiffies + 5 * HZ;
-        add_timer(&sk->sk_timer);
-        printk(KERN_INFO "wansock: packet sk destroy delayed\n");
-}
-
-/*============================================================
- * wanpipe_unlink_driver
- *
- *      When the socket is released, this function is
- *      used to remove links that bind the sock and the
- *      driver together.
- *===========================================================*/
-static void wanpipe_unlink_driver (struct sock *sk)
-{
-        struct net_device *dev;
-        wanpipe_common_t *chan=NULL;
-
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        sk->sk_state = WANSOCK_DISCONNECTED;
-        wp_sk(sk)->dev = NULL;
-
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (!dev){
-                printk(KERN_INFO "wansock: No dev on release\n");
-                return;
-        }
-        dev_put(dev);
-
-        if ((chan = dev->priv) == NULL){
-                printk(KERN_INFO "wansock: No Priv Area on release\n");
-                return;
-        }
-
-        set_bit(0,&chan->common_critical);
-        chan->sk=NULL;
-        chan->func=NULL;
-        chan->mbox=NULL;
-        chan->tx_timer=NULL;
-        clear_bit(0,&chan->common_critical);
-        release_device(dev);
-
-        return;
-}
-
-/*============================================================
- * wanpipe_link_driver
- *
- *      Upon successful bind(), sock is linked to a driver
- *      by binding in the wanpipe_rcv() bottom half handler
- *      to the driver function pointer, as well as sock and
- *      sock mailbox addresses.  This way driver can pass
- *      data up the socket.
- *===========================================================*/
-
-static void wanpipe_link_driver(struct net_device *dev, struct sock *sk)
-{
-        wanpipe_opt *wp = wp_sk(sk);
-        wanpipe_common_t *chan = dev->priv;
-        if (!chan)
-                return;
-        set_bit(0,&chan->common_critical);
-        chan->sk=sk;
-        chan->func=wanpipe_rcv;
-        chan->mbox = wp->mbox;
-        chan->tx_timer = &wp->tx_timer;
-        wp->dev = dev;
-        sock_set_flag(sk, SOCK_ZAPPED);
-        clear_bit(0,&chan->common_critical);
-}
-
-
-/*============================================================
- * release_device
- *
- *      During sock release, clear a critical bit, which
- *      marks the device a being taken.
- *===========================================================*/
-
-
-static void release_device(struct net_device *dev)
-{
-        wanpipe_common_t *chan=dev->priv;
-        clear_bit(0,(void*)&chan->rw_bind);
-}
-
-/*============================================================
- * wanpipe_release
- *
- *      Close a PACKET socket. This is fairly simple. We
- *      immediately go to 'closed' state and remove our
- *      protocol entry in the device list.
- *===========================================================*/
-
-static int wanpipe_release(struct socket *sock)
-{
-        wanpipe_opt *wp;
-        struct sock *sk = sock->sk;
-
-        if (!sk)
-                return 0;
-
-        wp = wp_sk(sk);
-        check_write_queue(sk);
-
-        /* Kill the tx timer, if we don't kill it now, the timer
-         * will run after we kill the sock.  Timer code will
-         * try to access the sock which has been killed and cause
-         * kernel panic */
-
-        del_timer(&wp->tx_timer);
-
-        /*
-         *      Unhook packet receive handler.
-         */
-
-        if (wp->num == htons(X25_PROT) &&
-            sk->sk_state != WANSOCK_DISCONNECTED && sock_flag(sk, SOCK_ZAPPED)) {
-                struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-                wanpipe_common_t *chan;
-                if (dev){
-                        chan=dev->priv;
-                        atomic_set(&chan->disconnect,1);
-                        DBG_PRINTK(KERN_INFO "wansock: Sending Clear Indication %i\n",
-                                        sk->sk_state);
-                        dev_put(dev);
-                }
-        }
-
-        set_bit(1,&wanpipe_tx_critical);
-        write_lock(&wanpipe_sklist_lock);
-        sk_del_node_init(sk);
-        write_unlock(&wanpipe_sklist_lock);
-        clear_bit(1,&wanpipe_tx_critical);
-
-
-
-        release_driver(sk);
-
-
-        /*
-         *      Now the socket is dead. No more input will appear.
-         */
-
-        sk->sk_state_change(sk);        /* It is useless. Just for sanity. */
-
-        sock->sk = NULL;
-        sk->sk_socket = NULL;
-        sock_set_flag(sk, SOCK_DEAD);
-
-        /* Purge queues */
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-        skb_queue_purge(&sk->sk_error_queue);
-
-        if (atomic_read(&sk->sk_rmem_alloc) ||
-            atomic_read(&sk->sk_wmem_alloc)) {
-                del_timer(&sk->sk_timer);
-                printk(KERN_INFO "wansock: Killing in Timer R %i , W %i\n",
-                        atomic_read(&sk->sk_rmem_alloc),
-                        atomic_read(&sk->sk_wmem_alloc));
-                sk->sk_timer.data       = (unsigned long)sk;
-                sk->sk_timer.expires    = jiffies + HZ;
-                sk->sk_timer.function   = wanpipe_destroy_timer;
-                add_timer(&sk->sk_timer);
-                return 0;
-        }
-
-        kfree(wp);
-        wp_sk(sk) = NULL;
-
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i !:release.\n",
-                                        atomic_read(&sk->sk_refcnt));
-                atomic_set(&sk->sk_refcnt, 1);
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-        return 0;
-}
-
-/*============================================================
- * check_write_queue
- *
- *      During sock shutdown, if the sock state is
- *      WANSOCK_CONNECTED and there is transmit data
- *      pending. Wait until data is released
- *      before proceeding.
- *===========================================================*/
-
-static void check_write_queue(struct sock *sk)
-{
-
-        if (sk->sk_state != WANSOCK_CONNECTED)
-                return;
-
-        if (!atomic_read(&sk->sk_wmem_alloc))
-                return;
-
-        printk(KERN_INFO "wansock: MAJOR ERROR, Data lost on sock release !!!\n");
-
-}
-
-/*============================================================
- * release_driver
- *
- *      This function is called during sock shutdown, to
- *      release any resources and links that bind the sock
- *      to the driver.  It also changes the state of the
- *      sock to WANSOCK_DISCONNECTED
- *===========================================================*/
-
-static void release_driver(struct sock *sk)
-{
-        wanpipe_opt *wp;
-        struct sk_buff *skb=NULL;
-        struct sock *deadsk=NULL;
-
-        if (sk->sk_state == WANSOCK_LISTEN ||
-            sk->sk_state == WANSOCK_BIND_LISTEN) {
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        if ((deadsk = get_newsk_from_skb(skb))){
-                                DBG_PRINTK (KERN_INFO "wansock: RELEASE: FOUND DEAD SOCK\n");
-                                sock_set_flag(deadsk, SOCK_DEAD);
-                                start_cleanup_timer(deadsk);
-                        }
-                        kfree_skb(skb);
-                }
-                if (sock_flag(sk, SOCK_ZAPPED))
-                        wanpipe_unlink_card(sk);
-        }else{
-                if (sock_flag(sk, SOCK_ZAPPED))
-                        wanpipe_unlink_driver(sk);
-        }
-        sk->sk_state        = WANSOCK_DISCONNECTED;
-        sk->sk_bound_dev_if = 0;
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        wp = wp_sk(sk);
-
-        if (wp) {
-                kfree(wp->mbox);
-                wp->mbox = NULL;
-        }
-}
-
-/*============================================================
- *  start_cleanup_timer
- *
- *      If new incoming call's are pending but the socket
- *      is being released, start the timer which will
- *      envoke the kill routines for pending socks.
- *===========================================================*/
-
-
-static void start_cleanup_timer (struct sock *sk)
-{
-        del_timer(&sk->sk_timer);
-        sk->sk_timer.data       = (unsigned long)sk;
-        sk->sk_timer.expires    = jiffies + HZ;
-        sk->sk_timer.function   = wanpipe_kill_sock_timer;
-        add_timer(&sk->sk_timer);
-}
-
-
-/*============================================================
- *  wanpipe_kill_sock
- *
- *      This is a function which performs actual killing
- *      of the sock.  It releases socket resources,
- *      and unlinks the sock from the driver.
- *===========================================================*/
-
-static void wanpipe_kill_sock_timer (unsigned long data)
-{
-
-        struct sock *sk = (struct sock *)data;
-        struct sock **skp;
-
-        if (!sk)
-                return;
-
-        /* This function can be called from interrupt. We must use
-         * appropriate locks */
-
-        if (test_bit(1,&wanpipe_tx_critical)){
-                sk->sk_timer.expires = jiffies + 10;
-                add_timer(&sk->sk_timer);
-                return;
-        }
-
-        write_lock(&wanpipe_sklist_lock);
-        sk_del_node_init(sk);
-        write_unlock(&wanpipe_sklist_lock);
-
-
-        if (wp_sk(sk)->num == htons(X25_PROT) &&
-            sk->sk_state != WANSOCK_DISCONNECTED) {
-                struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-                wanpipe_common_t *chan;
-                if (dev){
-                        chan=dev->priv;
-                        atomic_set(&chan->disconnect,1);
-                        dev_put(dev);
-                }
-        }
-
-        release_driver(sk);
-
-        sk->sk_socket = NULL;
-
-        /* Purge queues */
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-        skb_queue_purge(&sk->sk_error_queue);
-
-        if (atomic_read(&sk->sk_rmem_alloc) ||
-            atomic_read(&sk->sk_wmem_alloc)) {
-                del_timer(&sk->sk_timer);
-                printk(KERN_INFO "wansock: Killing SOCK in Timer\n");
-                sk->sk_timer.data       = (unsigned long)sk;
-                sk->sk_timer.expires    = jiffies + HZ;
-                sk->sk_timer.function   = wanpipe_destroy_timer;
-                add_timer(&sk->sk_timer);
-                return;
-        }
-
-        kfree(wp_sk(sk));
-        wp_sk(sk) = NULL;
-
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                atomic_set(&sk->sk_refcnt, 1);
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i ! :timer.\n",
-                                        atomic_read(&sk->sk_refcnt));
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-        return;
-}
-
-static void wanpipe_kill_sock_accept (struct sock *sk)
-{
-
-        struct sock **skp;
-
-        if (!sk)
-                return;
-
-        /* This function can be called from interrupt. We must use
-         * appropriate locks */
-
-        write_lock(&wanpipe_sklist_lock);
-        sk_del_node_init(sk);
-        write_unlock(&wanpipe_sklist_lock);
-
-        sk->sk_socket = NULL;
-
-
-        kfree(wp_sk(sk));
-        wp_sk(sk) = NULL;
-
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                atomic_set(&sk->sk_refcnt, 1);
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i ! :timer.\n",
-                                        atomic_read(&sk->sk_refcnt));
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-        return;
-}
-
-
-static void wanpipe_kill_sock_irq (struct sock *sk)
-{
-
-        if (!sk)
-                return;
-
-        sk->sk_socket = NULL;
-
-        kfree(wp_sk(sk));
-        wp_sk(sk) = NULL;
-
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                atomic_set(&sk->sk_refcnt, 1);
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i !:listen.\n",
-                                        atomic_read(&sk->sk_refcnt));
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-}
-
-
-/*============================================================
- *  wanpipe_do_bind
- *
- *      Bottom half of the binding system call.
- *      Once the wanpipe_bind() function checks  the
- *      legality of the call, this function binds the
- *      sock to the driver.
- *===========================================================*/
-
-static int wanpipe_do_bind(struct sock *sk, struct net_device *dev,
-                           int protocol)
-{
-        wanpipe_opt *wp = wp_sk(sk);
-        wanpipe_common_t *chan=NULL;
-        int err=0;
-
-        if (sock_flag(sk, SOCK_ZAPPED)) {
-                err = -EALREADY;
-                goto bind_unlock_exit;
-        }
-
-        wp->num = protocol;
-
-        if (protocol == 0){
-                release_device(dev);
-                err = -EINVAL;
-                goto bind_unlock_exit;
-        }
-
-        if (dev) {
-                if (dev->flags&IFF_UP) {
-                        chan=dev->priv;
-                        sk->sk_state = chan->state;
-
-                        if (wp->num == htons(X25_PROT) &&
-                            sk->sk_state != WANSOCK_DISCONNECTED &&
-                            sk->sk_state != WANSOCK_CONNECTING) {
-                                DBG_PRINTK(KERN_INFO
-                                        "wansock: Binding to Device not DISCONNECTED %i\n",
-                                                sk->sk_state);
-                                release_device(dev);
-                                err = -EAGAIN;
-                                goto bind_unlock_exit;
-                        }
-
-                        wanpipe_link_driver(dev,sk);
-                        sk->sk_bound_dev_if = dev->ifindex;
-
-                        /* X25 Specific option */
-                        if (wp->num == htons(X25_PROT))
-                                wp_sk(sk)->svc = chan->svc;
-
-                } else {
-                        sk->sk_err = ENETDOWN;
-                        sk->sk_error_report(sk);
-                        release_device(dev);
-                        err = -EINVAL;
-                }
-        } else {
-                err = -ENODEV;
-        }
-bind_unlock_exit:
-        /* FIXME where is this lock */
-
-        return err;
-}
-
-/*============================================================
- *  wanpipe_bind
- *
- *      BIND() System call, which is bound to the AF_WANPIPE
- *      operations structure.  It checks for correct wanpipe
- *      card name, and cross references interface names with
- *      the card names.  Thus, interface name must belong to
- *      the actual card.
- *===========================================================*/
-
-
-static int wanpipe_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
-{
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)uaddr;
-        struct sock *sk=sock->sk;
-        wanpipe_opt *wp = wp_sk(sk);
-        struct net_device *dev = NULL;
-        sdla_t *card=NULL;
-        char name[15];
-
-        /*
-         *      Check legality
-         */
-
-        if (addr_len < sizeof(struct wan_sockaddr_ll)){
-                printk(KERN_INFO "wansock: Address length error\n");
-                return -EINVAL;
-        }
-        if (sll->sll_family != AF_WANPIPE){
-                printk(KERN_INFO "wansock: Illegal family name specified.\n");
-                return -EINVAL;
-        }
-
-        card = wanpipe_find_card (sll->sll_card);
-        if (!card){
-                printk(KERN_INFO "wansock: Wanpipe card not found: %s\n",sll->sll_card);
-                return -ENODEV;
-        }else{
-                wp_sk(sk)->card = (void *)card;
-        }
-
-        if (!strcmp(sll->sll_device,"svc_listen")){
-
-                /* Bind a sock to a card structure for listening
-                 */
-                int err=0;
-
-                /* This is x25 specific area if protocol doesn't
-                 * match, return error */
-                if (sll->sll_protocol != htons(X25_PROT))
-                        return -EINVAL;
-
-                err= wanpipe_link_card (sk);
-                if (err < 0)
-                        return err;
-
-                if (sll->sll_protocol)
-                        wp->num = sll->sll_protocol;
-                sk->sk_state = WANSOCK_BIND_LISTEN;
-                return 0;
-
-        }else if (!strcmp(sll->sll_device,"svc_connect")){
-
-                /* This is x25 specific area if protocol doesn't
-                 * match, return error */
-                if (sll->sll_protocol != htons(X25_PROT))
-                        return -EINVAL;
-
-                /* Find a free device
-                 */
-                dev = wanpipe_find_free_dev(card);
-                if (dev == NULL){
-                        DBG_PRINTK(KERN_INFO "wansock: No free network devices for card %s\n",
-                                card->devname);
-                        return -EINVAL;
-                }
-        }else{
-                /* Bind a socket to a interface name
-                 * This is used by PVC mostly
-                 */
-                strlcpy(name,sll->sll_device,sizeof(name));
-                dev = dev_get_by_name(name);
-                if (dev == NULL){
-                        printk(KERN_INFO "wansock: Failed to get Dev from name: %s,\n",
-                                        name);
-                        return -ENODEV;
-                }
-
-                dev_put(dev);
-
-                if (check_dev(dev, card)){
-                        printk(KERN_INFO "wansock: Device %s, doesn't belong to card %s\n",
-                                dev->name, card->devname);
-                        return -EINVAL;
-                }
-                if (get_atomic_device (dev))
-                        return -EINVAL;
-        }
-
-        return wanpipe_do_bind(sk, dev, sll->sll_protocol ? : wp->num);
-}
-
-/*============================================================
- * get_atomic_device
- *
- *      Sets a bit atomically which indicates that
- *      the interface is taken. This avoids race conditions.
- *===========================================================*/
-
-
-static inline int get_atomic_device(struct net_device *dev)
-{
-        wanpipe_common_t *chan = dev->priv;
-        if (!test_and_set_bit(0,(void *)&chan->rw_bind)){
-                return 0;
-        }
-        return 1;
-}
-
-/*============================================================
- * check_dev
- *
- *      Check that device name belongs to a particular card.
- *===========================================================*/
-
-static int check_dev(struct net_device *dev, sdla_t *card)
-{
-        struct net_device* tmp_dev;
-
-        for (tmp_dev = card->wandev.dev; tmp_dev;
-             tmp_dev = *((struct net_device **)tmp_dev->priv)) {
-                if (tmp_dev->ifindex == dev->ifindex){
-                        return 0;
-                }
-        }
-        return 1;
-}
-
-/*============================================================
- *  wanpipe_find_free_dev
- *
- *      Find a free network interface. If found set atomic
- *      bit indicating that the interface is taken.
- *      X25API Specific.
- *===========================================================*/
-
-struct net_device *wanpipe_find_free_dev(sdla_t *card)
-{
-        struct net_device* dev;
-        volatile wanpipe_common_t *chan;
-
-        if (test_and_set_bit(0,&find_free_critical)){
-                printk(KERN_INFO "CRITICAL in Find Free\n");
-        }
-
-        for (dev = card->wandev.dev; dev;
-             dev = *((struct net_device **)dev->priv)) {
-                chan = dev->priv;
-                if (!chan)
-                        continue;
-                if (chan->usedby == API && chan->svc){
-                        if (!get_atomic_device (dev)){
-                                if (chan->state != WANSOCK_DISCONNECTED){
-                                        release_device(dev);
-                                }else{
-                                        clear_bit(0,&find_free_critical);
-                                        return dev;
-                                }
-                        }
-                }
-        }
-        clear_bit(0,&find_free_critical);
-        return NULL;
-}
-
-/*============================================================
- *  wanpipe_create
- *
- *      SOCKET() System call.  It allocates a sock structure
- *      and adds the socket to the wanpipe_sk_list.
- *      Crates AF_WANPIPE socket.
- *===========================================================*/
-
-static int wanpipe_create(struct socket *sock, int protocol)
-{
-        struct sock *sk;
-
-        //FIXME: This checks for root user, SECURITY ?
-        //if (!capable(CAP_NET_RAW))
-        //      return -EPERM;
-
-        if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
-                return -ESOCKTNOSUPPORT;
-
-        sock->state = SS_UNCONNECTED;
-
-        if ((sk = wanpipe_alloc_socket()) == NULL)
-                return -ENOBUFS;
-
-        sk->sk_reuse = 1;
-        sock->ops = &wanpipe_ops;
-        sock_init_data(sock,sk);
-
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        sk->sk_family       = PF_WANPIPE;
-        wp_sk(sk)->num      = protocol;
-        sk->sk_state        = WANSOCK_DISCONNECTED;
-        sk->sk_ack_backlog  = 0;
-        sk->sk_bound_dev_if = 0;
-
-        atomic_inc(&wanpipe_socks_nr);
-
-        /* We must disable interrupts because the ISR
-         * can also change the list */
-        set_bit(1,&wanpipe_tx_critical);
-        write_lock(&wanpipe_sklist_lock);
-        sk_add_node(sk, &wanpipe_sklist);
-        write_unlock(&wanpipe_sklist_lock);
-        clear_bit(1,&wanpipe_tx_critical);
-
-        return(0);
-}
-
-
-/*============================================================
- *  wanpipe_recvmsg
- *
- *      Pull a packet from our receive queue and hand it
- *      to the user. If necessary we block.
- *===========================================================*/
-
-static int wanpipe_recvmsg(struct kiocb *iocb, struct socket *sock,
-                           struct msghdr *msg, int len, int flags)
-{
-        struct sock *sk = sock->sk;
-        struct sk_buff *skb;
-        int copied, err=-ENOBUFS;
-
-
-        /*
-         *      If the address length field is there to be filled in, we fill
-         *      it in now.
-         */
-
-        msg->msg_namelen = sizeof(struct wan_sockaddr_ll);
-
-        /*
-         *      Call the generic datagram receiver. This handles all sorts
-         *      of horrible races and re-entrancy so we can forget about it
-         *      in the protocol layers.
-         *
-         *      Now it will return ENETDOWN, if device have just gone down,
-         *      but then it will block.
-         */
-
-        if (flags & MSG_OOB){
-                skb = skb_dequeue(&sk->sk_error_queue);
-        }else{
-                skb=skb_recv_datagram(sk,flags,1,&err);
-        }
-        /*
-         *      An error occurred so return it. Because skb_recv_datagram()
-         *      handles the blocking we don't see and worry about blocking
-         *      retries.
-         */
-
-        if(skb==NULL)
-                goto out;
-
-        /*
-         *      You lose any data beyond the buffer you gave. If it worries a
-         *      user program they can ask the device for its MTU anyway.
-         */
-
-        copied = skb->len;
-        if (copied > len)
-        {
-                copied=len;
-                msg->msg_flags|=MSG_TRUNC;
-        }
-
-        wanpipe_wakeup_driver(sk);
-
-        /* We can't use skb_copy_datagram here */
-        err = memcpy_toiovec(msg->msg_iov, skb->data, copied);
-        if (err)
-                goto out_free;
-
-        sock_recv_timestamp(msg, sk, skb);
-
-        if (msg->msg_name)
-                memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
-
-        /*
-         *      Free or return the buffer as appropriate. Again this
-         *      hides all the races and re-entrancy issues from us.
-         */
-        err = (flags&MSG_TRUNC) ? skb->len : copied;
-
-out_free:
-        skb_free_datagram(sk, skb);
-out:
-        return err;
-}
-
-
-/*============================================================
- *  wanpipe_wakeup_driver
- *
- *      If socket receive buffer is full and driver cannot
- *      pass data up the sock, it sets a packet_block flag.
- *      This function check that flag and if sock receive
- *      queue has room it kicks the driver BH handler.
- *
- *      This way, driver doesn't have to poll the sock
- *      receive queue.
- *===========================================================*/
-
-static void wanpipe_wakeup_driver(struct sock *sk)
-{
-        struct net_device *dev = NULL;
-        wanpipe_common_t *chan=NULL;
-
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (!dev)
-                return;
-
-        dev_put(dev);
-
-        if ((chan = dev->priv) == NULL)
-                return;
-
-        if (atomic_read(&chan->receive_block)){
-                if (atomic_read(&sk->sk_rmem_alloc) <
-                    ((unsigned)sk->sk_rcvbuf * 0.9)) {
-                        printk(KERN_INFO "wansock: Queuing task for wanpipe\n");
-                        atomic_set(&chan->receive_block,0);
-                        wanpipe_queue_tq(&chan->wanpipe_task);
-                        wanpipe_mark_bh();
-                }
-        }
-}
-
-/*============================================================
- *  wanpipe_getname
- *
- *      I don't know what to do with this yet.
- *      User can use this function to get sock address
- *      information. Not very useful for Sangoma's purposes.
- *===========================================================*/
-
-
-static int wanpipe_getname(struct socket *sock, struct sockaddr *uaddr,
-                          int *uaddr_len, int peer)
-{
-        struct net_device *dev;
-        struct sock *sk = sock->sk;
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)uaddr;
-
-        sll->sll_family = AF_WANPIPE;
-        sll->sll_ifindex = sk->sk_bound_dev_if;
-        sll->sll_protocol = wp_sk(sk)->num;
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (dev) {
-                sll->sll_hatype = dev->type;
-                sll->sll_halen = dev->addr_len;
-                memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
-        } else {
-                sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
-                sll->sll_halen = 0;
-        }
-        *uaddr_len = sizeof(*sll);
-
-        dev_put(dev);
-
-        return 0;
-}
-
-/*============================================================
- *  wanpipe_notifier
- *
- *      If driver turns off network interface, this function
- *      will be envoked. Currently I treate it as a
- *      call disconnect. More thought should go into this
- *      function.
- *
- * FIXME: More thought should go into this function.
- *
- *===========================================================*/
-
-static int wanpipe_notifier(struct notifier_block *this, unsigned long msg, void *data)
-{
-        struct sock *sk;
-        hlist_node *node;
-        struct net_device *dev = (struct net_device *)data;
-
-        sk_for_each(sk, node, &wanpipe_sklist) {
-                struct wanpipe_opt *po = wp_sk(sk);
-
-                if (!po)
-                        continue;
-                if (dev == NULL)
-                        continue;
-
-                switch (msg) {
-                case NETDEV_DOWN:
-                case NETDEV_UNREGISTER:
-                        if (dev->ifindex == sk->sk_bound_dev_if) {
-                                printk(KERN_INFO "wansock: Device down %s\n",dev->name);
-                                if (sock_flag(sk, SOCK_ZAPPED)) {
-                                        wanpipe_unlink_driver(sk);
-                                        sk->sk_err = ENETDOWN;
-                                        sk->sk_error_report(sk);
-                                }
-
-                                if (msg == NETDEV_UNREGISTER) {
-                                        printk(KERN_INFO "wansock: Unregistering Device: %s\n",
-                                                          dev->name);
-                                        wanpipe_unlink_driver(sk);
-                                        sk->sk_bound_dev_if = 0;
-                                }
-                        }
-                        break;
-                case NETDEV_UP:
-                        if (dev->ifindex == sk->sk_bound_dev_if &&
-                            po->num && !sock_flag(sk, SOCK_ZAPPED)) {
-                                printk(KERN_INFO "wansock: Registering Device: %s\n",
-                                                dev->name);
-                                wanpipe_link_driver(dev,sk);
-                        }
-                        break;
-                }
-        }
-        return NOTIFY_DONE;
-}
-
-/*============================================================
- *  wanpipe_ioctl
- *
- *      Execute a user commands, and set socket options.
- *
- * FIXME: More thought should go into this function.
- *
- *===========================================================*/
-
-static int wanpipe_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
-{
-        struct sock *sk = sock->sk;
-        int err;
-
-        switch(cmd)
-        {
-                case SIOCGSTAMP:
-                        return sock_get_timestamp(sk, (struct timeval __user *)arg);
-
-                case SIOC_WANPIPE_CHECK_TX:
-
-                        return atomic_read(&sk->sk_wmem_alloc);
-
-                case SIOC_WANPIPE_SOCK_STATE:
-
-                        if (sk->sk_state == WANSOCK_CONNECTED)
-                                return 0;
-
-                        return 1;
-
-
-                case SIOC_WANPIPE_GET_CALL_DATA:
-
-                        return get_ioctl_cmd (sk,(void*)arg);
-
-                case SIOC_WANPIPE_SET_CALL_DATA:
-
-                        return set_ioctl_cmd (sk,(void*)arg);
-
-                case SIOC_WANPIPE_ACCEPT_CALL:
-                case SIOC_WANPIPE_CLEAR_CALL:
-                case SIOC_WANPIPE_RESET_CALL:
-
-                        if ((err=set_ioctl_cmd(sk,(void*)arg)) < 0)
-                                return err;
-
-                        err=wanpipe_exec_cmd(sk,cmd,0);
-                        get_ioctl_cmd(sk,(void*)arg);
-                        return err;
-
-                case SIOC_WANPIPE_DEBUG:
-
-                        return wanpipe_debug(sk,(void*)arg);
-
-                case SIOC_WANPIPE_SET_NONBLOCK:
-
-                        if (sk->sk_state != WANSOCK_DISCONNECTED)
-                                return -EINVAL;
-
-                        sock->file->f_flags |= O_NONBLOCK;
-                        return 0;
-
-#ifdef CONFIG_INET
-                case SIOCADDRT:
-                case SIOCDELRT:
-                case SIOCDARP:
-                case SIOCGARP:
-                case SIOCSARP:
-                case SIOCDRARP:
-                case SIOCGRARP:
-                case SIOCSRARP:
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCSIFBRDADDR:
-                case SIOCGIFNETMASK:
-                case SIOCSIFNETMASK:
-                case SIOCGIFDSTADDR:
-                case SIOCSIFDSTADDR:
-                case SIOCSIFFLAGS:
-                        return inet_dgram_ops.ioctl(sock, cmd, arg);
-#endif
-
-                default:
-                        return -ENOIOCTLCMD;
-        }
-        /*NOTREACHED*/
-}
-
-/*============================================================
- *  wanpipe_debug
- *
- *      This function will pass up information about all
- *      active sockets.
- *
- * FIXME: More thought should go into this function.
- *
- *===========================================================*/
-
-static int wanpipe_debug (struct sock *origsk, void *arg)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-        struct net_device *dev = NULL;
-        wanpipe_common_t *chan=NULL;
-        int cnt=0, err=0;
-        wan_debug_t *dbg_data = (wan_debug_t *)arg;
-
-        sk_for_each(sk, node, &wanpipe_sklist) {
-                wanpipe_opt *wp = wp_sk(sk);
-
-                if (sk == origsk){
-                        continue;
-                }
-
-                if ((err=put_user(1, &dbg_data->debug[cnt].free)))
-                        return err;
-                if ((err = put_user(sk->sk_state,
-                                    &dbg_data->debug[cnt].state_sk)))
-                        return err;
-                if ((err = put_user(sk->sk_rcvbuf,
-                                    &dbg_data->debug[cnt].rcvbuf)))
-                        return err;
-                if ((err = put_user(atomic_read(&sk->sk_rmem_alloc),
-                                    &dbg_data->debug[cnt].rmem)))
-                        return err;
-                if ((err = put_user(atomic_read(&sk->sk_wmem_alloc),
-                                    &dbg_data->debug[cnt].wmem)))
-                        return err;
-                if ((err = put_user(sk->sk_sndbuf,
-                                    &dbg_data->debug[cnt].sndbuf)))
-                        return err;
-                if ((err=put_user(sk_count, &dbg_data->debug[cnt].sk_count)))
-                        return err;
-                if ((err=put_user(wp->poll_cnt, &dbg_data->debug[cnt].poll_cnt)))
-                        return err;
-                if ((err = put_user(sk->sk_bound_dev_if,
-                                    &dbg_data->debug[cnt].bound)))
-                        return err;
-
-                if (sk->sk_bound_dev_if) {
-                        dev = dev_get_by_index(sk->sk_bound_dev_if);
-                        if (!dev)
-                                continue;
-
-                        chan=dev->priv;
-                        dev_put(dev);
-
-                        if ((err=put_user(chan->state, &dbg_data->debug[cnt].d_state)))
-                                return err;
-                        if ((err=put_user(chan->svc, &dbg_data->debug[cnt].svc)))
-                                return err;
-
-                        if ((err=put_user(atomic_read(&chan->command),
-                                                &dbg_data->debug[cnt].command)))
-                                return err;
-
-
-                        if (wp){
-                                sdla_t *card = (sdla_t*)wp->card;
-
-                                if (card){
-                                        if ((err=put_user(atomic_read(&card->u.x.command_busy),
-                                                                &dbg_data->debug[cnt].cmd_busy)))
-                                                return err;
-                                }
-
-                                if ((err=put_user(wp->lcn,
-                                                  &dbg_data->debug[cnt].lcn)))
-                                        return err;
-
-                                if (wp->mbox) {
-                                        if ((err=put_user(1, &dbg_data->debug[cnt].mbox)))
-                                                return err;
-                                }
-                        }
-
-                        if ((err=put_user(atomic_read(&chan->receive_block),
-                                                                &dbg_data->debug[cnt].rblock)))
-                                return err;
-
-                        if (copy_to_user(dbg_data->debug[cnt].name, dev->name, strlen(dev->name)))
-                                return -EFAULT;
-                }
-
-                if (++cnt == MAX_NUM_DEBUG)
-                        break;
-        }
-        return 0;
-}
-
-/*============================================================
- *  get_ioctl_cmd
- *
- *      Pass up the contents of socket MBOX to the user.
- *===========================================================*/
-
-static int get_ioctl_cmd (struct sock *sk, void *arg)
-{
-        x25api_t *usr_data = (x25api_t *)arg;
-        mbox_cmd_t *mbox_ptr;
-        int err;
-
-        if (usr_data == NULL)
-                return -EINVAL;
-
-        if (!wp_sk(sk)->mbox) {
-                return -EINVAL;
-        }
-
-        mbox_ptr = (mbox_cmd_t *)wp_sk(sk)->mbox;
-
-        if ((err=put_user(mbox_ptr->cmd.qdm, &usr_data->hdr.qdm)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.cause, &usr_data->hdr.cause)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.diagn, &usr_data->hdr.diagn)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.length, &usr_data->hdr.length)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.result, &usr_data->hdr.result)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.lcn, &usr_data->hdr.lcn)))
-                return err;
-
-        if (mbox_ptr->cmd.length > 0){
-                if (mbox_ptr->cmd.length > X25_MAX_DATA)
-                        return -EINVAL;
-
-                if (copy_to_user(usr_data->data, mbox_ptr->data, mbox_ptr->cmd.length)){
-                        printk(KERN_INFO "wansock: Copy failed !!!\n");
-                        return -EFAULT;
-                }
-        }
-        return 0;
-}
-
-/*============================================================
- *  set_ioctl_cmd
- *
- *      Before command can be execute, socket MBOX must
- *      be created, and initialized with user data.
- *===========================================================*/
-
-static int set_ioctl_cmd (struct sock *sk, void *arg)
-{
-        x25api_t *usr_data = (x25api_t *)arg;
-        mbox_cmd_t *mbox_ptr;
-        int err;
-
-        if (!wp_sk(sk)->mbox) {
-                void *mbox_ptr;
-                struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-                if (!dev)
-                        return -ENODEV;
-
-                dev_put(dev);
-
-                if ((mbox_ptr = kzalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL)
-                        return -ENOMEM;
-
-                wp_sk(sk)->mbox = mbox_ptr;
-
-                wanpipe_link_driver(dev,sk);
-        }
-
-        mbox_ptr = (mbox_cmd_t*)wp_sk(sk)->mbox;
-        memset(mbox_ptr, 0, sizeof(mbox_cmd_t));
-
-        if (usr_data == NULL){
-                return 0;
-        }
-        if ((err=get_user(mbox_ptr->cmd.qdm, &usr_data->hdr.qdm)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.cause, &usr_data->hdr.cause)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.diagn, &usr_data->hdr.diagn)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.length, &usr_data->hdr.length)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.result, &usr_data->hdr.result)))
-                return err;
-
-        if (mbox_ptr->cmd.length > 0){
-                if (mbox_ptr->cmd.length > X25_MAX_DATA)
-                        return -EINVAL;
-
-                if (copy_from_user(mbox_ptr->data, usr_data->data, mbox_ptr->cmd.length)){
-                        printk(KERN_INFO "Copy failed\n");
-                        return -EFAULT;
-                }
-        }
-        return 0;
-}
-
-
-/*======================================================================
- * wanpipe_poll
- *
- *      Datagram poll: Again totally generic. This also handles
- *      sequenced packet sockets providing the socket receive queue
- *      is only ever holding data ready to receive.
- *
- *      Note: when you _don't_ use this routine for this protocol,
- *      and you use a different write policy from sock_writeable()
- *      then please supply your own write_space callback.
- *=====================================================================*/
-
-unsigned int wanpipe_poll(struct file * file, struct socket *sock, poll_table *wait)
-{
-        struct sock *sk = sock->sk;
-        unsigned int mask;
-
-        ++wp_sk(sk)->poll_cnt;
-
-        poll_wait(file, sk->sk_sleep, wait);
-        mask = 0;
-
-        /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue)) {
-                mask |= POLLPRI;
-                return mask;
-        }
-        if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLHUP;
-
-        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue)) {
-                mask |= POLLIN | POLLRDNORM;
-        }
-
-        /* connection hasn't started yet */
-        if (sk->sk_state == WANSOCK_CONNECTING) {
-                return mask;
-        }
-
-        if (sk->sk_state == WANSOCK_DISCONNECTED) {
-                mask = POLLPRI;
-                return mask;
-        }
-
-        /* This check blocks the user process if there is
-         * a packet already queued in the socket write queue.
-         * This option is only for X25API protocol, for other
-         * protocol like chdlc enable streaming mode,
-         * where multiple packets can be pending in the socket
-         * transmit queue */
-
-        if (wp_sk(sk)->num == htons(X25_PROT)) {
-                if (atomic_read(&wp_sk(sk)->packet_sent))
-                        return mask;
-        }
-
-        /* writable? */
-        if (sock_writeable(sk)){
-                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
-        }else{
-                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
-        }
-
-        return mask;
-}
-
-/*======================================================================
- * wanpipe_listen
- *
- *      X25API Specific function. Set a socket into LISTENING  MODE.
- *=====================================================================*/
-
-
-static int wanpipe_listen(struct socket *sock, int backlog)
-{
-        struct sock *sk = sock->sk;
-
-        /* This is x25 specific area if protocol doesn't
-         * match, return error */
-        if (wp_sk(sk)->num != htons(X25_PROT))
-                return -EINVAL;
-
-        if (sk->sk_state == WANSOCK_BIND_LISTEN) {
-
-                sk->sk_max_ack_backlog = backlog;
-                sk->sk_state           = WANSOCK_LISTEN;
-                return 0;
-        }else{
-                printk(KERN_INFO "wansock: Listening sock was not binded\n");
-        }
-
-        return -EINVAL;
-}
-
-/*======================================================================
- * wanpipe_link_card
- *
- *      Connects the listening socket to the driver
- *=====================================================================*/
-
-static int wanpipe_link_card (struct sock *sk)
-{
-        sdla_t *card = (sdla_t*)wp_sk(sk)->card;
-
-        if (!card)
-                return -ENOMEM;
-
-        if ((card->sk != NULL) || (card->func != NULL)){
-                printk(KERN_INFO "wansock: Listening queue is already established\n");
-                return -EINVAL;
-        }
-
-        card->sk=sk;
-        card->func=wanpipe_listen_rcv;
-        sock_set_flag(sk, SOCK_ZAPPED);
-
-        return 0;
-}
-
-/*======================================================================
- * wanpipe_listen
- *
- *      X25API Specific function. Disconnect listening socket from
- *      the driver.
- *=====================================================================*/
-
-static void wanpipe_unlink_card (struct sock *sk)
-{
-        sdla_t *card = (sdla_t*)wp_sk(sk)->card;
-
-        if (card){
-                card->sk=NULL;
-                card->func=NULL;
-        }
-}
-
-/*======================================================================
- * wanpipe_exec_cmd
- *
- *      Ioctl function calls this function to execute user command.
- *      Connect() sytem call also calls this function to execute
- *      place call.  This function blocks until command is executed.
- *=====================================================================*/
-
-static int wanpipe_exec_cmd(struct sock *sk, int cmd, unsigned int flags)
-{
-        int err = -EINVAL;
-        wanpipe_opt *wp = wp_sk(sk);
-        mbox_cmd_t *mbox_ptr = (mbox_cmd_t*)wp->mbox;
-
-        if (!mbox_ptr){
-                printk(KERN_INFO "NO MBOX PTR !!!!!\n");
-                return -EINVAL;
-        }
-
-        /* This is x25 specific area if protocol doesn't
-         * match, return error */
-        if (wp->num != htons(X25_PROT))
-                return -EINVAL;
-
-
-        switch (cmd){
-
-                case SIOC_WANPIPE_ACCEPT_CALL:
-
-                        if (sk->sk_state != WANSOCK_CONNECTING) {
-                                err = -EHOSTDOWN;
-                                break;
-                        }
-
-                        err = execute_command(sk,X25_ACCEPT_CALL,0);
-                        if (err < 0)
-                                break;
-
-                        /* Update. Mar6 2000.
-                         * Do not set the sock lcn number here, since
-                         * it is done in wanpipe_listen_rcv().
-                         */
-                        if (sk->sk_state == WANSOCK_CONNECTED) {
-                                wp->lcn = ((mbox_cmd_t*)wp->mbox)->cmd.lcn;
-                                DBG_PRINTK(KERN_INFO "\nwansock: Accept OK %i\n",
-                                        wp->lcn);
-                                err = 0;
-
-                        }else{
-                                DBG_PRINTK (KERN_INFO "\nwansock: Accept Failed %i\n",
-                                        wp->lcn);
-                                wp->lcn = 0;
-                                err = -ECONNREFUSED;
-                        }
-                        break;
-
-                case SIOC_WANPIPE_CLEAR_CALL:
-
-                        if (sk->sk_state == WANSOCK_DISCONNECTED) {
-                                err = -EINVAL;
-                                break;
-                        }
-
-
-                        /* Check if data buffers are pending for transmission,
-                         * if so, check whether user wants to wait until data
-                         * is transmitted, or clear a call and drop packets */
-
-                        if (atomic_read(&sk->sk_wmem_alloc) ||
-                            check_driver_busy(sk)) {
-                                mbox_cmd_t *mbox = wp->mbox;
-                                if (mbox->cmd.qdm & 0x80){
-                                        mbox->cmd.result = 0x35;
-                                        err = -EAGAIN;
-                                        break;
-                                }
-                        }
-
-                        sk->sk_state = WANSOCK_DISCONNECTING;
-
-                        err = execute_command(sk,X25_CLEAR_CALL,0);
-                        if (err < 0)
-                                break;
-
-                        err = -ECONNREFUSED;
-                        if (sk->sk_state == WANSOCK_DISCONNECTED) {
-                                DBG_PRINTK(KERN_INFO "\nwansock: CLEAR OK %i\n",
-                                           wp->lcn);
-                                wp->lcn = 0;
-                                err = 0;
-                        }
-                        break;
-
-                case SIOC_WANPIPE_RESET_CALL:
-
-                        if (sk->sk_state != WANSOCK_CONNECTED) {
-                                err = -EINVAL;
-                                break;
-                        }
-
-
-                        /* Check if data buffers are pending for transmission,
-                         * if so, check whether user wants to wait until data
-                         * is transmitted, or reset a call and drop packets */
-
-                        if (atomic_read(&sk->sk_wmem_alloc) ||
-                            check_driver_busy(sk)) {
-                                mbox_cmd_t *mbox = wp->mbox;
-                                if (mbox->cmd.qdm & 0x80){
-                                        mbox->cmd.result = 0x35;
-                                        err = -EAGAIN;
-                                        break;
-                                }
-                        }
-
-
-                        err = execute_command(sk, X25_RESET,0);
-                        if (err < 0)
-                                break;
-
-                        err = mbox_ptr->cmd.result;
-                        break;
-
-
-                case X25_PLACE_CALL:
-
-                        err=execute_command(sk,X25_PLACE_CALL,flags);
-                        if (err < 0)
-                                break;
-
-                        if (sk->sk_state == WANSOCK_CONNECTED) {
-
-                                wp->lcn = ((mbox_cmd_t*)wp->mbox)->cmd.lcn;
-
-                                DBG_PRINTK(KERN_INFO "\nwansock: PLACE CALL OK %i\n",
-                                        wp->lcn);
-                                err = 0;
-
-                        } else if (sk->sk_state == WANSOCK_CONNECTING &&
-                                   (flags & O_NONBLOCK)) {
-                                wp->lcn = ((mbox_cmd_t*)wp->mbox)->cmd.lcn;
-                                DBG_PRINTK(KERN_INFO "\nwansock: Place Call OK: Waiting %i\n",
-                                        wp->lcn);
-
-                                err = 0;
-
-                        }else{
-                                DBG_PRINTK(KERN_INFO "\nwansock: Place call Failed\n");
-                                err = -ECONNREFUSED;
-                        }
-
-                        break;
-
-                default:
-                        return -EINVAL;
-        }
-
-        return err;
-}
-
-static int check_driver_busy (struct sock *sk)
-{
-        struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-        wanpipe_common_t *chan;
-
-        if (!dev)
-                return 0;
-
-        dev_put(dev);
-
-        if ((chan=dev->priv) == NULL)
-                return 0;
-
-        return atomic_read(&chan->driver_busy);
-}
-
-
-/*======================================================================
- * wanpipe_accept
- *
- *      ACCEPT() System call.   X25API Specific function.
- *      For each incoming call, create a new socket and
- *      return it to the user.
- *=====================================================================*/
-
-static int wanpipe_accept(struct socket *sock, struct socket *newsock, int flags)
-{
-        struct sock *sk;
-        struct sock *newsk;
-        struct sk_buff *skb;
-        DECLARE_WAITQUEUE(wait, current);
-        int err=0;
-
-        if (newsock->sk != NULL){
-                wanpipe_kill_sock_accept(newsock->sk);
-                newsock->sk=NULL;
-        }
-
-        if ((sk = sock->sk) == NULL)
-                return -EINVAL;
-
-        if (sk->sk_type != SOCK_RAW)
-                return -EOPNOTSUPP;
-
-        if (sk->sk_state != WANSOCK_LISTEN)
-                return -EINVAL;
-
-        if (wp_sk(sk)->num != htons(X25_PROT))
-                return -EINVAL;
-
-        add_wait_queue(sk->sk_sleep,&wait);
-        current->state = TASK_INTERRUPTIBLE;
-        for (;;){
-                skb = skb_dequeue(&sk->sk_receive_queue);
-                if (skb){
-                        err=0;
-                        break;
-                }
-                if (signal_pending(current)) {
-                        err = -ERESTARTSYS;
-                        break;
-                }
-                schedule();
-        }
-        current->state = TASK_RUNNING;
-        remove_wait_queue(sk->sk_sleep,&wait);
-
-        if (err != 0)
-                return err;
-
-        newsk = get_newsk_from_skb(skb);
-        if (!newsk){
-                return -EINVAL;
-        }
-
-        set_bit(1,&wanpipe_tx_critical);
-        write_lock(&wanpipe_sklist_lock);
-        sk_add_node(newsk, &wanpipe_sklist);
-        write_unlock(&wanpipe_sklist_lock);
-        clear_bit(1,&wanpipe_tx_critical);
-
-        newsk->sk_socket = newsock;
-        newsk->sk_sleep = &newsock->wait;
-
-        /* Now attach up the new socket */
-        sk->sk_ack_backlog--;
-        newsock->sk = newsk;
-
-        kfree_skb(skb);
-
-        DBG_PRINTK(KERN_INFO "\nwansock: ACCEPT Got LCN %i\n",
-                   wp_sk(newsk)->lcn);
-        return 0;
-}
-
-/*======================================================================
- *  get_newsk_from_skb
- *
- *      Accept() uses this function to get the address of the new
- *      socket structure.
- *=====================================================================*/
-
-struct sock * get_newsk_from_skb (struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-        wanpipe_common_t *chan;
-
-        if (!dev){
-                return NULL;
-        }
-
-        if ((chan = dev->priv) == NULL){
-                return NULL;
-        }
-
-        if (!chan->sk){
-                return NULL;
-        }
-        return (struct sock *)chan->sk;
-}
-
-/*======================================================================
- *  wanpipe_connect
- *
- *      CONNECT() System Call. X25API specific function
- *      Check the state of the sock, and execute PLACE_CALL command.
- *      Connect can ether block or return without waiting for connection,
- *      if specified by user.
- *=====================================================================*/
-
-static int wanpipe_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)
-{
-        struct sock *sk = sock->sk;
-        struct wan_sockaddr_ll *addr = (struct wan_sockaddr_ll*)uaddr;
-        struct net_device *dev;
-        int err;
-
-        if (wp_sk(sk)->num != htons(X25_PROT))
-                return -EINVAL;
-
-        if (sk->sk_state == WANSOCK_CONNECTED)
-                return -EISCONN;        /* No reconnect on a seqpacket socket */
-
-        if (sk->sk_state != WAN_DISCONNECTED) {
-                printk(KERN_INFO "wansock: Trying to connect on channel NON DISCONNECT\n");
-                return -ECONNREFUSED;
-        }
-
-        sk->sk_state = WANSOCK_DISCONNECTED;
-        sock->state  = SS_UNCONNECTED;
-
-        if (addr_len != sizeof(struct wan_sockaddr_ll))
-                return -EINVAL;
-
-        if (addr->sll_family != AF_WANPIPE)
-                return -EINVAL;
-
-        if ((dev = dev_get_by_index(sk->sk_bound_dev_if)) == NULL)
-                return -ENETUNREACH;
-
-        dev_put(dev);
-
-        if (!sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
-        sock->state   = SS_CONNECTING;
-        sk->sk_state  = WANSOCK_CONNECTING;
-
-        if (!wp_sk(sk)->mbox) {
-                if (wp_sk (sk)->svc)
-                        return -EINVAL;
-                else {
-                        int err;
-                        if ((err=set_ioctl_cmd(sk,NULL)) < 0)
-                                return err;
-                }
-        }
-
-        if ((err=wanpipe_exec_cmd(sk, X25_PLACE_CALL,flags)) != 0){
-                sock->state = SS_UNCONNECTED;
-                sk->sk_state = WANSOCK_CONNECTED;
-                return err;
-        }
-
-        if (sk->sk_state != WANSOCK_CONNECTED && (flags & O_NONBLOCK)) {
-                return 0;
-        }
-
-        if (sk->sk_state != WANSOCK_CONNECTED) {
-                sock->state = SS_UNCONNECTED;
-                return -ECONNREFUSED;
-        }
-
-        sock->state = SS_CONNECTED;
-        return 0;
-}
-
-const struct proto_ops wanpipe_ops = {
-        .family =       PF_WANPIPE,
-        .owner =        THIS_MODULE,
-        .release =      wanpipe_release,
-        .bind =         wanpipe_bind,
-        .connect =      wanpipe_connect,
-        .socketpair =   sock_no_socketpair,
-        .accept =       wanpipe_accept,
-        .getname =      wanpipe_getname,
-        .poll =         wanpipe_poll,
-        .ioctl =        wanpipe_ioctl,
-        .listen =       wanpipe_listen,
-        .shutdown =     sock_no_shutdown,
-        .setsockopt =   sock_no_setsockopt,
-        .getsockopt =   sock_no_getsockopt,
-        .sendmsg =      wanpipe_sendmsg,
-        .recvmsg =      wanpipe_recvmsg
-};
-
-static struct net_proto_family wanpipe_family_ops = {
-        .family = PF_WANPIPE,
-        .create = wanpipe_create,
-        .owner  = THIS_MODULE,
-};
-
-struct notifier_block wanpipe_netdev_notifier = {
-        .notifier_call = wanpipe_notifier,
-};
-
-
-#ifdef MODULE
-void cleanup_module(void)
-{
-        printk(KERN_INFO "wansock: Cleaning up \n");
-        unregister_netdevice_notifier(&wanpipe_netdev_notifier);
-        sock_unregister(PF_WANPIPE);
-        proto_unregister(&wanpipe_proto);
-}
-
-int init_module(void)
-{
-        int rc;
-
-        printk(KERN_INFO "wansock: Registering Socket \n");
-
-        rc = proto_register(&wanpipe_proto, 0);
-        if (rc != 0)
-                goto out;
-
-        sock_register(&wanpipe_family_ops);
-        register_netdevice_notifier(&wanpipe_netdev_notifier);
-out:
-        return rc;
-}
-#endif
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NETPROTO(PF_WANPIPE);
diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index d339e0c810a8..8738ec7ce693 100644
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -26,64 +26,66 @@ int x25_forward_call(struct x25_address *dest_addr, struct x25_neigh *from,
         short same_lci = 0;
         int rc = 0;
 
-        if ((rt = x25_get_route(dest_addr)) != NULL) {
+        if ((rt = x25_get_route(dest_addr)) == NULL)
+                goto out_no_route;
 
-                if ((neigh_new = x25_get_neigh(rt->dev)) == NULL) {
-                        /* This shouldnt happen, if it occurs somehow
-                         * do something sensible
-                         */
-                        goto out_put_route;
-                }
-
-                /* Avoid a loop. This is the normal exit path for a
-                 * system with only one x.25 iface and default route
+        if ((neigh_new = x25_get_neigh(rt->dev)) == NULL) {
+                /* This shouldnt happen, if it occurs somehow
+                 * do something sensible
                  */
-                if (rt->dev == from->dev) {
-                        goto out_put_nb;
-                }
+                goto out_put_route;
+        }
 
-                /* Remote end sending a call request on an already
-                 * established LCI? It shouldnt happen, just in case..
-                 */
-                read_lock_bh(&x25_forward_list_lock);
-                list_for_each(entry, &x25_forward_list) {
-                        x25_frwd = list_entry(entry, struct x25_forward, node);
-                        if (x25_frwd->lci == lci) {
-                                printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
-                                same_lci = 1;
-                        }
-                }
-                read_unlock_bh(&x25_forward_list_lock);
-
-                /* Save the forwarding details for future traffic */
-                if (!same_lci){
-                        if ((new_frwd = kmalloc(sizeof(struct x25_forward),
-                                                        GFP_ATOMIC)) == NULL){
-                                rc = -ENOMEM;
-                                goto out_put_nb;
-                        }
-                        new_frwd->lci = lci;
-                        new_frwd->dev1 = rt->dev;
-                        new_frwd->dev2 = from->dev;
-                        write_lock_bh(&x25_forward_list_lock);
-                        list_add(&new_frwd->node, &x25_forward_list);
-                        write_unlock_bh(&x25_forward_list_lock);
+        /* Avoid a loop. This is the normal exit path for a
+         * system with only one x.25 iface and default route
+         */
+        if (rt->dev == from->dev) {
+                goto out_put_nb;
+        }
+
+        /* Remote end sending a call request on an already
+         * established LCI? It shouldnt happen, just in case..
+         */
+        read_lock_bh(&x25_forward_list_lock);
+        list_for_each(entry, &x25_forward_list) {
+                x25_frwd = list_entry(entry, struct x25_forward, node);
+                if (x25_frwd->lci == lci) {
+                        printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
+                        same_lci = 1;
                 }
+        }
+        read_unlock_bh(&x25_forward_list_lock);
 
-                /* Forward the call request */
-                if ( (skbn = skb_clone(skb, GFP_ATOMIC)) == NULL){
+        /* Save the forwarding details for future traffic */
+        if (!same_lci){
+                if ((new_frwd = kmalloc(sizeof(struct x25_forward),
+                                                GFP_ATOMIC)) == NULL){
+                        rc = -ENOMEM;
                         goto out_put_nb;
                 }
-                x25_transmit_link(skbn, neigh_new);
-                rc = 1;
+                new_frwd->lci = lci;
+                new_frwd->dev1 = rt->dev;
+                new_frwd->dev2 = from->dev;
+                write_lock_bh(&x25_forward_list_lock);
+                list_add(&new_frwd->node, &x25_forward_list);
+                write_unlock_bh(&x25_forward_list_lock);
         }
 
+        /* Forward the call request */
+        if ( (skbn = skb_clone(skb, GFP_ATOMIC)) == NULL){
+                goto out_put_nb;
+        }
+        x25_transmit_link(skbn, neigh_new);
+        rc = 1;
+
 
 out_put_nb:
         x25_neigh_put(neigh_new);
 
 out_put_route:
         x25_route_put(rt);
+
+out_no_route:
         return rc;
 }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0c3a70ac5075..785c3e39f062 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2089,7 +2089,7 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
                                         sizeof(struct in6_addr));
                         }
                         audit_log_format(audit_buf,
-                                         " src=" NIP6_FMT "dst=" NIP6_FMT,
+                                         " src=" NIP6_FMT " dst=" NIP6_FMT,
                                          NIP6(saddr6), NIP6(daddr6));
                 }
                 break;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a35f9e4ede26..5c5f6dcab974 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -704,7 +704,8 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
                     x->props.mode   != mode ||
                     x->props.family != family ||
                     x->km.state     != XFRM_STATE_ACQ ||
-                    x->id.spi       != 0)
+                    x->id.spi       != 0 ||
+                    x->id.proto     != proto)
                         continue;
 
                 switch (family) {
@@ -801,7 +802,8 @@ int xfrm_state_add(struct xfrm_state *x)
 
         if (use_spi && x->km.seq) {
                 x1 = __xfrm_find_acq_byseq(x->km.seq);
-                if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
+                if (x1 && ((x1->id.proto != x->id.proto) ||
+                    xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
                         xfrm_state_put(x1);
                         x1 = NULL;
                 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 96789952f6a3..e81e2fb3d429 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2025,7 +2025,7 @@ nlmsg_failure:
         return -1;
 }
 
-static int inline xfrm_sa_len(struct xfrm_state *x)
+static inline int xfrm_sa_len(struct xfrm_state *x)
 {
         int l = 0;
         if (x->aalg)
diff --git a/security/dummy.c b/security/dummy.c
index 558795b237d6..8ffd76405b5b 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -907,7 +907,7 @@ static void dummy_d_instantiate (struct dentry *dentry, struct inode *inode)
         return;
 }
 
-static int dummy_getprocattr(struct task_struct *p, char *name, void *value, size_t size)
+static int dummy_getprocattr(struct task_struct *p, char *name, char **value)
 {
         return -EINVAL;
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 19a385e9968e..d41e24d6ae41 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4468,11 +4468,12 @@ static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
 }
 
 static int selinux_getprocattr(struct task_struct *p,
-                               char *name, void *value, size_t size)
+                               char *name, char **value)
 {
         struct task_security_struct *tsec;
         u32 sid;
         int error;
+        unsigned len;
 
         if (current != p) {
                 error = task_has_perm(current, p, PROCESS__GETATTR);
@@ -4500,7 +4501,10 @@ static int selinux_getprocattr(struct task_struct *p,
         if (!sid)
                 return 0;
 
-        return selinux_getsecurity(sid, value, size);
+        error = security_sid_to_context(sid, value, &len);
+        if (error)
+                return error;
+        return len;
 }
 
 static int selinux_setprocattr(struct task_struct *p,
diff --git a/sound/oss/dmasound/dmasound_core.c b/sound/oss/dmasound/dmasound_core.c
index a0ec886f2aa3..f4056a9c371b 100644
--- a/sound/oss/dmasound/dmasound_core.c
+++ b/sound/oss/dmasound/dmasound_core.c
@@ -1346,22 +1346,34 @@ static const struct file_operations sq_fops =
         .ioctl          = sq_ioctl,
         .open           = sq_open,
         .release        = sq_release,
+};
+
 #ifdef HAS_RECORD
-        .read           = NULL  /* default to no read for compat mode */
-#endif
+static const struct file_operations sq_fops_record =
+{
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .write          = sq_write,
+        .poll           = sq_poll,
+        .ioctl          = sq_ioctl,
+        .open           = sq_open,
+        .release        = sq_release,
+        .read           = sq_read,
 };
+#endif
 
 static int sq_init(void)
 {
+        const struct file_operations *fops = &sq_fops;
 #ifndef MODULE
         int sq_unit;
 #endif
 
 #ifdef HAS_RECORD
         if (dmasound.mach.record)
-                sq_fops.read = sq_read ;
+                fops = &sq_fops_record;
 #endif
-        sq_unit = register_sound_dsp(&sq_fops, -1);
+        sq_unit = register_sound_dsp(fops, -1);
         if (sq_unit < 0) {
                 printk(KERN_ERR "dmasound_core: couldn't register fops\n") ;
                 return sq_unit ;
diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index 37fabf75daa7..b188a4df58cb 100644
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -1962,9 +1962,11 @@ static int snd_ac97_ad1888_downmix_put(struct snd_kcontrol *kcontrol, struct snd
 static void ad1888_update_jacks(struct snd_ac97 *ac97)
 {
         unsigned short val = 0;
-        if (! is_shared_linein(ac97))
+        /* clear LODIS if shared jack is to be used for Surround out */
+        if (is_shared_linein(ac97))
                 val |= (1 << 12);
-        if (! is_shared_micin(ac97))
+        /* clear CLDIS if shared jack is to be used for C/LFE out */
+        if (is_shared_micin(ac97))
                 val |= (1 << 11);
         /* shared Line-In */
         snd_ac97_update_bits(ac97, AC97_AD_MISC, (1 << 11) | (1 << 12), val);
@@ -2136,8 +2138,9 @@ static const struct snd_kcontrol_new snd_ac97_ad1985_controls[] = {
 static void ad1985_update_jacks(struct snd_ac97 *ac97)
 {
         ad1888_update_jacks(ac97);
+        /* clear OMS if shared jack is to be used for C/LFE out */
         snd_ac97_update_bits(ac97, AC97_AD_SERIAL_CFG, 1 << 9,
-                             is_shared_micin(ac97) ? 0 : 1 << 9);
+                             is_shared_micin(ac97) ? 1 << 9 : 0);
 }
 
 static int patch_ad1985_specific(struct snd_ac97 *ac97)
@@ -2418,9 +2421,9 @@ static void ad1986_update_jacks(struct snd_ac97 *ac97)
         unsigned short ser_val;
 
         /* disable SURROUND and CENTER/LFE if not surround mode */
-        if (! is_surround_on(ac97))
+        if (!is_surround_on(ac97))
                 misc_val |= AC97_AD1986_SODIS;
-        if (! is_clfe_on(ac97))
+        if (!is_clfe_on(ac97))
                 misc_val |= AC97_AD1986_CLDIS;
 
         /* select line input (default=LINE_IN, SURROUND or MIC_1/2) */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index b9a8e238b0a8..1672cace1ae7 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -199,7 +199,6 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 
 /* STATESTS int mask: SD2,SD1,SD0 */
 #define STATESTS_INT_MASK       0x07
-#define AZX_MAX_CODECS          3
 
 /* SD_CTL bits */
 #define SD_CTL_STREAM_RESET     0x01    /* stream reset bit */
@@ -966,6 +965,16 @@ static int azx_setup_controller(struct azx *chip, struct azx_dev *azx_dev)
  * Codec initialization
  */
 
+static unsigned int azx_max_codecs[] __devinitdata = {
+        [AZX_DRIVER_ICH] = 3,
+        [AZX_DRIVER_ATI] = 4,
+        [AZX_DRIVER_ATIHDMI] = 4,
+        [AZX_DRIVER_VIA] = 3,           /* FIXME: correct? */
+        [AZX_DRIVER_SIS] = 3,           /* FIXME: correct? */
+        [AZX_DRIVER_ULI] = 3,           /* FIXME: correct? */
+        [AZX_DRIVER_NVIDIA] = 3,        /* FIXME: correct? */
+};
+
 static int __devinit azx_codec_create(struct azx *chip, const char *model)
 {
         struct hda_bus_template bus_temp;
@@ -982,7 +991,7 @@ static int __devinit azx_codec_create(struct azx *chip, const char *model)
                 return err;
 
         codecs = 0;
-        for (c = 0; c < AZX_MAX_CODECS; c++) {
+        for (c = 0; c < azx_max_codecs[chip->driver_type]; c++) {
                 if ((chip->codec_mask & (1 << c)) & probe_mask) {
                         err = snd_hda_codec_new(chip->bus, c, NULL);
                         if (err < 0)
@@ -1078,6 +1087,10 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
         runtime->hw.rates = hinfo->rates;
         snd_pcm_limit_hw_rates(runtime);
         snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
+        snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_BUFFER_BYTES,
+                                   128);
+        snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_BYTES,
+                                   128);
         if ((err = hinfo->ops.open(hinfo, apcm->codec, substream)) < 0) {
                 azx_release_device(azx_dev);
                 mutex_unlock(&chip->open_mutex);
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 00ace59b05c9..f94f1f22889e 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -833,12 +833,14 @@ static struct snd_pci_quirk ad1986a_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS P5", AD1986A_3STACK),
         SND_PCI_QUIRK(0x1043, 0x81cb, "ASUS M2N", AD1986A_3STACK),
         SND_PCI_QUIRK(0x1043, 0x8234, "ASUS M2N", AD1986A_3STACK),
+        SND_PCI_QUIRK(0x144d, 0xb03c, "Samsung R55", AD1986A_3STACK),
         SND_PCI_QUIRK(0x144d, 0xc01e, "FSC V2060", AD1986A_LAPTOP),
         SND_PCI_QUIRK(0x144d, 0xc023, "Samsung X60", AD1986A_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x144d, 0xc024, "Samsung R65", AD1986A_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x144d, 0xc026, "Samsung X11", AD1986A_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x144d, 0xc504, "Samsung Q35", AD1986A_3STACK),
         SND_PCI_QUIRK(0x144d, 0xc027, "Samsung Q1", AD1986A_ULTRA),
+        SND_PCI_QUIRK(0x17aa, 0x1011, "Lenovo M55", AD1986A_LAPTOP),
         SND_PCI_QUIRK(0x17aa, 0x1017, "Lenovo A60", AD1986A_3STACK),
         SND_PCI_QUIRK(0x17aa, 0x2066, "Lenovo N100", AD1986A_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x17c0, 0x2017, "Samsung M50", AD1986A_LAPTOP),
@@ -1205,7 +1207,7 @@ static struct hda_verb ad1981_init_verbs[] = {
 /*
  * Patch for HP nx6320
  *
- * nx6320 uses EAPD in the reserve way - EAPD-on means the internal
+ * nx6320 uses EAPD in the reverse way - EAPD-on means the internal
  * speaker output enabled _and_ mute-LED off.
  */
 
@@ -1373,6 +1375,21 @@ static int ad1981_hp_init(struct hda_codec *codec)
         return 0;
 }
 
+/* configuration for Toshiba Laptops */
+static struct hda_verb ad1981_toshiba_init_verbs[] = {
+        {0x05, AC_VERB_SET_EAPD_BTLENABLE, 0x01 }, /* default on */
+        /* pin sensing on HP and Mic jacks */
+        {0x06, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1981_HP_EVENT},
+        {0x08, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | AD1981_MIC_EVENT},
+        {}
+};
+
+static struct snd_kcontrol_new ad1981_toshiba_mixers[] = {
+        HDA_CODEC_VOLUME("Amp Volume", 0x1a, 0x0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("Amp Switch", 0x1a, 0x0, HDA_OUTPUT),
+        { }
+};
+
 /* configuration for Lenovo Thinkpad T60 */
 static struct snd_kcontrol_new ad1981_thinkpad_mixers[] = {
         HDA_CODEC_VOLUME("Master Playback Volume", 0x05, 0x0, HDA_OUTPUT),
@@ -1418,6 +1435,7 @@ enum {
         AD1981_BASIC,
         AD1981_HP,
         AD1981_THINKPAD,
+        AD1981_TOSHIBA,
         AD1981_MODELS
 };
 
@@ -1425,6 +1443,7 @@ static const char *ad1981_models[AD1981_MODELS] = {
         [AD1981_HP]             = "hp",
         [AD1981_THINKPAD]       = "thinkpad",
         [AD1981_BASIC]          = "basic",
+        [AD1981_TOSHIBA]        = "toshiba"
 };
 
 static struct snd_pci_quirk ad1981_cfg_tbl[] = {
@@ -1435,6 +1454,7 @@ static struct snd_pci_quirk ad1981_cfg_tbl[] = {
         /* Lenovo Thinkpad T60/X60/Z6xx */
         SND_PCI_QUIRK(0x17aa, 0, "Lenovo Thinkpad", AD1981_THINKPAD),
         SND_PCI_QUIRK(0x1014, 0x0597, "Lenovo Z60", AD1981_THINKPAD),
+        SND_PCI_QUIRK(0x1179, 0x0001, "Toshiba U205", AD1981_TOSHIBA),
         {}
 };
 
@@ -1485,8 +1505,17 @@ static int patch_ad1981(struct hda_codec *codec)
                 spec->mixers[0] = ad1981_thinkpad_mixers;
                 spec->input_mux = &ad1981_thinkpad_capture_source;
                 break;
+        case AD1981_TOSHIBA:
+                spec->mixers[0] = ad1981_hp_mixers;
+                spec->mixers[1] = ad1981_toshiba_mixers;
+                spec->num_init_verbs = 2;
+                spec->init_verbs[1] = ad1981_toshiba_init_verbs;
+                spec->multiout.dig_out_nid = 0;
+                spec->input_mux = &ad1981_hp_capture_source;
+                codec->patch_ops.init = ad1981_hp_init;
+                codec->patch_ops.unsol_event = ad1981_hp_unsol_event;
+                break;
         }
-
         return 0;
 }
 
@@ -2607,6 +2636,12 @@ static const char *ad1988_models[AD1988_MODEL_LAST] = {
         [AD1988_AUTO]           = "auto",
 };
 
+static struct snd_pci_quirk ad1988_cfg_tbl[] = {
+        SND_PCI_QUIRK(0x1043, 0x81f6, "Asus M2N-SLI", AD1988_6STACK_DIG),
+        SND_PCI_QUIRK(0x1043, 0x81ec, "Asus P5B-DLX", AD1988_6STACK_DIG),
+        {}
+};
+
 static int patch_ad1988(struct hda_codec *codec)
 {
         struct ad198x_spec *spec;
@@ -2623,7 +2658,7 @@ static int patch_ad1988(struct hda_codec *codec)
                 snd_printk(KERN_INFO "patch_analog: AD1988A rev.2 is detected, enable workarounds\n");
 
         board_config = snd_hda_check_board_config(codec, AD1988_MODEL_LAST,
-                                                  ad1988_models, NULL);
+                                                  ad1988_models, ad1988_cfg_tbl);
         if (board_config < 0) {
                 printk(KERN_INFO "hda_codec: Unknown model for AD1988, trying auto-probe from BIOS...\n");
                 board_config = AD1988_AUTO;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 84d005ef30ee..fba3cb11bc2a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4186,6 +4186,8 @@ static const char *alc260_models[ALC260_MODEL_LAST] = {
 static struct snd_pci_quirk alc260_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x007b, "Acer C20x", ALC260_ACER),
         SND_PCI_QUIRK(0x1025, 0x008f, "Acer", ALC260_ACER),
+        SND_PCI_QUIRK(0x103c, 0x2808, "HP d5700", ALC260_HP_3013),
+        SND_PCI_QUIRK(0x103c, 0x280a, "HP d5750", ALC260_HP_3013),
         SND_PCI_QUIRK(0x103c, 0x3010, "HP", ALC260_HP_3013),
         SND_PCI_QUIRK(0x103c, 0x3011, "HP", ALC260_HP),
         SND_PCI_QUIRK(0x103c, 0x3012, "HP", ALC260_HP_3013),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 4c7b03996be9..c94291bc5367 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -60,7 +60,8 @@ enum {
         STAC_D945GTP5,
         STAC_MACMINI,
         STAC_MACBOOK,
-        STAC_MACBOOK_PRO,
+        STAC_MACBOOK_PRO_V1,
+        STAC_MACBOOK_PRO_V2,
         STAC_922X_MODELS
 };
 
@@ -529,7 +530,13 @@ static unsigned int macbook_pin_configs[10] = {
         0x400000fc, 0x400000fb,
 };
 
-static unsigned int macbook_pro_pin_configs[10] = {
+static unsigned int macbook_pro_v1_pin_configs[10] = {
+        0x0321e230, 0x03a1e020, 0x9017e110, 0x01014010,
+        0x01a19021, 0x0381e021, 0x1345e240, 0x13c5e22e,
+        0x02a19320, 0x400000fb
+};
+
+static unsigned int macbook_pro_v2_pin_configs[10] = {
         0x0221401f, 0x90a70120, 0x01813024, 0x01014010,
         0x400000fd, 0x01016011, 0x1345e240, 0x13c5e22e,
         0x400000fc, 0x400000fb,
@@ -541,7 +548,8 @@ static unsigned int *stac922x_brd_tbl[STAC_922X_MODELS] = {
         [STAC_D945GTP5] = d945gtp5_pin_configs,
         [STAC_MACMINI] = d945gtp5_pin_configs,
         [STAC_MACBOOK] = macbook_pin_configs,
-        [STAC_MACBOOK_PRO] = macbook_pro_pin_configs,
+        [STAC_MACBOOK_PRO_V1] = macbook_pro_v1_pin_configs,
+        [STAC_MACBOOK_PRO_V2] = macbook_pro_v2_pin_configs,
 };
 
 static const char *stac922x_models[STAC_922X_MODELS] = {
@@ -550,7 +558,8 @@ static const char *stac922x_models[STAC_922X_MODELS] = {
         [STAC_D945GTP3] = "3stack",
         [STAC_MACMINI]  = "macmini",
         [STAC_MACBOOK]  = "macbook",
-        [STAC_MACBOOK_PRO]      = "macbook-pro",
+        [STAC_MACBOOK_PRO_V1]   = "macbook-pro-v1",
+        [STAC_MACBOOK_PRO_V2]   = "macbook-pro",
 };
 
 static struct snd_pci_quirk stac922x_cfg_tbl[] = {
@@ -1600,6 +1609,11 @@ static int stac92xx_init(struct hda_codec *codec)
                 for (i = 0; i < cfg->hp_outs; i++)
                         enable_pin_detect(codec, cfg->hp_pins[i],
                                           STAC_HP_EVENT);
+                /* force to enable the first line-out; the others are set up
+                 * in unsol_event
+                 */
+                stac92xx_auto_set_pinctl(codec, spec->autocfg.line_out_pins[0],
+                                         AC_PINCTL_OUT_EN);
                 stac92xx_auto_init_hp_out(codec);
                 /* fake event to set up pins */
                 codec->patch_ops.unsol_event(codec, STAC_HP_EVENT << 26);
@@ -1889,9 +1903,13 @@ static int patch_stac922x(struct hda_codec *codec)
                 /* Intel Macs have all same PCI SSID, so we need to check
                  * codec SSID to distinguish the exact models
                  */
+                printk(KERN_INFO "hda_codec: STAC922x, Apple subsys_id=%x\n", codec->subsystem_id);
                 switch (codec->subsystem_id) {
-                case 0x106b1e00:
-                        spec->board_config = STAC_MACBOOK_PRO;
+                case 0x106b0200: /* MacBook Pro first generation */
+                        spec->board_config = STAC_MACBOOK_PRO_V1;
+                        break;
+                case 0x106b1e00: /* MacBook Pro second generation */
+                        spec->board_config = STAC_MACBOOK_PRO_V2;
                         break;
                 }
         }
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index a289abfc7172..7cf2dcb9d8d4 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -725,10 +725,11 @@ static void fill_nocache(void *buf, int size, int nocache)
 static inline void snd_intel8x0_update(struct intel8x0 *chip, struct ichdev *ichdev)
 {
         unsigned long port = ichdev->reg_offset;
+        unsigned long flags;
         int status, civ, i, step;
         int ack = 0;
 
-        spin_lock(&chip->reg_lock);
+        spin_lock_irqsave(&chip->reg_lock, flags);
         status = igetbyte(chip, port + ichdev->roff_sr);
         civ = igetbyte(chip, port + ICH_REG_OFF_CIV);
         if (!(status & ICH_BCIS)) {
@@ -768,7 +769,7 @@ static inline void snd_intel8x0_update(struct intel8x0 *chip, struct ichdev *ich
                         ack = 1;
                 }
         }
-        spin_unlock(&chip->reg_lock);
+        spin_unlock_irqrestore(&chip->reg_lock, flags);
         if (ack && ichdev->substream) {
                 snd_pcm_period_elapsed(ichdev->substream);
         }
@@ -2470,7 +2471,10 @@ static int intel8x0_suspend(struct pci_dev *pci, pm_message_t state)
         }
         pci_disable_device(pci);
         pci_save_state(pci);
-        pci_set_power_state(pci, pci_choose_state(pci, state));
+        /* The call below may disable built-in speaker on some laptops
+         * after S2RAM.  So, don't touch it.
+         */
+        /* pci_set_power_state(pci, pci_choose_state(pci, state)); */
         return 0;
 }
 
diff --git a/sound/soc/Kconfig b/sound/soc/Kconfig
index ec821a57f843..dccaa4be679e 100644
--- a/sound/soc/Kconfig
+++ b/sound/soc/Kconfig
@@ -10,6 +10,8 @@ config SND_SOC_AC97_BUS
 
 config SND_SOC
         tristate "SoC audio support"
+        depends on SND
+        select SND_PCM
         ---help---
 
           If you want SoC support, you should say Y here and also to the
diff --git a/sound/soc/at91/Kconfig b/sound/soc/at91/Kconfig
index 5bcf08b728b0..a5b2558916c1 100644
--- a/sound/soc/at91/Kconfig
+++ b/sound/soc/at91/Kconfig
@@ -2,8 +2,7 @@ menu "SoC Audio for the Atmel AT91"
 
 config SND_AT91_SOC
         tristate "SoC Audio for the Atmel AT91 System-on-Chip"
-        depends on ARCH_AT91 && SND
-        select SND_PCM
+        depends on ARCH_AT91 && SND_SOC
         help
           Say Y or M if you want to add support for codecs attached to
           the AT91 SSC interface. You will also need
diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
index 579e1c8d2b28..b9ab3b8e1d3e 100644
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -2,8 +2,7 @@ menu "SoC Audio for the Intel PXA2xx"
 
 config SND_PXA2XX_SOC
         tristate "SoC Audio for the Intel PXA2xx chip"
-        depends on ARCH_PXA && SND
-        select SND_PCM
+        depends on ARCH_PXA && SND_SOC
         help
           Say Y or M if you want to add support for codecs attached to
           the PXA2xx AC97, I2S or SSP interface. You will also need