132 files changed, 1200 insertions, 1432 deletions
diff --git a/Documentation/filesystems/ntfs.txt b/Documentation/filesystems/ntfs.txt
index 614de3124901..251168587899 100644
--- a/Documentation/filesystems/ntfs.txt
+++ b/Documentation/filesystems/ntfs.txt
@@ -457,6 +457,12 @@ ChangeLog
 Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
+2.1.26:
+        - Implement support for sector sizes above 512 bytes (up to the maximum
+          supported by NTFS which is 4096 bytes).
+        - Enhance support for NTFS volumes which were supported by Windows but
+          not by Linux due to invalid attribute list attribute flags.
+        - A few minor updates and bug fixes.
 2.1.25:
        - Write support is now extended with write(2) being able to both
          overwrite existing file data and to extend files.  Also, if a write
diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
index 8a155418c705..1773106976a2 100644
--- a/Documentation/filesystems/tmpfs.txt
+++ b/Documentation/filesystems/tmpfs.txt
@@ -92,6 +92,15 @@ NodeList format is a comma-separated list of decimal numbers and ranges,
 a range being two hyphen-separated decimal numbers, the smallest and
 largest node numbers in the range.  For example, mpol=bind:0-3,5,7,9-15
+Note that trying to mount a tmpfs with an mpol option will fail if the
+running kernel does not support NUMA; and will fail if its nodelist
+specifies a node >= MAX_NUMNODES.  If your system relies on that tmpfs
+being mounted, but from time to time runs a kernel built without NUMA
+capability (perhaps a safe recovery kernel), or configured to support
+fewer nodes, then it is advisable to omit the mpol option from automatic
+mount options.  It can be added later, when the tmpfs is already mounted
+on MountPoint, by 'mount -o remount,mpol=Policy:NodeList MountPoint'.
 To specify the initial root directory you can use the following mount
 options:
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 153740f460a6..1921353259ae 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -52,6 +52,10 @@ APICs
                 apicmaintimer. Useful when your PIT timer is totally
                 broken.
+   disable_8254_timer / enable_8254_timer
+                 Enable interrupt 0 timer routing over the 8254 in addition to over
+                 the IO-APIC. The kernel tries to set a sensible default.
 Early Console
   syntax: earlyprintk=vga
diff --git a/Makefile b/Makefile
index 77a448c8e776..46eea76bc570 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION =-rc4
+EXTRAVERSION =-rc5
 NAME=Sliding Snow Leopard
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-at91rm9200/gpio.c b/arch/arm/mach-at91rm9200/gpio.c
index a9f718bf8ba8..0e396feec468 100644
--- a/arch/arm/mach-at91rm9200/gpio.c
+++ b/arch/arm/mach-at91rm9200/gpio.c
@@ -274,8 +274,18 @@ static void gpio_irq_handler(unsigned irq, struct irqdesc *desc, struct pt_regs
                gpio = &irq_desc[pin];
                while (isr) {
-                        if (isr & 1)
+                        if (isr & 1) {
-                                gpio->handle(pin, gpio, regs);
+                                if (unlikely(gpio->disable_depth)) {
+                                        /*
+                                         * The core ARM interrupt handler lazily disables IRQs so
+                                         * another IRQ must be generated before it actually gets
+                                         * here to be disabled on the GPIO controller.
+                                         */
+                                        gpio_irq_mask(pin);
+                                }
+                                else
+                                        gpio->handle(pin, gpio, regs);
+                        }
                        pin++;
                        gpio++;
                        isr >>= 1;
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index 0afec8566e7b..5b1a7d46d1d9 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -733,7 +733,7 @@ config PHYSICAL_START
 config HOTPLUG_CPU
        bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
-        depends on SMP && HOTPLUG && EXPERIMENTAL
+        depends on SMP && HOTPLUG && EXPERIMENTAL && !X86_VOYAGER
        ---help---
          Say Y here to experiment with turning CPUs off and on.  CPUs
          can be controlled through /sys/devices/system/cpu.
@@ -1060,6 +1060,7 @@ source "arch/i386/oprofile/Kconfig"
 config KPROBES
        bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
        help
          Kprobes allows you to trap at almost any kernel address and
          execute a callback function.  register_kprobe() establishes
diff --git a/arch/i386/kernel/Makefile b/arch/i386/kernel/Makefile
index 60c3f76dfca4..53bb9a79e274 100644
--- a/arch/i386/kernel/Makefile
+++ b/arch/i386/kernel/Makefile
@@ -7,7 +7,7 @@ extra-y := head.o init_task.o vmlinux.lds
 obj-y   := process.o semaphore.o signal.o entry.o traps.o irq.o \
                ptrace.o time.o ioport.o ldt.o setup.o i8259.o sys_i386.o \
                pci-dma.o i386_ksyms.o i387.o dmi_scan.o bootflag.o \
-                quirks.o i8237.o
+                quirks.o i8237.o topology.o
 obj-y                           += cpu/
 obj-y                           += timers/
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 79577f0ace98..8309a7b2cd63 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -44,9 +44,6 @@ extern void __init clustered_apic_check(void);
 extern int gsi_irq_sharing(int gsi);
 #include <asm/proto.h>
-static inline int acpi_madt_oem_check(char *oem_id, char *oem_table_id) { return 0; }
 #else                           /* X86 */
 #ifdef  CONFIG_X86_LOCAL_APIC
diff --git a/arch/i386/kernel/cpu/common.c b/arch/i386/kernel/cpu/common.c
index 7eb9213734a3..4ecd4b326ded 100644
--- a/arch/i386/kernel/cpu/common.c
+++ b/arch/i386/kernel/cpu/common.c
@@ -4,6 +4,7 @@
 #include <linux/smp.h>
 #include <linux/module.h>
 #include <linux/percpu.h>
+#include <linux/bootmem.h>
 #include <asm/semaphore.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
@@ -18,6 +19,9 @@
 #include "cpu.h"
+DEFINE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
+EXPORT_PER_CPU_SYMBOL(cpu_gdt_descr);
 DEFINE_PER_CPU(unsigned char, cpu_16bit_stack[CPU_16BIT_STACK_SIZE]);
 EXPORT_PER_CPU_SYMBOL(cpu_16bit_stack);
@@ -571,8 +575,9 @@ void __devinit cpu_init(void)
        int cpu = smp_processor_id();
        struct tss_struct * t = &per_cpu(init_tss, cpu);
        struct thread_struct *thread = &current->thread;
-        struct desc_struct *gdt = get_cpu_gdt_table(cpu);
+        struct desc_struct *gdt;
        __u32 stk16_off = (__u32)&per_cpu(cpu_16bit_stack, cpu);
+        struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, cpu);
        if (cpu_test_and_set(cpu, cpu_initialized)) {
                printk(KERN_WARNING "CPU#%d already initialized!\n", cpu);
@@ -590,6 +595,25 @@ void __devinit cpu_init(void)
        }
        /*
+         * This is a horrible hack to allocate the GDT.  The problem
+         * is that cpu_init() is called really early for the boot CPU
+         * (and hence needs bootmem) but much later for the secondary
+         * CPUs, when bootmem will have gone away
+         */
+        if (NODE_DATA(0)->bdata->node_bootmem_map) {
+                gdt = (struct desc_struct *)alloc_bootmem_pages(PAGE_SIZE);
+                /* alloc_bootmem_pages panics on failure, so no check */
+                memset(gdt, 0, PAGE_SIZE);
+        } else {
+                gdt = (struct desc_struct *)get_zeroed_page(GFP_KERNEL);
+                if (unlikely(!gdt)) {
+                        printk(KERN_CRIT "CPU%d failed to allocate GDT\n", cpu);
+                        for (;;)
+                                local_irq_enable();
+                }
+        }
+        /*
         * Initialize the per-CPU GDT with the boot GDT,
         * and set up the GDT descriptor:
         */
@@ -601,10 +625,10 @@ void __devinit cpu_init(void)
                ((((__u64)stk16_off) << 32) & 0xff00000000000000ULL) |
                (CPU_16BIT_STACK_SIZE - 1);
-        cpu_gdt_descr[cpu].size = GDT_SIZE - 1;
+        cpu_gdt_descr->size = GDT_SIZE - 1;
-        cpu_gdt_descr[cpu].address = (unsigned long)gdt;
+        cpu_gdt_descr->address = (unsigned long)gdt;
-        load_gdt(&cpu_gdt_descr[cpu]);
+        load_gdt(cpu_gdt_descr);
        load_idt(&idt_descr);
        /*
diff --git a/arch/i386/kernel/efi.c b/arch/i386/kernel/efi.c
index ecad519fd395..e3e42fd62401 100644
--- a/arch/i386/kernel/efi.c
+++ b/arch/i386/kernel/efi.c
@@ -103,17 +103,19 @@ static void efi_call_phys_prelog(void)
         */
        local_flush_tlb();
-        cpu_gdt_descr[0].address = __pa(cpu_gdt_descr[0].address);
+        per_cpu(cpu_gdt_descr, 0).address =
-        load_gdt((struct Xgt_desc_struct *) __pa(&cpu_gdt_descr[0]));
+                                 __pa(per_cpu(cpu_gdt_descr, 0).address);
+        load_gdt((struct Xgt_desc_struct *)__pa(&per_cpu(cpu_gdt_descr, 0)));
 }
 static void efi_call_phys_epilog(void)
 {
        unsigned long cr4;
-        cpu_gdt_descr[0].address =
+        per_cpu(cpu_gdt_descr, 0).address =
-                (unsigned long) __va(cpu_gdt_descr[0].address);
+                        (unsigned long)__va(per_cpu(cpu_gdt_descr, 0).address);
-        load_gdt(&cpu_gdt_descr[0]);
+        load_gdt((struct Xgt_desc_struct *)__va(&per_cpu(cpu_gdt_descr, 0)));
        cr4 = read_cr4();
        if (cr4 & X86_CR4_PSE) {
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index 2bee6499edd9..e0b7c632efbc 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -534,5 +534,3 @@ ENTRY(cpu_gdt_table)
        .quad 0x0000000000000000        /* 0xf0 - unused */
        .quad 0x0000000000000000        /* 0xf8 - GDT entry 31: double-fault TSS */
-        /* Be sure this is zeroed to avoid false validations in Xen */
-        .fill PAGE_SIZE_asm / 8 - GDT_ENTRIES,8,0
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index 3999bec50c33..055325056a74 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -3,8 +3,6 @@
 #include <asm/checksum.h>
 #include <asm/desc.h>
-EXPORT_SYMBOL_GPL(cpu_gdt_descr);
 EXPORT_SYMBOL(__down_failed);
 EXPORT_SYMBOL(__down_failed_interruptible);
 EXPORT_SYMBOL(__down_failed_trylock);
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index f2dd218d88cb..235822b3f41b 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -2566,8 +2566,10 @@ int __init io_apic_get_unique_id (int ioapic, int apic_id)
                spin_unlock_irqrestore(&ioapic_lock, flags);
                /* Sanity check */
-                if (reg_00.bits.ID != apic_id)
+                if (reg_00.bits.ID != apic_id) {
-                        panic("IOAPIC[%d]: Unable change apic_id!\n", ioapic);
+                        printk("IOAPIC[%d]: Unable to change apic_id!\n", ioapic);
+                        return -1;
+                }
        }
        apic_printk(APIC_VERBOSE, KERN_INFO
diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index 6483eeb1a4e8..694a13997637 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -58,6 +58,11 @@ static inline int is_IF_modifier(kprobe_opcode_t opcode)
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 {
+        /* insn: must be on special executable page on i386. */
+        p->ainsn.insn = get_insn_slot();
+        if (!p->ainsn.insn)
+                return -ENOMEM;
        memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
        p->opcode = *p->addr;
        return 0;
@@ -77,6 +82,13 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
                           (unsigned long) p->addr + sizeof(kprobe_opcode_t));
 }
+void __kprobes arch_remove_kprobe(struct kprobe *p)
+{
+        down(&kprobe_mutex);
+        free_insn_slot(p->ainsn.insn);
+        up(&kprobe_mutex);
+}
 static inline void save_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
        kcb->prev_kprobe.kp = kprobe_running();
@@ -111,7 +123,7 @@ static inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
        if (p->opcode == BREAKPOINT_INSTRUCTION)
                regs->eip = (unsigned long)p->addr;
        else
-                regs->eip = (unsigned long)&p->ainsn.insn;
+                regs->eip = (unsigned long)p->ainsn.insn;
 }
 /* Called with kretprobe_lock held */
@@ -351,7 +363,7 @@ static void __kprobes resume_execution(struct kprobe *p,
 {
        unsigned long *tos = (unsigned long *)&regs->esp;
        unsigned long next_eip = 0;
-        unsigned long copy_eip = (unsigned long)&p->ainsn.insn;
+        unsigned long copy_eip = (unsigned long)p->ainsn.insn;
        unsigned long orig_eip = (unsigned long)p->addr;
        switch (p->ainsn.insn[0]) {
diff --git a/arch/i386/kernel/mpparse.c b/arch/i386/kernel/mpparse.c
index e7609abf3796..e6e2f43db85e 100644
--- a/arch/i386/kernel/mpparse.c
+++ b/arch/i386/kernel/mpparse.c
@@ -915,6 +915,7 @@ void __init mp_register_ioapic (
        u32                     gsi_base)
 {
        int                     idx = 0;
+        int                     tmpid;
        if (nr_ioapics >= MAX_IO_APICS) {
                printk(KERN_ERR "ERROR: Max # of I/O APICs (%d) exceeded "
@@ -935,9 +936,14 @@ void __init mp_register_ioapic (
        set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
        if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) && (boot_cpu_data.x86 < 15))
-                mp_ioapics[idx].mpc_apicid = io_apic_get_unique_id(idx, id);
+                tmpid = io_apic_get_unique_id(idx, id);
        else
-                mp_ioapics[idx].mpc_apicid = id;
+                tmpid = id;
+        if (tmpid == -1) {
+                nr_ioapics--;
+                return;
+        }
+        mp_ioapics[idx].mpc_apicid = tmpid;
        mp_ioapics[idx].mpc_apicver = io_apic_get_version(idx);
        
        /* 
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index fb00ab7b7612..eba7f53f8b4a 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -898,12 +898,6 @@ static int __devinit do_boot_cpu(int apicid, int cpu)
        unsigned long start_eip;
        unsigned short nmi_high = 0, nmi_low = 0;
-        if (!cpu_gdt_descr[cpu].address &&
-            !(cpu_gdt_descr[cpu].address = get_zeroed_page(GFP_KERNEL))) {
-                printk("Failed to allocate GDT for CPU %d\n", cpu);
-                return 1;
-        }
        ++cpucount;
        /*
diff --git a/arch/i386/mach-default/topology.c b/arch/i386/kernel/topology.c
index b64314069e78..67a0e1baa28b 100644
--- a/arch/i386/mach-default/topology.c
+++ b/arch/i386/kernel/topology.c
@@ -1,12 +1,12 @@
 /*
- * arch/i386/mach-generic/topology.c - Populate driverfs with topology information
+ * arch/i386/kernel/topology.c - Populate driverfs with topology information
 *
 * Written by: Matthew Dobson, IBM Corporation
 * Original Code: Paul Dorwin, IBM Corporation, Patrick Mochel, OSDL
 *
 * Copyright (C) 2002, IBM Corp.
 *
- * All rights reserved.          
+ * All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -34,7 +34,7 @@ static struct i386_cpu cpu_devices[NR_CPUS];
 int arch_register_cpu(int num){
        struct node *parent = NULL;
-        
 #ifdef CONFIG_NUMA
        int node = cpu_to_node(num);
        if (node_online(node))
diff --git a/arch/i386/mach-default/Makefile b/arch/i386/mach-default/Makefile
index e95bb0237921..012fe34459e6 100644
--- a/arch/i386/mach-default/Makefile
+++ b/arch/i386/mach-default/Makefile
@@ -2,4 +2,4 @@
 # Makefile for the linux kernel.
 #
-obj-y                           := setup.o topology.o
+obj-y                           := setup.o
diff --git a/arch/i386/mach-voyager/voyager_basic.c b/arch/i386/mach-voyager/voyager_basic.c
index aa49a33a572c..b584060ec004 100644
--- a/arch/i386/mach-voyager/voyager_basic.c
+++ b/arch/i386/mach-voyager/voyager_basic.c
@@ -23,6 +23,8 @@
 #include <linux/delay.h>
 #include <linux/reboot.h>
 #include <linux/sysrq.h>
+#include <linux/smp.h>
+#include <linux/nodemask.h>
 #include <asm/io.h>
 #include <asm/voyager.h>
 #include <asm/vic.h>
@@ -328,4 +330,3 @@ void machine_power_off(void)
        if (pm_power_off)
                pm_power_off();
 }
diff --git a/arch/i386/mach-voyager/voyager_smp.c b/arch/i386/mach-voyager/voyager_smp.c
index 6e4c3baef6cc..8165626a5c30 100644
--- a/arch/i386/mach-voyager/voyager_smp.c
+++ b/arch/i386/mach-voyager/voyager_smp.c
@@ -402,6 +402,7 @@ find_smp_config(void)
        cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 1) << 8;
        cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 2) << 16;
        cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 3) << 24;
+        cpu_possible_map = phys_cpu_present_map;
        printk("VOYAGER SMP: phys_cpu_present_map = 0x%lx\n", cpus_addr(phys_cpu_present_map)[0]);
        /* Here we set up the VIC to enable SMP */
        /* enable the CPIs by writing the base vector to their register */
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 845cd0902a50..a85ea9d37f05 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -453,6 +453,7 @@ source "arch/ia64/oprofile/Kconfig"
 config KPROBES
        bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
        help
          Kprobes allows you to trap at almost any kernel address and
          execute a callback function.  register_kprobe() establishes
diff --git a/arch/m32r/Makefile b/arch/m32r/Makefile
index 983d438b14b6..4b3c90ba926c 100644
--- a/arch/m32r/Makefile
+++ b/arch/m32r/Makefile
@@ -12,14 +12,14 @@ CFLAGS_MODULE += -mmodel=large
 ifdef CONFIG_CHIP_VDEC2
 cflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -Wa,-bitinst
-aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -Wa,-bitinst
+aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -O2 -Wa,-bitinst -Wa,-no-parallel
 else
 cflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2
-aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2
+aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2 -O2
 endif
 cflags-$(CONFIG_ISA_M32R)       += -DNO_FPU
-aflags-$(CONFIG_ISA_M32R)       += -DNO_FPU -Wa,-no-bitinst
+aflags-$(CONFIG_ISA_M32R)       += -DNO_FPU -O2 -Wa,-no-bitinst
 CFLAGS += $(cflags-y)
 AFLAGS += $(aflags-y)
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index 71763f7a1d19..cb33097fefc4 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -36,7 +36,7 @@ int do_signal(struct pt_regs *, sigset_t *);
 asmlinkage int
 sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
                  unsigned long r2, unsigned long r3, unsigned long r4,
-                  unsigned long r5, unsigned long r6, struct pt_regs regs)
+                  unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
        sigset_t saveset, newset;
@@ -54,21 +54,21 @@ sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        regs.r0 = -EINTR;
+        regs->r0 = -EINTR;
        while (1) {
                current->state = TASK_INTERRUPTIBLE;
                schedule();
-                if (do_signal(&regs, &saveset))
+                if (do_signal(regs, &saveset))
-                        return regs.r0;
+                        return regs->r0;
        }
 }
 asmlinkage int
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                unsigned long r2, unsigned long r3, unsigned long r4,
-                unsigned long r5, unsigned long r6, struct pt_regs regs)
+                unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
-        return do_sigaltstack(uss, uoss, regs.spu);
+        return do_sigaltstack(uss, uoss, regs->spu);
 }
@@ -140,11 +140,10 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
 asmlinkage int
 sys_rt_sigreturn(unsigned long r0, unsigned long r1,
                 unsigned long r2, unsigned long r3, unsigned long r4,
-                 unsigned long r5, unsigned long r6, struct pt_regs regs)
+                 unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
-        struct rt_sigframe __user *frame = (struct rt_sigframe __user *)regs.spu;
+        struct rt_sigframe __user *frame = (struct rt_sigframe __user *)regs->spu;
        sigset_t set;
-        stack_t st;
        int result;
        if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -158,14 +157,11 @@ sys_rt_sigreturn(unsigned long r0, unsigned long r1,
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        if (restore_sigcontext(&regs, &frame->uc.uc_mcontext, &result))
+        if (restore_sigcontext(regs, &frame->uc.uc_mcontext, &result))
                goto badframe;
-        if (__copy_from_user(&st, &frame->uc.uc_stack, sizeof(st)))
+        if (do_sigaltstack(&frame->uc.uc_stack, NULL, regs->spu) == -EFAULT)
                goto badframe;
-        /* It is more difficult to avoid calling this function than to
-           call it and ignore errors.  */
-        do_sigaltstack(&st, NULL, regs.spu);
        return result;
diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
index ce16bbe26a52..2d1dd2106c4d 100644
--- a/arch/m32r/lib/usercopy.c
+++ b/arch/m32r/lib/usercopy.c
@@ -64,7 +64,7 @@ do {									\
                "       .balign 4\n"                                    \
                "       .long 0b,3b\n"                                  \
                ".previous"                                             \
-                : "=r"(res), "=r"(count), "=&r" (__d0), "=&r" (__d1),   \
+                : "=&r"(res), "=&r"(count), "=&r" (__d0), "=&r" (__d1), \
                  "=&r" (__d2)                                          \
                : "i"(-EFAULT), "0"(count), "1"(count), "3"(src),       \
                  "4"(dst)                                              \
@@ -101,7 +101,7 @@ do {									\
                "       .balign 4\n"                                    \
                "       .long 0b,3b\n"                                  \
                ".previous"                                             \
-                : "=r"(res), "=r"(count), "=&r" (__d0), "=&r" (__d1),   \
+                : "=&r"(res), "=&r"(count), "=&r" (__d0), "=&r" (__d1), \
                  "=&r" (__d2)                                          \
                : "i"(-EFAULT), "0"(count), "1"(count), "3"(src),       \
                  "4"(dst)                                              \
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index d83e033dbc87..2f2dc54b2e26 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -626,7 +626,7 @@ einval:	li	v0, -EINVAL
        sys     sys_fstatat64           4
        sys     sys_unlinkat            3
        sys     sys_renameat            4       /* 4295 */
-        sys     sys_linkat              4
+        sys     sys_linkat              5
        sys     sys_symlinkat           3
        sys     sys_readlinkat          4
        sys     sys_fchmodat            3
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 80d114a3a837..a834f9e0bbb3 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -963,7 +963,7 @@ source "arch/powerpc/oprofile/Kconfig"
 config KPROBES
        bool "Kprobes (EXPERIMENTAL)"
-        depends on PPC64
+        depends on PPC64 && EXPERIMENTAL && MODULES
        help
          Kprobes allows you to trap at almost any kernel address and
          execute a callback function.  register_kprobe() establishes
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index d6fed3f56580..2c3fd2007676 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
+# Linux kernel version: 2.6.16-rc2
-# Tue Dec 20 15:59:30 2005
+# Fri Feb 10 17:33:08 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+# CONFIG_PPC_UDBG_16550 is not set
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 #
 # Processor support
@@ -26,13 +30,12 @@ CONFIG_PPC_FPU=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=2
+CONFIG_NR_CPUS=4
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
@@ -47,8 +50,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 #
 # Loadable module support
@@ -112,13 +117,12 @@ CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
 # CONFIG_PPC_RTAS is not set
 # CONFIG_MMIO_NVRAM is not set
+CONFIG_MPIC_BROKEN_U3=y
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -151,6 +155,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -202,6 +207,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -239,6 +245,7 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_XTABLES is not set
 #
 # IP: Netfilter Configuration
@@ -255,65 +262,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -324,6 +272,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -342,7 +295,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 #
 # Network testing
@@ -545,13 +497,7 @@ CONFIG_SCSI_SATA_SVW=y
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
+# CONFIG_SCSI_QLA_FC is not set
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -614,7 +560,6 @@ CONFIG_IEEE1394_SBP2=m
 CONFIG_IEEE1394_ETH1394=m
 CONFIG_IEEE1394_DV1394=m
 CONFIG_IEEE1394_RAWIO=y
-# CONFIG_IEEE1394_CMP is not set
 #
 # I2O device support
@@ -630,6 +575,7 @@ CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
 #
 # Network device support
@@ -682,8 +628,9 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
-CONFIG_TIGON3=m
+CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
 # CONFIG_MV643XX_ETH is not set
@@ -861,8 +808,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
-CONFIG_I2C_KEYWEST=y
+CONFIG_I2C_POWERMAC=y
-CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -895,6 +841,12 @@ CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -961,7 +913,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
@@ -1008,9 +959,10 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 #
 # Generic devices
@@ -1024,6 +976,8 @@ CONFIG_SND_GENERIC_DRIVER=y
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1032,39 +986,38 @@ CONFIG_SND_GENERIC_DRIVER=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_ALS4000 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 #
 # ALSA PowerMac devices
@@ -1136,13 +1089,16 @@ CONFIG_USB_STORAGE_DPCM=y
 CONFIG_USB_STORAGE_SDDR09=y
 CONFIG_USB_STORAGE_SDDR55=y
 CONFIG_USB_STORAGE_JUMPSHOT=y
+# CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_LIBUSUAL is not set
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 CONFIG_HID_FF=y
 CONFIG_HID_PID=y
 CONFIG_LOGITECH_FF=y
@@ -1159,6 +1115,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
@@ -1207,6 +1164,7 @@ CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
 # CONFIG_USB_SERIAL_ANYDATA is not set
 CONFIG_USB_SERIAL_BELKIN=m
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
 CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
 # CONFIG_USB_SERIAL_CP2101 is not set
 CONFIG_USB_SERIAL_CYPRESS_M8=m
@@ -1288,6 +1246,10 @@ CONFIG_USB_EZUSB=y
 #
 #
+# EDAC - error detection and reporting (RAS)
+#
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1317,6 +1279,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1357,6 +1320,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 #
 # Miscellaneous filesystems
@@ -1426,6 +1390,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 #
@@ -1481,10 +1446,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 #
 # Instrumentation Support
@@ -1497,24 +1458,31 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUGGER is not set
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 #
 # Security options
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 6f6c6bed1aa5..0362a70aa97c 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
+# Linux kernel version: 2.6.16-rc2
-# Tue Dec 20 15:59:38 2005
+# Fri Feb 10 17:32:14 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=32
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
@@ -48,8 +51,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
@@ -59,8 +60,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -69,8 +72,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 CONFIG_PPC_MAPLE=y
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_XICS=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
@@ -124,8 +128,8 @@ CONFIG_RTAS_FLASH=m
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_MPIC_BROKEN_U3=y
 CONFIG_IBMVIO=y
+# CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -158,6 +162,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_PPC_SPLPAR=y
 CONFIG_EEH=y
@@ -178,6 +183,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
@@ -221,6 +227,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -260,6 +267,7 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+# CONFIG_NETFILTER_XTABLES is not set
 #
 # IP: Netfilter Configuration
@@ -277,65 +285,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-CONFIG_IP_NF_MATCH_DCCP=m
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -346,6 +295,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -364,7 +318,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 #
 # Network testing
@@ -572,13 +525,7 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
+# CONFIG_SCSI_QLA_FC is not set
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-CONFIG_SCSI_QLA6312=m
-CONFIG_SCSI_QLA24XX=m
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -642,8 +589,6 @@ CONFIG_IEEE1394_SBP2=m
 CONFIG_IEEE1394_ETH1394=m
 CONFIG_IEEE1394_DV1394=m
 CONFIG_IEEE1394_RAWIO=y
-CONFIG_IEEE1394_CMP=m
-CONFIG_IEEE1394_AMDTP=m
 #
 # I2O device support
@@ -659,6 +604,7 @@ CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
 #
 # Network device support
@@ -731,6 +677,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -853,6 +800,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 #
@@ -880,6 +828,7 @@ CONFIG_HVCS=m
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
 CONFIG_GEN_RTC=y
+# CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -923,8 +872,7 @@ CONFIG_I2C_AMD8111=y
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
-CONFIG_I2C_KEYWEST=y
+CONFIG_I2C_POWERMAC=y
-CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -957,6 +905,12 @@ CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -1028,7 +982,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
@@ -1073,9 +1026,10 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 #
 # Generic devices
@@ -1089,6 +1043,8 @@ CONFIG_SND_GENERIC_DRIVER=y
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1097,39 +1053,38 @@ CONFIG_SND_GENERIC_DRIVER=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_ALS4000 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 #
 # ALSA PowerMac devices
@@ -1201,13 +1156,16 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_LIBUSUAL is not set
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1221,6 +1179,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
@@ -1307,6 +1266,10 @@ CONFIG_INFINIBAND_IPOIB=m
 #
 #
+# EDAC - error detection and reporting (RAS)
+#
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1340,6 +1303,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1379,6 +1343,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 #
 # Miscellaneous filesystems
@@ -1449,6 +1414,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 #
@@ -1504,10 +1470,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 #
 # Instrumentation Support
@@ -1520,18 +1482,20 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1540,6 +1504,11 @@ CONFIG_XMON=y
 # CONFIG_XMON_DEFAULT is not set
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 #
 # Security options
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index aa9893a1f6e8..daaf038a1faa 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
+# Linux kernel version: 2.6.16-rc2
-# Tue Dec 20 15:59:40 2005
+# Fri Feb 10 17:33:32 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=128
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
@@ -49,8 +52,6 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
@@ -60,8 +61,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -70,8 +73,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_PSERIES=y
 # CONFIG_PPC_PMAC is not set
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_XICS=y
 # CONFIG_U3_DART is not set
 CONFIG_MPIC=y
@@ -123,8 +127,8 @@ CONFIG_RTAS_PROC=y
 CONFIG_RTAS_FLASH=m
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_IBMVIO=y
+# CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
@@ -145,6 +149,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_PPC_SPLPAR=y
 CONFIG_EEH=y
@@ -165,6 +170,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
@@ -209,6 +215,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -248,6 +255,7 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+# CONFIG_NETFILTER_XTABLES is not set
 #
 # IP: Netfilter Configuration
@@ -265,65 +273,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -334,6 +283,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -352,7 +306,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 #
 # Network testing
@@ -550,13 +503,7 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
+# CONFIG_SCSI_QLA_FC is not set
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-CONFIG_SCSI_QLA6312=m
-CONFIG_SCSI_QLA24XX=m
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -678,6 +625,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -803,6 +751,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 #
@@ -909,6 +858,12 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -976,7 +931,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
@@ -1061,12 +1015,15 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1080,6 +1037,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
@@ -1167,6 +1125,10 @@ CONFIG_INFINIBAND_IPOIB=m
 #
 #
+# EDAC - error detection and reporting (RAS)
+#
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1200,6 +1162,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1240,6 +1203,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 #
 # Miscellaneous filesystems
@@ -1351,10 +1315,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 #
 # Instrumentation Support
@@ -1367,18 +1327,20 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1387,6 +1349,11 @@ CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_IRQSTACKS=y
 # CONFIG_BOOTX_TEXT is not set
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 #
 # Security options
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 8c21d378f5d2..778f22fd85d2 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -134,8 +134,10 @@ static void crash_kexec_prepare_cpus(void)
         * the crash CPU will send an IPI and wait for other CPUs to
         * respond. If not, proceed the kexec boot even though we failed to
         * capture other CPU states.
+         * Delay of at least 10 seconds.
         */
-        msecs = 1000000;
+        printk(KERN_ALERT "Sending IPI to other cpus...\n");
+        msecs = 10000;
        while ((atomic_read(&waiting_for_crash_ipi) > 0) && (--msecs > 0)) {
                barrier();
                mdelay(1);
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index 03b25f9359f8..a0579e859b21 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -714,6 +714,7 @@ AltiVecUnavailable:
 #ifdef CONFIG_ALTIVEC
        bne     load_up_altivec         /* if from user, just load it up */
 #endif /* CONFIG_ALTIVEC */
+        addi    r3,r1,STACK_FRAME_OVERHEAD
        EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 PerformanceMonitor:
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 2b03a09fe5e9..11f2cd5af7dc 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -139,7 +139,7 @@ _GLOBAL(__secondary_hold)
        ori     r24,r24,MSR_RI
        mtmsrd  r24                     /* RI on */
-        /* Grab our linux cpu number */
+        /* Grab our physical cpu number */
        mr      r24,r3
        /* Tell the master cpu we're here */
@@ -153,11 +153,7 @@ _GLOBAL(__secondary_hold)
        cmpdi   0,r4,1
        bne     100b
-#ifdef CONFIG_HMT
+#if defined(CONFIG_SMP) || defined(CONFIG_KEXEC)
-        SET_REG_IMMEDIATE(r4, .hmt_init)
-        mtctr   r4
-        bctr
-#elif defined(CONFIG_SMP) || defined(CONFIG_KEXEC)
        LOAD_REG_IMMEDIATE(r4, .pSeries_secondary_smp_init)
        mtctr   r4
        mr      r3,r24
@@ -319,7 +315,6 @@ exception_marker:
 label##_pSeries:                                        \
        HMT_MEDIUM;                                     \
        mtspr   SPRN_SPRG1,r13;         /* save r13 */  \
-        RUNLATCH_ON(r13);                               \
        EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, label##_common)
 #define STD_EXCEPTION_ISERIES(n, label, area)           \
@@ -327,7 +322,6 @@ label##_pSeries:					\
 label##_iSeries:                                        \
        HMT_MEDIUM;                                     \
        mtspr   SPRN_SPRG1,r13;         /* save r13 */  \
-        RUNLATCH_ON(r13);                               \
        EXCEPTION_PROLOG_ISERIES_1(area);               \
        EXCEPTION_PROLOG_ISERIES_2;                     \
        b       label##_common
@@ -337,7 +331,6 @@ label##_iSeries:					\
 label##_iSeries:                                                        \
        HMT_MEDIUM;                                                     \
        mtspr   SPRN_SPRG1,r13;         /* save r13 */                  \
-        RUNLATCH_ON(r13);                                               \
        EXCEPTION_PROLOG_ISERIES_1(PACA_EXGEN);                         \
        lbz     r10,PACAPROCENABLED(r13);                               \
        cmpwi   0,r10,0;                                                \
@@ -390,6 +383,7 @@ label##_common:						\
 label##_common:                                         \
        EXCEPTION_PROLOG_COMMON(trap, PACA_EXGEN);      \
        DISABLE_INTS;                                   \
+        bl      .ppc64_runlatch_on;                     \
        addi    r3,r1,STACK_FRAME_OVERHEAD;             \
        bl      hdlr;                                   \
        b       .ret_from_except_lite
@@ -407,7 +401,6 @@ __start_interrupts:
 _machine_check_pSeries:
        HMT_MEDIUM
        mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
        EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
        . = 0x300
@@ -434,7 +427,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
 data_access_slb_pSeries:
        HMT_MEDIUM
        mtspr   SPRN_SPRG1,r13
-        RUNLATCH_ON(r13)
        mfspr   r13,SPRN_SPRG3          /* get paca address into r13 */
        std     r3,PACA_EXSLB+EX_R3(r13)
        mfspr   r3,SPRN_DAR
@@ -460,7 +452,6 @@ data_access_slb_pSeries:
 instruction_access_slb_pSeries:
        HMT_MEDIUM
        mtspr   SPRN_SPRG1,r13
-        RUNLATCH_ON(r13)
        mfspr   r13,SPRN_SPRG3          /* get paca address into r13 */
        std     r3,PACA_EXSLB+EX_R3(r13)
        mfspr   r3,SPRN_SRR0            /* SRR0 is faulting address */
@@ -491,7 +482,6 @@ instruction_access_slb_pSeries:
        .globl  system_call_pSeries
 system_call_pSeries:
        HMT_MEDIUM
-        RUNLATCH_ON(r9)
        mr      r9,r13
        mfmsr   r10
        mfspr   r13,SPRN_SPRG3
@@ -575,7 +565,6 @@ slb_miss_user_pseries:
 system_reset_fwnmi:
        HMT_MEDIUM
        mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
        EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common)
        .globl machine_check_fwnmi
@@ -583,7 +572,6 @@ system_reset_fwnmi:
 machine_check_fwnmi:
        HMT_MEDIUM
        mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
        EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
 #ifdef CONFIG_PPC_ISERIES
@@ -894,7 +882,6 @@ unrecov_fer:
        .align  7
        .globl data_access_common
 data_access_common:
-        RUNLATCH_ON(r10)                /* It wont fit in the 0x300 handler */
        mfspr   r10,SPRN_DAR
        std     r10,PACA_EXGEN+EX_DAR(r13)
        mfspr   r10,SPRN_DSISR
@@ -1042,6 +1029,7 @@ hardware_interrupt_common:
        EXCEPTION_PROLOG_COMMON(0x500, PACA_EXGEN)
 hardware_interrupt_entry:
        DISABLE_INTS
+        bl      .ppc64_runlatch_on
        addi    r3,r1,STACK_FRAME_OVERHEAD
        bl      .do_IRQ
        b       .ret_from_except_lite
@@ -1816,22 +1804,6 @@ _STATIC(start_here_multiplatform)
        ori     r6,r6,MSR_RI
        mtmsrd  r6                      /* RI on */
-#ifdef CONFIG_HMT
-        /* Start up the second thread on cpu 0 */
-        mfspr   r3,SPRN_PVR
-        srwi    r3,r3,16
-        cmpwi   r3,0x34                 /* Pulsar  */
-        beq     90f
-        cmpwi   r3,0x36                 /* Icestar */
-        beq     90f
-        cmpwi   r3,0x37                 /* SStar   */
-        beq     90f
-        b       91f                     /* HMT not supported */
-90:     li      r3,0
-        bl      .hmt_start_secondary
-91:
-#endif
        /* The following gets the stack and TOC set up with the regs */
        /* pointing to the real addr of the kernel stack.  This is   */
        /* all done to support the C function call below which sets  */
@@ -1945,77 +1917,8 @@ _STATIC(start_here_common)
        bl .start_kernel
-_GLOBAL(hmt_init)
+        /* Not reached */
-#ifdef CONFIG_HMT
+        BUG_OPCODE
-        LOAD_REG_IMMEDIATE(r5, hmt_thread_data)
-        mfspr   r7,SPRN_PVR
-        srwi    r7,r7,16
-        cmpwi   r7,0x34                 /* Pulsar  */
-        beq     90f
-        cmpwi   r7,0x36                 /* Icestar */
-        beq     91f
-        cmpwi   r7,0x37                 /* SStar   */
-        beq     91f
-        b       101f
-90:     mfspr   r6,SPRN_PIR
-        andi.   r6,r6,0x1f
-        b       92f
-91:     mfspr   r6,SPRN_PIR
-        andi.   r6,r6,0x3ff
-92:     sldi    r4,r24,3
-        stwx    r6,r5,r4
-        bl      .hmt_start_secondary
-        b       101f
-__hmt_secondary_hold:
-        LOAD_REG_IMMEDIATE(r5, hmt_thread_data)
-        clrldi  r5,r5,4
-        li      r7,0
-        mfspr   r6,SPRN_PIR
-        mfspr   r8,SPRN_PVR
-        srwi    r8,r8,16
-        cmpwi   r8,0x34
-        bne     93f
-        andi.   r6,r6,0x1f
-        b       103f
-93:     andi.   r6,r6,0x3f
-103:    lwzx    r8,r5,r7
-        cmpw    r8,r6
-        beq     104f
-        addi    r7,r7,8
-        b       103b
-104:    addi    r7,r7,4
-        lwzx    r9,r5,r7
-        mr      r24,r9
-101:
-#endif
-        mr      r3,r24
-        b       .pSeries_secondary_smp_init
-#ifdef CONFIG_HMT
-_GLOBAL(hmt_start_secondary)
-        LOAD_REG_IMMEDIATE(r4,__hmt_secondary_hold)
-        clrldi  r4,r4,4
-        mtspr   SPRN_NIADORM, r4
-        mfspr   r4, SPRN_MSRDORM
-        li      r5, -65
-        and     r4, r4, r5
-        mtspr   SPRN_MSRDORM, r4
-        lis     r4,0xffef
-        ori     r4,r4,0x7403
-        mtspr   SPRN_TSC, r4
-        li      r4,0x1f4
-        mtspr   SPRN_TST, r4
-        mfspr   r4, SPRN_HID0
-        ori     r4, r4, 0x1
-        mtspr   SPRN_HID0, r4
-        mfspr   r4, SPRN_CTRLF
-        oris    r4, r4, 0x40
-        mtspr   SPRN_CTRLT, r4
-        blr
-#endif
 /*
 * We put a few things here that have to be page-aligned.
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index d6431440c54f..ee166c586642 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -26,8 +26,6 @@
 #include <asm/prom.h>
 #include <asm/smp.h>
-#define HASH_GROUP_SIZE 0x80    /* size of each hash group, asm/mmu.h */
 int default_machine_kexec_prepare(struct kimage *image)
 {
        int i;
@@ -61,7 +59,7 @@ int default_machine_kexec_prepare(struct kimage *image)
         */
        if (htab_address) {
                low = __pa(htab_address);
-                high = low + (htab_hash_mask + 1) * HASH_GROUP_SIZE;
+                high = low + htab_size_bytes;
                for (i = 0; i < image->nr_segments; i++) {
                        begin = image->segment[i].mem;
@@ -294,7 +292,7 @@ void default_machine_kexec(struct kimage *image)
 }
 /* Values we need to export to the second kernel via the device tree. */
-static unsigned long htab_base, htab_size, kernel_end;
+static unsigned long htab_base, kernel_end;
 static struct property htab_base_prop = {
        .name = "linux,htab-base",
@@ -305,7 +303,7 @@ static struct property htab_base_prop = {
 static struct property htab_size_prop = {
        .name = "linux,htab-size",
        .length = sizeof(unsigned long),
-        .value = (unsigned char *)&htab_size,
+        .value = (unsigned char *)&htab_size_bytes,
 };
 static struct property kernel_end_prop = {
@@ -331,8 +329,6 @@ static void __init export_htab_values(void)
        htab_base = __pa(htab_address);
        prom_add_property(node, &htab_base_prop);
-        htab_size = 1UL << ppc64_pft_size;
        prom_add_property(node, &htab_size_prop);
 out:
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 57703994a063..c225cf154bfe 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -888,3 +888,35 @@ void dump_stack(void)
        show_stack(current, NULL);
 }
 EXPORT_SYMBOL(dump_stack);
+#ifdef CONFIG_PPC64
+void ppc64_runlatch_on(void)
+{
+        unsigned long ctrl;
+        if (cpu_has_feature(CPU_FTR_CTRL) && !test_thread_flag(TIF_RUNLATCH)) {
+                HMT_medium();
+                ctrl = mfspr(SPRN_CTRLF);
+                ctrl |= CTRL_RUNLATCH;
+                mtspr(SPRN_CTRLT, ctrl);
+                set_thread_flag(TIF_RUNLATCH);
+        }
+}
+void ppc64_runlatch_off(void)
+{
+        unsigned long ctrl;
+        if (cpu_has_feature(CPU_FTR_CTRL) && test_thread_flag(TIF_RUNLATCH)) {
+                HMT_medium();
+                clear_thread_flag(TIF_RUNLATCH);
+                ctrl = mfspr(SPRN_CTRLF);
+                ctrl &= ~CTRL_RUNLATCH;
+                mtspr(SPRN_CTRLT, ctrl);
+        }
+}
+#endif
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 294832a7e0a6..6dbd21726770 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -816,8 +816,6 @@ void __init unflatten_device_tree(void)
 {
        unsigned long start, mem, size;
        struct device_node **allnextp = &allnodes;
-        char *p = NULL;
-        int l = 0;
        DBG(" -> unflatten_device_tree()\n");
@@ -857,19 +855,6 @@ void __init unflatten_device_tree(void)
        if (of_chosen == NULL)
                of_chosen = of_find_node_by_path("/chosen@0");
-        /* Retreive command line */
-        if (of_chosen != NULL) {
-                p = (char *)get_property(of_chosen, "bootargs", &l);
-                if (p != NULL && l > 0)
-                        strlcpy(cmd_line, p, min(l, COMMAND_LINE_SIZE));
-        }
-#ifdef CONFIG_CMDLINE
-        if (l == 0 || (l == 1 && (*p) == 0))
-                strlcpy(cmd_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE);
-#endif /* CONFIG_CMDLINE */
-        DBG("Command line is: %s\n", cmd_line);
        DBG(" <- unflatten_device_tree()\n");
 }
@@ -940,6 +925,8 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
 {
        u32 *prop;
        unsigned long *lprop;
+        unsigned long l;
+        char *p;
        DBG("search \"chosen\", depth: %d, uname: %s\n", depth, uname);
@@ -1004,6 +991,41 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
               crashk_res.end = crashk_res.start + *lprop - 1;
 #endif
+        /* Retreive command line */
+        p = of_get_flat_dt_prop(node, "bootargs", &l);
+        if (p != NULL && l > 0)
+                strlcpy(cmd_line, p, min((int)l, COMMAND_LINE_SIZE));
+#ifdef CONFIG_CMDLINE
+        if (l == 0 || (l == 1 && (*p) == 0))
+                strlcpy(cmd_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE);
+#endif /* CONFIG_CMDLINE */
+        DBG("Command line is: %s\n", cmd_line);
+        if (strstr(cmd_line, "mem=")) {
+                char *p, *q;
+                unsigned long maxmem = 0;
+                for (q = cmd_line; (p = strstr(q, "mem=")) != 0; ) {
+                        q = p + 4;
+                        if (p > cmd_line && p[-1] != ' ')
+                                continue;
+                        maxmem = simple_strtoul(q, &q, 0);
+                        if (*q == 'k' || *q == 'K') {
+                                maxmem <<= 10;
+                                ++q;
+                        } else if (*q == 'm' || *q == 'M') {
+                                maxmem <<= 20;
+                                ++q;
+                        } else if (*q == 'g' || *q == 'G') {
+                                maxmem <<= 30;
+                                ++q;
+                        }
+                }
+                memory_limit = maxmem;
+        }
        /* break now */
        return 1;
 }
@@ -1124,7 +1146,7 @@ static void __init early_reserve_mem(void)
                        size_32 = *(reserve_map_32++);
                        if (size_32 == 0)
                                break;
-                        DBG("reserving: %lx -> %lx\n", base_32, size_32);
+                        DBG("reserving: %x -> %x\n", base_32, size_32);
                        lmb_reserve(base_32, size_32);
                }
                return;
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index ec7153f4d47c..d34fe537400e 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -205,14 +205,6 @@ static cell_t __initdata regbuf[1024];
 #define MAX_CPU_THREADS 2
-/* TO GO */
-#ifdef CONFIG_HMT
-struct {
-        unsigned int pir;
-        unsigned int threadid;
-} hmt_thread_data[NR_CPUS];
-#endif /* CONFIG_HMT */
 /*
 * Error results ... some OF calls will return "-1" on error, some
 * will return 0, some will return either. To simplify, here are
@@ -1319,10 +1311,6 @@ static void __init prom_hold_cpus(void)
         */
        *spinloop = 0;
-#ifdef CONFIG_HMT
-        for (i = 0; i < NR_CPUS; i++)
-                RELOC(hmt_thread_data)[i].pir = 0xdeadbeef;
-#endif
        /* look for cpus */
        for (node = 0; prom_next_node(&node); ) {
                type[0] = 0;
@@ -1389,32 +1377,6 @@ static void __init prom_hold_cpus(void)
                /* Reserve cpu #s for secondary threads.   They start later. */
                cpuid += cpu_threads;
        }
-#ifdef CONFIG_HMT
-        /* Only enable HMT on processors that provide support. */
-        if (__is_processor(PV_PULSAR) || 
-            __is_processor(PV_ICESTAR) ||
-            __is_processor(PV_SSTAR)) {
-                prom_printf("    starting secondary threads\n");
-                for (i = 0; i < NR_CPUS; i += 2) {
-                        if (!cpu_online(i))
-                                continue;
-                        if (i == 0) {
-                                unsigned long pir = mfspr(SPRN_PIR);
-                                if (__is_processor(PV_PULSAR)) {
-                                        RELOC(hmt_thread_data)[i].pir = 
-                                                pir & 0x1f;
-                                } else {
-                                        RELOC(hmt_thread_data)[i].pir = 
-                                                pir & 0x3ff;
-                                }
-                        }
-                }
-        } else {
-                prom_printf("Processor is not HMT capable\n");
-        }
-#endif
        if (cpuid > NR_CPUS)
                prom_printf("WARNING: maximum CPUs (" __stringify(NR_CPUS)
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index d96bcfe4c6f6..33654d1b1b43 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -403,12 +403,17 @@ static void native_hpte_clear(void)
                 */
                hpte_v = hptep->v;
+                /*
+                 * Call __tlbie() here rather than tlbie() since we
+                 * already hold the native_tlbie_lock.
+                 */
                if (hpte_v & HPTE_V_VALID) {
                        hptep->v = 0;
-                        tlbie(slot2va(hpte_v, slot), MMU_PAGE_4K, 0);
+                        __tlbie(slot2va(hpte_v, slot), MMU_PAGE_4K);
                }
        }
+        asm volatile("eieio; tlbsync; ptesync":::"memory");
        spin_unlock(&native_tlbie_lock);
        local_irq_restore(flags);
 }
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 149351a84b94..b1f614c612dd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -88,6 +88,7 @@ static unsigned long _SDR1;
 struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
 hpte_t *htab_address;
+unsigned long htab_size_bytes;
 unsigned long htab_hash_mask;
 int mmu_linear_psize = MMU_PAGE_4K;
 int mmu_virtual_psize = MMU_PAGE_4K;
@@ -399,7 +400,7 @@ void create_section_mapping(unsigned long start, unsigned long end)
 void __init htab_initialize(void)
 {
-        unsigned long table, htab_size_bytes;
+        unsigned long table;
        unsigned long pteg_count;
        unsigned long mode_rw;
        unsigned long base = 0, size = 0;
diff --git a/arch/powerpc/oprofile/Kconfig b/arch/powerpc/oprofile/Kconfig
index eb2dece76a54..d03c0e5ca870 100644
--- a/arch/powerpc/oprofile/Kconfig
+++ b/arch/powerpc/oprofile/Kconfig
@@ -1,4 +1,5 @@
 config PROFILING
+        depends on !PPC_ISERIES
        bool "Profiling support (EXPERIMENTAL)"
        help
          Say Y here to enable the extended profiling support mechanisms used
diff --git a/arch/powerpc/platforms/iseries/lpevents.c b/arch/powerpc/platforms/iseries/lpevents.c
index 0b885300d1d1..8ca7b9396355 100644
--- a/arch/powerpc/platforms/iseries/lpevents.c
+++ b/arch/powerpc/platforms/iseries/lpevents.c
@@ -184,6 +184,8 @@ void setup_hvlpevent_queue(void)
 {
        void *eventStack;
+        spin_lock_init(&hvlpevent_queue.lock);
        /* Allocate a page for the Event Stack. */
        eventStack = alloc_bootmem_pages(LpEventStackSize);
        memset(eventStack, 0, LpEventStackSize);
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index 3f8790146b00..3ecc4a652d82 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -648,6 +648,7 @@ static void yield_shared_processor(void)
         * here and let the timer_interrupt code sort out the actual time.
         */
        get_lppaca()->int_dword.fields.decr_int = 1;
+        ppc64_runlatch_on();
        process_iSeries_events();
 }
diff --git a/arch/powerpc/platforms/maple/pci.c b/arch/powerpc/platforms/maple/pci.c
index 7d4099a34f92..85d6c93659cc 100644
--- a/arch/powerpc/platforms/maple/pci.c
+++ b/arch/powerpc/platforms/maple/pci.c
@@ -435,8 +435,8 @@ void __init maple_pci_init(void)
                        PCI_DN(np)->busno = 0xf0;
        }
-        /* Tell pci.c to use the common resource allocation mecanism */
+        /* Tell pci.c to not change any resource allocations.  */
-        pci_probe_only = 0;
+        pci_probe_only = 1;
        
        /* Allow all IO */
        io_page_mask = -1;
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index e3fc3407bb1f..4e5c8f8d869d 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -9,13 +9,6 @@ config PPC_SPLPAR
          processors, that is, which share physical processors between
          two or more partitions.
-config HMT
-        bool "Hardware multithreading"
-        depends on SMP && PPC_PSERIES && BROKEN
-        help
-          This option enables hardware multithreading on RS64 cpus.
-          pSeries systems p620 and p660 have such a cpu type.
 config EEH
        bool "PCI Extended Error Handling (EEH)" if EMBEDDED
        depends on PPC_PSERIES
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 4f26304d0263..7dcdfcb3c984 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -234,7 +234,7 @@ static void mpic_shutdown_ht_interrupt(struct mpic *mpic, unsigned int source,
        spin_lock_irqsave(&mpic->fixup_lock, flags);
        writeb(0x10 + 2 * fixup->index, fixup->base + 2);
        tmp = readl(fixup->base + 4);
-        tmp &= ~1U;
+        tmp |= 1;
        writel(tmp, fixup->base + 4);
        spin_unlock_irqrestore(&mpic->fixup_lock, flags);
 }
@@ -446,14 +446,15 @@ static unsigned int mpic_startup_irq(unsigned int irq)
 #ifdef CONFIG_MPIC_BROKEN_U3
        struct mpic *mpic = mpic_from_irq(irq);
        unsigned int src = irq - mpic->irq_offset;
+#endif /* CONFIG_MPIC_BROKEN_U3 */
+        mpic_enable_irq(irq);
+#ifdef CONFIG_MPIC_BROKEN_U3
        if (mpic_is_ht_interrupt(mpic, src))
                mpic_startup_ht_interrupt(mpic, src, irq_desc[irq].status);
 #endif /* CONFIG_MPIC_BROKEN_U3 */
-        mpic_enable_irq(irq);
        return 0;
 }
diff --git a/arch/ppc/kernel/head.S b/arch/ppc/kernel/head.S
index c5a890dca9cf..53ea845fb911 100644
--- a/arch/ppc/kernel/head.S
+++ b/arch/ppc/kernel/head.S
@@ -751,6 +751,7 @@ AltiVecUnavailable:
 #ifdef CONFIG_ALTIVEC
        bne     load_up_altivec         /* if from user, just load it up */
 #endif /* CONFIG_ALTIVEC */
+        addi    r3,r1,STACK_FRAME_OVERHEAD
        EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 #ifdef CONFIG_PPC64BRIDGE
diff --git a/arch/ppc/xmon/adb.c b/arch/ppc/xmon/adb.c
deleted file mode 100644
index e91384dcccac..000000000000
--- a/arch/ppc/xmon/adb.c
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- * Copyright (C) 1996 Paul Mackerras.
- */
-#include "nonstdio.h"
-#include "privinst.h"
-#define scanhex xmon_scanhex
-#define skipbl  xmon_skipbl
-#define ADB_B           (*(volatile unsigned char *)0xf3016000)
-#define ADB_SR          (*(volatile unsigned char *)0xf3017400)
-#define ADB_ACR         (*(volatile unsigned char *)0xf3017600)
-#define ADB_IFR         (*(volatile unsigned char *)0xf3017a00)
-static inline void eieio(void) { asm volatile ("eieio" : :); }
-#define N_ADB_LOG       1000
-struct adb_log {
-    unsigned char b;
-    unsigned char ifr;
-    unsigned char acr;
-    unsigned int time;
-} adb_log[N_ADB_LOG];
-int n_adb_log;
-void
-init_adb_log(void)
-{
-    adb_log[0].b = ADB_B;
-    adb_log[0].ifr = ADB_IFR;
-    adb_log[0].acr = ADB_ACR;
-    adb_log[0].time = get_dec();
-    n_adb_log = 0;
-}
-void
-dump_adb_log(void)
-{
-    unsigned t, t0;
-    struct adb_log *ap;
-    int i;
-    ap = adb_log;
-    t0 = ap->time;
-    for (i = 0; i <= n_adb_log; ++i, ++ap) {
-        t = t0 - ap->time;
-        printf("b=%x ifr=%x acr=%x at %d.%.7d\n", ap->b, ap->ifr, ap->acr,
-               t / 1000000000, (t % 1000000000) / 100);
-    }
-}
-void
-adb_chklog(void)
-{
-    struct adb_log *ap = &adb_log[n_adb_log + 1];
-    ap->b = ADB_B;
-    ap->ifr = ADB_IFR;
-    ap->acr = ADB_ACR;
-    if (ap->b != ap[-1].b || (ap->ifr & 4) != (ap[-1].ifr & 4)
-        || ap->acr != ap[-1].acr) {
-        ap->time = get_dec();
-        ++n_adb_log;
-    }
-}
-int
-adb_bitwait(int bmask, int bval, int fmask, int fval)
-{
-    int i;
-    struct adb_log *ap;
-    for (i = 10000; i > 0; --i) {
-        adb_chklog();
-        ap = &adb_log[n_adb_log];
-        if ((ap->b & bmask) == bval && (ap->ifr & fmask) == fval)
-            return 0;
-    }
-    return -1;
-}
-int
-adb_wait(void)
-{
-    if (adb_bitwait(0, 0, 4, 4) < 0) {
-        printf("adb: ready wait timeout\n");
-        return -1;
-    }
-    return 0;
-}
-void
-adb_readin(void)
-{
-    int i, j;
-    unsigned char d[64];
-    if (ADB_B & 8) {
-        printf("ADB_B: %x\n", ADB_B);
-        return;
-    }
-    i = 0;
-    adb_wait();
-    j = ADB_SR;
-    eieio();
-    ADB_B &= ~0x20;
-    eieio();
-    for (;;) {
-        if (adb_wait() < 0)
-            break;
-        d[i++] = ADB_SR;
-        eieio();
-        if (ADB_B & 8)
-            break;
-        ADB_B ^= 0x10;
-        eieio();
-    }
-    ADB_B |= 0x30;
-    if (adb_wait() == 0)
-        j = ADB_SR;
-    for (j = 0; j < i; ++j)
-        printf("%.2x ", d[j]);
-    printf("\n");
-}
-int
-adb_write(unsigned char *d, int i)
-{
-    int j;
-    unsigned x;
-    if ((ADB_B & 8) == 0) {
-        printf("r: ");
-        adb_readin();
-    }
-    for (;;) {
-        ADB_ACR = 0x1c;
-        eieio();
-        ADB_SR = d[0];
-        eieio();
-        ADB_B &= ~0x20;
-        eieio();
-        if (ADB_B & 8)
-            break;
-        ADB_ACR = 0xc;
-        eieio();
-        ADB_B |= 0x20;
-        eieio();
-        adb_readin();
-    }
-    adb_wait();
-    for (j = 1; j < i; ++j) {
-        ADB_SR = d[j];
-        eieio();
-        ADB_B ^= 0x10;
-        eieio();
-        if (adb_wait() < 0)
-            break;
-    }
-    ADB_ACR = 0xc;
-    eieio();
-    x = ADB_SR;
-    eieio();
-    ADB_B |= 0x30;
-    return j;
-}
-void
-adbcmds(void)
-{
-    char cmd;
-    unsigned rtcu, rtcl, dec, pdec, x;
-    int i, j;
-    unsigned char d[64];
-    cmd = skipbl();
-    switch (cmd) {
-    case 't':
-        for (;;) {
-            rtcl = get_rtcl();
-            rtcu = get_rtcu();
-            dec = get_dec();
-            printf("rtc u=%u l=%u dec=%x (%d = %d.%.7d)\n",
-                   rtcu, rtcl, dec, pdec - dec, (pdec - dec) / 1000000000,
-                   ((pdec - dec) % 1000000000) / 100);
-            pdec = dec;
-            if (cmd == 'x')
-                break;
-            while (xmon_read(stdin, &cmd, 1) != 1)
-                ;
-        }
-        break;
-    case 'r':
-        init_adb_log();
-        while (adb_bitwait(8, 0, 0, 0) == 0)
-            adb_readin();
-        break;
-    case 'w':
-        i = 0;
-        while (scanhex(&x))
-            d[i++] = x;
-        init_adb_log();
-        j = adb_write(d, i);
-        printf("sent %d bytes\n", j);
-        while (adb_bitwait(8, 0, 0, 0) == 0)
-            adb_readin();
-        break;
-    case 'l':
-        dump_adb_log();
-        break;
-    }
-}
diff --git a/arch/ppc/xmon/start.c b/arch/ppc/xmon/start.c
index 484f5bb1aa3e..ff86b2d814cb 100644
--- a/arch/ppc/xmon/start.c
+++ b/arch/ppc/xmon/start.c
@@ -6,16 +6,11 @@
 #include <asm/machdep.h>
 #include <asm/io.h>
 #include <asm/page.h>
-#include <linux/adb.h>
-#include <linux/pmu.h>
-#include <linux/cuda.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/sysrq.h>
 #include <linux/bitops.h>
 #include <asm/xmon.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
 #include <asm/machdep.h>
 #include <asm/errno.h>
 #include <asm/processor.h>
@@ -26,9 +21,7 @@ static volatile unsigned char *sccc, *sccd;
 unsigned int TXRDY, RXRDY, DLAB;
 static int xmon_expect(const char *str, unsigned int timeout);
-static int use_screen;
 static int via_modem;
-static int xmon_use_sccb;
 #define TB_SPEED        25000000
@@ -46,47 +39,6 @@ void buf_access(void)
                sccd[3] &= ~DLAB;       /* reset DLAB */
 }
-extern int adb_init(void);
-#ifdef CONFIG_PPC_CHRP
-/*
- * This looks in the "ranges" property for the primary PCI host bridge
- * to find the physical address of the start of PCI/ISA I/O space.
- * It is basically a cut-down version of pci_process_bridge_OF_ranges.
- */
-static unsigned long chrp_find_phys_io_base(void)
-{
-        struct device_node *node;
-        unsigned int *ranges;
-        unsigned long base = CHRP_ISA_IO_BASE;
-        int rlen = 0;
-        int np;
-        node = find_devices("isa");
-        if (node != NULL) {
-                node = node->parent;
-                if (node == NULL || node->type == NULL
-                    || strcmp(node->type, "pci") != 0)
-                        node = NULL;
-        }
-        if (node == NULL)
-                node = find_devices("pci");
-        if (node == NULL)
-                return base;
-        ranges = (unsigned int *) get_property(node, "ranges", &rlen);
-        np = prom_n_addr_cells(node) + 5;
-        while ((rlen -= np * sizeof(unsigned int)) >= 0) {
-                if ((ranges[0] >> 24) == 1 && ranges[2] == 0) {
-                        /* I/O space starting at 0, grab the phys base */
-                        base = ranges[np - 3];
-                        break;
-                }
-                ranges += np;
-        }
-        return base;
-}
-#endif /* CONFIG_PPC_CHRP */
 #ifdef CONFIG_MAGIC_SYSRQ
 static void sysrq_handle_xmon(int key, struct pt_regs *regs,
@@ -109,22 +61,6 @@ xmon_map_scc(void)
 #ifdef CONFIG_PPC_MULTIPLATFORM
        volatile unsigned char *base;
-#ifdef CONFIG_PPC_CHRP
-        base = (volatile unsigned char *) isa_io_base;
-        if (_machine == _MACH_chrp)
-                base = (volatile unsigned char *)
-                        ioremap(chrp_find_phys_io_base(), 0x1000);
-        sccc = base + 0x3fd;
-        sccd = base + 0x3f8;
-        if (xmon_use_sccb) {
-                sccc -= 0x100;
-                sccd -= 0x100;
-        }
-        TXRDY = 0x20;
-        RXRDY = 1;
-        DLAB = 0x80;
-#endif /* CONFIG_PPC_CHRP */
 #elif defined(CONFIG_GEMINI)
        /* should already be mapped by the kernel boot */
        sccc = (volatile unsigned char *) 0xffeffb0d;
@@ -143,7 +79,7 @@ xmon_map_scc(void)
        register_sysrq_key('x', &sysrq_xmon_op);
 }
-static int scc_initialized = 0;
+static int scc_initialized;
 void xmon_init_scc(void);
@@ -163,14 +99,6 @@ xmon_write(void *handle, void *ptr, int nb)
                        break;
 #endif
-#ifdef CONFIG_BOOTX_TEXT
-        if (use_screen) {
-                /* write it on the screen */
-                for (i = 0; i < nb; ++i)
-                        btext_drawchar(*p++);
-                goto out;
-        }
-#endif
        if (!scc_initialized)
                xmon_init_scc();
        ct = 0;
@@ -190,7 +118,6 @@ xmon_write(void *handle, void *ptr, int nb)
                eieio();
        }
- out:
 #ifdef CONFIG_SMP
        if (!locked)
                clear_bit(0, &xmon_write_lock);
@@ -199,65 +126,7 @@ xmon_write(void *handle, void *ptr, int nb)
 }
 int xmon_wants_key;
-int xmon_adb_keycode;
-#ifdef CONFIG_BOOTX_TEXT
-static int xmon_adb_shiftstate;
-static unsigned char xmon_keytab[128] =
-        "asdfhgzxcv\000bqwer"                           /* 0x00 - 0x0f */
-        "yt123465=97-80]o"                              /* 0x10 - 0x1f */
-        "u[ip\rlj'k;\\,/nm."                            /* 0x20 - 0x2f */
-        "\t `\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-static unsigned char xmon_shift_keytab[128] =
-        "ASDFHGZXCV\000BQWER"                           /* 0x00 - 0x0f */
-        "YT!@#$^%+(&_*)}O"                              /* 0x10 - 0x1f */
-        "U{IP\rLJ\"K:|<?NM>"                            /* 0x20 - 0x2f */
-        "\t ~\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-static int
-xmon_get_adb_key(void)
-{
-        int k, t, on;
-        xmon_wants_key = 1;
-        for (;;) {
-                xmon_adb_keycode = -1;
-                t = 0;
-                on = 0;
-                do {
-                        if (--t < 0) {
-                                on = 1 - on;
-                                btext_drawchar(on? 0xdb: 0x20);
-                                btext_drawchar('\b');
-                                t = 200000;
-                        }
-                        do_poll_adb();
-                } while (xmon_adb_keycode == -1);
-                k = xmon_adb_keycode;
-                if (on)
-                        btext_drawstring(" \b");
-                /* test for shift keys */
-                if ((k & 0x7f) == 0x38 || (k & 0x7f) == 0x7b) {
-                        xmon_adb_shiftstate = (k & 0x80) == 0;
-                        continue;
-                }
-                if (k >= 0x80)
-                        continue;       /* ignore up transitions */
-                k = (xmon_adb_shiftstate? xmon_shift_keytab: xmon_keytab)[k];
-                if (k != 0)
-                        break;
-        }
-        xmon_wants_key = 0;
-        return k;
-}
-#endif /* CONFIG_BOOTX_TEXT */
 int
 xmon_read(void *handle, void *ptr, int nb)
@@ -265,18 +134,11 @@ xmon_read(void *handle, void *ptr, int nb)
    char *p = ptr;
    int i;
-#ifdef CONFIG_BOOTX_TEXT
-    if (use_screen) {
-        for (i = 0; i < nb; ++i)
-            *p++ = xmon_get_adb_key();
-        return i;
-    }
-#endif
    if (!scc_initialized)
        xmon_init_scc();
    for (i = 0; i < nb; ++i) {
        while ((*sccc & RXRDY) == 0)
-            do_poll_adb();
+            ;
        buf_access();
        *p++ = *sccd;
    }
@@ -287,7 +149,7 @@ int
 xmon_read_poll(void)
 {
        if ((*sccc & RXRDY) == 0) {
-                do_poll_adb();
+                ;
                return -1;
        }
        buf_access();
@@ -297,15 +159,6 @@ xmon_read_poll(void)
 void
 xmon_init_scc(void)
 {
-        if ( _machine == _MACH_chrp )
-        {
-                sccd[3] = 0x83; eieio();        /* LCR = 8N1 + DLAB */
-                sccd[0] = 12; eieio();          /* DLL = 9600 baud */
-                sccd[1] = 0; eieio();
-                sccd[2] = 0; eieio();           /* FCR = 0 */
-                sccd[3] = 3; eieio();           /* LCR = 8N1 */
-                sccd[1] = 0; eieio();           /* IER = 0 */
-        }
        scc_initialized = 1;
        if (via_modem) {
                for (;;) {
@@ -321,22 +174,6 @@ xmon_init_scc(void)
        }
 }
-#if 0
-extern int (*prom_entry)(void *);
-int
-xmon_exit(void)
-{
-    struct prom_args {
-        char *service;
-    } args;
-    for (;;) {
-        args.service = "exit";
-        (*prom_entry)(&args);
-    }
-}
-#endif
 void *xmon_stdin;
 void *xmon_stdout;
diff --git a/arch/ppc/xmon/xmon.c b/arch/ppc/xmon/xmon.c
index bdaf6597b4c2..06fa44b5c647 100644
--- a/arch/ppc/xmon/xmon.c
+++ b/arch/ppc/xmon/xmon.c
@@ -12,8 +12,6 @@
 #include <linux/kallsyms.h>
 #include <asm/ptrace.h>
 #include <asm/string.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
 #include <asm/machdep.h>
 #include <asm/xmon.h>
 #include "nonstdio.h"
@@ -101,9 +99,6 @@ void cacheflush(void);
 static void cpu_cmd(void);
 #endif /* CONFIG_SMP */
 static void csum(void);
-#ifdef CONFIG_BOOTX_TEXT
-static void vidcmds(void);
-#endif
 static void bootcmds(void);
 static void proccall(void);
 static void printtime(void);
@@ -522,11 +517,6 @@ cmds(struct pt_regs *excp)
                        cpu_cmd();
                        break;
 #endif /* CONFIG_SMP */
-#ifdef CONFIG_BOOTX_TEXT
-                case 'v':
-                        vidcmds();
-                        break;
-#endif
                case 'z':
                        bootcmds();
                        break;
@@ -618,43 +608,6 @@ static void cpu_cmd(void)
 }
 #endif /* CONFIG_SMP */
-#ifdef CONFIG_BOOTX_TEXT
-extern boot_infos_t disp_bi;
-static void vidcmds(void)
-{
-        int c = inchar();
-        unsigned int val, w;
-        extern int boot_text_mapped;
-        if (!boot_text_mapped)
-                return;
-        if (c != '\n' && scanhex(&val)) {
-                switch (c) {
-                case 'd':
-                        w = disp_bi.dispDeviceRowBytes
-                                / (disp_bi.dispDeviceDepth >> 3);
-                        disp_bi.dispDeviceDepth = val;
-                        disp_bi.dispDeviceRowBytes = w * (val >> 3);
-                        return;
-                case 'p':
-                        disp_bi.dispDeviceRowBytes = val;
-                        return;
-                case 'w':
-                        disp_bi.dispDeviceRect[2] = val;
-                        return;
-                case 'h':
-                        disp_bi.dispDeviceRect[3] = val;
-                        return;
-                }
-        }
-        printf("W = %d (0x%x) H = %d (0x%x) D = %d (0x%x) P = %d (0x%x)\n",
-               disp_bi.dispDeviceRect[2], disp_bi.dispDeviceRect[2],
-               disp_bi.dispDeviceRect[3], disp_bi.dispDeviceRect[3],
-               disp_bi.dispDeviceDepth, disp_bi.dispDeviceDepth,
-               disp_bi.dispDeviceRowBytes, disp_bi.dispDeviceRowBytes);
-}
-#endif /* CONFIG_BOOTX_TEXT */
 static unsigned short fcstab[256] = {
        0x0000, 0x1189, 0x2312, 0x329b, 0x4624, 0x57ad, 0x6536, 0x74bf,
@@ -1020,7 +973,6 @@ dump_hash_table(void)
 }
 #else
-#ifndef CONFIG_PPC64BRIDGE
 static void
 dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
 {
@@ -1079,66 +1031,6 @@ dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
                printf(" ... %x\n", last_va);
 }
-#else /* CONFIG_PPC64BRIDGE */
-static void
-dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
-{
-        extern void *Hash;
-        extern unsigned long Hash_size;
-        unsigned *htab = Hash;
-        unsigned hsize = Hash_size;
-        unsigned v, hmask, va, last_va;
-        int found, last_found, i;
-        unsigned *hg, w1, last_w2, last_va0;
-        last_found = 0;
-        hmask = hsize / 128 - 1;
-        va = start;
-        start = (start >> 12) & 0xffff;
-        end = (end >> 12) & 0xffff;
-        for (v = start; v < end; ++v) {
-                found = 0;
-                hg = htab + (((v ^ seg) & hmask) * 32);
-                w1 = 1 | (seg << 12) | ((v & 0xf800) >> 4);
-                for (i = 0; i < 8; ++i, hg += 4) {
-                        if (hg[1] == w1) {
-                                found = 1;
-                                break;
-                        }
-                }
-                if (!found) {
-                        w1 ^= 2;
-                        hg = htab + ((~(v ^ seg) & hmask) * 32);
-                        for (i = 0; i < 8; ++i, hg += 4) {
-                                if (hg[1] == w1) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                }
-                if (!(last_found && found && (hg[3] & ~0x180) == last_w2 + 4096)) {
-                        if (last_found) {
-                                if (last_va != last_va0)
-                                        printf(" ... %x", last_va);
-                                printf("\n");
-                        }
-                        if (found) {
-                                printf("%x to %x", va, hg[3]);
-                                last_va0 = va;
-                        }
-                        last_found = found;
-                }
-                if (found) {
-                        last_w2 = hg[3] & ~0x180;
-                        last_va = va;
-                }
-                va += 4096;
-        }
-        if (last_found)
-                printf(" ... %x\n", last_va);
-}
-#endif /* CONFIG_PPC64BRIDGE */
 static unsigned hash_ctx;
 static unsigned hash_start;
 static unsigned hash_end;
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 615964cca15f..50e80138e7ad 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1552,6 +1552,7 @@ sys_linkat_wrapper:
        llgtr   %r3,%r3                 # const char *
        lgfr    %r4,%r4                 # int
        llgtr   %r5,%r5                 # const char *
+        lgfr    %r6,%r6                 # int
        jg      sys_linkat
        .globl sys_symlinkat_wrapper
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index ab733be9af08..4c0a50a76554 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -383,6 +383,7 @@ source "arch/sparc64/oprofile/Kconfig"
 config KPROBES
        bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
        help
          Kprobes allows you to trap at almost any kernel address and
          execute a callback function.  register_kprobe() establishes
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index 054461e6946d..158bd31e15b7 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -542,6 +542,8 @@ void __init setup_arch(char **cmdline_p)
        }
 #endif
+        smp_setup_cpu_possible_map();
        paging_init();
 }
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 1fb6323e65a4..1f7ad8a69052 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -1079,18 +1079,12 @@ int setup_profiling_timer(unsigned int multiplier)
        return 0;
 }
+/* Constrain the number of cpus to max_cpus.  */
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
-        int instance, mid;
-        instance = 0;
-        while (!cpu_find_by_instance(instance, NULL, &mid)) {
-                if (mid < max_cpus)
-                        cpu_set(mid, phys_cpu_present_map);
-                instance++;
-        }
        if (num_possible_cpus() > max_cpus) {
+                int instance, mid;
                instance = 0;
                while (!cpu_find_by_instance(instance, NULL, &mid)) {
                        if (mid != boot_cpu_id) {
@@ -1105,6 +1099,22 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
        smp_store_cpu_info(boot_cpu_id);
 }
+/* Set this up early so that things like the scheduler can init
+ * properly.  We use the same cpu mask for both the present and
+ * possible cpu map.
+ */
+void __init smp_setup_cpu_possible_map(void)
+{
+        int instance, mid;
+        instance = 0;
+        while (!cpu_find_by_instance(instance, NULL, &mid)) {
+                if (mid < NR_CPUS)
+                        cpu_set(mid, phys_cpu_present_map);
+                instance++;
+        }
+}
 void __devinit smp_prepare_boot_cpu(void)
 {
        if (hard_smp_processor_id() >= NR_CPUS) {
diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index dc36b222100b..04e3958266e0 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -46,7 +46,7 @@ extern int file_reader(__u64 offset, char *buf, int len, void *arg);
 extern int read_cow_header(int (*reader)(__u64, char *, int, void *),
                           void *arg, __u32 *version_out,
                           char **backing_file_out, time_t *mtime_out,
-                           unsigned long long *size_out, int *sectorsize_out,
+                           __u64 *size_out, int *sectorsize_out,
                           __u32 *align_out, int *bitmap_offset_out);
 extern int write_cow_header(char *cow_file, int fd, char *backing_file,
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index c83fc5d68936..94de4ead4f7a 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -23,17 +23,17 @@ static inline char *cow_strdup(char *str)
        return(uml_strdup(str));
 }
-static inline int cow_seek_file(int fd, unsigned long long offset)
+static inline int cow_seek_file(int fd, __u64 offset)
 {
        return(os_seek_file(fd, offset));
 }
-static inline int cow_file_size(char *file, unsigned long long *size_out)
+static inline int cow_file_size(char *file, __u64 *size_out)
 {
        return(os_file_size(file, size_out));
 }
-static inline int cow_write_file(int fd, char *buf, int size)
+static inline int cow_write_file(int fd, void *buf, int size)
 {
        return(os_write_file(fd, buf, size));
 }
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index fbe2217db5dd..61951b721268 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -176,7 +176,7 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
        err = -ENOMEM;
        header = cow_malloc(sizeof(*header));
        if(header == NULL){
-                cow_printf("Failed to allocate COW V3 header\n");
+                cow_printf("write_cow_header - failed to allocate COW V3 header\n");
                goto out;
        }
        header->magic = htonl(COW_MAGIC);
@@ -196,15 +196,17 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
        err = os_file_modtime(header->backing_file, &modtime);
        if(err < 0){
-                cow_printf("Backing file '%s' mtime request failed, "
+                cow_printf("write_cow_header - backing file '%s' mtime "
-                           "err = %d\n", header->backing_file, -err);
+                           "request failed, err = %d\n", header->backing_file,
+                           -err);
                goto out_free;
        }
        err = cow_file_size(header->backing_file, size);
        if(err < 0){
-                cow_printf("Couldn't get size of backing file '%s', "
+                cow_printf("write_cow_header - couldn't get size of "
-                           "err = %d\n", header->backing_file, -err);
+                           "backing file '%s', err = %d\n",
+                           header->backing_file, -err);
                goto out_free;
        }
@@ -214,10 +216,11 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
        header->alignment = htonl(alignment);
        header->cow_format = COW_BITMAP;
-        err = os_write_file(fd, header, sizeof(*header));
+        err = cow_write_file(fd, header, sizeof(*header));
        if(err != sizeof(*header)){
-                cow_printf("Write of header to new COW file '%s' failed, "
+                cow_printf("write_cow_header - write of header to "
-                           "err = %d\n", cow_file, -err);
+                           "new COW file '%s' failed, err = %d\n", cow_file,
+                           -err);
                goto out_free;
        }
        err = 0;
@@ -299,7 +302,7 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
        }
        else if(version == 3){
                if(n < sizeof(header->v3)){
-                        cow_printf("read_cow_header - failed to read V2 "
+                        cow_printf("read_cow_header - failed to read V3 "
                                   "header\n");
                        goto out;
                }
@@ -359,7 +362,8 @@ int init_cow_file(int fd, char *cow_file, char *backing_file, int sectorsize,
        if(err != sizeof(zero)){
                cow_printf("Write of bitmap to new COW file '%s' failed, "
                           "err = %d\n", cow_file, -err);
-                err = -EINVAL;
+                if (err >= 0)
+                        err = -EINVAL;
                goto out;
        }
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 098fa65981ab..0e2f06187ea7 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -47,10 +47,12 @@ void tap_check_ips(char *gate_addr, unsigned char *eth_addr)
        }
 }
+/* Do reliable error handling as this fails frequently enough. */
 void read_output(int fd, char *output, int len)
 {
-        int remain, n, actual;
+        int remain, ret, expected;
        char c;
+        char *str;
        if(output == NULL){
                output = &c;
@@ -58,23 +60,31 @@ void read_output(int fd, char *output, int len)
        }
                
        *output = '\0';
-        n = os_read_file(fd, &remain, sizeof(remain));
+        ret = os_read_file(fd, &remain, sizeof(remain));
-        if(n != sizeof(remain)){
-                printk("read_output - read of length failed, err = %d\n", -n);
+        if (ret != sizeof(remain)) {
-                return;
+                expected = sizeof(remain);
+                str = "length";
+                goto err;
        }
        while(remain != 0){
-                n = (remain < len) ? remain : len;
+                expected = (remain < len) ? remain : len;
-                actual = os_read_file(fd, output, n);
+                ret = os_read_file(fd, output, expected);
-                if(actual != n){
+                if (ret != expected) {
-                        printk("read_output - read of data failed, "
+                        str = "data";
-                               "err = %d\n", -actual);
+                        goto err;
-                        return;
                }
-                remain -= actual;
+                remain -= ret;
        }
        return;
+err:
+        if (ret < 0)
+                printk("read_output - read of %s failed, errno = %d\n", str, -ret);
+        else
+                printk("read_output - read of %s failed, read only %d of %d bytes\n", str, ret, expected);
 }
 int net_read(int fd, void *buf, int len)
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 101efd26d467..fa617e0719ab 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1135,7 +1135,7 @@ static int path_requires_switch(char *from_cmdline, char *from_cow, char *cow)
 static int backing_file_mismatch(char *file, __u64 size, time_t mtime)
 {
        unsigned long modtime;
-        long long actual;
+        unsigned long long actual;
        int err;
        err = os_file_modtime(file, &modtime);
diff --git a/arch/um/include/init.h b/arch/um/include/init.h
index cbd79a8d213d..d4de7c0120ce 100644
--- a/arch/um/include/init.h
+++ b/arch/um/include/init.h
@@ -122,7 +122,7 @@ extern struct uml_param __uml_setup_start, __uml_setup_end;
 #define __exitcall(fn) static exitcall_t __exitcall_##fn __exit_call = fn
-#define __init_call __attribute__ ((unused,__section__ (".initcall.init")))
+#define __init_call     __attribute_used__ __attribute__ ((__section__ (".initcall.init")))
 #endif
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index eb1710b81255..2a1c64d8d0bf 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -179,8 +179,11 @@ extern void os_stop_process(int pid);
 extern void os_kill_process(int pid, int reap_child);
 extern void os_kill_ptraced_process(int pid, int reap_child);
 extern void os_usr1_process(int pid);
+extern long os_ptrace_ldt(long pid, long addr, long data);
 extern int os_getpid(void);
 extern int os_getpgrp(void);
 extern void init_new_thread_stack(void *sig_stack, void (*usr1_handler)(int));
 extern void init_new_thread_signals(int altstack);
 extern int run_kernel_thread(int (*fn)(void *), void *arg, void **jmp_ptr);
diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c
index f55773c819e6..3bd10deea280 100644
--- a/arch/um/os-Linux/file.c
+++ b/arch/um/os-Linux/file.c
@@ -272,14 +272,23 @@ int os_connect_socket(char *name)
        snprintf(sock.sun_path, sizeof(sock.sun_path), "%s", name);
        fd = socket(AF_UNIX, SOCK_STREAM, 0);
-        if(fd < 0)
+        if(fd < 0) {
-                return(fd);
+                err = -errno;
+                goto out;
+        }
        err = connect(fd, (struct sockaddr *) &sock, sizeof(sock));
-        if(err)
+        if(err) {
-                return(-errno);
+                err = -errno;
+                goto out_close;
+        }
-        return(fd);
+        return fd;
+out_close:
+        close(fd);
+out:
+        return err;
 }
 void os_close_file(int fd)
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index 7f5e2dac2a35..d261888f39c4 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -19,6 +19,7 @@
 #include "irq_user.h"
 #include "kern_util.h"
 #include "longjmp.h"
+#include "skas_ptrace.h"
 #define ARBITRARY_ADDR -1
 #define FAILURE_PID    -1
@@ -100,6 +101,21 @@ void os_kill_process(int pid, int reap_child)
                
 }
+/* This is here uniquely to have access to the userspace errno, i.e. the one
+ * used by ptrace in case of error.
+ */
+long os_ptrace_ldt(long pid, long addr, long data)
+{
+        int ret;
+        ret = ptrace(PTRACE_LDT, pid, addr, data);
+        if (ret < 0)
+                return -errno;
+        return ret;
+}
 /* Kill off a ptraced child by all means available.  kill it normally first,
 * then PTRACE_KILL it, then PTRACE_CONT it in case it's in a run state from
 * which it can't exit directly.
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index 1fa09a79a10b..fe0877b3509c 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -107,7 +107,7 @@ long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
                 * So we need to switch child's mm into our userspace, then
                 * later switch back.
                 *
-                 * Note: I'm unshure: should interrupts be disabled here?
+                 * Note: I'm unsure: should interrupts be disabled here?
                 */
                if(!current->active_mm || current->active_mm == &init_mm ||
                   mm_idp != &current->active_mm->context.skas.id)
@@ -129,9 +129,7 @@ long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
                        pid = userspace_pid[cpu];
                }
-                res = ptrace(PTRACE_LDT, pid, 0, (unsigned long) &ldt_op);
+                res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op);
-                if(res)
-                        res = errno;
                if(proc_mm)
                        put_cpu();
@@ -181,8 +179,7 @@ static long read_ldt_from_host(void __user * ptr, unsigned long bytecount)
         */
        cpu = get_cpu();
-        res = ptrace(PTRACE_LDT, userspace_pid[cpu], 0,
+        res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt);
-                     (unsigned long) &ptrace_ldt);
        put_cpu();
        if(res < 0)
                goto out;
diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig
index 2f9deca31cc9..e18eb79bf855 100644
--- a/arch/x86_64/Kconfig
+++ b/arch/x86_64/Kconfig
@@ -354,21 +354,6 @@ config HPET_TIMER
          as it is off-chip.  You can find the HPET spec at
          <http://www.intel.com/hardwaredesign/hpetspec.htm>.
-config X86_PM_TIMER
-        bool "PM timer" if EMBEDDED
-        depends on ACPI
-        default y
-        help
-          Support the ACPI PM timer for time keeping. This is slow,
-          but is useful on some chipsets without HPET on systems with more
-          than one CPU. On a single processor or single socket multi core
-          system it is normally not required.
-          When the PM timer is active 64bit vsyscalls are disabled
-          and should not be enabled (/proc/sys/kernel/vsyscall64 should
-          not be changed).
-          The kernel selects the PM timer only as a last resort, so it is
-          useful to enable just in case.
 config HPET_EMULATE_RTC
        bool "Provide RTC interrupt"
        depends on HPET_TIMER && RTC=y
@@ -592,6 +577,7 @@ source "arch/x86_64/oprofile/Kconfig"
 config KPROBES
        bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
        help
          Kprobes allows you to trap at almost any kernel address and
          execute a callback function.  register_kprobe() establishes
diff --git a/arch/x86_64/kernel/Makefile b/arch/x86_64/kernel/Makefile
index 72fe60c20d39..a098a11e7755 100644
--- a/arch/x86_64/kernel/Makefile
+++ b/arch/x86_64/kernel/Makefile
@@ -43,7 +43,7 @@ CFLAGS_vsyscall.o		:= $(PROFILING) -g0
 bootflag-y                      += ../../i386/kernel/bootflag.o
 cpuid-$(subst m,y,$(CONFIG_X86_CPUID))  += ../../i386/kernel/cpuid.o
-topology-y                     += ../../i386/mach-default/topology.o
+topology-y                     += ../../i386/kernel/topology.o
 microcode-$(subst m,y,$(CONFIG_MICROCODE))  += ../../i386/kernel/microcode.o
 intel_cacheinfo-y               += ../../i386/kernel/cpu/intel_cacheinfo.o
 quirks-y                        += ../../i386/kernel/quirks.o
diff --git a/arch/x86_64/kernel/aperture.c b/arch/x86_64/kernel/aperture.c
index e4e2b7d01f89..a0f955b9995f 100644
--- a/arch/x86_64/kernel/aperture.c
+++ b/arch/x86_64/kernel/aperture.c
@@ -248,7 +248,7 @@ void __init iommu_hole_init(void)
                /* Got the aperture from the AGP bridge */
        } else if (swiotlb && !valid_agp) {
                /* Do nothing */
-        } else if ((!no_iommu && end_pfn >= MAX_DMA32_PFN) ||
+        } else if ((!no_iommu && end_pfn > MAX_DMA32_PFN) ||
                   force_iommu ||
                   valid_agp ||
                   fallback_aper_force) { 
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index e5b14c57eaa0..d70605eda333 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -962,12 +962,14 @@ void smp_apic_timer_interrupt(struct pt_regs *regs)
        irq_exit();
 }
+int __initdata unsync_tsc_on_multicluster;
 /*
 * oem_force_hpet_timer -- force HPET mode for some boxes.
 *
 * Thus far, the major user of this is IBM's Summit2 series:
 *
- * Clustered boxes may have unsynced TSC problems if they are
+ * Some clustered boxes may have unsynced TSC problems if they are
 * multi-chassis. Use available data to take a good guess.
 * If in doubt, go HPET.
 */
@@ -977,6 +979,11 @@ __cpuinit int oem_force_hpet_timer(void)
        unsigned id;
        DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
+        /* Only do this check on IBM machines - big Unisys systems
+           use multiple clusters too, but have synchronized TSC */
+        if (!unsync_tsc_on_multicluster)
+                return 0;
        bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
        for (i = 0; i < NR_CPUS; i++) {
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 2585c1d92b26..ffed464e6b12 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -50,6 +50,8 @@ static int no_timer_check;
 int disable_timer_pin_1 __initdata;
+int timer_over_8254 __initdata = 1;
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
@@ -251,6 +253,20 @@ static int __init enable_ioapic_setup(char *str)
 __setup("noapic", disable_ioapic_setup);
 __setup("apic", enable_ioapic_setup);
+static int __init setup_disable_8254_timer(char *s)
+{
+        timer_over_8254 = -1;
+        return 1;
+}
+static int __init setup_enable_8254_timer(char *s)
+{
+        timer_over_8254 = 2;
+        return 1;
+}
+__setup("disable_8254_timer", setup_disable_8254_timer);
+__setup("enable_8254_timer", setup_enable_8254_timer);
 #include <asm/pci-direct.h>
 #include <linux/pci_ids.h>
 #include <linux/pci.h>
@@ -309,27 +325,20 @@ void __init check_ioapic(void)
 #endif
                                        /* RED-PEN skip them on mptables too? */
                                        return;
+                                /* This should be actually default, but
+                                   for 2.6.16 let's do it for ATI only where
+                                   it's really needed. */
                                case PCI_VENDOR_ID_ATI:
-                                        if (apic_runs_main_timer != 0)
+                                        if (timer_over_8254 == 1) {     
-                                                break;
+                                                timer_over_8254 = 0;    
-#ifdef CONFIG_ACPI
-                                        /* Don't do this for laptops right
-                                           right now because their timer
-                                           doesn't necessarily tick in C2/3 */
-                                        if (acpi_fadt.revision >= 3 &&
-                        (acpi_fadt.plvl2_lat + acpi_fadt.plvl3_lat) < 1100) {
-                                                printk(KERN_INFO
-"ATI board detected, but seems to be a laptop. Timer might be shakey, sorry\n");
-                                                break;
-                                        }
-#endif                                  
                                        printk(KERN_INFO
-             "ATI board detected. Using APIC/PM timer.\n");
+                "ATI board detected. Disabling timer routing over 8254.\n");
-                                        apic_runs_main_timer = 1;
+                                        }       
-                                        nohpet = 1;
                                        return;
                                } 
                                /* No multi-function device? */
                                type = read_pci_config_byte(num,slot,func,
                                                            PCI_HEADER_TYPE);
@@ -1773,6 +1782,8 @@ static inline void unlock_ExtINT_logic(void)
 * a wide range of boards and BIOS bugs.  Fortunately only the timer IRQ
 * is so screwy.  Thanks to Brian Perkins for testing/hacking this beast
 * fanatically on his truly buggy board.
+ *
+ * FIXME: really need to revamp this for modern platforms only.
 */
 static inline void check_timer(void)
 {
@@ -1795,7 +1806,8 @@ static inline void check_timer(void)
         */
        apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
        init_8259A(1);
-        enable_8259A_irq(0);
+        if (timer_over_8254 > 0)
+                enable_8259A_irq(0);
        pin1  = find_isa_irq_pin(0, mp_INT);
        apic1 = find_isa_irq_apic(0, mp_INT);
@@ -1850,7 +1862,7 @@ static inline void check_timer(void)
        }
        printk(" failed.\n");
-        if (nmi_watchdog) {
+        if (nmi_watchdog == NMI_IO_APIC) {
                printk(KERN_WARNING "timer doesn't work through the IO-APIC - disabling NMI Watchdog!\n");
                nmi_watchdog = 0;
        }
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index dd0718dc178b..0c3f052ba6ce 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -228,11 +228,6 @@ static inline int need_iommu(struct device *dev, unsigned long addr, size_t size
        int mmu = high;
        if (force_iommu) 
                mmu = 1; 
-        if (no_iommu) { 
-                if (high) 
-                        panic("PCI-DMA: high address but no IOMMU.\n"); 
-                mmu = 0; 
-        }       
        return mmu; 
 }
@@ -241,11 +236,6 @@ static inline int nonforced_iommu(struct device *dev, unsigned long addr, size_t
        u64 mask = *dev->dma_mask;
        int high = addr + size >= mask;
        int mmu = high;
-        if (no_iommu) { 
-                if (high) 
-                        panic("PCI-DMA: high address but no IOMMU.\n"); 
-                mmu = 0; 
-        }       
        return mmu; 
 }
@@ -310,7 +300,7 @@ void gart_unmap_sg(struct device *dev, struct scatterlist *sg, int nents, int di
        for (i = 0; i < nents; i++) {
                struct scatterlist *s = &sg[i];
-                if (!s->dma_length)
+                if (!s->dma_length || !s->length)
                        break;
                dma_unmap_single(dev, s->dma_address, s->dma_length, dir);
        }
@@ -364,6 +354,7 @@ static int __dma_map_cont(struct scatterlist *sg, int start, int stopat,
                
                BUG_ON(i > start && s->offset);
                if (i == start) {
+                        *sout = *s; 
                        sout->dma_address = iommu_bus_base;
                        sout->dma_address += iommu_page*PAGE_SIZE + s->offset;
                        sout->dma_length = s->length;
@@ -390,6 +381,7 @@ static inline int dma_map_cont(struct scatterlist *sg, int start, int stopat,
 {
        if (!need) { 
                BUG_ON(stopat - start != 1);
+                *sout = sg[start]; 
                sout->dma_length = sg[start].length; 
                return 0;
        } 
@@ -632,17 +624,13 @@ static int __init pci_iommu_init(void)
                (agp_copy_info(agp_bridge, &info) < 0);
 #endif  
-        if (swiotlb) { 
+        if (swiotlb)
-                no_iommu = 1;
                return -1; 
-        } 
-        
        if (no_iommu ||
            (!force_iommu && end_pfn <= MAX_DMA32_PFN) ||
            !iommu_aperture ||
            (no_agp && init_k8_gatt(&info) < 0)) {
-                no_iommu = 1;
-                no_iommu_init();
                printk(KERN_INFO "PCI-DMA: Disabling IOMMU.\n");
                if (end_pfn > MAX_DMA32_PFN) {
                        printk(KERN_ERR "WARNING more than 4GB of memory "
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 9435ab7d6fb8..aa55e3cec665 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -423,6 +423,12 @@ static __init void parse_cmdline_early (char ** cmdline_p)
                else if(!memcmp(from, "elfcorehdr=", 11))
                        elfcorehdr_addr = memparse(from+11, &from);
 #endif
+#ifdef CONFIG_HOTPLUG_CPU
+                else if (!memcmp(from, "additional_cpus=", 16))
+                        setup_additional_cpus(from+16);
+#endif
        next_char:
                c = *(from++);
                if (!c)
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index 67e4e28f4df8..66e98659d077 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -1152,8 +1152,6 @@ void __init smp_cpus_done(unsigned int max_cpus)
        setup_ioapic_dest();
 #endif
-        time_init_gtod();
        check_nmi_watchdog();
 }
@@ -1244,7 +1242,7 @@ void __cpu_die(unsigned int cpu)
        printk(KERN_ERR "CPU %u didn't die...\n", cpu);
 }
-static __init int setup_additional_cpus(char *s)
+__init int setup_additional_cpus(char *s)
 {
        return get_option(&s, &additional_cpus);
 }
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 67841d11ed1f..3080f84bf7b7 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -48,6 +48,8 @@ static void cpufreq_delayed_get(void);
 extern void i8254_timer_resume(void);
 extern int using_apic_timer;
+static char *time_init_gtod(void);
 DEFINE_SPINLOCK(rtc_lock);
 DEFINE_SPINLOCK(i8253_lock);
@@ -901,6 +903,7 @@ static struct irqaction irq0 = {
 void __init time_init(void)
 {
        char *timename;
+        char *gtod;
 #ifdef HPET_HACK_ENABLE_DANGEROUS
        if (!vxtime.hpet_address) {
@@ -945,21 +948,19 @@ void __init time_init(void)
                timename = "PIT";
        }
-        printk(KERN_INFO "time.c: Using %ld.%06ld MHz %s timer.\n",
+        vxtime.mode = VXTIME_TSC;
-               vxtime_hz / 1000000, vxtime_hz % 1000000, timename);
+        gtod = time_init_gtod();
+        printk(KERN_INFO "time.c: Using %ld.%06ld MHz WALL %s GTOD %s timer.\n",
+               vxtime_hz / 1000000, vxtime_hz % 1000000, timename, gtod);
        printk(KERN_INFO "time.c: Detected %d.%03d MHz processor.\n",
                cpu_khz / 1000, cpu_khz % 1000);
-        vxtime.mode = VXTIME_TSC;
        vxtime.quot = (1000000L << 32) / vxtime_hz;
        vxtime.tsc_quot = (1000L << 32) / cpu_khz;
        vxtime.last_tsc = get_cycles_sync();
        setup_irq(0, &irq0);
        set_cyc2ns_scale(cpu_khz);
-#ifndef CONFIG_SMP
-        time_init_gtod();
-#endif
 }
 /*
@@ -981,9 +982,9 @@ __cpuinit int unsynchronized_tsc(void)
 }
 /*
- * Decide after all CPUs are booted what mode gettimeofday should use.
+ * Decide what mode gettimeofday should use.
 */
-void __init time_init_gtod(void)
+__init static char *time_init_gtod(void)
 {
        char *timetype;
@@ -1011,8 +1012,7 @@ void __init time_init_gtod(void)
                timetype = hpet_use_timer ? "HPET/TSC" : "PIT/TSC";
                vxtime.mode = VXTIME_TSC;
        }
+        return timetype;
-        printk(KERN_INFO "time.c: Using %s based timekeeping.\n", timetype);
 }
 __setup("report_lost_ticks", time_setup);
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 0cce28c4025b..33e2ca847a26 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -247,7 +247,7 @@ config ACPI_CUSTOM_DSDT_FILE
          Enter the full path name to the file wich includes the AmlCode declaration.
 config ACPI_BLACKLIST_YEAR
-        int "Disable ACPI for systems before Jan 1st this year" if X86
+        int "Disable ACPI for systems before Jan 1st this year" if X86_32
        default 0
        help
          enter a 4-digit year, eg. 2001 to disable ACPI by default
@@ -285,9 +285,8 @@ config ACPI_SYSTEM
          dump your ACPI DSDT table using /proc/acpi/dsdt.
 config X86_PM_TIMER
-        bool "Power Management Timer Support"
+        bool "Power Management Timer Support" if EMBEDDED
        depends on X86
-        depends on !X86_64
        default y
        help
          The Power Management Timer is available on all ACPI-capable,
@@ -298,9 +297,8 @@ config X86_PM_TIMER
          voltage scaling, unlike the commonly used Time Stamp Counter
          (TSC) timing source.
-          So, if you see messages like 'Losing too many ticks!' in the
+          You should nearly always say Y here because many modern
-          kernel logs, and/or you are using this on a notebook which
+          systems require this timer. 
-          does not yet have an HPET, you should say "Y" here.
 config ACPI_CONTAINER
        tristate "ACPI0004,PNP0A05 and PNP0A06 Container Driver (EXPERIMENTAL)"
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 1994a92d4733..f65b2e14a485 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -335,6 +335,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
        } /* else count == 0 */
        tty->driver_data = hp;
+        tty->low_latency = 1; /* Makes flushes to ldisc synchronous. */
        hp->tty = tty;
        /* Save for request_irq outside of spin_lock. */
        irq = hp->irq;
@@ -633,9 +635,6 @@ static int hvc_poll(struct hvc_struct *hp)
                        tty_insert_flip_char(tty, buf[i], 0);
                }
-                if (count)
-                        tty_schedule_flip(tty);
                /*
                 * Account for the total amount read in one loop, and if above
                 * 64 bytes, we do a quick schedule loop to let the tty grok
@@ -656,6 +655,9 @@ static int hvc_poll(struct hvc_struct *hp)
 bail:
        spin_unlock_irqrestore(&hp->lock, flags);
+        if (read_total)
+                tty_flip_buffer_push(tty);
+        
        return poll_mask;
 }
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index c2490e270f1f..588e75ec1630 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -2173,15 +2173,17 @@ static int probe_si (struct sx_board *board)
        if ( IS_SI1_BOARD(board)) {
                /* This should be an SI1 board, which has this
                   location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                        func_exit ();
                        return 0; 
+                }
        } else {
                /* This should be an SI2 board, which has the bottom
                   3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                        func_exit ();
                        return 0; 
+                }
        }
        /* Now we're pretty much convinced that there is an SI board here, 
@@ -2192,15 +2194,17 @@ static int probe_si (struct sx_board *board)
        if ( IS_SI1_BOARD(board)) {
                /* This should be an SI1 board, which has this
                   location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                        func_exit();
                        return 0; 
+                }
        } else {
                /* This should be an SI2 board, which has the bottom
                   3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                        func_exit ();
                        return 0; 
+                }
        }
        printheader ();
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index e9adeb9d172f..745ca1f67b14 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -849,10 +849,16 @@ static struct mapped_device *alloc_dev(unsigned int minor, int persistent)
 static void free_dev(struct mapped_device *md)
 {
-        free_minor(md->disk->first_minor);
+        unsigned int minor = md->disk->first_minor;
+        if (md->suspended_bdev) {
+                thaw_bdev(md->suspended_bdev, NULL);
+                bdput(md->suspended_bdev);
+        }
        mempool_destroy(md->tio_pool);
        mempool_destroy(md->io_pool);
        del_gendisk(md->disk);
+        free_minor(minor);
        put_disk(md->disk);
        blk_put_queue(md->queue);
        kfree(md);
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index ded2c33f5b85..1c074d63ff3a 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -408,6 +408,7 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
                cfi->chips[i].buffer_write_time = 1<<cfi->cfiq->BufWriteTimeoutTyp;
                cfi->chips[i].erase_time = 1<<cfi->cfiq->BlockEraseTimeoutTyp;
                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
        }
        map->fldrv = &cfi_intelext_chipdrv;
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 1b699259b4ec..31fb2d75dc44 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -57,7 +57,7 @@ struct ifb_private {
        struct sk_buff_head     tq;
 };
-static int numifbs = 1;
+static int numifbs = 2;
 static void ri_tasklet(unsigned long dev);
 static int ifb_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index 3d95fa20cd88..7a952fe60be2 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -540,7 +540,7 @@ static int __devinit sis900_probe(struct pci_dev *pci_dev,
        printk("%2.2x.\n", net_dev->dev_addr[i]);
        /* Detect Wake on Lan support */
-        ret = inl(CFGPMC & PMESP);
+        ret = (inl(net_dev->base_addr + CFGPMC) & PMESP) >> 27;
        if (netif_msg_probe(sis_priv) && (ret & PME_D3C) == 0)
                printk(KERN_INFO "%s: Wake on LAN only available from suspend to RAM.", net_dev->name);
@@ -2040,7 +2040,7 @@ static int sis900_set_wol(struct net_device *net_dev, struct ethtool_wolinfo *wo
        if (wol->wolopts == 0) {
                pci_read_config_dword(sis_priv->pci_dev, CFGPMCSR, &cfgpmcsr);
-                cfgpmcsr |= ~PME_EN;
+                cfgpmcsr &= ~PME_EN;
                pci_write_config_dword(sis_priv->pci_dev, CFGPMCSR, cfgpmcsr);
                outl(pmctrl_bits, pmctrl_addr);
                if (netif_msg_wol(sis_priv))
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index c2506b56a186..12076f8f942c 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -536,6 +536,7 @@ static int __devinit TLan_probe1(struct pci_dev *pdev,
        u16                device_id;
        int                reg, rc = -ENODEV;
+#ifdef CONFIG_PCI
        if (pdev) {
                rc = pci_enable_device(pdev);
                if (rc)
@@ -547,6 +548,7 @@ static int __devinit TLan_probe1(struct pci_dev *pdev,
                        goto err_out;
                }
        }
+#endif  /*  CONFIG_PCI  */
        dev = alloc_etherdev(sizeof(TLanPrivateInfo));
        if (dev == NULL) {
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index 17f74d3c10e7..9face3c6aa21 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -49,11 +49,13 @@
 #define DRV_VERSION     "0.9"
 enum {
+        SIL_FLAG_RERR_ON_DMA_ACT = (1 << 29),
        SIL_FLAG_MOD15WRITE     = (1 << 30),
        sil_3112                = 0,
        sil_3112_m15w           = 1,
-        sil_3114                = 2,
+        sil_3512                = 2,
+        sil_3114                = 3,
        SIL_FIFO_R0             = 0x40,
        SIL_FIFO_W0             = 0x41,
@@ -90,7 +92,7 @@ static void sil_post_set_mode (struct ata_port *ap);
 static const struct pci_device_id sil_pci_tbl[] = {
        { 0x1095, 0x3112, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
        { 0x1095, 0x0240, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
-        { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
+        { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3512 },
        { 0x1095, 0x3114, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3114 },
        { 0x1002, 0x436e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
        { 0x1002, 0x4379, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
@@ -185,7 +187,8 @@ static const struct ata_port_info sil_port_info[] = {
                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                .udma_mask      = 0x3f,                 /* udma0-5 */
                .port_ops       = &sil_ops,
-        }, /* sil_3112_15w - keep it sync'd w/ sil_3112 */
+        },
+        /* sil_3112_15w - keep it sync'd w/ sil_3112 */
        {
                .sht            = &sil_sht,
                .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
@@ -195,11 +198,24 @@ static const struct ata_port_info sil_port_info[] = {
                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                .udma_mask      = 0x3f,                 /* udma0-5 */
                .port_ops       = &sil_ops,
-        }, /* sil_3114 */
+        },
+        /* sil_3512 */
        {
                .sht            = &sil_sht,
                .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
-                                  ATA_FLAG_SRST | ATA_FLAG_MMIO,
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_RERR_ON_DMA_ACT,
+                .pio_mask       = 0x1f,                 /* pio0-4 */
+                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
+                .udma_mask      = 0x3f,                 /* udma0-5 */
+                .port_ops       = &sil_ops,
+        },
+        /* sil_3114 */
+        {
+                .sht            = &sil_sht,
+                .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_RERR_ON_DMA_ACT,
                .pio_mask       = 0x1f,                 /* pio0-4 */
                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                .udma_mask      = 0x3f,                 /* udma0-5 */
@@ -216,12 +232,13 @@ static const struct {
        unsigned long scr;      /* SATA control register block */
        unsigned long sien;     /* SATA Interrupt Enable register */
        unsigned long xfer_mode;/* data transfer mode register */
+        unsigned long sfis_cfg; /* SATA FIS reception config register */
 } sil_port[] = {
        /* port 0 ... */
-        { 0x80, 0x8A, 0x00, 0x100, 0x148, 0xb4 },
+        { 0x80, 0x8A, 0x00, 0x100, 0x148, 0xb4, 0x14c },
-        { 0xC0, 0xCA, 0x08, 0x180, 0x1c8, 0xf4 },
+        { 0xC0, 0xCA, 0x08, 0x180, 0x1c8, 0xf4, 0x1cc },
-        { 0x280, 0x28A, 0x200, 0x300, 0x348, 0x2b4 },
+        { 0x280, 0x28A, 0x200, 0x300, 0x348, 0x2b4, 0x34c },
-        { 0x2C0, 0x2CA, 0x208, 0x380, 0x3c8, 0x2f4 },
+        { 0x2C0, 0x2CA, 0x208, 0x380, 0x3c8, 0x2f4, 0x3cc },
        /* ... port 3 */
 };
@@ -471,6 +488,23 @@ static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                dev_printk(KERN_WARNING, &pdev->dev,
                         "cache line size not set.  Driver may not function\n");
+        /* Apply R_ERR on DMA activate FIS errata workaround */
+        if (probe_ent->host_flags & SIL_FLAG_RERR_ON_DMA_ACT) {
+                int cnt;
+                for (i = 0, cnt = 0; i < probe_ent->n_ports; i++) {
+                        tmp = readl(mmio_base + sil_port[i].sfis_cfg);
+                        if ((tmp & 0x3) != 0x01)
+                                continue;
+                        if (!cnt)
+                                dev_printk(KERN_INFO, &pdev->dev,
+                                           "Applying R_ERR on DMA activate "
+                                           "FIS errata fix\n");
+                        writel(tmp & ~0x3, mmio_base + sil_port[i].sfis_cfg);
+                        cnt++;
+                }
+        }
        if (ent->driver_data == sil_3114) {
                irq_mask = SIL_MASK_4PORT;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 930db398d107..9d9872347f56 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -89,6 +89,11 @@
 #define SD_MAX_RETRIES          5
 #define SD_PASSTHROUGH_RETRIES  1
+/*
+ * Size of the initial data buffer for mode and read capacity data
+ */
+#define SD_BUF_SIZE             512
 static void scsi_disk_release(struct kref *kref);
 struct scsi_disk {
@@ -1239,7 +1244,7 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage,
 /*
 * read write protect setting, if possible - called only in sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
 */
 static void
 sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
@@ -1297,7 +1302,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
 /*
 * sd_read_cache_type - called only from sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
 */
 static void
 sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
@@ -1342,6 +1347,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
        /* Take headers and block descriptors into account */
        len += data.header_length + data.block_descriptor_length;
+        if (len > SD_BUF_SIZE)
+                goto bad_sense;
        /* Get the data */
        res = sd_do_mode_sense(sdp, dbd, modepage, buffer, len, &data, &sshdr);
@@ -1354,6 +1361,12 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
                int ct = 0;
                int offset = data.header_length + data.block_descriptor_length;
+                if (offset >= SD_BUF_SIZE - 2) {
+                        printk(KERN_ERR "%s: malformed MODE SENSE response",
+                                diskname);
+                        goto defaults;
+                }
                if ((buffer[offset] & 0x3f) != modepage) {
                        printk(KERN_ERR "%s: got wrong page\n", diskname);
                        goto defaults;
@@ -1398,6 +1411,7 @@ defaults:
               diskname);
        sdkp->WCE = 0;
        sdkp->RCD = 0;
+        sdkp->DPOFUA = 0;
 }
 /**
@@ -1421,7 +1435,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
        if (!scsi_device_online(sdp))
                goto out;
-        buffer = kmalloc(512, GFP_KERNEL | __GFP_DMA);
+        buffer = kmalloc(SD_BUF_SIZE, GFP_KERNEL | __GFP_DMA);
        if (!buffer) {
                printk(KERN_WARNING "(sd_revalidate_disk:) Memory allocation "
                       "failure.\n");
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 244e8ff11977..7aca22c9976d 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2326,6 +2326,12 @@ static struct uart_driver serial8250_reg = {
        .cons                   = SERIAL8250_CONSOLE,
 };
+/*
+ * early_serial_setup - early registration for 8250 ports
+ *
+ * Setup an 8250 port structure prior to console initialisation.  Use
+ * after console initialisation will cause undefined behaviour.
+ */
 int __init early_serial_setup(struct uart_port *port)
 {
        if (port->line >= ARRAY_SIZE(serial8250_ports))
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index e64ed16bd42f..f5079c78ba4e 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -520,7 +520,7 @@ config FB_GBE
 config FB_GBE_MEM
        int "Video memory size in MB"
        depends on FB_GBE
-        default 8
+        default 4
        help
          This is the amount of memory reserved for the framebuffer,
          which can be any value between 1MB and 8MB.
diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index 69f75547865d..c924d81f7978 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -322,32 +322,29 @@ static int asiliantfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
        writeb(green, mmio_base + 0x791);
        writeb(blue, mmio_base + 0x791);
-        switch(p->var.bits_per_pixel) {
+        if (regno < 16) {
-        case 15:
+                switch(p->var.red.offset) {
-                if (regno < 16) {
+                case 10: /* RGB 555 */
                        ((u32 *)(p->pseudo_palette))[regno] =
                                ((red & 0xf8) << 7) |
                                ((green & 0xf8) << 2) |
                                ((blue & 0xf8) >> 3);
-                }
+                        break;
-                break;
+                case 11: /* RGB 565 */
-        case 16:
-                if (regno < 16) {
                        ((u32 *)(p->pseudo_palette))[regno] =
                                ((red & 0xf8) << 8) |
                                ((green & 0xfc) << 3) |
                                ((blue & 0xf8) >> 3);
-                }
+                        break;
-                break;
+                case 16: /* RGB 888 */
-        case 24:
-                if (regno < 24) {
                        ((u32 *)(p->pseudo_palette))[regno] =
                                (red << 16)  |
                                (green << 8) |
                                (blue);
+                        break;
                }
-                break;
        }
        return 0;
 }
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index 2406899f1207..3d04b2def0f1 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -49,6 +49,7 @@
 #include <linux/interrupt.h>
 #include <linux/ctype.h>
 #include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
 #include <asm/mach-au1x00/au1000.h>
@@ -406,7 +407,7 @@ int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
        vma->vm_flags |= VM_IO;
-        if (io_remap_page_range(vma, vma->vm_start, off,
+        if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
                                vma->vm_end - vma->vm_start,
                                vma->vm_page_prot)) {
                return -EAGAIN;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 12d9329d1408..5a86978537d2 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -509,57 +509,60 @@ static int vgacon_doresize(struct vc_data *c,
 {
        unsigned long flags;
        unsigned int scanlines = height * c->vc_font.height;
-        u8 scanlines_lo, r7, vsync_end, mode, max_scan;
+        u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
        spin_lock_irqsave(&vga_lock, flags);
-        outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
-        max_scan = inb_p(vga_video_port_val);
-        if (max_scan & 0x80)
-                scanlines <<= 1;
        vgacon_xres = width * VGA_FONTWIDTH;
        vgacon_yres = height * c->vc_font.height;
-        outb_p(VGA_CRTC_MODE, vga_video_port_reg);
+        if (vga_video_type >= VIDEO_TYPE_VGAC) {
-        mode = inb_p(vga_video_port_val);
+                outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
+                max_scan = inb_p(vga_video_port_val);
-        if (mode & 0x04)
+                if (max_scan & 0x80)
-                scanlines >>= 1;
+                        scanlines <<= 1;
-        scanlines -= 1;
+                outb_p(VGA_CRTC_MODE, vga_video_port_reg);
-        scanlines_lo = scanlines & 0xff;
+                mode = inb_p(vga_video_port_val);
-        outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                if (mode & 0x04)
-        r7 = inb_p(vga_video_port_val) & ~0x42;
+                        scanlines >>= 1;
-        if (scanlines & 0x100)
+                scanlines -= 1;
-                r7 |= 0x02;
+                scanlines_lo = scanlines & 0xff;
-        if (scanlines & 0x200)
-                r7 |= 0x40;
-        /* deprotect registers */
+                outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                r7 = inb_p(vga_video_port_val) & ~0x42;
-        vsync_end = inb_p(vga_video_port_val);
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                if (scanlines & 0x100)
-        outb_p(vsync_end & ~0x80, vga_video_port_val);
+                        r7 |= 0x02;
+                if (scanlines & 0x200)
+                        r7 |= 0x40;
+                /* deprotect registers */
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                vsync_end = inb_p(vga_video_port_val);
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                outb_p(vsync_end & ~0x80, vga_video_port_val);
+        }
        outb_p(VGA_CRTC_H_DISP, vga_video_port_reg);
        outb_p(width - 1, vga_video_port_val);
        outb_p(VGA_CRTC_OFFSET, vga_video_port_reg);
        outb_p(width >> 1, vga_video_port_val);
-        outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
+        if (vga_video_type >= VIDEO_TYPE_VGAC) {
-        outb_p(scanlines_lo, vga_video_port_val);
+                outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
-        outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                outb_p(scanlines_lo, vga_video_port_val);
-        outb_p(r7,vga_video_port_val);
+                outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                outb_p(r7,vga_video_port_val);
-        /* reprotect registers */
+                /* reprotect registers */
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        outb_p(vsync_end, vga_video_port_val);
+                outb_p(vsync_end, vga_video_port_val);
+        }
        spin_unlock_irqrestore(&vga_lock, flags);
        return 0;
 }
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index c9a7cdf6d543..5e25b9860196 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -656,12 +656,15 @@ static int gbefb_set_par(struct fb_info *info)
        switch (bytesPerPixel) {
        case 1:
                SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_I8);
+                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
                break;
        case 2:
                SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_ARGB5);
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                break;
        case 4:
                SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_RGB8);
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                break;
        }
        SET_GBE_FIELD(WID, BUF, val, GBE_BMODE_BOTH);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 1b117a441298..c2eac2a50bd2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -938,6 +938,11 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                kfree(elf_interpreter);
        } else {
                elf_entry = loc->elf_ex.e_entry;
+                if (BAD_ADDR(elf_entry)) {
+                        send_sig(SIGSEGV, current, 0);
+                        retval = -ENOEXEC; /* Nobody gets to see this, but.. */
+                        goto out_free_dentry;
+                }
        }
        kfree(elf_phdata);
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 057e60217fc5..537ac70edfe5 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -2531,18 +2531,9 @@ static int rtc_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
                val32 = kval;
                return put_user(val32, (unsigned int __user *)arg);
        case RTC_IRQP_SET32:
+                return sys_ioctl(fd, RTC_IRQP_SET, arg); 
        case RTC_EPOCH_SET32:
-                ret = get_user(val32, (unsigned int __user *)arg);
+                return sys_ioctl(fd, RTC_EPOCH_SET, arg);
-                if (ret)
-                        return ret;
-                kval = val32;
-                set_fs(KERNEL_DS);
-                ret = sys_ioctl(fd, (cmd == RTC_IRQP_SET32) ?
-                                RTC_IRQP_SET : RTC_EPOCH_SET,
-                                (unsigned long)&kval);
-                set_fs(oldfs);
-                return ret;
        default:
                /* unreached */
                return -ENOIOCTLCMD;
diff --git a/fs/namei.c b/fs/namei.c
index e28de846c591..557dcf395ca1 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2224,13 +2224,17 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
 * and other special files.  --ADM
 */
 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
-                           int newdfd, const char __user *newname)
+                           int newdfd, const char __user *newname,
+                           int flags)
 {
        struct dentry *new_dentry;
        struct nameidata nd, old_nd;
        int error;
        char * to;
+        if (flags != 0)
+                return -EINVAL;
        to = getname(newname);
        if (IS_ERR(to))
                return PTR_ERR(to);
@@ -2263,7 +2267,7 @@ exit:
 asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
 {
-        return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname);
+        return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
 }
 /*
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 02f44094bda9..9d8ffa89e2c2 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -1,9 +1,9 @@
 ToDo/Notes:
        - Find and fix bugs.
        - The only places in the kernel where a file is resized are
-          ntfs_file_write*() and ntfs_truncate() for both of which i_sem is
+          ntfs_file_write*() and ntfs_truncate() for both of which i_mutex is
          held.  Just have to be careful in read-/writepage and other helpers
-          not running under i_sem that we play nice...  Also need to be careful
+          not running under i_mutex that we play nice.  Also need to be careful
          with initialized_size extension in ntfs_file_write*() and writepage.
          UPDATE: The only things that need to be checked are the compressed
          write and the other attribute resize/write cases like index
@@ -19,6 +19,24 @@ ToDo/Notes:
        - Enable the code for setting the NT4 compatibility flag when we start
          making NTFS 1.2 specific modifications.
+2.1.26 - Minor bug fixes and updates.
+        - Fix a potential overflow in file.c where a cast to s64 was missing in
+          a left shift of a page index.
+        - The struct inode has had its i_sem semaphore changed to a mutex named
+          i_mutex.
+        - We have struct kmem_cache now so use it instead of the typedef
+          kmem_cache_t.  (Pekka Enberg)
+        - Implement support for sector sizes above 512 bytes (up to the maximum
+          supported by NTFS which is 4096 bytes).
+        - Do more detailed reporting of why we cannot mount read-write by
+          special casing the VOLUME_MODIFIED_BY_CHKDSK flag.
+        - Miscellaneous updates to layout.h.
+        - Cope with attribute list attribute having invalid flags.  Windows
+          copes with this and even chkdsk does not detect or fix this so we
+          have to cope with it, too.  Thanks to Pawel Kot for reporting the
+          problem.
 2.1.25 - (Almost) fully implement write(2) and truncate(2).
        - Change ntfs_map_runlist_nolock(), ntfs_attr_find_vcn_nolock() and
@@ -373,7 +391,7 @@ ToDo/Notes:
          single one of them had an mst error.  (Thanks to Ken MacFerrin for
          the bug report.)
        - Fix error handling in fs/ntfs/quota.c::ntfs_mark_quotas_out_of_date()
-          where we failed to release i_sem on the $Quota/$Q attribute inode.
+          where we failed to release i_mutex on the $Quota/$Q attribute inode.
        - Fix bug in handling of bad inodes in fs/ntfs/namei.c::ntfs_lookup().
        - Add mapping of unmapped buffers to all remaining code paths, i.e.
          fs/ntfs/aops.c::ntfs_write_mst_block(), mft.c::ntfs_sync_mft_mirror(),
@@ -874,7 +892,7 @@ ToDo/Notes:
          clusters. (Philipp Thomas)
        - attrib.c::load_attribute_list(): Fix bug when initialized_size is a
          multiple of the block_size but not the cluster size. (Szabolcs
-          Szakacsits <szaka@sienet.hu>)
+          Szakacsits)
 2.1.2 - Important bug fixes aleviating the hangs in statfs.
@@ -884,7 +902,7 @@ ToDo/Notes:
        - Add handling for initialized_size != data_size in compressed files.
        - Reduce function local stack usage from 0x3d4 bytes to just noise in
-          fs/ntfs/upcase.c. (Randy Dunlap <rdunlap@xenotime.net>)
+          fs/ntfs/upcase.c. (Randy Dunlap)
        - Remove compiler warnings for newer gcc.
        - Pages are no longer kmapped by mm/filemap.c::generic_file_write()
          around calls to ->{prepare,commit}_write.  Adapt NTFS appropriately
@@ -1201,11 +1219,11 @@ ToDo/Notes:
          the kernel. We probably want a kernel generic init_address_space()
          function...
        - Drop BKL from ntfs_readdir() after consultation with Al Viro. The
-          only caller of ->readdir() is vfs_readdir() which holds i_sem during
+          only caller of ->readdir() is vfs_readdir() which holds i_mutex
-          the call, and i_sem is sufficient protection against changes in the
+          during the call, and i_mutex is sufficient protection against changes
-          directory inode (including ->i_size).
+          in the directory inode (including ->i_size).
        - Use generic_file_llseek() for directories (as opposed to
-          default_llseek()) as this downs i_sem instead of the BKL which is
+          default_llseek()) as this downs i_mutex instead of the BKL which is
          what we now need for exclusion against ->f_pos changes considering we
          no longer take the BKL in ntfs_readdir().
diff --git a/fs/ntfs/Makefile b/fs/ntfs/Makefile
index d0d45d1c853a..d95fac7fdeb6 100644
--- a/fs/ntfs/Makefile
+++ b/fs/ntfs/Makefile
@@ -6,7 +6,7 @@ ntfs-objs := aops.o attrib.o collate.o compress.o debug.o dir.o file.o \
             index.o inode.o mft.o mst.o namei.o runlist.o super.o sysctl.o \
             unistr.o upcase.o
-EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.25\"
+EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.26\"
 ifeq ($(CONFIG_NTFS_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index 1c0a4315876a..7e361da770b3 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -2,7 +2,7 @@
 * aops.c - NTFS kernel address space operations and page cache handling.
 *          Part of the Linux-NTFS project.
 *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
 * Copyright (c) 2002 Richard Russon
 *
 * This program/include file is free software; you can redistribute it and/or
@@ -200,8 +200,8 @@ static int ntfs_read_block(struct page *page)
        /* $MFT/$DATA must have its complete runlist in memory at all times. */
        BUG_ON(!ni->runlist.rl && !ni->mft_no && !NInoAttr(ni));
-        blocksize_bits = VFS_I(ni)->i_blkbits;
+        blocksize = vol->sb->s_blocksize;
-        blocksize = 1 << blocksize_bits;
+        blocksize_bits = vol->sb->s_blocksize_bits;
        if (!page_has_buffers(page)) {
                create_empty_buffers(page, blocksize, 0);
@@ -569,10 +569,8 @@ static int ntfs_write_block(struct page *page, struct writeback_control *wbc)
        BUG_ON(!NInoNonResident(ni));
        BUG_ON(NInoMstProtected(ni));
+        blocksize = vol->sb->s_blocksize;
-        blocksize_bits = vi->i_blkbits;
+        blocksize_bits = vol->sb->s_blocksize_bits;
-        blocksize = 1 << blocksize_bits;
        if (!page_has_buffers(page)) {
                BUG_ON(!PageUptodate(page));
                create_empty_buffers(page, blocksize,
@@ -949,8 +947,8 @@ static int ntfs_write_mst_block(struct page *page,
         */
        BUG_ON(!(is_mft || S_ISDIR(vi->i_mode) ||
                        (NInoAttr(ni) && ni->type == AT_INDEX_ALLOCATION)));
-        bh_size_bits = vi->i_blkbits;
+        bh_size = vol->sb->s_blocksize;
-        bh_size = 1 << bh_size_bits;
+        bh_size_bits = vol->sb->s_blocksize_bits;
        max_bhs = PAGE_CACHE_SIZE / bh_size;
        BUG_ON(!max_bhs);
        BUG_ON(max_bhs > MAX_BUF_PER_PAGE);
@@ -1596,7 +1594,7 @@ void mark_ntfs_record_dirty(struct page *page, const unsigned int ofs) {
        BUG_ON(!PageUptodate(page));
        end = ofs + ni->itype.index.block_size;
-        bh_size = 1 << VFS_I(ni)->i_blkbits;
+        bh_size = VFS_I(ni)->i_sb->s_blocksize;
        spin_lock(&mapping->private_lock);
        if (unlikely(!page_has_buffers(page))) {
                spin_unlock(&mapping->private_lock);
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index fb413d3d8618..5027d3d1b3fe 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -1,7 +1,7 @@
 /*
 * file.c - NTFS kernel file operations.  Part of the Linux-NTFS project.
 *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
 *
 * This program/include file is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as published
@@ -248,7 +248,7 @@ do_non_resident_extend:
                 * enough to make ntfs_writepage() work.
                 */
                write_lock_irqsave(&ni->size_lock, flags);
-                ni->initialized_size = (index + 1) << PAGE_CACHE_SHIFT;
+                ni->initialized_size = (s64)(index + 1) << PAGE_CACHE_SHIFT;
                if (ni->initialized_size > new_init_size)
                        ni->initialized_size = new_init_size;
                write_unlock_irqrestore(&ni->size_lock, flags);
@@ -529,8 +529,8 @@ static int ntfs_prepare_pages_for_non_resident_write(struct page **pages,
                        "index 0x%lx, nr_pages 0x%x, pos 0x%llx, bytes 0x%zx.",
                        vi->i_ino, ni->type, pages[0]->index, nr_pages,
                        (long long)pos, bytes);
-        blocksize_bits = vi->i_blkbits;
+        blocksize = vol->sb->s_blocksize;
-        blocksize = 1 << blocksize_bits;
+        blocksize_bits = vol->sb->s_blocksize_bits;
        u = 0;
        do {
                struct page *page = pages[u];
@@ -1525,7 +1525,7 @@ static inline int ntfs_commit_pages_after_non_resident_write(
        vi = pages[0]->mapping->host;
        ni = NTFS_I(vi);
-        blocksize = 1 << vi->i_blkbits;
+        blocksize = vi->i_sb->s_blocksize;
        end = pos + bytes;
        u = 0;
        do {
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index ea1bd3feea1b..55263b7de9c0 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -677,13 +677,28 @@ static int ntfs_read_locked_inode(struct inode *vi)
                ntfs_debug("Attribute list found in inode 0x%lx.", vi->i_ino);
                NInoSetAttrList(ni);
                a = ctx->attr;
-                if (a->flags & ATTR_IS_ENCRYPTED ||
+                if (a->flags & ATTR_COMPRESSION_MASK) {
-                                a->flags & ATTR_COMPRESSION_MASK ||
-                                a->flags & ATTR_IS_SPARSE) {
                        ntfs_error(vi->i_sb, "Attribute list attribute is "
-                                        "compressed/encrypted/sparse.");
+                                        "compressed.");
                        goto unm_err_out;
                }
+                if (a->flags & ATTR_IS_ENCRYPTED ||
+                                a->flags & ATTR_IS_SPARSE) {
+                        if (a->non_resident) {
+                                ntfs_error(vi->i_sb, "Non-resident attribute "
+                                                "list attribute is encrypted/"
+                                                "sparse.");
+                                goto unm_err_out;
+                        }
+                        ntfs_warning(vi->i_sb, "Resident attribute list "
+                                        "attribute in inode 0x%lx is marked "
+                                        "encrypted/sparse which is not true.  "
+                                        "However, Windows allows this and "
+                                        "chkdsk does not detect or correct it "
+                                        "so we will just ignore the invalid "
+                                        "flags and pretend they are not set.",
+                                        vi->i_ino);
+                }
                /* Now allocate memory for the attribute list. */
                ni->attr_list_size = (u32)ntfs_attr_size(a);
                ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
@@ -1809,19 +1824,33 @@ int ntfs_read_inode_mount(struct inode *vi)
        } else /* if (!err) */ {
                ATTR_LIST_ENTRY *al_entry, *next_al_entry;
                u8 *al_end;
+                static const char *es = "  Not allowed.  $MFT is corrupt.  "
+                                "You should run chkdsk.";
                ntfs_debug("Attribute list attribute found in $MFT.");
                NInoSetAttrList(ni);
                a = ctx->attr;
-                if (a->flags & ATTR_IS_ENCRYPTED ||
+                if (a->flags & ATTR_COMPRESSION_MASK) {
-                                a->flags & ATTR_COMPRESSION_MASK ||
-                                a->flags & ATTR_IS_SPARSE) {
                        ntfs_error(sb, "Attribute list attribute is "
-                                        "compressed/encrypted/sparse. Not "
+                                        "compressed.%s", es);
-                                        "allowed. $MFT is corrupt. You should "
-                                        "run chkdsk.");
                        goto put_err_out;
                }
+                if (a->flags & ATTR_IS_ENCRYPTED ||
+                                a->flags & ATTR_IS_SPARSE) {
+                        if (a->non_resident) {
+                                ntfs_error(sb, "Non-resident attribute list "
+                                                "attribute is encrypted/"
+                                                "sparse.%s", es);
+                                goto put_err_out;
+                        }
+                        ntfs_warning(sb, "Resident attribute list attribute "
+                                        "in $MFT system file is marked "
+                                        "encrypted/sparse which is not true.  "
+                                        "However, Windows allows this and "
+                                        "chkdsk does not detect or correct it "
+                                        "so we will just ignore the invalid "
+                                        "flags and pretend they are not set.");
+                }
                /* Now allocate memory for the attribute list. */
                ni->attr_list_size = (u32)ntfs_attr_size(a);
                ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
diff --git a/fs/ntfs/layout.h b/fs/ntfs/layout.h
index f5678d5d7919..bb408d4dcbb0 100644
--- a/fs/ntfs/layout.h
+++ b/fs/ntfs/layout.h
@@ -838,15 +838,19 @@ enum {
           F_A_DEVICE, F_A_DIRECTORY, F_A_SPARSE_FILE, F_A_REPARSE_POINT,
           F_A_COMPRESSED, and F_A_ENCRYPTED and preserves the rest.  This mask
           is used to to obtain all flags that are valid for setting. */
        /*
-         * The following flags are only present in the FILE_NAME attribute (in
+         * The following flag is only present in the FILE_NAME attribute (in
         * the field file_attributes).
         */
        FILE_ATTR_DUP_FILE_NAME_INDEX_PRESENT   = const_cpu_to_le32(0x10000000),
        /* Note, this is a copy of the corresponding bit from the mft record,
           telling us whether this is a directory or not, i.e. whether it has
           an index root attribute or not. */
+        /*
+         * The following flag is present both in the STANDARD_INFORMATION
+         * attribute and in the FILE_NAME attribute (in the field
+         * file_attributes).
+         */
        FILE_ATTR_DUP_VIEW_INDEX_PRESENT        = const_cpu_to_le32(0x20000000),
        /* Note, this is a copy of the corresponding bit from the mft record,
           telling us whether this file has a view index present (eg. object id
@@ -1071,9 +1075,15 @@ typedef struct {
                                           modified. */
 /* 20*/ sle64 last_access_time;         /* Time this mft record was last
                                           accessed. */
-/* 28*/ sle64 allocated_size;           /* Byte size of allocated space for the
+/* 28*/ sle64 allocated_size;           /* Byte size of on-disk allocated space
-                                           data attribute. NOTE: Is a multiple
+                                           for the data attribute.  So for
-                                           of the cluster size. */
+                                           normal $DATA, this is the
+                                           allocated_size from the unnamed
+                                           $DATA attribute and for compressed
+                                           and/or sparse $DATA, this is the
+                                           compressed_size from the unnamed
+                                           $DATA attribute.  NOTE: This is a
+                                           multiple of the cluster size. */
 /* 30*/ sle64 data_size;                /* Byte size of actual data in data
                                           attribute. */
 /* 38*/ FILE_ATTR_FLAGS file_attributes;        /* Flags describing the file. */
@@ -1904,12 +1914,13 @@ enum {
        VOLUME_DELETE_USN_UNDERWAY      = const_cpu_to_le16(0x0010),
        VOLUME_REPAIR_OBJECT_ID         = const_cpu_to_le16(0x0020),
+        VOLUME_CHKDSK_UNDERWAY          = const_cpu_to_le16(0x4000),
        VOLUME_MODIFIED_BY_CHKDSK       = const_cpu_to_le16(0x8000),
-        VOLUME_FLAGS_MASK               = const_cpu_to_le16(0x803f),
+        VOLUME_FLAGS_MASK               = const_cpu_to_le16(0xc03f),
        /* To make our life easier when checking if we must mount read-only. */
-        VOLUME_MUST_MOUNT_RO_MASK       = const_cpu_to_le16(0x8027),
+        VOLUME_MUST_MOUNT_RO_MASK       = const_cpu_to_le16(0xc027),
 } __attribute__ ((__packed__));
 typedef le16 VOLUME_FLAGS;
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 0c65cbb8c5cf..6499aafc2258 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
 * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
 *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
 * Copyright (c) 2002 Richard Russon
 *
 * This program/include file is free software; you can redistribute it and/or
@@ -473,7 +473,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
        runlist_element *rl;
        unsigned int block_start, block_end, m_start, m_end, page_ofs;
        int i_bhs, nr_bhs, err = 0;
-        unsigned char blocksize_bits = vol->mftmirr_ino->i_blkbits;
+        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
        ntfs_debug("Entering for inode 0x%lx.", mft_no);
        BUG_ON(!max_bhs);
@@ -672,8 +672,8 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
 {
        ntfs_volume *vol = ni->vol;
        struct page *page = ni->page;
-        unsigned char blocksize_bits = vol->mft_ino->i_blkbits;
+        unsigned int blocksize = vol->sb->s_blocksize;
-        unsigned int blocksize = 1 << blocksize_bits;
+        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
        int max_bhs = vol->mft_record_size / blocksize;
        struct buffer_head *bhs[max_bhs];
        struct buffer_head *bh, *head;
diff --git a/fs/ntfs/ntfs.h b/fs/ntfs/ntfs.h
index 446b5014115c..653d2a5c4899 100644
--- a/fs/ntfs/ntfs.h
+++ b/fs/ntfs/ntfs.h
@@ -50,11 +50,11 @@ typedef enum {
 /* Global variables. */
 /* Slab caches (from super.c). */
-extern kmem_cache_t *ntfs_name_cache;
+extern struct kmem_cache *ntfs_name_cache;
-extern kmem_cache_t *ntfs_inode_cache;
+extern struct kmem_cache *ntfs_inode_cache;
-extern kmem_cache_t *ntfs_big_inode_cache;
+extern struct kmem_cache *ntfs_big_inode_cache;
-extern kmem_cache_t *ntfs_attr_ctx_cache;
+extern struct kmem_cache *ntfs_attr_ctx_cache;
-extern kmem_cache_t *ntfs_index_ctx_cache;
+extern struct kmem_cache *ntfs_index_ctx_cache;
 /* The various operations structs defined throughout the driver files. */
 extern struct address_space_operations ntfs_aops;
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index c3a3f1a8310b..368a8ec10668 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1,7 +1,7 @@
 /*
 * super.c - NTFS kernel super block handling. Part of the Linux-NTFS project.
 *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
 * Copyright (c) 2001,2002 Richard Russon
 *
 * This program/include file is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@
 #include <linux/stddef.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/spinlock.h>
 #include <linux/blkdev.h>       /* For bdev_hardsect_size(). */
@@ -471,9 +472,16 @@ static int ntfs_remount(struct super_block *sb, int *flags, char *opt)
                        ntfs_error(sb, "Volume is dirty and read-only%s", es);
                        return -EROFS;
                }
+                if (vol->vol_flags & VOLUME_MODIFIED_BY_CHKDSK) {
+                        ntfs_error(sb, "Volume has been modified by chkdsk "
+                                        "and is read-only%s", es);
+                        return -EROFS;
+                }
                if (vol->vol_flags & VOLUME_MUST_MOUNT_RO_MASK) {
-                        ntfs_error(sb, "Volume has unsupported flags set and "
+                        ntfs_error(sb, "Volume has unsupported flags set "
-                                        "is read-only%s", es);
+                                        "(0x%x) and is read-only%s",
+                                        (unsigned)le16_to_cpu(vol->vol_flags),
+                                        es);
                        return -EROFS;
                }
                if (ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY)) {
@@ -641,7 +649,7 @@ static struct buffer_head *read_ntfs_boot_sector(struct super_block *sb,
 {
        const char *read_err_str = "Unable to read %s boot sector.";
        struct buffer_head *bh_primary, *bh_backup;
-        long nr_blocks = NTFS_SB(sb)->nr_blocks;
+        sector_t nr_blocks = NTFS_SB(sb)->nr_blocks;
        /* Try to read primary boot sector. */
        if ((bh_primary = sb_bread(sb, 0))) {
@@ -688,13 +696,18 @@ hotfix_primary_boot_sector:
                /*
                 * If we managed to read sector zero and the volume is not
                 * read-only, copy the found, valid backup boot sector to the
-                 * primary boot sector.
+                 * primary boot sector.  Note we only copy the actual boot
+                 * sector structure, not the actual whole device sector as that
+                 * may be bigger and would potentially damage the $Boot system
+                 * file (FIXME: Would be nice to know if the backup boot sector
+                 * on a large sector device contains the whole boot loader or
+                 * just the first 512 bytes).
                 */
                if (!(sb->s_flags & MS_RDONLY)) {
                        ntfs_warning(sb, "Hot-fix: Recovering invalid primary "
                                        "boot sector from backup copy.");
                        memcpy(bh_primary->b_data, bh_backup->b_data,
-                                        sb->s_blocksize);
+                                        NTFS_BLOCK_SIZE);
                        mark_buffer_dirty(bh_primary);
                        sync_dirty_buffer(bh_primary);
                        if (buffer_uptodate(bh_primary)) {
@@ -733,9 +746,13 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
                        vol->sector_size);
        ntfs_debug("vol->sector_size_bits = %i (0x%x)", vol->sector_size_bits,
                        vol->sector_size_bits);
-        if (vol->sector_size != vol->sb->s_blocksize)
+        if (vol->sector_size < vol->sb->s_blocksize) {
-                ntfs_warning(vol->sb, "The boot sector indicates a sector size "
+                ntfs_error(vol->sb, "Sector size (%i) is smaller than the "
-                                "different from the device sector size.");
+                                "device block size (%lu).  This is not "
+                                "supported.  Sorry.", vol->sector_size,
+                                vol->sb->s_blocksize);
+                return FALSE;
+        }
        ntfs_debug("sectors_per_cluster = 0x%x", b->bpb.sectors_per_cluster);
        sectors_per_cluster_bits = ffs(b->bpb.sectors_per_cluster) - 1;
        ntfs_debug("sectors_per_cluster_bits = 0x%x",
@@ -748,16 +765,11 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
        ntfs_debug("vol->cluster_size = %i (0x%x)", vol->cluster_size,
                        vol->cluster_size);
        ntfs_debug("vol->cluster_size_mask = 0x%x", vol->cluster_size_mask);
-        ntfs_debug("vol->cluster_size_bits = %i (0x%x)",
+        ntfs_debug("vol->cluster_size_bits = %i", vol->cluster_size_bits);
-                        vol->cluster_size_bits, vol->cluster_size_bits);
+        if (vol->cluster_size < vol->sector_size) {
-        if (vol->sector_size > vol->cluster_size) {
+                ntfs_error(vol->sb, "Cluster size (%i) is smaller than the "
-                ntfs_error(vol->sb, "Sector sizes above the cluster size are "
+                                "sector size (%i).  This is not supported.  "
-                                "not supported.  Sorry.");
+                                "Sorry.", vol->cluster_size, vol->sector_size);
-                return FALSE;
-        }
-        if (vol->sb->s_blocksize > vol->cluster_size) {
-                ntfs_error(vol->sb, "Cluster sizes smaller than the device "
-                                "sector size are not supported.  Sorry.");
                return FALSE;
        }
        clusters_per_mft_record = b->clusters_per_mft_record;
@@ -786,11 +798,18 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         * we store $MFT/$DATA, the table of mft records in the page cache.
         */
        if (vol->mft_record_size > PAGE_CACHE_SIZE) {
-                ntfs_error(vol->sb, "Mft record size %i (0x%x) exceeds the "
+                ntfs_error(vol->sb, "Mft record size (%i) exceeds the "
-                                "page cache size on your system %lu (0x%lx).  "
+                                "PAGE_CACHE_SIZE on your system (%lu).  "
                                "This is not supported.  Sorry.",
-                                vol->mft_record_size, vol->mft_record_size,
+                                vol->mft_record_size, PAGE_CACHE_SIZE);
-                                PAGE_CACHE_SIZE, PAGE_CACHE_SIZE);
+                return FALSE;
+        }
+        /* We cannot support mft record sizes below the sector size. */
+        if (vol->mft_record_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Mft record size (%i) is smaller than the "
+                                "sector size (%i).  This is not supported.  "
+                                "Sorry.", vol->mft_record_size,
+                                vol->sector_size);
                return FALSE;
        }
        clusters_per_index_record = b->clusters_per_index_record;
@@ -816,6 +835,14 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
        ntfs_debug("vol->index_record_size_bits = %i (0x%x)",
                        vol->index_record_size_bits,
                        vol->index_record_size_bits);
+        /* We cannot support index record sizes below the sector size. */
+        if (vol->index_record_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Index record size (%i) is smaller than "
+                                "the sector size (%i).  This is not "
+                                "supported.  Sorry.", vol->index_record_size,
+                                vol->sector_size);
+                return FALSE;
+        }
        /*
         * Get the size of the volume in clusters and check for 64-bit-ness.
         * Windows currently only uses 32 bits to save the clusters so we do
@@ -845,15 +872,18 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
        }
        ll = sle64_to_cpu(b->mft_lcn);
        if (ll >= vol->nr_clusters) {
-                ntfs_error(vol->sb, "MFT LCN is beyond end of volume.  Weird.");
+                ntfs_error(vol->sb, "MFT LCN (%lli, 0x%llx) is beyond end of "
+                                "volume.  Weird.", (unsigned long long)ll,
+                                (unsigned long long)ll);
                return FALSE;
        }
        vol->mft_lcn = ll;
        ntfs_debug("vol->mft_lcn = 0x%llx", (long long)vol->mft_lcn);
        ll = sle64_to_cpu(b->mftmirr_lcn);
        if (ll >= vol->nr_clusters) {
-                ntfs_error(vol->sb, "MFTMirr LCN is beyond end of volume.  "
+                ntfs_error(vol->sb, "MFTMirr LCN (%lli, 0x%llx) is beyond end "
-                                "Weird.");
+                                "of volume.  Weird.", (unsigned long long)ll,
+                                (unsigned long long)ll);
                return FALSE;
        }
        vol->mftmirr_lcn = ll;
@@ -1822,11 +1852,24 @@ get_ctx_vol_failed:
        /* Make sure that no unsupported volume flags are set. */
        if (vol->vol_flags & VOLUME_MUST_MOUNT_RO_MASK) {
                static const char *es1a = "Volume is dirty";
-                static const char *es1b = "Volume has unsupported flags set";
+                static const char *es1b = "Volume has been modified by chkdsk";
-                static const char *es2 = ".  Run chkdsk and mount in Windows.";
+                static const char *es1c = "Volume has unsupported flags set";
-                const char *es1;
+                static const char *es2a = ".  Run chkdsk and mount in Windows.";
-                
+                static const char *es2b = ".  Mount in Windows.";
-                es1 = vol->vol_flags & VOLUME_IS_DIRTY ? es1a : es1b;
+                const char *es1, *es2;
+                es2 = es2a;
+                if (vol->vol_flags & VOLUME_IS_DIRTY)
+                        es1 = es1a;
+                else if (vol->vol_flags & VOLUME_MODIFIED_BY_CHKDSK) {
+                        es1 = es1b;
+                        es2 = es2b;
+                } else {
+                        es1 = es1c;
+                        ntfs_warning(sb, "Unsupported volume flags 0x%x "
+                                        "encountered.",
+                                        (unsigned)le16_to_cpu(vol->vol_flags));
+                }
                /* If a read-write mount, convert it to a read-only mount. */
                if (!(sb->s_flags & MS_RDONLY)) {
                        if (!(vol->on_errors & (ON_ERRORS_REMOUNT_RO |
@@ -2685,7 +2728,7 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
        ntfs_volume *vol;
        struct buffer_head *bh;
        struct inode *tmp_ino;
-        int result;
+        int blocksize, result;
        ntfs_debug("Entering.");
 #ifndef NTFS_RW
@@ -2724,60 +2767,85 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
        if (!parse_options(vol, (char*)opt))
                goto err_out_now;
+        /* We support sector sizes up to the PAGE_CACHE_SIZE. */
+        if (bdev_hardsect_size(sb->s_bdev) > PAGE_CACHE_SIZE) {
+                if (!silent)
+                        ntfs_error(sb, "Device has unsupported sector size "
+                                        "(%i).  The maximum supported sector "
+                                        "size on this architecture is %lu "
+                                        "bytes.",
+                                        bdev_hardsect_size(sb->s_bdev),
+                                        PAGE_CACHE_SIZE);
+                goto err_out_now;
+        }
        /*
-         * TODO: Fail safety check. In the future we should really be able to
+         * Setup the device access block size to NTFS_BLOCK_SIZE or the hard
-         * cope with this being the case, but for now just bail out.
+         * sector size, whichever is bigger.
         */
-        if (bdev_hardsect_size(sb->s_bdev) > NTFS_BLOCK_SIZE) {
+        blocksize = sb_min_blocksize(sb, NTFS_BLOCK_SIZE);
+        if (blocksize < NTFS_BLOCK_SIZE) {
                if (!silent)
-                        ntfs_error(sb, "Device has unsupported hardsect_size.");
+                        ntfs_error(sb, "Unable to set device block size.");
                goto err_out_now;
        }
+        BUG_ON(blocksize != sb->s_blocksize);
-        /* Setup the device access block size to NTFS_BLOCK_SIZE. */
+        ntfs_debug("Set device block size to %i bytes (block size bits %i).",
-        if (sb_set_blocksize(sb, NTFS_BLOCK_SIZE) != NTFS_BLOCK_SIZE) {
+                        blocksize, sb->s_blocksize_bits);
+        /* Determine the size of the device in units of block_size bytes. */
+        if (!i_size_read(sb->s_bdev->bd_inode)) {
                if (!silent)
-                        ntfs_error(sb, "Unable to set block size.");
+                        ntfs_error(sb, "Unable to determine device size.");
                goto err_out_now;
        }
-        /* Get the size of the device in units of NTFS_BLOCK_SIZE bytes. */
        vol->nr_blocks = i_size_read(sb->s_bdev->bd_inode) >>
-                        NTFS_BLOCK_SIZE_BITS;
+                        sb->s_blocksize_bits;
        /* Read the boot sector and return unlocked buffer head to it. */
        if (!(bh = read_ntfs_boot_sector(sb, silent))) {
                if (!silent)
                        ntfs_error(sb, "Not an NTFS volume.");
                goto err_out_now;
        }
        /*
-         * Extract the data from the boot sector and setup the ntfs super block
+         * Extract the data from the boot sector and setup the ntfs volume
         * using it.
         */
        result = parse_ntfs_boot_sector(vol, (NTFS_BOOT_SECTOR*)bh->b_data);
-        /* Initialize the cluster and mft allocators. */
-        ntfs_setup_allocators(vol);
        brelse(bh);
        if (!result) {
                if (!silent)
                        ntfs_error(sb, "Unsupported NTFS filesystem.");
                goto err_out_now;
        }
        /*
-         * TODO: When we start coping with sector sizes different from
+         * If the boot sector indicates a sector size bigger than the current
-         * NTFS_BLOCK_SIZE, we now probably need to set the blocksize of the
+         * device block size, switch the device block size to the sector size.
-         * device (probably to NTFS_BLOCK_SIZE).
+         * TODO: It may be possible to support this case even when the set
+         * below fails, we would just be breaking up the i/o for each sector
+         * into multiple blocks for i/o purposes but otherwise it should just
+         * work.  However it is safer to leave disabled until someone hits this
+         * error message and then we can get them to try it without the setting
+         * so we know for sure that it works.
         */
+        if (vol->sector_size > blocksize) {
+                blocksize = sb_set_blocksize(sb, vol->sector_size);
+                if (blocksize != vol->sector_size) {
+                        if (!silent)
+                                ntfs_error(sb, "Unable to set device block "
+                                                "size to sector size (%i).",
+                                                vol->sector_size);
+                        goto err_out_now;
+                }
+                BUG_ON(blocksize != sb->s_blocksize);
+                vol->nr_blocks = i_size_read(sb->s_bdev->bd_inode) >>
+                                sb->s_blocksize_bits;
+                ntfs_debug("Changed device block size to %i bytes (block size "
+                                "bits %i) to match volume sector size.",
+                                blocksize, sb->s_blocksize_bits);
+        }
+        /* Initialize the cluster and mft allocators. */
+        ntfs_setup_allocators(vol);
        /* Setup remaining fields in the super block. */
        sb->s_magic = NTFS_SB_MAGIC;
        /*
         * Ntfs allows 63 bits for the file size, i.e. correct would be:
         *      sb->s_maxbytes = ~0ULL >> 1;
@@ -2787,9 +2855,8 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
         * without overflowing the index or to 2^63 - 1, whichever is smaller.
         */
        sb->s_maxbytes = MAX_LFS_FILESIZE;
+        /* Ntfs measures time in 100ns intervals. */
        sb->s_time_gran = 100;
        /*
         * Now load the metadata required for the page cache and our address
         * space operations to function. We do this by setting up a specialised
@@ -2987,14 +3054,14 @@ err_out_now:
 * strings of the maximum length allowed by NTFS, which is NTFS_MAX_NAME_LEN
 * (255) Unicode characters + a terminating NULL Unicode character.
 */
-kmem_cache_t *ntfs_name_cache;
+struct kmem_cache *ntfs_name_cache;
 /* Slab caches for efficient allocation/deallocation of inodes. */
-kmem_cache_t *ntfs_inode_cache;
+struct kmem_cache *ntfs_inode_cache;
-kmem_cache_t *ntfs_big_inode_cache;
+struct kmem_cache *ntfs_big_inode_cache;
 /* Init once constructor for the inode slab cache. */
-static void ntfs_big_inode_init_once(void *foo, kmem_cache_t *cachep,
+static void ntfs_big_inode_init_once(void *foo, struct kmem_cache *cachep,
                unsigned long flags)
 {
        ntfs_inode *ni = (ntfs_inode *)foo;
@@ -3008,8 +3075,8 @@ static void ntfs_big_inode_init_once(void *foo, kmem_cache_t *cachep,
 * Slab caches to optimize allocations and deallocations of attribute search
 * contexts and index contexts, respectively.
 */
-kmem_cache_t *ntfs_attr_ctx_cache;
+struct kmem_cache *ntfs_attr_ctx_cache;
-kmem_cache_t *ntfs_index_ctx_cache;
+struct kmem_cache *ntfs_index_ctx_cache;
 /* Driver wide semaphore. */
 DECLARE_MUTEX(ntfs_lock);
diff --git a/fs/ntfs/upcase.c b/fs/ntfs/upcase.c
index 879cdf1d5bd3..9101807dc81a 100644
--- a/fs/ntfs/upcase.c
+++ b/fs/ntfs/upcase.c
@@ -3,10 +3,7 @@
 *            Part of the Linux-NTFS project.
 *
 * Copyright (c) 2001 Richard Russon <ntfs@flatcap.org>
- * Copyright (c) 2001-2004 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
- *
- * Modified for mkntfs inclusion 9 June 2001 by Anton Altaparmakov.
- * Modified for kernel inclusion 10 September 2001 by Anton Altparmakov.
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the Free
@@ -75,12 +72,13 @@ ntfschar *generate_default_upcase(void)
        if (!uc)
                return uc;
        memset(uc, 0, default_upcase_len * sizeof(ntfschar));
+        /* Generate the little endian Unicode upcase table used by ntfs. */
        for (i = 0; i < default_upcase_len; i++)
                uc[i] = cpu_to_le16(i);
        for (r = 0; uc_run_table[r][0]; r++)
                for (i = uc_run_table[r][0]; i < uc_run_table[r][1]; i++)
-                        uc[i] = cpu_to_le16((le16_to_cpu(uc[i]) +
+                        uc[i] = cpu_to_le16(le16_to_cpu(uc[i]) +
-                                        uc_run_table[r][2]));
+                                        uc_run_table[r][2]);
        for (r = 0; uc_dup_table[r][0]; r++)
                for (i = uc_dup_table[r][0]; i < uc_dup_table[r][1]; i += 2)
                        uc[i + 1] = cpu_to_le16(le16_to_cpu(uc[i + 1]) - 1);
diff --git a/fs/ntfs/volume.h b/fs/ntfs/volume.h
index 375cd20a9f61..406ab55dfb32 100644
--- a/fs/ntfs/volume.h
+++ b/fs/ntfs/volume.h
@@ -2,7 +2,7 @@
 * volume.h - Defines for volume structures in NTFS Linux kernel driver. Part
 *            of the Linux-NTFS project.
 *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
 * Copyright (c) 2002 Richard Russon
 *
 * This program/include file is free software; you can redistribute it and/or
@@ -41,10 +41,8 @@ typedef struct {
         * structure has stabilized... (AIA)
         */
        /* Device specifics. */
-        struct super_block *sb;         /* Pointer back to the super_block,
+        struct super_block *sb;         /* Pointer back to the super_block. */
-                                           so we don't have to get the offset
+        LCN nr_blocks;                  /* Number of sb->s_blocksize bytes
-                                           every time. */
-        LCN nr_blocks;                  /* Number of NTFS_BLOCK_SIZE bytes
                                           sized blocks on the device. */
        /* Configuration provided by user at mount time. */
        unsigned long flags;            /* Miscellaneous flags, see below. */
@@ -141,8 +139,8 @@ typedef enum {
        NV_ShowSystemFiles,     /* 1: Return system files in ntfs_readdir(). */
        NV_CaseSensitive,       /* 1: Treat file names as case sensitive and
                                      create filenames in the POSIX namespace.
-                                      Otherwise be case insensitive and create
+                                      Otherwise be case insensitive but still
-                                      file names in WIN32 namespace. */
+                                      create file names in POSIX namespace. */
        NV_LogFileEmpty,        /* 1: $LogFile journal is empty. */
        NV_QuotaOutOfDate,      /* 1: $Quota is out of date. */
        NV_UsnJrnlStamped,      /* 1: $UsnJrnl has been stamped. */
@@ -153,7 +151,7 @@ typedef enum {
 * Macro tricks to expand the NVolFoo(), NVolSetFoo(), and NVolClearFoo()
 * functions.
 */
-#define NVOL_FNS(flag)                                  \
+#define DEFINE_NVOL_BIT_OPS(flag)                                       \
 static inline int NVol##flag(ntfs_volume *vol)          \
 {                                                       \
        return test_bit(NV_##flag, &(vol)->flags);      \
@@ -168,12 +166,12 @@ static inline void NVolClear##flag(ntfs_volume *vol)	\
 }
 /* Emit the ntfs volume bitops functions. */
-NVOL_FNS(Errors)
+DEFINE_NVOL_BIT_OPS(Errors)
-NVOL_FNS(ShowSystemFiles)
+DEFINE_NVOL_BIT_OPS(ShowSystemFiles)
-NVOL_FNS(CaseSensitive)
+DEFINE_NVOL_BIT_OPS(CaseSensitive)
-NVOL_FNS(LogFileEmpty)
+DEFINE_NVOL_BIT_OPS(LogFileEmpty)
-NVOL_FNS(QuotaOutOfDate)
+DEFINE_NVOL_BIT_OPS(QuotaOutOfDate)
-NVOL_FNS(UsnJrnlStamped)
+DEFINE_NVOL_BIT_OPS(UsnJrnlStamped)
-NVOL_FNS(SparseEnabled)
+DEFINE_NVOL_BIT_OPS(SparseEnabled)
 #endif /* _LINUX_NTFS_VOLUME_H */
diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c
index c66bd5e4c05c..cde5d48994ae 100644
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -27,6 +27,7 @@
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
+#include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/smp_lock.h>
@@ -104,6 +105,7 @@ ramfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
                d_instantiate(dentry, inode);
                dget(dentry);   /* Extra count - pin the dentry in core */
                error = 0;
+                dir->i_mtime = dir->i_ctime = CURRENT_TIME;
        }
        return error;
 }
diff --git a/include/asm-i386/desc.h b/include/asm-i386/desc.h
index 494e73bca095..89b8b82c82b3 100644
--- a/include/asm-i386/desc.h
+++ b/include/asm-i386/desc.h
@@ -24,11 +24,13 @@ struct Xgt_desc_struct {
        unsigned short pad;
 } __attribute__ ((packed));
-extern struct Xgt_desc_struct idt_descr, cpu_gdt_descr[NR_CPUS];
+extern struct Xgt_desc_struct idt_descr;
+DECLARE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
 {
-        return ((struct desc_struct *)cpu_gdt_descr[cpu].address);
+        return (struct desc_struct *)per_cpu(cpu_gdt_descr, cpu).address;
 }
 #define load_TR_desc() __asm__ __volatile__("ltr %w0"::"q" (GDT_ENTRY_TSS*8))
diff --git a/include/asm-i386/kprobes.h b/include/asm-i386/kprobes.h
index 27cac050a60e..a0d2d74a7dda 100644
--- a/include/asm-i386/kprobes.h
+++ b/include/asm-i386/kprobes.h
@@ -27,6 +27,9 @@
 #include <linux/types.h>
 #include <linux/ptrace.h>
+#define  __ARCH_WANT_KPROBES_INSN_SLOT
+struct kprobe;
 struct pt_regs;
 typedef u8 kprobe_opcode_t;
@@ -40,14 +43,14 @@ typedef u8 kprobe_opcode_t;
 #define JPROBE_ENTRY(pentry)    (kprobe_opcode_t *)pentry
 #define ARCH_SUPPORTS_KRETPROBES
-#define arch_remove_kprobe(p)   do {} while (0)
+void arch_remove_kprobe(struct kprobe *p);
 void kretprobe_trampoline(void);
 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
        /* copy of the original instruction */
-        kprobe_opcode_t insn[MAX_INSN_SIZE];
+        kprobe_opcode_t *insn;
 };
 struct prev_kprobe {
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index 0da7c47d2f01..e8ae61956a51 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -328,7 +328,7 @@ extern void __put_user_bad(void);
                "       .long 1b,4b\n"                                  \
                "       .long 2b,4b\n"                                  \
                ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                             \
                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                : "r14", "memory")
@@ -353,7 +353,7 @@ extern void __put_user_bad(void);
                "       .long 1b,4b\n"                                  \
                "       .long 2b,4b\n"                                  \
                ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                            \
                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                : "r14", "memory")
 #else
@@ -398,7 +398,7 @@ struct __large_struct { unsigned long buf[100]; };
                "       .balign 4\n"                                    \
                "       .long 1b,3b\n"                                  \
                ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                            \
                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                : "r14", "memory")
@@ -442,7 +442,7 @@ do {									\
                "       .balign 4\n"                                    \
                "       .long 1b,3b\n"                                  \
                ".previous"                                             \
-                : "=r"(err), "=&r"(x)                                   \
+                : "=&r"(err), "=&r"(x)                                  \
                : "r"(addr), "i"(-EFAULT), "0"(err)                     \
                : "r14", "memory")
diff --git a/include/asm-powerpc/cputable.h b/include/asm-powerpc/cputable.h
index 64210549f56b..90d005bb4d1c 100644
--- a/include/asm-powerpc/cputable.h
+++ b/include/asm-powerpc/cputable.h
@@ -159,9 +159,11 @@ extern void do_cpu_ftr_fixups(unsigned long offset);
 #endif
 /* We need to mark all pages as being coherent if we're SMP or we
- * have a 74[45]x and an MPC107 host bridge.
+ * have a 74[45]x and an MPC107 host bridge. Also 83xx requires
+ * it for PCI "streaming/prefetch" to work properly.
 */
-#if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE)
+#if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE) \
+        || defined(CONFIG_PPC_83xx)
 #define CPU_FTR_COMMON                  CPU_FTR_NEED_COHERENT
 #else
 #define CPU_FTR_COMMON                  0
@@ -277,7 +279,8 @@ enum {
        CPU_FTRS_G2_LE = CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_MAYBE_CAN_DOZE |
            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
        CPU_FTRS_E300 = CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_MAYBE_CAN_DOZE |
-            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
+            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS |
+            CPU_FTR_COMMON,
        CPU_FTRS_CLASSIC32 = CPU_FTR_COMMON | CPU_FTR_SPLIT_ID_CACHE |
            CPU_FTR_USE_TB | CPU_FTR_HPTE_TABLE,
        CPU_FTRS_POWER3_32 = CPU_FTR_COMMON | CPU_FTR_SPLIT_ID_CACHE |
diff --git a/include/asm-powerpc/mmu.h b/include/asm-powerpc/mmu.h
index d096d9e76ad7..b0b9a3f8cdc2 100644
--- a/include/asm-powerpc/mmu.h
+++ b/include/asm-powerpc/mmu.h
@@ -112,6 +112,7 @@ typedef struct {
 } hpte_t;
 extern hpte_t *htab_address;
+extern unsigned long htab_size_bytes;
 extern unsigned long htab_hash_mask;
 /*
diff --git a/include/asm-powerpc/reg.h b/include/asm-powerpc/reg.h
index 12ecc9b9f285..72bfe3af0460 100644
--- a/include/asm-powerpc/reg.h
+++ b/include/asm-powerpc/reg.h
@@ -615,27 +615,9 @@
 #define proc_trap()     asm volatile("trap")
 #ifdef CONFIG_PPC64
-static inline void ppc64_runlatch_on(void)
-{
+extern void ppc64_runlatch_on(void);
-        unsigned long ctrl;
+extern void ppc64_runlatch_off(void);
-        if (cpu_has_feature(CPU_FTR_CTRL)) {
-                ctrl = mfspr(SPRN_CTRLF);
-                ctrl |= CTRL_RUNLATCH;
-                mtspr(SPRN_CTRLT, ctrl);
-        }
-}
-static inline void ppc64_runlatch_off(void)
-{
-        unsigned long ctrl;
-        if (cpu_has_feature(CPU_FTR_CTRL)) {
-                ctrl = mfspr(SPRN_CTRLF);
-                ctrl &= ~CTRL_RUNLATCH;
-                mtspr(SPRN_CTRLT, ctrl);
-        }
-}
 extern unsigned long scom970_read(unsigned int address);
 extern void scom970_write(unsigned int address, unsigned long value);
@@ -645,15 +627,6 @@ extern void scom970_write(unsigned int address, unsigned long value);
 #define __get_SP()      ({unsigned long sp; \
                        asm volatile("mr %0,1": "=r" (sp)); sp;})
-#else /* __ASSEMBLY__ */
-#define RUNLATCH_ON(REG)                        \
-BEGIN_FTR_SECTION                               \
-        mfspr   (REG),SPRN_CTRLF;               \
-        ori     (REG),(REG),CTRL_RUNLATCH;      \
-        mtspr   SPRN_CTRLT,(REG);               \
-END_FTR_SECTION_IFSET(CPU_FTR_CTRL)
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_REG_H */
diff --git a/include/asm-powerpc/thread_info.h b/include/asm-powerpc/thread_info.h
index c044ec16a879..237fc2b72974 100644
--- a/include/asm-powerpc/thread_info.h
+++ b/include/asm-powerpc/thread_info.h
@@ -113,7 +113,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_POLLING_NRFLAG      4       /* true if poll_idle() is polling
                                           TIF_NEED_RESCHED */
 #define TIF_32BIT               5       /* 32 bit binary */
-/* #define SPARE                6 */
+#define TIF_RUNLATCH            6       /* Is the runlatch enabled? */
 #define TIF_ABI_PENDING         7       /* 32/64 bit switch needed */
 #define TIF_SYSCALL_AUDIT       8       /* syscall auditing active */
 #define TIF_SINGLESTEP          9       /* singlestepping active */
@@ -131,7 +131,7 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_32BIT              (1<<TIF_32BIT)
-/* #define _SPARE               (1<<SPARE) */
+#define _TIF_RUNLATCH           (1<<TIF_RUNLATCH)
 #define _TIF_ABI_PENDING        (1<<TIF_ABI_PENDING)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
 #define _TIF_SINGLESTEP         (1<<TIF_SINGLESTEP)
diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
index 6a332a9f099c..0caf60147e97 100644
--- a/include/asm-sparc64/futex.h
+++ b/include/asm-sparc64/futex.h
@@ -1,6 +1,86 @@
-#ifndef _ASM_FUTEX_H
+#ifndef _SPARC64_FUTEX_H
-#define _ASM_FUTEX_H
+#define _SPARC64_FUTEX_H
-#include <asm-generic/futex.h>
+#include <linux/futex.h>
+#include <asm/errno.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
-#endif
+#define __futex_cas_op(insn, ret, oldval, uaddr, oparg) \
+        __asm__ __volatile__(                           \
+        "\n1:   lduwa   [%3] %%asi, %2\n"               \
+        "       " insn "\n"                             \
+        "2:     casa    [%3] %%asi, %2, %1\n"           \
+        "       cmp     %2, %1\n"                       \
+        "       bne,pn  %%icc, 1b\n"                    \
+        "        mov    0, %0\n"                        \
+        "3:\n"                                          \
+        "       .section .fixup,#alloc,#execinstr\n"    \
+        "       .align  4\n"                            \
+        "4:     ba      3b\n"                           \
+        "        mov    %5, %0\n"                       \
+        "       .previous\n"                            \
+        "       .section __ex_table,#alloc\n"           \
+        "       .align  4\n"                            \
+        "       .word   1b, 4b\n"                       \
+        "       .word   2b, 4b\n"                       \
+        "       .previous\n"                            \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tem)      \
+        : "r" (uaddr), "r" (oparg), "i" (-EFAULT)       \
+        : "memory")
+static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
+{
+        int op = (encoded_op >> 28) & 7;
+        int cmp = (encoded_op >> 24) & 15;
+        int oparg = (encoded_op << 8) >> 20;
+        int cmparg = (encoded_op << 20) >> 20;
+        int oldval = 0, ret, tem;
+        if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(int))))
+                return -EFAULT;
+        if (unlikely((((unsigned long) uaddr) & 0x3UL)))
+                return -EINVAL;
+        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
+                oparg = 1 << oparg;
+        inc_preempt_count();
+        switch (op) {
+        case FUTEX_OP_SET:
+                __futex_cas_op("mov\t%4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_ADD:
+                __futex_cas_op("add\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_OR:
+                __futex_cas_op("or\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_ANDN:
+                __futex_cas_op("and\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_XOR:
+                __futex_cas_op("xor\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        default:
+                ret = -ENOSYS;
+        }
+        dec_preempt_count();
+        if (!ret) {
+                switch (cmp) {
+                case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
+                case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
+                case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
+                case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
+                case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
+                case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
+                default: ret = -ENOSYS;
+                }
+        }
+        return ret;
+}
+#endif /* !(_SPARC64_FUTEX_H) */
diff --git a/include/asm-sparc64/smp.h b/include/asm-sparc64/smp.h
index 110a2de89123..473edb2603ec 100644
--- a/include/asm-sparc64/smp.h
+++ b/include/asm-sparc64/smp.h
@@ -66,8 +66,14 @@ static __inline__ int hard_smp_processor_id(void)
 #define raw_smp_processor_id() (current_thread_info()->cpu)
+extern void smp_setup_cpu_possible_map(void);
 #endif /* !(__ASSEMBLY__) */
+#else
+#define smp_setup_cpu_possible_map() do { } while (0)
 #endif /* !(CONFIG_SMP) */
 #define NO_PROC_ID              0xFF
diff --git a/include/asm-x86_64/acpi.h b/include/asm-x86_64/acpi.h
index aa1c7b2e438c..e2b9923189a0 100644
--- a/include/asm-x86_64/acpi.h
+++ b/include/asm-x86_64/acpi.h
@@ -164,6 +164,20 @@ extern u8 x86_acpiid_to_apicid[];
 extern int acpi_skip_timer_override;
+extern int unsync_tsc_on_multicluster;
+static inline int acpi_madt_oem_check(char *oem, char *productid) 
+{ 
+        /* Copied from i386. Probably has too many entries. */
+        if (!strncmp(oem, "IBM ENSW", 8) && 
+                (!strncmp(productid, "VIGIL SMP", 9) 
+                        || !strncmp(productid, "EXA", 3)
+                        || !strncmp(productid, "RUTHLESS SMP", 12))) {
+                unsync_tsc_on_multicluster = 1;
+        }
+        return 0;
+}
 #endif /*__KERNEL__*/
 #endif /*_ASM_ACPI_H*/
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index fd03e15d7ea6..8a05af264d18 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -19,8 +19,6 @@ extern unsigned int pcibios_assign_all_busses(void);
 #endif
 #define pcibios_scan_all_fns(a, b)      0
-extern int no_iommu, force_iommu;
 extern unsigned long pci_mem_start;
 #define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
diff --git a/include/asm-x86_64/pgtable.h b/include/asm-x86_64/pgtable.h
index 8fbf4dd72115..715fd94cf577 100644
--- a/include/asm-x86_64/pgtable.h
+++ b/include/asm-x86_64/pgtable.h
@@ -131,7 +131,7 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, unsigned long
 #define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
-#define USER_PTRS_PER_PGD       (TASK_SIZE/PGDIR_SIZE)
+#define USER_PTRS_PER_PGD       ((TASK_SIZE-1)/PGDIR_SIZE+1)
 #define FIRST_USER_ADDRESS      0
 #ifndef __ASSEMBLY__
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index eca3f2d633db..3ba8fd45fcb3 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -39,7 +39,6 @@ extern void config_acpi_tables(void);
 extern void ia32_syscall(void);
 extern void iommu_hole_init(void);
-extern void time_init_gtod(void);
 extern int pmtimer_mark_offset(void);
 extern void pmtimer_resume(void);
 extern void pmtimer_wait(unsigned);
@@ -134,6 +133,7 @@ extern int force_iommu;
 extern int reboot_force;
 extern int notsc_setup(char *);
+extern int setup_additional_cpus(char *);
 extern void smp_local_timer_interrupt(struct pt_regs * regs);
diff --git a/include/linux/serial_reg.h b/include/linux/serial_reg.h
index 6a2bb955844b..3c8a6aa77415 100644
--- a/include/linux/serial_reg.h
+++ b/include/linux/serial_reg.h
@@ -247,10 +247,10 @@
 #define UART_CTR        0xFF
 /*
- * The 16C950 Additional Control Reigster
+ * The 16C950 Additional Control Register
 */
 #define UART_ACR_RXDIS  0x01    /* Receiver disable */
-#define UART_ACR_TXDIS  0x02    /* Receiver disable */
+#define UART_ACR_TXDIS  0x02    /* Transmitter disable */
 #define UART_ACR_DSRFC  0x04    /* DSR Flow Control */
 #define UART_ACR_TLENB  0x20    /* 950 trigger levels enable */
 #define UART_ACR_ICRRD  0x40    /* ICR Read enable */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index d73501ba7e44..b9ea44ac0ddb 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -543,7 +543,7 @@ asmlinkage long sys_unlinkat(int dfd, const char __user * pathname, int flag);
 asmlinkage long sys_symlinkat(const char __user * oldname,
                              int newdfd, const char __user * newname);
 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
-                           int newdfd, const char __user *newname);
+                           int newdfd, const char __user *newname, int flags);
 asmlinkage long sys_renameat(int olddfd, const char __user * oldname,
                             int newdfd, const char __user * newname);
 asmlinkage long sys_futimesat(int dfd, char __user *filename,
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index d6111a2f0a23..004e645f3e18 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -403,6 +403,11 @@ unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short f
 extern void __xfrm_state_destroy(struct xfrm_state *);
+static inline void __xfrm_state_put(struct xfrm_state *x)
+{
+        atomic_dec(&x->refcnt);
+}
 static inline void xfrm_state_put(struct xfrm_state *x)
 {
        if (atomic_dec_and_test(&x->refcnt))
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 880831bd3003..67af4cea1e23 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -552,7 +552,7 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
         */
        if ((flags & MPOL_MF_MOVE_ALL) || page_mapcount(page) == 1) {
                if (isolate_lru_page(page))
-                        list_add(&page->lru, pagelist);
+                        list_add_tail(&page->lru, pagelist);
        }
 }
@@ -569,6 +569,7 @@ static int migrate_pages_to(struct list_head *pagelist,
        LIST_HEAD(moved);
        LIST_HEAD(failed);
        int err = 0;
+        unsigned long offset = 0;
        int nr_pages;
        struct page *page;
        struct list_head *p;
@@ -576,8 +577,21 @@ static int migrate_pages_to(struct list_head *pagelist,
 redo:
        nr_pages = 0;
        list_for_each(p, pagelist) {
-                if (vma)
+                if (vma) {
-                        page = alloc_page_vma(GFP_HIGHUSER, vma, vma->vm_start);
+                        /*
+                         * The address passed to alloc_page_vma is used to
+                         * generate the proper interleave behavior. We fake
+                         * the address here by an increasing offset in order
+                         * to get the proper distribution of pages.
+                         *
+                         * No decision has been made as to which page
+                         * a certain old page is moved to so we cannot
+                         * specify the correct address.
+                         */
+                        page = alloc_page_vma(GFP_HIGHUSER, vma,
+                                        offset + vma->vm_start);
+                        offset += PAGE_SIZE;
+                }
                else
                        page = alloc_pages_node(dest, GFP_HIGHUSER, 0);
@@ -585,7 +599,7 @@ redo:
                        err = -ENOMEM;
                        goto out;
                }
-                list_add(&page->lru, &newlist);
+                list_add_tail(&page->lru, &newlist);
                nr_pages++;
                if (nr_pages > MIGRATE_CHUNK_SIZE)
                        break;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 1838c15ca4fd..b0af7593d01e 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1908,7 +1908,12 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                sc.swap_cluster_max = SWAP_CLUSTER_MAX;
        cond_resched();
-        p->flags |= PF_MEMALLOC;
+        /*
+         * We need to be able to allocate from the reserves for RECLAIM_SWAP
+         * and we also need to be able to write out pages for RECLAIM_WRITE
+         * and RECLAIM_SWAP.
+         */
+        p->flags |= PF_MEMALLOC | PF_SWAPWRITE;
        reclaim_state.reclaimed_slab = 0;
        p->reclaim_state = &reclaim_state;
@@ -1932,11 +1937,10 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                 * a long time.
                 */
                shrink_slab(sc.nr_scanned, gfp_mask, order);
-                sc.nr_reclaimed = 1;    /* Avoid getting the off node timeout */
        }
        p->reclaim_state = NULL;
-        current->flags &= ~PF_MEMALLOC;
+        current->flags &= ~(PF_MEMALLOC | PF_SWAPWRITE);
        if (sc.nr_reclaimed == 0)
                zone->last_unsuccessful_zone_reclaim = jiffies;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 6bb0c7eb1ef0..e060aad8624d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -90,6 +90,7 @@ static struct rtable __fake_rtable = {
                        .dev                    = &__fake_net_device,
                        .path                   = &__fake_rtable.u.dst,
                        .metrics                = {[RTAX_MTU - 1] = 1500},
+                        .flags                  = DST_NOXFRM,
                }
        },
        .rt_flags       = 0,
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 9890fd97e538..c971f14712ec 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -95,6 +95,12 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                saddr = dev->dev_addr;
        memcpy(eth->h_source,saddr,dev->addr_len);
+        if(daddr)
+        {
+                memcpy(eth->h_dest,daddr,dev->addr_len);
+                return ETH_HLEN;
+        }
+        
        /*
         *      Anyway, the loopback-device should never use this function... 
         */
@@ -105,12 +111,6 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                return ETH_HLEN;
        }
        
-        if(daddr)
-        {
-                memcpy(eth->h_dest,daddr,dev->addr_len);
-                return ETH_HLEN;
-        }
-        
        return -ETH_HLEN;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d82c242ea704..fca5fe0cf94a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -835,7 +835,7 @@ static int rt_garbage_collect(void)
                                        int r;
                                        rthp = rt_remove_balanced_route(
-                                                &rt_hash_table[i].chain,
+                                                &rt_hash_table[k].chain,
                                                rth,
                                                &r);
                                        goal -= r;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 45f7ae58f2c0..f285bbf296e2 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -35,6 +35,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
                    xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                    xdst->u.rt.fl.fl4_src == fl->fl4_src &&
+                    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
                    xfrm_bundle_ok(xdst, fl, AF_INET)) {
                        dst_clone(dst);
                        break;
@@ -61,7 +62,8 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                .nl_u = {
                        .ip4_u = {
                                .saddr = local,
-                                .daddr = remote
+                                .daddr = remote,
+                                .tos = fl->fl4_tos
                        }
                }
        };
@@ -230,6 +232,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
        fl->proto = iph->protocol;
        fl->fl4_dst = iph->daddr;
        fl->fl4_src = iph->saddr;
+        fl->fl4_tos = iph->tos;
 }
 static inline int xfrm4_garbage_collect(void)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index efa3e72cfcfa..f999edd846a9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -494,6 +494,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        struct net_device *dev;
        struct sk_buff *frag;
        struct rt6_info *rt = (struct rt6_info*)skb->dst;
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
        struct ipv6hdr *tmp_hdr;
        struct frag_hdr *fh;
        unsigned int mtu, hlen, left, len;
@@ -505,7 +506,12 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        hlen = ip6_find_1stfragopt(skb, &prevhdr);
        nexthdr = *prevhdr;
-        mtu = dst_mtu(&rt->u.dst) - hlen - sizeof(struct frag_hdr);
+        mtu = dst_mtu(&rt->u.dst);
+        if (np && np->frag_size < mtu) {
+                if (np->frag_size)
+                        mtu = np->frag_size;
+        }
+        mtu -= hlen + sizeof(struct frag_hdr);
        if (skb_shinfo(skb)->frag_list) {
                int first_len = skb_pagelen(skb);
@@ -882,7 +888,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                inet->cork.fl = *fl;
                np->cork.hop_limit = hlimit;
                np->cork.tclass = tclass;
-                inet->cork.fragsize = mtu = dst_mtu(rt->u.dst.path);
+                mtu = dst_mtu(rt->u.dst.path);
+                if (np && np->frag_size < mtu) {
+                        if (np->frag_size)
+                                mtu = np->frag_size;
+                }
+                inet->cork.fragsize = mtu;
                if (dst_allfrag(rt->u.dst.path))
                        inet->cork.flags |= IPCORK_ALLFRAG;
                inet->cork.length = 0;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index faea8a120ee2..48597538db3f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -884,6 +884,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
        t->parms.encap_limit = p->encap_limit;
        t->parms.flowinfo = p->flowinfo;
        t->parms.link = p->link;
+        ip6_tnl_dst_reset(t);
        ip6ip6_tnl_link_config(t);
        return 0;
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ae86d237a456..b2d4d1dd2116 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1423,7 +1423,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
        if (err < 0) {
                x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                goto out;
        }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5e6b05ac1260..8206025d8e46 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -782,7 +782,7 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
        int nx = 0;
        int err;
        u32 genid;
-        u16 family = dst_orig->ops->family;
+        u16 family;
        u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
        u32 sk_sid = security_sk_sid(sk, fl, dir);
 restart:
@@ -796,13 +796,14 @@ restart:
                if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
                        return 0;
-                policy = flow_cache_lookup(fl, sk_sid, family, dir,
+                policy = flow_cache_lookup(fl, sk_sid, dst_orig->ops->family,
-                                           xfrm_policy_lookup);
+                                           dir, xfrm_policy_lookup);
        }
        if (!policy)
                return 0;
+        family = dst_orig->ops->family;
        policy->curlft.use_time = (unsigned long)xtime.tv_sec;
        switch (policy->action) {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e12d0be5f976..c656cbaf35e8 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -220,14 +220,14 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                x->km.state = XFRM_STATE_DEAD;
                spin_lock(&xfrm_state_lock);
                list_del(&x->bydst);
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                if (x->id.spi) {
                        list_del(&x->byspi);
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
                }
                spin_unlock(&xfrm_state_lock);
                if (del_timer(&x->timer))
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
                /* The number two in this test is the reference
                 * mentioned in the comment below plus the reference
@@ -243,7 +243,7 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                 * The xfrm_state_alloc call gives a reference, and that
                 * is what we are dropping here.
                 */
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                err = 0;
        }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ac87a09ba83e..7de17559249a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -345,7 +345,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
        if (err < 0) {
                x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                goto out;
        }
diff --git a/sound/drivers/opl3/opl3_oss.c b/sound/drivers/opl3/opl3_oss.c
index 31f1f2e25aa0..0345ae647681 100644
--- a/sound/drivers/opl3/opl3_oss.c
+++ b/sound/drivers/opl3/opl3_oss.c
@@ -146,7 +146,7 @@ void snd_opl3_init_seq_oss(struct snd_opl3 *opl3, char *name)
 void snd_opl3_free_seq_oss(struct snd_opl3 *opl3)
 {
        if (opl3->oss_seq_dev) {
-                snd_device_free(opl3->card, opl3->oss_seq_dev);
+                /* The instance should have been released in prior */
                opl3->oss_seq_dev = NULL;
        }
 }
diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
index 4fa431040564..99a42138bea0 100644
--- a/sound/isa/cs423x/cs4236.c
+++ b/sound/isa/cs423x/cs4236.c
@@ -414,7 +414,7 @@ static int __devinit snd_card_cs423x_pnpc(int dev, struct snd_card_cs4236 *acard
        }
        /* MPU initialization */
        if (acard->mpu && mpu_port[dev] > 0) {
-                if (snd_cs423x_pnp_init_mpu(dev, acard->ctrl, cfg) < 0)
+                if (snd_cs423x_pnp_init_mpu(dev, acard->mpu, cfg) < 0)
                        goto error;
        }
        kfree(cfg);