160 files changed, 1886 insertions, 1203 deletions
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 6e92ba61f7c0..914119309ddb 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -79,6 +79,7 @@ parameter is applicable:
                        Documentation/scsi/.
        SELINUX SELinux support is enabled.
        SERIAL  Serial support is enabled.
+        SH      SuperH architecture is enabled.
        SMP     The kernel is an SMP kernel.
        SPARC   Sparc architecture is enabled.
        SWSUSP  Software suspend is enabled.
@@ -485,7 +486,7 @@ and is between 256 and 4096 characters. It is defined in the file
        dtc3181e=       [HW,SCSI]
-        earlyprintk=    [IA-32,X86-64]
+        earlyprintk=    [IA-32,X86-64,SH]
                        earlyprintk=vga
                        earlyprintk=serial[,ttySn[,baudrate]]
@@ -1784,7 +1785,7 @@ and is between 256 and 4096 characters. It is defined in the file
        usbhid.mousepoll=
                        [USBHID] The interval which mice are to be polled at.
-        vdso=           [IA-32]
+        vdso=           [IA-32,SH]
                        vdso=1: enable VDSO (default)
                        vdso=0: disable VDSO mapping
diff --git a/Documentation/sparse.txt b/Documentation/sparse.txt
index f9c99c9a54f9..1a3bdc27d95e 100644
--- a/Documentation/sparse.txt
+++ b/Documentation/sparse.txt
@@ -45,11 +45,15 @@ special.
 Getting sparse
 ~~~~~~~~~~~~~~
-With git, you can just get it from
+You can get latest released versions from the Sparse homepage at
+http://www.kernel.org/pub/linux/kernel/people/josh/sparse/
-        rsync://rsync.kernel.org/pub/scm/devel/sparse/sparse.git
+Alternatively, you can get snapshots of the latest development version
+of sparse using git to clone..
-and DaveJ has tar-balls at
+        git://git.kernel.org/pub/scm/linux/kernel/git/josh/sparse.git
+DaveJ has hourly generated tarballs of the git tree available at..
        http://www.codemonkey.org.uk/projects/git-snapshots/sparse/
diff --git a/arch/avr32/kernel/ptrace.c b/arch/avr32/kernel/ptrace.c
index f2e81cd79002..6f4388f7c20b 100644
--- a/arch/avr32/kernel/ptrace.c
+++ b/arch/avr32/kernel/ptrace.c
@@ -313,7 +313,7 @@ asmlinkage void do_debug_priv(struct pt_regs *regs)
                __mtdr(DBGREG_DC, dc);
                ti = current_thread_info();
-                ti->flags |= _TIF_BREAKPOINT;
+                set_ti_thread_flag(ti, TIF_BREAKPOINT);
                /* The TLB miss handlers don't check thread flags */
                if ((regs->pc >= (unsigned long)&itlb_miss)
@@ -328,7 +328,7 @@ asmlinkage void do_debug_priv(struct pt_regs *regs)
                 * single step.
                 */
                if ((regs->sr & MODE_MASK) != MODE_SUPERVISOR)
-                        ti->flags |= TIF_SINGLE_STEP;
+                        set_ti_thread_flag(ti, TIF_SINGLE_STEP);
        } else {
                panic("Unable to handle debug trap at pc = %08lx\n",
                      regs->pc);
diff --git a/arch/avr32/kernel/traps.c b/arch/avr32/kernel/traps.c
index 7e803f4d7a12..adc01a12d154 100644
--- a/arch/avr32/kernel/traps.c
+++ b/arch/avr32/kernel/traps.c
@@ -49,39 +49,45 @@ out:
        return;
 }
+static inline int valid_stack_ptr(struct thread_info *tinfo, unsigned long p)
+{
+        return (p > (unsigned long)tinfo)
+                && (p < (unsigned long)tinfo + THREAD_SIZE - 3);
+}
 #ifdef CONFIG_FRAME_POINTER
 static inline void __show_trace(struct task_struct *tsk, unsigned long *sp,
                                struct pt_regs *regs)
 {
-        unsigned long __user *fp;
+        unsigned long lr, fp;
-        unsigned long __user *last_fp = NULL;
+        struct thread_info *tinfo;
-        if (regs) {
+        tinfo = (struct thread_info *)
-                fp = (unsigned long __user *)regs->r7;
+                ((unsigned long)sp & ~(THREAD_SIZE - 1));
-        } else if (tsk == current) {
-                register unsigned long __user *real_fp __asm__("r7");
+        if (regs)
-                fp = real_fp;
+                fp = regs->r7;
-        } else {
+        else if (tsk == current)
-                fp = (unsigned long __user *)tsk->thread.cpu_context.r7;
+                asm("mov %0, r7" : "=r"(fp));
-        }
+        else
+                fp = tsk->thread.cpu_context.r7;
        /*
-         * Walk the stack until (a) we get an exception, (b) the frame
+         * Walk the stack as long as the frame pointer (a) is within
-         * pointer becomes zero, or (c) the frame pointer gets stuck
+         * the kernel stack of the task, and (b) it doesn't move
-         * at the same value.
+         * downwards.
         */
-        while (fp && fp != last_fp) {
+        while (valid_stack_ptr(tinfo, fp)) {
-                unsigned long lr, new_fp = 0;
+                unsigned long new_fp;
-                last_fp = fp;
-                if (__get_user(lr, fp))
-                        break;
-                if (fp && __get_user(new_fp, fp + 1))
-                        break;
-                fp = (unsigned long __user *)new_fp;
+                lr = *(unsigned long *)fp;
                printk(" [<%08lx>] ", lr);
                print_symbol("%s\n", lr);
+                new_fp = *(unsigned long *)(fp + 4);
+                if (new_fp <= fp)
+                        break;
+                fp = new_fp;
        }
        printk("\n");
 }
diff --git a/arch/avr32/mach-at32ap/at32ap7000.c b/arch/avr32/mach-at32ap/at32ap7000.c
index bc235507c5c7..472703f90c22 100644
--- a/arch/avr32/mach-at32ap/at32ap7000.c
+++ b/arch/avr32/mach-at32ap/at32ap7000.c
@@ -752,7 +752,7 @@ static struct resource atmel_spi1_resource[] = {
 DEFINE_DEV(atmel_spi, 1);
 DEV_CLK(spi_clk, atmel_spi1, pba, 1);
-static void
+static void __init
 at32_spi_setup_slaves(unsigned int bus_num, struct spi_board_info *b,
                      unsigned int n, const u8 *pins)
 {
diff --git a/arch/avr32/mm/cache.c b/arch/avr32/mm/cache.c
index fb13f72e9a02..8f7b1c3cd0f9 100644
--- a/arch/avr32/mm/cache.c
+++ b/arch/avr32/mm/cache.c
@@ -121,9 +121,8 @@ void flush_icache_range(unsigned long start, unsigned long end)
 void flush_icache_page(struct vm_area_struct *vma, struct page *page)
 {
        if (vma->vm_flags & VM_EXEC) {
-                void *v = kmap(page);
+                void *v = page_address(page);
                __flush_icache_range((unsigned long)v, (unsigned long)v + PAGE_SIZE);
-                kunmap(v);
        }
 }
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index e5eb97a910ed..9ea5b8ecc7e1 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -1072,7 +1072,28 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
                               "ASUS A7V ACPI BIOS Revision 1007"),
                     },
         },
+        {
+                /*
+                 * Latest BIOS for IBM 600E (1.16) has bad pcinum
+                 * for LPC bridge, which is needed for the PCI
+                 * interrupt links to work. DSDT fix is in bug 5966.
+                 * 2645, 2646 model numbers are shared with 600/600E/600X
+                 */
+         .callback = disable_acpi_irq,
+         .ident = "IBM Thinkpad 600 Series 2645",
+         .matches = {
+                     DMI_MATCH(DMI_BOARD_VENDOR, "IBM"),
+                     DMI_MATCH(DMI_BOARD_NAME, "2645"),
+                     },
+         },
+        {
+         .callback = disable_acpi_irq,
+         .ident = "IBM Thinkpad 600 Series 2646",
+         .matches = {
+                     DMI_MATCH(DMI_BOARD_VENDOR, "IBM"),
+                     DMI_MATCH(DMI_BOARD_NAME, "2646"),
+                     },
+         },
        /*
         * Boxes that need ACPI PCI IRQ routing and PCI scan disabled
         */
diff --git a/arch/i386/kernel/acpi/earlyquirk.c b/arch/i386/kernel/acpi/earlyquirk.c
index bf86f7662d8b..a7d22d9f3d7e 100644
--- a/arch/i386/kernel/acpi/earlyquirk.c
+++ b/arch/i386/kernel/acpi/earlyquirk.c
@@ -14,11 +14,8 @@
 #ifdef CONFIG_ACPI
-static int nvidia_hpet_detected __initdata;
 static int __init nvidia_hpet_check(struct acpi_table_header *header)
 {
-        nvidia_hpet_detected = 1;
        return 0;
 }
 #endif
@@ -29,9 +26,7 @@ static int __init check_bridge(int vendor, int device)
        /* According to Nvidia all timer overrides are bogus unless HPET
           is enabled. */
        if (!acpi_use_timer_override && vendor == PCI_VENDOR_ID_NVIDIA) {
-                nvidia_hpet_detected = 0;
+                if (acpi_table_parse(ACPI_SIG_HPET, nvidia_hpet_check)) {
-                acpi_table_parse(ACPI_SIG_HPET, nvidia_hpet_check);
-                if (nvidia_hpet_detected == 0) {
                        acpi_skip_timer_override = 1;
                          printk(KERN_INFO "Nvidia board "
                       "detected. Ignoring ACPI "
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index 9b0dd2744c82..4ff55e675576 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -45,6 +45,7 @@
 #include <linux/notifier.h>
 #include <linux/cpu.h>
 #include <linux/percpu.h>
+#include <linux/nmi.h>
 #include <linux/delay.h>
 #include <linux/mc146818rtc.h>
@@ -1278,8 +1279,9 @@ void __cpu_die(unsigned int cpu)
 int __cpuinit __cpu_up(unsigned int cpu)
 {
+        unsigned long flags;
 #ifdef CONFIG_HOTPLUG_CPU
-        int ret=0;
+        int ret = 0;
        /*
         * We do warm boot only on cpus that had booted earlier
@@ -1297,23 +1299,25 @@ int __cpuinit __cpu_up(unsigned int cpu)
        /* In case one didn't come up */
        if (!cpu_isset(cpu, cpu_callin_map)) {
                printk(KERN_DEBUG "skipping cpu%d, didn't come online\n", cpu);
-                local_irq_enable();
                return -EIO;
        }
-        local_irq_enable();
        per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
        /* Unleash the CPU! */
        cpu_set(cpu, smp_commenced_mask);
        /*
-         * Check TSC synchronization with the AP:
+         * Check TSC synchronization with the AP (keep irqs disabled
+         * while doing so):
         */
+        local_irq_save(flags);
        check_tsc_sync_source(cpu);
+        local_irq_restore(flags);
-        while (!cpu_isset(cpu, cpu_online_map))
+        while (!cpu_isset(cpu, cpu_online_map)) {
                cpu_relax();
+                touch_nmi_watchdog();
+        }
 #ifdef CONFIG_X86_GENERICARCH
        if (num_online_cpus() > 8 && genapic == &apic_default)
diff --git a/arch/ia64/kernel/asm-offsets.c b/arch/ia64/kernel/asm-offsets.c
index 75a2a2c12258..2236fabbb3c6 100644
--- a/arch/ia64/kernel/asm-offsets.c
+++ b/arch/ia64/kernel/asm-offsets.c
@@ -35,6 +35,7 @@ void foo(void)
        BLANK();
        DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));
+        DEFINE(TI_CPU, offsetof(struct thread_info, cpu));
        DEFINE(TI_PRE_COUNT, offsetof(struct thread_info, preempt_count));
        BLANK();
diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
index 4061593e5b17..49b93682c752 100644
--- a/arch/ia64/kernel/efi.c
+++ b/arch/ia64/kernel/efi.c
@@ -971,6 +971,11 @@ efi_memmap_init(unsigned long *s, unsigned long *e)
                if (!is_memory_available(md))
                        continue;
+#ifdef CONFIG_CRASH_DUMP
+                /* saved_max_pfn should ignore max_addr= command line arg */
+                if (saved_max_pfn < (efi_md_end(md) >> PAGE_SHIFT))
+                        saved_max_pfn = (efi_md_end(md) >> PAGE_SHIFT);
+#endif
                /*
                 * Round ends inward to granule boundaries
                 * Give trimmings to uncached allocator
@@ -1010,11 +1015,6 @@ efi_memmap_init(unsigned long *s, unsigned long *e)
                } else
                        ae = efi_md_end(md);
-#ifdef CONFIG_CRASH_DUMP
-                /* saved_max_pfn should ignore max_addr= command line arg */
-                if (saved_max_pfn < (ae >> PAGE_SHIFT))
-                        saved_max_pfn = (ae >> PAGE_SHIFT);
-#endif
                /* keep within max_addr= and min_addr= command line arg */
                as = max(as, min_addr);
                ae = min(ae, max_addr);
diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
index 7a05b1cb2ad5..8589e84a27c6 100644
--- a/arch/ia64/kernel/fsys.S
+++ b/arch/ia64/kernel/fsys.S
@@ -10,6 +10,8 @@
 *                      probably broke it along the way... ;-)
 * 13-Jul-04 clameter   Implement fsys_clock_gettime and revise fsys_gettimeofday to make
 *                      it capable of using memory based clocks without falling back to C code.
+ * 08-Feb-07 Fenghua Yu Implement fsys_getcpu.
+ *
 */
 #include <asm/asmmacro.h>
@@ -505,6 +507,59 @@ EX(.fail_efault, (p15) st8 [r34]=r3)
 #endif
 END(fsys_rt_sigprocmask)
+/*
+ * fsys_getcpu doesn't use the third parameter in this implementation. It reads
+ * current_thread_info()->cpu and corresponding node in cpu_to_node_map.
+ */
+ENTRY(fsys_getcpu)
+        .prologue
+        .altrp b6
+        .body
+        ;;
+        add r2=TI_FLAGS+IA64_TASK_SIZE,r16
+        tnat.nz p6,p0 = r32                     // guard against NaT argument
+        add r3=TI_CPU+IA64_TASK_SIZE,r16
+        ;;
+        ld4 r3=[r3]                             // M r3 = thread_info->cpu
+        ld4 r2=[r2]                             // M r2 = thread_info->flags
+(p6)    br.cond.spnt.few .fail_einval           // B
+        ;;
+        tnat.nz p7,p0 = r33                     // I guard against NaT argument
+(p7)    br.cond.spnt.few .fail_einval           // B
+#ifdef CONFIG_NUMA
+        movl r17=cpu_to_node_map
+        ;;
+EX(.fail_efault, probe.w.fault r32, 3)          // M This takes 5 cycles
+EX(.fail_efault, probe.w.fault r33, 3)          // M This takes 5 cycles
+        shladd r18=r3,1,r17
+        ;;
+        ld2 r20=[r18]                           // r20 = cpu_to_node_map[cpu]
+        and r2 = TIF_ALLWORK_MASK,r2
+        ;;
+        cmp.ne p8,p0=0,r2
+(p8)    br.spnt.many fsys_fallback_syscall
+        ;;
+        ;;
+EX(.fail_efault, st4 [r32] = r3)
+EX(.fail_efault, st2 [r33] = r20)
+        mov r8=0
+        ;;
+#else
+EX(.fail_efault, probe.w.fault r32, 3)          // M This takes 5 cycles
+EX(.fail_efault, probe.w.fault r33, 3)          // M This takes 5 cycles
+        and r2 = TIF_ALLWORK_MASK,r2
+        ;;
+        cmp.ne p8,p0=0,r2
+(p8)    br.spnt.many fsys_fallback_syscall
+        ;;
+EX(.fail_efault, st4 [r32] = r3)
+EX(.fail_efault, st2 [r33] = r0)
+        mov r8=0
+        ;;
+#endif
+        FSYS_RETURN
+END(fsys_getcpu)
 ENTRY(fsys_fallback_syscall)
        .prologue
        .altrp b6
@@ -878,6 +933,56 @@ fsyscall_table:
        data8 0                         // timer_delete
        data8 0                         // clock_settime
        data8 fsys_clock_gettime        // clock_gettime
+        data8 0                         // clock_getres         // 1255
+        data8 0                         // clock_nanosleep
+        data8 0                         // fstatfs64
+        data8 0                         // statfs64
+        data8 0                         // mbind
+        data8 0                         // get_mempolicy        // 1260
+        data8 0                         // set_mempolicy
+        data8 0                         // mq_open
+        data8 0                         // mq_unlink
+        data8 0                         // mq_timedsend
+        data8 0                         // mq_timedreceive      // 1265
+        data8 0                         // mq_notify
+        data8 0                         // mq_getsetattr
+        data8 0                         // kexec_load
+        data8 0                         // vserver
+        data8 0                         // waitid               // 1270
+        data8 0                         // add_key
+        data8 0                         // request_key
+        data8 0                         // keyctl
+        data8 0                         // ioprio_set
+        data8 0                         // ioprio_get           // 1275
+        data8 0                         // move_pages
+        data8 0                         // inotify_init
+        data8 0                         // inotify_add_watch
+        data8 0                         // inotify_rm_watch
+        data8 0                         // migrate_pages        // 1280
+        data8 0                         // openat
+        data8 0                         // mkdirat
+        data8 0                         // mknodat
+        data8 0                         // fchownat
+        data8 0                         // futimesat            // 1285
+        data8 0                         // newfstatat
+        data8 0                         // unlinkat
+        data8 0                         // renameat
+        data8 0                         // linkat
+        data8 0                         // symlinkat            // 1290
+        data8 0                         // readlinkat
+        data8 0                         // fchmodat
+        data8 0                         // faccessat
+        data8 0
+        data8 0                                                 // 1295
+        data8 0                         // unshare
+        data8 0                         // splice
+        data8 0                         // set_robust_list
+        data8 0                         // get_robust_list
+        data8 0                         // sync_file_range      // 1300
+        data8 0                         // tee
+        data8 0                         // vmsplice
+        data8 0
+        data8 fsys_getcpu               // getcpu               // 1304
        // fill in zeros for the remaining entries
        .zero:
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index d6aab40c6416..dcfbf3e7a9ef 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -446,7 +446,7 @@ iosapic_end_level_irq (unsigned int irq)
 #define iosapic_disable_level_irq       mask_irq
 #define iosapic_ack_level_irq           nop
-struct hw_interrupt_type irq_type_iosapic_level = {
+struct irq_chip irq_type_iosapic_level = {
        .name =         "IO-SAPIC-level",
        .startup =      iosapic_startup_level_irq,
        .shutdown =     iosapic_shutdown_level_irq,
@@ -454,6 +454,8 @@ struct hw_interrupt_type irq_type_iosapic_level = {
        .disable =      iosapic_disable_level_irq,
        .ack =          iosapic_ack_level_irq,
        .end =          iosapic_end_level_irq,
+        .mask =         mask_irq,
+        .unmask =       unmask_irq,
        .set_affinity = iosapic_set_affinity
 };
@@ -493,7 +495,7 @@ iosapic_ack_edge_irq (unsigned int irq)
 #define iosapic_disable_edge_irq        nop
 #define iosapic_end_edge_irq            nop
-struct hw_interrupt_type irq_type_iosapic_edge = {
+struct irq_chip irq_type_iosapic_edge = {
        .name =         "IO-SAPIC-edge",
        .startup =      iosapic_startup_edge_irq,
        .shutdown =     iosapic_disable_edge_irq,
@@ -501,6 +503,8 @@ struct hw_interrupt_type irq_type_iosapic_edge = {
        .disable =      iosapic_disable_edge_irq,
        .ack =          iosapic_ack_edge_irq,
        .end =          iosapic_end_edge_irq,
+        .mask =         mask_irq,
+        .unmask =       unmask_irq,
        .set_affinity = iosapic_set_affinity
 };
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index 7d6fe65c93f4..339e8a54c2f1 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -91,8 +91,6 @@ static struct resource code_resource = {
        .name   = "Kernel code",
        .flags  = IORESOURCE_BUSY | IORESOURCE_MEM
 };
-extern void efi_initialize_iomem_resources(struct resource *,
-                struct resource *);
 extern char _text[], _end[], _etext[];
 unsigned long ia64_max_cacheline_size;
diff --git a/arch/ia64/sn/kernel/io_acpi_init.c b/arch/ia64/sn/kernel/io_acpi_init.c
index 8c331ca6e5c9..c6216f454ffb 100644
--- a/arch/ia64/sn/kernel/io_acpi_init.c
+++ b/arch/ia64/sn/kernel/io_acpi_init.c
@@ -53,12 +53,15 @@ sal_ioif_init(u64 *result)
 }
 /*
- * sn_hubdev_add - The 'add' function of the acpi_sn_hubdev_driver.
+ * sn_acpi_hubdev_init() - This function is called by acpi_ns_get_device_callback()
- *                 Called for every "SGIHUB" or "SGITIO" device defined
+ *                         for all SGIHUB and SGITIO acpi devices defined in the
- *                 in the ACPI namespace.
+ *                         DSDT. It obtains the hubdev_info pointer from the
+ *                         ACPI vendor resource, which the PROM setup, and sets up the
+ *                         hubdev_info in the pda.
 */
-static int __init
-sn_hubdev_add(struct acpi_device *device)
+static acpi_status __init
+sn_acpi_hubdev_init(acpi_handle handle, u32 depth, void *context, void **ret)
 {
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
        u64 addr;
@@ -67,18 +70,19 @@ sn_hubdev_add(struct acpi_device *device)
        int i;
        u64 nasid;
        struct acpi_resource *resource;
-        int ret = 0;
        acpi_status status;
        struct acpi_resource_vendor_typed *vendor;
        extern void sn_common_hubdev_init(struct hubdev_info *);
-        status = acpi_get_vendor_resource(device->handle, METHOD_NAME__CRS,
+        status = acpi_get_vendor_resource(handle, METHOD_NAME__CRS,
                                          &sn_uuid, &buffer);
        if (ACPI_FAILURE(status)) {
                printk(KERN_ERR
-                       "sn_hubdev_add: acpi_get_vendor_resource() failed: %d\n",
+                       "sn_acpi_hubdev_init: acpi_get_vendor_resource() "
-                        status);
+                       "(0x%x) failed for: ", status);
-                return 1;
+                acpi_ns_print_node_pathname(handle, NULL);
+                printk("\n");
+                return AE_OK;           /* Continue walking namespace */
        }
        resource = buffer.pointer;
@@ -86,9 +90,10 @@ sn_hubdev_add(struct acpi_device *device)
        if ((vendor->byte_length - sizeof(struct acpi_vendor_uuid)) !=
            sizeof(struct hubdev_info *)) {
                printk(KERN_ERR
-                       "sn_hubdev_add: Invalid vendor data length: %d\n",
+                       "sn_acpi_hubdev_init: Invalid vendor data length: %d for: ",
                        vendor->byte_length);
-                ret = 1;
+                acpi_ns_print_node_pathname(handle, NULL);
+                printk("\n");
                goto exit;
        }
@@ -103,7 +108,7 @@ sn_hubdev_add(struct acpi_device *device)
 exit:
        kfree(buffer.pointer);
-        return ret;
+        return AE_OK;           /* Continue walking namespace */
 }
 /*
@@ -441,14 +446,6 @@ sn_acpi_slot_fixup(struct pci_dev *dev)
 EXPORT_SYMBOL(sn_acpi_slot_fixup);
-static struct acpi_driver acpi_sn_hubdev_driver = {
-        .name = "SGI HUBDEV Driver",
-        .ids = "SGIHUB,SGITIO",
-        .ops = {
-                .add = sn_hubdev_add,
-                },
-};
 /*
 * sn_acpi_bus_fixup -  Perform SN specific setup of software structs
@@ -492,7 +489,10 @@ sn_io_acpi_init(void)
        /* SN Altix does not follow the IOSAPIC IRQ routing model */
        acpi_irq_model = ACPI_IRQ_MODEL_PLATFORM;
-        acpi_bus_register_driver(&acpi_sn_hubdev_driver);
+        /* Setup hubdev_info for all SGIHUB/SGITIO devices */
+        acpi_get_devices("SGIHUB", sn_acpi_hubdev_init, NULL, NULL);
+        acpi_get_devices("SGITIO", sn_acpi_hubdev_init, NULL, NULL);
        status = sal_ioif_init(&result);
        if (status || result)
                panic("sal_ioif_init failed: [%lx] %s\n",
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 8c5bee01eaa2..8d2a1bfbfe7c 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -205,7 +205,17 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
                (void)sn_retarget_vector(sn_irq_info, nasid, slice);
 }
-struct hw_interrupt_type irq_type_sn = {
+static void
+sn_mask_irq(unsigned int irq)
+{
+}
+static void
+sn_unmask_irq(unsigned int irq)
+{
+}
+struct irq_chip irq_type_sn = {
        .name           = "SN hub",
        .startup        = sn_startup_irq,
        .shutdown       = sn_shutdown_irq,
@@ -213,6 +223,8 @@ struct hw_interrupt_type irq_type_sn = {
        .disable        = sn_disable_irq,
        .ack            = sn_ack_irq,
        .end            = sn_end_irq,
+        .mask           = sn_mask_irq,
+        .unmask         = sn_unmask_irq,
        .set_affinity   = sn_set_affinity_irq
 };
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index 8571e52c2efd..bd5373d593e1 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -397,6 +397,8 @@ void __init sn_setup(char **cmdline_p)
        ia64_sn_set_os_feature(OSF_PCISEGMENT_ENABLE);
        ia64_sn_set_os_feature(OSF_ACPI_ENABLE);
+        /* Load the new DSDT and SSDT tables into the global table list. */
+        acpi_table_init();
 #if defined(CONFIG_VT) && defined(CONFIG_VGA_CONSOLE)
        /*
diff --git a/arch/mips/arc/init.c b/arch/mips/arc/init.c
index 0ac8f42d3752..e2f75b13312f 100644
--- a/arch/mips/arc/init.c
+++ b/arch/mips/arc/init.c
@@ -23,16 +23,16 @@ LONG *_prom_argv, *_prom_envp;
 void __init prom_init(void)
 {
        PSYSTEM_PARAMETER_BLOCK pb = PROMBLOCK;
        romvec = ROMVECTOR;
-        ULONG cnt;
-        CHAR c;
        prom_argc = fw_arg0;
        _prom_argv = (LONG *) fw_arg1;
        _prom_envp = (LONG *) fw_arg2;
        if (pb->magic != 0x53435241) {
-                printk(KERN_CRIT "Aieee, bad prom vector magic %08lx\n", pb->magic);
+                printk(KERN_CRIT "Aieee, bad prom vector magic %08lx\n",
+                       (unsigned long) pb->magic);
                while(1)
                        ;
        }
diff --git a/arch/mips/dec/prom/init.c b/arch/mips/dec/prom/init.c
index bf2858071f1f..a217aafe59f6 100644
--- a/arch/mips/dec/prom/init.c
+++ b/arch/mips/dec/prom/init.c
@@ -103,9 +103,6 @@ void __init prom_init(void)
        if (prom_is_rex(magic))
                rex_clear_cache();
-        /* Register the early console.  */
-        register_prom_console();
        /* Were we compiled with the right CPU option? */
 #if defined(CONFIG_CPU_R3000)
        if ((current_cpu_data.cputype == CPU_R4000SC) ||
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 30d433f14f93..1df544c1f966 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -564,49 +564,3 @@ _sys32_clone(nabi_no_regargs struct pt_regs regs)
        return do_fork(clone_flags, newsp, &regs, 0,
                       parent_tidptr, child_tidptr);
 }
-/*
- * Implement the event wait interface for the eventpoll file. It is the kernel
- * part of the user space epoll_pwait(2).
- */
-asmlinkage long compat_sys_epoll_pwait(int epfd,
-        struct epoll_event __user *events, int maxevents, int timeout,
-        const compat_sigset_t __user *sigmask, size_t sigsetsize)
-{
-        int error;
-        sigset_t ksigmask, sigsaved;
-        /*
-         * If the caller wants a certain signal mask to be set during the wait,
-         * we apply it here.
-         */
-        if (sigmask) {
-                if (sigsetsize != sizeof(sigset_t))
-                        return -EINVAL;
-                if (!access_ok(VERIFY_READ, sigmask, sizeof(ksigmask)))
-                        return -EFAULT;
-                if (__copy_conv_sigset_from_user(&ksigmask, sigmask))
-                        return -EFAULT;
-                sigdelsetmask(&ksigmask, sigmask(SIGKILL) | sigmask(SIGSTOP));
-                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
-        }
-        error = sys_epoll_wait(epfd, events, maxevents, timeout);
-        /*
-         * If we changed the signal mask, we need to restore the original one.
-         * In case we've got a signal while waiting, we do not restore the
-         * signal mask yet, and we allow do_signal() to deliver the signal on
-         * the way back to userspace, before the signal mask is restored.
-         */
-        if (sigmask) {
-                if (error == -EINTR) {
-                        memcpy(&current->saved_sigmask, &sigsaved,
-                                sizeof(sigsaved));
-                        set_thread_flag(TIF_RESTORE_SIGMASK);
-                } else
-                        sigprocmask(SIG_SETMASK, &sigsaved, NULL);
-        }
-        return error;
-}
diff --git a/arch/mips/sibyte/Kconfig b/arch/mips/sibyte/Kconfig
index 67dac6204b6d..bdf24a7b5494 100644
--- a/arch/mips/sibyte/Kconfig
+++ b/arch/mips/sibyte/Kconfig
@@ -1,31 +1,35 @@
 config SIBYTE_SB1250
        bool
        select HW_HAS_PCI
-        select SIBYTE_HAS_LDT
+        select SIBYTE_ENABLE_LDT_IF_PCI
        select SIBYTE_SB1xxx_SOC
        select SYS_SUPPORTS_SMP
 config SIBYTE_BCM1120
        bool
        select SIBYTE_BCM112X
+        select SIBYTE_HAS_ZBUS_PROFILING
        select SIBYTE_SB1xxx_SOC
 config SIBYTE_BCM1125
        bool
        select HW_HAS_PCI
        select SIBYTE_BCM112X
+        select SIBYTE_HAS_ZBUS_PROFILING
        select SIBYTE_SB1xxx_SOC
 config SIBYTE_BCM1125H
        bool
        select HW_HAS_PCI
        select SIBYTE_BCM112X
-        select SIBYTE_HAS_LDT
+        select SIBYTE_ENABLE_LDT_IF_PCI
+        select SIBYTE_HAS_ZBUS_PROFILING
        select SIBYTE_SB1xxx_SOC
 config SIBYTE_BCM112X
        bool
        select SIBYTE_SB1xxx_SOC
+        select SIBYTE_HAS_ZBUS_PROFILING
 config SIBYTE_BCM1x80
        bool
@@ -37,6 +41,7 @@ config SIBYTE_BCM1x55
        bool
        select HW_HAS_PCI
        select SIBYTE_SB1xxx_SOC
+        select SIBYTE_HAS_ZBUS_PROFILING
        select SYS_SUPPORTS_SMP
 config SIBYTE_SB1xxx_SOC
@@ -95,8 +100,10 @@ config CPU_SB1_PASS_2
 config SIBYTE_HAS_LDT
        bool
-        depends on PCI && (SIBYTE_SB1250 || SIBYTE_BCM1125H)
-        default y
+config SIBYTE_ENABLE_LDT_IF_PCI
+        bool
+        select SIBYTE_HAS_LDT if PCI
 config SIMULATION
        bool "Running under simulation"
@@ -162,5 +169,8 @@ config SIBYTE_SB1250_PROF
        depends on SIBYTE_SB1xxx_SOC
 config SIBYTE_TBPROF
-        bool "Support for ZBbus profiling"
+        tristate "Support for ZBbus profiling"
-        depends on SIBYTE_SB1xxx_SOC
+        depends on SIBYTE_HAS_ZBUS_PROFILING
+config SIBYTE_HAS_ZBUS_PROFILING
+        bool
diff --git a/arch/mips/sibyte/sb1250/bcm1250_tbprof.c b/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
index 212547c57310..ea0ca131a3cf 100644
--- a/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
+++ b/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
@@ -1,6 +1,4 @@
 /*
- * Copyright (C) 2001, 2002, 2003 Broadcom Corporation
- *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
@@ -14,10 +12,16 @@
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ *
+ * Copyright (C) 2001, 2002, 2003 Broadcom Corporation
+ * Copyright (C) 2007 Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) 2007 MIPS Technologies, Inc.
+ *    written by Ralf Baechle <ralf@linux-mips.org>
 */
-#define SBPROF_TB_DEBUG 0
+#undef DEBUG
+#include <linux/device.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
@@ -27,24 +31,98 @@
 #include <linux/vmalloc.h>
 #include <linux/fs.h>
 #include <linux/errno.h>
-#include <linux/reboot.h>
+#include <linux/types.h>
-#include <linux/smp_lock.h>
 #include <linux/wait.h>
-#include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/sibyte/sb1250.h>
 #include <asm/sibyte/sb1250_regs.h>
 #include <asm/sibyte/sb1250_scd.h>
 #include <asm/sibyte/sb1250_int.h>
-#include <asm/sibyte/trace_prof.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
-#define DEVNAME "bcm1250_tbprof"
+#define SBPROF_TB_MAJOR 240
+typedef u64 tb_sample_t[6*256];
+enum open_status {
+        SB_CLOSED,
+        SB_OPENING,
+        SB_OPEN
+};
+struct sbprof_tb {
+        wait_queue_head_t       tb_sync;
+        wait_queue_head_t       tb_read;
+        struct mutex            lock;
+        enum open_status        open;
+        tb_sample_t             *sbprof_tbbuf;
+        int                     next_tb_sample;
+        volatile int            tb_enable;
+        volatile int            tb_armed;
+};
 static struct sbprof_tb sbp;
+#define MAX_SAMPLE_BYTES (24*1024*1024)
+#define MAX_TBSAMPLE_BYTES (12*1024*1024)
+#define MAX_SAMPLES (MAX_SAMPLE_BYTES/sizeof(u_int32_t))
+#define TB_SAMPLE_SIZE (sizeof(tb_sample_t))
+#define MAX_TB_SAMPLES (MAX_TBSAMPLE_BYTES/TB_SAMPLE_SIZE)
+/* ioctls */
+#define SBPROF_ZBSTART          _IOW('s', 0, int)
+#define SBPROF_ZBSTOP           _IOW('s', 1, int)
+#define SBPROF_ZBWAITFULL       _IOW('s', 2, int)
+/*
+ * Routines for using 40-bit SCD cycle counter
+ *
+ * Client responsible for either handling interrupts or making sure
+ * the cycles counter never saturates, e.g., by doing
+ * zclk_timer_init(0) at least every 2^40 - 1 ZCLKs.
+ */
+/*
+ * Configures SCD counter 0 to count ZCLKs starting from val;
+ * Configures SCD counters1,2,3 to count nothing.
+ * Must not be called while gathering ZBbus profiles.
+ */
+#define zclk_timer_init(val) \
+  __asm__ __volatile__ (".set push;" \
+                        ".set mips64;" \
+                        "la   $8, 0xb00204c0;" /* SCD perf_cnt_cfg */ \
+                        "sd   %0, 0x10($8);"   /* write val to counter0 */ \
+                        "sd   %1, 0($8);"      /* config counter0 for zclks*/ \
+                        ".set pop" \
+                        : /* no outputs */ \
+                                                     /* enable, counter0 */ \
+                        : /* inputs */ "r"(val), "r" ((1ULL << 33) | 1ULL) \
+                        : /* modifies */ "$8" )
+/* Reads SCD counter 0 and puts result in value
+   unsigned long long val; */
+#define zclk_get(val) \
+  __asm__ __volatile__ (".set push;" \
+                        ".set mips64;" \
+                        "la   $8, 0xb00204c0;" /* SCD perf_cnt_cfg */ \
+                        "ld   %0, 0x10($8);"   /* write val to counter0 */ \
+                        ".set pop" \
+                        : /* outputs */ "=r"(val) \
+                        : /* inputs */ \
+                        : /* modifies */ "$8" )
+#define DEVNAME "bcm1250_tbprof"
 #define TB_FULL (sbp.next_tb_sample == MAX_TB_SAMPLES)
-/************************************************************************
+/*
 * Support for ZBbus sampling using the trace buffer
 *
 * We use the SCD performance counter interrupt, caused by a Zclk counter
@@ -54,30 +132,36 @@ static struct sbprof_tb sbp;
 * overflow.
 *
 * We map the interrupt for trace_buffer_freeze to handle it on CPU 0.
- *
+ */
- ************************************************************************/
-static u_int64_t tb_period;
+static u64 tb_period;
 static void arm_tb(void)
 {
-        u_int64_t scdperfcnt;
+        u64 scdperfcnt;
-        u_int64_t next = (1ULL << 40) - tb_period;
+        u64 next = (1ULL << 40) - tb_period;
-        u_int64_t tb_options = M_SCD_TRACE_CFG_FREEZE_FULL;
+        u64 tb_options = M_SCD_TRACE_CFG_FREEZE_FULL;
-        /* Generate an SCD_PERFCNT interrupt in TB_PERIOD Zclks to
-           trigger start of trace.  XXX vary sampling period */
+        /*
+         * Generate an SCD_PERFCNT interrupt in TB_PERIOD Zclks to trigger
+         *start of trace.  XXX vary sampling period
+         */
        __raw_writeq(0, IOADDR(A_SCD_PERF_CNT_1));
        scdperfcnt = __raw_readq(IOADDR(A_SCD_PERF_CNT_CFG));
-        /* Unfortunately, in Pass 2 we must clear all counters to knock down
-           a previous interrupt request.  This means that bus profiling
+        /*
-           requires ALL of the SCD perf counters. */
+         * Unfortunately, in Pass 2 we must clear all counters to knock down a
+         * previous interrupt request.  This means that bus profiling requires
+         * ALL of the SCD perf counters.
+         */
        __raw_writeq((scdperfcnt & ~M_SPC_CFG_SRC1) |
-                                                // keep counters 0,2,3 as is
+                                                /* keep counters 0,2,3 as is */
-                     M_SPC_CFG_ENABLE |         // enable counting
+                     M_SPC_CFG_ENABLE |         /* enable counting */
-                     M_SPC_CFG_CLEAR |          // clear all counters
+                     M_SPC_CFG_CLEAR |          /* clear all counters */
-                     V_SPC_CFG_SRC1(1),         // counter 1 counts cycles
+                     V_SPC_CFG_SRC1(1),         /* counter 1 counts cycles */
                     IOADDR(A_SCD_PERF_CNT_CFG));
        __raw_writeq(next, IOADDR(A_SCD_PERF_CNT_1));
        /* Reset the trace buffer */
        __raw_writeq(M_SCD_TRACE_CFG_RESET, IOADDR(A_SCD_TRACE_CFG));
 #if 0 && defined(M_SCD_TRACE_CFG_FORCECNT)
@@ -91,43 +175,45 @@ static void arm_tb(void)
 static irqreturn_t sbprof_tb_intr(int irq, void *dev_id)
 {
        int i;
-        DBG(printk(DEVNAME ": tb_intr\n"));
+        pr_debug(DEVNAME ": tb_intr\n");
        if (sbp.next_tb_sample < MAX_TB_SAMPLES) {
                /* XXX should use XKPHYS to make writes bypass L2 */
-                u_int64_t *p = sbp.sbprof_tbbuf[sbp.next_tb_sample++];
+                u64 *p = sbp.sbprof_tbbuf[sbp.next_tb_sample++];
                /* Read out trace */
                __raw_writeq(M_SCD_TRACE_CFG_START_READ,
                             IOADDR(A_SCD_TRACE_CFG));
                __asm__ __volatile__ ("sync" : : : "memory");
                /* Loop runs backwards because bundles are read out in reverse order */
                for (i = 256 * 6; i > 0; i -= 6) {
-                        // Subscripts decrease to put bundle in the order
+                        /* Subscripts decrease to put bundle in the order */
-                        //   t0 lo, t0 hi, t1 lo, t1 hi, t2 lo, t2 hi
+                        /*   t0 lo, t0 hi, t1 lo, t1 hi, t2 lo, t2 hi */
                        p[i - 1] = __raw_readq(IOADDR(A_SCD_TRACE_READ));
-                                                                // read t2 hi
+                                                                /* read t2 hi */
                        p[i - 2] = __raw_readq(IOADDR(A_SCD_TRACE_READ));
-                                                                // read t2 lo
+                                                                /* read t2 lo */
                        p[i - 3] = __raw_readq(IOADDR(A_SCD_TRACE_READ));
-                                                                // read t1 hi
+                                                                /* read t1 hi */
                        p[i - 4] = __raw_readq(IOADDR(A_SCD_TRACE_READ));
-                                                                // read t1 lo
+                                                                /* read t1 lo */
                        p[i - 5] = __raw_readq(IOADDR(A_SCD_TRACE_READ));
-                                                                // read t0 hi
+                                                                /* read t0 hi */
                        p[i - 6] = __raw_readq(IOADDR(A_SCD_TRACE_READ));
-                                                                // read t0 lo
+                                                                /* read t0 lo */
                }
                if (!sbp.tb_enable) {
-                        DBG(printk(DEVNAME ": tb_intr shutdown\n"));
+                        pr_debug(DEVNAME ": tb_intr shutdown\n");
                        __raw_writeq(M_SCD_TRACE_CFG_RESET,
                                     IOADDR(A_SCD_TRACE_CFG));
                        sbp.tb_armed = 0;
                        wake_up(&sbp.tb_sync);
                } else {
-                        arm_tb();       // knock down current interrupt and get another one later
+                        arm_tb();       /* knock down current interrupt and get another one later */
                }
        } else {
                /* No more trace buffer samples */
-                DBG(printk(DEVNAME ": tb_intr full\n"));
+                pr_debug(DEVNAME ": tb_intr full\n");
                __raw_writeq(M_SCD_TRACE_CFG_RESET, IOADDR(A_SCD_TRACE_CFG));
                sbp.tb_armed = 0;
                if (!sbp.tb_enable) {
@@ -135,6 +221,7 @@ static irqreturn_t sbprof_tb_intr(int irq, void *dev_id)
                }
                wake_up(&sbp.tb_read);
        }
        return IRQ_HANDLED;
 }
@@ -144,23 +231,30 @@ static irqreturn_t sbprof_pc_intr(int irq, void *dev_id)
        return IRQ_NONE;
 }
-int sbprof_zbprof_start(struct file *filp)
+/*
+ * Requires: Already called zclk_timer_init with a value that won't
+ *           saturate 40 bits.  No subsequent use of SCD performance counters
+ *           or trace buffer.
+ */
+static int sbprof_zbprof_start(struct file *filp)
 {
-        u_int64_t scdperfcnt;
+        u64 scdperfcnt;
+        int err;
-        if (sbp.tb_enable)
+        if (xchg(&sbp.tb_enable, 1))
                return -EBUSY;
-        DBG(printk(DEVNAME ": starting\n"));
+        pr_debug(DEVNAME ": starting\n");
-        sbp.tb_enable = 1;
        sbp.next_tb_sample = 0;
        filp->f_pos = 0;
-        if (request_irq
+        err = request_irq(K_INT_TRACE_FREEZE, sbprof_tb_intr, 0,
-            (K_INT_TRACE_FREEZE, sbprof_tb_intr, 0, DEVNAME " trace freeze", &sbp)) {
+                        DEVNAME " trace freeze", &sbp);
+        if (err)
                return -EBUSY;
-        }
        /* Make sure there isn't a perf-cnt interrupt waiting */
        scdperfcnt = __raw_readq(IOADDR(A_SCD_PERF_CNT_CFG));
        /* Disable and clear counters, override SRC_1 */
@@ -168,18 +262,21 @@ int sbprof_zbprof_start(struct file *filp)
                     M_SPC_CFG_ENABLE | M_SPC_CFG_CLEAR | V_SPC_CFG_SRC1(1),
                     IOADDR(A_SCD_PERF_CNT_CFG));
-        /* We grab this interrupt to prevent others from trying to use
+        /*
-           it, even though we don't want to service the interrupts
+         * We grab this interrupt to prevent others from trying to use it, even
-           (they only feed into the trace-on-interrupt mechanism) */
+         * though we don't want to service the interrupts (they only feed into
-        if (request_irq
+         * the trace-on-interrupt mechanism)
-            (K_INT_PERF_CNT, sbprof_pc_intr, 0, DEVNAME " scd perfcnt", &sbp)) {
+         */
-                free_irq(K_INT_TRACE_FREEZE, &sbp);
+        err = request_irq(K_INT_PERF_CNT, sbprof_pc_intr, 0,
-                return -EBUSY;
+                        DEVNAME " scd perfcnt", &sbp);
-        }
+        if (err)
+                goto out_free_irq;
-        /* I need the core to mask these, but the interrupt mapper to
-           pass them through.  I am exploiting my knowledge that
+        /*
-           cp0_status masks out IP[5]. krw */
+         * I need the core to mask these, but the interrupt mapper to pass them
+         * through.  I am exploiting my knowledge that cp0_status masks out
+         * IP[5]. krw
+         */
        __raw_writeq(K_INT_MAP_I3,
                     IOADDR(A_IMR_REGISTER(0, R_IMR_INTERRUPT_MAP_BASE) +
                            (K_INT_PERF_CNT << 3)));
@@ -201,7 +298,7 @@ int sbprof_zbprof_start(struct file *filp)
        __raw_writeq(0, IOADDR(A_ADDR_TRAP_CFG_3));
        /* Initialize Trace Event 0-7 */
-        //                              when interrupt
+        /*                              when interrupt */
        __raw_writeq(M_SCD_TREVT_INTERRUPT, IOADDR(A_SCD_TRACE_EVENT_0));
        __raw_writeq(0, IOADDR(A_SCD_TRACE_EVENT_1));
        __raw_writeq(0, IOADDR(A_SCD_TRACE_EVENT_2));
@@ -212,10 +309,10 @@ int sbprof_zbprof_start(struct file *filp)
        __raw_writeq(0, IOADDR(A_SCD_TRACE_EVENT_7));
        /* Initialize Trace Sequence 0-7 */
-        //                                   Start on event 0 (interrupt)
+        /*                                   Start on event 0 (interrupt) */
        __raw_writeq(V_SCD_TRSEQ_FUNC_START | 0x0fff,
                     IOADDR(A_SCD_TRACE_SEQUENCE_0));
-        //                        dsamp when d used | asamp when a used
+        /*                        dsamp when d used | asamp when a used */
        __raw_writeq(M_SCD_TRSEQ_ASAMPLE | M_SCD_TRSEQ_DSAMPLE |
                     K_SCD_TRSEQ_TRIGGER_ALL,
                     IOADDR(A_SCD_TRACE_SEQUENCE_1));
@@ -232,33 +329,41 @@ int sbprof_zbprof_start(struct file *filp)
        arm_tb();
-        DBG(printk(DEVNAME ": done starting\n"));
+        pr_debug(DEVNAME ": done starting\n");
        return 0;
+out_free_irq:
+        free_irq(K_INT_TRACE_FREEZE, &sbp);
+        return err;
 }
-int sbprof_zbprof_stop(void)
+static int sbprof_zbprof_stop(void)
 {
-        DEFINE_WAIT(wait);
+        int err;
-        DBG(printk(DEVNAME ": stopping\n"));
+        pr_debug(DEVNAME ": stopping\n");
        if (sbp.tb_enable) {
+                /*
+                 * XXXKW there is a window here where the intr handler may run,
+                 * see the disable, and do the wake_up before this sleep
+                 * happens.
+                 */
+                pr_debug(DEVNAME ": wait for disarm\n");
+                err = wait_event_interruptible(sbp.tb_sync, !sbp.tb_armed);
+                pr_debug(DEVNAME ": disarm complete, stat %d\n", err);
+                if (err)
+                        return err;
                sbp.tb_enable = 0;
-                /* XXXKW there is a window here where the intr handler
-                   may run, see the disable, and do the wake_up before
-                   this sleep happens. */
-                if (sbp.tb_armed) {
-                        DBG(printk(DEVNAME ": wait for disarm\n"));
-                        prepare_to_wait(&sbp.tb_sync, &wait, TASK_INTERRUPTIBLE);
-                        schedule();
-                        finish_wait(&sbp.tb_sync, &wait);
-                        DBG(printk(DEVNAME ": disarm complete\n"));
-                }
                free_irq(K_INT_TRACE_FREEZE, &sbp);
                free_irq(K_INT_PERF_CNT, &sbp);
        }
-        DBG(printk(DEVNAME ": done stopping\n"));
+        pr_debug(DEVNAME ": done stopping\n");
        return 0;
 }
@@ -268,42 +373,45 @@ static int sbprof_tb_open(struct inode *inode, struct file *filp)
        int minor;
        minor = iminor(inode);
-        if (minor != 0) {
+        if (minor != 0)
                return -ENODEV;
-        }
-        if (sbp.open) {
+        if (xchg(&sbp.open, SB_OPENING) != SB_CLOSED)
                return -EBUSY;
-        }
        memset(&sbp, 0, sizeof(struct sbprof_tb));
        sbp.sbprof_tbbuf = vmalloc(MAX_TBSAMPLE_BYTES);
-        if (!sbp.sbprof_tbbuf) {
+        if (!sbp.sbprof_tbbuf)
                return -ENOMEM;
-        }
        memset(sbp.sbprof_tbbuf, 0, MAX_TBSAMPLE_BYTES);
        init_waitqueue_head(&sbp.tb_sync);
        init_waitqueue_head(&sbp.tb_read);
-        sbp.open = 1;
+        mutex_init(&sbp.lock);
+        sbp.open = SB_OPEN;
        return 0;
 }
 static int sbprof_tb_release(struct inode *inode, struct file *filp)
 {
-        int minor;
+        int minor = iminor(inode);
-        minor = iminor(inode);
+        if (minor != 0 || !sbp.open)
-        if (minor != 0 || !sbp.open) {
                return -ENODEV;
-        }
-        if (sbp.tb_armed || sbp.tb_enable) {
+        mutex_lock(&sbp.lock);
+        if (sbp.tb_armed || sbp.tb_enable)
                sbprof_zbprof_stop();
-        }
        vfree(sbp.sbprof_tbbuf);
        sbp.open = 0;
+        mutex_unlock(&sbp.lock);
        return 0;
 }
@@ -311,21 +419,35 @@ static ssize_t sbprof_tb_read(struct file *filp, char *buf,
                              size_t size, loff_t *offp)
 {
        int cur_sample, sample_off, cur_count, sample_left;
-        char *src;
-        int   count   =  0;
-        char *dest    =  buf;
        long  cur_off = *offp;
+        char *dest    =  buf;
+        int   count   =  0;
+        char *src;
+        if (!access_ok(VERIFY_WRITE, buf, size))
+                return -EFAULT;
+        mutex_lock(&sbp.lock);
        count = 0;
        cur_sample = cur_off / TB_SAMPLE_SIZE;
        sample_off = cur_off % TB_SAMPLE_SIZE;
        sample_left = TB_SAMPLE_SIZE - sample_off;
        while (size && (cur_sample < sbp.next_tb_sample)) {
+                int err;
                cur_count = size < sample_left ? size : sample_left;
                src = (char *)(((long)sbp.sbprof_tbbuf[cur_sample])+sample_off);
-                copy_to_user(dest, src, cur_count);
+                err = __copy_to_user(dest, src, cur_count);
-                DBG(printk(DEVNAME ": read from sample %d, %d bytes\n",
+                if (err) {
-                           cur_sample, cur_count));
+                        *offp = cur_off + cur_count - err;
+                        mutex_unlock(&sbp.lock);
+                        return err;
+                }
+                pr_debug(DEVNAME ": read from sample %d, %d bytes\n",
+                         cur_sample, cur_count);
                size -= cur_count;
                sample_left -= cur_count;
                if (!sample_left) {
@@ -339,37 +461,43 @@ static ssize_t sbprof_tb_read(struct file *filp, char *buf,
                dest += cur_count;
                count += cur_count;
        }
        *offp = cur_off;
+        mutex_unlock(&sbp.lock);
        return count;
 }
-static long sbprof_tb_ioctl(struct file *filp,
+static long sbprof_tb_ioctl(struct file *filp, unsigned int command,
-                            unsigned int command,
+        unsigned long arg)
-                            unsigned long arg)
 {
        int error = 0;
-        lock_kernel();
        switch (command) {
        case SBPROF_ZBSTART:
+                mutex_lock(&sbp.lock);
                error = sbprof_zbprof_start(filp);
+                mutex_unlock(&sbp.lock);
                break;
        case SBPROF_ZBSTOP:
+                mutex_lock(&sbp.lock);
                error = sbprof_zbprof_stop();
+                mutex_unlock(&sbp.lock);
                break;
        case SBPROF_ZBWAITFULL:
-                DEFINE_WAIT(wait);
+                error = wait_event_interruptible(sbp.tb_read, TB_FULL);
-                prepare_to_wait(&sbp.tb_read, &wait, TASK_INTERRUPTIBLE);
+                if (error)
-                schedule();
+                        break;
-                finish_wait(&sbp.tb_read, &wait);
-                /* XXXKW check if interrupted? */
+                error = put_user(TB_FULL, (int *) arg);
-                return put_user(TB_FULL, (int *) arg);
+                break;
        default:
                error = -EINVAL;
                break;
        }
-        unlock_kernel();
        return error;
 }
@@ -384,23 +512,60 @@ static const struct file_operations sbprof_tb_fops = {
        .mmap           = NULL,
 };
+static struct class *tb_class;
+static struct device *tb_dev;
 static int __init sbprof_tb_init(void)
 {
+        struct device *dev;
+        struct class *tbc;
+        int err;
        if (register_chrdev(SBPROF_TB_MAJOR, DEVNAME, &sbprof_tb_fops)) {
                printk(KERN_WARNING DEVNAME ": initialization failed (dev %d)\n",
                       SBPROF_TB_MAJOR);
                return -EIO;
        }
+        tbc = class_create(THIS_MODULE, "sb_tracebuffer");
+        if (IS_ERR(tbc)) {
+                err = PTR_ERR(tbc);
+                goto out_chrdev;
+        }
+        tb_class = tbc;
+        dev = device_create(tbc, NULL, MKDEV(SBPROF_TB_MAJOR, 0), "tb");
+        if (IS_ERR(dev)) {
+                err = PTR_ERR(dev);
+                goto out_class;
+        }
+        tb_dev = dev;
        sbp.open = 0;
        tb_period = zbbus_mhz * 10000LL;
-        printk(KERN_INFO DEVNAME ": initialized - tb_period = %lld\n", tb_period);
+        pr_info(DEVNAME ": initialized - tb_period = %lld\n", tb_period);
        return 0;
+out_class:
+        class_destroy(tb_class);
+out_chrdev:
+        unregister_chrdev(SBPROF_TB_MAJOR, DEVNAME);
+        return err;
 }
 static void __exit sbprof_tb_cleanup(void)
 {
+        device_destroy(tb_class, MKDEV(SBPROF_TB_MAJOR, 0));
        unregister_chrdev(SBPROF_TB_MAJOR, DEVNAME);
+        class_destroy(tb_class);
 }
 module_init(sbprof_tb_init);
 module_exit(sbprof_tb_cleanup);
+MODULE_ALIAS_CHARDEV_MAJOR(SBPROF_TB_MAJOR);
+MODULE_AUTHOR("Ralf Baechle <ralf@linux-mips.org>");
+MODULE_LICENSE("GPL");
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index 1cb042eab720..87188f0f6fbe 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -16,6 +16,7 @@
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 */
 #include <linux/init.h>
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/reboot.h>
 #include <linux/string.h>
@@ -32,6 +33,7 @@ unsigned int soc_pass;
 unsigned int soc_type;
 unsigned int periph_rev;
 unsigned int zbbus_mhz;
+EXPORT_SYMBOL(zbbus_mhz);
 static char *soc_str;
 static char *pass_str;
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 7ec4ac77c0fa..e4006dc087ca 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -225,6 +225,22 @@ static struct cpu_spec cpu_specs[] = {
                .oprofile_type          = PPC_OPROFILE_POWER4,
                .platform               = "ppc970",
        },
+        {       /* PPC970MP DD1.0 - no DEEPNAP, use regular 970 init */
+                .pvr_mask               = 0xffffffff,
+                .pvr_value              = 0x00440100,
+                .cpu_name               = "PPC970MP",
+                .cpu_features           = CPU_FTRS_PPC970,
+                .cpu_user_features      = COMMON_USER_POWER4 |
+                        PPC_FEATURE_HAS_ALTIVEC_COMP,
+                .icache_bsize           = 128,
+                .dcache_bsize           = 128,
+                .num_pmcs               = 8,
+                .cpu_setup              = __setup_cpu_ppc970,
+                .cpu_restore            = __restore_cpu_ppc970,
+                .oprofile_cpu_type      = "ppc64/970MP",
+                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .platform               = "ppc970",
+        },
        {       /* PPC970MP */
                .pvr_mask               = 0xffff0000,
                .pvr_value              = 0x00440000,
diff --git a/arch/powerpc/kernel/prom_parse.c b/arch/powerpc/kernel/prom_parse.c
index ea6fd552c7ea..91b443c9a488 100644
--- a/arch/powerpc/kernel/prom_parse.c
+++ b/arch/powerpc/kernel/prom_parse.c
@@ -916,7 +916,7 @@ EXPORT_SYMBOL_GPL(of_irq_map_raw);
 static int of_irq_map_oldworld(struct device_node *device, int index,
                               struct of_irq *out_irq)
 {
-        const u32 *ints;
+        const u32 *ints = NULL;
        int intlen;
        /*
diff --git a/arch/powerpc/platforms/83xx/mpc834x_mds.c b/arch/powerpc/platforms/83xx/mpc834x_mds.c
index e5d819166874..8aa9a93e2aa2 100644
--- a/arch/powerpc/platforms/83xx/mpc834x_mds.c
+++ b/arch/powerpc/platforms/83xx/mpc834x_mds.c
@@ -55,9 +55,9 @@ static int mpc834x_usb_cfg(void)
        struct device_node *np = NULL;
        int port0_is_dr = 0;
-        if ((np = of_find_compatible_node(np, "usb", "fsl-usb2-dr")) != NULL)
+        if ((np = of_find_compatible_node(NULL, "usb", "fsl-usb2-dr")) != NULL)
                port0_is_dr = 1;
-        if ((np = of_find_compatible_node(np, "usb", "fsl-usb2-mph")) != NULL){
+        if ((np = of_find_compatible_node(NULL, "usb", "fsl-usb2-mph")) != NULL){
                if (port0_is_dr) {
                        printk(KERN_WARNING
                                "There is only one USB port on PB board! \n");
@@ -103,8 +103,8 @@ static int mpc834x_usb_cfg(void)
                return -1;
        /*
-         * if MDS board is plug into PIB board,
+         * if Processor Board is plugged into PIB board,
-         * force to use the PHY on MDS board
+         * force to use the PHY on Processor Board
         */
        bcsr5 = in_8(bcsr_regs + 5);
        if (!(bcsr5 & BCSR5_INT_USB))
diff --git a/arch/powerpc/platforms/85xx/Kconfig b/arch/powerpc/platforms/85xx/Kconfig
index eb661ccf2dab..e764c0aced88 100644
--- a/arch/powerpc/platforms/85xx/Kconfig
+++ b/arch/powerpc/platforms/85xx/Kconfig
@@ -47,6 +47,7 @@ config MPC85xx
        bool
        select PPC_UDBG_16550
        select PPC_INDIRECT_PCI
+        select SERIAL_8250_SHARE_IRQ if SERIAL_8250
        default y if MPC8540_ADS || MPC85xx_CDS || MPC8560_ADS || MPC85xx_MDS
 config PPC_INDIRECT_PCI_BE
diff --git a/arch/powerpc/platforms/celleb/scc_epci.c b/arch/powerpc/platforms/celleb/scc_epci.c
index c11b39c3776a..fb23d53eb09c 100644
--- a/arch/powerpc/platforms/celleb/scc_epci.c
+++ b/arch/powerpc/platforms/celleb/scc_epci.c
@@ -43,11 +43,34 @@
 #define iob()  __asm__ __volatile__("eieio; sync":::"memory")
+static inline volatile void __iomem *celleb_epci_get_epci_base(
+                                        struct pci_controller *hose)
+{
+        /*
+         * Note:
+         * Celleb epci uses cfg_addr as a base address for
+         * epci control registers.
+         */
+        return hose->cfg_addr;
+}
+static inline volatile void __iomem *celleb_epci_get_epci_cfg(
+                                        struct pci_controller *hose)
+{
+        /*
+         * Note:
+         * Celleb epci uses cfg_data as a base address for
+         * configuration area for epci devices.
+         */
+        return hose->cfg_data;
+}
 #if 0 /* test code for epci dummy read */
 static void celleb_epci_dummy_read(struct pci_dev *dev)
 {
-        void __iomem *epci_base;
+        volatile void __iomem *epci_base;
        struct device_node *node;
        struct pci_controller *hose;
        u32 val;
@@ -58,7 +81,7 @@ static void celleb_epci_dummy_read(struct pci_dev *dev)
        if (!hose)
                return;
-        epci_base = hose->cfg_addr;
+        epci_base = celleb_epci_get_epci_base(hose);
        val = in_be32(epci_base + SCC_EPCI_WATRP);
        iosync();
@@ -70,19 +93,20 @@ static void celleb_epci_dummy_read(struct pci_dev *dev)
 static inline void clear_and_disable_master_abort_interrupt(
                                        struct pci_controller *hose)
 {
-        void __iomem *addr;
+        volatile void __iomem *epci_base, *reg;
-        addr = hose->cfg_addr + PCI_COMMAND;
+        epci_base = celleb_epci_get_epci_base(hose);
-        out_be32(addr, in_be32(addr) | (PCI_STATUS_REC_MASTER_ABORT << 16));
+        reg = epci_base + PCI_COMMAND;
+        out_be32(reg, in_be32(reg) | (PCI_STATUS_REC_MASTER_ABORT << 16));
 }
 static int celleb_epci_check_abort(struct pci_controller *hose,
-                                   void __iomem *addr)
+                                   volatile void __iomem *addr)
 {
-        void __iomem *reg, *epci_base;
+        volatile void __iomem *reg, *epci_base;
        u32 val;
        iob();
-        epci_base = hose->cfg_addr;
+        epci_base = celleb_epci_get_epci_base(hose);
        reg = epci_base + PCI_COMMAND;
        val = in_be32(reg);
@@ -108,20 +132,21 @@ static int celleb_epci_check_abort(struct pci_controller *hose,
        return PCIBIOS_SUCCESSFUL;
 }
-static void __iomem *celleb_epci_make_config_addr(struct pci_controller *hose,
+static volatile void __iomem *celleb_epci_make_config_addr(
+                                        struct pci_controller *hose,
                                        unsigned int devfn, int where)
 {
-        void __iomem *addr;
+        volatile void __iomem *addr;
        struct pci_bus *bus = hose->bus;
        if (bus->self)
-                addr = hose->cfg_data +
+                addr = celleb_epci_get_epci_cfg(hose) +
                       (((bus->number & 0xff) << 16)
                        | ((devfn & 0xff) << 8)
                        | (where & 0xff)
                        | 0x01000000);
        else
-                addr = hose->cfg_data +
+                addr = celleb_epci_get_epci_cfg(hose) +
                       (((devfn & 0xff) << 8) | (where & 0xff));
        pr_debug("EPCI: config_addr = 0x%p\n", addr);
@@ -132,7 +157,7 @@ static void __iomem *celleb_epci_make_config_addr(struct pci_controller *hose,
 static int celleb_epci_read_config(struct pci_bus *bus,
                        unsigned int devfn, int where, int size, u32 * val)
 {
-        void __iomem *addr;
+        volatile void __iomem *epci_base, *addr;
        struct device_node *node;
        struct pci_controller *hose;
@@ -142,13 +167,14 @@ static int celleb_epci_read_config(struct pci_bus *bus,
        node = (struct device_node *)bus->sysdata;
        hose = pci_find_hose_for_OF_device(node);
-        if (!hose->cfg_data)
+        if (!celleb_epci_get_epci_cfg(hose))
                return PCIBIOS_DEVICE_NOT_FOUND;
        if (bus->number == hose->first_busno && devfn == 0) {
                /* EPCI controller self */
-                addr = hose->cfg_addr + where;
+                epci_base = celleb_epci_get_epci_base(hose);
+                addr = epci_base + where;
                switch (size) {
                case 1:
@@ -185,7 +211,7 @@ static int celleb_epci_read_config(struct pci_bus *bus,
        }
        pr_debug("EPCI: "
-                 "addr=0x%lx, devfn=0x%x, where=0x%x, size=0x%x, val=0x%x\n",
+                 "addr=0x%p, devfn=0x%x, where=0x%x, size=0x%x, val=0x%x\n",
                 addr, devfn, where, size, *val);
        return celleb_epci_check_abort(hose, NULL);
@@ -194,7 +220,7 @@ static int celleb_epci_read_config(struct pci_bus *bus,
 static int celleb_epci_write_config(struct pci_bus *bus,
                        unsigned int devfn, int where, int size, u32 val)
 {
-        void __iomem *addr;
+        volatile void __iomem *epci_base, *addr;
        struct device_node *node;
        struct pci_controller *hose;
@@ -204,13 +230,15 @@ static int celleb_epci_write_config(struct pci_bus *bus,
        node = (struct device_node *)bus->sysdata;
        hose = pci_find_hose_for_OF_device(node);
-        if (!hose->cfg_data)
+        if (!celleb_epci_get_epci_cfg(hose))
                return PCIBIOS_DEVICE_NOT_FOUND;
        if (bus->number == hose->first_busno && devfn == 0) {
                /* EPCI controller self */
-                addr = hose->cfg_addr + where;
+                epci_base = celleb_epci_get_epci_base(hose);
+                addr = epci_base + where;
                switch (size) {
                case 1:
@@ -258,10 +286,10 @@ struct pci_ops celleb_epci_ops = {
 static int __devinit celleb_epci_init(struct pci_controller *hose)
 {
        u32 val;
-        void __iomem *reg, *epci_base;
+        volatile void __iomem *reg, *epci_base;
        int hwres = 0;
-        epci_base = hose->cfg_addr;
+        epci_base = celleb_epci_get_epci_base(hose);
        /* PCI core reset(Internal bus and PCI clock) */
        reg = epci_base + SCC_EPCI_CKCTRL;
@@ -382,6 +410,18 @@ int __devinit celleb_setup_epci(struct device_node *node,
        pr_debug("PCI: celleb_setup_epci()\n");
+        /*
+         * Note:
+         * Celleb epci uses cfg_addr and cfg_data member of
+         * pci_controller structure in irregular way.
+         *
+         * cfg_addr is used to map for control registers of
+         * celleb epci.
+         *
+         * cfg_data is used for configuration area of devices
+         * on Celleb epci buses.
+         */
        if (of_address_to_resource(node, 0, &r))
                goto error;
        hose->cfg_addr = ioremap(r.start, (r.end - r.start + 1));
diff --git a/arch/powerpc/platforms/embedded6xx/Kconfig b/arch/powerpc/platforms/embedded6xx/Kconfig
index 886c522d78e9..3410bcbc9dbe 100644
--- a/arch/powerpc/platforms/embedded6xx/Kconfig
+++ b/arch/powerpc/platforms/embedded6xx/Kconfig
@@ -79,6 +79,7 @@ config LINKSTATION
        select MPIC
        select FSL_SOC
        select PPC_UDBG_16550 if SERIAL_8250
+        select DEFAULT_UIMAGE
        help
          Select LINKSTATION if configuring for one of PPC- (MPC8241)
          based NAS systems from Buffalo Technology. So far only
diff --git a/arch/powerpc/platforms/powermac/feature.c b/arch/powerpc/platforms/powermac/feature.c
index c29a6a064d22..24cc50c1774a 100644
--- a/arch/powerpc/platforms/powermac/feature.c
+++ b/arch/powerpc/platforms/powermac/feature.c
@@ -810,6 +810,7 @@ core99_ata100_enable(struct device_node *node, long value)
        unsigned long flags;
        struct pci_dev *pdev = NULL;
        u8 pbus, pid;
+        int rc;
        if (uninorth_rev < 0x24)
                return -ENODEV;
@@ -828,7 +829,9 @@ core99_ata100_enable(struct device_node *node, long value)
                        pdev = pci_find_slot(pbus, pid);
                if (pdev == NULL)
                        return 0;
-                pci_enable_device(pdev);
+                rc = pci_enable_device(pdev);
+                if (rc)
+                        return rc;
                pci_set_master(pdev);
        }
        return 0;
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index f42475b27c15..6fbac308ded6 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -1191,8 +1191,11 @@ void __init pmac_pcibios_after_init(void)
         * -- BenH
         */
        for_each_pci_dev(dev) {
-                if ((dev->class >> 16) == PCI_BASE_CLASS_STORAGE)
+                if ((dev->class >> 16) != PCI_BASE_CLASS_STORAGE)
-                        pci_enable_device(dev);
+                        continue;
+                if (pci_enable_device(dev))
+                        printk(KERN_WARNING
+                               "pci: Failed to enable %s\n", pci_name(dev));
        }
 #endif /* CONFIG_BLK_DEV_IDE */
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 0183e5fbaf46..bf299b66f3fc 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -218,7 +218,7 @@ Commands:\n\
 "  ss   stop execution on all spus\n\
  sr    restore execution on stopped spus\n\
  sf  # dump spu fields for spu # (in hex)\n\
-  sd  # dump spu local store for spu # (in hex)\
+  sd  # dump spu local store for spu # (in hex)\n\
  sdi # disassemble spu local store for spu # (in hex)\n"
 #endif
 "  S    print special registers\n\
diff --git a/arch/sh/boards/renesas/r7780rp/Makefile b/arch/sh/boards/renesas/r7780rp/Makefile
index 3c93012e91a3..ed5f5a9a3b3e 100644
--- a/arch/sh/boards/renesas/r7780rp/Makefile
+++ b/arch/sh/boards/renesas/r7780rp/Makefile
@@ -2,6 +2,6 @@
 # Makefile for the R7780RP-1 specific parts of the kernel
 #
-obj-y    := setup.o io.o irq.o
+obj-y    := setup.o irq.o
 obj-$(CONFIG_PUSH_SWITCH)       += psw.o
diff --git a/arch/sh/boards/renesas/r7780rp/io.c b/arch/sh/boards/renesas/r7780rp/io.c
deleted file mode 100644
index f74d2ffb3851..000000000000
--- a/arch/sh/boards/renesas/r7780rp/io.c
+++ /dev/null
@@ -1,233 +0,0 @@
-/*
- * Copyright (C) 2001  Ian da Silva, Jeremy Siegel
- * Based largely on io_se.c.
- *
- * I/O routine for Renesas Solutions Highlander R7780RP-1
- *
- * Initial version only to support LAN access; some
- * placeholder code from io_r7780rp.c left in with the
- * expectation of later SuperIO and PCMCIA access.
- */
-#include <linux/pci.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/io.h>
-#include <asm/r7780rp.h>
-#include <asm/addrspace.h>
-static inline unsigned long port88796l(unsigned int port, int flag)
-{
-        unsigned long addr;
-        if (flag)
-                addr = PA_AX88796L + ((port - AX88796L_IO_BASE) << 1);
-        else
-                addr = PA_AX88796L + ((port - AX88796L_IO_BASE) << 1) + 0x1000;
-        return addr;
-}
-#if defined(CONFIG_NE2000) || defined(CONFIG_NE2000_MODULE)
-#define CHECK_AX88796L_PORT(port) \
-  ((port >= AX88796L_IO_BASE) && (port < (AX88796L_IO_BASE+0x20)))
-#else
-#define CHECK_AX88796L_PORT(port) (0)
-#endif
-/*
- * General outline: remap really low stuff [eventually] to SuperIO,
- * stuff in PCI IO space (at or above window at pci.h:PCIBIOS_MIN_IO)
- * is mapped through the PCI IO window.  Stuff with high bits (PXSEG)
- * should be way beyond the window, and is used  w/o translation for
- * compatibility.
- */
-u8 r7780rp_inb(unsigned long port)
-{
-        if (CHECK_AX88796L_PORT(port))
-                return ctrl_inw(port88796l(port, 0)) & 0xff;
-        else if (is_pci_ioaddr(port))
-                return ctrl_inb(pci_ioaddr(port));
-        return ctrl_inw(port) & 0xff;
-}
-u8 r7780rp_inb_p(unsigned long port)
-{
-        u8 v;
-        if (CHECK_AX88796L_PORT(port))
-                v = ctrl_inw(port88796l(port, 0)) & 0xff;
-        else if (is_pci_ioaddr(port))
-                v = ctrl_inb(pci_ioaddr(port));
-        else
-                v = ctrl_inw(port) & 0xff;
-        ctrl_delay();
-        return v;
-}
-u16 r7780rp_inw(unsigned long port)
-{
-        if (is_pci_ioaddr(port))
-                return ctrl_inw(pci_ioaddr(port));
-        return ctrl_inw(port);
-}
-u32 r7780rp_inl(unsigned long port)
-{
-        if (is_pci_ioaddr(port))
-                return ctrl_inl(pci_ioaddr(port));
-        return ctrl_inl(port);
-}
-void r7780rp_outb(u8 value, unsigned long port)
-{
-        if (CHECK_AX88796L_PORT(port))
-                ctrl_outw(value, port88796l(port, 0));
-        else if (is_pci_ioaddr(port))
-                ctrl_outb(value, pci_ioaddr(port));
-        else
-                ctrl_outb(value, port);
-}
-void r7780rp_outb_p(u8 value, unsigned long port)
-{
-        if (CHECK_AX88796L_PORT(port))
-                ctrl_outw(value, port88796l(port, 0));
-        else if (is_pci_ioaddr(port))
-                ctrl_outb(value, pci_ioaddr(port));
-        else
-                ctrl_outb(value, port);
-        ctrl_delay();
-}
-void r7780rp_outw(u16 value, unsigned long port)
-{
-        if (is_pci_ioaddr(port))
-                ctrl_outw(value, pci_ioaddr(port));
-        else
-                ctrl_outw(value, port);
-}
-void r7780rp_outl(u32 value, unsigned long port)
-{
-        if (is_pci_ioaddr(port))
-                ctrl_outl(value, pci_ioaddr(port));
-        else
-                ctrl_outl(value, port);
-}
-void r7780rp_insb(unsigned long port, void *dst, unsigned long count)
-{
-        volatile u16 *p;
-        u8 *buf = dst;
-        if (CHECK_AX88796L_PORT(port)) {
-                p = (volatile u16 *)port88796l(port, 0);
-                while (count--)
-                        *buf++ = *p & 0xff;
-        } else if (is_pci_ioaddr(port)) {
-                volatile u8 *bp = (volatile u8 *)pci_ioaddr(port);
-                while (count--)
-                        *buf++ = *bp;
-        } else {
-                p = (volatile u16 *)port;
-                while (count--)
-                        *buf++ = *p & 0xff;
-        }
-}
-void r7780rp_insw(unsigned long port, void *dst, unsigned long count)
-{
-        volatile u16 *p;
-        u16 *buf = dst;
-        if (CHECK_AX88796L_PORT(port))
-                p = (volatile u16 *)port88796l(port, 1);
-        else if (is_pci_ioaddr(port))
-                p = (volatile u16 *)pci_ioaddr(port);
-        else
-                p = (volatile u16 *)port;
-        while (count--)
-                *buf++ = *p;
-        flush_dcache_all();
-}
-void r7780rp_insl(unsigned long port, void *dst, unsigned long count)
-{
-        if (is_pci_ioaddr(port)) {
-                volatile u32 *p = (volatile u32 *)pci_ioaddr(port);
-                u32 *buf = dst;
-                while (count--)
-                        *buf++ = *p;
-        }
-}
-void r7780rp_outsb(unsigned long port, const void *src, unsigned long count)
-{
-        volatile u16 *p;
-        const u8 *buf = src;
-        if (CHECK_AX88796L_PORT(port)) {
-                p = (volatile u16 *)port88796l(port, 0);
-                while (count--)
-                        *p = *buf++;
-        } else if (is_pci_ioaddr(port)) {
-                volatile u8 *bp = (volatile u8 *)pci_ioaddr(port);
-                while (count--)
-                        *bp = *buf++;
-        } else
-                while (count--)
-                        ctrl_outb(*buf++, port);
-}
-void r7780rp_outsw(unsigned long port, const void *src, unsigned long count)
-{
-        volatile u16 *p;
-        const u16 *buf = src;
-        if (CHECK_AX88796L_PORT(port))
-                p = (volatile u16 *)port88796l(port, 1);
-        else if (is_pci_ioaddr(port))
-                p = (volatile u16 *)pci_ioaddr(port);
-        else
-                p = (volatile u16 *)port;
-        while (count--)
-                *p = *buf++;
-        flush_dcache_all();
-}
-void r7780rp_outsl(unsigned long port, const void *src, unsigned long count)
-{
-        const u32 *buf = src;
-        u32 *p;
-        if (is_pci_ioaddr(port))
-                p = (u32 *)pci_ioaddr(port);
-        else
-                p = (u32 *)port;
-        while (count--)
-                ctrl_outl(*buf++, (unsigned long)p);
-}
-void __iomem *r7780rp_ioport_map(unsigned long port, unsigned int size)
-{
-        if (CHECK_AX88796L_PORT(port))
-                return (void __iomem *)port88796l(port, size > 1);
-        else if (is_pci_ioaddr(port))
-                return (void __iomem *)pci_ioaddr(port);
-        return (void __iomem *)port;
-}
diff --git a/arch/sh/boards/renesas/r7780rp/setup.c b/arch/sh/boards/renesas/r7780rp/setup.c
index 0d74db9f1792..2faba6679e64 100644
--- a/arch/sh/boards/renesas/r7780rp/setup.c
+++ b/arch/sh/boards/renesas/r7780rp/setup.c
@@ -187,31 +187,7 @@ static void __init r7780rp_setup(char **cmdline_p)
 struct sh_machine_vector mv_r7780rp __initmv = {
        .mv_name                = "Highlander R7780RP-1",
        .mv_setup               = r7780rp_setup,
        .mv_nr_irqs             = 109,
-        .mv_inb                 = r7780rp_inb,
-        .mv_inw                 = r7780rp_inw,
-        .mv_inl                 = r7780rp_inl,
-        .mv_outb                = r7780rp_outb,
-        .mv_outw                = r7780rp_outw,
-        .mv_outl                = r7780rp_outl,
-        .mv_inb_p               = r7780rp_inb_p,
-        .mv_inw_p               = r7780rp_inw,
-        .mv_inl_p               = r7780rp_inl,
-        .mv_outb_p              = r7780rp_outb_p,
-        .mv_outw_p              = r7780rp_outw,
-        .mv_outl_p              = r7780rp_outl,
-        .mv_insb                = r7780rp_insb,
-        .mv_insw                = r7780rp_insw,
-        .mv_insl                = r7780rp_insl,
-        .mv_outsb               = r7780rp_outsb,
-        .mv_outsw               = r7780rp_outsw,
-        .mv_outsl               = r7780rp_outsl,
-        .mv_ioport_map          = r7780rp_ioport_map,
        .mv_init_irq            = init_r7780rp_IRQ,
 };
 ALIAS_MV(r7780rp)
diff --git a/arch/sh/boards/renesas/rts7751r2d/setup.c b/arch/sh/boards/renesas/rts7751r2d/setup.c
index 44b42082a0af..593f26a85e9c 100644
--- a/arch/sh/boards/renesas/rts7751r2d/setup.c
+++ b/arch/sh/boards/renesas/rts7751r2d/setup.c
@@ -12,6 +12,7 @@
 #include <linux/platform_device.h>
 #include <linux/pata_platform.h>
 #include <linux/serial_8250.h>
+#include <linux/sm501.h>
 #include <linux/pm.h>
 #include <asm/machvec.h>
 #include <asm/rts7751r2d.h>
@@ -111,10 +112,35 @@ static struct platform_device heartbeat_device = {
        .resource       = heartbeat_resources,
 };
+static struct resource sm501_resources[] = {
+        [0]     = {
+                .start  = 0x10000000,
+                .end    = 0x13e00000 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1]     = {
+                .start  = 0x13e00000,
+                .end    = 0x13ffffff,
+                .flags  = IORESOURCE_MEM,
+        },
+        [2]     = {
+                .start  = 32,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device sm501_device = {
+        .name           = "sm501",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(sm501_resources),
+        .resource       = sm501_resources,
+};
 static struct platform_device *rts7751r2d_devices[] __initdata = {
        &uart_device,
        &heartbeat_device,
        &cf_ide_device,
+        &sm501_device,
 };
 static int __init rts7751r2d_devices_setup(void)
diff --git a/arch/sh/configs/rts7751r2d_defconfig b/arch/sh/configs/rts7751r2d_defconfig
index db6a02df5af6..a59bb78bd071 100644
--- a/arch/sh/configs/rts7751r2d_defconfig
+++ b/arch/sh/configs/rts7751r2d_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.20
+# Linux kernel version: 2.6.21-rc1
-# Thu Feb 15 17:17:29 2007
+# Thu Mar  1 16:42:40 2007
 #
 CONFIG_SUPERH=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_HARDIRQS=y
-CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 # CONFIG_GENERIC_TIME is not set
@@ -33,6 +32,7 @@ CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
@@ -119,7 +119,6 @@ CONFIG_SH_RTS7751R2D=y
 # CONFIG_SH_SHMIN is not set
 # CONFIG_SH_7206_SOLUTION_ENGINE is not set
 # CONFIG_SH_7619_SOLUTION_ENGINE is not set
-# CONFIG_SH_ASDAP310 is not set
 # CONFIG_SH_UNKNOWN is not set
 #
@@ -281,7 +280,7 @@ CONFIG_ZERO_PAGE_OFFSET=0x00010000
 CONFIG_BOOT_LINK_OFFSET=0x00800000
 # CONFIG_UBC_WAKEUP is not set
 CONFIG_CMDLINE_BOOL=y
-CONFIG_CMDLINE="console=ttySC0,115200 root=/dev/sda1"
+CONFIG_CMDLINE="console=tty0 console=ttySC0,115200 root=/dev/sda1"
 #
 # Bus options
@@ -433,6 +432,7 @@ CONFIG_FW_LOADER=m
 #
 # Plug and Play support
 #
+# CONFIG_PNPACPI is not set
 #
 # Block devices
@@ -770,7 +770,26 @@ CONFIG_NET_WIRELESS=y
 #
 # Input device support
 #
-# CONFIG_INPUT is not set
+CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
+#
+# Userland interfaces
+#
+# CONFIG_INPUT_MOUSEDEV is not set
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_TSDEV is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_EVBUG is not set
+#
+# Input Device Drivers
+#
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
 #
 # Hardware I/O ports
@@ -781,7 +800,10 @@ CONFIG_NET_WIRELESS=y
 #
 # Character devices
 #
-# CONFIG_VT is not set
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_HW_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_SERIAL_NONSTANDARD is not set
 #
@@ -857,6 +879,11 @@ CONFIG_HWMON=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 #
+# Multifunction device drivers
+#
+CONFIG_MFD_SM501=y
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -869,9 +896,66 @@ CONFIG_HWMON=y
 #
 # Graphics support
 #
-CONFIG_FIRMWARE_EDID=y
-# CONFIG_FB is not set
 # CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+CONFIG_FB=y
+# CONFIG_FIRMWARE_EDID is not set
+# CONFIG_FB_DDC is not set
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+# CONFIG_FB_SVGALIB is not set
+# CONFIG_FB_MACMODES is not set
+# CONFIG_FB_BACKLIGHT is not set
+# CONFIG_FB_MODE_HELPERS is not set
+# CONFIG_FB_TILEBLITTING is not set
+#
+# Frambuffer hardware drivers
+#
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_PM2 is not set
+# CONFIG_FB_CYBER2000 is not set
+# CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_IMSTT is not set
+# CONFIG_FB_EPSON1355 is not set
+# CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_NVIDIA is not set
+# CONFIG_FB_RIVA is not set
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_RADEON is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_ATY is not set
+# CONFIG_FB_S3 is not set
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_NEOMAGIC is not set
+# CONFIG_FB_KYRO is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_TRIDENT is not set
+CONFIG_FB_SM501=y
+# CONFIG_FB_VIRTUAL is not set
+#
+# Console display driver support
+#
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x8=y
+CONFIG_FONT_8x16=y
+#
+# Logo configuration
+#
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+# CONFIG_LOGO_LINUX_CLUT224 is not set
+# CONFIG_LOGO_SUPERH_MONO is not set
+# CONFIG_LOGO_SUPERH_VGA16 is not set
+CONFIG_LOGO_SUPERH_CLUT224=y
 #
 # Sound
@@ -985,6 +1069,12 @@ CONFIG_SOUND_PRIME=m
 CONFIG_AC97_BUS=m
 #
+# HID Devices
+#
+CONFIG_HID=y
+# CONFIG_HID_DEBUG is not set
+#
 # USB support
 #
 CONFIG_USB_ARCH_HAS_HCD=y
@@ -1237,7 +1327,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_EARLY_SCIF_CONSOLE=y
 CONFIG_EARLY_SCIF_CONSOLE_PORT=0xffe80000
 CONFIG_EARLY_PRINTK=y
-# CONFIG_KGDB is not set
+# CONFIG_SH_KGDB is not set
 #
 # Security options
diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index ab4ebb856c2a..b46728027195 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -224,7 +224,7 @@ work_resched:
 syscall_exit_work:
        ! r0: current_thread_info->flags
        ! r8: current_thread_info
-        tst     #_TIF_SYSCALL_TRACE, r0
+        tst     #_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP, r0
        bt/s    work_pending
         tst    #_TIF_NEED_RESCHED, r0
 #ifdef CONFIG_TRACE_IRQFLAGS
diff --git a/arch/sh/kernel/io_generic.c b/arch/sh/kernel/io_generic.c
index 66626c03e1ee..771ea4230441 100644
--- a/arch/sh/kernel/io_generic.c
+++ b/arch/sh/kernel/io_generic.c
@@ -14,7 +14,6 @@
 #include <linux/module.h>
 #include <linux/io.h>
 #include <asm/machvec.h>
-#include <asm/cacheflush.h>
 #ifdef CONFIG_CPU_SH3
 /* SH3 has a PCMCIA bug that needs a dummy read from area 6 for a
@@ -96,7 +95,6 @@ void generic_insw(unsigned long port, void *dst, unsigned long count)
        while (count--)
                *buf++ = *port_addr;
-        flush_dcache_all();
        dummy_read();
 }
@@ -171,7 +169,6 @@ void generic_outsw(unsigned long port, const void *src, unsigned long count)
        while (count--)
                *port_addr = *buf++;
-        flush_dcache_all();
        dummy_read();
 }
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index 9d6a438b3eaf..e7607366ac4e 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -250,12 +250,11 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long usp,
                childregs->regs[15] = usp;
                ti->addr_limit = USER_DS;
        } else {
-                childregs->regs[15] = (unsigned long)task_stack_page(p) +
+                childregs->regs[15] = (unsigned long)childregs;
-                                                        THREAD_SIZE;
                ti->addr_limit = KERNEL_DS;
        }
-        if (clone_flags & CLONE_SETTLS)
+        if (clone_flags & CLONE_SETTLS)
                childregs->gbr = childregs->regs[0];
        childregs->regs[0] = 0; /* Set return value for child */
diff --git a/arch/sh/kernel/ptrace.c b/arch/sh/kernel/ptrace.c
index 04ca13a041c1..855f7246cfff 100644
--- a/arch/sh/kernel/ptrace.c
+++ b/arch/sh/kernel/ptrace.c
@@ -8,7 +8,6 @@
 * SuperH version:   Copyright (C) 1999, 2000  Kaz Kojima & Niibe Yutaka
 *
 */
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
@@ -20,8 +19,7 @@
 #include <linux/slab.h>
 #include <linux/security.h>
 #include <linux/signal.h>
+#include <linux/io.h>
-#include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
@@ -59,6 +57,23 @@ static inline int put_stack_long(struct task_struct *task, int offset,
        return 0;
 }
+static void ptrace_disable_singlestep(struct task_struct *child)
+{
+        clear_tsk_thread_flag(child, TIF_SINGLESTEP);
+        /*
+         * Ensure the UBC is not programmed at the next context switch.
+         *
+         * Normally this is not needed but there are sequences such as
+         * singlestep, signal delivery, and continue that leave the
+         * ubc_pc non-zero leading to spurious SIGTRAPs.
+         */
+        if (child->thread.ubc_pc != 0) {
+                ubc_usercnt -= 1;
+                child->thread.ubc_pc = 0;
+        }
+}
 /*
 * Called by kernel/ptrace.c when detaching..
 *
@@ -66,7 +81,7 @@ static inline int put_stack_long(struct task_struct *task, int offset,
 */
 void ptrace_disable(struct task_struct *child)
 {
-        /* nothing to do.. */
+        ptrace_disable_singlestep(child);
 }
 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
@@ -76,7 +91,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
        switch (request) {
        /* when I and D space are separate, these will need to be fixed. */
-        case PTRACE_PEEKTEXT: /* read word at location addr. */ 
+        case PTRACE_PEEKTEXT: /* read word at location addr. */
        case PTRACE_PEEKDATA: {
                unsigned long tmp;
                int copied;
@@ -94,7 +109,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                unsigned long tmp;
                ret = -EIO;
-                if ((addr & 3) || addr < 0 || 
+                if ((addr & 3) || addr < 0 ||
                    addr > sizeof(struct user) - 3)
                        break;
@@ -129,7 +144,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
        case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
                ret = -EIO;
-                if ((addr & 3) || addr < 0 || 
+                if ((addr & 3) || addr < 0 ||
                    addr > sizeof(struct user) - 3)
                        break;
@@ -156,6 +171,9 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                        set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                else
                        clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
+                ptrace_disable_singlestep(child);
                child->exit_code = data;
                wake_up_process(child);
                ret = 0;
@@ -163,14 +181,15 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
        }
 /*
- * make the child exit.  Best I can do is send it a sigkill. 
+ * make the child exit.  Best I can do is send it a sigkill.
- * perhaps it should be put in the status that it wants to 
+ * perhaps it should be put in the status that it wants to
 * exit.
 */
        case PTRACE_KILL: {
                ret = 0;
                if (child->exit_state == EXIT_ZOMBIE)   /* already dead */
                        break;
+                ptrace_disable_singlestep(child);
                child->exit_code = SIGKILL;
                wake_up_process(child);
                break;
@@ -196,6 +215,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                        ubc_usercnt += 1;
                child->thread.ubc_pc = pc;
+                set_tsk_thread_flag(child, TIF_SINGLESTEP);
                child->exit_code = data;
                /* give it a chance to run. */
                wake_up_process(child);
@@ -248,14 +268,15 @@ asmlinkage void do_syscall_trace(void)
 {
        struct task_struct *tsk = current;
-        if (!test_thread_flag(TIF_SYSCALL_TRACE))
+        if (!test_thread_flag(TIF_SYSCALL_TRACE) &&
+            !test_thread_flag(TIF_SINGLESTEP))
                return;
        if (!(tsk->ptrace & PT_PTRACED))
                return;
        /* the 0x80 provides a way for the tracing parent to distinguish
           between a syscall stop and SIGTRAP delivery */
-        ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
+        ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) &&
-                                 ? 0x80 : 0));
+                                 !test_thread_flag(TIF_SINGLESTEP) ? 0x80 : 0));
        /*
         * this isn't the same as continuing with a signal, but it will do
diff --git a/arch/sh/kernel/signal.c b/arch/sh/kernel/signal.c
index 32f10a03fbb5..9f39ef1f73da 100644
--- a/arch/sh/kernel/signal.c
+++ b/arch/sh/kernel/signal.c
@@ -589,6 +589,8 @@ static void do_signal(struct pt_regs *regs, unsigned int save_r0)
                        if (test_thread_flag(TIF_RESTORE_SIGMASK))
                                clear_thread_flag(TIF_RESTORE_SIGMASK);
                }
+                return;
        }
 no_signal:
@@ -598,7 +600,7 @@ static void do_signal(struct pt_regs *regs, unsigned int save_r0)
                if (regs->regs[0] == -ERESTARTNOHAND ||
                    regs->regs[0] == -ERESTARTSYS ||
                    regs->regs[0] == -ERESTARTNOINTR) {
-                        regs->regs[0] = save_r0;
+                        regs->regs[0] = save_r0;
                        regs->pc -= 2;
                } else if (regs->regs[0] == -ERESTART_RESTARTBLOCK) {
                        regs->pc -= 2;
diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
index 75de165867a0..78a6c09875b2 100644
--- a/arch/sh/kernel/vmlinux.lds.S
+++ b/arch/sh/kernel/vmlinux.lds.S
@@ -3,6 +3,7 @@
 * Written by Niibe Yutaka
 */
 #include <asm/thread_info.h>
+#include <asm/cache.h>
 #include <asm-generic/vmlinux.lds.h>
 #ifdef CONFIG_CPU_LITTLE_ENDIAN
@@ -53,7 +54,7 @@ SECTIONS
  . = ALIGN(PAGE_SIZE);
  .data.page_aligned : { *(.data.page_aligned) }
-  . = ALIGN(32);
+  . = ALIGN(L1_CACHE_BYTES);
  __per_cpu_start = .;
  .data.percpu : { *(.data.percpu) }
  __per_cpu_end = .;
diff --git a/arch/sh/mm/cache-sh4.c b/arch/sh/mm/cache-sh4.c
index e0cd4b7f4aeb..981b04089055 100644
--- a/arch/sh/mm/cache-sh4.c
+++ b/arch/sh/mm/cache-sh4.c
@@ -237,20 +237,10 @@ static inline void flush_cache_4096(unsigned long start,
 /*
 * Write back & invalidate the D-cache of the page.
 * (To avoid "alias" issues)
- *
- * This uses a lazy write-back on UP, which is explicitly
- * disabled on SMP.
 */
 void flush_dcache_page(struct page *page)
 {
-#ifndef CONFIG_SMP
+        if (test_bit(PG_mapped, &page->flags)) {
-        struct address_space *mapping = page_mapping(page);
-        if (mapping && !mapping_mapped(mapping))
-                set_bit(PG_dcache_dirty, &page->flags);
-        else
-#endif
-        {
                unsigned long phys = PHYSADDR(page_address(page));
                unsigned long addr = CACHE_OC_ADDRESS_ARRAY;
                int i, n;
diff --git a/arch/sh/mm/cache-sh7705.c b/arch/sh/mm/cache-sh7705.c
index 31f8deb7a158..4896d7376926 100644
--- a/arch/sh/mm/cache-sh7705.c
+++ b/arch/sh/mm/cache-sh7705.c
@@ -3,11 +3,11 @@
 *
 * Copyright (C) 1999, 2000  Niibe Yutaka
 * Copyright (C) 2004  Alex Song
- * Copyright (C) 2006  Paul Mundt
 *
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
+ *
 */
 #include <linux/init.h>
 #include <linux/mman.h>
@@ -51,6 +51,7 @@ static inline void cache_wback_all(void)
                        if ((data & v) == v)
                                ctrl_outl(data & ~v, addr);
                }
                addrstart += current_cpu_data.dcache.way_incr;
@@ -127,11 +128,7 @@ static void __flush_dcache_page(unsigned long phys)
 */
 void flush_dcache_page(struct page *page)
 {
-        struct address_space *mapping = page_mapping(page);
+        if (test_bit(PG_mapped, &page->flags))
-        if (mapping && !mapping_mapped(mapping))
-                set_bit(PG_dcache_dirty, &page->flags);
-        else
                __flush_dcache_page(PHYSADDR(page_address(page)));
 }
diff --git a/arch/sh/mm/pg-sh4.c b/arch/sh/mm/pg-sh4.c
index 969efeceb928..df69da9ca69c 100644
--- a/arch/sh/mm/pg-sh4.c
+++ b/arch/sh/mm/pg-sh4.c
@@ -23,6 +23,7 @@ extern struct mutex p3map_mutex[];
 */
 void clear_user_page(void *to, unsigned long address, struct page *page)
 {
+        __set_bit(PG_mapped, &page->flags);
        if (((address ^ (unsigned long)to) & CACHE_ALIAS) == 0)
                clear_page(to);
        else {
@@ -58,6 +59,7 @@ void clear_user_page(void *to, unsigned long address, struct page *page)
 void copy_user_page(void *to, void *from, unsigned long address,
                    struct page *page)
 {
+        __set_bit(PG_mapped, &page->flags);
        if (((address ^ (unsigned long)to) & CACHE_ALIAS) == 0)
                copy_page(to, from);
        else {
@@ -82,3 +84,23 @@ void copy_user_page(void *to, void *from, unsigned long address,
                mutex_unlock(&p3map_mutex[(address & CACHE_ALIAS)>>12]);
        }
 }
+/*
+ * For SH-4, we have our own implementation for ptep_get_and_clear
+ */
+inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+{
+        pte_t pte = *ptep;
+        pte_clear(mm, addr, ptep);
+        if (!pte_not_present(pte)) {
+                unsigned long pfn = pte_pfn(pte);
+                if (pfn_valid(pfn)) {
+                        struct page *page = pfn_to_page(pfn);
+                        struct address_space *mapping = page_mapping(page);
+                        if (!mapping || !mapping_writably_mapped(mapping))
+                                __clear_bit(PG_mapped, &page->flags);
+                }
+        }
+        return pte;
+}
diff --git a/arch/sh/mm/pg-sh7705.c b/arch/sh/mm/pg-sh7705.c
index 887ab9d18ccd..a4b015f95a3a 100644
--- a/arch/sh/mm/pg-sh7705.c
+++ b/arch/sh/mm/pg-sh7705.c
@@ -7,7 +7,9 @@
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
+ *
 */
 #include <linux/init.h>
 #include <linux/mman.h>
 #include <linux/mm.h>
@@ -74,6 +76,7 @@ void clear_user_page(void *to, unsigned long address, struct page *pg)
 {
        struct page *page = virt_to_page(to);
+        __set_bit(PG_mapped, &page->flags);
        if (((address ^ (unsigned long)to) & CACHE_ALIAS) == 0) {
                clear_page(to);
                __flush_wback_region(to, PAGE_SIZE);
@@ -92,11 +95,12 @@ void clear_user_page(void *to, unsigned long address, struct page *pg)
 * @from: P1 address
 * @address: U0 address to be mapped
 */
-void copy_user_page(void *to, void *from, unsigned long address,
+void copy_user_page(void *to, void *from, unsigned long address, struct page *pg)
-                    struct page *pg)
 {
        struct page *page = virt_to_page(to);
+        __set_bit(PG_mapped, &page->flags);
        if (((address ^ (unsigned long)to) & CACHE_ALIAS) == 0) {
                copy_page(to, from);
                __flush_wback_region(to, PAGE_SIZE);
@@ -108,3 +112,26 @@ void copy_user_page(void *to, void *from, unsigned long address,
                __flush_wback_region(to, PAGE_SIZE);
        }
 }
+/*
+ * For SH7705, we have our own implementation for ptep_get_and_clear
+ * Copied from pg-sh4.c
+ */
+inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+{
+        pte_t pte = *ptep;
+        pte_clear(mm, addr, ptep);
+        if (!pte_not_present(pte)) {
+                unsigned long pfn = pte_pfn(pte);
+                if (pfn_valid(pfn)) {
+                        struct page *page = pfn_to_page(pfn);
+                        struct address_space *mapping = page_mapping(page);
+                        if (!mapping || !mapping_writably_mapped(mapping))
+                                __clear_bit(PG_mapped, &page->flags);
+                }
+        }
+        return pte;
+}
diff --git a/arch/sh/mm/tlb-flush.c b/arch/sh/mm/tlb-flush.c
index d2f7b4a2eb05..6f45c1f8a7fe 100644
--- a/arch/sh/mm/tlb-flush.c
+++ b/arch/sh/mm/tlb-flush.c
@@ -2,17 +2,15 @@
 * TLB flushing operations for SH with an MMU.
 *
 *  Copyright (C) 1999  Niibe Yutaka
- *  Copyright (C) 2003 - 2006  Paul Mundt
+ *  Copyright (C) 2003  Paul Mundt
 *
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
 */
 #include <linux/mm.h>
-#include <linux/io.h>
 #include <asm/mmu_context.h>
 #include <asm/tlbflush.h>
-#include <asm/cacheflush.h>
 void local_flush_tlb_page(struct vm_area_struct *vma, unsigned long page)
 {
@@ -140,54 +138,3 @@ void local_flush_tlb_all(void)
        ctrl_barrier();
        local_irq_restore(flags);
 }
-void update_mmu_cache(struct vm_area_struct *vma,
-                      unsigned long address, pte_t pte)
-{
-        unsigned long flags;
-        unsigned long pteval;
-        unsigned long vpn;
-        struct page *page;
-        unsigned long pfn = pte_pfn(pte);
-        struct address_space *mapping;
-        if (!pfn_valid(pfn))
-                return;
-        page = pfn_to_page(pfn);
-        mapping = page_mapping(page);
-        if (mapping) {
-                unsigned long phys = pte_val(pte) & PTE_PHYS_MASK;
-                int dirty = test_and_clear_bit(PG_dcache_dirty, &page->flags);
-                if (dirty)
-                        __flush_wback_region((void *)P1SEGADDR(phys),
-                                             PAGE_SIZE);
-        }
-        local_irq_save(flags);
-        /* Set PTEH register */
-        vpn = (address & MMU_VPN_MASK) | get_asid();
-        ctrl_outl(vpn, MMU_PTEH);
-        pteval = pte_val(pte);
-#ifdef CONFIG_CPU_HAS_PTEA
-        /* Set PTEA register */
-        /* TODO: make this look less hacky */
-        ctrl_outl(((pteval >> 28) & 0xe) | (pteval & 0x1), MMU_PTEA);
-#endif
-        /* Set PTEL register */
-        pteval &= _PAGE_FLAGS_HARDWARE_MASK; /* drop software flags */
-#if defined(CONFIG_SH_WRITETHROUGH) && defined(CONFIG_CPU_SH4)
-        pteval |= _PAGE_WT;
-#endif
-        /* conveniently, we want all the software flags to be 0 anyway */
-        ctrl_outl(pteval, MMU_PTEL);
-        /* Load the TLB */
-        asm volatile("ldtlb": /* no output */ : /* no input */ : "memory");
-        local_irq_restore(flags);
-}
diff --git a/arch/sh/mm/tlb-sh3.c b/arch/sh/mm/tlb-sh3.c
index e5e76eb7ee09..7fbfd5a11ffa 100644
--- a/arch/sh/mm/tlb-sh3.c
+++ b/arch/sh/mm/tlb-sh3.c
@@ -8,9 +8,69 @@
 *
 * Released under the terms of the GNU GPL v2.0.
 */
-#include <linux/io.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/ptrace.h>
+#include <linux/mman.h>
+#include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/smp_lock.h>
+#include <linux/interrupt.h>
 #include <asm/system.h>
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/pgalloc.h>
 #include <asm/mmu_context.h>
+#include <asm/cacheflush.h>
+void update_mmu_cache(struct vm_area_struct * vma,
+                      unsigned long address, pte_t pte)
+{
+        unsigned long flags;
+        unsigned long pteval;
+        unsigned long vpn;
+        /* Ptrace may call this routine. */
+        if (vma && current->active_mm != vma->vm_mm)
+                return;
+#if defined(CONFIG_SH7705_CACHE_32KB)
+        {
+                struct page *page = pte_page(pte);
+                unsigned long pfn = pte_pfn(pte);
+                if (pfn_valid(pfn) && !test_bit(PG_mapped, &page->flags)) {
+                        unsigned long phys = pte_val(pte) & PTE_PHYS_MASK;
+                        __flush_wback_region((void *)P1SEGADDR(phys),
+                                             PAGE_SIZE);
+                        __set_bit(PG_mapped, &page->flags);
+                }
+        }
+#endif
+        local_irq_save(flags);
+        /* Set PTEH register */
+        vpn = (address & MMU_VPN_MASK) | get_asid();
+        ctrl_outl(vpn, MMU_PTEH);
+        pteval = pte_val(pte);
+        /* Set PTEL register */
+        pteval &= _PAGE_FLAGS_HARDWARE_MASK; /* drop software flags */
+        /* conveniently, we want all the software flags to be 0 anyway */
+        ctrl_outl(pteval, MMU_PTEL);
+        /* Load the TLB */
+        asm volatile("ldtlb": /* no output */ : /* no input */ : "memory");
+        local_irq_restore(flags);
+}
 void local_flush_tlb_one(unsigned long asid, unsigned long page)
 {
@@ -34,3 +94,4 @@ void local_flush_tlb_one(unsigned long asid, unsigned long page)
        for (i = 0; i < ways; i++)
                ctrl_outl(data, addr + (i << 8));
 }
diff --git a/arch/sh/mm/tlb-sh4.c b/arch/sh/mm/tlb-sh4.c
index 221e7095473d..f74cf667c8fa 100644
--- a/arch/sh/mm/tlb-sh4.c
+++ b/arch/sh/mm/tlb-sh4.c
@@ -8,9 +8,74 @@
 *
 * Released under the terms of the GNU GPL v2.0.
 */
-#include <linux/io.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/ptrace.h>
+#include <linux/mman.h>
+#include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/smp_lock.h>
+#include <linux/interrupt.h>
 #include <asm/system.h>
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/pgalloc.h>
 #include <asm/mmu_context.h>
+#include <asm/cacheflush.h>
+void update_mmu_cache(struct vm_area_struct * vma,
+                      unsigned long address, pte_t pte)
+{
+        unsigned long flags;
+        unsigned long pteval;
+        unsigned long vpn;
+        struct page *page;
+        unsigned long pfn;
+        /* Ptrace may call this routine. */
+        if (vma && current->active_mm != vma->vm_mm)
+                return;
+        pfn = pte_pfn(pte);
+        if (pfn_valid(pfn)) {
+                page = pfn_to_page(pfn);
+                if (!test_bit(PG_mapped, &page->flags)) {
+                        unsigned long phys = pte_val(pte) & PTE_PHYS_MASK;
+                        __flush_wback_region((void *)P1SEGADDR(phys), PAGE_SIZE);
+                        __set_bit(PG_mapped, &page->flags);
+                }
+        }
+        local_irq_save(flags);
+        /* Set PTEH register */
+        vpn = (address & MMU_VPN_MASK) | get_asid();
+        ctrl_outl(vpn, MMU_PTEH);
+        pteval = pte_val(pte);
+        /* Set PTEA register */
+        if (cpu_data->flags & CPU_HAS_PTEA)
+                /* TODO: make this look less hacky */
+                ctrl_outl(((pteval >> 28) & 0xe) | (pteval & 0x1), MMU_PTEA);
+        /* Set PTEL register */
+        pteval &= _PAGE_FLAGS_HARDWARE_MASK; /* drop software flags */
+#ifdef CONFIG_SH_WRITETHROUGH
+        pteval |= _PAGE_WT;
+#endif
+        /* conveniently, we want all the software flags to be 0 anyway */
+        ctrl_outl(pteval, MMU_PTEL);
+        /* Load the TLB */
+        asm volatile("ldtlb": /* no output */ : /* no input */ : "memory");
+        local_irq_restore(flags);
+}
 void local_flush_tlb_one(unsigned long asid, unsigned long page)
 {
@@ -28,3 +93,4 @@ void local_flush_tlb_one(unsigned long asid, unsigned long page)
        ctrl_outl(data, addr);
        back_to_P1();
 }
diff --git a/arch/um/drivers/daemon_user.c b/arch/um/drivers/daemon_user.c
index 310af0f1e49e..021b82c7a759 100644
--- a/arch/um/drivers/daemon_user.c
+++ b/arch/um/drivers/daemon_user.c
@@ -56,30 +56,31 @@ static int connect_to_switch(struct daemon_data *pri)
        pri->control = socket(AF_UNIX, SOCK_STREAM, 0);
        if(pri->control < 0){
+                err = -errno;
                printk("daemon_open : control socket failed, errno = %d\n", 
-                       errno);          
+                       -err);
-                return(-errno);
+                return err;
        }
        if(connect(pri->control, (struct sockaddr *) ctl_addr, 
                   sizeof(*ctl_addr)) < 0){
-                printk("daemon_open : control connect failed, errno = %d\n",
-                       errno);
                err = -errno;
+                printk("daemon_open : control connect failed, errno = %d\n",
+                       -err);
                goto out;
        }
        fd = socket(AF_UNIX, SOCK_DGRAM, 0);
        if(fd < 0){
-                printk("daemon_open : data socket failed, errno = %d\n", 
-                       errno);
                err = -errno;
+                printk("daemon_open : data socket failed, errno = %d\n",
+                       -err);
                goto out;
        }
        if(bind(fd, (struct sockaddr *) local_addr, sizeof(*local_addr)) < 0){
-                printk("daemon_open : data bind failed, errno = %d\n", 
-                       errno);
                err = -errno;
+                printk("daemon_open : data bind failed, errno = %d\n",
+                       -err);
                goto out_close;
        }
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 01d4ab6b0ef1..f75d7b05c481 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -370,10 +370,10 @@ static irqreturn_t line_write_interrupt(int irq, void *data)
        struct tty_struct *tty = line->tty;
        int err;
-        /* Interrupts are enabled here because we registered the interrupt with
+        /* Interrupts are disabled here because we registered the interrupt with
         * IRQF_DISABLED (see line_setup_irq).*/
-        spin_lock_irq(&line->lock);
+        spin_lock(&line->lock);
        err = flush_buffer(line);
        if (err == 0) {
                return IRQ_NONE;
@@ -381,7 +381,7 @@ static irqreturn_t line_write_interrupt(int irq, void *data)
                line->head = line->buffer;
                line->tail = line->buffer;
        }
-        spin_unlock_irq(&line->lock);
+        spin_unlock(&line->lock);
        if(tty == NULL)
                return IRQ_NONE;
diff --git a/arch/um/drivers/mcast_user.c b/arch/um/drivers/mcast_user.c
index 8138f5ea1bf7..b827e82884c9 100644
--- a/arch/um/drivers/mcast_user.c
+++ b/arch/um/drivers/mcast_user.c
@@ -50,6 +50,14 @@ static void mcast_user_init(void *data, void *dev)
        pri->dev = dev;
 }
+static void mcast_remove(void *data)
+{
+        struct mcast_data *pri = data;
+        kfree(pri->mcast_addr);
+        pri->mcast_addr = NULL;
+}
 static int mcast_open(void *data)
 {
        struct mcast_data *pri = data;
@@ -157,7 +165,7 @@ const struct net_user_info mcast_user_info = {
        .init           = mcast_user_init,
        .open           = mcast_open,
        .close          = mcast_close,
-        .remove         = NULL,
+        .remove         = mcast_remove,
        .set_mtu        = mcast_set_mtu,
        .add_address    = NULL,
        .delete_address = NULL,
diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
index fc22b9bd9153..4b382a6e710f 100644
--- a/arch/um/drivers/ssl.c
+++ b/arch/um/drivers/ssl.c
@@ -179,7 +179,7 @@ static struct console ssl_cons = {
        .write          = ssl_console_write,
        .device         = ssl_console_device,
        .setup          = ssl_console_setup,
-        .flags          = CON_PRINTBUFFER,
+        .flags          = CON_PRINTBUFFER|CON_ANYTIME,
        .index          = -1,
 };
diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
index 7ff0b0fc37e7..76d1f1c980ef 100644
--- a/arch/um/drivers/stdio_console.c
+++ b/arch/um/drivers/stdio_console.c
@@ -153,7 +153,7 @@ static struct console stdiocons = {
        .write          = uml_console_write,
        .device         = uml_console_device,
        .setup          = uml_console_setup,
-        .flags          = CON_PRINTBUFFER,
+        .flags          = CON_PRINTBUFFER|CON_ANYTIME,
        .index          = -1,
 };
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index 8629bd191492..5c74da410451 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -192,7 +192,9 @@ extern int os_process_parent(int pid);
 extern void os_stop_process(int pid);
 extern void os_kill_process(int pid, int reap_child);
 extern void os_kill_ptraced_process(int pid, int reap_child);
+#ifdef UML_CONFIG_MODE_TT
 extern void os_usr1_process(int pid);
+#endif
 extern long os_ptrace_ldt(long pid, long addr, long data);
 extern int os_getpid(void);
@@ -261,7 +263,6 @@ extern void block_signals(void);
 extern void unblock_signals(void);
 extern int get_signals(void);
 extern int set_signals(int enable);
-extern void os_usr1_signal(int on);
 /* trap.c */
 extern void os_fill_handlinfo(struct kern_handlers h);
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index 50a288bb875a..dbf2f5bc842f 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -142,6 +142,7 @@ int activate_fd(int irq, int fd, int type, void *dev_id)
                                     .events            = events,
                                     .current_events    = 0 } );
+        err = -EBUSY;
        spin_lock_irqsave(&irq_lock, flags);
        for (irq_fd = active_fds; irq_fd != NULL; irq_fd = irq_fd->next) {
                if ((irq_fd->fd == fd) && (irq_fd->type == type)) {
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index c692a192957a..76bdd6712417 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -21,6 +21,7 @@
 #include "longjmp.h"
 #include "skas_ptrace.h"
 #include "kern_constants.h"
+#include "uml-config.h"
 #define ARBITRARY_ADDR -1
 #define FAILURE_PID    -1
@@ -131,10 +132,12 @@ void os_kill_ptraced_process(int pid, int reap_child)
                CATCH_EINTR(waitpid(pid, NULL, 0));
 }
+#ifdef UML_CONFIG_MODE_TT
 void os_usr1_process(int pid)
 {
        kill(pid, SIGUSR1);
 }
+#endif
 /* Don't use the glibc version, which caches the result in TLS. It misses some
 * syscalls, and also breaks with clone(), which does not unshare the TLS.
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index b897e8592d77..266768629fee 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -243,8 +243,3 @@ int set_signals(int enable)
        return ret;
 }
-void os_usr1_signal(int on)
-{
-        change_sig(SIGUSR1, on);
-}
diff --git a/arch/um/sys-x86_64/syscalls.c b/arch/um/sys-x86_64/syscalls.c
index 01b91f9fa789..b3f6350cac44 100644
--- a/arch/um/sys-x86_64/syscalls.c
+++ b/arch/um/sys-x86_64/syscalls.c
@@ -103,6 +103,9 @@ long arch_prctl_skas(struct task_struct *task, int code,
        switch(code){
        case ARCH_SET_FS:
+                current->thread.arch.fs = (unsigned long) ptr;
+                save_registers(pid, &current->thread.regs.regs);
+                break;
        case ARCH_SET_GS:
                save_registers(pid, &current->thread.regs.regs);
                break;
@@ -140,9 +143,8 @@ long sys_clone(unsigned long clone_flags, unsigned long newsp,
 void arch_switch_to_skas(struct task_struct *from, struct task_struct *to)
 {
-        if(to->thread.arch.fs == 0)
+        if((to->thread.arch.fs == 0) || (to->mm == NULL))
                return;
        arch_prctl_skas(to, ARCH_SET_FS, (void __user *) to->thread.arch.fs);
 }
diff --git a/arch/x86_64/ia32/ptrace32.c b/arch/x86_64/ia32/ptrace32.c
index 04566fe5de49..4de3a54318f4 100644
--- a/arch/x86_64/ia32/ptrace32.c
+++ b/arch/x86_64/ia32/ptrace32.c
@@ -243,6 +243,7 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
        case PTRACE_SINGLESTEP:
        case PTRACE_DETACH:
        case PTRACE_SYSCALL:
+        case PTRACE_OLDSETOPTIONS:
        case PTRACE_SETOPTIONS:
        case PTRACE_SET_THREAD_AREA:
        case PTRACE_GET_THREAD_AREA:
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 8047ea8c2ab2..dec587b293bf 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -30,11 +30,8 @@ static void via_bugs(void)
 #ifdef CONFIG_ACPI
-static int nvidia_hpet_detected __initdata;
 static int __init nvidia_hpet_check(struct acpi_table_header *header)
 {
-        nvidia_hpet_detected = 1;
        return 0;
 }
 #endif
@@ -52,11 +49,7 @@ static void nvidia_bugs(void)
        if (acpi_use_timer_override)
                return;
-        nvidia_hpet_detected = 0;
+        if (acpi_table_parse(ACPI_SIG_HPET, nvidia_hpet_check)) {
-        if (acpi_table_parse(ACPI_SIG_HPET, nvidia_hpet_check))
-                return;
-        if (nvidia_hpet_detected == 0) {
                acpi_skip_timer_override = 1;
                printk(KERN_INFO "Nvidia board "
                       "detected. Ignoring ACPI "
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index 35443729aad8..cd4643a37022 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -923,8 +923,9 @@ void __init smp_prepare_boot_cpu(void)
 */
 int __cpuinit __cpu_up(unsigned int cpu)
 {
-        int err;
        int apicid = cpu_present_to_apicid(cpu);
+        unsigned long flags;
+        int err;
        WARN_ON(irqs_disabled());
@@ -958,7 +959,9 @@ int __cpuinit __cpu_up(unsigned int cpu)
        /*
         * Make sure and check TSC sync:
         */
+        local_irq_save(flags);
        check_tsc_sync_source(cpu);
+        local_irq_restore(flags);
        while (!cpu_isset(cpu, cpu_online_map))
                cpu_relax();
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 7c49e103cf8f..4a3220b218d8 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -243,6 +243,17 @@ config ACPI_IBM_DOCK
          If you are not sure, say N here.
+config ACPI_IBM_BAY
+        bool "Legacy Removable Bay Support"
+        depends on ACPI_IBM
+        default y
+        ---help---
+          Allows the ibm_acpi driver to handle removable bays.  It will allow
+          disabling the device in the bay, and also generate notifications when
+          the bay lever is ejected or inserted.
+          If you are not sure, say Y here.
 config ACPI_TOSHIBA
        tristate "Toshiba Laptop Extras"
        depends on X86
diff --git a/drivers/acpi/ibm_acpi.c b/drivers/acpi/ibm_acpi.c
index 4cc534e36e81..36901362fd24 100644
--- a/drivers/acpi/ibm_acpi.c
+++ b/drivers/acpi/ibm_acpi.c
@@ -86,6 +86,7 @@
 #include <linux/proc_fs.h>
 #include <linux/backlight.h>
+#include <linux/fb.h>
 #include <asm/uaccess.h>
 #include <linux/dmi.h>
@@ -157,6 +158,7 @@ IBM_HANDLE(dock, root, "\\_SB.GDCK",	/* X30, X31, X40 */
           "\\_SB.PCI.ISA.SLCE",        /* 570 */
    );                          /* A21e,G4x,R30,R31,R32,R40,R40e,R50e */
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
 IBM_HANDLE(bay, root, "\\_SB.PCI.IDE.SECN.MAST",        /* 570 */
           "\\_SB.PCI0.IDE0.IDES.IDSM", /* 600e/x, 770e, 770x */
           "\\_SB.PCI0.SATA.SCND.MSTR", /* T60, X60, Z60 */ 
@@ -174,6 +176,7 @@ IBM_HANDLE(bay2, root, "\\_SB.PCI0.IDE0.PRIM.SLAV",	/* A3x, R32 */
 IBM_HANDLE(bay2_ej, bay2, "_EJ3",       /* 600e/x, 770e, A3x */
           "_EJ0",              /* 770x */
    );                          /* all others */
+#endif /* CONFIG_ACPI_IBM_BAY */
 /* don't list other alternatives as we install a notify handler on the 570 */
 IBM_HANDLE(pci, root, "\\_SB.PCI");     /* 570 */
@@ -1044,6 +1047,7 @@ static int light_write(char *buf)
        return 0;
 }
+#if defined(CONFIG_ACPI_IBM_DOCK) || defined(CONFIG_ACPI_IBM_BAY)
 static int _sta(acpi_handle handle)
 {
        int status;
@@ -1053,6 +1057,7 @@ static int _sta(acpi_handle handle)
        return status;
 }
+#endif
 #ifdef CONFIG_ACPI_IBM_DOCK
 #define dock_docked() (_sta(dock_handle) & 1)
@@ -1119,6 +1124,7 @@ static void dock_notify(struct ibm_struct *ibm, u32 event)
 }
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
 static int bay_status_supported;
 static int bay_status2_supported;
 static int bay_eject_supported;
@@ -1194,6 +1200,7 @@ static void bay_notify(struct ibm_struct *ibm, u32 event)
 {
        acpi_bus_generate_event(ibm->device, event, 0);
 }
+#endif /* CONFIG_ACPI_IBM_BAY */
 static int cmos_read(char *p)
 {
@@ -1701,7 +1708,10 @@ static int brightness_write(char *buf)
 static int brightness_update_status(struct backlight_device *bd)
 {
-        return brightness_set(bd->props.brightness);
+        return brightness_set(
+                (bd->props.fb_blank == FB_BLANK_UNBLANK &&
+                 bd->props.power == FB_BLANK_UNBLANK) ?
+                                bd->props.brightness : 0);
 }
 static struct backlight_ops ibm_backlight_data = {
@@ -1711,6 +1721,12 @@ static struct backlight_ops ibm_backlight_data = {
 static int brightness_init(void)
 {
+        int b;
+        b = brightness_get(NULL);
+        if (b < 0)
+                return b;
        ibm_backlight_device = backlight_device_register("ibm", NULL, NULL,
                                                         &ibm_backlight_data);
        if (IS_ERR(ibm_backlight_device)) {
@@ -1718,7 +1734,9 @@ static int brightness_init(void)
                return PTR_ERR(ibm_backlight_device);
        }
-        ibm_backlight_device->props.max_brightness = 7;
+        ibm_backlight_device->props.max_brightness = 7;
+        ibm_backlight_device->props.brightness = b;
+        backlight_update_status(ibm_backlight_device);
        return 0;
 }
@@ -2353,6 +2371,7 @@ static struct ibm_struct ibms[] = {
         .type = ACPI_SYSTEM_NOTIFY,
         },
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
        {
         .name = "bay",
         .init = bay_init,
@@ -2362,6 +2381,7 @@ static struct ibm_struct ibms[] = {
         .handle = &bay_handle,
         .type = ACPI_SYSTEM_NOTIFY,
         },
+#endif /* CONFIG_ACPI_IBM_BAY */
        {
         .name = "cmos",
         .read = cmos_read,
@@ -2647,7 +2667,9 @@ IBM_PARAM(light);
 #ifdef CONFIG_ACPI_IBM_DOCK
 IBM_PARAM(dock);
 #endif
+#ifdef CONFIG_ACPI_IBM_BAY
 IBM_PARAM(bay);
+#endif /* CONFIG_ACPI_IBM_BAY */
 IBM_PARAM(cmos);
 IBM_PARAM(led);
 IBM_PARAM(beep);
@@ -2723,12 +2745,14 @@ static int __init acpi_ibm_init(void)
        IBM_HANDLE_INIT(dock);
 #endif
        IBM_HANDLE_INIT(pci);
+#ifdef CONFIG_ACPI_IBM_BAY
        IBM_HANDLE_INIT(bay);
        if (bay_handle)
                IBM_HANDLE_INIT(bay_ej);
        IBM_HANDLE_INIT(bay2);
        if (bay2_handle)
                IBM_HANDLE_INIT(bay2_ej);
+#endif /* CONFIG_ACPI_IBM_BAY */
        IBM_HANDLE_INIT(beep);
        IBM_HANDLE_INIT(ecrd);
        IBM_HANDLE_INIT(ecwr);
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 1ef338545dfe..547eee7537bc 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -436,8 +436,6 @@ int acpi_power_transition(struct acpi_device *device, int state)
        cl = &device->power.states[device->power.state].resources;
        tl = &device->power.states[state].resources;
-        device->power.state = ACPI_STATE_UNKNOWN;
        if (!cl->count && !tl->count) {
                result = -ENODEV;
                goto end;
@@ -468,12 +466,15 @@ int acpi_power_transition(struct acpi_device *device, int state)
                        goto end;
        }
-        /* We shouldn't change the state till all above operations succeed */
+     end:
-        device->power.state = state;
+        if (result) {
-      end:
+                device->power.state = ACPI_STATE_UNKNOWN;
-        if (result)
                printk(KERN_WARNING PREFIX "Transitioning device [%s] to D%d\n",
                              device->pnp.bus_id, state);
+        } else {
+        /* We shouldn't change the state till all above operations succeed */
+                device->power.state = state;
+        }
        return result;
 }
diff --git a/drivers/acpi/resources/rscreate.c b/drivers/acpi/resources/rscreate.c
index 1358c06a969c..cc48ab05676c 100644
--- a/drivers/acpi/resources/rscreate.c
+++ b/drivers/acpi/resources/rscreate.c
@@ -191,6 +191,9 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
        user_prt = ACPI_CAST_PTR(struct acpi_pci_routing_table, buffer);
        for (index = 0; index < number_of_elements; index++) {
+                int source_name_index = 2;
+                int source_index_index = 3;
                /*
                 * Point user_prt past this current structure
                 *
@@ -261,10 +264,28 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
                }
                /*
+                 * If BIOS erroneously reversed the _PRT source_name and source_index,
+                 * then reverse them back.
+                 */
+                if (ACPI_GET_OBJECT_TYPE (sub_object_list[3]) != ACPI_TYPE_INTEGER) {
+                        if (acpi_gbl_enable_interpreter_slack) {
+                                source_name_index = 3;
+                                source_index_index = 2;
+                                printk(KERN_WARNING "ACPI: Handling Garbled _PRT entry\n");
+                        } else {
+                                ACPI_ERROR((AE_INFO,
+                                        "(PRT[%X].source_index) Need Integer, found %s",
+                                        index,
+                                        acpi_ut_get_object_type_name(sub_object_list[3])));
+                                return_ACPI_STATUS(AE_BAD_DATA);
+                        }
+                }
+                /*
                 * 3) Third subobject: Dereference the PRT.source_name
                 * The name may be unresolved (slack mode), so allow a null object
                 */
-                obj_desc = sub_object_list[2];
+                obj_desc = sub_object_list[source_name_index];
                if (obj_desc) {
                        switch (ACPI_GET_OBJECT_TYPE(obj_desc)) {
                        case ACPI_TYPE_LOCAL_REFERENCE:
@@ -339,7 +360,7 @@ acpi_rs_create_pci_routing_table(union acpi_operand_object *package_object,
                /* 4) Fourth subobject: Dereference the PRT.source_index */
-                obj_desc = sub_object_list[3];
+                obj_desc = sub_object_list[source_index_index];
                if (ACPI_GET_OBJECT_TYPE(obj_desc) == ACPI_TYPE_INTEGER) {
                        user_prt->source_index = (u32) obj_desc->integer.value;
                } else {
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index dc42ba1b46f7..b952c584338f 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -93,7 +93,7 @@
 #include <linux/libata.h>
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "2.10"
+#define DRV_VERSION     "2.10ac1"
 enum {
        PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
@@ -667,14 +667,9 @@ static int ich_pata_prereset(struct ata_port *ap)
 {
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
-        if (!pci_test_config_bits(pdev, &piix_enable_bits[ap->port_no])) {
+        if (!pci_test_config_bits(pdev, &piix_enable_bits[ap->port_no]))
-                ata_port_printk(ap, KERN_INFO, "port disabled. ignoring.\n");
+                return -ENOENT;
-                ap->eh_context.i.action &= ~ATA_EH_RESET_MASK;
-                return 0;
-        }
        ich_pata_cbl_detect(ap);
        return ata_std_prereset(ap);
 }
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index d14a48e75f1b..c428a56e6f31 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -34,6 +34,13 @@ struct taskfile_array {
        u8      tfa[REGS_PER_GTF];      /* regs. 0x1f1 - 0x1f7 */
 };
+/*
+ *      Helper - belongs in the PCI layer somewhere eventually
+ */
+static int is_pci_dev(struct device *dev)
+{
+        return (dev->bus == &pci_bus_type);
+}
 /**
 * sata_get_dev_handle - finds acpi_handle and PCI device.function
@@ -53,6 +60,9 @@ static int sata_get_dev_handle(struct device *dev, acpi_handle *handle,
        struct pci_dev  *pci_dev;
        acpi_integer    addr;
+        if (!is_pci_dev(dev))
+                return -ENODEV;
        pci_dev = to_pci_dev(dev);      /* NOTE: PCI-specific */
        /* Please refer to the ACPI spec for the syntax of _ADR. */
        addr = (PCI_SLOT(pci_dev->devfn) << 16) | PCI_FUNC(pci_dev->devfn);
@@ -84,7 +94,12 @@ static int pata_get_dev_handle(struct device *dev, acpi_handle *handle,
        acpi_status status;
        struct acpi_device_info *dinfo = NULL;
        int ret = -ENODEV;
-        struct pci_dev *pdev = to_pci_dev(dev);
+        struct pci_dev *pdev;
+        if (!is_pci_dev(dev))
+                return -ENODEV;
+        pdev = to_pci_dev(dev);
        bus = pdev->bus->number;
        devnum = PCI_SLOT(pdev->devfn);
@@ -561,6 +576,13 @@ int ata_acpi_exec_tfs(struct ata_port *ap)
        if (noacpi)
                return 0;
+        /*
+         * TBD - implement PATA support.  For now,
+         * we should not run GTF on PATA devices since some
+         * PATA require execution of GTM/STM before GTF.
+         */
+        if (!(ap->cbl == ATA_CBL_SATA))
+                return 0;
        for (ix = 0; ix < ATA_MAX_DEVICES; ix++) {
                if (!ata_dev_enabled(&ap->device[ix]))
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index dc362fa01ca4..3c1f8830ac8b 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3455,7 +3455,8 @@ static void ata_dev_xfermask(struct ata_device *dev)
                               "device is on DMA blacklist, disabling DMA\n");
        }
-        if ((host->flags & ATA_HOST_SIMPLEX) && host->simplex_claimed != ap) {
+        if ((host->flags & ATA_HOST_SIMPLEX) &&
+            host->simplex_claimed && host->simplex_claimed != ap) {
                xfer_mask &= ~(ATA_MASK_MWDMA | ATA_MASK_UDMA);
                ata_dev_printk(dev, KERN_WARNING, "simplex DMA is claimed by "
                               "other device, disabling DMA\n");
@@ -5684,18 +5685,22 @@ static void ata_host_release(struct device *gendev, void *res)
        for (i = 0; i < host->n_ports; i++) {
                struct ata_port *ap = host->ports[i];
-                if (!ap)
+                if (ap && ap->ops->port_stop)
-                        continue;
-                if (ap->ops->port_stop)
                        ap->ops->port_stop(ap);
-                scsi_host_put(ap->scsi_host);
        }
        if (host->ops->host_stop)
                host->ops->host_stop(host);
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
+                if (ap)
+                        scsi_host_put(ap->scsi_host);
+                host->ports[i] = NULL;
+        }
        dev_set_drvdata(gendev, NULL);
 }
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 388d07fab5f7..9d9670a9b117 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -874,8 +874,14 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                        if (status & (NV_ADMA_STAT_DONE |
                                      NV_ADMA_STAT_CPBERR)) {
-                                u32 check_commands = notifier | notifier_error;
+                                u32 check_commands;
                                int pos, error = 0;
+                                if(ata_tag_valid(ap->active_tag))
+                                        check_commands = 1 << ap->active_tag;
+                                else
+                                        check_commands = ap->sactive;
                                /** Check CPBs for completed commands */
                                while ((pos = ffs(check_commands)) && !error) {
                                        pos--;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index cf2a398aaaa1..89ebe3682726 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -787,6 +787,13 @@ void device_del(struct device * dev)
        device_remove_attrs(dev);
        bus_remove_device(dev);
+        /*
+         * Some platform devices are driven without driver attached
+         * and managed resources may have been acquired.  Make sure
+         * all resources are released.
+         */
+        devres_release_all(dev);
        /* Notify the platform of the removal, in case they
         * need to do anything...
         */
diff --git a/drivers/char/ds1286.c b/drivers/char/ds1286.c
index 6d58b0370802..59146e3365ba 100644
--- a/drivers/char/ds1286.c
+++ b/drivers/char/ds1286.c
@@ -197,6 +197,7 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
                hrs = alm_tm.tm_hour;
                min = alm_tm.tm_min;
+                sec = alm_tm.tm_sec;
                if (hrs >= 24)
                        hrs = 0xff;
@@ -204,9 +205,11 @@ static int ds1286_ioctl(struct inode *inode, struct file *file,
                if (min >= 60)
                        min = 0xff;
-                BIN_TO_BCD(sec);
+                if (sec != 0)
-                BIN_TO_BCD(min);
+                        return -EINVAL;
-                BIN_TO_BCD(hrs);
+                min = BIN2BCD(min);
+                min = BIN2BCD(hrs);
                spin_lock(&ds1286_lock);
                rtc_write(hrs, RTC_HOURS_ALARM);
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index a44db75bc25b..a905f7820331 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -128,7 +128,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
 */
 static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data)
 {
-        struct cn_callback_entry *__cbq;
+        struct cn_callback_entry *__cbq, *__new_cbq;
        struct cn_dev *dev = &cdev;
        int err = -ENODEV;
@@ -148,27 +148,27 @@ static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), v
                        } else {
                                struct cn_callback_data *d;
                                
-                                __cbq = kzalloc(sizeof(*__cbq), GFP_ATOMIC);
+                                err = -ENOMEM;
-                                if (__cbq) {
+                                __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
-                                        d = &__cbq->data;
+                                if (__new_cbq) {
+                                        d = &__new_cbq->data;
                                        d->callback_priv = msg;
                                        d->callback = __cbq->data.callback;
                                        d->ddata = data;
                                        d->destruct_data = destruct_data;
-                                        d->free = __cbq;
+                                        d->free = __new_cbq;
-                                        INIT_WORK(&__cbq->work,
+                                        INIT_WORK(&__new_cbq->work,
                                                        &cn_queue_wrapper);
-                                        
                                        if (queue_work(dev->cbdev->cn_queue,
-                                                    &__cbq->work))
+                                                    &__new_cbq->work))
                                                err = 0;
                                        else {
-                                                kfree(__cbq);
+                                                kfree(__new_cbq);
                                                err = -EINVAL;
                                        }
-                                } else
+                                }
-                                        err = -ENOMEM;
                        }
                        break;
                }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index d441815a3e0c..fde92ce45153 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1821,7 +1821,7 @@ static int cma_alloc_port(struct idr *ps, struct rdma_id_private *id_priv,
        struct rdma_bind_list *bind_list;
        int port, ret;
-        bind_list = kmalloc(sizeof *bind_list, GFP_KERNEL);
+        bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
        if (!bind_list)
                return -ENOMEM;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index b516b93b8550..c859134c1daa 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -266,7 +266,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
        mutex_lock(&ctx->file->mut);
        if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
                if (!ctx->backlog) {
-                        ret = -EDQUOT;
+                        ret = -ENOMEM;
                        kfree(uevent);
                        goto out;
                }
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index d737c738d876..818cf1aee8c7 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -36,6 +36,7 @@
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include "cxio_resource.h"
 #include "cxio_hal.h"
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index b21fde8b659d..d0ed1d35ca3e 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -305,8 +305,7 @@ static int status2errno(int status)
 */
 static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
 {
-        if (skb) {
+        if (skb && !skb_is_nonlinear(skb) && !skb_cloned(skb)) {
-                BUG_ON(skb_cloned(skb));
                skb_trim(skb, 0);
                skb_get(skb);
        } else {
@@ -1415,6 +1414,7 @@ static int peer_close(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                wake_up(&ep->com.waitq);
                break;
        case FPDU_MODE:
+                start_ep_timer(ep);
                __state_set(&ep->com, CLOSING);
                attrs.next_state = IWCH_QP_STATE_CLOSING;
                iwch_modify_qp(ep->com.qp->rhp, ep->com.qp,
@@ -1425,7 +1425,6 @@ static int peer_close(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                disconnect = 0;
                break;
        case CLOSING:
-                start_ep_timer(ep);
                __state_set(&ep->com, MORIBUND);
                disconnect = 0;
                break;
@@ -1487,8 +1486,10 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        case CONNECTING:
                break;
        case MPA_REQ_WAIT:
+                stop_ep_timer(ep);
                break;
        case MPA_REQ_SENT:
+                stop_ep_timer(ep);
                connect_reply_upcall(ep, -ECONNRESET);
                break;
        case MPA_REP_SENT:
@@ -1507,9 +1508,10 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                get_ep(&ep->com);
                break;
        case MORIBUND:
+        case CLOSING:
                stop_ep_timer(ep);
+                /*FALLTHROUGH*/
        case FPDU_MODE:
-        case CLOSING:
                if (ep->com.cm_id && ep->com.qp) {
                        attrs.next_state = IWCH_QP_STATE_ERROR;
                        ret = iwch_modify_qp(ep->com.qp->rhp,
@@ -1570,7 +1572,6 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        spin_lock_irqsave(&ep->com.lock, flags);
        switch (ep->com.state) {
        case CLOSING:
-                start_ep_timer(ep);
                __state_set(&ep->com, MORIBUND);
                break;
        case MORIBUND:
@@ -1586,6 +1587,8 @@ static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                __state_set(&ep->com, DEAD);
                release = 1;
                break;
+        case ABORTING:
+                break;
        case DEAD:
        default:
                BUG_ON(1);
@@ -1659,6 +1662,7 @@ static void ep_timeout(unsigned long arg)
                break;
        case MPA_REQ_WAIT:
                break;
+        case CLOSING:
        case MORIBUND:
                if (ep->com.cm_id && ep->com.qp) {
                        attrs.next_state = IWCH_QP_STATE_ERROR;
@@ -1687,12 +1691,11 @@ int iwch_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
                return -ECONNRESET;
        }
        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
-        state_set(&ep->com, CLOSING);
        if (mpa_rev == 0)
                abort_connection(ep, NULL, GFP_KERNEL);
        else {
                err = send_mpa_reject(ep, pdata, pdata_len);
-                err = send_halfclose(ep, GFP_KERNEL);
+                err = iwch_ep_disconnect(ep, 0, GFP_KERNEL);
        }
        return 0;
 }
@@ -1957,11 +1960,11 @@ int iwch_ep_disconnect(struct iwch_ep *ep, int abrupt, gfp_t gfp)
        case MPA_REQ_RCVD:
        case MPA_REP_SENT:
        case FPDU_MODE:
+                start_ep_timer(ep);
                ep->com.state = CLOSING;
                close = 1;
                break;
        case CLOSING:
-                start_ep_timer(ep);
                ep->com.state = MORIBUND;
                close = 1;
                break;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_ev.c b/drivers/infiniband/hw/cxgb3/iwch_ev.c
index 54362afbf72f..b40676662a8a 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_ev.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_ev.c
@@ -47,12 +47,6 @@ static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
        struct iwch_qp_attributes attrs;
        struct iwch_qp *qhp;
-        printk(KERN_ERR "%s - AE qpid 0x%x opcode %d status 0x%x "
-               "type %d wrid.hi 0x%x wrid.lo 0x%x \n", __FUNCTION__,
-               CQE_QPID(rsp_msg->cqe), CQE_OPCODE(rsp_msg->cqe),
-               CQE_STATUS(rsp_msg->cqe), CQE_TYPE(rsp_msg->cqe),
-               CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
        spin_lock(&rnicp->lock);
        qhp = get_qhp(rnicp, CQE_QPID(rsp_msg->cqe));
@@ -73,6 +67,12 @@ static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
                return;
        }
+        printk(KERN_ERR "%s - AE qpid 0x%x opcode %d status 0x%x "
+               "type %d wrid.hi 0x%x wrid.lo 0x%x \n", __FUNCTION__,
+               CQE_QPID(rsp_msg->cqe), CQE_OPCODE(rsp_msg->cqe),
+               CQE_STATUS(rsp_msg->cqe), CQE_TYPE(rsp_msg->cqe),
+               CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
        atomic_inc(&qhp->refcnt);
        spin_unlock(&rnicp->lock);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 9947a144a929..f2774ae906bf 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -331,6 +331,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
        int ret = 0;
        struct iwch_mm_entry *mm;
        struct iwch_ucontext *ucontext;
+        u64 addr;
        PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff,
             key, len);
@@ -345,10 +346,11 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
        mm = remove_mmap(ucontext, key, len);
        if (!mm)
                return -EINVAL;
+        addr = mm->addr;
        kfree(mm);
-        if ((mm->addr >= rdev_p->rnic_info.udbell_physbase) &&
+        if ((addr >= rdev_p->rnic_info.udbell_physbase) &&
-            (mm->addr < (rdev_p->rnic_info.udbell_physbase +
+            (addr < (rdev_p->rnic_info.udbell_physbase +
                       rdev_p->rnic_info.udbell_len))) {
                /*
@@ -362,7 +364,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
                vma->vm_flags &= ~VM_MAYREAD;
                ret = io_remap_pfn_range(vma, vma->vm_start,
-                                         mm->addr >> PAGE_SHIFT,
+                                         addr >> PAGE_SHIFT,
                                         len, vma->vm_page_prot);
        } else {
@@ -370,7 +372,7 @@ static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
                 * Map WQ or CQ contig dma memory...
                 */
                ret = remap_pfn_range(vma, vma->vm_start,
-                                      mm->addr >> PAGE_SHIFT,
+                                      addr >> PAGE_SHIFT,
                                      len, vma->vm_page_prot);
        }
@@ -463,9 +465,6 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
        php = to_iwch_pd(pd);
        rhp = php->rhp;
-        acc = iwch_convert_access(acc);
        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
        if (!mhp)
                return ERR_PTR(-ENOMEM);
@@ -491,12 +490,7 @@ static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
        mhp->attr.pdid = php->pdid;
        mhp->attr.zbva = 0;
-        /* NOTE: TPT perms are backwards from BIND WR perms! */
+        mhp->attr.perms = iwch_ib_to_tpt_access(acc);
-        mhp->attr.perms = (acc & 0x1) << 3;
-        mhp->attr.perms |= (acc & 0x2) << 1;
-        mhp->attr.perms |= (acc & 0x4) >> 1;
-        mhp->attr.perms |= (acc & 0x8) >> 3;
        mhp->attr.va_fbo = *iova_start;
        mhp->attr.page_size = shift - 12;
@@ -525,7 +519,6 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
        struct iwch_mr mh, *mhp;
        struct iwch_pd *php;
        struct iwch_dev *rhp;
-        int new_acc;
        __be64 *page_list = NULL;
        int shift = 0;
        u64 total_size;
@@ -546,14 +539,12 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
        if (rhp != php->rhp)
                return -EINVAL;
-        new_acc = mhp->attr.perms;
        memcpy(&mh, mhp, sizeof *mhp);
        if (mr_rereg_mask & IB_MR_REREG_PD)
                php = to_iwch_pd(pd);
        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
-                mh.attr.perms = iwch_convert_access(acc);
+                mh.attr.perms = iwch_ib_to_tpt_access(acc);
        if (mr_rereg_mask & IB_MR_REREG_TRANS)
                ret = build_phys_page_list(buffer_list, num_phys_buf,
                                           iova_start,
@@ -568,7 +559,7 @@ static int iwch_reregister_phys_mem(struct ib_mr *mr,
        if (mr_rereg_mask & IB_MR_REREG_PD)
                mhp->attr.pdid = php->pdid;
        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
-                mhp->attr.perms = acc;
+                mhp->attr.perms = iwch_ib_to_tpt_access(acc);
        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
                mhp->attr.zbva = 0;
                mhp->attr.va_fbo = *iova_start;
@@ -613,8 +604,6 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
                goto err;
        }
-        acc = iwch_convert_access(acc);
        i = n = 0;
        list_for_each_entry(chunk, &region->chunk_list, list)
@@ -630,10 +619,7 @@ static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
        mhp->rhp = rhp;
        mhp->attr.pdid = php->pdid;
        mhp->attr.zbva = 0;
-        mhp->attr.perms = (acc & 0x1) << 3;
+        mhp->attr.perms = iwch_ib_to_tpt_access(acc);
-        mhp->attr.perms |= (acc & 0x2) << 1;
-        mhp->attr.perms |= (acc & 0x4) >> 1;
-        mhp->attr.perms |= (acc & 0x8) >> 3;
        mhp->attr.va_fbo = region->virt_base;
        mhp->attr.page_size = shift - 12;
        mhp->attr.len = (u32) region->length;
@@ -736,10 +722,8 @@ static int iwch_destroy_qp(struct ib_qp *ib_qp)
        qhp = to_iwch_qp(ib_qp);
        rhp = qhp->rhp;
-        if (qhp->attr.state == IWCH_QP_STATE_RTS) {
+        attrs.next_state = IWCH_QP_STATE_ERROR;
-                attrs.next_state = IWCH_QP_STATE_ERROR;
+        iwch_modify_qp(rhp, qhp, IWCH_QP_ATTR_NEXT_STATE, &attrs, 0);
-                iwch_modify_qp(rhp, qhp, IWCH_QP_ATTR_NEXT_STATE, &attrs, 0);
-        }
        wait_event(qhp->wait, !qhp->ep);
        remove_handle(rhp, &rhp->qpidr, qhp->wq.qpid);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.h b/drivers/infiniband/hw/cxgb3/iwch_provider.h
index de0fe1b93a0c..93bcc56756bd 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.h
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.h
@@ -286,27 +286,20 @@ static inline int iwch_convert_state(enum ib_qp_state ib_state)
        }
 }
-enum iwch_mem_perms {
+static inline u32 iwch_ib_to_tpt_access(int acc)
-        IWCH_MEM_ACCESS_LOCAL_READ = 1 << 0,
-        IWCH_MEM_ACCESS_LOCAL_WRITE = 1 << 1,
-        IWCH_MEM_ACCESS_REMOTE_READ = 1 << 2,
-        IWCH_MEM_ACCESS_REMOTE_WRITE = 1 << 3,
-        IWCH_MEM_ACCESS_ATOMICS = 1 << 4,
-        IWCH_MEM_ACCESS_BINDING = 1 << 5,
-        IWCH_MEM_ACCESS_LOCAL =
-            (IWCH_MEM_ACCESS_LOCAL_READ | IWCH_MEM_ACCESS_LOCAL_WRITE),
-        IWCH_MEM_ACCESS_REMOTE =
-            (IWCH_MEM_ACCESS_REMOTE_WRITE | IWCH_MEM_ACCESS_REMOTE_READ)
-            /* cannot go beyond 1 << 31 */
-} __attribute__ ((packed));
-static inline u32 iwch_convert_access(int acc)
 {
-        return (acc & IB_ACCESS_REMOTE_WRITE ? IWCH_MEM_ACCESS_REMOTE_WRITE : 0)
+        return (acc & IB_ACCESS_REMOTE_WRITE ? TPT_REMOTE_WRITE : 0) |
-            | (acc & IB_ACCESS_REMOTE_READ ? IWCH_MEM_ACCESS_REMOTE_READ : 0) |
+               (acc & IB_ACCESS_REMOTE_READ ? TPT_REMOTE_READ : 0) |
-            (acc & IB_ACCESS_LOCAL_WRITE ? IWCH_MEM_ACCESS_LOCAL_WRITE : 0) |
+               (acc & IB_ACCESS_LOCAL_WRITE ? TPT_LOCAL_WRITE : 0) |
-            (acc & IB_ACCESS_MW_BIND ? IWCH_MEM_ACCESS_BINDING : 0) |
+               TPT_LOCAL_READ;
-            IWCH_MEM_ACCESS_LOCAL_READ;
+}
+static inline u32 iwch_ib_to_mwbind_access(int acc)
+{
+        return (acc & IB_ACCESS_REMOTE_WRITE ? T3_MEM_ACCESS_REM_WRITE : 0) |
+               (acc & IB_ACCESS_REMOTE_READ ? T3_MEM_ACCESS_REM_READ : 0) |
+               (acc & IB_ACCESS_LOCAL_WRITE ? T3_MEM_ACCESS_LOCAL_WRITE : 0) |
+               T3_MEM_ACCESS_LOCAL_READ;
 }
 enum iwch_mmid_state {
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 9ea00cc4a5f8..0a472c9b44db 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -439,7 +439,7 @@ int iwch_bind_mw(struct ib_qp *qp,
        wqe->bind.type = T3_VA_BASED_TO;
        /* TBD: check perms */
-        wqe->bind.perms = iwch_convert_access(mw_bind->mw_access_flags);
+        wqe->bind.perms = iwch_ib_to_mwbind_access(mw_bind->mw_access_flags);
        wqe->bind.mr_stag = cpu_to_be32(mw_bind->mr->lkey);
        wqe->bind.mw_stag = cpu_to_be32(mw->rkey);
        wqe->bind.mw_len = cpu_to_be32(mw_bind->length);
diff --git a/drivers/infiniband/hw/ehca/ehca_classes.h b/drivers/infiniband/hw/ehca/ehca_classes.h
index 40404c9e2817..82ded44c6cee 100644
--- a/drivers/infiniband/hw/ehca/ehca_classes.h
+++ b/drivers/infiniband/hw/ehca/ehca_classes.h
@@ -52,6 +52,8 @@ struct ehca_mw;
 struct ehca_pd;
 struct ehca_av;
+#include <linux/wait.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
@@ -153,7 +155,9 @@ struct ehca_cq {
        spinlock_t cb_lock;
        struct hlist_head qp_hashtab[QP_HASHTAB_LEN];
        struct list_head entry;
-        u32 nr_callbacks;
+        u32 nr_callbacks; /* #events assigned to cpu by scaling code */
+        u32 nr_events;    /* #events seen */
+        wait_queue_head_t wait_completion;
        spinlock_t task_lock;
        u32 ownpid;
        /* mmap counter for resources mapped into user space */
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c
index 6ebfa27e4e16..e2cdc1a16fe9 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/infiniband/hw/ehca/ehca_cq.c
@@ -146,6 +146,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe,
        spin_lock_init(&my_cq->spinlock);
        spin_lock_init(&my_cq->cb_lock);
        spin_lock_init(&my_cq->task_lock);
+        init_waitqueue_head(&my_cq->wait_completion);
        my_cq->ownpid = current->tgid;
        cq = &my_cq->ib_cq;
@@ -302,6 +303,16 @@ create_cq_exit1:
        return cq;
 }
+static int get_cq_nr_events(struct ehca_cq *my_cq)
+{
+        int ret;
+        unsigned long flags;
+        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+        ret = my_cq->nr_events;
+        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+        return ret;
+}
 int ehca_destroy_cq(struct ib_cq *cq)
 {
        u64 h_ret;
@@ -329,10 +340,11 @@ int ehca_destroy_cq(struct ib_cq *cq)
        }
        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
-        while (my_cq->nr_callbacks) {
+        while (my_cq->nr_events) {
                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
-                yield();
+                wait_event(my_cq->wait_completion, !get_cq_nr_events(my_cq));
                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                /* recheck nr_events to assure no cqe has just arrived */
        }
        idr_remove(&ehca_cq_idr, my_cq->token);
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 3ec53c687d08..20f36bf8b2b6 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -404,10 +404,11 @@ static inline void process_eqe(struct ehca_shca *shca, struct ehca_eqe *eqe)
        u32 token;
        unsigned long flags;
        struct ehca_cq *cq;
        eqe_value = eqe->entry;
        ehca_dbg(&shca->ib_device, "eqe_value=%lx", eqe_value);
        if (EHCA_BMASK_GET(EQE_COMPLETION_EVENT, eqe_value)) {
-                ehca_dbg(&shca->ib_device, "... completion event");
+                ehca_dbg(&shca->ib_device, "Got completion event");
                token = EHCA_BMASK_GET(EQE_CQ_TOKEN, eqe_value);
                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
                cq = idr_find(&ehca_cq_idr, token);
@@ -419,16 +420,20 @@ static inline void process_eqe(struct ehca_shca *shca, struct ehca_eqe *eqe)
                        return;
                }
                reset_eq_pending(cq);
-                if (ehca_scaling_code) {
+                cq->nr_events++;
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+                if (ehca_scaling_code)
                        queue_comp_task(cq);
-                        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+                else {
-                } else {
-                        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                        comp_event_callback(cq);
+                        spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                        cq->nr_events--;
+                        if (!cq->nr_events)
+                                wake_up(&cq->wait_completion);
+                        spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
                }
        } else {
-                ehca_dbg(&shca->ib_device,
+                ehca_dbg(&shca->ib_device, "Got non completion event");
-                         "Got non completion event");
                parse_identifier(shca, eqe_value);
        }
 }
@@ -478,6 +483,7 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
                                         "token=%x", token);
                                continue;
                        }
+                        eqe_cache[eqe_cnt].cq->nr_events++;
                        spin_unlock(&ehca_cq_idr_lock);
                } else
                        eqe_cache[eqe_cnt].cq = NULL;
@@ -504,12 +510,18 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
        /* call completion handler for cached eqes */
        for (i = 0; i < eqe_cnt; i++)
                if (eq->eqe_cache[i].cq) {
-                        if (ehca_scaling_code) {
+                        if (ehca_scaling_code)
-                                spin_lock(&ehca_cq_idr_lock);
                                queue_comp_task(eq->eqe_cache[i].cq);
-                                spin_unlock(&ehca_cq_idr_lock);
+                        else {
-                        } else
+                                struct ehca_cq *cq = eq->eqe_cache[i].cq;
-                                comp_event_callback(eq->eqe_cache[i].cq);
+                                comp_event_callback(cq);
+                                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                                cq->nr_events--;
+                                if (!cq->nr_events)
+                                        wake_up(&cq->wait_completion);
+                                spin_unlock_irqrestore(&ehca_cq_idr_lock,
+                                                       flags);
+                        }
                } else {
                        ehca_dbg(&shca->ib_device, "Got non completion event");
                        parse_identifier(shca, eq->eqe_cache[i].eqe->entry);
@@ -523,7 +535,6 @@ void ehca_process_eq(struct ehca_shca *shca, int is_irq)
                if (!eqe)
                        break;
                process_eqe(shca, eqe);
-                eqe_cnt++;
        } while (1);
 unlock_irq_spinlock:
@@ -567,8 +578,7 @@ static void __queue_comp_task(struct ehca_cq *__cq,
                list_add_tail(&__cq->entry, &cct->cq_list);
                cct->cq_jobs++;
                wake_up(&cct->wait_queue);
-        }
+        } else
-        else
                __cq->nr_callbacks++;
        spin_unlock(&__cq->task_lock);
@@ -577,18 +587,21 @@ static void __queue_comp_task(struct ehca_cq *__cq,
 static void queue_comp_task(struct ehca_cq *__cq)
 {
-        int cpu;
        int cpu_id;
        struct ehca_cpu_comp_task *cct;
+        int cq_jobs;
+        unsigned long flags;
-        cpu = get_cpu();
        cpu_id = find_next_online_cpu(pool);
        BUG_ON(!cpu_online(cpu_id));
        cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
        BUG_ON(!cct);
-        if (cct->cq_jobs > 0) {
+        spin_lock_irqsave(&cct->task_lock, flags);
+        cq_jobs = cct->cq_jobs;
+        spin_unlock_irqrestore(&cct->task_lock, flags);
+        if (cq_jobs > 0) {
                cpu_id = find_next_online_cpu(pool);
                cct = per_cpu_ptr(pool->cpu_comp_tasks, cpu_id);
                BUG_ON(!cct);
@@ -608,11 +621,17 @@ static void run_comp_task(struct ehca_cpu_comp_task* cct)
                cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
                spin_unlock_irqrestore(&cct->task_lock, flags);
                comp_event_callback(cq);
-                spin_lock_irqsave(&cct->task_lock, flags);
+                spin_lock_irqsave(&ehca_cq_idr_lock, flags);
+                cq->nr_events--;
+                if (!cq->nr_events)
+                        wake_up(&cq->wait_completion);
+                spin_unlock_irqrestore(&ehca_cq_idr_lock, flags);
+                spin_lock_irqsave(&cct->task_lock, flags);
                spin_lock(&cq->task_lock);
                cq->nr_callbacks--;
-                if (cq->nr_callbacks == 0) {
+                if (!cq->nr_callbacks) {
                        list_del_init(cct->cq_list.next);
                        cct->cq_jobs--;
                }
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index c1835121a822..059da9628bb5 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -52,7 +52,7 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
 MODULE_DESCRIPTION("IBM eServer HCA InfiniBand Device Driver");
-MODULE_VERSION("SVNEHCA_0021");
+MODULE_VERSION("SVNEHCA_0022");
 int ehca_open_aqp1     = 0;
 int ehca_debug_level   = 0;
@@ -810,7 +810,7 @@ int __init ehca_module_init(void)
        int ret;
        printk(KERN_INFO "eHCA Infiniband Device Driver "
-               "(Rel.: SVNEHCA_0021)\n");
+               "(Rel.: SVNEHCA_0022)\n");
        idr_init(&ehca_qp_idr);
        idr_init(&ehca_cq_idr);
        spin_lock_init(&ehca_qp_idr_lock);
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 71dc84bd4254..1c6b63aca268 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1088,21 +1088,21 @@ static void mthca_unmap_memfree(struct mthca_dev *dev,
 static int mthca_alloc_memfree(struct mthca_dev *dev,
                               struct mthca_qp *qp)
 {
-        int ret = 0;
        if (mthca_is_memfree(dev)) {
                qp->rq.db_index = mthca_alloc_db(dev, MTHCA_DB_TYPE_RQ,
                                                 qp->qpn, &qp->rq.db);
                if (qp->rq.db_index < 0)
-                        return ret;
+                        return -ENOMEM;
                qp->sq.db_index = mthca_alloc_db(dev, MTHCA_DB_TYPE_SQ,
                                                 qp->qpn, &qp->sq.db);
-                if (qp->sq.db_index < 0)
+                if (qp->sq.db_index < 0) {
                        mthca_free_db(dev, MTHCA_DB_TYPE_RQ, qp->rq.db_index);
+                        return -ENOMEM;
+                }
        }
-        return ret;
+        return 0;
 }
 static void mthca_free_memfree(struct mthca_dev *dev,
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index bb2e3d5eee20..56c87a81bb67 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -407,6 +407,10 @@ static int ipoib_mcast_join_complete(int status,
                        queue_delayed_work(ipoib_workqueue,
                                           &priv->mcast_task, 0);
                mutex_unlock(&mcast_mutex);
+                if (mcast == priv->broadcast)
+                        netif_carrier_on(dev);
                return 0;
        }
@@ -594,7 +598,6 @@ void ipoib_mcast_join_task(struct work_struct *work)
        ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
        clear_bit(IPOIB_MCAST_RUN, &priv->flags);
-        netif_carrier_on(dev);
 }
 int ipoib_mcast_start_thread(struct net_device *dev)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 3cb551b88756..7f3ec205e35f 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -259,12 +259,13 @@ void ipoib_event(struct ib_event_handler *handler,
        struct ipoib_dev_priv *priv =
                container_of(handler, struct ipoib_dev_priv, event_handler);
-        if (record->event == IB_EVENT_PORT_ERR    ||
+        if ((record->event == IB_EVENT_PORT_ERR    ||
-            record->event == IB_EVENT_PKEY_CHANGE ||
+             record->event == IB_EVENT_PKEY_CHANGE ||
-            record->event == IB_EVENT_PORT_ACTIVE ||
+             record->event == IB_EVENT_PORT_ACTIVE ||
-            record->event == IB_EVENT_LID_CHANGE  ||
+             record->event == IB_EVENT_LID_CHANGE  ||
-            record->event == IB_EVENT_SM_CHANGE   ||
+             record->event == IB_EVENT_SM_CHANGE   ||
-            record->event == IB_EVENT_CLIENT_REREGISTER) {
+             record->event == IB_EVENT_CLIENT_REREGISTER) &&
+            record->element.port_num == priv->port) {
                ipoib_dbg(priv, "Port state change event\n");
                queue_work(ipoib_workqueue, &priv->flush_task);
        }
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index ec195a36e8f6..db9cca3b65e0 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -553,7 +553,8 @@ static int __devinit i8042_check_aux(void)
 */
        param = 0x5a;
-        if (i8042_command(&param, I8042_CMD_AUX_LOOP) || param != 0x5a) {
+        retval = i8042_command(&param, I8042_CMD_AUX_LOOP);
+        if (retval || param != 0x5a) {
 /*
 * External connection test - filters out AT-soldered PS/2 i8042's
@@ -567,7 +568,12 @@ static int __devinit i8042_check_aux(void)
                    (param && param != 0xfa && param != 0xff))
                        return -1;
-                aux_loop_broken = 1;
+/*
+ * If AUX_LOOP completed without error but returned unexpected data
+ * mark it as broken
+ */
+                if (!retval)
+                        aux_loop_broken = 1;
        }
 /*
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index e3acd398fb37..1f6445840461 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -359,6 +359,8 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
                cfi->chips[i].word_write_time = 1<<cfi->cfiq->WordWriteTimeoutTyp;
                cfi->chips[i].buffer_write_time = 1<<cfi->cfiq->BufWriteTimeoutTyp;
                cfi->chips[i].erase_time = 1<<cfi->cfiq->BlockEraseTimeoutTyp;
+                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
        }
        map->fldrv = &cfi_amdstd_chipdrv;
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 69d49e0250a9..b344ff858b2d 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -158,6 +158,8 @@ struct mtd_info *cfi_cmdset_0020(struct map_info *map, int primary)
                cfi->chips[i].word_write_time = 128;
                cfi->chips[i].buffer_write_time = 128;
                cfi->chips[i].erase_time = 1024;
+                cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
        }
        return cfi_staa_setup(map);
diff --git a/drivers/mtd/maps/dilnetpc.c b/drivers/mtd/maps/dilnetpc.c
index b1104fe1f207..1c3b34ad7325 100644
--- a/drivers/mtd/maps/dilnetpc.c
+++ b/drivers/mtd/maps/dilnetpc.c
@@ -402,8 +402,8 @@ static int __init init_dnpc(void)
                        ++higlvl_partition_info[i].name;
        }
-        printk(KERN_NOTICE "DIL/Net %s flash: 0x%lx at 0x%lx\n",
+        printk(KERN_NOTICE "DIL/Net %s flash: 0x%lx at 0x%llx\n",
-                is_dnp ? "DNPC" : "ADNP", dnpc_map.size, dnpc_map.phys);
+                is_dnp ? "DNPC" : "ADNP", dnpc_map.size, (unsigned long long)dnpc_map.phys);
        dnpc_map.virt = ioremap_nocache(dnpc_map.phys, dnpc_map.size);
diff --git a/drivers/mtd/maps/esb2rom.c b/drivers/mtd/maps/esb2rom.c
index 0bc013fd66a3..aa64a4752781 100644
--- a/drivers/mtd/maps/esb2rom.c
+++ b/drivers/mtd/maps/esb2rom.c
@@ -30,7 +30,7 @@
 #define ROM_PROBE_STEP_SIZE (64*1024) /* 64KiB */
-#define BIOS_CNTL       0xDC
+#define BIOS_CNTL               0xDC
 #define BIOS_LOCK_ENABLE        0x02
 #define BIOS_WRITE_ENABLE       0x01
@@ -145,7 +145,7 @@ static void esb2rom_cleanup(struct esb2rom_window *window)
 }
 static int __devinit esb2rom_init_one(struct pci_dev *pdev,
-                                const struct pci_device_id *ent)
+                                      const struct pci_device_id *ent)
 {
        static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL };
        struct esb2rom_window *window = &esb2rom_window;
@@ -185,7 +185,7 @@ static int __devinit esb2rom_init_one(struct pci_dev *pdev,
        /* Find a region continuous to the end of the ROM window  */
        window->phys = 0;
        pci_read_config_word(pdev, FWH_DEC_EN1, &word);
-        printk(KERN_DEBUG "pci_read_config_byte : %x\n", word);
+        printk(KERN_DEBUG "pci_read_config_word : %x\n", word);
        if ((word & FWH_8MiB) == FWH_8MiB)
                window->phys = 0xff400000;
@@ -212,6 +212,11 @@ static int __devinit esb2rom_init_one(struct pci_dev *pdev,
        else if ((word & FWH_0_5MiB) == FWH_0_5MiB)
                window->phys = 0xfff80000;
+        if (window->phys == 0) {
+                printk(KERN_ERR MOD_NAME ": Rom window is closed\n");
+                goto out;
+        }
        /* reserved  0x0020 and 0x0010 */
        window->phys -= 0x400000UL;
        window->size = (0xffffffffUL - window->phys) + 1UL;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 880580c44e01..41844ea02462 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -727,6 +727,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
        concat->mtd.erasesize = subdev[0]->erasesize;
        concat->mtd.writesize = subdev[0]->writesize;
        concat->mtd.oobsize = subdev[0]->oobsize;
+        concat->mtd.oobavail = subdev[0]->oobavail;
        if (subdev[0]->writev)
                concat->mtd.writev = concat_writev;
        if (subdev[0]->read_oob)
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 633def3fb087..1af989023c66 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -200,6 +200,11 @@ static int part_erase (struct mtd_info *mtd, struct erase_info *instr)
                return -EINVAL;
        instr->addr += part->offset;
        ret = part->master->erase(part->master, instr);
+        if (ret) {
+                if (instr->fail_addr != 0xffffffff)
+                        instr->fail_addr -= part->offset;
+                instr->addr -= part->offset;
+        }
        return ret;
 }
@@ -338,6 +343,7 @@ int add_mtd_partitions(struct mtd_info *master,
                slave->mtd.size = parts[i].size;
                slave->mtd.writesize = master->writesize;
                slave->mtd.oobsize = master->oobsize;
+                slave->mtd.oobavail = master->oobavail;
                slave->mtd.subpage_sft = master->subpage_sft;
                slave->mtd.name = parts[i].name;
@@ -559,4 +565,3 @@ EXPORT_SYMBOL_GPL(deregister_mtd_parser);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
 MODULE_DESCRIPTION("Generic support for partitioning of MTD devices");
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 12608c13cce5..595208f965a5 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -114,7 +114,7 @@ module_param(no_autopart, int, 0);
 static int show_firmware_partition = 0;
 module_param(show_firmware_partition, int, 0);
-#ifdef MTD_NAND_DISKONCHIP_BBTWRITE
+#ifdef CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE
 static int inftl_bbt_write = 1;
 #else
 static int inftl_bbt_write = 0;
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index acaf97bc80d1..6af37b8cff65 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2524,6 +2524,7 @@ int nand_scan_tail(struct mtd_info *mtd)
        for (i = 0; chip->ecc.layout->oobfree[i].length; i++)
                chip->ecc.layout->oobavail +=
                        chip->ecc.layout->oobfree[i].length;
+        mtd->oobavail = chip->ecc.layout->oobavail;
        /*
         * Set the number of read / write steps for one page depending on ECC
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 7f1cb6e5dccb..9e14a26ca4e8 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -4,6 +4,11 @@
 *  Copyright (C) 2005-2007 Samsung Electronics
 *  Kyungmin Park <kyungmin.park@samsung.com>
 *
+ *  Credits:
+ *      Adrian Hunter <ext-adrian.hunter@nokia.com>:
+ *      auto-placement support, read-while load support, various fixes
+ *      Copyright (C) Nokia Corporation, 2007
+ *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
@@ -831,7 +836,7 @@ static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int col
        int readcol = column;
        int readend = column + thislen;
        int lastgap = 0;
-        uint8_t *oob_buf = this->page_buf + mtd->writesize;
+        uint8_t *oob_buf = this->oob_buf;
        for (free = this->ecclayout->oobfree; free->length; ++free) {
                if (readcol >= lastgap)
@@ -849,7 +854,8 @@ static int onenand_transfer_auto_oob(struct mtd_info *mtd, uint8_t *buf, int col
                        int n = ed - st;
                        memcpy(buf, oob_buf + st, n);
                        buf += n;
-                }
+                } else
+                        break;
        }
        return 0;
 }
@@ -947,9 +953,9 @@ static int onenand_do_read_oob(struct mtd_info *mtd, loff_t from, size_t len,
 /**
 * onenand_read_oob - [MTD Interface] NAND write data and/or out-of-band
- * @mtd:        MTD device structure
+ * @param mtd:          MTD device structure
- * @from:       offset to read from
+ * @param from:         offset to read from
- * @ops:        oob operation description structure
+ * @param ops:          oob operation description structure
 */
 static int onenand_read_oob(struct mtd_info *mtd, loff_t from,
                            struct mtd_oob_ops *ops)
@@ -1017,7 +1023,7 @@ static int onenand_bbt_wait(struct mtd_info *mtd, int state)
 * onenand_bbt_read_oob - [MTD Interface] OneNAND read out-of-band for bbt scan
 * @param mtd           MTD device structure
 * @param from          offset to read from
- * @param @ops          oob operation description structure
+ * @param ops           oob operation description structure
 *
 * OneNAND read out-of-band data from the spare area for bbt scan
 */
@@ -1093,7 +1099,7 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
 static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to)
 {
        struct onenand_chip *this = mtd->priv;
-        char *readp = this->page_buf + mtd->writesize;
+        char oobbuf[64];
        int status, i;
        this->command(mtd, ONENAND_CMD_READOOB, to, mtd->oobsize);
@@ -1102,9 +1108,9 @@ static int onenand_verify_oob(struct mtd_info *mtd, const u_char *buf, loff_t to
        if (status)
                return status;
-        this->read_bufferram(mtd, ONENAND_SPARERAM, readp, 0, mtd->oobsize);
+        this->read_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
-        for(i = 0; i < mtd->oobsize; i++)
+        for (i = 0; i < mtd->oobsize; i++)
-                if (buf[i] != 0xFF && buf[i] != readp[i])
+                if (buf[i] != 0xFF && buf[i] != oobbuf[i])
                        return -EBADMSG;
        return 0;
@@ -1290,7 +1296,8 @@ static int onenand_fill_auto_oob(struct mtd_info *mtd, u_char *oob_buf,
                        int n = ed - st;
                        memcpy(oob_buf + st, buf, n);
                        buf += n;
-                }
+                } else
+                        break;
        }
        return 0;
 }
@@ -1312,6 +1319,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
        struct onenand_chip *this = mtd->priv;
        int column, ret = 0, oobsize;
        int written = 0;
+        u_char *oobbuf;
        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
@@ -1331,7 +1339,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
        }
        /* For compatibility with NAND: Do not allow write past end of page */
-        if (column + len > oobsize) {
+        if (unlikely(column + len > oobsize)) {
                printk(KERN_ERR "onenand_write_oob: "
                      "Attempt to write past end of page\n");
                return -EINVAL;
@@ -1348,6 +1356,8 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
        /* Grab the lock and see if the device is available */
        onenand_get_device(mtd, FL_WRITING);
+        oobbuf = this->oob_buf;
        /* Loop until all data write */
        while (written < len) {
                int thislen = min_t(int, oobsize, len - written);
@@ -1358,12 +1368,12 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                /* We send data to spare ram with oobsize
                 * to prevent byte access */
-                memset(this->page_buf, 0xff, mtd->oobsize);
+                memset(oobbuf, 0xff, mtd->oobsize);
                if (mode == MTD_OOB_AUTO)
-                        onenand_fill_auto_oob(mtd, this->page_buf, buf, column, thislen);
+                        onenand_fill_auto_oob(mtd, oobbuf, buf, column, thislen);
                else
-                        memcpy(this->page_buf + column, buf, thislen);
+                        memcpy(oobbuf + column, buf, thislen);
-                this->write_bufferram(mtd, ONENAND_SPARERAM, this->page_buf, 0, mtd->oobsize);
+                this->write_bufferram(mtd, ONENAND_SPARERAM, oobbuf, 0, mtd->oobsize);
                this->command(mtd, ONENAND_CMD_PROGOOB, to, mtd->oobsize);
@@ -1375,7 +1385,7 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
                        break;
                }
-                ret = onenand_verify_oob(mtd, this->page_buf, to);
+                ret = onenand_verify_oob(mtd, oobbuf, to);
                if (ret) {
                        printk(KERN_ERR "onenand_write_oob: verify failed %d\n", ret);
                        break;
@@ -1400,9 +1410,9 @@ static int onenand_do_write_oob(struct mtd_info *mtd, loff_t to, size_t len,
 /**
 * onenand_write_oob - [MTD Interface] NAND write data and/or out-of-band
- * @mtd:        MTD device structure
+ * @param mtd:          MTD device structure
- * @from:       offset to read from
+ * @param to:           offset to write
- * @ops:        oob operation description structure
+ * @param ops:          oob operation description structure
 */
 static int onenand_write_oob(struct mtd_info *mtd, loff_t to,
                             struct mtd_oob_ops *ops)
@@ -1616,6 +1626,7 @@ static int onenand_block_markbad(struct mtd_info *mtd, loff_t ofs)
 * @param mtd           MTD device structure
 * @param ofs           offset relative to mtd start
 * @param len           number of bytes to lock or unlock
+ * @param cmd           lock or unlock command
 *
 * Lock or unlock one or more blocks
 */
@@ -2117,10 +2128,11 @@ static void onenand_check_features(struct mtd_info *mtd)
 }
 /**
- * onenand_print_device_info - Print device ID
+ * onenand_print_device_info - Print device & version ID
 * @param device        device ID
+ * @param version       version ID
 *
- * Print device ID
+ * Print device & version ID
 */
 static void onenand_print_device_info(int device, int version)
 {
@@ -2320,15 +2332,25 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        /* Allocate buffers, if necessary */
        if (!this->page_buf) {
-                size_t len;
+                this->page_buf = kzalloc(mtd->writesize, GFP_KERNEL);
-                len = mtd->writesize + mtd->oobsize;
-                this->page_buf = kmalloc(len, GFP_KERNEL);
                if (!this->page_buf) {
                        printk(KERN_ERR "onenand_scan(): Can't allocate page_buf\n");
                        return -ENOMEM;
                }
                this->options |= ONENAND_PAGEBUF_ALLOC;
        }
+        if (!this->oob_buf) {
+                this->oob_buf = kzalloc(mtd->oobsize, GFP_KERNEL);
+                if (!this->oob_buf) {
+                        printk(KERN_ERR "onenand_scan(): Can't allocate oob_buf\n");
+                        if (this->options & ONENAND_PAGEBUF_ALLOC) {
+                                this->options &= ~ONENAND_PAGEBUF_ALLOC;
+                                kfree(this->page_buf);
+                        }
+                        return -ENOMEM;
+                }
+                this->options |= ONENAND_OOBBUF_ALLOC;
+        }
        this->state = FL_READY;
        init_waitqueue_head(&this->wq);
@@ -2367,6 +2389,7 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        for (i = 0; this->ecclayout->oobfree[i].length; i++)
                this->ecclayout->oobavail +=
                        this->ecclayout->oobfree[i].length;
+        mtd->oobavail = this->ecclayout->oobavail;
        mtd->ecclayout = this->ecclayout;
@@ -2424,9 +2447,11 @@ void onenand_release(struct mtd_info *mtd)
                kfree(bbm->bbt);
                kfree(this->bbm);
        }
-        /* Buffer allocated by onenand_scan */
+        /* Buffers allocated by onenand_scan */
        if (this->options & ONENAND_PAGEBUF_ALLOC)
                kfree(this->page_buf);
+        if (this->options & ONENAND_OOBBUF_ALLOC)
+                kfree(this->oob_buf);
 }
 EXPORT_SYMBOL_GPL(onenand_scan);
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 72995777f809..b406ecfa7268 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -858,19 +858,7 @@ static struct eisa_device_id vortex_eisa_ids[] = {
 };
 MODULE_DEVICE_TABLE(eisa, vortex_eisa_ids);
-static int vortex_eisa_probe(struct device *device);
+static int __init vortex_eisa_probe(struct device *device)
-static int vortex_eisa_remove(struct device *device);
-static struct eisa_driver vortex_eisa_driver = {
-        .id_table = vortex_eisa_ids,
-        .driver   = {
-                .name    = "3c59x",
-                .probe   = vortex_eisa_probe,
-                .remove  = vortex_eisa_remove
-        }
-};
-static int vortex_eisa_probe(struct device *device)
 {
        void __iomem *ioaddr;
        struct eisa_device *edev;
@@ -893,7 +881,7 @@ static int vortex_eisa_probe(struct device *device)
        return 0;
 }
-static int vortex_eisa_remove(struct device *device)
+static int __devexit vortex_eisa_remove(struct device *device)
 {
        struct eisa_device *edev;
        struct net_device *dev;
@@ -918,7 +906,17 @@ static int vortex_eisa_remove(struct device *device)
        free_netdev(dev);
        return 0;
 }
-#endif
+static struct eisa_driver vortex_eisa_driver = {
+        .id_table = vortex_eisa_ids,
+        .driver   = {
+                .name    = "3c59x",
+                .probe   = vortex_eisa_probe,
+                .remove  = __devexit_p(vortex_eisa_remove)
+        }
+};
+#endif /* CONFIG_EISA */
 /* returns count found (>= 0), or negative on error */
 static int __init vortex_eisa_init(void)
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 9ba21e0f27c5..1ee27c360a4b 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -787,6 +787,12 @@ static int mv643xx_eth_open(struct net_device *dev)
        unsigned int size;
        int err;
+        /* Clear any pending ethernet port interrupts */
+        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_REG(port_num), 0);
+        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_EXTEND_REG(port_num), 0);
+        /* wait for previous write to complete */
+        mv_read (MV643XX_ETH_INTERRUPT_CAUSE_EXTEND_REG(port_num));
        err = request_irq(dev->irq, mv643xx_eth_int_handler,
                        IRQF_SHARED | IRQF_SAMPLE_RANDOM, dev->name, dev);
        if (err) {
@@ -875,10 +881,6 @@ static int mv643xx_eth_open(struct net_device *dev)
        mv643xx_eth_rx_refill_descs(dev);       /* Fill RX ring with skb's */
-        /* Clear any pending ethernet port interrupts */
-        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_REG(port_num), 0);
-        mv_write(MV643XX_ETH_INTERRUPT_CAUSE_EXTEND_REG(port_num), 0);
        eth_port_start(dev);
        /* Interrupt Coalescing */
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index b05dc6ed7fb7..ac02b3b60f92 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -181,6 +181,7 @@ struct myri10ge_priv {
        int intr_coal_delay;
        __be32 __iomem *intr_coal_delay_ptr;
        int mtrr;
+        int wc_enabled;
        int wake_queue;
        int stop_queue;
        int down_cnt;
@@ -717,6 +718,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
        int status;
        size_t bytes;
        u32 len;
+        struct page *dmatest_page;
+        dma_addr_t dmatest_bus;
        /* try to send a reset command to the card to see if it
         * is alive */
@@ -726,6 +729,11 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                dev_err(&mgp->pdev->dev, "failed reset\n");
                return -ENXIO;
        }
+        dmatest_page = alloc_page(GFP_KERNEL);
+        if (!dmatest_page)
+                return -ENOMEM;
+        dmatest_bus = pci_map_page(mgp->pdev, dmatest_page, 0, PAGE_SIZE,
+                                   DMA_BIDIRECTIONAL);
        /* Now exchange information about interrupts  */
@@ -764,8 +772,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
        len = mgp->tx.boundary;
-        cmd.data0 = MYRI10GE_LOWPART_TO_U32(mgp->rx_done.bus);
+        cmd.data0 = MYRI10GE_LOWPART_TO_U32(dmatest_bus);
-        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(mgp->rx_done.bus);
+        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(dmatest_bus);
        cmd.data2 = len * 0x10000;
        status = myri10ge_send_cmd(mgp, MXGEFW_DMA_TEST, &cmd, 0);
        if (status == 0)
@@ -774,8 +782,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
        else
                dev_warn(&mgp->pdev->dev, "DMA read benchmark failed: %d\n",
                         status);
-        cmd.data0 = MYRI10GE_LOWPART_TO_U32(mgp->rx_done.bus);
+        cmd.data0 = MYRI10GE_LOWPART_TO_U32(dmatest_bus);
-        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(mgp->rx_done.bus);
+        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(dmatest_bus);
        cmd.data2 = len * 0x1;
        status = myri10ge_send_cmd(mgp, MXGEFW_DMA_TEST, &cmd, 0);
        if (status == 0)
@@ -785,8 +793,8 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                dev_warn(&mgp->pdev->dev, "DMA write benchmark failed: %d\n",
                         status);
-        cmd.data0 = MYRI10GE_LOWPART_TO_U32(mgp->rx_done.bus);
+        cmd.data0 = MYRI10GE_LOWPART_TO_U32(dmatest_bus);
-        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(mgp->rx_done.bus);
+        cmd.data1 = MYRI10GE_HIGHPART_TO_U32(dmatest_bus);
        cmd.data2 = len * 0x10001;
        status = myri10ge_send_cmd(mgp, MXGEFW_DMA_TEST, &cmd, 0);
        if (status == 0)
@@ -796,6 +804,9 @@ static int myri10ge_reset(struct myri10ge_priv *mgp)
                dev_warn(&mgp->pdev->dev,
                         "DMA read/write benchmark failed: %d\n", status);
+        pci_unmap_page(mgp->pdev, dmatest_bus, PAGE_SIZE, DMA_BIDIRECTIONAL);
+        put_page(dmatest_page);
        memset(mgp->rx_done.entry, 0, bytes);
        /* reset mcp/driver shared state back to 0 */
@@ -1375,7 +1386,7 @@ myri10ge_get_ethtool_stats(struct net_device *netdev,
                data[i] = ((unsigned long *)&mgp->stats)[i];
        data[i++] = (unsigned int)mgp->tx.boundary;
-        data[i++] = (unsigned int)(mgp->mtrr >= 0);
+        data[i++] = (unsigned int)mgp->wc_enabled;
        data[i++] = (unsigned int)mgp->pdev->irq;
        data[i++] = (unsigned int)mgp->msi_enabled;
        data[i++] = (unsigned int)mgp->read_dma;
@@ -1456,6 +1467,8 @@ static int myri10ge_allocate_rings(struct net_device *dev)
        status = myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_SEND_RING_SIZE, &cmd, 0);
        tx_ring_size = cmd.data0;
        status |= myri10ge_send_cmd(mgp, MXGEFW_CMD_GET_RX_RING_SIZE, &cmd, 0);
+        if (status != 0)
+                return status;
        rx_ring_size = cmd.data0;
        tx_ring_entries = tx_ring_size / sizeof(struct mcp_kreq_ether_send);
@@ -1463,6 +1476,8 @@ static int myri10ge_allocate_rings(struct net_device *dev)
        mgp->tx.mask = tx_ring_entries - 1;
        mgp->rx_small.mask = mgp->rx_big.mask = rx_ring_entries - 1;
+        status = -ENOMEM;
        /* allocate the host shadow rings */
        bytes = 8 + (MYRI10GE_MAX_SEND_DESC_TSO + 4)
@@ -1735,7 +1750,7 @@ static int myri10ge_open(struct net_device *dev)
                goto abort_with_irq;
        }
-        if (myri10ge_wcfifo && mgp->mtrr >= 0) {
+        if (myri10ge_wcfifo && mgp->wc_enabled) {
                mgp->tx.wc_fifo = (u8 __iomem *) mgp->sram + MXGEFW_ETH_SEND_4;
                mgp->rx_small.wc_fifo =
                    (u8 __iomem *) mgp->sram + MXGEFW_ETH_RECV_SMALL;
@@ -2510,6 +2525,12 @@ static void myri10ge_select_firmware(struct myri10ge_priv *mgp)
                                 bridge->vendor, bridge->device);
                        mgp->tx.boundary = 4096;
                        mgp->fw_name = myri10ge_fw_aligned;
+                } else if (bridge &&
+                           bridge->vendor == PCI_VENDOR_ID_SGI &&
+                           bridge->device == 0x4002 /* TIOCE pcie-port */ ) {
+                        /* this pcie bridge does not support 4K rdma request */
+                        mgp->tx.boundary = 2048;
+                        mgp->fw_name = myri10ge_fw_aligned;
                }
        } else {
                if (myri10ge_force_firmware == 1) {
@@ -2830,9 +2851,12 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        mgp->board_span = pci_resource_len(pdev, 0);
        mgp->iomem_base = pci_resource_start(pdev, 0);
        mgp->mtrr = -1;
+        mgp->wc_enabled = 0;
 #ifdef CONFIG_MTRR
        mgp->mtrr = mtrr_add(mgp->iomem_base, mgp->board_span,
                             MTRR_TYPE_WRCOMB, 1);
+        if (mgp->mtrr >= 0)
+                mgp->wc_enabled = 1;
 #endif
        /* Hack.  need to get rid of these magic numbers */
        mgp->sram_size =
@@ -2927,7 +2951,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        dev_info(dev, "%s IRQ %d, tx bndry %d, fw %s, WC %s\n",
                 (mgp->msi_enabled ? "MSI" : "xPIC"),
                 netdev->irq, mgp->tx.boundary, mgp->fw_name,
-                 (mgp->mtrr >= 0 ? "Enabled" : "Disabled"));
+                 (mgp->wc_enabled ? "Enabled" : "Disabled"));
        return 0;
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index a2877f33fa85..1be55702557d 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -228,7 +228,7 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                            &adapter->ctx_desc_pdev);
        printk("ctx_desc_phys_addr: 0x%llx\n",
-               (u64) adapter->ctx_desc_phys_addr);
+               (unsigned long long) adapter->ctx_desc_phys_addr);
        if (addr == NULL) {
                DPRINTK(ERR, "bad return from pci_alloc_consistent\n");
                err = -ENOMEM;
@@ -247,7 +247,8 @@ int netxen_nic_hw_resources(struct netxen_adapter *adapter)
                            adapter->max_tx_desc_count,
                            (dma_addr_t *) & hw->cmd_desc_phys_addr,
                            &adapter->ahw.cmd_desc_pdev);
-        printk("cmd_desc_phys_addr: 0x%llx\n", (u64) hw->cmd_desc_phys_addr);
+        printk("cmd_desc_phys_addr: 0x%llx\n",
+               (unsigned long long) hw->cmd_desc_phys_addr);
        if (addr == NULL) {
                DPRINTK(ERR, "bad return from pci_alloc_consistent\n");
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 15d954e50cae..521b5f0618a4 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -572,8 +572,8 @@ static void rtl8169_xmii_reset_enable(void __iomem *ioaddr)
 {
        unsigned int val;
-        mdio_write(ioaddr, MII_BMCR, BMCR_RESET);
+        val = mdio_read(ioaddr, MII_BMCR) | BMCR_RESET;
-        val = mdio_read(ioaddr, MII_BMCR);
+        mdio_write(ioaddr, MII_BMCR, val & 0xffff);
 }
 static void rtl8169_check_link_status(struct net_device *dev,
@@ -1368,11 +1368,7 @@ static inline void rtl8169_request_timer(struct net_device *dev)
            (tp->phy_version >= RTL_GIGA_PHY_VER_H))
                return;
-        init_timer(timer);
+        mod_timer(timer, jiffies + RTL8169_PHY_TIMEOUT);
-        timer->expires = jiffies + RTL8169_PHY_TIMEOUT;
-        timer->data = (unsigned long)(dev);
-        timer->function = rtl8169_phy_timer;
-        add_timer(timer);
 }
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -1685,6 +1681,10 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->mmio_addr = ioaddr;
        tp->align = rtl_cfg_info[ent->driver_data].align;
+        init_timer(&tp->timer);
+        tp->timer.data = (unsigned long) dev;
+        tp->timer.function = rtl8169_phy_timer;
        spin_lock_init(&tp->lock);
        rc = register_netdev(dev);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 53839979cfb8..ab0ab92583fe 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -2165,9 +2165,27 @@ force_update:
                        /* fall through */
 #endif
                case OP_RXCHKS:
-                        skb = sky2->rx_ring[sky2->rx_next].skb;
+                        if (!sky2->rx_csum)
-                        skb->ip_summed = CHECKSUM_COMPLETE;
+                                break;
-                        skb->csum = status & 0xffff;
+                        /* Both checksum counters are programmed to start at
+                         * the same offset, so unless there is a problem they
+                         * should match. This failure is an early indication that
+                         * hardware receive checksumming won't work.
+                         */
+                        if (likely(status >> 16 == (status & 0xffff))) {
+                                skb = sky2->rx_ring[sky2->rx_next].skb;
+                                skb->ip_summed = CHECKSUM_COMPLETE;
+                                skb->csum = status & 0xffff;
+                        } else {
+                                printk(KERN_NOTICE PFX "%s: hardware receive "
+                                       "checksum problem (status = %#x)\n",
+                                       dev->name, status);
+                                sky2->rx_csum = 0;
+                                sky2_write32(sky2->hw,
+                                             Q_ADDR(rxqaddr[le->link], Q_CSR),
+                                             BMU_DIS_RX_CHKSUM);
+                        }
                        break;
                case OP_TXINDEXLE:
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 0d97e10ccac5..36202e94ee91 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -186,7 +186,6 @@ static char __devinit *adapter_def(char type)
 #define TRC_INITV 0x02          /*  verbose init trace points     */
 static unsigned char ibmtr_debug_trace = 0;
-static int      ibmtr_probe(struct net_device *dev);
 static int      ibmtr_probe1(struct net_device *dev, int ioaddr);
 static unsigned char get_sram_size(struct tok_info *adapt_info);
 static int      trdev_init(struct net_device *dev);
@@ -335,17 +334,6 @@ static void ibmtr_cleanup_card(struct net_device *dev)
 #endif          
 }
-int ibmtr_probe_card(struct net_device *dev)
-{
-        int err = ibmtr_probe(dev);
-        if (!err) {
-                err = register_netdev(dev);
-                if (err)
-                        ibmtr_cleanup_card(dev);
-        }
-        return err;
-}
 /****************************************************************************
 *      ibmtr_probe():  Routine specified in the network device structure
 *      to probe for an IBM Token Ring Adapter.  Routine outline:
@@ -358,7 +346,7 @@ int ibmtr_probe_card(struct net_device *dev)
 *      which references it.
 ****************************************************************************/
-static int ibmtr_probe(struct net_device *dev)
+static int __init ibmtr_probe(struct net_device *dev)
 {
        int i;
        int base_addr = dev->base_addr;
@@ -378,6 +366,17 @@ static int ibmtr_probe(struct net_device *dev)
        return -ENODEV;
 }
+int __init ibmtr_probe_card(struct net_device *dev)
+{
+        int err = ibmtr_probe(dev);
+        if (!err) {
+                err = register_netdev(dev);
+                if (err)
+                        ibmtr_cleanup_card(dev);
+        }
+        return err;
+}
 /*****************************************************************************/
 static int __devinit ibmtr_probe1(struct net_device *dev, int PIOaddr)
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index ebbda1d8f542..f3a972e74e9a 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -30,8 +30,8 @@
 */
 #define DRV_NAME        "via-rhine"
-#define DRV_VERSION     "1.4.2"
+#define DRV_VERSION     "1.4.3"
-#define DRV_RELDATE     "Sept-11-2006"
+#define DRV_RELDATE     "2007-03-06"
 /* A few user-configurable values.
@@ -105,6 +105,7 @@ static const int multicast_filter_limit = 32;
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/uaccess.h>
+#include <linux/dmi.h>
 /* These identify the driver base version and may not be removed. */
 static char version[] __devinitdata =
@@ -1995,6 +1996,23 @@ static struct pci_driver rhine_driver = {
        .shutdown =     rhine_shutdown,
 };
+static struct dmi_system_id __initdata rhine_dmi_table[] = {
+        {
+                .ident = "EPIA-M",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Award Software International, Inc."),
+                        DMI_MATCH(DMI_BIOS_VERSION, "6.00 PG"),
+                },
+        },
+        {
+                .ident = "KV7",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                        DMI_MATCH(DMI_BIOS_VERSION, "6.00 PG"),
+                },
+        },
+        { NULL }
+};
 static int __init rhine_init(void)
 {
@@ -2002,6 +2020,16 @@ static int __init rhine_init(void)
 #ifdef MODULE
        printk(version);
 #endif
+        if (dmi_check_system(rhine_dmi_table)) {
+                /* these BIOSes fail at PXE boot if chip is in D3 */
+                avoid_D3 = 1;
+                printk(KERN_WARNING "%s: Broken BIOS detected, avoid_D3 "
+                                    "enabled.\n",
+                       DRV_NAME);
+        }
+        else if (avoid_D3)
+                printk(KERN_INFO "%s: avoid_D3 set.\n", DRV_NAME);
        return pci_register_driver(&rhine_driver);
 }
diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
index 8dbcf83bb5f3..8b4540bfc1b0 100644
--- a/drivers/net/wan/z85230.c
+++ b/drivers/net/wan/z85230.c
@@ -407,7 +407,7 @@ static void z8530_tx(struct z8530_channel *c)
        while(c->txcount) {
                /* FIFO full ? */
                if(!(read_zsreg(c, R0)&4))
-                        break;
+                        return;
                c->txcount--;
                /*
                 *      Shovel out the byte
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index e594af46ff05..80cb88eb98c6 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1858,9 +1858,6 @@ static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id)
        spin_lock(&bcm->irq_lock);
-        assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
-        assert(bcm->current_core->id == BCM43xx_COREID_80211);
        reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
        if (reason == 0xffffffff) {
                /* irq not for us (shared irq) */
@@ -1871,6 +1868,9 @@ static irqreturn_t bcm43xx_interrupt_handler(int irq, void *dev_id)
        if (!reason)
                goto out;
+        assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
+        assert(bcm->current_core->id == BCM43xx_COREID_80211);
        bcm->dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA0_REASON)
                             & 0x0001DC00;
        bcm->dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index 3a5c9c2b2150..cae89258a640 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -859,6 +859,11 @@ static void bcm43xx_phy_initb6(struct bcm43xx_private *bcm)
                bcm43xx_radio_write16(bcm, 0x005D, 0x0088);
                bcm43xx_radio_write16(bcm, 0x005E, 0x0088);
                bcm43xx_radio_write16(bcm, 0x007D, 0x0088);
+                bcm43xx_shm_write32(bcm, BCM43xx_SHM_SHARED,
+                                    BCM43xx_UCODEFLAGS_OFFSET,
+                                    (bcm43xx_shm_read32(bcm, BCM43xx_SHM_SHARED,
+                                    BCM43xx_UCODEFLAGS_OFFSET)
+                                    | 0x00000200));
        }
        if (radio->revision == 8) {
                bcm43xx_radio_write16(bcm, 0x0051, 0x0000);
@@ -941,7 +946,8 @@ static void bcm43xx_phy_initb6(struct bcm43xx_private *bcm)
        bcm43xx_phy_write(bcm, 0x0038, 0x0668);
        bcm43xx_radio_set_txpower_bg(bcm, 0xFFFF, 0xFFFF, 0xFFFF);
        if (radio->revision <= 5)
-                bcm43xx_phy_write(bcm, 0x005D, bcm43xx_phy_read(bcm, 0x005D) | 0x0003);
+                bcm43xx_phy_write(bcm, 0x005D, (bcm43xx_phy_read(bcm, 0x005D)
+                                  & 0xFF80) | 0x0003);
        if (radio->revision <= 2)
                bcm43xx_radio_write16(bcm, 0x005D, 0x000D);
        
@@ -958,7 +964,7 @@ static void bcm43xx_phy_initb6(struct bcm43xx_private *bcm)
                bcm43xx_phy_write(bcm, 0x0016, 0x0410);
                bcm43xx_phy_write(bcm, 0x0017, 0x0820);
                bcm43xx_phy_write(bcm, 0x0062, 0x0007);
-                (void) bcm43xx_radio_calibrationvalue(bcm);
+                bcm43xx_radio_init2050(bcm);
                bcm43xx_phy_lo_g_measure(bcm);
                if (bcm->sprom.boardflags & BCM43xx_BFL_RSSI) {
                        bcm43xx_calc_nrssi_slope(bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 7b665e2386a8..d6d9413d7f23 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -105,18 +105,24 @@ static int bcm43xx_wx_set_channelfreq(struct net_device *net_dev,
        struct bcm43xx_private *bcm = bcm43xx_priv(net_dev);
        unsigned long flags;
        u8 channel;
+        s8 expon;
        int freq;
        int err = -EINVAL;
        mutex_lock(&bcm->mutex);
        spin_lock_irqsave(&bcm->irq_lock, flags);
-        if ((data->freq.m >= 0) && (data->freq.m <= 1000)) {
+        if ((data->freq.e == 0) &&
+            (data->freq.m >= 0) && (data->freq.m <= 1000)) {
                channel = data->freq.m;
                freq = bcm43xx_channel_to_freq(bcm, channel);
        } else {
-                channel = bcm43xx_freq_to_channel(bcm, data->freq.m);
                freq = data->freq.m;
+                expon = 6 - data->freq.e;
+                while (--expon >= 0)    /* scale down the frequency to MHz */
+                        freq /= 10;
+                assert(freq > 1000);
+                channel = bcm43xx_freq_to_channel(bcm, freq);
        }
        if (!ieee80211_is_valid_channel(bcm->ieee, channel))
                goto out_unlock;
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 7a535542fe92..118ac9779b3c 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -89,6 +89,7 @@ pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, u32 gsi,
                return;
        res->irq_resource[i].flags = IORESOURCE_IRQ;  // Also clears _UNSET flag
+        res->irq_resource[i].flags |= irq_flags(triggering, polarity);
        irq = acpi_register_gsi(gsi, triggering, polarity);
        if (irq < 0) {
                res->irq_resource[i].flags |= IORESOURCE_DISABLED;
@@ -103,8 +104,52 @@ pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res, u32 gsi,
        pcibios_penalize_isa_irq(irq, 1);
 }
+static int dma_flags(int type, int bus_master, int transfer)
+{
+        int flags = 0;
+        if (bus_master)
+                flags |= IORESOURCE_DMA_MASTER;
+        switch (type) {
+        case ACPI_COMPATIBILITY:
+                flags |= IORESOURCE_DMA_COMPATIBLE;
+                break;
+        case ACPI_TYPE_A:
+                flags |= IORESOURCE_DMA_TYPEA;
+                break;
+        case ACPI_TYPE_B:
+                flags |= IORESOURCE_DMA_TYPEB;
+                break;
+        case ACPI_TYPE_F:
+                flags |= IORESOURCE_DMA_TYPEF;
+                break;
+        default:
+                /* Set a default value ? */
+                flags |= IORESOURCE_DMA_COMPATIBLE;
+                pnp_err("Invalid DMA type");
+        }
+        switch (transfer) {
+        case ACPI_TRANSFER_8:
+                flags |= IORESOURCE_DMA_8BIT;
+                break;
+        case ACPI_TRANSFER_8_16:
+                flags |= IORESOURCE_DMA_8AND16BIT;
+                break;
+        case ACPI_TRANSFER_16:
+                flags |= IORESOURCE_DMA_16BIT;
+                break;
+        default:
+                /* Set a default value ? */
+                flags |= IORESOURCE_DMA_8AND16BIT;
+                pnp_err("Invalid DMA transfer type");
+        }
+        return flags;
+}
 static void
-pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma)
+pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma,
+        int type, int bus_master, int transfer)
 {
        int i = 0;
        while (i < PNP_MAX_DMA &&
@@ -112,6 +157,7 @@ pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma)
                i++;
        if (i < PNP_MAX_DMA) {
                res->dma_resource[i].flags = IORESOURCE_DMA;  // Also clears _UNSET flag
+                res->dma_resource[i].flags |= dma_flags(type, bus_master, transfer);
                if (dma == -1) {
                        res->dma_resource[i].flags |= IORESOURCE_DISABLED;
                        return;
@@ -123,7 +169,7 @@ pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res, u32 dma)
 static void
 pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
-        u64 io, u64 len)
+        u64 io, u64 len, int io_decode)
 {
        int i = 0;
        while (!(res->port_resource[i].flags & IORESOURCE_UNSET) &&
@@ -131,6 +177,8 @@ pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
                i++;
        if (i < PNP_MAX_PORT) {
                res->port_resource[i].flags = IORESOURCE_IO;  // Also clears _UNSET flag
+                if (io_decode == ACPI_DECODE_16)
+                        res->port_resource[i].flags |= PNP_PORT_FLAG_16BITADDR;
                if (len <= 0 || (io + len -1) >= 0x10003) {
                        res->port_resource[i].flags |= IORESOURCE_DISABLED;
                        return;
@@ -142,7 +190,7 @@ pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
 static void
 pnpacpi_parse_allocated_memresource(struct pnp_resource_table *res,
-        u64 mem, u64 len)
+        u64 mem, u64 len, int write_protect)
 {
        int i = 0;
        while (!(res->mem_resource[i].flags & IORESOURCE_UNSET) &&
@@ -154,6 +202,9 @@ pnpacpi_parse_allocated_memresource(struct pnp_resource_table *res,
                        res->mem_resource[i].flags |= IORESOURCE_DISABLED;
                        return;
                }
+                if(write_protect == ACPI_READ_WRITE_MEMORY)
+                        res->mem_resource[i].flags |= IORESOURCE_MEM_WRITEABLE;
                res->mem_resource[i].start = mem;
                res->mem_resource[i].end = mem + len - 1;
        }
@@ -178,10 +229,11 @@ pnpacpi_parse_allocated_address_space(struct pnp_resource_table *res_table,
        if (p->resource_type == ACPI_MEMORY_RANGE)
                pnpacpi_parse_allocated_memresource(res_table,
-                                p->minimum, p->address_length);
+                                p->minimum, p->address_length, p->info.mem.write_protect);
        else if (p->resource_type == ACPI_IO_RANGE)
                pnpacpi_parse_allocated_ioresource(res_table,
-                                p->minimum, p->address_length);
+                                p->minimum, p->address_length,
+                                p->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16);
 }
 static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
@@ -208,13 +260,17 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        case ACPI_RESOURCE_TYPE_DMA:
                if (res->data.dma.channel_count > 0)
                        pnpacpi_parse_allocated_dmaresource(res_table,
-                                        res->data.dma.channels[0]);
+                                        res->data.dma.channels[0],
+                                        res->data.dma.type,
+                                        res->data.dma.bus_master,
+                                        res->data.dma.transfer);
                break;
        case ACPI_RESOURCE_TYPE_IO:
                pnpacpi_parse_allocated_ioresource(res_table,
                                res->data.io.minimum,
-                                res->data.io.address_length);
+                                res->data.io.address_length,
+                                res->data.io.io_decode);
                break;
        case ACPI_RESOURCE_TYPE_START_DEPENDENT:
@@ -224,7 +280,8 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        case ACPI_RESOURCE_TYPE_FIXED_IO:
                pnpacpi_parse_allocated_ioresource(res_table,
                                res->data.fixed_io.address,
-                                res->data.fixed_io.address_length);
+                                res->data.fixed_io.address_length,
+                                ACPI_DECODE_10);
                break;
        case ACPI_RESOURCE_TYPE_VENDOR:
@@ -236,17 +293,20 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
        case ACPI_RESOURCE_TYPE_MEMORY24:
                pnpacpi_parse_allocated_memresource(res_table,
                                res->data.memory24.minimum,
-                                res->data.memory24.address_length);
+                                res->data.memory24.address_length,
+                                res->data.memory24.write_protect);
                break;
        case ACPI_RESOURCE_TYPE_MEMORY32:
                pnpacpi_parse_allocated_memresource(res_table,
                                res->data.memory32.minimum,
-                                res->data.memory32.address_length);
+                                res->data.memory32.address_length,
+                                res->data.memory32.write_protect);
                break;
        case ACPI_RESOURCE_TYPE_FIXED_MEMORY32:
                pnpacpi_parse_allocated_memresource(res_table,
                                res->data.fixed_memory32.address,
-                                res->data.fixed_memory32.address_length);
+                                res->data.fixed_memory32.address_length,
+                                res->data.fixed_memory32.write_protect);
                break;
        case ACPI_RESOURCE_TYPE_ADDRESS16:
        case ACPI_RESOURCE_TYPE_ADDRESS32:
@@ -304,42 +364,8 @@ static void pnpacpi_parse_dma_option(struct pnp_option *option, struct acpi_reso
        for(i = 0; i < p->channel_count; i++)
                dma->map |= 1 << p->channels[i];
-        dma->flags = 0;
-        if (p->bus_master)
+        dma->flags = dma_flags(p->type, p->bus_master, p->transfer);
-                dma->flags |= IORESOURCE_DMA_MASTER;
-        switch (p->type) {
-        case ACPI_COMPATIBILITY:
-                dma->flags |= IORESOURCE_DMA_COMPATIBLE;
-                break;
-        case ACPI_TYPE_A:
-                dma->flags |= IORESOURCE_DMA_TYPEA;
-                break;
-        case ACPI_TYPE_B:
-                dma->flags |= IORESOURCE_DMA_TYPEB;
-                break;
-        case ACPI_TYPE_F:
-                dma->flags |= IORESOURCE_DMA_TYPEF;
-                break;
-        default:
-                /* Set a default value ? */
-                dma->flags |= IORESOURCE_DMA_COMPATIBLE;
-                pnp_err("Invalid DMA type");
-        }
-        switch (p->transfer) {
-        case ACPI_TRANSFER_8:
-                dma->flags |= IORESOURCE_DMA_8BIT;
-                break;
-        case ACPI_TRANSFER_8_16:
-                dma->flags |= IORESOURCE_DMA_8AND16BIT;
-                break;
-        case ACPI_TRANSFER_16:
-                dma->flags |= IORESOURCE_DMA_16BIT;
-                break;
-        default:
-                /* Set a default value ? */
-                dma->flags |= IORESOURCE_DMA_8AND16BIT;
-                pnp_err("Invalid DMA transfer type");
-        }
        pnp_register_dma_resource(option, dma);
        return;
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 253ceb895ca7..a27e9e92cb5e 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -636,25 +636,6 @@ static irqreturn_t sn_sal_interrupt(int irq, void *dev_id)
 }
 /**
- * sn_sal_connect_interrupt - Request interrupt, handled by sn_sal_interrupt
- * @port: Our sn_cons_port (which contains the uart port)
- *
- * returns the console irq if interrupt is successfully registered, else 0
- *
- */
-static int sn_sal_connect_interrupt(struct sn_cons_port *port)
-{
-        if (request_irq(SGI_UART_VECTOR, sn_sal_interrupt,
-                        IRQF_DISABLED | IRQF_SHARED,
-                        "SAL console driver", port) >= 0) {
-                return SGI_UART_VECTOR;
-        }
-        printk(KERN_INFO "sn_console: console proceeding in polled mode\n");
-        return 0;
-}
-/**
 * sn_sal_timer_poll - this function handles polled console mode
 * @data: A pointer to our sn_cons_port (which contains the uart port)
 *
@@ -746,30 +727,31 @@ static void __init sn_sal_switch_to_asynch(struct sn_cons_port *port)
 * mode.  We were previously in asynch/polling mode (using init_timer).
 *
 * We attempt to switch to interrupt mode here by calling
- * sn_sal_connect_interrupt.  If that works out, we enable receive interrupts.
+ * request_irq.  If that works out, we enable receive interrupts.
 */
 static void __init sn_sal_switch_to_interrupts(struct sn_cons_port *port)
 {
-        int irq;
        unsigned long flags;
-        if (!port)
+        if (port) {
-                return;
+                DPRINTF("sn_console: switching to interrupt driven console\n");
-        DPRINTF("sn_console: switching to interrupt driven console\n");
-        spin_lock_irqsave(&port->sc_port.lock, flags);
-        irq = sn_sal_connect_interrupt(port);
+                if (request_irq(SGI_UART_VECTOR, sn_sal_interrupt,
+                                IRQF_DISABLED | IRQF_SHARED,
+                                "SAL console driver", port) >= 0) {
+                        spin_lock_irqsave(&port->sc_port.lock, flags);
+                        port->sc_port.irq = SGI_UART_VECTOR;
+                        port->sc_ops = &intr_ops;
-        if (irq) {
+                        /* turn on receive interrupts */
-                port->sc_port.irq = irq;
+                        ia64_sn_console_intr_enable(SAL_CONSOLE_INTR_RECV);
-                port->sc_ops = &intr_ops;
+                        spin_unlock_irqrestore(&port->sc_port.lock, flags);
+                }
-                /* turn on receive interrupts */
+                else {
-                ia64_sn_console_intr_enable(SAL_CONSOLE_INTR_RECV);
+                        printk(KERN_INFO
+                            "sn_console: console proceeding in polled mode\n");
+                }
        }
-        spin_unlock_irqrestore(&port->sc_port.lock, flags);
 }
 /*
diff --git a/fs/compat.c b/fs/compat.c
index 0ec70e3cee0a..040a8be38a48 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -48,6 +48,7 @@
 #include <linux/highmem.h>
 #include <linux/poll.h>
 #include <linux/mm.h>
+#include <linux/eventpoll.h>
 #include <net/sock.h>           /* siocdevprivate_ioctl */
@@ -2235,3 +2236,102 @@ long asmlinkage compat_sys_nfsservctl(int cmd, void *notused, void *notused2)
        return sys_ni_syscall();
 }
 #endif
+#ifdef CONFIG_EPOLL
+#ifdef CONFIG_HAS_COMPAT_EPOLL_EVENT
+asmlinkage long compat_sys_epoll_ctl(int epfd, int op, int fd,
+                        struct compat_epoll_event __user *event)
+{
+        long err = 0;
+        struct compat_epoll_event user;
+        struct epoll_event __user *kernel = NULL;
+        if (event) {
+                if (copy_from_user(&user, event, sizeof(user)))
+                        return -EFAULT;
+                kernel = compat_alloc_user_space(sizeof(struct epoll_event));
+                err |= __put_user(user.events, &kernel->events);
+                err |= __put_user(user.data, &kernel->data);
+        }
+        return err ? err : sys_epoll_ctl(epfd, op, fd, kernel);
+}
+asmlinkage long compat_sys_epoll_wait(int epfd,
+                        struct compat_epoll_event __user *events,
+                        int maxevents, int timeout)
+{
+        long i, ret, err = 0;
+        struct epoll_event __user *kbuf;
+        struct epoll_event ev;
+        if ((maxevents <= 0) ||
+                        (maxevents > (INT_MAX / sizeof(struct epoll_event))))
+                return -EINVAL;
+        kbuf = compat_alloc_user_space(sizeof(struct epoll_event) * maxevents);
+        ret = sys_epoll_wait(epfd, kbuf, maxevents, timeout);
+        for (i = 0; i < ret; i++) {
+                err |= __get_user(ev.events, &kbuf[i].events);
+                err |= __get_user(ev.data, &kbuf[i].data);
+                err |= __put_user(ev.events, &events->events);
+                err |= __put_user_unaligned(ev.data, &events->data);
+                events++;
+        }
+        return err ? -EFAULT: ret;
+}
+#endif  /* CONFIG_HAS_COMPAT_EPOLL_EVENT */
+#ifdef TIF_RESTORE_SIGMASK
+asmlinkage long compat_sys_epoll_pwait(int epfd,
+                        struct compat_epoll_event __user *events,
+                        int maxevents, int timeout,
+                        const compat_sigset_t __user *sigmask,
+                        compat_size_t sigsetsize)
+{
+        long err;
+        compat_sigset_t csigmask;
+        sigset_t ksigmask, sigsaved;
+        /*
+         * If the caller wants a certain signal mask to be set during the wait,
+         * we apply it here.
+         */
+        if (sigmask) {
+                if (sigsetsize != sizeof(compat_sigset_t))
+                        return -EINVAL;
+                if (copy_from_user(&csigmask, sigmask, sizeof(csigmask)))
+                        return -EFAULT;
+                sigset_from_compat(&ksigmask, &csigmask);
+                sigdelsetmask(&ksigmask, sigmask(SIGKILL) | sigmask(SIGSTOP));
+                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
+        }
+#ifdef CONFIG_HAS_COMPAT_EPOLL_EVENT
+        err = compat_sys_epoll_wait(epfd, events, maxevents, timeout);
+#else
+        err = sys_epoll_wait(epfd, events, maxevents, timeout);
+#endif
+        /*
+         * If we changed the signal mask, we need to restore the original one.
+         * In case we've got a signal while waiting, we do not restore the
+         * signal mask yet, and we allow do_signal() to deliver the signal on
+         * the way back to userspace, before the signal mask is restored.
+         */
+        if (sigmask) {
+                if (err == -EINTR) {
+                        memcpy(&current->saved_sigmask, &sigsaved,
+                               sizeof(sigsaved));
+                        set_thread_flag(TIF_RESTORE_SIGMASK);
+                } else
+                        sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+        }
+        return err;
+}
+#endif /* TIF_RESTORE_SIGMASK */
+#endif /* CONFIG_EPOLL */
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 40db61dc95f2..3870150b83a4 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -22,6 +22,7 @@
 #include "lockspace.h"
 #include "lock.h"
 #include "lvb_table.h"
+#include "user.h"
 static const char *name_prefix="dlm";
 static struct miscdevice ctl_device;
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index e62f3fc7241e..1548be26b5e6 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -38,7 +38,7 @@ static struct dentry *lock_parent(struct dentry *dentry)
        struct dentry *dir;
        dir = dget(dentry->d_parent);
-        mutex_lock(&(dir->d_inode->i_mutex));
+        mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
        return dir;
 }
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 6618c1190252..12accb08fe02 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -20,6 +20,7 @@
 #include <linux/list.h>
 #include <linux/lm_interface.h>
 #include <linux/wait.h>
+#include <linux/module.h>
 #include <linux/rwsem.h>
 #include <asm/uaccess.h>
@@ -953,9 +954,6 @@ static void drop_bh(struct gfs2_glock *gl, unsigned int ret)
                spin_unlock(&gl->gl_spin);
        }
-        if (glops->go_drop_bh)
-                glops->go_drop_bh(gl);
        spin_lock(&gl->gl_spin);
        gl->gl_req_gh = NULL;
        gl->gl_req_bh = NULL;
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 46af55355513..39c8ae23bd9c 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -245,7 +245,6 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
        if (ip && S_ISREG(ip->i_inode.i_mode)) {
                truncate_inode_pages(ip->i_inode.i_mapping, 0);
-                gfs2_assert_withdraw(GFS2_SB(&ip->i_inode), !ip->i_inode.i_mapping->nrpages);
                clear_bit(GIF_PAGED, &ip->i_flags);
        }
 }
@@ -459,6 +458,8 @@ const struct gfs2_glock_operations gfs2_inode_glops = {
 };
 const struct gfs2_glock_operations gfs2_rgrp_glops = {
+        .go_xmote_th = meta_go_sync,
+        .go_drop_th = meta_go_sync,
        .go_inval = meta_go_inval,
        .go_demote_ok = rgrp_go_demote_ok,
        .go_lock = rgrp_go_lock,
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 12c80fd28db5..49f0dbf40d86 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -104,7 +104,6 @@ struct gfs2_glock_operations {
        void (*go_xmote_th) (struct gfs2_glock *gl);
        void (*go_xmote_bh) (struct gfs2_glock *gl);
        void (*go_drop_th) (struct gfs2_glock *gl);
-        void (*go_drop_bh) (struct gfs2_glock *gl);
        void (*go_inval) (struct gfs2_glock *gl, int flags);
        int (*go_demote_ok) (struct gfs2_glock *gl);
        int (*go_lock) (struct gfs2_holder *gh);
@@ -416,7 +415,6 @@ struct gfs2_tune {
        unsigned int gt_stall_secs; /* Detects trouble! */
        unsigned int gt_complain_secs;
        unsigned int gt_reclaim_limit; /* Max num of glocks in reclaim list */
-        unsigned int gt_entries_per_readdir;
        unsigned int gt_statfs_quantum;
        unsigned int gt_statfs_slow;
 };
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 0d6831a40565..df0b8b3018b9 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -43,7 +43,8 @@ static int iget_test(struct inode *inode, void *opaque)
        struct gfs2_inode *ip = GFS2_I(inode);
        struct gfs2_inum_host *inum = opaque;
-        if (ip->i_num.no_addr == inum->no_addr)
+        if (ip->i_num.no_addr == inum->no_addr &&
+            inode->i_private != NULL)
                return 1;
        return 0;
@@ -61,13 +62,13 @@ static int iget_set(struct inode *inode, void *opaque)
 struct inode *gfs2_ilookup(struct super_block *sb, struct gfs2_inum_host *inum)
 {
-        return ilookup5(sb, (unsigned long)inum->no_formal_ino,
+        return ilookup5(sb, (unsigned long)inum->no_addr,
                        iget_test, inum);
 }
 static struct inode *gfs2_iget(struct super_block *sb, struct gfs2_inum_host *inum)
 {
-        return iget5_locked(sb, (unsigned long)inum->no_formal_ino,
+        return iget5_locked(sb, (unsigned long)inum->no_addr,
                     iget_test, iget_set, inum);
 }
diff --git a/fs/gfs2/ops_address.c b/fs/gfs2/ops_address.c
index 56e33590b656..b3b7e8475359 100644
--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -266,9 +266,11 @@ skip_lock:
 out:
        return error;
 out_unlock:
-        if (error == GLR_TRYFAILED)
-                error = AOP_TRUNCATED_PAGE;
        unlock_page(page);
+        if (error == GLR_TRYFAILED) {
+                error = AOP_TRUNCATED_PAGE;
+                yield();
+        }
        if (do_unlock)
                gfs2_holder_uninit(&gh);
        goto out;
@@ -364,6 +366,7 @@ static int gfs2_prepare_write(struct file *file, struct page *page,
                if (error == GLR_TRYFAILED) {
                        unlock_page(page);
                        error = AOP_TRUNCATED_PAGE;
+                        yield();
                }
                goto out_uninit;
        }
diff --git a/fs/gfs2/ops_export.c b/fs/gfs2/ops_export.c
index 1de05b63d43a..aad918337a46 100644
--- a/fs/gfs2/ops_export.c
+++ b/fs/gfs2/ops_export.c
@@ -38,14 +38,11 @@ static struct dentry *gfs2_decode_fh(struct super_block *sb,
        struct gfs2_fh_obj fh_obj;
        struct gfs2_inum_host *this, parent;
-        if (fh_type != fh_len)
-                return NULL;
        this            = &fh_obj.this;
        fh_obj.imode    = DT_UNKNOWN;
        memset(&parent, 0, sizeof(struct gfs2_inum));
-        switch (fh_type) {
+        switch (fh_len) {
        case GFS2_LARGE_FH_SIZE:
                parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32;
                parent.no_formal_ino |= be32_to_cpu(fh[5]);
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index ee80b8a5e7bc..ee54cb667083 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -840,7 +840,7 @@ static struct super_block* get_gfs2_sb(const char *dev_name)
        }
        printk(KERN_WARNING "GFS2: Unrecognized block device or "
-               "mount point %s", dev_name);
+               "mount point %s\n", dev_name);
 free_nd:
        path_release(&nd);
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index d0db881b55d2..c186857e48a8 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -279,7 +279,7 @@ static int bh_get(struct gfs2_quota_data *qd)
                (bh->b_data + sizeof(struct gfs2_meta_header) +
                 offset * sizeof(struct gfs2_quota_change));
-        mutex_lock(&sdp->sd_quota_mutex);
+        mutex_unlock(&sdp->sd_quota_mutex);
        return 0;
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 70f424fcf1cd..4fdda974dc83 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -76,7 +76,6 @@ void gfs2_tune_init(struct gfs2_tune *gt)
        gt->gt_stall_secs = 600;
        gt->gt_complain_secs = 10;
        gt->gt_reclaim_limit = 5000;
-        gt->gt_entries_per_readdir = 32;
        gt->gt_statfs_quantum = 30;
        gt->gt_statfs_slow = 0;
 }
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index e965eb11d76f..9baf69773ed1 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -47,7 +47,7 @@ struct dentry_operations hostfs_dentry_ops = {
 };
 /* Changed in hostfs_args before the kernel starts running */
-static char *root_ino = "/";
+static char *root_ino = "";
 static int append = 0;
 #define HOSTFS_SUPER_MAGIC 0x00c0ffee
@@ -947,15 +947,17 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
        sb->s_magic = HOSTFS_SUPER_MAGIC;
        sb->s_op = &hostfs_sbops;
-        if((data == NULL) || (*data == '\0'))
+        /* NULL is printed as <NULL> by sprintf: avoid that. */
-                data = root_ino;
+        if (data == NULL)
+                data = "";
        err = -ENOMEM;
-        name = kmalloc(strlen(data) + 1, GFP_KERNEL);
+        name = kmalloc(strlen(root_ino) + 1
+                        + strlen(data) + 1, GFP_KERNEL);
        if(name == NULL)
                goto out;
-        strcpy(name, data);
+        sprintf(name, "%s/%s", root_ino, data);
        root_inode = iget(sb, 0);
        if(root_inode == NULL)
@@ -966,6 +968,9 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
                goto out_put;
        HOSTFS_I(root_inode)->host_filename = name;
+        /* Avoid that in the error path, iput(root_inode) frees again name through
+         * hostfs_destroy_inode! */
+        name = NULL;
        err = -ENOMEM;
        sb->s_root = d_alloc_root(root_inode);
@@ -977,7 +982,7 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
                /* No iput in this case because the dput does that for us */
                dput(sb->s_root);
                sb->s_root = NULL;
-                goto out_free;
+                goto out;
        }
        return(0);
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index 6eb3daebd563..888f236e5494 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -99,7 +99,13 @@ static int jffs2_garbage_collect_thread(void *_c)
                if (try_to_freeze())
                        continue;
-                cond_resched();
+                /* This thread is purely an optimisation. But if it runs when
+                   other things could be running, it actually makes things a
+                   lot worse. Use yield() and put it at the back of the runqueue
+                   every time. Especially during boot, pulling an inode in
+                   with read_inode() is much preferable to having the GC thread
+                   get there first. */
+                yield();
                /* Put_super will send a SIGKILL and then wait on the sem.
                 */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 58a0b912e9d0..717a48cf7df2 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -373,7 +373,14 @@ free_out:
 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 {
        /* We don't mark unknown nodes as REF_UNCHECKED */
-        BUG_ON(ref_flags(ref) == REF_UNCHECKED);
+        if (ref_flags(ref) == REF_UNCHECKED) {
+                JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
+                            ref_offset(ref));
+                JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
+                            je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
+                            je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
+                return 1;
+        }
        un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
@@ -576,6 +583,13 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                        jffs2_mark_node_obsolete(c, ref);
                        goto cont;
                }
+                /* Due to poor choice of crc32 seed, an all-zero node will have a correct CRC */
+                if (!je32_to_cpu(node->u.hdr_crc) && !je16_to_cpu(node->u.nodetype) &&
+                    !je16_to_cpu(node->u.magic) && !je32_to_cpu(node->u.totlen)) {
+                        JFFS2_NOTICE("All zero node header at %#08x.\n", ref_offset(ref));
+                        jffs2_mark_node_obsolete(c, ref);
+                        goto cont;
+                }
                switch (je16_to_cpu(node->u.nodetype)) {
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
index 31c1475d922a..7fb45bd4915c 100644
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -734,6 +734,15 @@ scan_more:
                        ofs += 4;
                        continue;
                }
+                /* Due to poor choice of crc32 seed, an all-zero node will have a correct CRC */
+                if (!je32_to_cpu(node->hdr_crc) && !je16_to_cpu(node->nodetype) &&
+                    !je16_to_cpu(node->magic) && !je32_to_cpu(node->totlen)) {
+                        noisy_printk(&noise, "jffs2_scan_eraseblock(): All zero node header at 0x%08x.\n", ofs);
+                        if ((err = jffs2_scan_dirty_space(c, jeb, 4)))
+                                return err;
+                        ofs += 4;
+                        continue;
+                }
                if (ofs + je32_to_cpu(node->totlen) >
                    jeb->offset + c->sector_size) {
diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
index de718e3a1692..4fac6dd53954 100644
--- a/fs/jffs2/wbuf.c
+++ b/fs/jffs2/wbuf.c
@@ -238,7 +238,10 @@ static void jffs2_wbuf_recover(struct jffs2_sb_info *c)
        jeb = &c->blocks[c->wbuf_ofs / c->sector_size];
        spin_lock(&c->erase_completion_lock);
-        jffs2_block_refile(c, jeb, REFILE_NOTEMPTY);
+        if (c->wbuf_ofs % c->mtd->erasesize)
+                jffs2_block_refile(c, jeb, REFILE_NOTEMPTY);
+        else
+                jffs2_block_refile(c, jeb, REFILE_ANYWAY);
        spin_unlock(&c->erase_completion_lock);
        BUG_ON(!ref_obsolete(jeb->last_node));
@@ -1087,7 +1090,7 @@ int jffs2_write_nand_badblock(struct jffs2_sb_info *c, struct jffs2_eraseblock *
        if (!c->mtd->block_markbad)
                return 1; // What else can we do?
-        D1(printk(KERN_WARNING "jffs2_write_nand_badblock(): Marking bad block at %08x\n", bad_offset));
+        printk(KERN_WARNING "JFFS2: marking eraseblock at %08x\n as bad", bad_offset);
        ret = c->mtd->block_markbad(c->mtd, bad_offset);
        if (ret) {
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 22d38ffc9ef0..e46d237b10f9 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -180,7 +180,7 @@ check_partition(struct gendisk *hd, struct block_device *bdev)
        }
        if (res > 0)
                return state;
-        if (!err)
+        if (err)
        /* The partition is unrecognized. So report I/O errors if there were any */
                res = err;
        if (!res)
diff --git a/include/asm-avr32/Kbuild b/include/asm-avr32/Kbuild
index 8770e73ce938..3136628ba8d2 100644
--- a/include/asm-avr32/Kbuild
+++ b/include/asm-avr32/Kbuild
@@ -1,3 +1,3 @@
 include include/asm-generic/Kbuild.asm
-headers-y       += cachectl.h
+header-y        += cachectl.h
diff --git a/include/asm-avr32/dma-mapping.h b/include/asm-avr32/dma-mapping.h
index 115813e48fe0..21bb60bbb9a1 100644
--- a/include/asm-avr32/dma-mapping.h
+++ b/include/asm-avr32/dma-mapping.h
@@ -274,6 +274,24 @@ dma_sync_single_for_device(struct device *dev, dma_addr_t dma_handle,
        dma_cache_sync(dev, bus_to_virt(dma_handle), size, direction);
 }
+static inline void
+dma_sync_single_range_for_cpu(struct device *dev, dma_addr_t dma_handle,
+                              unsigned long offset, size_t size,
+                              enum dma_data_direction direction)
+{
+        /* just sync everything, that's all the pci API can do */
+        dma_sync_single_for_cpu(dev, dma_handle, offset+size, direction);
+}
+static inline void
+dma_sync_single_range_for_device(struct device *dev, dma_addr_t dma_handle,
+                                 unsigned long offset, size_t size,
+                                 enum dma_data_direction direction)
+{
+        /* just sync everything, that's all the pci API can do */
+        dma_sync_single_for_device(dev, dma_handle, offset+size, direction);
+}
 /**
 * dma_sync_sg_for_cpu
 * @dev: valid struct device pointer, or NULL for ISA and EISA-like devices
diff --git a/include/asm-mips/dma.h b/include/asm-mips/dma.h
index e06ef0776d48..833437d31ef1 100644
--- a/include/asm-mips/dma.h
+++ b/include/asm-mips/dma.h
@@ -74,7 +74,7 @@
 *
 */
-#ifndef GENERIC_ISA_DMA_SUPPORT_BROKEN
+#ifndef CONFIG_GENERIC_ISA_DMA_SUPPORT_BROKEN
 #define MAX_DMA_CHANNELS        8
 #endif
diff --git a/include/asm-mips/sibyte/trace_prof.h b/include/asm-mips/sibyte/trace_prof.h
deleted file mode 100644
index 557792075e9a..000000000000
--- a/include/asm-mips/sibyte/trace_prof.h
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (C) 2001 Broadcom Corporation
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- */
-#ifndef __ASM_SIBYTE_TRACE_PROF_H
-#define __ASM_SIBYTE_TRACE_PROF_H
-#undef DBG
-#if SBPROF_TB_DEBUG
-#define DBG(a) a
-#else
-#define DBG(a)
-#endif
-#define SBPROF_TB_MAJOR 240
-#define DEVNAME "bcm1250_tbprof"
-typedef u_int64_t tb_sample_t[6*256];
-struct sbprof_tb {
-        int          open;
-        tb_sample_t *sbprof_tbbuf;
-        int          next_tb_sample;
-        volatile int tb_enable;
-        volatile int tb_armed;
-        wait_queue_head_t tb_sync;
-        wait_queue_head_t tb_read;
-};
-#define MAX_SAMPLE_BYTES (24*1024*1024)
-#define MAX_TBSAMPLE_BYTES (12*1024*1024)
-#define MAX_SAMPLES (MAX_SAMPLE_BYTES/sizeof(u_int32_t))
-#define TB_SAMPLE_SIZE (sizeof(tb_sample_t))
-#define MAX_TB_SAMPLES (MAX_TBSAMPLE_BYTES/TB_SAMPLE_SIZE)
-/* IOCTLs */
-#define SBPROF_ZBSTART          _IOW('s', 0, int)
-#define SBPROF_ZBSTOP           _IOW('s', 1, int)
-#define SBPROF_ZBWAITFULL       _IOW('s', 2, int)
-/***************************************************************************
- * Routines for gathering ZBbus profiles using trace buffer
- ***************************************************************************/
-/* Requires: Already called zclk_timer_init with a value that won't
-             saturate 40 bits.  No subsequent use of SCD performance counters
-             or trace buffer.
-   Effect:   Starts gathering random ZBbus profiles using trace buffer. */
-extern int sbprof_zbprof_start(struct file *filp);
-/* Effect: Stops collection of ZBbus profiles */
-extern int sbprof_zbprof_stop(void);
-/***************************************************************************
- * Routines for using 40-bit SCD cycle counter
- *
- * Client responsible for either handling interrupts or making sure
- * the cycles counter never saturates, e.g., by doing
- * zclk_timer_init(0) at least every 2^40 - 1 ZCLKs.
- ***************************************************************************/
-/* Configures SCD counter 0 to count ZCLKs starting from val;
-   Configures SCD counters1,2,3 to count nothing.
-   Must not be called while gathering ZBbus profiles.
-unsigned long long val; */
-#define zclk_timer_init(val) \
-  __asm__ __volatile__ (".set push;" \
-                        ".set mips64;" \
-                        "la   $8, 0xb00204c0;" /* SCD perf_cnt_cfg */ \
-                        "sd   %0, 0x10($8);"   /* write val to counter0 */ \
-                        "sd   %1, 0($8);"      /* config counter0 for zclks*/ \
-                        ".set pop" \
-                        : /* no outputs */ \
-                                                     /* enable, counter0 */ \
-                        : /* inputs */ "r"(val), "r" ((1ULL << 33) | 1ULL) \
-                        : /* modifies */ "$8" )
-/* Reads SCD counter 0 and puts result in value
-   unsigned long long val; */
-#define zclk_get(val) \
-  __asm__ __volatile__ (".set push;" \
-                        ".set mips64;" \
-                        "la   $8, 0xb00204c0;" /* SCD perf_cnt_cfg */ \
-                        "ld   %0, 0x10($8);"   /* write val to counter0 */ \
-                        ".set pop" \
-                        : /* outputs */ "=r"(val) \
-                        : /* inputs */ \
-                        : /* modifies */ "$8" )
-#endif /* __ASM_SIBYTE_TRACE_PROF_H */
diff --git a/include/asm-sh/cache.h b/include/asm-sh/cache.h
index e3a180cf5062..9a3cb6ba9d15 100644
--- a/include/asm-sh/cache.h
+++ b/include/asm-sh/cache.h
@@ -21,6 +21,7 @@
 #define L1_CACHE_ALIGN(x)       (((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1))
+#ifndef __ASSEMBLY__
 struct cache_info {
        unsigned int ways;              /* Number of cache ways */
        unsigned int sets;              /* Number of cache sets */
@@ -47,6 +48,6 @@ struct cache_info {
        unsigned long flags;
 };
+#endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* __ASM_SH_CACHE_H */
diff --git a/include/asm-sh/cacheflush.h b/include/asm-sh/cacheflush.h
index 22f12634975b..07f62ec9ff0c 100644
--- a/include/asm-sh/cacheflush.h
+++ b/include/asm-sh/cacheflush.h
@@ -30,8 +30,5 @@ extern void __flush_invalidate_region(void *start, int size);
 #define HAVE_ARCH_UNMAPPED_AREA
-/* Page flag for lazy dcache write-back for the aliasing UP caches */
-#define PG_dcache_dirty PG_arch_1
 #endif /* __KERNEL__ */
 #endif /* __ASM_SH_CACHEFLUSH_H */
diff --git a/include/asm-sh/cpu-sh3/cacheflush.h b/include/asm-sh/cpu-sh3/cacheflush.h
index 6fabbba228de..f70d8ef76a15 100644
--- a/include/asm-sh/cpu-sh3/cacheflush.h
+++ b/include/asm-sh/cpu-sh3/cacheflush.h
@@ -36,6 +36,8 @@
 /* 32KB cache, 4kb PAGE sizes need to check bit 12 */
 #define CACHE_ALIAS 0x00001000
+#define PG_mapped       PG_arch_1
 void flush_cache_all(void);
 void flush_cache_mm(struct mm_struct *mm);
 #define flush_cache_dup_mm(mm) flush_cache_mm(mm)
diff --git a/include/asm-sh/cpu-sh4/cacheflush.h b/include/asm-sh/cpu-sh4/cacheflush.h
index b3746a936a09..5fd5c89ef86a 100644
--- a/include/asm-sh/cpu-sh4/cacheflush.h
+++ b/include/asm-sh/cpu-sh4/cacheflush.h
@@ -39,4 +39,6 @@ void flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
 /* Initialization of P3 area for copy_user_page */
 void p3_cache_init(void);
+#define PG_mapped       PG_arch_1
 #endif /* __ASM_CPU_SH4_CACHEFLUSH_H */
diff --git a/include/asm-sh/pgtable.h b/include/asm-sh/pgtable.h
index 9214c015fe14..184d7fcaaf10 100644
--- a/include/asm-sh/pgtable.h
+++ b/include/asm-sh/pgtable.h
@@ -583,6 +583,11 @@ struct mm_struct;
 extern unsigned int kobjsize(const void *objp);
 #endif /* !CONFIG_MMU */
+#if defined(CONFIG_CPU_SH4) || defined(CONFIG_SH7705_CACHE_32KB)
+#define __HAVE_ARCH_PTEP_GET_AND_CLEAR
+extern pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
+#endif
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 extern void paging_init(void);
diff --git a/include/asm-sh/thread_info.h b/include/asm-sh/thread_info.h
index 279e70a77c75..31d55e3782d5 100644
--- a/include/asm-sh/thread_info.h
+++ b/include/asm-sh/thread_info.h
@@ -111,6 +111,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_RESTORE_SIGMASK     4       /* restore signal mask in do_signal() */
+#define TIF_SINGLESTEP          5       /* singlestepping active */
 #define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
@@ -121,6 +122,7 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_SIGPENDING         (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
+#define _TIF_SINGLESTEP         (1<<TIF_SINGLESTEP)
 #define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_FREEZE             (1<<TIF_FREEZE)
diff --git a/include/asm-sparc64/parport.h b/include/asm-sparc64/parport.h
index be9509c8f8c1..284dfd01a33d 100644
--- a/include/asm-sparc64/parport.h
+++ b/include/asm-sparc64/parport.h
@@ -19,6 +19,17 @@
 */
 #define HAS_DMA
+static DEFINE_SPINLOCK(dma_spin_lock);
+#define claim_dma_lock() \
+({      unsigned long flags; \
+        spin_lock_irqsave(&dma_spin_lock, flags); \
+        flags; \
+})
+#define release_dma_lock(__flags) \
+        spin_unlock_irqrestore(&dma_spin_lock, __flags);
 static struct sparc_ebus_info {
        struct ebus_dma_info info;
        unsigned int addr;
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 80b17f440ec1..ccd863dd77fa 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -234,5 +234,24 @@ asmlinkage long compat_sys_migrate_pages(compat_pid_t pid,
                compat_ulong_t maxnode, const compat_ulong_t __user *old_nodes,
                const compat_ulong_t __user *new_nodes);
+/*
+ * epoll (fs/eventpoll.c) compat bits follow ...
+ */
+#ifndef CONFIG_HAS_COMPAT_EPOLL_EVENT
+struct epoll_event;
+#define compat_epoll_event      epoll_event
+#else
+asmlinkage long compat_sys_epoll_ctl(int epfd, int op, int fd,
+                        struct compat_epoll_event __user *event);
+asmlinkage long compat_sys_epoll_wait(int epfd,
+                        struct compat_epoll_event __user *events,
+                        int maxevents, int timeout);
+#endif
+asmlinkage long compat_sys_epoll_pwait(int epfd,
+                        struct compat_epoll_event __user *events,
+                        int maxevents, int timeout,
+                        const compat_sigset_t __user *sigmask,
+                        compat_size_t sigsetsize);
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index 6a8570be331b..3d956c3abb31 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -121,6 +121,7 @@ struct mtd_info {
        u_int32_t writesize;
        u_int32_t oobsize;   // Amount of OOB data per block (e.g. 16)
+        u_int32_t oobavail;  // Available OOB bytes per block
        // Kernel-only stuff starts here.
        char *name;
diff --git a/include/linux/mtd/onenand.h b/include/linux/mtd/onenand.h
index d8af8a95e58d..a56d24ada505 100644
--- a/include/linux/mtd/onenand.h
+++ b/include/linux/mtd/onenand.h
@@ -82,7 +82,8 @@ struct onenand_bufferram {
 * @wq:                 [INTERN] wait queue to sleep on if a OneNAND
 *                      operation is in progress
 * @state:              [INTERN] the current state of the OneNAND device
- * @page_buf:           data buffer
+ * @page_buf:           [INTERN] page main data buffer
+ * @oob_buf:            [INTERN] page oob data buffer
 * @subpagesize:        [INTERN] holds the subpagesize
 * @ecclayout:          [REPLACEABLE] the default ecc placement scheme
 * @bbm:                [REPLACEABLE] pointer to Bad Block Management
@@ -122,6 +123,7 @@ struct onenand_chip {
        wait_queue_head_t       wq;
        onenand_state_t         state;
        unsigned char           *page_buf;
+        unsigned char           *oob_buf;
        int                     subpagesize;
        struct nand_ecclayout   *ecclayout;
@@ -156,6 +158,7 @@ struct onenand_chip {
 #define ONENAND_HAS_CONT_LOCK           (0x0001)
 #define ONENAND_HAS_UNLOCK_ALL          (0x0002)
 #define ONENAND_PAGEBUF_ALLOC           (0x1000)
+#define ONENAND_OOBBUF_ALLOC            (0x2000)
 /*
 * OneNAND Flash Manufacturer ID Codes
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 92a1fc46ea59..5a00aa85b756 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -988,8 +988,9 @@ extern int xfrm_policy_walk(u8 type, int (*func)(struct xfrm_policy *, int, int,
 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                                          struct xfrm_selector *sel,
-                                          struct xfrm_sec_ctx *ctx, int delete);
+                                          struct xfrm_sec_ctx *ctx, int delete,
-struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete);
+                                          int *err);
+struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err);
 void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
 u32 xfrm_get_acqseq(void);
 void xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 34b2301276ce..1b255df4fcd0 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -846,7 +846,8 @@ static ctl_table vm_table[] = {
                .extra2         = &one_hundred,
        },
 #endif
-#ifdef CONFIG_X86_32
+#if defined(CONFIG_X86_32) || \
+   (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL))
        {
                .ctl_name       = VM_VDSO_ENABLED,
                .procname       = "vdso_enabled",
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index f928d2b2a17d..71f5cfbbebb8 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -656,7 +656,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                /* Detach sockets from device */
                read_lock(&hci_sk_list.lock);
                sk_for_each(sk, node, &hci_sk_list.head) {
-                        bh_lock_sock(sk);
+                        lock_sock(sk);
                        if (hci_pi(sk)->hdev == hdev) {
                                hci_pi(sk)->hdev = NULL;
                                sk->sk_err = EPIPE;
@@ -665,7 +665,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                                hci_dev_put(hdev);
                        }
-                        bh_unlock_sock(sk);
+                        release_sock(sk);
                }
                read_unlock(&hci_sk_list.lock);
        }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 6845a258408f..f3a2e29be40c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -428,6 +428,10 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        spin_lock_bh(&br->lock);
        br_stp_recalculate_bridge_id(br);
        br_features_recompute(br);
+        if ((dev->flags & IFF_UP) && netif_carrier_ok(dev) &&
+            (br->dev->flags & IFF_UP))
+                br_stp_enable_port(p);
        spin_unlock_bh(&br->lock);
        dev_set_mtu(br->dev, br_min_mtu(br));
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 5361a4d8e13b..746f79d104b3 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -545,12 +545,7 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                /* set idle flag */
                hctx->ccid3hctx_idle = 1;
                break;
-        case TFRC_SSTATE_NO_SENT:
+        case TFRC_SSTATE_NO_SENT:       /* fall through */
-                /*
-                 * XXX when implementing bidirectional rx/tx check this again
-                 */
-                DCCP_WARN("Illegal ACK received - no packet sent\n");
-                /* fall through */
        case TFRC_SSTATE_TERM:          /* ignore feedback when closing */
                break;
        }
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 287099f7f042..78b043c458bf 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -248,18 +248,8 @@ int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
                            DCCP_ACKVEC_STATE_RECEIVED))
                goto discard;
-        /*
+        ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
-         * Deliver to the CCID module in charge.
+        ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-         * FIXME: Currently DCCP operates one-directional only, i.e. a listening
-         *        server is not at the same time a connecting client. There is
-         *        not much sense in delivering to both rx/tx sides at the moment
-         *        (only one is active at a time); when moving to bidirectional
-         *        service, this needs to be revised.
-         */
-        if (dccp_sk(sk)->dccps_role == DCCP_ROLE_CLIENT)
-                ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-        else    /* listening or connected server */
-                ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
        return __dccp_rcv_established(sk, skb, dh, len);
 discard:
@@ -494,11 +484,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                    DCCP_ACKVEC_STATE_RECEIVED))
                        goto discard;
-                /* XXX see the comments in dccp_rcv_established about this */
+                ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
-                if (dccp_sk(sk)->dccps_role == DCCP_ROLE_CLIENT)
+                ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-                        ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-                else
-                        ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
        }
        /*
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ce6c46034314..fc620a7c1db4 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1215,6 +1215,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
                if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
                        goto short_packet;
+                uh = skb->h.uh;
                udp4_csum_init(skb, uh);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e16f1bba5dff..a7fee6b27320 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -342,10 +342,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
        }
 #endif
-        if (netif_carrier_ok(dev))
-                ndev->if_flags |= IF_READY;
        ipv6_mc_init_dev(ndev);
        ndev->tstamp = jiffies;
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 286c86735aed..4e0561a082d0 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -795,11 +795,15 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_ipv6_setsockopt);
 #endif
-static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
                                  char __user *optval, int len)
 {
-        if (!hdr)
+        struct ipv6_opt_hdr *hdr;
+        if (!opt || !opt->hopopt)
                return 0;
+        hdr = opt->hopopt;
        len = min_t(int, len, ipv6_optlen(hdr));
        if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
                return -EFAULT;
@@ -940,7 +944,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
        {
                lock_sock(sk);
-                len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
+                len = ipv6_getsockopt_sticky(sk, np->opt,
                                             optval, len);
                release_sock(sk);
                return put_user(len, optlen);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 6f19c4a49560..d1102455668d 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -257,6 +257,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                }
                nf_conntrack_get(reasm->nfct);
                (*pskb)->nfct = reasm->nfct;
+                (*pskb)->nfctinfo = reasm->nfctinfo;
                return NF_ACCEPT;
        }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1c58204d767e..a4e7e2db0ff3 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1467,9 +1467,6 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        err = xfrm_state_delete(x);
-        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        if (err < 0)
                goto out;
@@ -1478,6 +1475,8 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        c.event = XFRM_MSG_DELSA;
        km_state_notify(x, &c);
 out:
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        xfrm_state_put(x);
        return err;
@@ -2294,14 +2293,12 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
        }
        xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
-                                   &sel, tmp.security, 1);
+                                   &sel, tmp.security, 1, &err);
        security_xfrm_policy_free(&tmp);
        if (xp == NULL)
                return -ENOENT;
-        err = security_xfrm_policy_delete(xp);
        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
                       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
@@ -2539,7 +2536,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
        unsigned int dir;
-        int err;
+        int err = 0, delete;
        struct sadb_x_policy *pol;
        struct xfrm_policy *xp;
        struct km_event c;
@@ -2551,16 +2548,20 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        if (dir >= XFRM_POLICY_MAX)
                return -EINVAL;
+        delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
        xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id,
-                              hdr->sadb_msg_type == SADB_X_SPDDELETE2);
+                              delete, &err);
        if (xp == NULL)
                return -ENOENT;
-        err = 0;
+        if (delete) {
+                xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                               AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
-        c.seq = hdr->sadb_msg_seq;
+                if (err)
-        c.pid = hdr->sadb_msg_pid;
+                        goto out;
-        if (hdr->sadb_msg_type == SADB_X_SPDDELETE2) {
+                c.seq = hdr->sadb_msg_seq;
+                c.pid = hdr->sadb_msg_pid;
                c.data.byid = 1;
                c.event = XFRM_MSG_DELPOLICY;
                km_policy_notify(xp, dir, &c);
@@ -2568,6 +2569,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
                err = key_pol_get_resp(sk, xp, hdr, dir);
        }
+out:
        xfrm_pol_put(xp);
        return err;
 }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 91a0972ec117..5cb30ebba0f4 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -486,7 +486,7 @@ __build_packet_message(struct nfulnl_instance *inst,
                         * for physical device (when called from ipv4) */
                        NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
                                sizeof(tmp_uint), &tmp_uint);
-                        if (skb->nf_bridge) {
+                        if (skb->nf_bridge && skb->nf_bridge->physoutdev) {
                                tmp_uint =
                                    htonl(skb->nf_bridge->physoutdev->ifindex);
                                NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
@@ -615,7 +615,7 @@ nfulnl_log_packet(unsigned int pf,
        plen = 0;
        if (prefix)
-                plen = strlen(prefix);
+                plen = strlen(prefix) + 1;
        /* all macros expand to constant values at compile time */
        /* FIXME: do we want to make the size calculation conditional based on
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 63fe1093b616..0b9c49b3a100 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -360,7 +360,7 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
                return;
        }
-        read_lock(&in6_dev->lock);
+        read_lock_bh(&in6_dev->lock);
        for (ifp = in6_dev->addr_list; ifp; ifp = ifp->if_next) {
                /* Add the address to the local list.  */
                addr = t_new(struct sctp_sockaddr_entry, GFP_ATOMIC);
@@ -374,7 +374,7 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
                }
        }
-        read_unlock(&in6_dev->lock);
+        read_unlock_bh(&in6_dev->lock);
        rcu_read_unlock();
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 946b715db5ec..0c3a70ac5075 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -735,12 +735,14 @@ EXPORT_SYMBOL(xfrm_policy_insert);
 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                                          struct xfrm_selector *sel,
-                                          struct xfrm_sec_ctx *ctx, int delete)
+                                          struct xfrm_sec_ctx *ctx, int delete,
+                                          int *err)
 {
        struct xfrm_policy *pol, *ret;
        struct hlist_head *chain;
        struct hlist_node *entry;
+        *err = 0;
        write_lock_bh(&xfrm_policy_lock);
        chain = policy_hash_bysel(sel, sel->family, dir);
        ret = NULL;
@@ -750,6 +752,11 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                    xfrm_sec_ctx_match(ctx, pol->security)) {
                        xfrm_pol_hold(pol);
                        if (delete) {
+                                *err = security_xfrm_policy_delete(pol);
+                                if (*err) {
+                                        write_unlock_bh(&xfrm_policy_lock);
+                                        return pol;
+                                }
                                hlist_del(&pol->bydst);
                                hlist_del(&pol->byidx);
                                xfrm_policy_count[dir]--;
@@ -768,12 +775,14 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
 }
 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
-struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
+struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
+                                     int *err)
 {
        struct xfrm_policy *pol, *ret;
        struct hlist_head *chain;
        struct hlist_node *entry;
+        *err = 0;
        write_lock_bh(&xfrm_policy_lock);
        chain = xfrm_policy_byidx + idx_hash(id);
        ret = NULL;
@@ -781,6 +790,11 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
                if (pol->type == type && pol->index == id) {
                        xfrm_pol_hold(pol);
                        if (delete) {
+                                *err = security_xfrm_policy_delete(pol);
+                                if (*err) {
+                                        write_unlock_bh(&xfrm_policy_lock);
+                                        return pol;
+                                }
                                hlist_del(&pol->bydst);
                                hlist_del(&pol->byidx);
                                xfrm_policy_count[dir]--;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 956cfe0ff7f8..96789952f6a3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -530,9 +530,6 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
        err = xfrm_state_delete(x);
-        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        if (err < 0)
                goto out;
@@ -542,6 +539,8 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
        km_state_notify(x, &c);
 out:
+        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        xfrm_state_put(x);
        return err;
 }
@@ -1254,7 +1253,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                return err;
        if (p->index)
-                xp = xfrm_policy_byid(type, p->dir, p->index, delete);
+                xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err);
        else {
                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                struct xfrm_policy tmp;
@@ -1270,7 +1269,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                        if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
                                return err;
                }
-                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
+                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
+                                           delete, &err);
                security_xfrm_policy_free(&tmp);
        }
        if (xp == NULL)
@@ -1288,8 +1288,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                                              MSG_DONTWAIT);
                }
        } else {
-                err = security_xfrm_policy_delete(xp);
                xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
                               AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
@@ -1303,9 +1301,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                km_policy_notify(xp, p->dir, &c);
        }
-        xfrm_pol_put(xp);
 out:
+        xfrm_pol_put(xp);
        return err;
 }
@@ -1502,7 +1499,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                return err;
        if (p->index)
-                xp = xfrm_policy_byid(type, p->dir, p->index, 0);
+                xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err);
        else {
                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                struct xfrm_policy tmp;
@@ -1518,13 +1515,14 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                        if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
                                return err;
                }
-                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, 0);
+                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
+                                           0, &err);
                security_xfrm_policy_free(&tmp);
        }
        if (xp == NULL)
-                return err;
+                return -ENOENT;
-                                                                                        read_lock(&xp->lock);
+        read_lock(&xp->lock);
        if (xp->dead) {
                read_unlock(&xp->lock);
                goto out;