584 files changed, 9094 insertions, 5093 deletions
diff --git a/.mailmap b/.mailmap
index 726084286d33..dfab12f809ed 100644
--- a/.mailmap
+++ b/.mailmap
@@ -96,4 +96,6 @@ Tejun Heo <htejun@gmail.com>
 Thomas Graf <tgraf@suug.ch>
 Tony Luck <tony.luck@intel.com>
 Tsuneo Yoshioka <Tsuneo.Yoshioka@f-secure.com>
+Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
+Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
 Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 5b5aba404aac..73060819ed99 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -251,8 +251,6 @@ mono.txt
        - how to execute Mono-based .NET binaries with the help of BINFMT_MISC.
 moxa-smartio
        - file with info on installing/using Moxa multiport serial driver.
-mtrr.txt
-        - how to use PPro Memory Type Range Registers to increase performance.
 mutex-design.txt
        - info on the generic mutex subsystem.
 namespaces/
diff --git a/Documentation/ABI/testing/sysfs-gpio b/Documentation/ABI/testing/sysfs-gpio
new file mode 100644
index 000000000000..8aab8092ad35
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-gpio
@@ -0,0 +1,26 @@
+What:           /sys/class/gpio/
+Date:           July 2008
+KernelVersion:  2.6.27
+Contact:        David Brownell <dbrownell@users.sourceforge.net>
+Description:
+  As a Kconfig option, individual GPIO signals may be accessed from
+  userspace.  GPIOs are only made available to userspace by an explicit
+  "export" operation.  If a given GPIO is not claimed for use by
+  kernel code, it may be exported by userspace (and unexported later).
+  Kernel code may export it for complete or partial access.
+  GPIOs are identified as they are inside the kernel, using integers in
+  the range 0..INT_MAX.  See Documentation/gpio.txt for more information.
+    /sys/class/gpio
+        /export ... asks the kernel to export a GPIO to userspace
+        /unexport ... to return a GPIO to the kernel
+        /gpioN ... for each exported GPIO #N
+            /value ... always readable, writes fail for input GPIOs
+            /direction ... r/w as: in, out (default low); write: high, low
+        /gpiochipN ... for each gpiochip; #N is its first GPIO
+            /base ... (r/o) same as N
+            /label ... (r/o) descriptive, not necessarily unique
+            /ngpio ... (r/o) number of GPIOs; numbered N to N + (ngpio - 1)
diff --git a/Documentation/DMA-mapping.txt b/Documentation/DMA-mapping.txt
index b463ecd0c7ce..c74fec8c2351 100644
--- a/Documentation/DMA-mapping.txt
+++ b/Documentation/DMA-mapping.txt
@@ -740,7 +740,7 @@ failure can be determined by:
        dma_addr_t dma_handle;
        dma_handle = pci_map_single(pdev, addr, size, direction);
-        if (pci_dma_mapping_error(dma_handle)) {
+        if (pci_dma_mapping_error(pdev, dma_handle)) {
                /*
                 * reduce current DMA mapping usage,
                 * delay and try again later or
diff --git a/Documentation/HOWTO b/Documentation/HOWTO
index c2371c5a98f9..48a3955f05fc 100644
--- a/Documentation/HOWTO
+++ b/Documentation/HOWTO
@@ -77,7 +77,8 @@ documentation files are also added which explain how to use the feature.
 When a kernel change causes the interface that the kernel exposes to
 userspace to change, it is recommended that you send the information or
 a patch to the manual pages explaining the change to the manual pages
-maintainer at mtk.manpages@gmail.com.
+maintainer at mtk.manpages@gmail.com, and CC the list
+linux-api@vger.kernel.org.
 Here is a list of files that are in the kernel source tree that are
 required reading:
diff --git a/Documentation/SubmitChecklist b/Documentation/SubmitChecklist
index da10e0714241..21f0795af20f 100644
--- a/Documentation/SubmitChecklist
+++ b/Documentation/SubmitChecklist
@@ -67,6 +67,8 @@ kernel patches.
 19: All new userspace interfaces are documented in Documentation/ABI/.
    See Documentation/ABI/README for more information.
+    Patches that change userspace interfaces should be CCed to
+    linux-api@vger.kernel.org.
 20: Check that it all passes `make headers_check'.
diff --git a/Documentation/cpu-freq/index.txt b/Documentation/cpu-freq/index.txt
index ffdb5323df37..3d0b915035b9 100644
--- a/Documentation/cpu-freq/index.txt
+++ b/Documentation/cpu-freq/index.txt
@@ -35,11 +35,9 @@ Mailing List
 ------------
 There is a CPU frequency changing CVS commit and general list where
 you can report bugs, problems or submit patches. To post a message,
-send an email to cpufreq@lists.linux.org.uk, to subscribe go to
+send an email to cpufreq@vger.kernel.org, to subscribe go to
-http://lists.linux.org.uk/mailman/listinfo/cpufreq. Previous post to the
+http://vger.kernel.org/vger-lists.html#cpufreq and follow the
-mailing list are available to subscribers at
+instructions there.
-http://lists.linux.org.uk/mailman/private/cpufreq/.
 Links
 -----
@@ -50,7 +48,7 @@ how to access the CVS repository:
 * http://cvs.arm.linux.org.uk/
 the CPUFreq Mailing list:
-* http://lists.linux.org.uk/mailman/listinfo/cpufreq
+* http://vger.kernel.org/vger-lists.html#cpufreq
 Clock and voltage scaling for the SA-1100:
 * http://www.lartmaker.nl/projects/scaling
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index 1f5a924d1e56..47e568a9370a 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -635,14 +635,16 @@ prior 'mems' setting, will not be moved.
 There is an exception to the above.  If hotplug functionality is used
 to remove all the CPUs that are currently assigned to a cpuset,
-then the kernel will automatically update the cpus_allowed of all
+then all the tasks in that cpuset will be moved to the nearest ancestor
-tasks attached to CPUs in that cpuset to allow all CPUs.  When memory
+with non-empty cpus.  But the moving of some (or all) tasks might fail if
-hotplug functionality for removing Memory Nodes is available, a
+cpuset is bound with another cgroup subsystem which has some restrictions
-similar exception is expected to apply there as well.  In general,
+on task attaching.  In this failing case, those tasks will stay
-the kernel prefers to violate cpuset placement, over starving a task
+in the original cpuset, and the kernel will automatically update
-that has had all its allowed CPUs or Memory Nodes taken offline.  User
+their cpus_allowed to allow all online CPUs.  When memory hotplug
-code should reconfigure cpusets to only refer to online CPUs and Memory
+functionality for removing Memory Nodes is available, a similar exception
-Nodes when using hotplug to add or remove such resources.
+is expected to apply there as well.  In general, the kernel prefers to
+violate cpuset placement, over starving a task that has had all
+its allowed CPUs or Memory Nodes taken offline.
 There is a second exception to the above.  GFP_ATOMIC requests are
 kernel internal allocations that must be satisfied, immediately.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index eb1a47b97427..83c88cae1eda 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -322,3 +322,11 @@ Why:  Accounting can now be enabled/disabled without kernel recompilation.
      controlled by a kernel/module/sysfs/sysctl parameter.
 Who:  Krzysztof Piotr Oledzki <ole@ans.pl>
+---------------------------
+What: ide-scsi (BLK_DEV_IDESCSI)
+When: 2.6.29
+Why:  The 2.6 kernel supports direct writing to ide CD drives, which
+      eliminates the need for ide-scsi. The new method is more
+      efficient in every way.
+Who:  FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 394eb2cc1c39..f566ad9bcb7b 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -2413,6 +2413,8 @@ The following 4 memory types are supported:
  - (bit 1) anonymous shared memory
  - (bit 2) file-backed private memory
  - (bit 3) file-backed shared memory
+  - (bit 4) ELF header pages in file-backed private memory areas (it is
+            effective only if the bit 2 is cleared)
  Note that MMIO pages such as frame buffer are never dumped and vDSO pages
  are always dumped regardless of the bitmask status.
diff --git a/Documentation/hwmon/adt7473 b/Documentation/hwmon/adt7473
index 2126de34c711..1cbf671822e2 100644
--- a/Documentation/hwmon/adt7473
+++ b/Documentation/hwmon/adt7473
@@ -14,14 +14,14 @@ Description
 This driver implements support for the Analog Devices ADT7473 chip family.
-The LM85 uses the 2-wire interface compatible with the SMBUS 2.0
+The ADT7473 uses the 2-wire interface compatible with the SMBUS 2.0
 specification. Using an analog to digital converter it measures three (3)
-temperatures and two (2) voltages. It has three (3) 16-bit counters for
+temperatures and two (2) voltages. It has four (4) 16-bit counters for
 measuring fan speed. There are three (3) PWM outputs that can be used
 to control fan speed.
 A sophisticated control system for the PWM outputs is designed into the
-LM85 that allows fan speed to be adjusted automatically based on any of the
+ADT7473 that allows fan speed to be adjusted automatically based on any of the
 three temperature sensors. Each PWM output is individually adjustable and
 programmable. Once configured, the ADT7473 will adjust the PWM outputs in
 response to the measured temperatures without further host intervention.
@@ -46,14 +46,6 @@ from the raw value to get the temperature value.
 The Analog Devices datasheet is very detailed and describes a procedure for
 determining an optimal configuration for the automatic PWM control.
-Hardware Configurations
-----------------------
-The ADT7473 chips have an optional SMBALERT output that can be used to
-signal the chipset in case a limit is exceeded or the temperature sensors
-fail. Individual sensor interrupts can be masked so they won't trigger
-SMBALERT. The SMBALERT output if configured replaces the PWM2 function.
 Configuration Notes
 -------------------
@@ -61,8 +53,8 @@ Besides standard interfaces driver adds the following:
 * PWM Control
-* pwm#_auto_point1_pwm and pwm#_auto_point1_temp and
+* pwm#_auto_point1_pwm and temp#_auto_point1_temp and
-* pwm#_auto_point2_pwm and pwm#_auto_point2_temp -
+* pwm#_auto_point2_pwm and temp#_auto_point2_temp -
 point1: Set the pwm speed at a lower temperature bound.
 point2: Set the pwm speed at a higher temperature bound.
diff --git a/Documentation/hwmon/sysfs-interface b/Documentation/hwmon/sysfs-interface
index 2d845730d4e0..6dbfd5efd991 100644
--- a/Documentation/hwmon/sysfs-interface
+++ b/Documentation/hwmon/sysfs-interface
@@ -329,6 +329,10 @@ power[1-*]_average		Average power use
                                Unit: microWatt
                                RO
+power[1-*]_average_interval     Power use averaging interval
+                                Unit: milliseconds
+                                RW
 power[1-*]_average_highest      Historical average maximum power use
                                Unit: microWatt
                                RO
@@ -354,6 +358,14 @@ power[1-*]_reset_history	Reset input_highest, input_lowest,
                                WO
 **********
+* Energy *
+**********
+energy[1-*]_input               Cumulative energy use
+                                Unit: microJoule
+                                RO
+**********
 * Alarms *
 **********
diff --git a/Documentation/ioctl/cdrom.txt b/Documentation/ioctl/cdrom.txt
index 62d4af44ec4a..59df81c8da2b 100644
--- a/Documentation/ioctl/cdrom.txt
+++ b/Documentation/ioctl/cdrom.txt
@@ -271,14 +271,14 @@ CDROMCLOSETRAY			pendant of CDROMEJECT
        usage:
-          ioctl(fd, CDROMEJECT, 0);
+          ioctl(fd, CDROMCLOSETRAY, 0);
        inputs:         none
        outputs:        none
        error returns:
-          ENOSYS        cd drive not capable of ejecting
+          ENOSYS        cd drive not capable of closing the tray
          EBUSY         other processes are accessing drive, or door is locked
        notes:
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 1de51110e622..c5d891fd75e3 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -284,6 +284,11 @@ and is between 256 and 4096 characters. It is defined in the file
                        isolate - enable device isolation (each device, as far
                                  as possible, will get its own protection
                                  domain)
+                        fullflush - enable flushing of IO/TLB entries when
+                                    they are unmapped. Otherwise they are
+                                    flushed before they will be reused, which
+                                    is a lot of faster
        amd_iommu_size= [HW,X86-64]
                        Define the size of the aperture for the AMD IOMMU
                        driver. Possible values are:
@@ -463,12 +468,6 @@ and is between 256 and 4096 characters. It is defined in the file
                        Range: 0 - 8192
                        Default: 64
-        disable_8254_timer
-        enable_8254_timer
-                        [IA32/X86_64] Disable/Enable interrupt 0 timer routing
-                        over the 8254 in addition to over the IO-APIC. The
-                        kernel tries to set a sensible default.
        hpet=           [X86-32,HPET] option to control HPET usage
                        Format: { enable (default) | disable | force }
                        disable: disable HPET and use PIT instead
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 276a7e637822..e1ff0d920a5c 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -351,9 +351,10 @@ kernel.  This value defaults to SHMMAX.
 softlockup_thresh:
-This value can be used to lower the softlockup tolerance
+This value can be used to lower the softlockup tolerance threshold.  The
-threshold. The default threshold is 10s.  If a cpu is locked up
+default threshold is 60 seconds.  If a cpu is locked up for 60 seconds,
-for 10s, the kernel complains.  Valid values are 1-60s.
+the kernel complains.  Valid values are 1-60 seconds.  Setting this
+tunable to zero will disable the softlockup detection altogether.
 ==============================================================
diff --git a/Documentation/usb/anchors.txt b/Documentation/usb/anchors.txt
index 7304bcf5a306..5e6b64c20d25 100644
--- a/Documentation/usb/anchors.txt
+++ b/Documentation/usb/anchors.txt
@@ -42,9 +42,21 @@ This function kills all URBs associated with an anchor. The URBs
 are called in the reverse temporal order they were submitted.
 This way no data can be reordered.
+usb_unlink_anchored_urbs()
+--------------------------
+This function unlinks all URBs associated with an anchor. The URBs
+are processed in the reverse temporal order they were submitted.
+This is similar to usb_kill_anchored_urbs(), but it will not sleep.
+Therefore no guarantee is made that the URBs have been unlinked when
+the call returns. They may be unlinked later but will be unlinked in
+finite time.
 usb_wait_anchor_empty_timeout()
 -------------------------------
 This function waits for all URBs associated with an anchor to finish
 or a timeout, whichever comes first. Its return value will tell you
 whether the timeout was reached.
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 89c7f32abf9f..53449cb99b17 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -46,7 +46,7 @@
 45 -> Pinnacle PCTV DVB-T                      (em2870)
 46 -> Compro, VideoMate U3                     (em2870)        [185b:2870]
 47 -> KWorld DVB-T 305U                        (em2880)        [eb1a:e305]
- 48 -> KWorld DVB-T 310U                        (em2880)
+ 48 -> KWorld DVB-T 310U                        (em2880)        [eb1a:e310]
 49 -> MSI DigiVox A/D                          (em2880)        [eb1a:e310]
 50 -> MSI DigiVox A/D II                       (em2880)        [eb1a:e320]
 51 -> Terratec Hybrid XS Secam                 (em2880)        [0ccd:004c]
diff --git a/Documentation/video4linux/gspca.txt b/Documentation/video4linux/gspca.txt
index 0f03900c48fb..9a3e4d797fa8 100644
--- a/Documentation/video4linux/gspca.txt
+++ b/Documentation/video4linux/gspca.txt
@@ -190,6 +190,7 @@ pac7311		093a:260f	SnakeCam
 pac7311         093a:2621       PAC731x
 pac7311         093a:2624       PAC7302
 pac7311         093a:2626       Labtec 2200
+pac7311         093a:262a       Webcam 300k
 zc3xx           0ac8:0302       Z-star Vimicro zc0302
 vc032x          0ac8:0321       Vimicro generic vc0321
 vc032x          0ac8:0323       Vimicro Vc0323
diff --git a/Documentation/x86/00-INDEX b/Documentation/x86/00-INDEX
new file mode 100644
index 000000000000..dbe3377754af
--- /dev/null
+++ b/Documentation/x86/00-INDEX
@@ -0,0 +1,4 @@
+00-INDEX
+        - this file
+mtrr.txt
+        - how to use x86 Memory Type Range Registers to increase performance
diff --git a/Documentation/x86/i386/boot.txt b/Documentation/x86/boot.txt
index 147bfe511cdd..83c0033ee9e0 100644
--- a/Documentation/x86/i386/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -308,7 +308,7 @@ Protocol:	2.00+
 Field name:     start_sys
 Type:           read
-Offset/size:    0x20c/4
+Offset/size:    0x20c/2
 Protocol:       2.00+
  The load low segment (0x1000).  Obsolete.
diff --git a/Documentation/mtrr.txt b/Documentation/x86/mtrr.txt
index c39ac395970e..cc071dc333c2 100644
--- a/Documentation/mtrr.txt
+++ b/Documentation/x86/mtrr.txt
@@ -18,7 +18,7 @@ Richard Gooch
  The AMD K6-2 (stepping 8 and above) and K6-3 processors have two
  MTRRs. These are supported.  The AMD Athlon family provide 8 Intel
  style MTRRs.
-  
  The Centaur C6 (WinChip) has 8 MCRs, allowing write-combining. These
  are supported.
@@ -87,7 +87,7 @@ reg00: base=0x00000000 (   0MB), size=  64MB: write-back, count=1
 reg01: base=0xfb000000 (4016MB), size=  16MB: write-combining, count=1
 reg02: base=0xfb000000 (4016MB), size=   4kB: uncachable, count=1
-Some cards (especially Voodoo Graphics boards) need this 4 kB area 
+Some cards (especially Voodoo Graphics boards) need this 4 kB area
 excluded from the beginning of the region because it is used for
 registers.
diff --git a/Documentation/x86/pat.txt b/Documentation/x86/pat.txt
index 17965f927c15..c93ff5f4c0dd 100644
--- a/Documentation/x86/pat.txt
+++ b/Documentation/x86/pat.txt
@@ -14,6 +14,10 @@ PAT allows for different types of memory attributes. The most commonly used
 ones that will be supported at this time are Write-back, Uncached,
 Write-combined and Uncached Minus.
+PAT APIs
+--------
 There are many different APIs in the kernel that allows setting of memory
 attributes at the page level. In order to avoid aliasing, these interfaces
 should be used thoughtfully. Below is a table of interfaces available,
@@ -26,38 +30,38 @@ address range to avoid any aliasing.
 API                    |    RAM   |  ACPI,...  |  Reserved/Holes  |
 -----------------------|----------|------------|------------------|
                       |          |            |                  |
-ioremap                |    --    |    UC      |       UC         |
+ioremap                |    --    |    UC-     |       UC-        |
                       |          |            |                  |
 ioremap_cache          |    --    |    WB      |       WB         |
                       |          |            |                  |
-ioremap_nocache        |    --    |    UC      |       UC         |
+ioremap_nocache        |    --    |    UC-     |       UC-        |
                       |          |            |                  |
 ioremap_wc             |    --    |    --      |       WC         |
                       |          |            |                  |
-set_memory_uc          |    UC    |    --      |       --         |
+set_memory_uc          |    UC-   |    --      |       --         |
 set_memory_wb         |          |            |                  |
                       |          |            |                  |
 set_memory_wc          |    WC    |    --      |       --         |
 set_memory_wb         |          |            |                  |
                       |          |            |                  |
-pci sysfs resource     |    --    |    --      |       UC         |
+pci sysfs resource     |    --    |    --      |       UC-        |
                       |          |            |                  |
 pci sysfs resource_wc  |    --    |    --      |       WC         |
 is IORESOURCE_PREFETCH|          |            |                  |
                       |          |            |                  |
-pci proc               |    --    |    --      |       UC         |
+pci proc               |    --    |    --      |       UC-        |
 !PCIIOC_WRITE_COMBINE |          |            |                  |
                       |          |            |                  |
 pci proc               |    --    |    --      |       WC         |
 PCIIOC_WRITE_COMBINE  |          |            |                  |
                       |          |            |                  |
-/dev/mem               |    --    |    UC      |       UC         |
+/dev/mem               |    --    |  WB/WC/UC- |    WB/WC/UC-     |
 read-write            |          |            |                  |
                       |          |            |                  |
-/dev/mem               |    --    |    UC      |       UC         |
+/dev/mem               |    --    |    UC-     |       UC-        |
 mmap SYNC flag        |          |            |                  |
                       |          |            |                  |
-/dev/mem               |    --    |  WB/WC/UC  |    WB/WC/UC      |
+/dev/mem               |    --    |  WB/WC/UC- |    WB/WC/UC-     |
 mmap !SYNC flag       |          |(from exist-|  (from exist-    |
 and                   |          |  ing alias)|    ing alias)    |
 any alias to this area|          |            |                  |
@@ -68,7 +72,7 @@ pci proc               |    --    |    --      |       WC         |
 and                   |          |            |                  |
 MTRR says WB          |          |            |                  |
                       |          |            |                  |
-/dev/mem               |    --    |    --      |    UC_MINUS      |
+/dev/mem               |    --    |    --      |       UC-        |
 mmap !SYNC flag       |          |            |                  |
 no alias to this area |          |            |                  |
 and                   |          |            |                  |
@@ -98,3 +102,35 @@ types.
 Drivers should use set_memory_[uc|wc] to set access type for RAM ranges.
+PAT debugging
+-------------
+With CONFIG_DEBUG_FS enabled, PAT memtype list can be examined by
+# mount -t debugfs debugfs /sys/kernel/debug
+# cat /sys/kernel/debug/x86/pat_memtype_list
+PAT memtype list:
+uncached-minus @ 0x7fadf000-0x7fae0000
+uncached-minus @ 0x7fb19000-0x7fb1a000
+uncached-minus @ 0x7fb1a000-0x7fb1b000
+uncached-minus @ 0x7fb1b000-0x7fb1c000
+uncached-minus @ 0x7fb1c000-0x7fb1d000
+uncached-minus @ 0x7fb1d000-0x7fb1e000
+uncached-minus @ 0x7fb1e000-0x7fb25000
+uncached-minus @ 0x7fb25000-0x7fb26000
+uncached-minus @ 0x7fb26000-0x7fb27000
+uncached-minus @ 0x7fb27000-0x7fb28000
+uncached-minus @ 0x7fb28000-0x7fb2e000
+uncached-minus @ 0x7fb2e000-0x7fb2f000
+uncached-minus @ 0x7fb2f000-0x7fb30000
+uncached-minus @ 0x7fb31000-0x7fb32000
+uncached-minus @ 0x80000000-0x90000000
+This list shows physical address ranges and various PAT settings used to
+access those physical address ranges.
+Another, more verbose way of getting PAT related debug messages is with
+"debugpat" boot parameter. With this parameter, various debug messages are
+printed to dmesg log.
diff --git a/Documentation/x86/i386/usb-legacy-support.txt b/Documentation/x86/usb-legacy-support.txt
index 1894cdfc69d9..1894cdfc69d9 100644
--- a/Documentation/x86/i386/usb-legacy-support.txt
+++ b/Documentation/x86/usb-legacy-support.txt
diff --git a/Documentation/x86/x86_64/boot-options.txt b/Documentation/x86/x86_64/boot-options.txt
index b0c7b6c4abda..72ffb5373ec7 100644
--- a/Documentation/x86/x86_64/boot-options.txt
+++ b/Documentation/x86/x86_64/boot-options.txt
@@ -54,10 +54,6 @@ APICs
                 apicmaintimer. Useful when your PIT timer is totally
                 broken.
-   disable_8254_timer / enable_8254_timer
-                 Enable interrupt 0 timer routing over the 8254 in addition to over
-                 the IO-APIC. The kernel tries to set a sensible default.
 Early Console
   syntax: earlyprintk=vga
diff --git a/Documentation/x86/i386/zero-page.txt b/Documentation/x86/zero-page.txt
index 169ad423a3d1..169ad423a3d1 100644
--- a/Documentation/x86/i386/zero-page.txt
+++ b/Documentation/x86/zero-page.txt
diff --git a/MAINTAINERS b/MAINTAINERS
index 186be3ba5069..3c124d7989e0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -271,20 +271,20 @@ W:	http://www.lesswatts.org/projects/acpi/
 S:      Supported
 ACPI WMI DRIVER
-P:      Carlos Corbacho
+P:      Carlos Corbacho
-M:      carlos@strangeworlds.co.uk
+M:      carlos@strangeworlds.co.uk
-L:      linux-acpi@vger.kernel.org
+L:      linux-acpi@vger.kernel.org
-W:      http://www.lesswatts.org/projects/acpi/
+W:      http://www.lesswatts.org/projects/acpi/
-S:      Maintained
+S:      Maintained
 AD1889 ALSA SOUND DRIVER
-P:     Kyle McMartin
+P:      Kyle McMartin
-M:     kyle@mcmartin.ca
+M:      kyle@mcmartin.ca
-P:     Thibaut Varene
+P:      Thibaut Varene
-M:     T-Bone@parisc-linux.org
+M:      T-Bone@parisc-linux.org
-W:     http://wiki.parisc-linux.org/AD1889
+W:      http://wiki.parisc-linux.org/AD1889
-L:     linux-parisc@vger.kernel.org
+L:      linux-parisc@vger.kernel.org
-S:     Maintained
+S:      Maintained
 ADM1025 HARDWARE MONITOR DRIVER
 P:      Jean Delvare
@@ -387,6 +387,7 @@ AMD IOMMU (AMD-VI)
 P:      Joerg Roedel
 M:      joerg.roedel@amd.com
 L:      iommu@lists.linux-foundation.org
+T:      git://git.kernel.org/pub/scm/linux/kernel/git/joro/linux-2.6-iommu.git
 S:      Supported
 AMS (Apple Motion Sensor) DRIVER
@@ -473,11 +474,11 @@ L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 S:      Maintained
 ARM/ATMEL AT91RM9200 ARM ARCHITECTURE
-P:      Andrew Victor
+P:      Andrew Victor
-M:      linux@maxim.org.za
+M:      linux@maxim.org.za
-L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
+L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-W:      http://maxim.org.za/at91_26.html
+W:      http://maxim.org.za/at91_26.html
-S:      Maintained
+S:      Maintained
 ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
 P:      Lennert Buytenhek
@@ -532,10 +533,10 @@ L:	linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 S:      Maintained
 ARM/HP JORNADA 7XX MACHINE SUPPORT
-P:      Kristoffer Ericson
+P:      Kristoffer Ericson
-M:      kristoffer.ericson@gmail.com
+M:      kristoffer.ericson@gmail.com
-W:      www.jlime.com
+W:      www.jlime.com
-S:      Maintained
+S:      Maintained
 ARM/INTEL IOP32X ARM ARCHITECTURE
 P:      Lennert Buytenhek
@@ -1017,7 +1018,7 @@ T:	git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Maintained
 CAFE CMOS INTEGRATED CAMERA CONTROLLER DRIVER
-P:      Jonathan Corbet
+P:      Jonathan Corbet
 M:      corbet@lwn.net
 L:      video4linux-list@redhat.com
 S:      Maintained
@@ -1198,9 +1199,7 @@ M:	hpa@zytor.com
 S:      Maintained
 CPUSETS
-P:      Paul Jackson
 P:      Paul Menage
-M:      pj@sgi.com
 M:      menage@google.com
 L:      linux-kernel@vger.kernel.org
 W:      http://www.bullopensource.org/cpuset/
@@ -1359,7 +1358,7 @@ P:	Digi International, Inc
 M:      Eng.Linux@digi.com
 L:      Eng.Linux@digi.com
 W:      http://www.digi.com
-S:      Orphaned
+S:      Orphan
 DIRECTORY NOTIFICATION
 P:      Stephen Rothwell
@@ -1423,12 +1422,12 @@ L:	linux-acpi@vger.kernel.org
 S:      Supported
 DOCUMENTATION (/Documentation directory)
-P:     Michael Kerrisk
+P:      Michael Kerrisk
-M:     mtk.manpages@gmail.com
+M:      mtk.manpages@gmail.com
-P:     Randy Dunlap
+P:      Randy Dunlap
-M:     rdunlap@xenotime.net
+M:      rdunlap@xenotime.net
-L:     linux-doc@vger.kernel.org
+L:      linux-doc@vger.kernel.org
-S:     Maintained
+S:      Maintained
 DOUBLETALK DRIVER
 P:      James R. Van Zandt
@@ -1459,7 +1458,7 @@ S:	Maintained
 DVB SUBSYSTEM AND DRIVERS
 P:      LinuxTV.org Project
 M:      v4l-dvb-maintainer@linuxtv.org
-L:      linux-dvb@linuxtv.org (subscription required)
+L:      linux-dvb@linuxtv.org (subscription required)
 W:      http://linuxtv.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
 S:      Maintained
@@ -1797,7 +1796,7 @@ FUTURE DOMAIN TMC-16x0 SCSI DRIVER (16-bit)
 P:      Rik Faith
 M:      faith@cs.unc.edu
 L:      linux-scsi@vger.kernel.org
-S:      Odd fixes (e.g., new signatures)
+S:      Odd Fixes (e.g., new signatures)
 GDT SCSI DISK ARRAY CONTROLLER DRIVER
 P:      Achim Leubner
@@ -1838,10 +1837,10 @@ S:	Maintained
 HARDWARE MONITORING
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
-S:      Orphaned
+S:      Orphan
 HARDWARE RANDOM NUMBER GENERATOR CORE
-S:      Orphaned
+S:      Orphan
 HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
 P:      Robert Love
@@ -1984,7 +1983,7 @@ S:	Maintained
 I2C/SMBUS STUB DRIVER
 P:      Mark M. Hoffman
 M:      mhoffman@lightlink.com
-L:      lm-sensors@lm-sensors.org
+L:      i2c@lm-sensors.org
 S:      Maintained
 I2C SUBSYSTEM
@@ -2108,7 +2107,7 @@ M:	rolandd@cisco.com
 P:      Sean Hefty
 M:      sean.hefty@intel.com
 P:      Hal Rosenstock
-M:      hal.rosenstock@gmail.com 
+M:      hal.rosenstock@gmail.com
 L:      general@lists.openfabrics.org
 W:      http://www.openib.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/roland/infiniband.git
@@ -2696,17 +2695,18 @@ S:	Maintained
 MARVELL YUKON / SYSKONNECT DRIVER
 P:      Mirko Lindner
-M:      mlindner@syskonnect.de
+M:      mlindner@syskonnect.de
 P:      Ralph Roesler
-M:      rroesler@syskonnect.de
+M:      rroesler@syskonnect.de
-W:      http://www.syskonnect.com
+W:      http://www.syskonnect.com
-S:      Supported
+S:      Supported
 MAN-PAGES: MANUAL PAGES FOR LINUX -- Sections 2, 3, 4, 5, and 7
 P:      Michael Kerrisk
 M:      mtk.manpages@gmail.com
-W:     http://www.kernel.org/doc/man-pages
+W:      http://www.kernel.org/doc/man-pages
-S:     Supported
+L:      linux-man@vger.kernel.org
+S:      Supported
 MARVELL LIBERTAS WIRELESS DRIVER
 P:      Dan Williams
@@ -2735,7 +2735,7 @@ S:	Maintained
 MEGARAID SCSI DRIVERS
 P:      Neela Syam Kolli
 M:      megaraidlinux@lsi.com
-S:      linux-scsi@vger.kernel.org
+L:      linux-scsi@vger.kernel.org
 W:      http://megaraid.lsilogic.com
 S:      Maintained
@@ -2853,7 +2853,7 @@ MULTIMEDIA CARD (MMC) ETC. OVER SPI
 P:      David Brownell
 M:      dbrownell@users.sourceforge.net
 L:      linux-kernel@vger.kernel.org
-S:      Odd fixes
+S:      Odd Fixes
 MULTISOUND SOUND DRIVER
 P:      Andrew Veliath
@@ -2867,10 +2867,10 @@ L:	linux-kernel@vger.kernel.org
 S:      Maintained
 MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER
-P:     Felipe Balbi
+P:      Felipe Balbi
-M:     felipe.balbi@nokia.com
+M:      felipe.balbi@nokia.com
-L:     linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
-S:     Maintained
+S:      Maintained
 MYRICOM MYRI-10G 10GbE DRIVER (MYRI10GE)
 P:      Andrew Gallatin
@@ -2882,7 +2882,7 @@ W:	http://www.myri.com/scs/download-Myri10GE.html
 S:      Supported
 NATSEMI ETHERNET DRIVER (DP8381x)
-P:      Tim Hockin
+P:      Tim Hockin
 M:      thockin@hockin.org
 S:      Maintained
@@ -3101,7 +3101,7 @@ M:	laforge@gnumonks.org
 S:      Maintained
 OMNIVISION OV7670 SENSOR DRIVER
-P:      Jonathan Corbet
+P:      Jonathan Corbet
 M:      corbet@lwn.net
 L:      video4linux-list@redhat.com
 S:      Maintained
@@ -3211,7 +3211,7 @@ T:	git kernel.org:/pub/scm/linux/kernel/git/jbarnes/pci-2.6.git
 S:      Supported
 PCI HOTPLUG CORE
-P:      Kristen Carlson Accardi
+P:      Kristen Carlson Accardi
 M:      kristen.c.accardi@intel.com
 S:      Supported
@@ -3650,7 +3650,7 @@ M:	jmorris@namei.org
 P:      Eric Paris
 M:      eparis@parisplace.org
 L:      linux-kernel@vger.kernel.org (kernel issues)
-L:      selinux@tycho.nsa.gov (subscribers-only, general discussion)
+L:      selinux@tycho.nsa.gov (subscribers-only, general discussion)
 W:      http://www.nsa.gov/selinux
 S:      Supported
@@ -3726,7 +3726,7 @@ S:	Maintained
 SIS 96X I2C/SMBUS DRIVER
 P:      Mark M. Hoffman
 M:      mhoffman@lightlink.com
-L:      lm-sensors@lm-sensors.org
+L:      i2c@lm-sensors.org
 S:      Maintained
 SIS FRAMEBUFFER DRIVER
@@ -3768,10 +3768,10 @@ M:	bn@niasdigital.com
 S:      Maintained
 SOC-CAMERA V4L2 SUBSYSTEM
-P:     Guennadi Liakhovetski
+P:      Guennadi Liakhovetski
-M:     g.liakhovetski@gmx.de
+M:      g.liakhovetski@gmx.de
-L:     video4linux-list@redhat.com
+L:      video4linux-list@redhat.com
-S:     Maintained
+S:      Maintained
 SOFTWARE RAID (Multiple Disks) SUPPORT
 P:      Ingo Molnar
@@ -3833,11 +3833,12 @@ S:	Maintained
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT
 P:      Liam Girdwood
-M:      liam.girdwood@wolfsonmicro.com
+M:      lrg@slimlogic.co.uk
 P:      Mark Brown
 M:      broonie@opensource.wolfsonmicro.com
 T:      git opensource.wolfsonmicro.com/linux-2.6-asoc
 L:      alsa-devel@alsa-project.org (subscribers-only)
+W:      http://alsa-project.org/main/index.php/ASoC
 S:      Supported
 SPI SUBSYSTEM
@@ -3925,7 +3926,7 @@ S:	Maintained
 STARMODE RADIO IP (STRIP) PROTOCOL DRIVER
 W:      http://mosquitonet.Stanford.EDU/strip.html
-S:      Unsupported ?
+S:      Orphan
 STRADIS MPEG-2 DECODER DRIVER
 P:      Nathan Laredo
@@ -4006,9 +4007,9 @@ T:	git repo.or.cz/linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git
 S:      Maintained
 TI FLASH MEDIA INTERFACE DRIVER
-P:      Alex Dubov
+P:      Alex Dubov
-M:      oakad@yahoo.com
+M:      oakad@yahoo.com
-S:      Maintained
+S:      Maintained
 TI OMAP MMC INTERFACE DRIVER
 P:      Carlos Aguiar, Anderson Briglia and Syed Khasim
@@ -4154,13 +4155,13 @@ USB BLOCK DRIVER (UB ub)
 P:      Pete Zaitcev
 M:      zaitcev@redhat.com
 L:      linux-kernel@vger.kernel.org
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Supported
 USB CDC ETHERNET DRIVER
 P:      Greg Kroah-Hartman
 M:      greg@kroah.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 W:      http://www.kroah.com/linux-usb/
@@ -4187,13 +4188,13 @@ S:	Maintained
 USB EHCI DRIVER
 P:      David Brownell
 M:      dbrownell@users.sourceforge.net
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Odd Fixes
 USB ET61X[12]51 DRIVER
 P:      Luca Risolia
 M:      luca.risolia@studio.unibo.it
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      video4linux-list@redhat.com
 W:      http://www.linux-projects.org
 S:      Maintained
@@ -4201,33 +4202,33 @@ S:	Maintained
 USB GADGET/PERIPHERAL SUBSYSTEM
 P:      David Brownell
 M:      dbrownell@users.sourceforge.net
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://www.linux-usb.org/gadget
 S:      Maintained
 USB HID/HIDBP DRIVERS (USB KEYBOARDS, MICE, REMOTE CONTROLS, ...)
 P:      Jiri Kosina
 M:      jkosina@suse.cz
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
 USB ISP116X DRIVER
 P:      Olav Kongas
 M:      ok@artecdesign.ee
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB KAWASAKI LSI DRIVER
 P:      Oliver Neukum
 M:      oliver@neukum.name
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB MASS STORAGE DRIVER
 P:      Matthew Dharm
 M:      mdharm-usb@one-eyed-alien.net
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      usb-storage@lists.one-eyed-alien.net
 S:      Maintained
 W:      http://www.one-eyed-alien.net/~mdharm/linux-usb/
@@ -4235,26 +4236,26 @@ W:	http://www.one-eyed-alien.net/~mdharm/linux-usb/
 USB OHCI DRIVER
 P:      David Brownell
 M:      dbrownell@users.sourceforge.net
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Odd Fixes
 USB OPTION-CARD DRIVER
 P:      Matthias Urlichs
 M:      smurf@smurf.noris.de
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB OV511 DRIVER
 P:      Mark McClelland
 M:      mmcclell@bigfoot.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://alpha.dyndns.org/ov511/
 S:      Maintained
 USB PEGASUS DRIVER
 P:      Petko Manolov
 M:      petkan@users.sourceforge.net
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      netdev@vger.kernel.org
 W:      http://pegasus2.sourceforge.net/
 S:      Maintained
@@ -4262,13 +4263,13 @@ S:	Maintained
 USB PRINTER DRIVER (usblp)
 P:      Pete Zaitcev
 M:      zaitcev@redhat.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Supported
 USB RTL8150 DRIVER
 P:      Petko Manolov
 M:      petkan@users.sourceforge.net
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      netdev@vger.kernel.org
 W:      http://pegasus2.sourceforge.net/
 S:      Maintained
@@ -4276,20 +4277,20 @@ S:	Maintained
 USB SE401 DRIVER
 P:      Jeroen Vreeken
 M:      pe1rxq@amsat.org
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://www.chello.nl/~j.vreeken/se401/
 S:      Maintained
 USB SERIAL BELKIN F5U103 DRIVER
 P:      William Greathouse
 M:      wgreathouse@smva.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB SERIAL CYPRESS M8 DRIVER
 P:      Lonnie Mendez
 M:      dignome@gmail.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 W:      http://geocities.com/i0xox0i
 W:      http://firstlight.net/cvs
@@ -4304,39 +4305,39 @@ USB SERIAL DIGI ACCELEPORT DRIVER
 P:      Peter Berger and Al Borchers
 M:      pberger@brimson.com
 M:      alborchers@steinerpoint.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB SERIAL DRIVER
 P:      Greg Kroah-Hartman
 M:      gregkh@suse.de
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Supported
 USB SERIAL EMPEG EMPEG-CAR MARK I/II DRIVER
 P:      Gary Brubaker
 M:      xavyer@ix.netcom.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB SERIAL KEYSPAN DRIVER
 P:      Greg Kroah-Hartman
 M:      greg@kroah.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://www.kroah.com/linux/
 S:      Maintained
 USB SERIAL WHITEHEAT DRIVER
 P:      Support Department
 M:      support@connecttech.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://www.connecttech.com
 S:      Supported
 USB SN9C1xx DRIVER
 P:      Luca Risolia
 M:      luca.risolia@studio.unibo.it
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      video4linux-list@redhat.com
 W:      http://www.linux-projects.org
 S:      Maintained
@@ -4344,7 +4345,7 @@ S:	Maintained
 USB SUBSYSTEM
 P:      Greg Kroah-Hartman
 M:      gregkh@suse.de
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://www.linux-usb.org
 T:      quilt kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/
 S:      Supported
@@ -4352,7 +4353,7 @@ S:	Supported
 USB UHCI DRIVER
 P:      Alan Stern
 M:      stern@rowland.harvard.edu
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 S:      Maintained
 USB "USBNET" DRIVER FRAMEWORK
@@ -4365,7 +4366,7 @@ S:	Maintained
 USB VIDEO CLASS
 P:      Laurent Pinchart
 M:      laurent.pinchart@skynet.be
-L:      linx-uvc-devel@berlios.de
+L:      linux-uvc-devel@lists.berlios.de
 L:      video4linux-list@redhat.com
 W:      http://linux-uvc.berlios.de
 S:      Maintained
@@ -4373,7 +4374,7 @@ S:	Maintained
 USB W996[87]CF DRIVER
 P:      Luca Risolia
 M:      luca.risolia@studio.unibo.it
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      video4linux-list@redhat.com
 W:      http://www.linux-projects.org
 S:      Maintained
@@ -4387,7 +4388,7 @@ S:	Maintained
 USB ZC0301 DRIVER
 P:      Luca Risolia
 M:      luca.risolia@studio.unibo.it
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      video4linux-list@redhat.com
 W:      http://www.linux-projects.org
 S:      Maintained
@@ -4395,14 +4396,14 @@ S:	Maintained
 USB ZD1201 DRIVER
 P:      Jeroen Vreeken
 M:      pe1rxq@amsat.org
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 W:      http://linux-lc100020.sourceforge.net
 S:      Maintained
 USB ZR364XX DRIVER
 P:      Antoine Jacquet
 M:      royale@zerezo.com
-L:      linux-usb@vger.kernel.org
+L:      linux-usb@vger.kernel.org
 L:      video4linux-list@redhat.com
 W:      http://royale.zerezo.com/zr364xx/
 S:      Maintained
diff --git a/Makefile b/Makefile
index 4ff83ea36c19..16e3fbb968a8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 27
-EXTRAVERSION = -rc6
+EXTRAVERSION =
 NAME = Rotary Wombat
 # *DOCUMENTATION*
diff --git a/arch/arm/include/asm/pci.h b/arch/arm/include/asm/pci.h
index 721c03d53f4b..918d0cbbf064 100644
--- a/arch/arm/include/asm/pci.h
+++ b/arch/arm/include/asm/pci.h
@@ -30,7 +30,7 @@ static inline void pcibios_penalize_isa_irq(int irq, int active)
 * The networking and block device layers use this boolean for bounce
 * buffer decisions.
 */
-#define PCI_DMA_BUS_IS_PHYS     (0)
+#define PCI_DMA_BUS_IS_PHYS     (1)
 /*
 * Whether pci_unmap_{single,page} is a nop depends upon the
diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
index aaffaecffcd1..ba8ccfede964 100644
--- a/arch/arm/kernel/kgdb.c
+++ b/arch/arm/kernel/kgdb.c
@@ -111,8 +111,6 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
        case 'D':
        case 'k':
        case 'c':
-                kgdb_contthread = NULL;
                /*
                 * Try to read optional parameter, pc unchanged if no parm.
                 * If this was a compiled breakpoint, we need to move
diff --git a/arch/arm/mach-davinci/psc.c b/arch/arm/mach-davinci/psc.c
index 720c48b9ee04..aa2fc375a325 100644
--- a/arch/arm/mach-davinci/psc.c
+++ b/arch/arm/mach-davinci/psc.c
@@ -70,9 +70,6 @@ void davinci_psc_config(unsigned int domain, unsigned int id, char enable)
 {
        u32 epcpr, ptcmd, ptstat, pdstat, pdctl1, mdstat, mdctl, mdstat_mask;
-        if (id < 0)
-                return;
        mdctl = davinci_readl(DAVINCI_PWR_SLEEP_CNTRL_BASE + MDCTL + 4 * id);
        if (enable)
                mdctl |= 0x00000003;    /* Enable Module */
diff --git a/arch/arm/mach-mx3/pcm037.c b/arch/arm/mach-mx3/pcm037.c
index 0a152ed15a85..df8582a6231b 100644
--- a/arch/arm/mach-mx3/pcm037.c
+++ b/arch/arm/mach-mx3/pcm037.c
@@ -54,7 +54,7 @@ static struct platform_device pcm037_flash = {
 };
 static struct imxuart_platform_data uart_pdata = {
-        .flags = 0,
+        .flags = IMXUART_HAVE_RTSCTS,
 };
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm/mach-pxa/time.c b/arch/arm/mach-pxa/time.c
index 67e18509d7bf..b0d6b32654cf 100644
--- a/arch/arm/mach-pxa/time.c
+++ b/arch/arm/mach-pxa/time.c
@@ -17,9 +17,9 @@
 #include <linux/interrupt.h>
 #include <linux/clockchips.h>
 #include <linux/sched.h>
+#include <linux/cnt32_to_63.h>
 #include <asm/div64.h>
-#include <asm/cnt32_to_63.h>
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 #include <mach/pxa-regs.h>
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index 5dab30eafddc..9f3ef9eb32e3 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -50,6 +50,7 @@
 #include <asm/mach/sharpsl_param.h>
 #include "generic.h"
+#include "clock.h"
 #include "devices.h"
 static unsigned long tosa_pin_config[] = {
@@ -521,6 +522,14 @@ static struct gpio_keys_button tosa_gpio_keys[] = {
                .wakeup = 1,
                .active_low = 1,
        },
+        {
+                .type   = EV_SW,
+                .code   = SW_HEADPHONE_INSERT,
+                .gpio   = TOSA_GPIO_EAR_IN,
+                .desc   = "HeadPhone insert",
+                .active_low = 1,
+                .debounce_interval = 300,
+        },
 };
 static struct gpio_keys_platform_data tosa_gpio_keys_platform_data = {
@@ -792,6 +801,8 @@ static void __init tosa_init(void)
        pxa_set_i2c_info(NULL);
        platform_scoop_config = &tosa_pcmcia_config;
+        clk_add_alias("CLK_CK3P6MI", &tc6393xb_device.dev, "GPIO11_CLK", NULL);
        platform_add_devices(devices, ARRAY_SIZE(devices));
 }
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 1362994c78aa..b422526f6d8b 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -18,9 +18,9 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>        /* just for sched_clock() - funny that */
 #include <linux/platform_device.h>
+#include <linux/cnt32_to_63.h>
 #include <asm/div64.h>
-#include <asm/cnt32_to_63.h>
 #include <mach/hardware.h>
 #include <asm/system.h>
 #include <asm/pgtable.h>
diff --git a/arch/arm/mach-sa1100/include/mach/jornada720.h b/arch/arm/mach-sa1100/include/mach/jornada720.h
index bc120850d313..cc6b4bfcecf6 100644
--- a/arch/arm/mach-sa1100/include/mach/jornada720.h
+++ b/arch/arm/mach-sa1100/include/mach/jornada720.h
@@ -1,10 +1,10 @@
 /*
 * arch/arm/mach-sa1100/include/mach/jornada720.h
 *
- * This file contains SSP/MCU communication definitions for HP Jornada 710/720/728
+ * SSP/MCU communication definitions for HP Jornada 710/720/728
 *
- * Copyright (C) 2007 Kristoffer Ericson <Kristoffer.Ericson@gmail.com>
+ * Copyright 2007,2008 Kristoffer Ericson <Kristoffer.Ericson@gmail.com>
- *  Copyright (C) 2000 John Ankcorn <jca@lcs.mit.edu>
+ *  Copyright 2000 John Ankcorn <jca@lcs.mit.edu>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -25,3 +25,8 @@
 #define PWMOFF                  0xDF
 #define TXDUMMY                 0x11
 #define ERRORCODE               0x00
+extern void jornada_ssp_start(void);
+extern void jornada_ssp_end(void);
+extern int jornada_ssp_inout(u8 byte);
+extern int jornada_ssp_byte(u8 byte);
diff --git a/arch/arm/mach-sa1100/jornada720_ssp.c b/arch/arm/mach-sa1100/jornada720_ssp.c
index 06ea7abd9170..28cf36967977 100644
--- a/arch/arm/mach-sa1100/jornada720_ssp.c
+++ b/arch/arm/mach-sa1100/jornada720_ssp.c
@@ -21,8 +21,8 @@
 #include <linux/slab.h>
 #include <mach/hardware.h>
-#include <asm/hardware/ssp.h>
 #include <mach/jornada720.h>
+#include <asm/hardware/ssp.h>
 static DEFINE_SPINLOCK(jornada_ssp_lock);
 static unsigned long jornada_ssp_flags;
@@ -109,12 +109,12 @@ EXPORT_SYMBOL(jornada_ssp_inout);
 * jornada_ssp_start - enable mcu
 *
 */
-int jornada_ssp_start()
+void jornada_ssp_start(void)
 {
        spin_lock_irqsave(&jornada_ssp_lock, jornada_ssp_flags);
        GPCR = GPIO_GPIO25;
        udelay(50);
-        return 0;
+        return;
 };
 EXPORT_SYMBOL(jornada_ssp_start);
@@ -122,11 +122,11 @@ EXPORT_SYMBOL(jornada_ssp_start);
 * jornada_ssp_end - disable mcu and turn off lock
 *
 */
-int jornada_ssp_end()
+void jornada_ssp_end(void)
 {
        GPSR = GPIO_GPIO25;
        spin_unlock_irqrestore(&jornada_ssp_lock, jornada_ssp_flags);
-        return 0;
+        return;
 };
 EXPORT_SYMBOL(jornada_ssp_end);
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index d75e795c893e..b638f10411e8 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -28,8 +28,8 @@
 #include <linux/amba/clcd.h>
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
+#include <linux/cnt32_to_63.h>
-#include <asm/cnt32_to_63.h>
 #include <asm/system.h>
 #include <mach/hardware.h>
 #include <asm/io.h>
diff --git a/arch/arm/plat-omap/devices.c b/arch/arm/plat-omap/devices.c
index 187e3d8bfdfe..01da719a7453 100644
--- a/arch/arm/plat-omap/devices.c
+++ b/arch/arm/plat-omap/devices.c
@@ -21,6 +21,7 @@
 #include <mach/tc.h>
 #include <mach/board.h>
+#include <mach/mmc.h>
 #include <mach/mux.h>
 #include <mach/gpio.h>
 #include <mach/menelaus.h>
@@ -194,25 +195,38 @@ void omap_mcbsp_register_board_cfg(struct omap_mcbsp_platform_data *config,
 /*-------------------------------------------------------------------------*/
-#if     defined(CONFIG_MMC_OMAP) || defined(CONFIG_MMC_OMAP_MODULE)
+#if     defined(CONFIG_MMC_OMAP) || defined(CONFIG_MMC_OMAP_MODULE) || \
+        defined(CONFIG_MMC_OMAP_HS) || defined(CONFIG_MMC_OMAP_HS_MODULE)
-#ifdef CONFIG_ARCH_OMAP24XX
+#if defined(CONFIG_ARCH_OMAP24XX) || defined(CONFIG_ARCH_OMAP34XX)
 #define OMAP_MMC1_BASE          0x4809c000
-#define OMAP_MMC1_INT           INT_24XX_MMC_IRQ
+#define OMAP_MMC1_END           (OMAP_MMC1_BASE + 0x1fc)
+#define OMAP_MMC1_INT           INT_24XX_MMC_IRQ
+#define OMAP_MMC2_BASE          0x480b4000
+#define OMAP_MMC2_END           (OMAP_MMC2_BASE + 0x1fc)
+#define OMAP_MMC2_INT           INT_24XX_MMC2_IRQ
 #else
 #define OMAP_MMC1_BASE          0xfffb7800
+#define OMAP_MMC1_END           (OMAP_MMC1_BASE + 0x7f)
 #define OMAP_MMC1_INT           INT_MMC
-#endif
 #define OMAP_MMC2_BASE          0xfffb7c00      /* omap16xx only */
+#define OMAP_MMC2_END           (OMAP_MMC2_BASE + 0x7f)
+#define OMAP_MMC2_INT           INT_1610_MMC2
+#endif
-static struct omap_mmc_conf mmc1_conf;
+static struct omap_mmc_platform_data mmc1_data;
 static u64 mmc1_dmamask = 0xffffffff;
 static struct resource mmc1_resources[] = {
        {
                .start          = OMAP_MMC1_BASE,
-                .end            = OMAP_MMC1_BASE + 0x7f,
+                .end            = OMAP_MMC1_END,
                .flags          = IORESOURCE_MEM,
        },
        {
@@ -226,26 +240,27 @@ static struct platform_device mmc_omap_device1 = {
        .id             = 1,
        .dev = {
                .dma_mask       = &mmc1_dmamask,
-                .platform_data  = &mmc1_conf,
+                .platform_data  = &mmc1_data,
        },
        .num_resources  = ARRAY_SIZE(mmc1_resources),
        .resource       = mmc1_resources,
 };
-#ifdef  CONFIG_ARCH_OMAP16XX
+#if defined(CONFIG_ARCH_OMAP16XX) || defined(CONFIG_ARCH_OMAP2430) || \
+        defined(CONFIG_ARCH_OMAP34XX)
-static struct omap_mmc_conf mmc2_conf;
+static struct omap_mmc_platform_data mmc2_data;
 static u64 mmc2_dmamask = 0xffffffff;
 static struct resource mmc2_resources[] = {
        {
                .start          = OMAP_MMC2_BASE,
-                .end            = OMAP_MMC2_BASE + 0x7f,
+                .end            = OMAP_MMC2_END,
                .flags          = IORESOURCE_MEM,
        },
        {
-                .start          = INT_1610_MMC2,
+                .start          = OMAP_MMC2_INT,
                .flags          = IORESOURCE_IRQ,
        },
 };
@@ -255,26 +270,19 @@ static struct platform_device mmc_omap_device2 = {
        .id             = 2,
        .dev = {
                .dma_mask       = &mmc2_dmamask,
-                .platform_data  = &mmc2_conf,
+                .platform_data  = &mmc2_data,
        },
        .num_resources  = ARRAY_SIZE(mmc2_resources),
        .resource       = mmc2_resources,
 };
 #endif
-static void __init omap_init_mmc(void)
+static inline void omap_init_mmc_conf(const struct omap_mmc_config *mmc_conf)
 {
-        const struct omap_mmc_config    *mmc_conf;
+        if (cpu_is_omap2430() || cpu_is_omap34xx())
-        const struct omap_mmc_conf      *mmc;
-        /* NOTE:  assumes MMC was never (wrongly) enabled */
-        mmc_conf = omap_get_config(OMAP_TAG_MMC, struct omap_mmc_config);
-        if (!mmc_conf)
                return;
-        /* block 1 is always available and has just one pinout option */
+        if (mmc_conf->mmc[0].enabled) {
-        mmc = &mmc_conf->mmc[0];
-        if (mmc->enabled) {
                if (cpu_is_omap24xx()) {
                        omap_cfg_reg(H18_24XX_MMC_CMD);
                        omap_cfg_reg(H15_24XX_MMC_CLKI);
@@ -292,7 +300,7 @@ static void __init omap_init_mmc(void)
                                omap_cfg_reg(P20_1710_MMC_DATDIR0);
                        }
                }
-                if (mmc->wire4) {
+                if (mmc_conf->mmc[0].wire4) {
                        if (cpu_is_omap24xx()) {
                                omap_cfg_reg(H14_24XX_MMC_DAT1);
                                omap_cfg_reg(E19_24XX_MMC_DAT2);
@@ -303,25 +311,22 @@ static void __init omap_init_mmc(void)
                        } else {
                                omap_cfg_reg(MMC_DAT1);
                                /* NOTE:  DAT2 can be on W10 (here) or M15 */
-                                if (!mmc->nomux)
+                                if (!mmc_conf->mmc[0].nomux)
                                        omap_cfg_reg(MMC_DAT2);
                                omap_cfg_reg(MMC_DAT3);
                        }
                }
-                mmc1_conf = *mmc;
-                (void) platform_device_register(&mmc_omap_device1);
        }
 #ifdef  CONFIG_ARCH_OMAP16XX
        /* block 2 is on newer chips, and has many pinout options */
-        mmc = &mmc_conf->mmc[1];
+        if (mmc_conf->mmc[1].enabled) {
-        if (mmc->enabled) {
+                if (!mmc_conf->mmc[1].nomux) {
-                if (!mmc->nomux) {
                        omap_cfg_reg(Y8_1610_MMC2_CMD);
                        omap_cfg_reg(Y10_1610_MMC2_CLK);
                        omap_cfg_reg(R18_1610_MMC2_CLKIN);
                        omap_cfg_reg(W8_1610_MMC2_DAT0);
-                        if (mmc->wire4) {
+                        if (mmc_conf->mmc[1].wire4) {
                                omap_cfg_reg(V8_1610_MMC2_DAT1);
                                omap_cfg_reg(W15_1610_MMC2_DAT2);
                                omap_cfg_reg(R10_1610_MMC2_DAT3);
@@ -337,14 +342,55 @@ static void __init omap_init_mmc(void)
                if (cpu_is_omap1710())
                        omap_writel(omap_readl(MOD_CONF_CTRL_1) | (1 << 24),
                                     MOD_CONF_CTRL_1);
-                mmc2_conf = *mmc;
+        }
+#endif
+}
+static void __init omap_init_mmc(void)
+{
+        const struct omap_mmc_config    *mmc_conf;
+        /* NOTE:  assumes MMC was never (wrongly) enabled */
+        mmc_conf = omap_get_config(OMAP_TAG_MMC, struct omap_mmc_config);
+        if (!mmc_conf)
+                return;
+        omap_init_mmc_conf(mmc_conf);
+        if (mmc_conf->mmc[0].enabled) {
+                mmc1_data.conf = mmc_conf->mmc[0];
+                (void) platform_device_register(&mmc_omap_device1);
+        }
+#if defined(CONFIG_ARCH_OMAP16XX) || defined(CONFIG_ARCH_OMAP2430) || \
+        defined(CONFIG_ARCH_OMAP34XX)
+        if (mmc_conf->mmc[1].enabled) {
+                mmc2_data.conf = mmc_conf->mmc[1];
                (void) platform_device_register(&mmc_omap_device2);
        }
 #endif
-        return;
 }
+void omap_set_mmc_info(int host, const struct omap_mmc_platform_data *info)
+{
+        switch (host) {
+        case 1:
+                mmc1_data = *info;
+                break;
+#if defined(CONFIG_ARCH_OMAP16XX) || defined(CONFIG_ARCH_OMAP2430) || \
+        defined(CONFIG_ARCH_OMAP34XX)
+        case 2:
+                mmc2_data = *info;
+                break;
+#endif
+        default:
+                BUG();
+        }
+}
 #else
 static inline void omap_init_mmc(void) {}
+void omap_set_mmc_info(int host, const struct omap_mmc_platform_data *info) {}
 #endif
 /*-------------------------------------------------------------------------*/
diff --git a/arch/avr32/boards/atstk1000/atstk1002.c b/arch/avr32/boards/atstk1000/atstk1002.c
index ee4c292683e1..dfc3443e23aa 100644
--- a/arch/avr32/boards/atstk1000/atstk1002.c
+++ b/arch/avr32/boards/atstk1000/atstk1002.c
@@ -325,7 +325,7 @@ static int __init atstk1002_init(void)
 #ifdef CONFIG_BOARD_ATSTK100X_SPI1
        at32_add_device_spi(1, spi1_board_info, ARRAY_SIZE(spi1_board_info));
 #endif
-#ifndef CONFIG_BOARD_ATSTK1002_SW2_CUSTOM
+#ifndef CONFIG_BOARD_ATSTK100X_SW2_CUSTOM
        at32_add_device_mci(0, MCI_PDATA);
 #endif
 #ifdef CONFIG_BOARD_ATSTK1002_SW5_CUSTOM
diff --git a/arch/avr32/boot/images/.gitignore b/arch/avr32/boot/images/.gitignore
new file mode 100644
index 000000000000..64ea9d0141d2
--- /dev/null
+++ b/arch/avr32/boot/images/.gitignore
@@ -0,0 +1,4 @@
+uImage
+uImage.srec
+vmlinux.cso
+sfdwarf.log
diff --git a/arch/avr32/kernel/.gitignore b/arch/avr32/kernel/.gitignore
new file mode 100644
index 000000000000..c5f676c3c224
--- /dev/null
+++ b/arch/avr32/kernel/.gitignore
@@ -0,0 +1 @@
+vmlinux.lds
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index 84a7d44edc67..11e310c567a9 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -58,6 +58,7 @@ EXPORT_SYMBOL(find_first_zero_bit);
 EXPORT_SYMBOL(find_next_zero_bit);
 EXPORT_SYMBOL(find_first_bit);
 EXPORT_SYMBOL(find_next_bit);
+EXPORT_SYMBOL(generic_find_next_le_bit);
 EXPORT_SYMBOL(generic_find_next_zero_le_bit);
 /* I/O primitives (lib/io-*.S) */
diff --git a/arch/avr32/kernel/syscall-stubs.S b/arch/avr32/kernel/syscall-stubs.S
index 890286a1e62b..673178e235f3 100644
--- a/arch/avr32/kernel/syscall-stubs.S
+++ b/arch/avr32/kernel/syscall-stubs.S
@@ -109,3 +109,12 @@ __sys_epoll_pwait:
        rcall   sys_epoll_pwait
        sub     sp, -4
        popm    pc
+        .global __sys_sync_file_range
+        .type   __sys_sync_file_range,@function
+__sys_sync_file_range:
+        pushm   lr
+        st.w    --sp, ARG6
+        rcall   sys_sync_file_range
+        sub     sp, -4
+        popm    pc
diff --git a/arch/avr32/kernel/syscall_table.S b/arch/avr32/kernel/syscall_table.S
index 478bda4c4a09..7ee0057613b3 100644
--- a/arch/avr32/kernel/syscall_table.S
+++ b/arch/avr32/kernel/syscall_table.S
@@ -275,7 +275,7 @@ sys_call_table:
        .long   sys_set_robust_list
        .long   sys_get_robust_list     /* 260 */
        .long   __sys_splice
-        .long   sys_sync_file_range
+        .long   __sys_sync_file_range
        .long   sys_tee
        .long   sys_vmsplice
        .long   __sys_epoll_pwait       /* 265 */
diff --git a/arch/avr32/kernel/traps.c b/arch/avr32/kernel/traps.c
index b835c4c01368..0d987373bc01 100644
--- a/arch/avr32/kernel/traps.c
+++ b/arch/avr32/kernel/traps.c
@@ -116,15 +116,15 @@ asmlinkage void do_nmi(unsigned long ecr, struct pt_regs *regs)
        switch (ret) {
        case NOTIFY_OK:
        case NOTIFY_STOP:
-                return;
+                break;
        case NOTIFY_BAD:
                die("Fatal Non-Maskable Interrupt", regs, SIGINT);
        default:
+                printk(KERN_ALERT "Got NMI, but nobody cared. Disabling...\n");
+                nmi_disable();
                break;
        }
+        nmi_exit();
-        printk(KERN_ALERT "Got NMI, but nobody cared. Disabling...\n");
-        nmi_disable();
 }
 asmlinkage void do_critical_exception(unsigned long ecr, struct pt_regs *regs)
diff --git a/arch/avr32/lib/findbit.S b/arch/avr32/lib/findbit.S
index c6b91dee857c..997b33b2288a 100644
--- a/arch/avr32/lib/findbit.S
+++ b/arch/avr32/lib/findbit.S
@@ -123,6 +123,36 @@ ENTRY(find_next_bit)
        brgt    1b
        retal   r11
+ENTRY(generic_find_next_le_bit)
+        lsr     r8, r10, 5
+        sub     r9, r11, r10
+        retle   r11
+        lsl     r8, 2
+        add     r12, r8
+        andl    r10, 31, COH
+        breq    1f
+        /* offset is not word-aligned. Handle the first (32 - r10) bits */
+        ldswp.w r8, r12[0]
+        sub     r12, -4
+        lsr     r8, r8, r10
+        brne    .L_found
+        /* r9 = r9 - (32 - r10) = r9 + r10 - 32 */
+        add     r9, r10
+        sub     r9, 32
+        retle   r11
+        /* Main loop. offset must be word-aligned */
+1:      ldswp.w r8, r12[0]
+        cp.w    r8, 0
+        brne    .L_found
+        sub     r12, -4
+        sub     r9, 32
+        brgt    1b
+        retal   r11
 ENTRY(generic_find_next_zero_le_bit)
        lsr     r8, r10, 5
        sub     r9, r11, r10
diff --git a/arch/ia64/include/asm/dma-mapping.h b/arch/ia64/include/asm/dma-mapping.h
index 9f0df9bd46b7..06ff1ba21465 100644
--- a/arch/ia64/include/asm/dma-mapping.h
+++ b/arch/ia64/include/asm/dma-mapping.h
@@ -8,7 +8,9 @@
 #include <asm/machvec.h>
 #include <linux/scatterlist.h>
-#define dma_alloc_coherent      platform_dma_alloc_coherent
+#define dma_alloc_coherent(dev, size, handle, gfp)      \
+        platform_dma_alloc_coherent(dev, size, handle, (gfp) | GFP_DMA)
 /* coherent mem. is cheap */
 static inline void *
 dma_alloc_noncoherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
index 5e0c1a6bce8d..2acb6b6543c9 100644
--- a/arch/ia64/include/asm/elf.h
+++ b/arch/ia64/include/asm/elf.h
@@ -266,4 +266,19 @@ do {									\
        }                                                               \
 } while (0)
+/*
+ * format for entries in the Global Offset Table
+ */
+struct got_entry {
+        uint64_t val;
+};
+/*
+ * Layout of the Function Descriptor
+ */
+struct fdesc {
+        uint64_t ip;
+        uint64_t gp;
+};
 #endif /* _ASM_IA64_ELF_H */
diff --git a/arch/ia64/include/asm/sections.h b/arch/ia64/include/asm/sections.h
index a7acad2bc2f0..1a873b36a4a1 100644
--- a/arch/ia64/include/asm/sections.h
+++ b/arch/ia64/include/asm/sections.h
@@ -6,9 +6,14 @@
 *      David Mosberger-Tang <davidm@hpl.hp.com>
 */
+#include <linux/elf.h>
+#include <linux/uaccess.h>
 #include <asm-generic/sections.h>
 extern char __per_cpu_start[], __per_cpu_end[], __phys_per_cpu_start[];
+#ifdef  CONFIG_SMP
+extern char __cpu0_per_cpu[];
+#endif
 extern char __start___vtop_patchlist[], __end___vtop_patchlist[];
 extern char __start___rse_patchlist[], __end___rse_patchlist[];
 extern char __start___mckinley_e9_bundles[], __end___mckinley_e9_bundles[];
@@ -22,7 +27,16 @@ extern char __start_unwind[], __end_unwind[];
 extern char __start_ivt_text[], __end_ivt_text[];
 #undef dereference_function_descriptor
-void *dereference_function_descriptor(void *);
+static inline void *dereference_function_descriptor(void *ptr)
+{
+        struct fdesc *desc = ptr;
+        void *p;
+        if (!probe_kernel_address(&desc->ip, p))
+                ptr = p;
+        return ptr;
+}
 #endif /* _ASM_IA64_SECTIONS_H */
diff --git a/arch/ia64/include/asm/sn/bte.h b/arch/ia64/include/asm/sn/bte.h
index a0d214f43115..5efecf06c9a4 100644
--- a/arch/ia64/include/asm/sn/bte.h
+++ b/arch/ia64/include/asm/sn/bte.h
@@ -223,10 +223,11 @@ extern void bte_error_handler(unsigned long);
 * until the transfer is complete.  In order to get the asynch
 * version of bte_copy, you must perform this check yourself.
 */
-#define BTE_UNALIGNED_COPY(src, dest, len, mode)                        \
+#define BTE_UNALIGNED_COPY(src, dest, len, mode)                        \
-        (((len & L1_CACHE_MASK) || (src & L1_CACHE_MASK) ||             \
+        (((len & (L1_CACHE_BYTES - 1)) ||                               \
-          (dest & L1_CACHE_MASK)) ?                                     \
+          (src & (L1_CACHE_BYTES - 1)) ||                               \
-         bte_unaligned_copy(src, dest, len, mode) :                     \
+          (dest & (L1_CACHE_BYTES - 1))) ?                              \
+         bte_unaligned_copy(src, dest, len, mode) :                     \
         bte_copy(src, dest, len, mode, NULL))
diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
index d45f215bc8fc..51b75cea7018 100644
--- a/arch/ia64/kernel/efi.c
+++ b/arch/ia64/kernel/efi.c
@@ -1232,9 +1232,10 @@ efi_initialize_iomem_resources(struct resource *code_resource,
                                if (md->attribute & EFI_MEMORY_WP) {
                                        name = "System ROM";
                                        flags |= IORESOURCE_READONLY;
-                                } else {
+                                } else if (md->attribute == EFI_MEMORY_UC)
+                                        name = "Uncached RAM";
+                                else
                                        name = "System RAM";
-                                }
                                break;
                        case EFI_ACPI_MEMORY_NVS:
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 8bdea8eb62e3..66e491d8baac 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -367,16 +367,17 @@ start_ap:
        ;;
 #else
 (isAP)  br.few 2f
-        mov r20=r19
+        movl r20=__cpu0_per_cpu
-        sub r19=r19,r18
        ;;
        shr.u r18=r18,3
 1:
-        ld8 r21=[r20],8;;
+        ld8 r21=[r19],8;;
-        st8[r19]=r21,8
+        st8[r20]=r21,8
        adds r18=-1,r18;;
        cmp4.lt p7,p6=0,r18
 (p7)    br.cond.dptk.few 1b
+        mov r19=r20
+        ;;
 2:
 #endif
        tpa r19=r19
diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index 545626f66a4c..aaa7d901521f 100644
--- a/arch/ia64/kernel/module.c
+++ b/arch/ia64/kernel/module.c
@@ -31,11 +31,9 @@
 #include <linux/elf.h>
 #include <linux/moduleloader.h>
 #include <linux/string.h>
-#include <linux/uaccess.h>
 #include <linux/vmalloc.h>
 #include <asm/patch.h>
-#include <asm/sections.h>
 #include <asm/unaligned.h>
 #define ARCH_MODULE_DEBUG 0
@@ -137,15 +135,6 @@ static const char *reloc_name[256] = {
 #undef N
-struct got_entry {
-        uint64_t val;
-};
-struct fdesc {
-        uint64_t ip;
-        uint64_t gp;
-};
 /* Opaque struct for insns, to protect against derefs. */
 struct insn;
@@ -943,13 +932,3 @@ module_arch_cleanup (struct module *mod)
        if (mod->arch.core_unw_table)
                unw_remove_unwind_table(mod->arch.core_unw_table);
 }
-void *dereference_function_descriptor(void *ptr)
-{
-        struct fdesc *desc = ptr;
-        void *p;
-        if (!probe_kernel_address(&desc->ip, p))
-                ptr = p;
-        return ptr;
-}
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index c27d5b2c182b..de636b215677 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -616,7 +616,9 @@ setup_arch (char **cmdline_p)
                ia64_mca_init();
        platform_setup(cmdline_p);
+#ifndef CONFIG_IA64_HP_SIM
        check_sal_cache_flush();
+#endif
        paging_init();
 }
diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c
index bcea81e432fd..d8f05e504fbf 100644
--- a/arch/ia64/kernel/smpboot.c
+++ b/arch/ia64/kernel/smpboot.c
@@ -741,16 +741,14 @@ int __cpu_disable(void)
                        return -EBUSY;
        }
-        cpu_clear(cpu, cpu_online_map);
        if (migrate_platform_irqs(cpu)) {
                cpu_set(cpu, cpu_online_map);
                return (-EBUSY);
        }
        remove_siblinginfo(cpu);
-        cpu_clear(cpu, cpu_online_map);
        fixup_irqs();
+        cpu_clear(cpu, cpu_online_map);
        local_flush_tlb_all();
        cpu_clear(cpu, cpu_callin_map);
        return 0;
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index de71da811cd6..10a7d47e8510 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -215,9 +215,6 @@ SECTIONS
  /* Per-cpu data: */
  percpu : { } :percpu
  . = ALIGN(PERCPU_PAGE_SIZE);
-#ifdef  CONFIG_SMP
-  . = . + PERCPU_PAGE_SIZE;     /* cpu0 per-cpu space */
-#endif
  __phys_per_cpu_start = .;
  .data.percpu PERCPU_ADDR : AT(__phys_per_cpu_start - LOAD_OFFSET)
        {
@@ -233,6 +230,11 @@ SECTIONS
  data : { } :data
  .data : AT(ADDR(.data) - LOAD_OFFSET)
        {
+#ifdef  CONFIG_SMP
+  . = ALIGN(PERCPU_PAGE_SIZE);
+                __cpu0_per_cpu = .;
+  . = . + PERCPU_PAGE_SIZE;     /* cpu0 per-cpu space */
+#endif
                DATA_DATA
                *(.data1)
                *(.gnu.linkonce.d*)
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index 7a37d06376be..cd0d1a7284b7 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -38,6 +38,7 @@
 #include <asm/cacheflush.h>
 #include <asm/div64.h>
 #include <asm/tlb.h>
+#include <asm/elf.h>
 #include "misc.h"
 #include "vti.h"
@@ -61,12 +62,6 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
        { NULL }
 };
-struct fdesc{
-    unsigned long ip;
-    unsigned long gp;
-};
 static void kvm_flush_icache(unsigned long start, unsigned long len)
 {
        int l;
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index e566ff43884a..0ee085efbe29 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -163,7 +163,7 @@ per_cpu_init (void)
         * get_zeroed_page().
         */
        if (first_time) {
-                void *cpu0_data = __phys_per_cpu_start - PERCPU_PAGE_SIZE;
+                void *cpu0_data = __cpu0_per_cpu;
                first_time=0;
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index 78026aabaa7f..d8c5fcd89e5b 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -144,7 +144,7 @@ static void *per_cpu_node_setup(void *cpu_data, int node)
        for_each_possible_early_cpu(cpu) {
                if (cpu == 0) {
-                        void *cpu0_data = __phys_per_cpu_start - PERCPU_PAGE_SIZE;
+                        void *cpu0_data = __cpu0_per_cpu;
                        __per_cpu_offset[cpu] = (char*)cpu0_data -
                                __per_cpu_start;
                } else if (node == node_cpuid[cpu].nid) {
diff --git a/arch/ia64/sn/pci/tioca_provider.c b/arch/ia64/sn/pci/tioca_provider.c
index 529462c01570..79165122501c 100644
--- a/arch/ia64/sn/pci/tioca_provider.c
+++ b/arch/ia64/sn/pci/tioca_provider.c
@@ -420,8 +420,10 @@ tioca_dma_mapped(struct pci_dev *pdev, u64 paddr, size_t req_size)
                entry = find_next_zero_bit(map, mapsize, last_entry);
        }
-        if (entry > mapsize)
+        if (entry > mapsize) {
+                kfree(ca_dmamap);
                goto map_return;
+        }
        for (i = 0; i < entries; i++)
                set_bit(entry + i, map);
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index a5f864c445b2..f57113f1f892 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -216,10 +216,6 @@ config MEMORY_SIZE
        default "01000000" if PLAT_M32104UT
        default "00800000" if PLAT_OAKS32R
-config NOHIGHMEM
-        bool
-        default y
 config ARCH_DISCONTIGMEM_ENABLE
        bool "Internal RAM Support"
        depends on CHIP_M32700 || CHIP_M32102 || CHIP_VDEC2 || CHIP_OPSP || CHIP_M32104
@@ -410,11 +406,7 @@ config PCI_DIRECT
 source "drivers/pci/Kconfig"
 config ISA
-        bool "ISA support"
+        bool
-        help
-          Find out whether you have ISA slots on your motherboard.  ISA is the
-          name of a bus system, i.e. the way the CPU talks to the other stuff
-          inside your box.  If you have ISA, say Y, otherwise N.
 source "drivers/pcmcia/Kconfig"
diff --git a/arch/m32r/kernel/entry.S b/arch/m32r/kernel/entry.S
index d4eaa2fd1818..612d35b082a6 100644
--- a/arch/m32r/kernel/entry.S
+++ b/arch/m32r/kernel/entry.S
@@ -143,7 +143,7 @@ ret_from_intr:
        and3    r4, r4, #0x8000         ; check BSM bit
 #endif
        beqz    r4, resume_kernel
-ENTRY(resume_userspace)
+resume_userspace:
        DISABLE_INTERRUPTS(r4)          ; make sure we don't miss an interrupt
                                        ; setting need_resched or sigpending
                                        ; between sampling and the iret
diff --git a/arch/m32r/kernel/head.S b/arch/m32r/kernel/head.S
index dab7436d7bbe..40180778a5c7 100644
--- a/arch/m32r/kernel/head.S
+++ b/arch/m32r/kernel/head.S
@@ -29,7 +29,6 @@ __INITDATA
        .global _end
 ENTRY(stext)
 ENTRY(_stext)
-ENTRY(startup_32)
        /* Setup up the stack pointer */
        LDIMM   (r0, spi_stack_top)
        LDIMM   (r1, spu_stack_top)
diff --git a/arch/m32r/kernel/irq.c b/arch/m32r/kernel/irq.c
index d0c5b0b7da2f..2aeae4670098 100644
--- a/arch/m32r/kernel/irq.c
+++ b/arch/m32r/kernel/irq.c
@@ -22,9 +22,6 @@
 #include <linux/module.h>
 #include <asm/uaccess.h>
-atomic_t irq_err_count;
-atomic_t irq_mis_count;
 /*
 * Generic, controller-independent functions:
 */
@@ -63,9 +60,6 @@ int show_interrupts(struct seq_file *p, void *v)
                seq_putc(p, '\n');
 skip:
                spin_unlock_irqrestore(&irq_desc[i].lock, flags);
-        } else if (i == NR_IRQS) {
-                seq_printf(p, "ERR: %10u\n", atomic_read(&irq_err_count));
-                seq_printf(p, "MIS: %10u\n", atomic_read(&irq_mis_count));
        }
        return 0;
 }
diff --git a/arch/m32r/kernel/m32r_ksyms.c b/arch/m32r/kernel/m32r_ksyms.c
index 16bcb189a383..22624b51d4d3 100644
--- a/arch/m32r/kernel/m32r_ksyms.c
+++ b/arch/m32r/kernel/m32r_ksyms.c
@@ -14,6 +14,7 @@
 #include <asm/delay.h>
 #include <asm/irq.h>
 #include <asm/tlbflush.h>
+#include <asm/pgtable.h>
 /* platform dependent support */
 EXPORT_SYMBOL(boot_cpu_data);
@@ -65,6 +66,7 @@ EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(clear_page);
 EXPORT_SYMBOL(strlen);
+EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(_inb);
 EXPORT_SYMBOL(_inw);
diff --git a/arch/m32r/kernel/process.c b/arch/m32r/kernel/process.c
index a689e2978b6e..5be4faaf5b1c 100644
--- a/arch/m32r/kernel/process.c
+++ b/arch/m32r/kernel/process.c
@@ -35,8 +35,6 @@
 #include <linux/err.h>
-static int hlt_counter=0;
 /*
 * Return saved PC of a blocked thread.
 */
@@ -48,31 +46,16 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
 /*
 * Powermanagement idle function, if any..
 */
-void (*pm_idle)(void) = NULL;
+static void (*pm_idle)(void) = NULL;
-EXPORT_SYMBOL(pm_idle);
 void (*pm_power_off)(void) = NULL;
 EXPORT_SYMBOL(pm_power_off);
-void disable_hlt(void)
-{
-        hlt_counter++;
-}
-EXPORT_SYMBOL(disable_hlt);
-void enable_hlt(void)
-{
-        hlt_counter--;
-}
-EXPORT_SYMBOL(enable_hlt);
 /*
 * We use this is we don't have any better
 * idle routine..
 */
-void default_idle(void)
+static void default_idle(void)
 {
        /* M32R_FIXME: Please use "cpu_sleep" mode.  */
        cpu_relax();
@@ -260,15 +243,6 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long spu,
        return 0;
 }
-/*
- * Capture the user space registers if the task is not running (in user space)
- */
-int dump_task_regs(struct task_struct *tsk, elf_gregset_t *regs)
-{
-        /* M32R_FIXME */
-        return 1;
-}
 asmlinkage int sys_fork(unsigned long r0, unsigned long r1, unsigned long r2,
        unsigned long r3, unsigned long r4, unsigned long r5, unsigned long r6,
        struct pt_regs regs)
diff --git a/arch/m32r/kernel/smp.c b/arch/m32r/kernel/smp.c
index 7577f971ea4e..929e5c9d3ad9 100644
--- a/arch/m32r/kernel/smp.c
+++ b/arch/m32r/kernel/smp.c
@@ -84,7 +84,7 @@ void smp_send_timer(void);
 void smp_ipi_timer_interrupt(struct pt_regs *);
 void smp_local_timer_interrupt(void);
-void send_IPI_allbutself(int, int);
+static void send_IPI_allbutself(int, int);
 static void send_IPI_mask(cpumask_t, int, int);
 unsigned long send_IPI_mask_phys(cpumask_t, int, int);
@@ -722,7 +722,7 @@ void smp_local_timer_interrupt(void)
 * ---------- --- --------------------------------------------------------
 *
 *==========================================================================*/
-void send_IPI_allbutself(int ipi_num, int try)
+static void send_IPI_allbutself(int ipi_num, int try)
 {
        cpumask_t cpumask;
diff --git a/arch/m32r/kernel/time.c b/arch/m32r/kernel/time.c
index 994cc1556355..6ea017727cce 100644
--- a/arch/m32r/kernel/time.c
+++ b/arch/m32r/kernel/time.c
@@ -34,7 +34,6 @@
 #include <asm/hw_irq.h>
 #ifdef CONFIG_SMP
-extern void send_IPI_allbutself(int, int);
 extern void smp_local_timer_interrupt(void);
 #endif
@@ -188,7 +187,7 @@ static long last_rtc_update = 0;
 * timer_interrupt() needs to keep up the real-time clock,
 * as well as call the "do_timer()" routine every clocktick
 */
-irqreturn_t timer_interrupt(int irq, void *dev_id)
+static irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
 #ifndef CONFIG_SMP
        profile_tick(CPU_PROFILING);
@@ -228,7 +227,7 @@ irqreturn_t timer_interrupt(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-struct irqaction irq0 = {
+static struct irqaction irq0 = {
        .handler = timer_interrupt,
        .flags = IRQF_DISABLED,
        .mask = CPU_MASK_NONE,
diff --git a/arch/m32r/kernel/traps.c b/arch/m32r/kernel/traps.c
index 46159a4e644b..03b14e55cd89 100644
--- a/arch/m32r/kernel/traps.c
+++ b/arch/m32r/kernel/traps.c
@@ -61,7 +61,7 @@ extern unsigned long	eit_vector[];
        ((unsigned long)func - (unsigned long)eit_vector - entry*4)/4 \
        + 0xff000000UL
-void    set_eit_vector_entries(void)
+static void set_eit_vector_entries(void)
 {
        extern void default_eit_handler(void);
        extern void system_call(void);
@@ -121,9 +121,9 @@ void __init trap_init(void)
        cpu_init();
 }
-int kstack_depth_to_print = 24;
+static int kstack_depth_to_print = 24;
-void show_trace(struct task_struct *task, unsigned long *stack)
+static void show_trace(struct task_struct *task, unsigned long *stack)
 {
        unsigned long addr;
@@ -224,7 +224,7 @@ bad:
        printk("\n");
 }
-DEFINE_SPINLOCK(die_lock);
+static DEFINE_SPINLOCK(die_lock);
 void die(const char * str, struct pt_regs * regs, long err)
 {
diff --git a/arch/m32r/lib/delay.c b/arch/m32r/lib/delay.c
index 59bfc34e0d9f..ced549be80f5 100644
--- a/arch/m32r/lib/delay.c
+++ b/arch/m32r/lib/delay.c
@@ -6,6 +6,7 @@
 */
 #include <linux/param.h>
+#include <linux/module.h>
 #ifdef CONFIG_SMP
 #include <linux/sched.h>
 #include <asm/current.h>
@@ -121,3 +122,4 @@ void __ndelay(unsigned long nsecs)
 {
        __const_udelay(nsecs * 0x00005);  /* 2**32 / 1000000000 (rounded up) */
 }
+EXPORT_SYMBOL(__ndelay);
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 8e2a0f5faf53..8bd61a640fc9 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:00 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -166,10 +172,6 @@ CONFIG_GENERIC_ISA_DMA=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_ZORRO_NAMES=y
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -183,6 +185,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -413,6 +416,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -432,7 +436,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -460,6 +466,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -470,6 +477,7 @@ CONFIG_BLK_DEV_IDE=y
 #
 # Please see Documentation/ide/ide.txt for help/info on IDE drives
 #
+CONFIG_IDE_ATAPI=y
 # CONFIG_BLK_DEV_IDE_SATA is not set
 CONFIG_BLK_DEV_IDEDISK=y
 # CONFIG_IDEDISK_MULTI_MODE is not set
@@ -489,8 +497,6 @@ CONFIG_BLK_DEV_GAYLE=y
 CONFIG_BLK_DEV_IDEDOUBLER=y
 CONFIG_BLK_DEV_BUDDHA=y
 # CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_BLK_DEV_HD_ONLY is not set
-# CONFIG_BLK_DEV_HD is not set
 #
 # SCSI device support
@@ -556,6 +562,7 @@ CONFIG_A2091_SCSI=y
 CONFIG_GVP11_SCSI=y
 CONFIG_SCSI_A4000T=y
 CONFIG_SCSI_ZORRO7XX=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -564,7 +571,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -573,13 +580,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -722,6 +725,7 @@ CONFIG_INPUT_M68K_BEEP=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -757,6 +761,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -768,8 +773,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -844,10 +851,6 @@ CONFIG_LOGO=y
 CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
-#
-# Sound
-#
 CONFIG_SOUND=m
 CONFIG_DMASOUND_PAULA=m
 CONFIG_DMASOUND=m
@@ -861,6 +864,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
@@ -899,6 +903,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -958,6 +963,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -980,7 +986,6 @@ CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=m
 CONFIG_SUNRPC_GSS=m
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=m
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -989,7 +994,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -1054,6 +1058,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1113,6 +1119,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1154,6 +1164,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index e2d511e2a1d1..c41b854c0284 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:01 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -161,10 +167,6 @@ CONFIG_HEARTBEAT=y
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -178,6 +180,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -411,6 +414,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -430,7 +434,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -448,6 +454,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -499,6 +506,7 @@ CONFIG_SCSI_SRP_TGT_ATTRS=y
 CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -507,7 +515,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -516,13 +524,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -532,7 +536,6 @@ CONFIG_VETH=m
 # CONFIG_PHYLIB is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
-CONFIG_APOLLO_ELPLUS=y
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
@@ -627,6 +630,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -657,6 +661,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -668,8 +673,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -738,10 +745,6 @@ CONFIG_LOGO=y
 CONFIG_LOGO_LINUX_MONO=y
 # CONFIG_LOGO_LINUX_VGA16 is not set
 # CONFIG_LOGO_LINUX_CLUT224 is not set
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -753,6 +756,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -789,6 +793,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -848,6 +853,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -860,18 +866,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -880,7 +885,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -944,6 +948,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1003,6 +1009,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1044,6 +1054,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 6e20d656adaf..654c5acb9e86 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:02 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -162,10 +168,6 @@ CONFIG_HEARTBEAT=y
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -179,6 +181,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -409,6 +412,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -428,7 +432,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -452,6 +458,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -462,6 +469,7 @@ CONFIG_BLK_DEV_IDE=y
 #
 # Please see Documentation/ide/ide.txt for help/info on IDE drives
 #
+CONFIG_IDE_ATAPI=y
 # CONFIG_BLK_DEV_IDE_SATA is not set
 CONFIG_BLK_DEV_IDEDISK=y
 # CONFIG_IDEDISK_MULTI_MODE is not set
@@ -479,8 +487,6 @@ CONFIG_IDE_PROC_FS=y
 # CONFIG_BLK_DEV_PLATFORM is not set
 CONFIG_BLK_DEV_FALCON_IDE=y
 # CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_BLK_DEV_HD_ONLY is not set
-# CONFIG_BLK_DEV_HD is not set
 #
 # SCSI device support
@@ -530,6 +536,7 @@ CONFIG_ISCSI_TCP=m
 CONFIG_ATARI_SCSI=y
 # CONFIG_ATARI_SCSI_TOSHIBA_DELAY is not set
 # CONFIG_ATARI_SCSI_RESET_BOOT is not set
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -538,7 +545,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -547,13 +554,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -666,6 +669,7 @@ CONFIG_SERIO_LIBPS2=y
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -700,6 +704,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -711,8 +716,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -782,10 +789,6 @@ CONFIG_LOGO=y
 CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
-#
-# Sound
-#
 CONFIG_SOUND=m
 CONFIG_DMASOUND_ATARI=m
 CONFIG_DMASOUND=m
@@ -799,6 +802,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
@@ -806,11 +810,8 @@ CONFIG_HIDRAW=y
 # Character devices
 #
 CONFIG_ATARI_MFPSER=m
-CONFIG_ATARI_SCC=y
-CONFIG_ATARI_SCC_DMA=y
 CONFIG_ATARI_MIDI=m
 CONFIG_ATARI_DSP56K=m
-# CONFIG_SERIAL_CONSOLE is not set
 #
 # File systems
@@ -820,8 +821,10 @@ CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XIP is not set
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
-# CONFIG_EXT4DEV_FS is not set
+CONFIG_EXT4DEV_FS=y
+# CONFIG_EXT4DEV_FS_XATTR is not set
 CONFIG_JBD=y
+CONFIG_JBD2=y
 CONFIG_REISERFS_FS=m
 # CONFIG_REISERFS_CHECK is not set
 # CONFIG_REISERFS_PROC_INFO is not set
@@ -840,6 +843,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -899,6 +903,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -920,7 +925,6 @@ CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=m
-CONFIG_SUNRPC_BIND34=y
 # CONFIG_RPCSEC_GSS_KRB5 is not set
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -929,7 +933,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -994,6 +997,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1053,6 +1058,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1094,6 +1103,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=y
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index a0a9b30bb502..2e44af0fe54a 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:03 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -163,10 +169,6 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -180,6 +182,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -413,6 +416,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -432,7 +436,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -450,6 +456,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -503,6 +510,7 @@ CONFIG_ISCSI_TCP=m
 CONFIG_53C700_BE_BUS=y
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_BVME6000_SCSI=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -511,7 +519,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -520,13 +528,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -631,6 +635,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -661,6 +666,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -672,8 +678,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -708,10 +716,6 @@ CONFIG_SSB_POSSIBLE=y
 # Console display driver support
 #
 CONFIG_DUMMY_CONSOLE=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -723,6 +727,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -759,6 +764,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -818,6 +824,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -830,18 +837,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -850,7 +856,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -915,6 +920,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -974,6 +981,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1015,6 +1026,7 @@ CONFIG_BITREVERSE=m
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=m
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 6778041de262..3570fc89b089 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:04 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -162,10 +168,6 @@ CONFIG_HEARTBEAT=y
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -179,6 +181,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -412,6 +415,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -431,7 +435,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -449,6 +455,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -500,6 +507,7 @@ CONFIG_SCSI_SRP_TGT_ATTRS=y
 CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -508,7 +516,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -517,13 +525,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -636,6 +640,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -666,6 +671,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -677,8 +683,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -747,10 +755,6 @@ CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
 CONFIG_LOGO_LINUX_CLUT224=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -762,6 +766,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -796,6 +801,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -855,6 +861,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -867,18 +874,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -887,7 +893,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -951,6 +956,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1010,6 +1017,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1051,6 +1062,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 7cd375740348..db6e8822594a 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:06 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -163,10 +169,6 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -180,6 +182,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -413,6 +416,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -432,7 +436,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -450,6 +456,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -460,6 +467,7 @@ CONFIG_BLK_DEV_IDE=y
 #
 # Please see Documentation/ide/ide.txt for help/info on IDE drives
 #
+CONFIG_IDE_ATAPI=y
 # CONFIG_BLK_DEV_IDE_SATA is not set
 CONFIG_BLK_DEV_IDEDISK=y
 # CONFIG_IDEDISK_MULTI_MODE is not set
@@ -477,8 +485,6 @@ CONFIG_IDE_PROC_FS=y
 # CONFIG_BLK_DEV_PLATFORM is not set
 CONFIG_BLK_DEV_MAC_IDE=y
 # CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_BLK_DEV_HD_ONLY is not set
-# CONFIG_BLK_DEV_HD is not set
 #
 # SCSI device support
@@ -527,6 +533,7 @@ CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_MAC_SCSI=y
 CONFIG_SCSI_MAC_ESP=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -535,7 +542,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -544,9 +551,6 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_MACINTOSH_DRIVERS=y
@@ -559,7 +563,6 @@ CONFIG_ADB_CUDA=y
 CONFIG_INPUT_ADBHID=y
 CONFIG_MAC_EMUMOUSEBTN=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -670,6 +673,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -700,6 +704,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -711,8 +716,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -784,10 +791,6 @@ CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
 CONFIG_LOGO_MAC_CLUT224=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -799,6 +802,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -836,6 +840,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -895,6 +900,7 @@ CONFIG_HFSPLUS_FS=y
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -917,7 +923,6 @@ CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=m
 CONFIG_SUNRPC_GSS=m
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=m
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -926,7 +931,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -991,6 +995,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1050,6 +1056,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1091,6 +1101,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 0747fa3984df..1a806102b999 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:07 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -173,10 +179,6 @@ CONFIG_GENERIC_ISA_DMA=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_ZORRO_NAMES=y
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -190,6 +192,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -427,6 +430,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -446,7 +450,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -476,6 +482,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -486,6 +493,7 @@ CONFIG_BLK_DEV_IDE=y
 #
 # Please see Documentation/ide/ide.txt for help/info on IDE drives
 #
+CONFIG_IDE_ATAPI=y
 # CONFIG_BLK_DEV_IDE_SATA is not set
 CONFIG_BLK_DEV_IDEDISK=y
 # CONFIG_IDEDISK_MULTI_MODE is not set
@@ -508,8 +516,6 @@ CONFIG_BLK_DEV_FALCON_IDE=y
 CONFIG_BLK_DEV_MAC_IDE=y
 CONFIG_BLK_DEV_Q40IDE=y
 # CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_BLK_DEV_HD_ONLY is not set
-# CONFIG_BLK_DEV_HD is not set
 #
 # SCSI device support
@@ -584,6 +590,7 @@ CONFIG_MVME147_SCSI=y
 CONFIG_MVME16x_SCSI=y
 CONFIG_BVME6000_SCSI=y
 CONFIG_SUN3X_ESP=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -592,7 +599,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -601,9 +608,6 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_MACINTOSH_DRIVERS=y
@@ -616,7 +620,6 @@ CONFIG_ADB_CUDA=y
 CONFIG_INPUT_ADBHID=y
 CONFIG_MAC_EMUMOUSEBTN=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -632,7 +635,6 @@ CONFIG_A2065=m
 CONFIG_HYDRA=m
 CONFIG_ZORRO8390=m
 CONFIG_APNE=m
-CONFIG_APOLLO_ELPLUS=y
 CONFIG_MAC8390=y
 CONFIG_MAC89x0=m
 CONFIG_MACSONIC=m
@@ -791,6 +793,7 @@ CONFIG_SERIO_LIBPS2=y
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -827,6 +830,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -838,8 +842,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -923,10 +929,6 @@ CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
 CONFIG_LOGO_MAC_CLUT224=y
-#
-# Sound
-#
 CONFIG_SOUND=m
 CONFIG_DMASOUND_ATARI=m
 CONFIG_DMASOUND_PAULA=m
@@ -942,6 +944,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
@@ -949,8 +952,6 @@ CONFIG_HIDRAW=y
 # Character devices
 #
 CONFIG_ATARI_MFPSER=m
-CONFIG_ATARI_SCC=y
-CONFIG_ATARI_SCC_DMA=y
 CONFIG_ATARI_MIDI=m
 CONFIG_ATARI_DSP56K=m
 CONFIG_AMIGA_BUILTIN_SERIAL=y
@@ -972,8 +973,10 @@ CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XIP is not set
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
-# CONFIG_EXT4DEV_FS is not set
+CONFIG_EXT4DEV_FS=y
+# CONFIG_EXT4DEV_FS_XATTR is not set
 CONFIG_JBD=y
+CONFIG_JBD2=y
 CONFIG_REISERFS_FS=m
 # CONFIG_REISERFS_CHECK is not set
 # CONFIG_REISERFS_PROC_INFO is not set
@@ -992,6 +995,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -1051,6 +1055,7 @@ CONFIG_HFSPLUS_FS=y
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -1063,18 +1068,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -1083,7 +1087,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -1152,6 +1155,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1211,6 +1216,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1252,6 +1261,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=y
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index e7a8246840b5..cacb5aef6a37 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:08 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -163,10 +169,6 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -180,6 +182,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -413,6 +416,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -432,7 +436,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -450,6 +456,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -502,6 +509,7 @@ CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_MVME147_SCSI=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -510,7 +518,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -519,13 +527,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -630,6 +634,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -660,6 +665,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -671,8 +677,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -707,10 +715,6 @@ CONFIG_SSB_POSSIBLE=y
 # Console display driver support
 #
 CONFIG_DUMMY_CONSOLE=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -722,6 +726,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -758,6 +763,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -817,6 +823,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -829,18 +836,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -849,7 +855,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -914,6 +919,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -973,6 +980,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1014,6 +1025,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index ab536eb172bb..a183e25e348d 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:09 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -163,10 +169,6 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -180,6 +182,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -413,6 +416,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -432,7 +436,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -450,6 +456,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -503,6 +510,7 @@ CONFIG_ISCSI_TCP=m
 CONFIG_53C700_BE_BUS=y
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_MVME16x_SCSI=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -511,7 +519,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -520,13 +528,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -631,6 +635,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -661,6 +666,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -672,8 +678,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -708,10 +716,6 @@ CONFIG_SSB_POSSIBLE=y
 # Console display driver support
 #
 CONFIG_DUMMY_CONSOLE=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -723,6 +727,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -760,6 +765,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -819,6 +825,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -831,18 +838,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -851,7 +857,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -916,6 +921,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -975,6 +982,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1016,6 +1027,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index e05be687b500..72eaff0776b8 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:10 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -163,10 +169,6 @@ CONFIG_ISA=y
 CONFIG_GENERIC_ISA_DMA=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -180,6 +182,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -410,6 +413,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -429,7 +433,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -448,6 +454,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -458,6 +465,7 @@ CONFIG_BLK_DEV_IDE=y
 #
 # Please see Documentation/ide/ide.txt for help/info on IDE drives
 #
+CONFIG_IDE_ATAPI=y
 # CONFIG_BLK_DEV_IDE_SATA is not set
 CONFIG_BLK_DEV_IDEDISK=y
 # CONFIG_IDEDISK_MULTI_MODE is not set
@@ -475,8 +483,6 @@ CONFIG_IDE_PROC_FS=y
 # CONFIG_BLK_DEV_PLATFORM is not set
 CONFIG_BLK_DEV_Q40IDE=y
 # CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_BLK_DEV_HD_ONLY is not set
-# CONFIG_BLK_DEV_HD is not set
 #
 # SCSI device support
@@ -536,6 +542,7 @@ CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_SYM53C416 is not set
 # CONFIG_SCSI_T128 is not set
 # CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -544,7 +551,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -553,13 +560,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -680,6 +683,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -711,6 +715,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -722,8 +727,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -792,10 +799,6 @@ CONFIG_LOGO=y
 CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
-#
-# Sound
-#
 CONFIG_SOUND=m
 CONFIG_DMASOUND_Q40=m
 CONFIG_DMASOUND=m
@@ -809,6 +812,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -843,6 +847,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -902,6 +907,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -924,7 +930,6 @@ CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -933,7 +938,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -997,6 +1001,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1056,6 +1062,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1097,6 +1107,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 296340d2b315..cb62b96d766e 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:11 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -149,10 +155,6 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -166,6 +168,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -399,6 +402,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -418,7 +422,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -436,6 +442,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -488,6 +495,7 @@ CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_SUN3_SCSI=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -496,7 +504,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -505,13 +513,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -527,7 +531,6 @@ CONFIG_SUN3_82586=y
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
-# CONFIG_B44 is not set
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
@@ -617,6 +620,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -647,19 +651,20 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
 # Sonics Silicon Backplane
 #
-CONFIG_SSB_POSSIBLE=y
-# CONFIG_SSB is not set
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -727,10 +732,6 @@ CONFIG_LOGO=y
 CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -776,6 +777,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -835,6 +837,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -847,18 +850,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -867,7 +869,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -932,6 +933,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -991,6 +994,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1032,6 +1039,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 8d3a416c92bf..04b4363a7050 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc4
+# Linux kernel version: 2.6.27-rc6
-# Wed May 28 22:47:35 2008
+# Wed Sep 10 09:02:12 2008
 #
 CONFIG_M68K=y
 CONFIG_MMU=y
@@ -52,7 +52,6 @@ CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -75,10 +74,16 @@ CONFIG_SLAB=y
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
 # CONFIG_HAVE_OPROFILE is not set
+# CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is not set
+# CONFIG_HAVE_IOREMAP_PROT is not set
 # CONFIG_HAVE_KPROBES is not set
 # CONFIG_HAVE_KRETPROBES is not set
+# CONFIG_HAVE_ARCH_TRACEHOOK is not set
 # CONFIG_HAVE_DMA_ATTRS is not set
+# CONFIG_USE_GENERIC_SMP_HELPERS is not set
+# CONFIG_HAVE_CLK is not set
 CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
@@ -95,6 +100,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
 #
 # IO Schedulers
@@ -160,10 +166,6 @@ CONFIG_BINFMT_MISC=m
 CONFIG_PROC_HARDWARE=y
 CONFIG_ZONE_DMA=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-#
-# Networking
-#
 CONFIG_NET=y
 #
@@ -177,6 +179,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -410,6 +413,7 @@ CONFIG_NET_CLS_ROUTE=y
 #
 # CONFIG_CFG80211 is not set
 CONFIG_WIRELESS_EXT=y
+# CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_MAC80211 is not set
 CONFIG_IEEE80211=m
 # CONFIG_IEEE80211_DEBUG is not set
@@ -429,7 +433,9 @@ CONFIG_IEEE80211_CRYPT_TKIP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-CONFIG_FW_LOADER=m
+CONFIG_FW_LOADER=y
+# CONFIG_FIRMWARE_IN_KERNEL is not set
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_SYS_HYPERVISOR is not set
 CONFIG_CONNECTOR=m
 # CONFIG_MTD is not set
@@ -447,6 +453,7 @@ CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
 CONFIG_ATA_OVER_ETH=m
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -499,6 +506,7 @@ CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_SUN3X_ESP=y
+# CONFIG_SCSI_DH is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=m
 CONFIG_MD_LINEAR=m
@@ -507,7 +515,7 @@ CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID456=m
 CONFIG_MD_RAID5_RESHAPE=y
-CONFIG_MD_MULTIPATH=m
+# CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_DEBUG is not set
@@ -516,13 +524,9 @@ CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_EMC=m
-CONFIG_DM_MULTIPATH_RDAC=m
-CONFIG_DM_MULTIPATH_HP=m
 # CONFIG_DM_DELAY is not set
 CONFIG_DM_UEVENT=y
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 CONFIG_MACVLAN=m
@@ -627,6 +631,7 @@ CONFIG_SERIO_LIBPS2=m
 # Character devices
 #
 CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_VT_HW_CONSOLE_BINDING=y
@@ -657,6 +662,7 @@ CONFIG_GEN_RTC_X=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -668,8 +674,10 @@ CONFIG_SSB_POSSIBLE=y
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
 #
 # Multimedia devices
@@ -737,10 +745,6 @@ CONFIG_LOGO=y
 CONFIG_LOGO_LINUX_MONO=y
 CONFIG_LOGO_LINUX_VGA16=y
 CONFIG_LOGO_LINUX_CLUT224=y
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_HID_SUPPORT=y
 CONFIG_HID=m
@@ -752,6 +756,7 @@ CONFIG_HIDRAW=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 #
@@ -786,6 +791,7 @@ CONFIG_XFS_FS=m
 CONFIG_OCFS2_FS=m
 CONFIG_OCFS2_FS_O2CB=m
 CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+# CONFIG_OCFS2_FS_STATS is not set
 # CONFIG_OCFS2_DEBUG_MASKLOG is not set
 # CONFIG_OCFS2_DEBUG_FS is not set
 CONFIG_DNOTIFY=y
@@ -845,6 +851,7 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_CRAMFS=m
 # CONFIG_VXFS_FS is not set
 CONFIG_MINIX_FS=y
+# CONFIG_OMFS_FS is not set
 CONFIG_HPFS_FS=m
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -857,18 +864,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
-CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
-CONFIG_SUNRPC_BIND34=y
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -877,7 +883,6 @@ CONFIG_SMB_NLS_REMOTE="cp437"
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 CONFIG_CODA_FS=m
-# CONFIG_CODA_FS_OLD_API is not set
 # CONFIG_AFS_FS is not set
 #
@@ -942,6 +947,8 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_SAMPLES is not set
 #
@@ -1001,6 +1008,10 @@ CONFIG_CRYPTO_CRC32C=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1042,6 +1053,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_GENERIC_FIND_NEXT_BIT is not set
 CONFIG_CRC_CCITT=m
 CONFIG_CRC16=m
+CONFIG_CRC_T10DIF=y
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 49896a2a1d72..1e06d233fa83 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -211,6 +211,7 @@ config MIPS_MALTA
        select SYS_SUPPORTS_64BIT_KERNEL
        select SYS_SUPPORTS_BIG_ENDIAN
        select SYS_SUPPORTS_LITTLE_ENDIAN
+        select SYS_SUPPORTS_MIPS_CMP if BROKEN  # because SYNC_R4K is broken
        select SYS_SUPPORTS_MULTITHREADING
        select SYS_SUPPORTS_SMARTMIPS
        help
@@ -1403,7 +1404,6 @@ config MIPS_MT_SMTC
        depends on CPU_MIPS32_R2
        #depends on CPU_MIPS64_R2               # once there is hardware ...
        depends on SYS_SUPPORTS_MULTITHREADING
-        select GENERIC_CLOCKEVENTS_BROADCAST
        select CPU_MIPSR2_IRQ_VI
        select CPU_MIPSR2_IRQ_EI
        select MIPS_MT
@@ -1451,32 +1451,17 @@ config MIPS_VPE_LOADER
          Includes a loader for loading an elf relocatable object
          onto another VPE and running it.
-config MIPS_MT_SMTC_INSTANT_REPLAY
-        bool "Low-latency Dispatch of Deferred SMTC IPIs"
-        depends on MIPS_MT_SMTC && !PREEMPT
-        default y
-        help
-          SMTC pseudo-interrupts between TCs are deferred and queued
-          if the target TC is interrupt-inhibited (IXMT). In the first
-          SMTC prototypes, these queued IPIs were serviced on return
-          to user mode, or on entry into the kernel idle loop. The
-          INSTANT_REPLAY option dispatches them as part of local_irq_restore()
-          processing, which adds runtime overhead (hence the option to turn
-          it off), but ensures that IPIs are handled promptly even under
-          heavy I/O interrupt load.
 config MIPS_MT_SMTC_IM_BACKSTOP
        bool "Use per-TC register bits as backstop for inhibited IM bits"
        depends on MIPS_MT_SMTC
-        default y
+        default n
        help
          To support multiple TC microthreads acting as "CPUs" within
          a VPE, VPE-wide interrupt mask bits must be specially manipulated
          during interrupt handling. To support legacy drivers and interrupt
          controller management code, SMTC has a "backstop" to track and
          if necessary restore the interrupt mask. This has some performance
-          impact on interrupt service overhead. Disable it only if you know
+          impact on interrupt service overhead.
-          what you are doing.
 config MIPS_MT_SMTC_IRQAFF
        bool "Support IRQ affinity API"
@@ -1486,10 +1471,8 @@ config MIPS_MT_SMTC_IRQAFF
          Enables SMP IRQ affinity API (/proc/irq/*/smp_affinity, etc.)
          for SMTC Linux kernel. Requires platform support, of which
          an example can be found in the MIPS kernel i8259 and Malta
-          platform code.  It is recommended that MIPS_MT_SMTC_INSTANT_REPLAY
+          platform code.  Adds some overhead to interrupt dispatch, and
-          be enabled if MIPS_MT_SMTC_IRQAFF is used. Adds overhead to
+          should be used only if you know what you are doing.
-          interrupt dispatch, and should be used only if you know what
-          you are doing.
 config MIPS_VPE_LOADER_TOM
        bool "Load VPE program into memory hidden from linux"
@@ -1517,6 +1500,18 @@ config MIPS_APSP_KSPD
          "exit" syscall notifying other kernel modules the SP program is
          exiting.  You probably want to say yes here.
+config MIPS_CMP
+        bool "MIPS CMP framework support"
+        depends on SYS_SUPPORTS_MIPS_CMP
+        select SYNC_R4K if BROKEN
+        select SYS_SUPPORTS_SMP
+        select SYS_SUPPORTS_SCHED_SMT if SMP
+        select WEAK_ORDERING
+        default n
+        help
+          This is a placeholder option for the GCMP work. It will need to
+          be handled differently...
 config SB1_PASS_1_WORKAROUNDS
        bool
        depends on CPU_SB1_PASS_1
@@ -1693,6 +1688,9 @@ config SMP
 config SMP_UP
        bool
+config SYS_SUPPORTS_MIPS_CMP
+        bool
 config SYS_SUPPORTS_SMP
        bool
@@ -1740,17 +1738,6 @@ config NR_CPUS
          performance should round up your number of processors to the next
          power of two.
-config MIPS_CMP
-        bool "MIPS CMP framework support"
-        depends on SMP
-        select SYNC_R4K
-        select SYS_SUPPORTS_SCHED_SMT
-        select WEAK_ORDERING
-        default n
-        help
-          This is a placeholder option for the GCMP work. It will need to
-          be handled differently...
 source "kernel/time/Kconfig"
 #
diff --git a/arch/mips/au1000/common/gpio.c b/arch/mips/au1000/common/gpio.c
index b485d94ce8a5..e660ddd611c4 100644
--- a/arch/mips/au1000/common/gpio.c
+++ b/arch/mips/au1000/common/gpio.c
@@ -48,7 +48,7 @@ static void au1xxx_gpio2_write(unsigned gpio, int value)
 {
        gpio -= AU1XXX_GPIO_BASE;
-        gpio2->output = (GPIO2_OUTPUT_ENABLE_MASK << gpio) | (value << gpio);
+        gpio2->output = (GPIO2_OUTPUT_ENABLE_MASK << gpio) | ((!!value) << gpio);
 }
 static int au1xxx_gpio2_direction_input(unsigned gpio)
@@ -61,7 +61,8 @@ static int au1xxx_gpio2_direction_input(unsigned gpio)
 static int au1xxx_gpio2_direction_output(unsigned gpio, int value)
 {
        gpio -= AU1XXX_GPIO_BASE;
-        gpio2->dir = (0x01 << gpio) | (value << gpio);
+        gpio2->dir |= 0x01 << gpio;
+        gpio2->output = (GPIO2_OUTPUT_ENABLE_MASK << gpio) | ((!!value) << gpio);
        return 0;
 }
@@ -90,6 +91,7 @@ static int au1xxx_gpio1_direction_input(unsigned gpio)
 static int au1xxx_gpio1_direction_output(unsigned gpio, int value)
 {
        gpio1->trioutclr = (0x01 & gpio);
+        au1xxx_gpio1_write(gpio, value);
        return 0;
 }
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index 706f93974797..25775cb54000 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -10,6 +10,7 @@ obj-y		+= cpu-probe.o branch.o entry.o genex.o irq.o process.o \
 obj-$(CONFIG_CEVT_BCM1480)      += cevt-bcm1480.o
 obj-$(CONFIG_CEVT_R4K)          += cevt-r4k.o
+obj-$(CONFIG_MIPS_MT_SMTC)      += cevt-smtc.o
 obj-$(CONFIG_CEVT_DS1287)       += cevt-ds1287.o
 obj-$(CONFIG_CEVT_GT641XX)      += cevt-gt641xx.o
 obj-$(CONFIG_CEVT_SB1250)       += cevt-sb1250.o
diff --git a/arch/mips/kernel/cevt-r4k.c b/arch/mips/kernel/cevt-r4k.c
index 24a2d907aa0d..4a4c59f2737a 100644
--- a/arch/mips/kernel/cevt-r4k.c
+++ b/arch/mips/kernel/cevt-r4k.c
@@ -12,6 +12,14 @@
 #include <asm/smtc_ipi.h>
 #include <asm/time.h>
+#include <asm/cevt-r4k.h>
+/*
+ * The SMTC Kernel for the 34K, 1004K, et. al. replaces several
+ * of these routines with SMTC-specific variants.
+ */
+#ifndef CONFIG_MIPS_MT_SMTC
 static int mips_next_event(unsigned long delta,
                           struct clock_event_device *evt)
@@ -19,60 +27,27 @@ static int mips_next_event(unsigned long delta,
        unsigned int cnt;
        int res;
-#ifdef CONFIG_MIPS_MT_SMTC
-        {
-        unsigned long flags, vpflags;
-        local_irq_save(flags);
-        vpflags = dvpe();
-#endif
        cnt = read_c0_count();
        cnt += delta;
        write_c0_compare(cnt);
        res = ((int)(read_c0_count() - cnt) > 0) ? -ETIME : 0;
-#ifdef CONFIG_MIPS_MT_SMTC
-        evpe(vpflags);
-        local_irq_restore(flags);
-        }
-#endif
        return res;
 }
-static void mips_set_mode(enum clock_event_mode mode,
+#endif /* CONFIG_MIPS_MT_SMTC */
-                          struct clock_event_device *evt)
+void mips_set_clock_mode(enum clock_event_mode mode,
+                                struct clock_event_device *evt)
 {
        /* Nothing to do ...  */
 }
-static DEFINE_PER_CPU(struct clock_event_device, mips_clockevent_device);
+DEFINE_PER_CPU(struct clock_event_device, mips_clockevent_device);
-static int cp0_timer_irq_installed;
+int cp0_timer_irq_installed;
-/*
+#ifndef CONFIG_MIPS_MT_SMTC
- * Timer ack for an R4k-compatible timer of a known frequency.
- */
-static void c0_timer_ack(void)
-{
-        write_c0_compare(read_c0_compare());
-}
-/*
+irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
- * Possibly handle a performance counter interrupt.
- * Return true if the timer interrupt should not be checked
- */
-static inline int handle_perf_irq(int r2)
-{
-        /*
-         * The performance counter overflow interrupt may be shared with the
-         * timer interrupt (cp0_perfcount_irq < 0). If it is and a
-         * performance counter has overflowed (perf_irq() == IRQ_HANDLED)
-         * and we can't reliably determine if a counter interrupt has also
-         * happened (!r2) then don't check for a timer interrupt.
-         */
-        return (cp0_perfcount_irq < 0) &&
-                perf_irq() == IRQ_HANDLED &&
-                !r2;
-}
-static irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
 {
        const int r2 = cpu_has_mips_r2;
        struct clock_event_device *cd;
@@ -93,12 +68,8 @@ static irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
         * interrupt.  Being the paranoiacs we are we check anyway.
         */
        if (!r2 || (read_c0_cause() & (1 << 30))) {
-                c0_timer_ack();
+                /* Clear Count/Compare Interrupt */
-#ifdef CONFIG_MIPS_MT_SMTC
+                write_c0_compare(read_c0_compare());
-                if (cpu_data[cpu].vpe_id)
-                        goto out;
-                cpu = 0;
-#endif
                cd = &per_cpu(mips_clockevent_device, cpu);
                cd->event_handler(cd);
        }
@@ -107,65 +78,16 @@ out:
        return IRQ_HANDLED;
 }
-static struct irqaction c0_compare_irqaction = {
+#endif /* Not CONFIG_MIPS_MT_SMTC */
+struct irqaction c0_compare_irqaction = {
        .handler = c0_compare_interrupt,
-#ifdef CONFIG_MIPS_MT_SMTC
-        .flags = IRQF_DISABLED,
-#else
        .flags = IRQF_DISABLED | IRQF_PERCPU,
-#endif
        .name = "timer",
 };
-#ifdef CONFIG_MIPS_MT_SMTC
-DEFINE_PER_CPU(struct clock_event_device, smtc_dummy_clockevent_device);
-static void smtc_set_mode(enum clock_event_mode mode,
-                          struct clock_event_device *evt)
-{
-}
-static void mips_broadcast(cpumask_t mask)
-{
-        unsigned int cpu;
-        for_each_cpu_mask(cpu, mask)
-                smtc_send_ipi(cpu, SMTC_CLOCK_TICK, 0);
-}
-static void setup_smtc_dummy_clockevent_device(void)
-{
-        //uint64_t mips_freq = mips_hpt_^frequency;
-        unsigned int cpu = smp_processor_id();
-        struct clock_event_device *cd;
-        cd = &per_cpu(smtc_dummy_clockevent_device, cpu);
+void mips_event_handler(struct clock_event_device *dev)
-        cd->name                = "SMTC";
-        cd->features            = CLOCK_EVT_FEAT_DUMMY;
-        /* Calculate the min / max delta */
-        cd->mult        = 0; //div_sc((unsigned long) mips_freq, NSEC_PER_SEC, 32);
-        cd->shift               = 0; //32;
-        cd->max_delta_ns        = 0; //clockevent_delta2ns(0x7fffffff, cd);
-        cd->min_delta_ns        = 0; //clockevent_delta2ns(0x30, cd);
-        cd->rating              = 200;
-        cd->irq                 = 17; //-1;
-//      if (cpu)
-//              cd->cpumask     = CPU_MASK_ALL; // cpumask_of_cpu(cpu);
-//      else
-                cd->cpumask     = cpumask_of_cpu(cpu);
-        cd->set_mode            = smtc_set_mode;
-        cd->broadcast           = mips_broadcast;
-        clockevents_register_device(cd);
-}
-#endif
-static void mips_event_handler(struct clock_event_device *dev)
 {
 }
@@ -177,7 +99,23 @@ static int c0_compare_int_pending(void)
        return (read_c0_cause() >> cp0_compare_irq) & 0x100;
 }
-static int c0_compare_int_usable(void)
+/*
+ * Compare interrupt can be routed and latched outside the core,
+ * so a single execution hazard barrier may not be enough to give
+ * it time to clear as seen in the Cause register.  4 time the
+ * pipeline depth seems reasonably conservative, and empirically
+ * works better in configurations with high CPU/bus clock ratios.
+ */
+#define compare_change_hazard() \
+        do { \
+                irq_disable_hazard(); \
+                irq_disable_hazard(); \
+                irq_disable_hazard(); \
+                irq_disable_hazard(); \
+        } while (0)
+int c0_compare_int_usable(void)
 {
        unsigned int delta;
        unsigned int cnt;
@@ -187,7 +125,7 @@ static int c0_compare_int_usable(void)
         */
        if (c0_compare_int_pending()) {
                write_c0_compare(read_c0_count());
-                irq_disable_hazard();
+                compare_change_hazard();
                if (c0_compare_int_pending())
                        return 0;
        }
@@ -196,7 +134,7 @@ static int c0_compare_int_usable(void)
                cnt = read_c0_count();
                cnt += delta;
                write_c0_compare(cnt);
-                irq_disable_hazard();
+                compare_change_hazard();
                if ((int)(read_c0_count() - cnt) < 0)
                    break;
                /* increase delta if the timer was already expired */
@@ -205,11 +143,12 @@ static int c0_compare_int_usable(void)
        while ((int)(read_c0_count() - cnt) <= 0)
                ;       /* Wait for expiry  */
+        compare_change_hazard();
        if (!c0_compare_int_pending())
                return 0;
        write_c0_compare(read_c0_count());
-        irq_disable_hazard();
+        compare_change_hazard();
        if (c0_compare_int_pending())
                return 0;
@@ -219,6 +158,8 @@ static int c0_compare_int_usable(void)
        return 1;
 }
+#ifndef CONFIG_MIPS_MT_SMTC
 int __cpuinit mips_clockevent_init(void)
 {
        uint64_t mips_freq = mips_hpt_frequency;
@@ -229,17 +170,6 @@ int __cpuinit mips_clockevent_init(void)
        if (!cpu_has_counter || !mips_hpt_frequency)
                return -ENXIO;
-#ifdef CONFIG_MIPS_MT_SMTC
-        setup_smtc_dummy_clockevent_device();
-        /*
-         * On SMTC we only register VPE0's compare interrupt as clockevent
-         * device.
-         */
-        if (cpu)
-                return 0;
-#endif
        if (!c0_compare_int_usable())
                return -ENXIO;
@@ -265,13 +195,9 @@ int __cpuinit mips_clockevent_init(void)
        cd->rating              = 300;
        cd->irq                 = irq;
-#ifdef CONFIG_MIPS_MT_SMTC
-        cd->cpumask             = CPU_MASK_ALL;
-#else
        cd->cpumask             = cpumask_of_cpu(cpu);
-#endif
        cd->set_next_event      = mips_next_event;
-        cd->set_mode            = mips_set_mode;
+        cd->set_mode            = mips_set_clock_mode;
        cd->event_handler       = mips_event_handler;
        clockevents_register_device(cd);
@@ -281,12 +207,9 @@ int __cpuinit mips_clockevent_init(void)
        cp0_timer_irq_installed = 1;
-#ifdef CONFIG_MIPS_MT_SMTC
-#define CPUCTR_IMASKBIT (0x100 << cp0_compare_irq)
-        setup_irq_smtc(irq, &c0_compare_irqaction, CPUCTR_IMASKBIT);
-#else
        setup_irq(irq, &c0_compare_irqaction);
-#endif
        return 0;
 }
+#endif /* Not CONFIG_MIPS_MT_SMTC */
diff --git a/arch/mips/kernel/cevt-smtc.c b/arch/mips/kernel/cevt-smtc.c
new file mode 100644
index 000000000000..5162fe4b5952
--- /dev/null
+++ b/arch/mips/kernel/cevt-smtc.c
@@ -0,0 +1,321 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2007 MIPS Technologies, Inc.
+ * Copyright (C) 2007 Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) 2008 Kevin D. Kissell, Paralogos sarl
+ */
+#include <linux/clockchips.h>
+#include <linux/interrupt.h>
+#include <linux/percpu.h>
+#include <asm/smtc_ipi.h>
+#include <asm/time.h>
+#include <asm/cevt-r4k.h>
+/*
+ * Variant clock event timer support for SMTC on MIPS 34K, 1004K
+ * or other MIPS MT cores.
+ *
+ * Notes on SMTC Support:
+ *
+ * SMTC has multiple microthread TCs pretending to be Linux CPUs.
+ * But there's only one Count/Compare pair per VPE, and Compare
+ * interrupts are taken opportunisitically by available TCs
+ * bound to the VPE with the Count register.  The new timer
+ * framework provides for global broadcasts, but we really
+ * want VPE-level multicasts for best behavior. So instead
+ * of invoking the high-level clock-event broadcast code,
+ * this version of SMTC support uses the historical SMTC
+ * multicast mechanisms "under the hood", appearing to the
+ * generic clock layer as if the interrupts are per-CPU.
+ *
+ * The approach taken here is to maintain a set of NR_CPUS
+ * virtual timers, and track which "CPU" needs to be alerted
+ * at each event.
+ *
+ * It's unlikely that we'll see a MIPS MT core with more than
+ * 2 VPEs, but we *know* that we won't need to handle more
+ * VPEs than we have "CPUs".  So NCPUs arrays of NCPUs elements
+ * is always going to be overkill, but always going to be enough.
+ */
+unsigned long smtc_nexttime[NR_CPUS][NR_CPUS];
+static int smtc_nextinvpe[NR_CPUS];
+/*
+ * Timestamps stored are absolute values to be programmed
+ * into Count register.  Valid timestamps will never be zero.
+ * If a Zero Count value is actually calculated, it is converted
+ * to be a 1, which will introduce 1 or two CPU cycles of error
+ * roughly once every four billion events, which at 1000 HZ means
+ * about once every 50 days.  If that's actually a problem, one
+ * could alternate squashing 0 to 1 and to -1.
+ */
+#define MAKEVALID(x) (((x) == 0L) ? 1L : (x))
+#define ISVALID(x) ((x) != 0L)
+/*
+ * Time comparison is subtle, as it's really truncated
+ * modular arithmetic.
+ */
+#define IS_SOONER(a, b, reference) \
+    (((a) - (unsigned long)(reference)) < ((b) - (unsigned long)(reference)))
+/*
+ * CATCHUP_INCREMENT, used when the function falls behind the counter.
+ * Could be an increasing function instead of a constant;
+ */
+#define CATCHUP_INCREMENT 64
+static int mips_next_event(unsigned long delta,
+                                struct clock_event_device *evt)
+{
+        unsigned long flags;
+        unsigned int mtflags;
+        unsigned long timestamp, reference, previous;
+        unsigned long nextcomp = 0L;
+        int vpe = current_cpu_data.vpe_id;
+        int cpu = smp_processor_id();
+        local_irq_save(flags);
+        mtflags = dmt();
+        /*
+         * Maintain the per-TC virtual timer
+         * and program the per-VPE shared Count register
+         * as appropriate here...
+         */
+        reference = (unsigned long)read_c0_count();
+        timestamp = MAKEVALID(reference + delta);
+        /*
+         * To really model the clock, we have to catch the case
+         * where the current next-in-VPE timestamp is the old
+         * timestamp for the calling CPE, but the new value is
+         * in fact later.  In that case, we have to do a full
+         * scan and discover the new next-in-VPE CPU id and
+         * timestamp.
+         */
+        previous = smtc_nexttime[vpe][cpu];
+        if (cpu == smtc_nextinvpe[vpe] && ISVALID(previous)
+            && IS_SOONER(previous, timestamp, reference)) {
+                int i;
+                int soonest = cpu;
+                /*
+                 * Update timestamp array here, so that new
+                 * value gets considered along with those of
+                 * other virtual CPUs on the VPE.
+                 */
+                smtc_nexttime[vpe][cpu] = timestamp;
+                for_each_online_cpu(i) {
+                        if (ISVALID(smtc_nexttime[vpe][i])
+                            && IS_SOONER(smtc_nexttime[vpe][i],
+                                smtc_nexttime[vpe][soonest], reference)) {
+                                    soonest = i;
+                        }
+                }
+                smtc_nextinvpe[vpe] = soonest;
+                nextcomp = smtc_nexttime[vpe][soonest];
+        /*
+         * Otherwise, we don't have to process the whole array rank,
+         * we just have to see if the event horizon has gotten closer.
+         */
+        } else {
+                if (!ISVALID(smtc_nexttime[vpe][smtc_nextinvpe[vpe]]) ||
+                    IS_SOONER(timestamp,
+                        smtc_nexttime[vpe][smtc_nextinvpe[vpe]], reference)) {
+                            smtc_nextinvpe[vpe] = cpu;
+                            nextcomp = timestamp;
+                }
+                /*
+                 * Since next-in-VPE may me the same as the executing
+                 * virtual CPU, we update the array *after* checking
+                 * its value.
+                 */
+                smtc_nexttime[vpe][cpu] = timestamp;
+        }
+        /*
+         * It may be that, in fact, we don't need to update Compare,
+         * but if we do, we want to make sure we didn't fall into
+         * a crack just behind Count.
+         */
+        if (ISVALID(nextcomp)) {
+                write_c0_compare(nextcomp);
+                ehb();
+                /*
+                 * We never return an error, we just make sure
+                 * that we trigger the handlers as quickly as
+                 * we can if we fell behind.
+                 */
+                while ((nextcomp - (unsigned long)read_c0_count())
+                        > (unsigned long)LONG_MAX) {
+                        nextcomp += CATCHUP_INCREMENT;
+                        write_c0_compare(nextcomp);
+                        ehb();
+                }
+        }
+        emt(mtflags);
+        local_irq_restore(flags);
+        return 0;
+}
+void smtc_distribute_timer(int vpe)
+{
+        unsigned long flags;
+        unsigned int mtflags;
+        int cpu;
+        struct clock_event_device *cd;
+        unsigned long nextstamp = 0L;
+        unsigned long reference;
+repeat:
+        for_each_online_cpu(cpu) {
+            /*
+             * Find virtual CPUs within the current VPE who have
+             * unserviced timer requests whose time is now past.
+             */
+            local_irq_save(flags);
+            mtflags = dmt();
+            if (cpu_data[cpu].vpe_id == vpe &&
+                ISVALID(smtc_nexttime[vpe][cpu])) {
+                reference = (unsigned long)read_c0_count();
+                if ((smtc_nexttime[vpe][cpu] - reference)
+                         > (unsigned long)LONG_MAX) {
+                            smtc_nexttime[vpe][cpu] = 0L;
+                            emt(mtflags);
+                            local_irq_restore(flags);
+                            /*
+                             * We don't send IPIs to ourself.
+                             */
+                            if (cpu != smp_processor_id()) {
+                                smtc_send_ipi(cpu, SMTC_CLOCK_TICK, 0);
+                            } else {
+                                cd = &per_cpu(mips_clockevent_device, cpu);
+                                cd->event_handler(cd);
+                            }
+                } else {
+                        /* Local to VPE but Valid Time not yet reached. */
+                        if (!ISVALID(nextstamp) ||
+                            IS_SOONER(smtc_nexttime[vpe][cpu], nextstamp,
+                            reference)) {
+                                smtc_nextinvpe[vpe] = cpu;
+                                nextstamp = smtc_nexttime[vpe][cpu];
+                        }
+                        emt(mtflags);
+                        local_irq_restore(flags);
+                }
+            } else {
+                emt(mtflags);
+                local_irq_restore(flags);
+            }
+        }
+        /* Reprogram for interrupt at next soonest timestamp for VPE */
+        if (ISVALID(nextstamp)) {
+                write_c0_compare(nextstamp);
+                ehb();
+                if ((nextstamp - (unsigned long)read_c0_count())
+                        > (unsigned long)LONG_MAX)
+                                goto repeat;
+        }
+}
+irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
+{
+        int cpu = smp_processor_id();
+        /* If we're running SMTC, we've got MIPS MT and therefore MIPS32R2 */
+        handle_perf_irq(1);
+        if (read_c0_cause() & (1 << 30)) {
+                /* Clear Count/Compare Interrupt */
+                write_c0_compare(read_c0_compare());
+                smtc_distribute_timer(cpu_data[cpu].vpe_id);
+        }
+        return IRQ_HANDLED;
+}
+int __cpuinit mips_clockevent_init(void)
+{
+        uint64_t mips_freq = mips_hpt_frequency;
+        unsigned int cpu = smp_processor_id();
+        struct clock_event_device *cd;
+        unsigned int irq;
+        int i;
+        int j;
+        if (!cpu_has_counter || !mips_hpt_frequency)
+                return -ENXIO;
+        if (cpu == 0) {
+                for (i = 0; i < num_possible_cpus(); i++) {
+                        smtc_nextinvpe[i] = 0;
+                        for (j = 0; j < num_possible_cpus(); j++)
+                                smtc_nexttime[i][j] = 0L;
+                }
+                /*
+                 * SMTC also can't have the usablility test
+                 * run by secondary TCs once Compare is in use.
+                 */
+                if (!c0_compare_int_usable())
+                        return -ENXIO;
+        }
+        /*
+         * With vectored interrupts things are getting platform specific.
+         * get_c0_compare_int is a hook to allow a platform to return the
+         * interrupt number of it's liking.
+         */
+        irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
+        if (get_c0_compare_int)
+                irq = get_c0_compare_int();
+        cd = &per_cpu(mips_clockevent_device, cpu);
+        cd->name                = "MIPS";
+        cd->features            = CLOCK_EVT_FEAT_ONESHOT;
+        /* Calculate the min / max delta */
+        cd->mult        = div_sc((unsigned long) mips_freq, NSEC_PER_SEC, 32);
+        cd->shift               = 32;
+        cd->max_delta_ns        = clockevent_delta2ns(0x7fffffff, cd);
+        cd->min_delta_ns        = clockevent_delta2ns(0x300, cd);
+        cd->rating              = 300;
+        cd->irq                 = irq;
+        cd->cpumask             = cpumask_of_cpu(cpu);
+        cd->set_next_event      = mips_next_event;
+        cd->set_mode            = mips_set_clock_mode;
+        cd->event_handler       = mips_event_handler;
+        clockevents_register_device(cd);
+        /*
+         * On SMTC we only want to do the data structure
+         * initialization and IRQ setup once.
+         */
+        if (cpu)
+                return 0;
+        /*
+         * And we need the hwmask associated with the c0_compare
+         * vector to be initialized.
+         */
+        irq_hwmask[irq] = (0x100 << cp0_compare_irq);
+        if (cp0_timer_irq_installed)
+                return 0;
+        cp0_timer_irq_installed = 1;
+        setup_irq(irq, &c0_compare_irqaction);
+        return 0;
+}
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 335a6ae3d594..e621fda8ab37 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -45,18 +45,7 @@ static void r39xx_wait(void)
        local_irq_enable();
 }
-/*
+extern void r4k_wait(void);
- * There is a race when WAIT instruction executed with interrupt
- * enabled.
- * But it is implementation-dependent wheter the pipelie restarts when
- * a non-enabled interrupt is requested.
- */
-static void r4k_wait(void)
-{
-        __asm__("       .set    mips3                   \n"
-                "       wait                            \n"
-                "       .set    mips0                   \n");
-}
 /*
 * This variant is preferable as it allows testing need_resched and going to
@@ -65,14 +54,18 @@ static void r4k_wait(void)
 * interrupt is requested" restriction in the MIPS32/MIPS64 architecture makes
 * using this version a gamble.
 */
-static void r4k_wait_irqoff(void)
+void r4k_wait_irqoff(void)
 {
        local_irq_disable();
        if (!need_resched())
-                __asm__("       .set    mips3           \n"
+                __asm__("       .set    push            \n"
+                        "       .set    mips3           \n"
                        "       wait                    \n"
-                        "       .set    mips0           \n");
+                        "       .set    pop             \n");
        local_irq_enable();
+        __asm__("       .globl __pastwait       \n"
+                "__pastwait:                    \n");
+        return;
 }
 /*
@@ -128,7 +121,7 @@ static int __init wait_disable(char *s)
 __setup("nowait", wait_disable);
-static inline void check_wait(void)
+void __init check_wait(void)
 {
        struct cpuinfo_mips *c = &current_cpu_data;
@@ -242,7 +235,6 @@ static inline void check_errata(void)
 void __init check_bugs32(void)
 {
-        check_wait();
        check_errata();
 }
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index e29598ae939d..ffa331029e08 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -79,11 +79,6 @@ FEXPORT(syscall_exit)
 FEXPORT(restore_all)                    # restore full frame
 #ifdef CONFIG_MIPS_MT_SMTC
-/* Detect and execute deferred IPI "interrupts" */
-        LONG_L  s0, TI_REGS($28)
-        LONG_S  sp, TI_REGS($28)
-        jal     deferred_smtc_ipi
-        LONG_S  s0, TI_REGS($28)
 #ifdef CONFIG_MIPS_MT_SMTC_IM_BACKSTOP
 /* Re-arm any temporarily masked interrupts not explicitly "acked" */
        mfc0    v0, CP0_TCSTATUS
@@ -112,6 +107,11 @@ FEXPORT(restore_all)			# restore full frame
        xor     t0, t0, t3
        mtc0    t0, CP0_TCCONTEXT
 #endif /* CONFIG_MIPS_MT_SMTC_IM_BACKSTOP */
+/* Detect and execute deferred IPI "interrupts" */
+        LONG_L  s0, TI_REGS($28)
+        LONG_S  sp, TI_REGS($28)
+        jal     deferred_smtc_ipi
+        LONG_S  s0, TI_REGS($28)
 #endif /* CONFIG_MIPS_MT_SMTC */
        .set    noat
        RESTORE_TEMP
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index c6ada98ee042..01dcbe38fa01 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -20,6 +20,7 @@
 #include <asm/stackframe.h>
 #include <asm/war.h>
 #include <asm/page.h>
+#include <asm/thread_info.h>
 #define PANIC_PIC(msg)                                  \
                .set push;                              \
@@ -126,7 +127,42 @@ handle_vcei:
        __FINIT
+        .align  5       /* 32 byte rollback region */
+LEAF(r4k_wait)
+        .set    push
+        .set    noreorder
+        /* start of rollback region */
+        LONG_L  t0, TI_FLAGS($28)
+        nop
+        andi    t0, _TIF_NEED_RESCHED
+        bnez    t0, 1f
+         nop
+        nop
+        nop
+        .set    mips3
+        wait
+        /* end of rollback region (the region size must be power of two) */
+        .set    pop
+1:
+        jr      ra
+        END(r4k_wait)
+        .macro  BUILD_ROLLBACK_PROLOGUE handler
+        FEXPORT(rollback_\handler)
+        .set    push
+        .set    noat
+        MFC0    k0, CP0_EPC
+        PTR_LA  k1, r4k_wait
+        ori     k0, 0x1f        /* 32 byte rollback region */
+        xori    k0, 0x1f
+        bne     k0, k1, 9f
+        MTC0    k0, CP0_EPC
+9:
+        .set pop
+        .endm
        .align  5
+BUILD_ROLLBACK_PROLOGUE handle_int
 NESTED(handle_int, PT_SIZE, sp)
 #ifdef CONFIG_TRACE_IRQFLAGS
        /*
@@ -201,6 +237,7 @@ NESTED(except_vec_ejtag_debug, 0, sp)
 * This prototype is copied to ebase + n*IntCtl.VS and patched
 * to invoke the handler
 */
+BUILD_ROLLBACK_PROLOGUE except_vec_vi
 NESTED(except_vec_vi, 0, sp)
        SAVE_SOME
        SAVE_AT
@@ -245,8 +282,8 @@ NESTED(except_vec_vi_handler, 0, sp)
        and     t0, a0, t1
 #ifdef CONFIG_MIPS_MT_SMTC_IM_BACKSTOP
        mfc0    t2, CP0_TCCONTEXT
-        or      t0, t0, t2
+        or      t2, t0, t2
-        mtc0    t0, CP0_TCCONTEXT
+        mtc0    t2, CP0_TCCONTEXT
 #endif /* CONFIG_MIPS_MT_SMTC_IM_BACKSTOP */
        xor     t1, t1, t0
        mtc0    t1, CP0_STATUS
diff --git a/arch/mips/kernel/head.S b/arch/mips/kernel/head.S
index 361364501d34..492a0a8d70fb 100644
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -22,6 +22,7 @@
 #include <asm/irqflags.h>
 #include <asm/regdef.h>
 #include <asm/page.h>
+#include <asm/pgtable-bits.h>
 #include <asm/mipsregs.h>
 #include <asm/stackframe.h>
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 8f6d58ede33c..6e152c80cd4a 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -236,8 +236,7 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
                atomic_set(&kgdb_cpu_doing_single_step, -1);
                if (remcom_in_buffer[0] == 's')
-                        if (kgdb_contthread)
+                        atomic_set(&kgdb_cpu_doing_single_step, cpu);
-                                atomic_set(&kgdb_cpu_doing_single_step, cpu);
                return 0;
        }
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index df4d3f2f740c..dc9eb72ed9de 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -159,7 +159,7 @@ __setup("fpaff=", fpaff_thresh);
 /*
 * FPU Use Factor empirically derived from experiments on 34K
 */
-#define FPUSEFACTOR 333
+#define FPUSEFACTOR 2000
 static __init int mt_fp_affinity_init(void)
 {
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index b16facd9ea8e..22fc19bbe87f 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -55,7 +55,7 @@ void __noreturn cpu_idle(void)
        while (1) {
                tick_nohz_stop_sched_tick(1);
                while (!need_resched()) {
-#ifdef CONFIG_SMTC_IDLE_HOOK_DEBUG
+#ifdef CONFIG_MIPS_MT_SMTC
                        extern void smtc_idle_loop_hook(void);
                        smtc_idle_loop_hook();
@@ -145,17 +145,18 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long usp,
         */
        p->thread.cp0_status = read_c0_status() & ~(ST0_CU2|ST0_CU1);
        childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
-        clear_tsk_thread_flag(p, TIF_USEDFPU);
-#ifdef CONFIG_MIPS_MT_FPAFF
+#ifdef CONFIG_MIPS_MT_SMTC
        /*
-         * FPU affinity support is cleaner if we track the
+         * SMTC restores TCStatus after Status, and the CU bits
-         * user-visible CPU affinity from the very beginning.
+         * are aliased there.
-         * The generic cpus_allowed mask will already have
-         * been copied from the parent before copy_thread
-         * is invoked.
         */
-        p->thread.user_cpus_allowed = p->cpus_allowed;
+        childregs->cp0_tcstatus &= ~(ST0_CU2|ST0_CU1);
+#endif
+        clear_tsk_thread_flag(p, TIF_USEDFPU);
+#ifdef CONFIG_MIPS_MT_FPAFF
+        clear_tsk_thread_flag(p, TIF_FPUBOUND);
 #endif /* CONFIG_MIPS_MT_FPAFF */
        if (clone_flags & CLONE_SETTLS)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 35234b92b9a5..96ffc9c6d194 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -238,7 +238,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                case FPC_EIR: { /* implementation / version register */
                        unsigned int flags;
 #ifdef CONFIG_MIPS_MT_SMTC
-                        unsigned int irqflags;
+                        unsigned long irqflags;
                        unsigned int mtflags;
 #endif /* CONFIG_MIPS_MT_SMTC */
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index a516286532ab..897fb2b4751c 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -1,4 +1,21 @@
-/* Copyright (C) 2004 Mips Technologies, Inc */
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ *
+ * Copyright (C) 2004 Mips Technologies, Inc
+ * Copyright (C) 2008 Kevin D. Kissell
+ */
 #include <linux/clockchips.h>
 #include <linux/kernel.h>
@@ -21,7 +38,6 @@
 #include <asm/time.h>
 #include <asm/addrspace.h>
 #include <asm/smtc.h>
-#include <asm/smtc_ipi.h>
 #include <asm/smtc_proc.h>
 /*
@@ -58,11 +74,6 @@ unsigned long irq_hwmask[NR_IRQS];
 asiduse smtc_live_asid[MAX_SMTC_TLBS][MAX_SMTC_ASIDS];
-/*
- * Clock interrupt "latch" buffers, per "CPU"
- */
-static atomic_t ipi_timer_latch[NR_CPUS];
 /*
 * Number of InterProcessor Interrupt (IPI) message buffers to allocate
@@ -70,7 +81,7 @@ static atomic_t ipi_timer_latch[NR_CPUS];
 #define IPIBUF_PER_CPU 4
-static struct smtc_ipi_q IPIQ[NR_CPUS];
+struct smtc_ipi_q IPIQ[NR_CPUS];
 static struct smtc_ipi_q freeIPIq;
@@ -282,7 +293,7 @@ static void smtc_configure_tlb(void)
 * phys_cpu_present_map and the logical/physical mappings.
 */
-int __init mipsmt_build_cpu_map(int start_cpu_slot)
+int __init smtc_build_cpu_map(int start_cpu_slot)
 {
        int i, ntcs;
@@ -325,7 +336,12 @@ static void smtc_tc_setup(int vpe, int tc, int cpu)
        write_tc_c0_tcstatus((read_tc_c0_tcstatus()
                        & ~(TCSTATUS_TKSU | TCSTATUS_DA | TCSTATUS_IXMT))
                        | TCSTATUS_A);
-        write_tc_c0_tccontext(0);
+        /*
+         * TCContext gets an offset from the base of the IPIQ array
+         * to be used in low-level code to detect the presence of
+         * an active IPI queue
+         */
+        write_tc_c0_tccontext((sizeof(struct smtc_ipi_q) * cpu) << 16);
        /* Bind tc to vpe */
        write_tc_c0_tcbind(vpe);
        /* In general, all TCs should have the same cpu_data indications */
@@ -336,10 +352,18 @@ static void smtc_tc_setup(int vpe, int tc, int cpu)
                cpu_data[cpu].options &= ~MIPS_CPU_FPU;
        cpu_data[cpu].vpe_id = vpe;
        cpu_data[cpu].tc_id = tc;
+        /* Multi-core SMTC hasn't been tested, but be prepared */
+        cpu_data[cpu].core = (read_vpe_c0_ebase() >> 1) & 0xff;
 }
+/*
+ * Tweak to get Count registes in as close a sync as possible.
+ * Value seems good for 34K-class cores.
+ */
+#define CP0_SKEW 8
-void mipsmt_prepare_cpus(void)
+void smtc_prepare_cpus(int cpus)
 {
        int i, vpe, tc, ntc, nvpe, tcpervpe[NR_CPUS], slop, cpu;
        unsigned long flags;
@@ -363,13 +387,13 @@ void mipsmt_prepare_cpus(void)
                IPIQ[i].head = IPIQ[i].tail = NULL;
                spin_lock_init(&IPIQ[i].lock);
                IPIQ[i].depth = 0;
-                atomic_set(&ipi_timer_latch[i], 0);
        }
        /* cpu_data index starts at zero */
        cpu = 0;
        cpu_data[cpu].vpe_id = 0;
        cpu_data[cpu].tc_id = 0;
+        cpu_data[cpu].core = (read_c0_ebase() >> 1) & 0xff;
        cpu++;
        /* Report on boot-time options */
@@ -484,7 +508,8 @@ void mipsmt_prepare_cpus(void)
                        write_vpe_c0_compare(0);
                        /* Propagate Config7 */
                        write_vpe_c0_config7(read_c0_config7());
-                        write_vpe_c0_count(read_c0_count());
+                        write_vpe_c0_count(read_c0_count() + CP0_SKEW);
+                        ehb();
                }
                /* enable multi-threading within VPE */
                write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() | VPECONTROL_TE);
@@ -556,7 +581,7 @@ void mipsmt_prepare_cpus(void)
 void __cpuinit smtc_boot_secondary(int cpu, struct task_struct *idle)
 {
        extern u32 kernelsp[NR_CPUS];
-        long flags;
+        unsigned long flags;
        int mtflags;
        LOCK_MT_PRA();
@@ -585,24 +610,22 @@ void __cpuinit smtc_boot_secondary(int cpu, struct task_struct *idle)
 void smtc_init_secondary(void)
 {
-        /*
-         * Start timer on secondary VPEs if necessary.
-         * plat_timer_setup has already have been invoked by init/main
-         * on "boot" TC.  Like per_cpu_trap_init() hack, this assumes that
-         * SMTC init code assigns TCs consdecutively and in ascending order
-         * to across available VPEs.
-         */
-        if (((read_c0_tcbind() & TCBIND_CURTC) != 0) &&
-            ((read_c0_tcbind() & TCBIND_CURVPE)
-            != cpu_data[smp_processor_id() - 1].vpe_id)){
-                write_c0_compare(read_c0_count() + mips_hpt_frequency/HZ);
-        }
        local_irq_enable();
 }
 void smtc_smp_finish(void)
 {
+        int cpu = smp_processor_id();
+        /*
+         * Lowest-numbered CPU per VPE starts a clock tick.
+         * Like per_cpu_trap_init() hack, this assumes that
+         * SMTC init code assigns TCs consdecutively and
+         * in ascending order across available VPEs.
+         */
+        if (cpu > 0 && (cpu_data[cpu].vpe_id != cpu_data[cpu - 1].vpe_id))
+                write_c0_compare(read_c0_count() + mips_hpt_frequency/HZ);
        printk("TC %d going on-line as CPU %d\n",
                cpu_data[smp_processor_id()].tc_id, smp_processor_id());
 }
@@ -753,8 +776,10 @@ void smtc_send_ipi(int cpu, int type, unsigned int action)
 {
        int tcstatus;
        struct smtc_ipi *pipi;
-        long flags;
+        unsigned long flags;
        int mtflags;
+        unsigned long tcrestart;
+        extern void r4k_wait_irqoff(void), __pastwait(void);
        if (cpu == smp_processor_id()) {
                printk("Cannot Send IPI to self!\n");
@@ -771,8 +796,6 @@ void smtc_send_ipi(int cpu, int type, unsigned int action)
        pipi->arg = (void *)action;
        pipi->dest = cpu;
        if (cpu_data[cpu].vpe_id != cpu_data[smp_processor_id()].vpe_id) {
-                if (type == SMTC_CLOCK_TICK)
-                        atomic_inc(&ipi_timer_latch[cpu]);
                /* If not on same VPE, enqueue and send cross-VPE interrupt */
                smtc_ipi_nq(&IPIQ[cpu], pipi);
                LOCK_CORE_PRA();
@@ -800,22 +823,29 @@ void smtc_send_ipi(int cpu, int type, unsigned int action)
                if ((tcstatus & TCSTATUS_IXMT) != 0) {
                        /*
-                         * Spin-waiting here can deadlock,
+                         * If we're in the the irq-off version of the wait
-                         * so we queue the message for the target TC.
+                         * loop, we need to force exit from the wait and
+                         * do a direct post of the IPI.
+                         */
+                        if (cpu_wait == r4k_wait_irqoff) {
+                                tcrestart = read_tc_c0_tcrestart();
+                                if (tcrestart >= (unsigned long)r4k_wait_irqoff
+                                    && tcrestart < (unsigned long)__pastwait) {
+                                        write_tc_c0_tcrestart(__pastwait);
+                                        tcstatus &= ~TCSTATUS_IXMT;
+                                        write_tc_c0_tcstatus(tcstatus);
+                                        goto postdirect;
+                                }
+                        }
+                        /*
+                         * Otherwise we queue the message for the target TC
+                         * to pick up when he does a local_irq_restore()
                         */
                        write_tc_c0_tchalt(0);
                        UNLOCK_CORE_PRA();
-                        /* Try to reduce redundant timer interrupt messages */
-                        if (type == SMTC_CLOCK_TICK) {
-                            if (atomic_postincrement(&ipi_timer_latch[cpu])!=0){
-                                smtc_ipi_nq(&freeIPIq, pipi);
-                                return;
-                            }
-                        }
                        smtc_ipi_nq(&IPIQ[cpu], pipi);
                } else {
-                        if (type == SMTC_CLOCK_TICK)
+postdirect:
-                                atomic_inc(&ipi_timer_latch[cpu]);
                        post_direct_ipi(cpu, pipi);
                        write_tc_c0_tchalt(0);
                        UNLOCK_CORE_PRA();
@@ -883,7 +913,7 @@ static void ipi_call_interrupt(void)
        smp_call_function_interrupt();
 }
-DECLARE_PER_CPU(struct clock_event_device, smtc_dummy_clockevent_device);
+DECLARE_PER_CPU(struct clock_event_device, mips_clockevent_device);
 void ipi_decode(struct smtc_ipi *pipi)
 {
@@ -891,20 +921,13 @@ void ipi_decode(struct smtc_ipi *pipi)
        struct clock_event_device *cd;
        void *arg_copy = pipi->arg;
        int type_copy = pipi->type;
-        int ticks;
        smtc_ipi_nq(&freeIPIq, pipi);
        switch (type_copy) {
        case SMTC_CLOCK_TICK:
                irq_enter();
                kstat_this_cpu.irqs[MIPS_CPU_IRQ_BASE + 1]++;
-                cd = &per_cpu(smtc_dummy_clockevent_device, cpu);
+                cd = &per_cpu(mips_clockevent_device, cpu);
-                ticks = atomic_read(&ipi_timer_latch[cpu]);
+                cd->event_handler(cd);
-                atomic_sub(ticks, &ipi_timer_latch[cpu]);
-                while (ticks) {
-                        cd->event_handler(cd);
-                        ticks--;
-                }
                irq_exit();
                break;
@@ -937,24 +960,48 @@ void ipi_decode(struct smtc_ipi *pipi)
        }
 }
+/*
+ * Similar to smtc_ipi_replay(), but invoked from context restore,
+ * so it reuses the current exception frame rather than set up a
+ * new one with self_ipi.
+ */
 void deferred_smtc_ipi(void)
 {
-        struct smtc_ipi *pipi;
+        int cpu = smp_processor_id();
-        unsigned long flags;
-/* DEBUG */
-        int q = smp_processor_id();
        /*
         * Test is not atomic, but much faster than a dequeue,
         * and the vast majority of invocations will have a null queue.
+         * If irq_disabled when this was called, then any IPIs queued
+         * after we test last will be taken on the next irq_enable/restore.
+         * If interrupts were enabled, then any IPIs added after the
+         * last test will be taken directly.
         */
-        if (IPIQ[q].head != NULL) {
-                while((pipi = smtc_ipi_dq(&IPIQ[q])) != NULL) {
+        while (IPIQ[cpu].head != NULL) {
-                        /* ipi_decode() should be called with interrupts off */
+                struct smtc_ipi_q *q = &IPIQ[cpu];
-                        local_irq_save(flags);
+                struct smtc_ipi *pipi;
+                unsigned long flags;
+                /*
+                 * It may be possible we'll come in with interrupts
+                 * already enabled.
+                 */
+                local_irq_save(flags);
+                spin_lock(&q->lock);
+                pipi = __smtc_ipi_dq(q);
+                spin_unlock(&q->lock);
+                if (pipi != NULL)
                        ipi_decode(pipi);
-                        local_irq_restore(flags);
+                /*
-                }
+                 * The use of the __raw_local restore isn't
+                 * as obviously necessary here as in smtc_ipi_replay(),
+                 * but it's more efficient, given that we're already
+                 * running down the IPI queue.
+                 */
+                __raw_local_irq_restore(flags);
        }
 }
@@ -975,7 +1022,7 @@ static irqreturn_t ipi_interrupt(int irq, void *dev_idm)
        struct smtc_ipi *pipi;
        unsigned long tcstatus;
        int sent;
-        long flags;
+        unsigned long flags;
        unsigned int mtflags;
        unsigned int vpflags;
@@ -1066,55 +1113,53 @@ static void setup_cross_vpe_interrupts(unsigned int nvpe)
 /*
 * SMTC-specific hacks invoked from elsewhere in the kernel.
- *
- * smtc_ipi_replay is called from raw_local_irq_restore which is only ever
- * called with interrupts disabled.  We do rely on interrupts being disabled
- * here because using spin_lock_irqsave()/spin_unlock_irqrestore() would
- * result in a recursive call to raw_local_irq_restore().
 */
-static void __smtc_ipi_replay(void)
+ /*
+  * smtc_ipi_replay is called from raw_local_irq_restore
+  */
+void smtc_ipi_replay(void)
 {
        unsigned int cpu = smp_processor_id();
        /*
         * To the extent that we've ever turned interrupts off,
         * we may have accumulated deferred IPIs.  This is subtle.
-         * If we use the smtc_ipi_qdepth() macro, we'll get an
-         * exact number - but we'll also disable interrupts
-         * and create a window of failure where a new IPI gets
-         * queued after we test the depth but before we re-enable
-         * interrupts. So long as IXMT never gets set, however,
         * we should be OK:  If we pick up something and dispatch
         * it here, that's great. If we see nothing, but concurrent
         * with this operation, another TC sends us an IPI, IXMT
         * is clear, and we'll handle it as a real pseudo-interrupt
-         * and not a pseudo-pseudo interrupt.
+         * and not a pseudo-pseudo interrupt.  The important thing
+         * is to do the last check for queued message *after* the
+         * re-enabling of interrupts.
         */
-        if (IPIQ[cpu].depth > 0) {
+        while (IPIQ[cpu].head != NULL) {
-                while (1) {
+                struct smtc_ipi_q *q = &IPIQ[cpu];
-                        struct smtc_ipi_q *q = &IPIQ[cpu];
+                struct smtc_ipi *pipi;
-                        struct smtc_ipi *pipi;
+                unsigned long flags;
-                        extern void self_ipi(struct smtc_ipi *);
+                /*
-                        spin_lock(&q->lock);
+                 * It's just possible we'll come in with interrupts
-                        pipi = __smtc_ipi_dq(q);
+                 * already enabled.
-                        spin_unlock(&q->lock);
+                 */
-                        if (!pipi)
+                local_irq_save(flags);
-                                break;
+                spin_lock(&q->lock);
+                pipi = __smtc_ipi_dq(q);
+                spin_unlock(&q->lock);
+                /*
+                 ** But use a raw restore here to avoid recursion.
+                 */
+                __raw_local_irq_restore(flags);
+                if (pipi) {
                        self_ipi(pipi);
                        smtc_cpu_stats[cpu].selfipis++;
                }
        }
 }
-void smtc_ipi_replay(void)
-{
-        raw_local_irq_disable();
-        __smtc_ipi_replay();
-}
 EXPORT_SYMBOL(smtc_ipi_replay);
 void smtc_idle_loop_hook(void)
@@ -1193,40 +1238,13 @@ void smtc_idle_loop_hook(void)
                }
        }
-        /*
-         * Now that we limit outstanding timer IPIs, check for hung TC
-         */
-        for (tc = 0; tc < NR_CPUS; tc++) {
-                /* Don't check ourself - we'll dequeue IPIs just below */
-                if ((tc != smp_processor_id()) &&
-                    atomic_read(&ipi_timer_latch[tc]) > timerq_limit) {
-                    if (clock_hang_reported[tc] == 0) {
-                        pdb_msg += sprintf(pdb_msg,
-                                "TC %d looks hung with timer latch at %d\n",
-                                tc, atomic_read(&ipi_timer_latch[tc]));
-                        clock_hang_reported[tc]++;
-                        }
-                }
-        }
        emt(mtflags);
        local_irq_restore(flags);
        if (pdb_msg != &id_ho_db_msg[0])
                printk("CPU%d: %s", smp_processor_id(), id_ho_db_msg);
 #endif /* CONFIG_SMTC_IDLE_HOOK_DEBUG */
-        /*
+        smtc_ipi_replay();
-         * Replay any accumulated deferred IPIs. If "Instant Replay"
-         * is in use, there should never be any.
-         */
-#ifndef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
-        {
-                unsigned long flags;
-                local_irq_save(flags);
-                __smtc_ipi_replay();
-                local_irq_restore(flags);
-        }
-#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
 }
 void smtc_soft_dump(void)
@@ -1242,10 +1260,6 @@ void smtc_soft_dump(void)
                printk("%d: %ld\n", i, smtc_cpu_stats[i].selfipis);
        }
        smtc_ipi_qdump();
-        printk("Timer IPI Backlogs:\n");
-        for (i=0; i < NR_CPUS; i++) {
-                printk("%d: %d\n", i, atomic_read(&ipi_timer_latch[i]));
-        }
        printk("%d Recoveries of \"stolen\" FPU\n",
               atomic_read(&smtc_fpu_recoveries));
 }
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 6bee29097a56..b602ac6eb47d 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -46,6 +46,9 @@
 #include <asm/types.h>
 #include <asm/stacktrace.h>
+extern void check_wait(void);
+extern asmlinkage void r4k_wait(void);
+extern asmlinkage void rollback_handle_int(void);
 extern asmlinkage void handle_int(void);
 extern asmlinkage void handle_tlbm(void);
 extern asmlinkage void handle_tlbl(void);
@@ -822,8 +825,10 @@ static void mt_ase_fp_affinity(void)
                if (cpus_intersects(current->cpus_allowed, mt_fpu_cpumask)) {
                        cpumask_t tmask;
-                        cpus_and(tmask, current->thread.user_cpus_allowed,
+                        current->thread.user_cpus_allowed
-                                 mt_fpu_cpumask);
+                                = current->cpus_allowed;
+                        cpus_and(tmask, current->cpus_allowed,
+                                mt_fpu_cpumask);
                        set_cpus_allowed(current, tmask);
                        set_thread_flag(TIF_FPUBOUND);
                }
@@ -1251,6 +1256,9 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs)
                extern char except_vec_vi, except_vec_vi_lui;
                extern char except_vec_vi_ori, except_vec_vi_end;
+                extern char rollback_except_vec_vi;
+                char *vec_start = (cpu_wait == r4k_wait) ?
+                        &rollback_except_vec_vi : &except_vec_vi;
 #ifdef CONFIG_MIPS_MT_SMTC
                /*
                 * We need to provide the SMTC vectored interrupt handler
@@ -1258,11 +1266,11 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs)
                 * Status.IM bit to be masked before going there.
                 */
                extern char except_vec_vi_mori;
-                const int mori_offset = &except_vec_vi_mori - &except_vec_vi;
+                const int mori_offset = &except_vec_vi_mori - vec_start;
 #endif /* CONFIG_MIPS_MT_SMTC */
-                const int handler_len = &except_vec_vi_end - &except_vec_vi;
+                const int handler_len = &except_vec_vi_end - vec_start;
-                const int lui_offset = &except_vec_vi_lui - &except_vec_vi;
+                const int lui_offset = &except_vec_vi_lui - vec_start;
-                const int ori_offset = &except_vec_vi_ori - &except_vec_vi;
+                const int ori_offset = &except_vec_vi_ori - vec_start;
                if (handler_len > VECTORSPACING) {
                        /*
@@ -1272,7 +1280,7 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs)
                        panic("VECTORSPACING too small");
                }
-                memcpy(b, &except_vec_vi, handler_len);
+                memcpy(b, vec_start, handler_len);
 #ifdef CONFIG_MIPS_MT_SMTC
                BUG_ON(n > 7);  /* Vector index %d exceeds SMTC maximum. */
@@ -1554,6 +1562,10 @@ void __init trap_init(void)
        extern char except_vec3_generic, except_vec3_r4000;
        extern char except_vec4;
        unsigned long i;
+        int rollback;
+        check_wait();
+        rollback = (cpu_wait == r4k_wait);
 #if defined(CONFIG_KGDB)
        if (kgdb_early_setup)
@@ -1618,7 +1630,7 @@ void __init trap_init(void)
        if (board_be_init)
                board_be_init();
-        set_except_vector(0, handle_int);
+        set_except_vector(0, rollback ? rollback_handle_int : handle_int);
        set_except_vector(1, handle_tlbm);
        set_except_vector(2, handle_tlbl);
        set_except_vector(3, handle_tlbs);
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index b5470ceb418b..afb119f35682 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -36,6 +36,7 @@ SECTIONS
                SCHED_TEXT
                LOCK_TEXT
                KPROBES_TEXT
+                *(.text.*)
                *(.fixup)
                *(.gnu.warning)
        } :text = 0
diff --git a/arch/mips/lib/csum_partial.S b/arch/mips/lib/csum_partial.S
index 8d7784122c14..edac9892c51a 100644
--- a/arch/mips/lib/csum_partial.S
+++ b/arch/mips/lib/csum_partial.S
@@ -39,12 +39,14 @@
 #ifdef USE_DOUBLE
 #define LOAD   ld
+#define LOAD32 lwu
 #define ADD    daddu
 #define NBYTES 8
 #else
 #define LOAD   lw
+#define LOAD32 lw
 #define ADD    addu
 #define NBYTES 4
@@ -60,6 +62,14 @@
        ADD     sum, v1;                                        \
        .set    pop
+#define ADDC32(sum,reg)                                         \
+        .set    push;                                           \
+        .set    noat;                                           \
+        addu    sum, reg;                                       \
+        sltu    v1, sum, reg;                                   \
+        addu    sum, v1;                                        \
+        .set    pop
 #define CSUM_BIGCHUNK1(src, offset, sum, _t0, _t1, _t2, _t3)    \
        LOAD    _t0, (offset + UNIT(0))(src);                   \
        LOAD    _t1, (offset + UNIT(1))(src);                   \
@@ -132,7 +142,7 @@ LEAF(csum_partial)
        beqz    t8, .Lqword_align
         andi   t8, src, 0x8
-        lw      t0, 0x00(src)
+        LOAD32  t0, 0x00(src)
        LONG_SUBU       a1, a1, 0x4
        ADDC(sum, t0)
        PTR_ADDU        src, src, 0x4
@@ -211,7 +221,7 @@ LEAF(csum_partial)
        LONG_SRL        t8, t8, 0x2
 .Lend_words:
-        lw      t0, (src)
+        LOAD32  t0, (src)
        LONG_SUBU       t8, t8, 0x1
        ADDC(sum, t0)
        .set    reorder                         /* DADDI_WAR */
@@ -230,6 +240,9 @@ LEAF(csum_partial)
        /* Still a full word to go  */
        ulw     t1, (src)
        PTR_ADDIU       src, 4
+#ifdef USE_DOUBLE
+        dsll    t1, t1, 32                      /* clear lower 32bit */
+#endif
        ADDC(sum, t1)
 1:      move    t1, zero
@@ -280,7 +293,7 @@ LEAF(csum_partial)
 1:
        .set    reorder
        /* Add the passed partial csum.  */
-        ADDC(sum, a2)
+        ADDC32(sum, a2)
        jr      ra
        .set    noreorder
        END(csum_partial)
@@ -681,7 +694,7 @@ EXC(	sb	t0, NBYTES-2(dst), .Ls_exc)
        .set    pop
 1:
        .set reorder
-        ADDC(sum, psum)
+        ADDC32(sum, psum)
        jr      ra
        .set noreorder
diff --git a/arch/mips/mti-malta/Makefile b/arch/mips/mti-malta/Makefile
index 3b7dd722c32a..cef2db8d2225 100644
--- a/arch/mips/mti-malta/Makefile
+++ b/arch/mips/mti-malta/Makefile
@@ -15,6 +15,6 @@ obj-$(CONFIG_EARLY_PRINTK)	+= malta-console.o
 obj-$(CONFIG_PCI)               += malta-pci.o
 # FIXME FIXME FIXME
-obj-$(CONFIG_MIPS_MT_SMTC)      += malta_smtc.o
+obj-$(CONFIG_MIPS_MT_SMTC)      += malta-smtc.o
 EXTRA_CFLAGS += -Werror
diff --git a/arch/mips/mti-malta/malta-smtc.c b/arch/mips/mti-malta/malta-smtc.c
index 5ea705e49454..f84a46a8ae6e 100644
--- a/arch/mips/mti-malta/malta-smtc.c
+++ b/arch/mips/mti-malta/malta-smtc.c
@@ -84,12 +84,17 @@ static void msmtc_cpus_done(void)
 static void __init msmtc_smp_setup(void)
 {
-        mipsmt_build_cpu_map(0);
+        /*
+         * we won't get the definitive value until
+         * we've run smtc_prepare_cpus later, but
+         * we would appear to need an upper bound now.
+         */
+        smp_num_siblings = smtc_build_cpu_map(0);
 }
 static void __init msmtc_prepare_cpus(unsigned int max_cpus)
 {
-        mipsmt_prepare_cpus();
+        smtc_prepare_cpus(max_cpus);
 }
 struct plat_smp_ops msmtc_smp_ops = {
diff --git a/arch/mips/pci/Makefile b/arch/mips/pci/Makefile
index 15e01aec37fd..c8c32f417b6c 100644
--- a/arch/mips/pci/Makefile
+++ b/arch/mips/pci/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_SOC_TX3927)	+= ops-tx3927.o
 obj-$(CONFIG_PCI_VR41XX)        += ops-vr41xx.o pci-vr41xx.o
 obj-$(CONFIG_MARKEINS)          += ops-emma2rh.o pci-emma2rh.o fixup-emma2rh.o
 obj-$(CONFIG_PCI_TX4927)        += ops-tx4927.o
+obj-$(CONFIG_BCM47XX)           += pci-bcm47xx.o
 #
 # These are still pretty much in the old state, watch, go blind.
diff --git a/arch/mips/pci/pci-bcm47xx.c b/arch/mips/pci/pci-bcm47xx.c
new file mode 100644
index 000000000000..bea9b6cdfdbf
--- /dev/null
+++ b/arch/mips/pci/pci-bcm47xx.c
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (C) 2008 Aurelien Jarno <aurelien@aurel32.net>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/ssb/ssb.h>
+int __init pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+{
+        return 0;
+}
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+        int res;
+        u8 slot, pin;
+        res = ssb_pcibios_plat_dev_init(dev);
+        if (res < 0) {
+                printk(KERN_ALERT "PCI: Failed to init device %s\n",
+                       pci_name(dev));
+                return res;
+        }
+        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
+        slot = PCI_SLOT(dev->devfn);
+        res = ssb_pcibios_map_irq(dev, slot, pin);
+        /* IRQ-0 and IRQ-1 are software interrupts. */
+        if (res < 2) {
+                printk(KERN_ALERT "PCI: Failed to map IRQ of device %s\n",
+                       pci_name(dev));
+                return res;
+        }
+        dev->irq = res;
+        return 0;
+}
diff --git a/arch/mips/pci/pci-ip27.c b/arch/mips/pci/pci-ip27.c
index bd78368c82bf..f97ab1461012 100644
--- a/arch/mips/pci/pci-ip27.c
+++ b/arch/mips/pci/pci-ip27.c
@@ -143,25 +143,47 @@ int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
 */
 int __devinit pcibios_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
+        return 0;
+}
+/* Most MIPS systems have straight-forward swizzling needs.  */
+static inline u8 bridge_swizzle(u8 pin, u8 slot)
+{
+        return (((pin - 1) + slot) % 4) + 1;
+}
+static inline struct pci_dev *bridge_root_dev(struct pci_dev *dev)
+{
+        while (dev->bus->parent) {
+                /* Move up the chain of bridges. */
+                dev = dev->bus->self;
+        }
+        return dev;
+}
+/* Do platform specific device initialization at pci_enable_device() time */
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
        struct bridge_controller *bc = BRIDGE_CONTROLLER(dev->bus);
-        int irq = bc->pci_int[slot];
+        struct pci_dev *rdev = bridge_root_dev(dev);
+        int slot = PCI_SLOT(rdev->devfn);
+        int irq;
+        irq = bc->pci_int[slot];
        if (irq == -1) {
-                irq = bc->pci_int[slot] = request_bridge_irq(bc);
+                irq = request_bridge_irq(bc);
                if (irq < 0)
-                        panic("Can't allocate interrupt for PCI device %s\n",
+                        return irq;
-                              pci_name(dev));
+                bc->pci_int[slot] = irq;
        }
        irq_to_bridge[irq] = bc;
        irq_to_slot[irq] = slot;
-        return irq;
+        dev->irq = irq;
-}
-/* Do platform specific device initialization at pci_enable_device() time */
-int pcibios_plat_dev_init(struct pci_dev *dev)
-{
        return 0;
 }
diff --git a/arch/mips/sibyte/swarm/Makefile b/arch/mips/sibyte/swarm/Makefile
index f18ba9201bbc..7b45f199d92a 100644
--- a/arch/mips/sibyte/swarm/Makefile
+++ b/arch/mips/sibyte/swarm/Makefile
@@ -1,3 +1,4 @@
-obj-y                           := setup.o rtc_xicor1241.o rtc_m41t81.o
+obj-y                           := platform.o setup.o rtc_xicor1241.o \
+                                   rtc_m41t81.o
 obj-$(CONFIG_I2C_BOARDINFO)     += swarm-i2c.o
diff --git a/arch/mips/sibyte/swarm/platform.c b/arch/mips/sibyte/swarm/platform.c
new file mode 100644
index 000000000000..54847fe1e564
--- /dev/null
+++ b/arch/mips/sibyte/swarm/platform.c
@@ -0,0 +1,85 @@
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/ata_platform.h>
+#include <asm/sibyte/board.h>
+#include <asm/sibyte/sb1250_genbus.h>
+#include <asm/sibyte/sb1250_regs.h>
+#if defined(CONFIG_SIBYTE_SWARM) || defined(CONFIG_SIBYTE_LITTLESUR)
+#define DRV_NAME        "pata-swarm"
+#define SWARM_IDE_SHIFT 5
+#define SWARM_IDE_BASE  0x1f0
+#define SWARM_IDE_CTRL  0x3f6
+static struct resource swarm_pata_resource[] = {
+        {
+                .name   = "Swarm GenBus IDE",
+                .flags  = IORESOURCE_MEM,
+        }, {
+                .name   = "Swarm GenBus IDE",
+                .flags  = IORESOURCE_MEM,
+        }, {
+                .name   = "Swarm GenBus IDE",
+                .flags  = IORESOURCE_IRQ,
+                .start  = K_INT_GB_IDE,
+                .end    = K_INT_GB_IDE,
+        },
+};
+static struct pata_platform_info pata_platform_data = {
+        .ioport_shift   = SWARM_IDE_SHIFT,
+};
+static struct platform_device swarm_pata_device = {
+        .name           = "pata_platform",
+        .id             = -1,
+        .resource       = swarm_pata_resource,
+        .num_resources  = ARRAY_SIZE(swarm_pata_resource),
+        .dev  = {
+                .platform_data          = &pata_platform_data,
+                .coherent_dma_mask      = ~0,   /* grumble */
+        },
+};
+static int __init swarm_pata_init(void)
+{
+        u8 __iomem *base;
+        phys_t offset, size;
+        struct resource *r;
+        if (!SIBYTE_HAVE_IDE)
+                return -ENODEV;
+        base = ioremap(A_IO_EXT_BASE, 0x800);
+        offset = __raw_readq(base + R_IO_EXT_REG(R_IO_EXT_START_ADDR, IDE_CS));
+        size = __raw_readq(base + R_IO_EXT_REG(R_IO_EXT_MULT_SIZE, IDE_CS));
+        iounmap(base);
+        offset = G_IO_START_ADDR(offset) << S_IO_ADDRBASE;
+        size = (G_IO_MULT_SIZE(size) + 1) << S_IO_REGSIZE;
+        if (offset < A_PHYS_GENBUS || offset >= A_PHYS_GENBUS_END) {
+                pr_info(DRV_NAME ": PATA interface at GenBus disabled\n");
+                return -EBUSY;
+        }
+        pr_info(DRV_NAME ": PATA interface at GenBus slot %i\n", IDE_CS);
+        r = swarm_pata_resource;
+        r[0].start = offset + (SWARM_IDE_BASE << SWARM_IDE_SHIFT);
+        r[0].end   = offset + ((SWARM_IDE_BASE + 8) << SWARM_IDE_SHIFT) - 1;
+        r[1].start = offset + (SWARM_IDE_CTRL << SWARM_IDE_SHIFT);
+        r[1].end   = offset + ((SWARM_IDE_CTRL + 1) << SWARM_IDE_SHIFT) - 1;
+        return platform_device_register(&swarm_pata_device);
+}
+device_initcall(swarm_pata_init);
+#endif /* defined(CONFIG_SIBYTE_SWARM) || defined(CONFIG_SIBYTE_LITTLESUR) */
diff --git a/arch/mips/vr41xx/common/irq.c b/arch/mips/vr41xx/common/irq.c
index cba36a247e32..92dd1a0ca352 100644
--- a/arch/mips/vr41xx/common/irq.c
+++ b/arch/mips/vr41xx/common/irq.c
@@ -72,6 +72,7 @@ static void irq_dispatch(unsigned int irq)
        cascade = irq_cascade + irq;
        if (cascade->get_irq != NULL) {
                unsigned int source_irq = irq;
+                int ret;
                desc = irq_desc + source_irq;
                if (desc->chip->mask_ack)
                        desc->chip->mask_ack(source_irq);
@@ -79,8 +80,9 @@ static void irq_dispatch(unsigned int irq)
                        desc->chip->mask(source_irq);
                        desc->chip->ack(source_irq);
                }
-                irq = cascade->get_irq(irq);
+                ret = cascade->get_irq(irq);
-                if (irq < 0)
+                irq = ret;
+                if (ret < 0)
                        atomic_inc(&irq_err_count);
                else
                        irq_dispatch(irq);
diff --git a/arch/mn10300/kernel/irq.c b/arch/mn10300/kernel/irq.c
index 761c434a2488..56c64ccc9c21 100644
--- a/arch/mn10300/kernel/irq.c
+++ b/arch/mn10300/kernel/irq.c
@@ -20,22 +20,8 @@ EXPORT_SYMBOL(__mn10300_irq_enabled_epsw);
 atomic_t irq_err_count;
 /*
- * MN10300 INTC controller operations
+ * MN10300 interrupt controller operations
 */
-static void mn10300_cpupic_disable(unsigned int irq)
-{
-        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_DETECT;
-        tmp = GxICR(irq);
-}
-static void mn10300_cpupic_enable(unsigned int irq)
-{
-        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
-        tmp = GxICR(irq);
-}
 static void mn10300_cpupic_ack(unsigned int irq)
 {
        u16 tmp;
@@ -60,26 +46,54 @@ static void mn10300_cpupic_mask_ack(unsigned int irq)
 static void mn10300_cpupic_unmask(unsigned int irq)
 {
        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE | GxICR_DETECT;
+        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
        tmp = GxICR(irq);
 }
-static void mn10300_cpupic_end(unsigned int irq)
+static void mn10300_cpupic_unmask_clear(unsigned int irq)
 {
+        /* the MN10300 PIC latches its interrupt request bit, even after the
+         * device has ceased to assert its interrupt line and the interrupt
+         * channel has been disabled in the PIC, so for level-triggered
+         * interrupts we need to clear the request bit when we re-enable */
        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
+        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE | GxICR_DETECT;
        tmp = GxICR(irq);
 }
-static struct irq_chip mn10300_cpu_pic = {
+/*
-        .name           = "cpu",
+ * MN10300 PIC level-triggered IRQ handling.
-        .disable        = mn10300_cpupic_disable,
+ *
-        .enable         = mn10300_cpupic_enable,
+ * The PIC has no 'ACK' function per se.  It is possible to clear individual
+ * channel latches, but each latch relatches whether or not the channel is
+ * masked, so we need to clear the latch when we unmask the channel.
+ *
+ * Also for this reason, we don't supply an ack() op (it's unused anyway if
+ * mask_ack() is provided), and mask_ack() just masks.
+ */
+static struct irq_chip mn10300_cpu_pic_level = {
+        .name           = "cpu_l",
+        .disable        = mn10300_cpupic_mask,
+        .enable         = mn10300_cpupic_unmask_clear,
+        .ack            = NULL,
+        .mask           = mn10300_cpupic_mask,
+        .mask_ack       = mn10300_cpupic_mask,
+        .unmask         = mn10300_cpupic_unmask_clear,
+};
+/*
+ * MN10300 PIC edge-triggered IRQ handling.
+ *
+ * We use the latch clearing function of the PIC as the 'ACK' function.
+ */
+static struct irq_chip mn10300_cpu_pic_edge = {
+        .name           = "cpu_e",
+        .disable        = mn10300_cpupic_mask,
+        .enable         = mn10300_cpupic_unmask,
        .ack            = mn10300_cpupic_ack,
        .mask           = mn10300_cpupic_mask,
        .mask_ack       = mn10300_cpupic_mask_ack,
        .unmask         = mn10300_cpupic_unmask,
-        .end            = mn10300_cpupic_end,
 };
 /*
@@ -114,7 +128,8 @@ void set_intr_level(int irq, u16 level)
 */
 void set_intr_postackable(int irq)
 {
-        set_irq_handler(irq, handle_level_irq);
+        set_irq_chip_and_handler(irq, &mn10300_cpu_pic_level,
+                                 handle_level_irq);
 }
 /*
@@ -126,8 +141,12 @@ void __init init_IRQ(void)
        for (irq = 0; irq < NR_IRQS; irq++)
                if (irq_desc[irq].chip == &no_irq_type)
-                        set_irq_chip_and_handler(irq, &mn10300_cpu_pic,
+                        /* due to the PIC latching interrupt requests, even
-                                                 handle_edge_irq);
+                         * when the IRQ is disabled, IRQ_PENDING is superfluous
+                         * and we can use handle_level_irq() for edge-triggered
+                         * interrupts */
+                        set_irq_chip_and_handler(irq, &mn10300_cpu_pic_edge,
+                                                 handle_level_irq);
        unit_init_IRQ();
 }
diff --git a/arch/mn10300/kernel/time.c b/arch/mn10300/kernel/time.c
index babb7c2ac377..e4606586f94c 100644
--- a/arch/mn10300/kernel/time.c
+++ b/arch/mn10300/kernel/time.c
@@ -1,6 +1,6 @@
 /* MN10300 Low level time management
 *
- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
+ * Copyright (C) 2007-2008 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 * - Derived from arch/i386/kernel/time.c
 *
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/smp.h>
 #include <linux/profile.h>
+#include <linux/cnt32_to_63.h>
 #include <asm/irq.h>
 #include <asm/div64.h>
 #include <asm/processor.h>
@@ -40,27 +41,54 @@ static struct irqaction timer_irq = {
        .name           = "timer",
 };
+static unsigned long sched_clock_multiplier;
 /*
 * scheduler clock - returns current time in nanosec units.
 */
 unsigned long long sched_clock(void)
 {
        union {
-                unsigned long long l;
+                unsigned long long ll;
-                u32 w[2];
+                unsigned l[2];
-        } quot;
+        } tsc64, result;
+        unsigned long tsc, tmp;
+        unsigned product[3]; /* 96-bit intermediate value */
+        /* read the TSC value
+         */
+        tsc = 0 - get_cycles(); /* get_cycles() counts down */
-        quot.w[0] = mn10300_last_tsc - get_cycles();
+        /* expand to 64-bits.
-        quot.w[1] = 1000000000;
+         * - sched_clock() must be called once a minute or better or the
+         *   following will go horribly wrong - see cnt32_to_63()
+         */
+        tsc64.ll = cnt32_to_63(tsc) & 0x7fffffffffffffffULL;
-        asm("mulu %2,%3,%0,%1"
+        /* scale the 64-bit TSC value to a nanosecond value via a 96-bit
-            : "=r"(quot.w[1]), "=r"(quot.w[0])
+         * intermediate
-            : "0"(quot.w[1]), "1"(quot.w[0])
+         */
+        asm("mulu       %2,%0,%3,%0     \n"     /* LSW * mult ->  0:%3:%0 */
+            "mulu       %2,%1,%2,%1     \n"     /* MSW * mult -> %2:%1:0 */
+            "add        %3,%1           \n"
+            "addc       0,%2            \n"     /* result in %2:%1:%0 */
+            : "=r"(product[0]), "=r"(product[1]), "=r"(product[2]), "=r"(tmp)
+            :  "0"(tsc64.l[0]),  "1"(tsc64.l[1]),  "2"(sched_clock_multiplier)
            : "cc");
-        do_div(quot.l, MN10300_TSCCLK);
+        result.l[0] = product[1] << 16 | product[0] >> 16;
+        result.l[1] = product[2] << 16 | product[1] >> 16;
-        return quot.l;
+        return result.ll;
+}
+/*
+ * initialise the scheduler clock
+ */
+static void __init mn10300_sched_clock_init(void)
+{
+        sched_clock_multiplier =
+                __muldiv64u(NSEC_PER_SEC, 1 << 16, MN10300_TSCCLK);
 }
 /*
@@ -128,4 +156,6 @@ void __init time_init(void)
        /* start the watchdog timer */
        watchdog_go();
 #endif
+        mn10300_sched_clock_init();
 }
diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
index 78f092ca0316..33cf25025dac 100644
--- a/arch/mn10300/mm/fault.c
+++ b/arch/mn10300/mm/fault.c
@@ -174,7 +174,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long fault_code,
         * If we're in an interrupt or have no user
         * context, we must not take the fault..
         */
-        if (in_interrupt() || !mm)
+        if (in_atomic() || !mm)
                goto no_context;
        down_read(&mm->mmap_sem);
diff --git a/arch/mn10300/unit-asb2303/unit-init.c b/arch/mn10300/unit-asb2303/unit-init.c
index 14b2c817cff8..70e8cb4ea266 100644
--- a/arch/mn10300/unit-asb2303/unit-init.c
+++ b/arch/mn10300/unit-asb2303/unit-init.c
@@ -51,7 +51,7 @@ void __init unit_init_IRQ(void)
                switch (GET_XIRQ_TRIGGER(extnum)) {
                case XIRQ_TRIGGER_HILEVEL:
                case XIRQ_TRIGGER_LOWLEVEL:
-                        set_irq_handler(XIRQ2IRQ(extnum), handle_level_irq);
+                        set_intr_postackable(XIRQ2IRQ(extnum));
                        break;
                default:
                        break;
diff --git a/arch/mn10300/unit-asb2305/unit-init.c b/arch/mn10300/unit-asb2305/unit-init.c
index 6a352414a358..72812a9439ac 100644
--- a/arch/mn10300/unit-asb2305/unit-init.c
+++ b/arch/mn10300/unit-asb2305/unit-init.c
@@ -52,7 +52,7 @@ void __init unit_init_IRQ(void)
                switch (GET_XIRQ_TRIGGER(extnum)) {
                case XIRQ_TRIGGER_HILEVEL:
                case XIRQ_TRIGGER_LOWLEVEL:
-                        set_irq_handler(XIRQ2IRQ(extnum), handle_level_irq);
+                        set_intr_postackable(XIRQ2IRQ(extnum));
                        break;
                default:
                        break;
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 717a3bc1352e..65d1a8454d2c 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -195,7 +195,7 @@ image-$(CONFIG_PPC_CELLEB)		+= zImage.pseries
 image-$(CONFIG_PPC_CHRP)                += zImage.chrp
 image-$(CONFIG_PPC_EFIKA)               += zImage.chrp
 image-$(CONFIG_PPC_PMAC)                += zImage.pmac
-image-$(CONFIG_PPC_HOLLY)               += zImage.holly
+image-$(CONFIG_PPC_HOLLY)               += dtbImage.holly
 image-$(CONFIG_PPC_PRPMC2800)           += dtbImage.prpmc2800
 image-$(CONFIG_PPC_ISERIES)             += zImage.iseries
 image-$(CONFIG_DEFAULT_UIMAGE)          += uImage
diff --git a/arch/powerpc/boot/dts/holly.dts b/arch/powerpc/boot/dts/holly.dts
index f87fe7b9ced9..c6e11ebecebb 100644
--- a/arch/powerpc/boot/dts/holly.dts
+++ b/arch/powerpc/boot/dts/holly.dts
@@ -133,61 +133,61 @@
                        reg = <0x00007400 0x00000400>;
                        big-endian;
                };
+        };
-                pci@1000 {
+        pci@c0001000 {
-                        device_type = "pci";
+                device_type = "pci";
-                        compatible = "tsi109-pci", "tsi108-pci";
+                compatible = "tsi109-pci", "tsi108-pci";
-                        #interrupt-cells = <1>;
+                #interrupt-cells = <1>;
-                        #size-cells = <2>;
+                #size-cells = <2>;
-                        #address-cells = <3>;
+                #address-cells = <3>;
-                        reg = <0x00001000 0x00001000>;
+                reg = <0xc0001000 0x00001000>;
-                        bus-range = <0x0 0x0>;
+                bus-range = <0x0 0x0>;
-                        /*----------------------------------------------------+
+                /*----------------------------------------------------+
-                        | PCI memory range.
+                | PCI memory range.
-                        | 01 denotes I/O space
+                | 01 denotes I/O space
-                        | 02 denotes 32-bit memory space
+                | 02 denotes 32-bit memory space
-                        +----------------------------------------------------*/
+                +----------------------------------------------------*/
-                        ranges = <0x02000000 0x00000000 0x40000000 0x40000000 0x00000000 0x10000000
+                ranges = <0x02000000 0x00000000 0x40000000 0x40000000 0x00000000 0x10000000
-                                  0x01000000 0x00000000 0x00000000 0x7e000000 0x00000000 0x00010000>;
+                          0x01000000 0x00000000 0x00000000 0x7e000000 0x00000000 0x00010000>;
-                        clock-frequency = <133333332>;
+                clock-frequency = <133333332>;
-                        interrupt-parent = <&MPIC>;
+                interrupt-parent = <&MPIC>;
+                interrupts = <0x17 0x2>;
+                interrupt-map-mask = <0xf800 0x0 0x0 0x7>;
+                /*----------------------------------------------------+
+                | The INTA, INTB, INTC, INTD are shared.
+                +----------------------------------------------------*/
+                interrupt-map = <
+                        0x800 0x0 0x0 0x1 &RT0 0x24 0x0
+                        0x800 0x0 0x0 0x2 &RT0 0x25 0x0
+                        0x800 0x0 0x0 0x3 &RT0 0x26 0x0
+                        0x800 0x0 0x0 0x4 &RT0 0x27 0x0
+                        0x1000 0x0 0x0 0x1 &RT0 0x25 0x0
+                        0x1000 0x0 0x0 0x2 &RT0 0x26 0x0
+                        0x1000 0x0 0x0 0x3 &RT0 0x27 0x0
+                        0x1000 0x0 0x0 0x4 &RT0 0x24 0x0
+                        0x1800 0x0 0x0 0x1 &RT0 0x26 0x0
+                        0x1800 0x0 0x0 0x2 &RT0 0x27 0x0
+                        0x1800 0x0 0x0 0x3 &RT0 0x24 0x0
+                        0x1800 0x0 0x0 0x4 &RT0 0x25 0x0
+                        0x2000 0x0 0x0 0x1 &RT0 0x27 0x0
+                        0x2000 0x0 0x0 0x2 &RT0 0x24 0x0
+                        0x2000 0x0 0x0 0x3 &RT0 0x25 0x0
+                        0x2000 0x0 0x0 0x4 &RT0 0x26 0x0
+                        >;
+                RT0: router@1180 {
+                        device_type = "pic-router";
+                        interrupt-controller;
+                        big-endian;
+                        clock-frequency = <0>;
+                        #address-cells = <0>;
+                        #interrupt-cells = <2>;
                        interrupts = <0x17 0x2>;
-                        interrupt-map-mask = <0xf800 0x0 0x0 0x7>;
+                        interrupt-parent = <&MPIC>;
-                        /*----------------------------------------------------+
-                        | The INTA, INTB, INTC, INTD are shared.
-                        +----------------------------------------------------*/
-                        interrupt-map = <
-                                0x800 0x0 0x0 0x1 &RT0 0x24 0x0
-                                0x800 0x0 0x0 0x2 &RT0 0x25 0x0
-                                0x800 0x0 0x0 0x3 &RT0 0x26 0x0
-                                0x800 0x0 0x0 0x4 &RT0 0x27 0x0
-                                0x1000 0x0 0x0 0x1 &RT0 0x25 0x0
-                                0x1000 0x0 0x0 0x2 &RT0 0x26 0x0
-                                0x1000 0x0 0x0 0x3 &RT0 0x27 0x0
-                                0x1000 0x0 0x0 0x4 &RT0 0x24 0x0
-                                0x1800 0x0 0x0 0x1 &RT0 0x26 0x0
-                                0x1800 0x0 0x0 0x2 &RT0 0x27 0x0
-                                0x1800 0x0 0x0 0x3 &RT0 0x24 0x0
-                                0x1800 0x0 0x0 0x4 &RT0 0x25 0x0
-                                0x2000 0x0 0x0 0x1 &RT0 0x27 0x0
-                                0x2000 0x0 0x0 0x2 &RT0 0x24 0x0
-                                0x2000 0x0 0x0 0x3 &RT0 0x25 0x0
-                                0x2000 0x0 0x0 0x4 &RT0 0x26 0x0
-                                >;
-                        RT0: router@1180 {
-                                device_type = "pic-router";
-                                interrupt-controller;
-                                big-endian;
-                                clock-frequency = <0>;
-                                #address-cells = <0>;
-                                #interrupt-cells = <2>;
-                                interrupts = <0x17 0x2>;
-                                interrupt-parent = <&MPIC>;
-                        };
                };
        };
diff --git a/arch/powerpc/boot/dts/mpc8610_hpcd.dts b/arch/powerpc/boot/dts/mpc8610_hpcd.dts
index 3b3a1062cb25..584a4f184eb2 100644
--- a/arch/powerpc/boot/dts/mpc8610_hpcd.dts
+++ b/arch/powerpc/boot/dts/mpc8610_hpcd.dts
@@ -281,7 +281,7 @@
                                cell-index = <0>;
                                reg = <0x0 0x80>;
                                interrupt-parent = <&mpic>;
-                                interrupts = <60 2>;
+                                interrupts = <76 2>;
                        };
                        dma-channel@1 {
                                compatible = "fsl,mpc8610-dma-channel",
@@ -289,7 +289,7 @@
                                cell-index = <1>;
                                reg = <0x80 0x80>;
                                interrupt-parent = <&mpic>;
-                                interrupts = <61 2>;
+                                interrupts = <77 2>;
                        };
                        dma-channel@2 {
                                compatible = "fsl,mpc8610-dma-channel",
@@ -297,7 +297,7 @@
                                cell-index = <2>;
                                reg = <0x100 0x80>;
                                interrupt-parent = <&mpic>;
-                                interrupts = <62 2>;
+                                interrupts = <78 2>;
                        };
                        dma-channel@3 {
                                compatible = "fsl,mpc8610-dma-channel",
@@ -305,7 +305,7 @@
                                cell-index = <3>;
                                reg = <0x180 0x80>;
                                interrupt-parent = <&mpic>;
-                                interrupts = <63 2>;
+                                interrupts = <79 2>;
                        };
                };
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 80d1f399ee51..64c6ee22eefd 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -409,6 +409,13 @@ do {									\
 /* Keep this the last entry.  */
 #define R_PPC64_NUM             107
+/* There's actually a third entry here, but it's unused */
+struct ppc64_opd_entry
+{
+        unsigned long funcaddr;
+        unsigned long r2;
+};
 #ifdef  __KERNEL__
 #ifdef CONFIG_SPU_BASE
diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h
index 7710e9e6660f..07956f3e7844 100644
--- a/arch/powerpc/include/asm/sections.h
+++ b/arch/powerpc/include/asm/sections.h
@@ -2,6 +2,8 @@
 #define _ASM_POWERPC_SECTIONS_H
 #ifdef __KERNEL__
+#include <linux/elf.h>
+#include <linux/uaccess.h>
 #include <asm-generic/sections.h>
 #ifdef __powerpc64__
@@ -17,7 +19,15 @@ static inline int in_kernel_text(unsigned long addr)
 }
 #undef dereference_function_descriptor
-void *dereference_function_descriptor(void *);
+static inline void *dereference_function_descriptor(void *ptr)
+{
+        struct ppc64_opd_entry *desc = ptr;
+        void *p;
+        if (!probe_kernel_address(&desc->funcaddr, p))
+                ptr = p;
+        return ptr;
+}
 #endif
diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
index d308a9f70f1b..31982d05d81a 100644
--- a/arch/powerpc/kernel/idle.c
+++ b/arch/powerpc/kernel/idle.c
@@ -34,11 +34,7 @@
 #include <asm/smp.h>
 #ifdef CONFIG_HOTPLUG_CPU
-/* this is used for software suspend, and that shuts down
+#define cpu_should_die()        cpu_is_offline(smp_processor_id())
- * CPUs even while the system is still booting... */
-#define cpu_should_die()        (cpu_is_offline(smp_processor_id()) && \
-                                   (system_state == SYSTEM_RUNNING     \
-                                 || system_state == SYSTEM_BOOTING))
 #else
 #define cpu_should_die()        0
 #endif
diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
index b4fdf2f2743c..fe8f71dd0b3f 100644
--- a/arch/powerpc/kernel/kgdb.c
+++ b/arch/powerpc/kernel/kgdb.c
@@ -347,9 +347,8 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
                        linux_regs->msr |= MSR_SE;
 #endif
                        kgdb_single_step = 1;
-                        if (kgdb_contthread)
+                        atomic_set(&kgdb_cpu_doing_single_step,
-                                atomic_set(&kgdb_cpu_doing_single_step,
+                                   raw_smp_processor_id());
-                                           raw_smp_processor_id());
                }
                return 0;
        }
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index ad79de272ff3..1af2377e4992 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -21,9 +21,7 @@
 #include <linux/err.h>
 #include <linux/vmalloc.h>
 #include <linux/bug.h>
-#include <linux/uaccess.h>
 #include <asm/module.h>
-#include <asm/sections.h>
 #include <asm/firmware.h>
 #include <asm/code-patching.h>
 #include <linux/sort.h>
@@ -43,13 +41,6 @@
 #define DEBUGP(fmt , ...)
 #endif
-/* There's actually a third entry here, but it's unused */
-struct ppc64_opd_entry
-{
-        unsigned long funcaddr;
-        unsigned long r2;
-};
 /* Like PPC32, we need little trampolines to do > 24-bit jumps (into
   the kernel itself).  But on PPC64, these need to be used for every
   jump, actually, to reset r2 (TOC+0x8000). */
@@ -452,13 +443,3 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
        return 0;
 }
-void *dereference_function_descriptor(void *ptr)
-{
-        struct ppc64_opd_entry *desc = ptr;
-        void *p;
-        if (!probe_kernel_address(&desc->funcaddr, p))
-                ptr = p;
-        return ptr;
-}
diff --git a/arch/powerpc/platforms/fsl_uli1575.c b/arch/powerpc/platforms/fsl_uli1575.c
index ef74a0763ec1..8c619963becc 100644
--- a/arch/powerpc/platforms/fsl_uli1575.c
+++ b/arch/powerpc/platforms/fsl_uli1575.c
@@ -219,11 +219,21 @@ static void __devinit quirk_final_uli5249(struct pci_dev *dev)
        int i;
        u8 *dummy;
        struct pci_bus *bus = dev->bus;
+        resource_size_t end = 0;
+        for (i = PCI_BRIDGE_RESOURCES; i < PCI_BRIDGE_RESOURCES+3; i++) {
+                unsigned long flags = pci_resource_flags(dev, i);
+                if ((flags & (IORESOURCE_MEM|IORESOURCE_PREFETCH)) == IORESOURCE_MEM)
+                        end = pci_resource_end(dev, i);
+        }
        for (i = 0; i < PCI_BUS_NUM_RESOURCES; i++) {
                if ((bus->resource[i]) &&
                        (bus->resource[i]->flags & IORESOURCE_MEM)) {
-                        dummy = ioremap(bus->resource[i]->end - 3, 0x4);
+                        if (bus->resource[i]->end == end)
+                                dummy = ioremap(bus->resource[i]->start, 0x4);
+                        else
+                                dummy = ioremap(bus->resource[i]->end - 3, 0x4);
                        if (dummy) {
                                in_8(dummy);
                                iounmap(dummy);
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index ca114fe46ffb..06acb1a18bbc 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -169,6 +169,8 @@ void init_cpu_timer(void)
 static void clock_comparator_interrupt(__u16 code)
 {
+        if (S390_lowcore.clock_comparator == -1ULL)
+                set_clock_comparator(S390_lowcore.clock_comparator);
 }
 static void etr_timing_alert(struct etr_irq_parm *);
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index fc6ab6094df8..0953cee05efc 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -1,14 +1,9 @@
 /*
- *  arch/s390/lib/delay.c
 *    Precise Delay Loops for S390
 *
- *  S390 version
+ *    Copyright IBM Corp. 1999,2008
- *    Copyright (C) 1999 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>,
- *    Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com),
+ *               Heiko Carstens <heiko.carstens@de.ibm.com>,
- *
- *  Derived from "arch/i386/lib/delay.c"
- *    Copyright (C) 1993 Linus Torvalds
- *    Copyright (C) 1997 Martin Mares <mj@atrey.karlin.mff.cuni.cz>
 */
 #include <linux/sched.h>
@@ -29,30 +24,31 @@ void __delay(unsigned long loops)
        asm volatile("0: brct %0,0b" : : "d" ((loops/2) + 1));
 }
-/*
+static void __udelay_disabled(unsigned long usecs)
- * Waits for 'usecs' microseconds using the TOD clock comparator.
- */
-void __udelay(unsigned long usecs)
 {
-        u64 end, time, old_cc = 0;
+        unsigned long mask, cr0, cr0_saved;
-        unsigned long flags, cr0, mask, dummy;
+        u64 clock_saved;
-        int irq_context;
-        irq_context = in_interrupt();
+        clock_saved = local_tick_disable();
-        if (!irq_context)
+        set_clock_comparator(get_clock() + ((u64) usecs << 12));
-                local_bh_disable();
+        __ctl_store(cr0_saved, 0, 0);
-        local_irq_save(flags);
+        cr0 = (cr0_saved & 0xffff00e0) | 0x00000800;
-        if (raw_irqs_disabled_flags(flags)) {
+        __ctl_load(cr0 , 0, 0);
-                old_cc = local_tick_disable();
+        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
-                S390_lowcore.clock_comparator = -1ULL;
+        trace_hardirqs_on();
-                __ctl_store(cr0, 0, 0);
+        __load_psw_mask(mask);
-                dummy = (cr0 & 0xffff00e0) | 0x00000800;
+        local_irq_disable();
-                __ctl_load(dummy , 0, 0);
+        __ctl_load(cr0_saved, 0, 0);
-                mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
+        local_tick_enable(clock_saved);
-        } else
+        set_clock_comparator(S390_lowcore.clock_comparator);
-                mask = psw_kernel_bits | PSW_MASK_WAIT |
+}
-                        PSW_MASK_EXT | PSW_MASK_IO;
+static void __udelay_enabled(unsigned long usecs)
+{
+        unsigned long mask;
+        u64 end, time;
+        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT | PSW_MASK_IO;
        end = get_clock() + ((u64) usecs << 12);
        do {
                time = end < S390_lowcore.clock_comparator ?
@@ -62,13 +58,37 @@ void __udelay(unsigned long usecs)
                __load_psw_mask(mask);
                local_irq_disable();
        } while (get_clock() < end);
+        set_clock_comparator(S390_lowcore.clock_comparator);
+}
-        if (raw_irqs_disabled_flags(flags)) {
+/*
-                __ctl_load(cr0, 0, 0);
+ * Waits for 'usecs' microseconds using the TOD clock comparator.
-                local_tick_enable(old_cc);
+ */
+void __udelay(unsigned long usecs)
+{
+        unsigned long flags;
+        preempt_disable();
+        local_irq_save(flags);
+        if (in_irq()) {
+                __udelay_disabled(usecs);
+                goto out;
+        }
+        if (in_softirq()) {
+                if (raw_irqs_disabled_flags(flags))
+                        __udelay_disabled(usecs);
+                else
+                        __udelay_enabled(usecs);
+                goto out;
        }
-        if (!irq_context)
+        if (raw_irqs_disabled_flags(flags)) {
+                local_bh_disable();
+                __udelay_disabled(usecs);
                _local_bh_enable();
-        set_clock_comparator(S390_lowcore.clock_comparator);
+                goto out;
+        }
+        __udelay_enabled(usecs);
+out:
        local_irq_restore(flags);
+        preempt_enable();
 }
diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
index c481d45f97b7..f58c537446a8 100644
--- a/arch/sparc/kernel/of_device.c
+++ b/arch/sparc/kernel/of_device.c
@@ -241,7 +241,7 @@ static int of_bus_sbus_map(u32 *addr, const u32 *range, int na, int ns, int pna)
        return of_bus_default_map(addr, range, na, ns, pna);
 }
-static unsigned int of_bus_sbus_get_flags(const u32 *addr)
+static unsigned long of_bus_sbus_get_flags(const u32 *addr, unsigned long flags)
 {
        return IORESOURCE_MEM;
 }
diff --git a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c
index 20699c701412..8ce6285a06d5 100644
--- a/arch/sparc/kernel/ptrace.c
+++ b/arch/sparc/kernel/ptrace.c
@@ -288,7 +288,7 @@ static const struct user_regset sparc32_regsets[] = {
         */
        [REGSET_GENERAL] = {
                .core_note_type = NT_PRSTATUS,
-                .n = 38 * sizeof(u32),
+                .n = 38,
                .size = sizeof(u32), .align = sizeof(u32),
                .get = genregs32_get, .set = genregs32_set
        },
@@ -304,7 +304,7 @@ static const struct user_regset sparc32_regsets[] = {
         */
        [REGSET_FP] = {
                .core_note_type = NT_PRFPREG,
-                .n = 99 * sizeof(u32),
+                .n = 99,
                .size = sizeof(u32), .align = sizeof(u32),
                .get = fpregs32_get, .set = fpregs32_set
        },
diff --git a/arch/sparc64/kernel/irq.c b/arch/sparc64/kernel/irq.c
index 23963882bc18..7495bc774685 100644
--- a/arch/sparc64/kernel/irq.c
+++ b/arch/sparc64/kernel/irq.c
@@ -7,6 +7,7 @@
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/linkage.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
 #include <linux/kernel_stat.h>
@@ -866,7 +867,7 @@ static void kill_prom_timer(void)
        : "g1", "g2");
 }
-void init_irqwork_curcpu(void)
+void notrace init_irqwork_curcpu(void)
 {
        int cpu = hard_smp_processor_id();
@@ -897,7 +898,7 @@ static void __cpuinit register_one_mondo(unsigned long paddr, unsigned long type
        }
 }
-void __cpuinit sun4v_register_mondo_queues(int this_cpu)
+void __cpuinit notrace sun4v_register_mondo_queues(int this_cpu)
 {
        struct trap_per_cpu *tb = &trap_block[this_cpu];
diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
index f845f150f565..100ebd527499 100644
--- a/arch/sparc64/kernel/of_device.c
+++ b/arch/sparc64/kernel/of_device.c
@@ -169,7 +169,7 @@ static unsigned long of_bus_default_get_flags(const u32 *addr, unsigned long fla
 static int of_bus_pci_match(struct device_node *np)
 {
-        if (!strcmp(np->type, "pci") || !strcmp(np->type, "pciex")) {
+        if (!strcmp(np->name, "pci")) {
                const char *model = of_get_property(np, "model", NULL);
                if (model && !strcmp(model, "SUNW,simba"))
@@ -200,7 +200,7 @@ static int of_bus_simba_match(struct device_node *np)
        /* Treat PCI busses lacking ranges property just like
         * simba.
         */
-        if (!strcmp(np->type, "pci") || !strcmp(np->type, "pciex")) {
+        if (!strcmp(np->name, "pci")) {
                if (!of_find_property(np, "ranges", NULL))
                        return 1;
        }
@@ -429,7 +429,7 @@ static int __init use_1to1_mapping(struct device_node *pp)
         * it lacks a ranges property, and this will include
         * cases like Simba.
         */
-        if (!strcmp(pp->type, "pci") || !strcmp(pp->type, "pciex"))
+        if (!strcmp(pp->name, "pci"))
                return 0;
        return 1;
@@ -714,8 +714,7 @@ static unsigned int __init build_one_device_irq(struct of_device *op,
                                break;
                        }
                } else {
-                        if (!strcmp(pp->type, "pci") ||
+                        if (!strcmp(pp->name, "pci")) {
-                            !strcmp(pp->type, "pciex")) {
                                unsigned int this_orig_irq = irq;
                                irq = pci_irq_swizzle(dp, pp, irq);
diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
index 55096195458f..80dad76f8b81 100644
--- a/arch/sparc64/kernel/pci.c
+++ b/arch/sparc64/kernel/pci.c
@@ -425,7 +425,7 @@ struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
        dev->current_state = 4;         /* unknown power state */
        dev->error_state = pci_channel_io_normal;
-        if (!strcmp(type, "pci") || !strcmp(type, "pciex")) {
+        if (!strcmp(node->name, "pci")) {
                /* a PCI-PCI bridge */
                dev->hdr_type = PCI_HEADER_TYPE_BRIDGE;
                dev->rom_base_reg = PCI_ROM_ADDRESS1;
diff --git a/arch/sparc64/kernel/pci_psycho.c b/arch/sparc64/kernel/pci_psycho.c
index ef5fe29202c2..f85b6bebb0be 100644
--- a/arch/sparc64/kernel/pci_psycho.c
+++ b/arch/sparc64/kernel/pci_psycho.c
@@ -575,7 +575,7 @@ static irqreturn_t psycho_pcierr_intr_other(struct pci_pbm_info *pbm, int is_pbm
 {
        unsigned long csr_reg, csr, csr_error_bits;
        irqreturn_t ret = IRQ_NONE;
-        u16 stat;
+        u16 stat, *addr;
        if (is_pbm_a) {
                csr_reg = pbm->controller_regs + PSYCHO_PCIA_CTRL;
@@ -597,7 +597,9 @@ static irqreturn_t psycho_pcierr_intr_other(struct pci_pbm_info *pbm, int is_pbm
                        printk("%s: PCI SERR signal asserted.\n", pbm->name);
                ret = IRQ_HANDLED;
        }
-        pci_read_config_word(pbm->pci_bus->self, PCI_STATUS, &stat);
+        addr = psycho_pci_config_mkaddr(pbm, pbm->pci_first_busno,
+                                        0, PCI_STATUS);
+        pci_config_read16(addr, &stat);
        if (stat & (PCI_STATUS_PARITY |
                    PCI_STATUS_SIG_TARGET_ABORT |
                    PCI_STATUS_REC_TARGET_ABORT |
@@ -605,7 +607,7 @@ static irqreturn_t psycho_pcierr_intr_other(struct pci_pbm_info *pbm, int is_pbm
                    PCI_STATUS_SIG_SYSTEM_ERROR)) {
                printk("%s: PCI bus error, PCI_STATUS[%04x]\n",
                       pbm->name, stat);
-                pci_write_config_word(pbm->pci_bus->self, PCI_STATUS, 0xffff);
+                pci_config_write16(addr, 0xffff);
                ret = IRQ_HANDLED;
        }
        return ret;
@@ -744,16 +746,16 @@ static void psycho_register_error_handlers(struct pci_pbm_info *pbm)
         * the second will just error out since we do not pass in
         * IRQF_SHARED.
         */
-        err = request_irq(op->irqs[1], psycho_ue_intr, 0,
+        err = request_irq(op->irqs[1], psycho_ue_intr, IRQF_SHARED,
                          "PSYCHO_UE", pbm);
-        err = request_irq(op->irqs[2], psycho_ce_intr, 0,
+        err = request_irq(op->irqs[2], psycho_ce_intr, IRQF_SHARED,
                          "PSYCHO_CE", pbm);
        /* This one, however, ought not to fail.  We can just warn
         * about it since the system can still operate properly even
         * if this fails.
         */
-        err = request_irq(op->irqs[0], psycho_pcierr_intr, 0,
+        err = request_irq(op->irqs[0], psycho_pcierr_intr, IRQF_SHARED,
                          "PSYCHO_PCIERR", pbm);
        if (err)
                printk(KERN_WARNING "%s: Could not register PCIERR, "
diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c
index 3c048ac4e638..7151513f156e 100644
--- a/arch/sparc64/kernel/prom.c
+++ b/arch/sparc64/kernel/prom.c
@@ -156,55 +156,11 @@ static unsigned long psycho_pcislot_imap_offset(unsigned long ino)
                return PSYCHO_IMAP_B_SLOT0 + (slot * 8);
 }
-#define PSYCHO_IMAP_SCSI        0x1000UL
+#define PSYCHO_OBIO_IMAP_BASE   0x1000UL
-#define PSYCHO_IMAP_ETH         0x1008UL
-#define PSYCHO_IMAP_BPP         0x1010UL
-#define PSYCHO_IMAP_AU_REC      0x1018UL
-#define PSYCHO_IMAP_AU_PLAY     0x1020UL
-#define PSYCHO_IMAP_PFAIL       0x1028UL
-#define PSYCHO_IMAP_KMS         0x1030UL
-#define PSYCHO_IMAP_FLPY        0x1038UL
-#define PSYCHO_IMAP_SHW         0x1040UL
-#define PSYCHO_IMAP_KBD         0x1048UL
-#define PSYCHO_IMAP_MS          0x1050UL
-#define PSYCHO_IMAP_SER         0x1058UL
-#define PSYCHO_IMAP_TIM0        0x1060UL
-#define PSYCHO_IMAP_TIM1        0x1068UL
-#define PSYCHO_IMAP_UE          0x1070UL
-#define PSYCHO_IMAP_CE          0x1078UL
-#define PSYCHO_IMAP_A_ERR       0x1080UL
-#define PSYCHO_IMAP_B_ERR       0x1088UL
-#define PSYCHO_IMAP_PMGMT       0x1090UL
-#define PSYCHO_IMAP_GFX         0x1098UL
-#define PSYCHO_IMAP_EUPA        0x10a0UL
-static unsigned long __psycho_onboard_imap_off[] = {
-/*0x20*/        PSYCHO_IMAP_SCSI,
-/*0x21*/        PSYCHO_IMAP_ETH,
-/*0x22*/        PSYCHO_IMAP_BPP,
-/*0x23*/        PSYCHO_IMAP_AU_REC,
-/*0x24*/        PSYCHO_IMAP_AU_PLAY,
-/*0x25*/        PSYCHO_IMAP_PFAIL,
-/*0x26*/        PSYCHO_IMAP_KMS,
-/*0x27*/        PSYCHO_IMAP_FLPY,
-/*0x28*/        PSYCHO_IMAP_SHW,
-/*0x29*/        PSYCHO_IMAP_KBD,
-/*0x2a*/        PSYCHO_IMAP_MS,
-/*0x2b*/        PSYCHO_IMAP_SER,
-/*0x2c*/        PSYCHO_IMAP_TIM0,
-/*0x2d*/        PSYCHO_IMAP_TIM1,
-/*0x2e*/        PSYCHO_IMAP_UE,
-/*0x2f*/        PSYCHO_IMAP_CE,
-/*0x30*/        PSYCHO_IMAP_A_ERR,
-/*0x31*/        PSYCHO_IMAP_B_ERR,
-/*0x32*/        PSYCHO_IMAP_PMGMT,
-/*0x33*/        PSYCHO_IMAP_GFX,
-/*0x34*/        PSYCHO_IMAP_EUPA,
-};
 #define PSYCHO_ONBOARD_IRQ_BASE         0x20
-#define PSYCHO_ONBOARD_IRQ_LAST         0x34
 #define psycho_onboard_imap_offset(__ino) \
-        __psycho_onboard_imap_off[(__ino) - PSYCHO_ONBOARD_IRQ_BASE]
+        (PSYCHO_OBIO_IMAP_BASE + (((__ino) & 0x1f) << 3))
 #define PSYCHO_ICLR_A_SLOT0     0x1400UL
 #define PSYCHO_ICLR_SCSI        0x1800UL
@@ -228,10 +184,6 @@ static unsigned int psycho_irq_build(struct device_node *dp,
                imap_off = psycho_pcislot_imap_offset(ino);
        } else {
                /* Onboard device */
-                if (ino > PSYCHO_ONBOARD_IRQ_LAST) {
-                        prom_printf("psycho_irq_build: Wacky INO [%x]\n", ino);
-                        prom_halt();
-                }
                imap_off = psycho_onboard_imap_offset(ino);
        }
@@ -318,23 +270,6 @@ static void sabre_wsync_handler(unsigned int ino, void *_arg1, void *_arg2)
 #define SABRE_IMAP_A_SLOT0      0x0c00UL
 #define SABRE_IMAP_B_SLOT0      0x0c20UL
-#define SABRE_IMAP_SCSI         0x1000UL
-#define SABRE_IMAP_ETH          0x1008UL
-#define SABRE_IMAP_BPP          0x1010UL
-#define SABRE_IMAP_AU_REC       0x1018UL
-#define SABRE_IMAP_AU_PLAY      0x1020UL
-#define SABRE_IMAP_PFAIL        0x1028UL
-#define SABRE_IMAP_KMS          0x1030UL
-#define SABRE_IMAP_FLPY         0x1038UL
-#define SABRE_IMAP_SHW          0x1040UL
-#define SABRE_IMAP_KBD          0x1048UL
-#define SABRE_IMAP_MS           0x1050UL
-#define SABRE_IMAP_SER          0x1058UL
-#define SABRE_IMAP_UE           0x1070UL
-#define SABRE_IMAP_CE           0x1078UL
-#define SABRE_IMAP_PCIERR       0x1080UL
-#define SABRE_IMAP_GFX          0x1098UL
-#define SABRE_IMAP_EUPA         0x10a0UL
 #define SABRE_ICLR_A_SLOT0      0x1400UL
 #define SABRE_ICLR_B_SLOT0      0x1480UL
 #define SABRE_ICLR_SCSI         0x1800UL
@@ -364,33 +299,10 @@ static unsigned long sabre_pcislot_imap_offset(unsigned long ino)
                return SABRE_IMAP_B_SLOT0 + (slot * 8);
 }
-static unsigned long __sabre_onboard_imap_off[] = {
+#define SABRE_OBIO_IMAP_BASE    0x1000UL
-/*0x20*/        SABRE_IMAP_SCSI,
+#define SABRE_ONBOARD_IRQ_BASE  0x20
-/*0x21*/        SABRE_IMAP_ETH,
-/*0x22*/        SABRE_IMAP_BPP,
-/*0x23*/        SABRE_IMAP_AU_REC,
-/*0x24*/        SABRE_IMAP_AU_PLAY,
-/*0x25*/        SABRE_IMAP_PFAIL,
-/*0x26*/        SABRE_IMAP_KMS,
-/*0x27*/        SABRE_IMAP_FLPY,
-/*0x28*/        SABRE_IMAP_SHW,
-/*0x29*/        SABRE_IMAP_KBD,
-/*0x2a*/        SABRE_IMAP_MS,
-/*0x2b*/        SABRE_IMAP_SER,
-/*0x2c*/        0 /* reserved */,
-/*0x2d*/        0 /* reserved */,
-/*0x2e*/        SABRE_IMAP_UE,
-/*0x2f*/        SABRE_IMAP_CE,
-/*0x30*/        SABRE_IMAP_PCIERR,
-/*0x31*/        0 /* reserved */,
-/*0x32*/        0 /* reserved */,
-/*0x33*/        SABRE_IMAP_GFX,
-/*0x34*/        SABRE_IMAP_EUPA,
-};
-#define SABRE_ONBOARD_IRQ_BASE          0x20
-#define SABRE_ONBOARD_IRQ_LAST          0x30
 #define sabre_onboard_imap_offset(__ino) \
-        __sabre_onboard_imap_off[(__ino) - SABRE_ONBOARD_IRQ_BASE]
+        (SABRE_OBIO_IMAP_BASE + (((__ino) & 0x1f) << 3))
 #define sabre_iclr_offset(ino)                                        \
        ((ino & 0x20) ? (SABRE_ICLR_SCSI + (((ino) & 0x1f) << 3)) :  \
@@ -453,10 +365,6 @@ static unsigned int sabre_irq_build(struct device_node *dp,
                imap_off = sabre_pcislot_imap_offset(ino);
        } else {
                /* onboard device */
-                if (ino > SABRE_ONBOARD_IRQ_LAST) {
-                        prom_printf("sabre_irq_build: Wacky INO [%x]\n", ino);
-                        prom_halt();
-                }
                imap_off = sabre_onboard_imap_offset(ino);
        }
diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
index bd578cc4856d..10306e476e38 100644
--- a/arch/sparc64/kernel/ptrace.c
+++ b/arch/sparc64/kernel/ptrace.c
@@ -443,7 +443,7 @@ static const struct user_regset sparc64_regsets[] = {
         */
        [REGSET_GENERAL] = {
                .core_note_type = NT_PRSTATUS,
-                .n = 36 * sizeof(u64),
+                .n = 36,
                .size = sizeof(u64), .align = sizeof(u64),
                .get = genregs64_get, .set = genregs64_set
        },
@@ -455,7 +455,7 @@ static const struct user_regset sparc64_regsets[] = {
         */
        [REGSET_FP] = {
                .core_note_type = NT_PRFPREG,
-                .n = 35 * sizeof(u64),
+                .n = 35,
                .size = sizeof(u64), .align = sizeof(u64),
                .get = fpregs64_get, .set = fpregs64_set
        },
@@ -801,7 +801,7 @@ static const struct user_regset sparc32_regsets[] = {
         */
        [REGSET_GENERAL] = {
                .core_note_type = NT_PRSTATUS,
-                .n = 38 * sizeof(u32),
+                .n = 38,
                .size = sizeof(u32), .align = sizeof(u32),
                .get = genregs32_get, .set = genregs32_set
        },
@@ -817,7 +817,7 @@ static const struct user_regset sparc32_regsets[] = {
         */
        [REGSET_FP] = {
                .core_note_type = NT_PRFPREG,
-                .n = 99 * sizeof(u32),
+                .n = 99,
                .size = sizeof(u32), .align = sizeof(u32),
                .get = fpregs32_get, .set = fpregs32_set
        },
diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
index 3d924121c796..c824df13f589 100644
--- a/arch/sparc64/kernel/traps.c
+++ b/arch/sparc64/kernel/traps.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/linkage.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/smp.h>
@@ -2453,7 +2454,7 @@ struct trap_per_cpu trap_block[NR_CPUS];
 /* This can get invoked before sched_init() so play it super safe
 * and use hard_smp_processor_id().
 */
-void init_cur_cpu_trap(struct thread_info *t)
+void notrace init_cur_cpu_trap(struct thread_info *t)
 {
        int cpu = hard_smp_processor_id();
        struct trap_per_cpu *p = &trap_block[cpu];
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 21ef9dd36187..44d4f2130d01 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -29,6 +29,7 @@ config X86
        select HAVE_FTRACE
        select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
        select HAVE_ARCH_KGDB if !X86_VOYAGER
+        select HAVE_ARCH_TRACEHOOK
        select HAVE_GENERIC_DMA_COHERENT if X86_32
        select HAVE_EFFICIENT_UNALIGNED_ACCESS
@@ -553,6 +554,7 @@ config CALGARY_IOMMU_ENABLED_BY_DEFAULT
 config AMD_IOMMU
        bool "AMD IOMMU support"
        select SWIOTLB
+        select PCI_MSI
        depends on X86_64 && PCI && ACPI
        help
          With this option you can enable support for AMD IOMMU hardware in
@@ -1020,7 +1022,7 @@ config HAVE_ARCH_ALLOC_REMAP
 config ARCH_FLATMEM_ENABLE
        def_bool y
-        depends on X86_32 && ARCH_SELECT_MEMORY_MODEL && X86_PC && !NUMA
+        depends on X86_32 && ARCH_SELECT_MEMORY_MODEL && !NUMA
 config ARCH_DISCONTIGMEM_ENABLE
        def_bool y
@@ -1036,7 +1038,7 @@ config ARCH_SPARSEMEM_DEFAULT
 config ARCH_SPARSEMEM_ENABLE
        def_bool y
-        depends on X86_64 || NUMA || (EXPERIMENTAL && X86_PC)
+        depends on X86_64 || NUMA || (EXPERIMENTAL && X86_PC) || X86_GENERICARCH
        select SPARSEMEM_STATIC if X86_32
        select SPARSEMEM_VMEMMAP_ENABLE if X86_64
@@ -1117,10 +1119,10 @@ config MTRR
          You can safely say Y even if your machine doesn't have MTRRs, you'll
          just add about 9 KB to your kernel.
-          See <file:Documentation/mtrr.txt> for more information.
+          See <file:Documentation/x86/mtrr.txt> for more information.
 config MTRR_SANITIZER
-        bool
+        def_bool y
        prompt "MTRR cleanup support"
        depends on MTRR
        help
@@ -1131,7 +1133,7 @@ config MTRR_SANITIZER
          The largest mtrr entry size for a continous block can be set with
          mtrr_chunk_size.
-          If unsure, say N.
+          If unsure, say Y.
 config MTRR_SANITIZER_ENABLE_DEFAULT
        int "MTRR cleanup enable value (0-1)"
@@ -1191,7 +1193,6 @@ config IRQBALANCE
 config SECCOMP
        def_bool y
        prompt "Enable seccomp to safely compute untrusted bytecode"
-        depends on PROC_FS
        help
          This kernel feature is useful for number crunching applications
          that may need to compute untrusted bytecode during their
@@ -1199,7 +1200,7 @@ config SECCOMP
          the process as file descriptors supporting the read/write
          syscalls, it's possible to isolate those applications in
          their own address space using seccomp. Once seccomp is
-          enabled via /proc/<pid>/seccomp, it cannot be disabled
+          enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
          and the task is only allowed to execute a few safe syscalls
          defined by each seccomp mode.
@@ -1356,14 +1357,14 @@ config PHYSICAL_ALIGN
          Don't change this unless you know what you are doing.
 config HOTPLUG_CPU
-        bool "Support for suspend on SMP and hot-pluggable CPUs (EXPERIMENTAL)"
+        bool "Support for hot-pluggable CPUs"
-        depends on SMP && HOTPLUG && EXPERIMENTAL && !X86_VOYAGER
+        depends on SMP && HOTPLUG && !X86_VOYAGER
        ---help---
-          Say Y here to experiment with turning CPUs off and on, and to
+          Say Y here to allow turning CPUs off and on. CPUs can be
-          enable suspend on SMP systems. CPUs can be controlled through
+          controlled through /sys/devices/system/cpu.
-          /sys/devices/system/cpu.
+          ( Note: power management support will enable this option
-          Say N if you want to disable CPU hotplug and don't need to
+            automatically on SMP systems. )
-          suspend.
+          Say N if you want to disable CPU hotplug.
 config COMPAT_VDSO
        def_bool y
@@ -1378,6 +1379,51 @@ config COMPAT_VDSO
          If unsure, say Y.
+config CMDLINE_BOOL
+        bool "Built-in kernel command line"
+        default n
+        help
+          Allow for specifying boot arguments to the kernel at
+          build time.  On some systems (e.g. embedded ones), it is
+          necessary or convenient to provide some or all of the
+          kernel boot arguments with the kernel itself (that is,
+          to not rely on the boot loader to provide them.)
+          To compile command line arguments into the kernel,
+          set this option to 'Y', then fill in the
+          the boot arguments in CONFIG_CMDLINE.
+          Systems with fully functional boot loaders (i.e. non-embedded)
+          should leave this option set to 'N'.
+config CMDLINE
+        string "Built-in kernel command string"
+        depends on CMDLINE_BOOL
+        default ""
+        help
+          Enter arguments here that should be compiled into the kernel
+          image and used at boot time.  If the boot loader provides a
+          command line at boot time, it is appended to this string to
+          form the full kernel command line, when the system boots.
+          However, you can use the CONFIG_CMDLINE_OVERRIDE option to
+          change this behavior.
+          In most cases, the command line (whether built-in or provided
+          by the boot loader) should specify the device for the root
+          file system.
+config CMDLINE_OVERRIDE
+        bool "Built-in command line overrides boot loader arguments"
+        default n
+        depends on CMDLINE_BOOL
+        help
+          Set this option to 'Y' to have the kernel ignore the boot loader
+          command line, and use ONLY the built-in command line.
+          This is used to work around broken boot loaders.  This should
+          be set to 'N' under normal conditions.
 endmenu
 config ARCH_ENABLE_MEMORY_HOTPLUG
@@ -1781,7 +1827,7 @@ config COMPAT_FOR_U64_ALIGNMENT
 config SYSVIPC_COMPAT
        def_bool y
-        depends on X86_64 && COMPAT && SYSVIPC
+        depends on COMPAT && SYSVIPC
 endmenu
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index ba7736cf2ec7..29c5fbf08392 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -137,14 +137,15 @@ relocated:
 */
        movl output_len(%ebx), %eax
        pushl %eax
+                        # push arguments for decompress_kernel:
        pushl %ebp      # output address
        movl input_len(%ebx), %eax
        pushl %eax      # input_len
        leal input_data(%ebx), %eax
        pushl %eax      # input_data
        leal boot_heap(%ebx), %eax
-        pushl %eax      # heap area as third argument
+        pushl %eax      # heap area
-        pushl %esi      # real mode pointer as second arg
+        pushl %esi      # real mode pointer
        call decompress_kernel
        addl $20, %esp
        popl %ecx
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index aaf5a2131efc..5780d361105b 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -27,7 +27,7 @@
 #include <linux/linkage.h>
 #include <linux/screen_info.h>
 #include <linux/elf.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/page.h>
 #include <asm/boot.h>
 #include <asm/bootparam.h>
@@ -251,7 +251,7 @@ static void __putstr(int error, const char *s)
                                y--;
                        }
                } else {
-                        vidmem [(x + cols * y) * 2] = c;
+                        vidmem[(x + cols * y) * 2] = c;
                        if (++x >= cols) {
                                x = 0;
                                if (++y >= lines) {
@@ -277,7 +277,8 @@ static void *memset(void *s, int c, unsigned n)
        int i;
        char *ss = s;
-        for (i = 0; i < n; i++) ss[i] = c;
+        for (i = 0; i < n; i++)
+                ss[i] = c;
        return s;
 }
@@ -287,7 +288,8 @@ static void *memcpy(void *dest, const void *src, unsigned n)
        const char *s = src;
        char *d = dest;
-        for (i = 0; i < n; i++) d[i] = s[i];
+        for (i = 0; i < n; i++)
+                d[i] = s[i];
        return dest;
 }
diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
index a1310c52fc0c..857e492c571e 100644
--- a/arch/x86/boot/compressed/relocs.c
+++ b/arch/x86/boot/compressed/relocs.c
@@ -492,7 +492,7 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
                        continue;
                }
                sh_symtab = sec_symtab->symtab;
-                sym_strtab = sec->link->strtab;
+                sym_strtab = sec_symtab->link->strtab;
                for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
                        Elf32_Rel *rel;
                        Elf32_Sym *sym;
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index af86e431acfa..b993062e9a5f 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -30,7 +30,6 @@ SYSSEG		= DEF_SYSSEG		/* system loaded at 0x10000 (65536) */
 SYSSIZE         = DEF_SYSSIZE           /* system size: # of 16-byte clicks */
                                        /* to be loaded */
 ROOT_DEV        = 0                     /* ROOT_DEV is now written by "build" */
-SWAP_DEV        = 0                     /* SWAP_DEV is now written by "build" */
 #ifndef SVGA_MODE
 #define SVGA_MODE ASK_VGA
diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index 104275e191a8..ef9a52005ec9 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.27-rc4
+# Linux kernel version: 2.6.27-rc5
-# Mon Aug 25 15:04:00 2008
+# Wed Sep  3 17:23:09 2008
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -202,7 +202,7 @@ CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 # CONFIG_M586 is not set
 # CONFIG_M586TSC is not set
 # CONFIG_M586MMX is not set
-# CONFIG_M686 is not set
+CONFIG_M686=y
 # CONFIG_MPENTIUMII is not set
 # CONFIG_MPENTIUMIII is not set
 # CONFIG_MPENTIUMM is not set
@@ -221,13 +221,14 @@ CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 # CONFIG_MVIAC3_2 is not set
 # CONFIG_MVIAC7 is not set
 # CONFIG_MPSC is not set
-CONFIG_MCORE2=y
+# CONFIG_MCORE2 is not set
 # CONFIG_GENERIC_CPU is not set
 CONFIG_X86_GENERIC=y
 CONFIG_X86_CPU=y
 CONFIG_X86_CMPXCHG=y
 CONFIG_X86_L1_CACHE_SHIFT=7
 CONFIG_X86_XADD=y
+# CONFIG_X86_PPRO_FENCE is not set
 CONFIG_X86_WP_WORKS_OK=y
 CONFIG_X86_INVLPG=y
 CONFIG_X86_BSWAP=y
@@ -235,14 +236,15 @@ CONFIG_X86_POPAD_OK=y
 CONFIG_X86_INTEL_USERCOPY=y
 CONFIG_X86_USE_PPRO_CHECKSUM=y
 CONFIG_X86_TSC=y
+CONFIG_X86_CMOV=y
 CONFIG_X86_MINIMUM_CPU_FAMILY=4
 CONFIG_X86_DEBUGCTLMSR=y
 CONFIG_HPET_TIMER=y
 CONFIG_HPET_EMULATE_RTC=y
 CONFIG_DMI=y
 # CONFIG_IOMMU_HELPER is not set
-CONFIG_NR_CPUS=4
+CONFIG_NR_CPUS=64
-# CONFIG_SCHED_SMT is not set
+CONFIG_SCHED_SMT=y
 CONFIG_SCHED_MC=y
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_VOLUNTARY=y
@@ -254,7 +256,8 @@ CONFIG_VM86=y
 # CONFIG_TOSHIBA is not set
 # CONFIG_I8K is not set
 CONFIG_X86_REBOOTFIXUPS=y
-# CONFIG_MICROCODE is not set
+CONFIG_MICROCODE=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
 CONFIG_X86_MSR=y
 CONFIG_X86_CPUID=y
 # CONFIG_NOHIGHMEM is not set
@@ -2115,7 +2118,7 @@ CONFIG_IO_DELAY_0X80=y
 CONFIG_DEFAULT_IO_DELAY_TYPE=0
 CONFIG_DEBUG_BOOT_PARAMS=y
 # CONFIG_CPA_DEBUG is not set
-# CONFIG_OPTIMIZE_INLINING is not set
+CONFIG_OPTIMIZE_INLINING=y
 #
 # Security options
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 678c8acefe04..e620ea6e2a7a 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.27-rc4
+# Linux kernel version: 2.6.27-rc5
-# Mon Aug 25 14:40:46 2008
+# Wed Sep  3 17:13:39 2008
 #
 CONFIG_64BIT=y
 # CONFIG_X86_32 is not set
@@ -218,17 +218,14 @@ CONFIG_X86_PC=y
 # CONFIG_MVIAC3_2 is not set
 # CONFIG_MVIAC7 is not set
 # CONFIG_MPSC is not set
-CONFIG_MCORE2=y
+# CONFIG_MCORE2 is not set
-# CONFIG_GENERIC_CPU is not set
+CONFIG_GENERIC_CPU=y
 CONFIG_X86_CPU=y
-CONFIG_X86_L1_CACHE_BYTES=64
+CONFIG_X86_L1_CACHE_BYTES=128
-CONFIG_X86_INTERNODE_CACHE_BYTES=64
+CONFIG_X86_INTERNODE_CACHE_BYTES=128
 CONFIG_X86_CMPXCHG=y
-CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_L1_CACHE_SHIFT=7
 CONFIG_X86_WP_WORKS_OK=y
-CONFIG_X86_INTEL_USERCOPY=y
-CONFIG_X86_USE_PPRO_CHECKSUM=y
-CONFIG_X86_P6_NOP=y
 CONFIG_X86_TSC=y
 CONFIG_X86_CMPXCHG64=y
 CONFIG_X86_CMOV=y
@@ -243,9 +240,8 @@ CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y
 CONFIG_AMD_IOMMU=y
 CONFIG_SWIOTLB=y
 CONFIG_IOMMU_HELPER=y
-# CONFIG_MAXSMP is not set
+CONFIG_NR_CPUS=64
-CONFIG_NR_CPUS=4
+CONFIG_SCHED_SMT=y
-# CONFIG_SCHED_SMT is not set
 CONFIG_SCHED_MC=y
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_VOLUNTARY=y
@@ -254,7 +250,8 @@ CONFIG_X86_LOCAL_APIC=y
 CONFIG_X86_IO_APIC=y
 # CONFIG_X86_MCE is not set
 # CONFIG_I8K is not set
-# CONFIG_MICROCODE is not set
+CONFIG_MICROCODE=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
 CONFIG_X86_MSR=y
 CONFIG_X86_CPUID=y
 CONFIG_NUMA=y
@@ -290,7 +287,7 @@ CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_MTRR=y
 # CONFIG_MTRR_SANITIZER is not set
-# CONFIG_X86_PAT is not set
+CONFIG_X86_PAT=y
 CONFIG_EFI=y
 CONFIG_SECCOMP=y
 # CONFIG_HZ_100 is not set
@@ -2089,7 +2086,7 @@ CONFIG_IO_DELAY_0X80=y
 CONFIG_DEFAULT_IO_DELAY_TYPE=0
 CONFIG_DEBUG_BOOT_PARAMS=y
 # CONFIG_CPA_DEBUG is not set
-# CONFIG_OPTIMIZE_INLINING is not set
+CONFIG_OPTIMIZE_INLINING=y
 #
 # Security options
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index a0e1dbe67dc1..127ec3f07214 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -85,8 +85,10 @@ static void dump_thread32(struct pt_regs *regs, struct user32 *dump)
        dump->regs.ax = regs->ax;
        dump->regs.ds = current->thread.ds;
        dump->regs.es = current->thread.es;
-        asm("movl %%fs,%0" : "=r" (fs)); dump->regs.fs = fs;
+        savesegment(fs, fs);
-        asm("movl %%gs,%0" : "=r" (gs)); dump->regs.gs = gs;
+        dump->regs.fs = fs;
+        savesegment(gs, gs);
+        dump->regs.gs = gs;
        dump->regs.orig_ax = regs->orig_ax;
        dump->regs.ip = regs->ip;
        dump->regs.cs = regs->cs;
@@ -430,8 +432,9 @@ beyond_if:
        current->mm->start_stack =
                (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
        /* start thread */
-        asm volatile("movl %0,%%fs" :: "r" (0)); \
+        loadsegment(fs, 0);
-        asm volatile("movl %0,%%es; movl %0,%%ds": :"r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
+        loadsegment(es, __USER32_DS);
        load_gs_index(0);
        (regs)->ip = ex.a_entry;
        (regs)->sp = current->mm->start_stack;
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index f25a10124005..8d64c1bc8474 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -207,7 +207,7 @@ struct rt_sigframe
        { unsigned int cur;                                             \
          unsigned short pre;                                           \
          err |= __get_user(pre, &sc->seg);                             \
-          asm volatile("movl %%" #seg ",%0" : "=r" (cur));              \
+          savesegment(seg, cur);                                        \
          pre |= mask;                                                  \
          if (pre != cur) loadsegment(seg, pre); }
@@ -236,7 +236,7 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
         */
        err |= __get_user(gs, &sc->gs);
        gs |= 3;
-        asm("movl %%gs,%0" : "=r" (oldgs));
+        savesegment(gs, oldgs);
        if (gs != oldgs)
                load_gs_index(gs);
@@ -342,14 +342,13 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
 {
        int tmp, err = 0;
-        tmp = 0;
+        savesegment(gs, tmp);
-        __asm__("movl %%gs,%0" : "=r"(tmp): "0"(tmp));
        err |= __put_user(tmp, (unsigned int __user *)&sc->gs);
-        __asm__("movl %%fs,%0" : "=r"(tmp): "0"(tmp));
+        savesegment(fs, tmp);
        err |= __put_user(tmp, (unsigned int __user *)&sc->fs);
-        __asm__("movl %%ds,%0" : "=r"(tmp): "0"(tmp));
+        savesegment(ds, tmp);
        err |= __put_user(tmp, (unsigned int __user *)&sc->ds);
-        __asm__("movl %%es,%0" : "=r"(tmp): "0"(tmp));
+        savesegment(es, tmp);
        err |= __put_user(tmp, (unsigned int __user *)&sc->es);
        err |= __put_user((u32)regs->di, &sc->di);
@@ -491,8 +490,8 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
        regs->dx = 0;
        regs->cx = 0;
-        asm volatile("movl %0,%%ds" :: "r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
-        asm volatile("movl %0,%%es" :: "r" (__USER32_DS));
+        loadsegment(es, __USER32_DS);
        regs->cs = __USER32_CS;
        regs->ss = __USER32_DS;
@@ -588,8 +587,8 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        regs->dx = (unsigned long) &frame->info;
        regs->cx = (unsigned long) &frame->uc;
-        asm volatile("movl %0,%%ds" :: "r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
-        asm volatile("movl %0,%%es" :: "r" (__USER32_DS));
+        loadsegment(es, __USER32_DS);
        regs->cs = __USER32_CS;
        regs->ss = __USER32_DS;
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index d3c64088b981..beda4232ce69 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -556,15 +556,6 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
        return ret;
 }
-/* These are here just in case some old ia32 binary calls it. */
-asmlinkage long sys32_pause(void)
-{
-        current->state = TASK_INTERRUPTIBLE;
-        schedule();
-        return -ERESTARTNOHAND;
-}
 #ifdef CONFIG_SYSCTL_SYSCALL
 struct sysctl_ia32 {
        unsigned int    name;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 27ef365e757d..c2ac1b4515a0 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -58,7 +58,6 @@ EXPORT_SYMBOL(acpi_disabled);
 #ifdef  CONFIG_X86_64
 #include <asm/proto.h>
-#include <asm/genapic.h>
 #else                           /* X86 */
@@ -97,8 +96,6 @@ static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
 #warning ACPI uses CMPXCHG, i486 and later hardware
 #endif
-static int acpi_mcfg_64bit_base_addr __initdata = FALSE;
 /* --------------------------------------------------------------------------
                              Boot-time Configuration
   -------------------------------------------------------------------------- */
@@ -160,6 +157,8 @@ char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 struct acpi_mcfg_allocation *pci_mmcfg_config;
 int pci_mmcfg_config_num;
+static int acpi_mcfg_64bit_base_addr __initdata = FALSE;
 static int __init acpi_mcfg_oem_check(struct acpi_table_mcfg *mcfg)
 {
        if (!strcmp(mcfg->header.oem_id, "SGI"))
@@ -253,10 +252,8 @@ static void __cpuinit acpi_register_lapic(int id, u8 enabled)
                return;
        }
-#ifdef CONFIG_X86_32
        if (boot_cpu_physical_apicid != -1U)
                ver = apic_version[boot_cpu_physical_apicid];
-#endif
        generic_processor_info(id, ver);
 }
@@ -776,10 +773,8 @@ static void __init acpi_register_lapic_address(unsigned long address)
        set_fixmap_nocache(FIX_APIC_BASE, address);
        if (boot_cpu_physical_apicid == -1U) {
                boot_cpu_physical_apicid  = read_apic_id();
-#ifdef CONFIG_X86_32
                apic_version[boot_cpu_physical_apicid] =
                         GET_APIC_VERSION(apic_read(APIC_LVR));
-#endif
        }
 }
@@ -1607,6 +1602,14 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
         */
        {
         .callback = dmi_ignore_irq0_timer_override,
+         .ident = "HP nx6115 laptop",
+         .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nx6115"),
+                     },
+         },
+        {
+         .callback = dmi_ignore_irq0_timer_override,
         .ident = "HP NX6125 laptop",
         .matches = {
                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
@@ -1621,6 +1624,14 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nx6325"),
                     },
         },
+        {
+         .callback = dmi_ignore_irq0_timer_override,
+         .ident = "HP 6715b laptop",
+         .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
+                     },
+         },
        {}
 };
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 65a0c1b48696..fb04e49776ba 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -231,25 +231,25 @@ static void alternatives_smp_lock(u8 **start, u8 **end, u8 *text, u8 *text_end)
                        continue;
                if (*ptr > text_end)
                        continue;
-                text_poke(*ptr, ((unsigned char []){0xf0}), 1); /* add lock prefix */
+                /* turn DS segment override prefix into lock prefix */
+                text_poke(*ptr, ((unsigned char []){0xf0}), 1);
        };
 }
 static void alternatives_smp_unlock(u8 **start, u8 **end, u8 *text, u8 *text_end)
 {
        u8 **ptr;
-        char insn[1];
        if (noreplace_smp)
                return;
-        add_nops(insn, 1);
        for (ptr = start; ptr < end; ptr++) {
                if (*ptr < text)
                        continue;
                if (*ptr > text_end)
                        continue;
-                text_poke(*ptr, insn, 1);
+                /* turn lock prefix into DS segment override prefix */
+                text_poke(*ptr, ((unsigned char []){0x3E}), 1);
        };
 }
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index 69b4d060b21c..34e4d112b1ef 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -33,6 +33,10 @@
 static DEFINE_RWLOCK(amd_iommu_devtable_lock);
+/* A list of preallocated protection domains */
+static LIST_HEAD(iommu_pd_list);
+static DEFINE_SPINLOCK(iommu_pd_list_lock);
 /*
 * general struct to manage commands send to an IOMMU
 */
@@ -51,6 +55,102 @@ static int iommu_has_npcache(struct amd_iommu *iommu)
 /****************************************************************************
 *
+ * Interrupt handling functions
+ *
+ ****************************************************************************/
+static void iommu_print_event(void *__evt)
+{
+        u32 *event = __evt;
+        int type  = (event[1] >> EVENT_TYPE_SHIFT)  & EVENT_TYPE_MASK;
+        int devid = (event[0] >> EVENT_DEVID_SHIFT) & EVENT_DEVID_MASK;
+        int domid = (event[1] >> EVENT_DOMID_SHIFT) & EVENT_DOMID_MASK;
+        int flags = (event[1] >> EVENT_FLAGS_SHIFT) & EVENT_FLAGS_MASK;
+        u64 address = (u64)(((u64)event[3]) << 32) | event[2];
+        printk(KERN_ERR "AMD IOMMU: Event logged [");
+        switch (type) {
+        case EVENT_TYPE_ILL_DEV:
+                printk("ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x "
+                       "address=0x%016llx flags=0x%04x]\n",
+                       PCI_BUS(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+                       address, flags);
+                break;
+        case EVENT_TYPE_IO_FAULT:
+                printk("IO_PAGE_FAULT device=%02x:%02x.%x "
+                       "domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+                       PCI_BUS(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+                       domid, address, flags);
+                break;
+        case EVENT_TYPE_DEV_TAB_ERR:
+                printk("DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x "
+                       "address=0x%016llx flags=0x%04x]\n",
+                       PCI_BUS(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+                       address, flags);
+                break;
+        case EVENT_TYPE_PAGE_TAB_ERR:
+                printk("PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x "
+                       "domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+                       PCI_BUS(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+                       domid, address, flags);
+                break;
+        case EVENT_TYPE_ILL_CMD:
+                printk("ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address);
+                break;
+        case EVENT_TYPE_CMD_HARD_ERR:
+                printk("COMMAND_HARDWARE_ERROR address=0x%016llx "
+                       "flags=0x%04x]\n", address, flags);
+                break;
+        case EVENT_TYPE_IOTLB_INV_TO:
+                printk("IOTLB_INV_TIMEOUT device=%02x:%02x.%x "
+                       "address=0x%016llx]\n",
+                       PCI_BUS(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+                       address);
+                break;
+        case EVENT_TYPE_INV_DEV_REQ:
+                printk("INVALID_DEVICE_REQUEST device=%02x:%02x.%x "
+                       "address=0x%016llx flags=0x%04x]\n",
+                       PCI_BUS(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+                       address, flags);
+                break;
+        default:
+                printk(KERN_ERR "UNKNOWN type=0x%02x]\n", type);
+        }
+}
+static void iommu_poll_events(struct amd_iommu *iommu)
+{
+        u32 head, tail;
+        unsigned long flags;
+        spin_lock_irqsave(&iommu->lock, flags);
+        head = readl(iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+        tail = readl(iommu->mmio_base + MMIO_EVT_TAIL_OFFSET);
+        while (head != tail) {
+                iommu_print_event(iommu->evt_buf + head);
+                head = (head + EVENT_ENTRY_SIZE) % iommu->evt_buf_size;
+        }
+        writel(head, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+        spin_unlock_irqrestore(&iommu->lock, flags);
+}
+irqreturn_t amd_iommu_int_handler(int irq, void *data)
+{
+        struct amd_iommu *iommu;
+        list_for_each_entry(iommu, &amd_iommu_list, list)
+                iommu_poll_events(iommu);
+        return IRQ_HANDLED;
+}
+/****************************************************************************
+ *
 * IOMMU command queuing functions
 *
 ****************************************************************************/
@@ -101,10 +201,10 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
 */
 static int iommu_completion_wait(struct amd_iommu *iommu)
 {
-        int ret, ready = 0;
+        int ret = 0, ready = 0;
        unsigned status = 0;
        struct iommu_cmd cmd;
-        unsigned long i = 0;
+        unsigned long flags, i = 0;
        memset(&cmd, 0, sizeof(cmd));
        cmd.data[0] = CMD_COMPL_WAIT_INT_MASK;
@@ -112,10 +212,12 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
        iommu->need_sync = 0;
-        ret = iommu_queue_command(iommu, &cmd);
+        spin_lock_irqsave(&iommu->lock, flags);
+        ret = __iommu_queue_command(iommu, &cmd);
        if (ret)
-                return ret;
+                goto out;
        while (!ready && (i < EXIT_LOOP_COUNT)) {
                ++i;
@@ -130,6 +232,8 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
        if (unlikely((i == EXIT_LOOP_COUNT) && printk_ratelimit()))
                printk(KERN_WARNING "AMD IOMMU: Completion wait loop failed\n");
+out:
+        spin_unlock_irqrestore(&iommu->lock, flags);
        return 0;
 }
@@ -140,6 +244,7 @@ static int iommu_completion_wait(struct amd_iommu *iommu)
 static int iommu_queue_inv_dev_entry(struct amd_iommu *iommu, u16 devid)
 {
        struct iommu_cmd cmd;
+        int ret;
        BUG_ON(iommu == NULL);
@@ -147,9 +252,11 @@ static int iommu_queue_inv_dev_entry(struct amd_iommu *iommu, u16 devid)
        CMD_SET_TYPE(&cmd, CMD_INV_DEV_ENTRY);
        cmd.data[0] = devid;
+        ret = iommu_queue_command(iommu, &cmd);
        iommu->need_sync = 1;
-        return iommu_queue_command(iommu, &cmd);
+        return ret;
 }
 /*
@@ -159,6 +266,7 @@ static int iommu_queue_inv_iommu_pages(struct amd_iommu *iommu,
                u64 address, u16 domid, int pde, int s)
 {
        struct iommu_cmd cmd;
+        int ret;
        memset(&cmd, 0, sizeof(cmd));
        address &= PAGE_MASK;
@@ -171,9 +279,11 @@ static int iommu_queue_inv_iommu_pages(struct amd_iommu *iommu,
        if (pde) /* PDE bit - we wan't flush everything not only the PTEs */
                cmd.data[2] |= CMD_INV_IOMMU_PAGES_PDE_MASK;
+        ret = iommu_queue_command(iommu, &cmd);
        iommu->need_sync = 1;
-        return iommu_queue_command(iommu, &cmd);
+        return ret;
 }
 /*
@@ -203,6 +313,14 @@ static int iommu_flush_pages(struct amd_iommu *iommu, u16 domid,
        return 0;
 }
+/* Flush the whole IO/TLB for a given protection domain */
+static void iommu_flush_tlb(struct amd_iommu *iommu, u16 domid)
+{
+        u64 address = CMD_INV_IOMMU_ALL_PAGES_ADDRESS;
+        iommu_queue_inv_iommu_pages(iommu, address, domid, 0, 1);
+}
 /****************************************************************************
 *
 * The functions below are used the create the page table mappings for
@@ -362,11 +480,6 @@ static int init_unity_mappings_for_device(struct dma_ops_domain *dma_dom,
 * efficient allocator.
 *
 ****************************************************************************/
-static unsigned long dma_mask_to_pages(unsigned long mask)
-{
-        return (mask >> PAGE_SHIFT) +
-                (PAGE_ALIGN(mask & ~PAGE_MASK) >> PAGE_SHIFT);
-}
 /*
 * The address allocator core function.
@@ -375,25 +488,31 @@ static unsigned long dma_mask_to_pages(unsigned long mask)
 */
 static unsigned long dma_ops_alloc_addresses(struct device *dev,
                                             struct dma_ops_domain *dom,
-                                             unsigned int pages)
+                                             unsigned int pages,
+                                             unsigned long align_mask,
+                                             u64 dma_mask)
 {
-        unsigned long limit = dma_mask_to_pages(*dev->dma_mask);
+        unsigned long limit;
        unsigned long address;
-        unsigned long size = dom->aperture_size >> PAGE_SHIFT;
        unsigned long boundary_size;
        boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
                        PAGE_SIZE) >> PAGE_SHIFT;
-        limit = limit < size ? limit : size;
+        limit = iommu_device_max_index(dom->aperture_size >> PAGE_SHIFT, 0,
+                                       dma_mask >> PAGE_SHIFT);
-        if (dom->next_bit >= limit)
+        if (dom->next_bit >= limit) {
                dom->next_bit = 0;
+                dom->need_flush = true;
+        }
        address = iommu_area_alloc(dom->bitmap, limit, dom->next_bit, pages,
-                        0 , boundary_size, 0);
+                                   0 , boundary_size, align_mask);
-        if (address == -1)
+        if (address == -1) {
                address = iommu_area_alloc(dom->bitmap, limit, 0, pages,
-                                0, boundary_size, 0);
+                                0, boundary_size, align_mask);
+                dom->need_flush = true;
+        }
        if (likely(address != -1)) {
                dom->next_bit = address + pages;
@@ -459,7 +578,7 @@ static void dma_ops_reserve_addresses(struct dma_ops_domain *dom,
        if (start_page + pages > last_page)
                pages = last_page - start_page;
-        set_bit_string(dom->bitmap, start_page, pages);
+        iommu_area_reserve(dom->bitmap, start_page, pages);
 }
 static void dma_ops_free_pagetable(struct dma_ops_domain *dma_dom)
@@ -553,6 +672,9 @@ static struct dma_ops_domain *dma_ops_domain_alloc(struct amd_iommu *iommu,
        dma_dom->bitmap[0] = 1;
        dma_dom->next_bit = 0;
+        dma_dom->need_flush = false;
+        dma_dom->target_dev = 0xffff;
        /* Intialize the exclusion range if necessary */
        if (iommu->exclusion_start &&
            iommu->exclusion_start < dma_dom->aperture_size) {
@@ -623,12 +745,13 @@ static void set_device_domain(struct amd_iommu *iommu,
        u64 pte_root = virt_to_phys(domain->pt_root);
-        pte_root |= (domain->mode & 0x07) << 9;
+        pte_root |= (domain->mode & DEV_ENTRY_MODE_MASK)
-        pte_root |= IOMMU_PTE_IR | IOMMU_PTE_IW | IOMMU_PTE_P | 2;
+                    << DEV_ENTRY_MODE_SHIFT;
+        pte_root |= IOMMU_PTE_IR | IOMMU_PTE_IW | IOMMU_PTE_P | IOMMU_PTE_TV;
        write_lock_irqsave(&amd_iommu_devtable_lock, flags);
-        amd_iommu_dev_table[devid].data[0] = pte_root;
+        amd_iommu_dev_table[devid].data[0] = lower_32_bits(pte_root);
-        amd_iommu_dev_table[devid].data[1] = pte_root >> 32;
+        amd_iommu_dev_table[devid].data[1] = upper_32_bits(pte_root);
        amd_iommu_dev_table[devid].data[2] = domain->id;
        amd_iommu_pd_table[devid] = domain;
@@ -646,6 +769,45 @@ static void set_device_domain(struct amd_iommu *iommu,
 *****************************************************************************/
 /*
+ * This function checks if the driver got a valid device from the caller to
+ * avoid dereferencing invalid pointers.
+ */
+static bool check_device(struct device *dev)
+{
+        if (!dev || !dev->dma_mask)
+                return false;
+        return true;
+}
+/*
+ * In this function the list of preallocated protection domains is traversed to
+ * find the domain for a specific device
+ */
+static struct dma_ops_domain *find_protection_domain(u16 devid)
+{
+        struct dma_ops_domain *entry, *ret = NULL;
+        unsigned long flags;
+        if (list_empty(&iommu_pd_list))
+                return NULL;
+        spin_lock_irqsave(&iommu_pd_list_lock, flags);
+        list_for_each_entry(entry, &iommu_pd_list, list) {
+                if (entry->target_dev == devid) {
+                        ret = entry;
+                        list_del(&ret->list);
+                        break;
+                }
+        }
+        spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
+        return ret;
+}
+/*
 * In the dma_ops path we only have the struct device. This function
 * finds the corresponding IOMMU, the protection domain and the
 * requestor id for a given device.
@@ -661,27 +823,30 @@ static int get_device_resources(struct device *dev,
        struct pci_dev *pcidev;
        u16 _bdf;
-        BUG_ON(!dev || dev->bus != &pci_bus_type || !dev->dma_mask);
+        *iommu = NULL;
+        *domain = NULL;
+        *bdf = 0xffff;
+        if (dev->bus != &pci_bus_type)
+                return 0;
        pcidev = to_pci_dev(dev);
        _bdf = calc_devid(pcidev->bus->number, pcidev->devfn);
        /* device not translated by any IOMMU in the system? */
-        if (_bdf > amd_iommu_last_bdf) {
+        if (_bdf > amd_iommu_last_bdf)
-                *iommu = NULL;
-                *domain = NULL;
-                *bdf = 0xffff;
                return 0;
-        }
        *bdf = amd_iommu_alias_table[_bdf];
        *iommu = amd_iommu_rlookup_table[*bdf];
        if (*iommu == NULL)
                return 0;
-        dma_dom = (*iommu)->default_dom;
        *domain = domain_for_device(*bdf);
        if (*domain == NULL) {
+                dma_dom = find_protection_domain(*bdf);
+                if (!dma_dom)
+                        dma_dom = (*iommu)->default_dom;
                *domain = &dma_dom->domain;
                set_device_domain(*iommu, *domain, *bdf);
                printk(KERN_INFO "AMD IOMMU: Using protection domain %d for "
@@ -760,17 +925,24 @@ static dma_addr_t __map_single(struct device *dev,
                               struct dma_ops_domain *dma_dom,
                               phys_addr_t paddr,
                               size_t size,
-                               int dir)
+                               int dir,
+                               bool align,
+                               u64 dma_mask)
 {
        dma_addr_t offset = paddr & ~PAGE_MASK;
        dma_addr_t address, start;
        unsigned int pages;
+        unsigned long align_mask = 0;
        int i;
        pages = iommu_num_pages(paddr, size);
        paddr &= PAGE_MASK;
-        address = dma_ops_alloc_addresses(dev, dma_dom, pages);
+        if (align)
+                align_mask = (1UL << get_order(size)) - 1;
+        address = dma_ops_alloc_addresses(dev, dma_dom, pages, align_mask,
+                                          dma_mask);
        if (unlikely(address == bad_dma_address))
                goto out;
@@ -782,6 +954,12 @@ static dma_addr_t __map_single(struct device *dev,
        }
        address += offset;
+        if (unlikely(dma_dom->need_flush && !amd_iommu_unmap_flush)) {
+                iommu_flush_tlb(iommu, dma_dom->domain.id);
+                dma_dom->need_flush = false;
+        } else if (unlikely(iommu_has_npcache(iommu)))
+                iommu_flush_pages(iommu, dma_dom->domain.id, address, size);
 out:
        return address;
 }
@@ -812,6 +990,9 @@ static void __unmap_single(struct amd_iommu *iommu,
        }
        dma_ops_free_addresses(dma_dom, dma_addr, pages);
+        if (amd_iommu_unmap_flush)
+                iommu_flush_pages(iommu, dma_dom->domain.id, dma_addr, size);
 }
 /*
@@ -825,6 +1006,12 @@ static dma_addr_t map_single(struct device *dev, phys_addr_t paddr,
        struct protection_domain *domain;
        u16 devid;
        dma_addr_t addr;
+        u64 dma_mask;
+        if (!check_device(dev))
+                return bad_dma_address;
+        dma_mask = *dev->dma_mask;
        get_device_resources(dev, &iommu, &domain, &devid);
@@ -833,14 +1020,12 @@ static dma_addr_t map_single(struct device *dev, phys_addr_t paddr,
                return (dma_addr_t)paddr;
        spin_lock_irqsave(&domain->lock, flags);
-        addr = __map_single(dev, iommu, domain->priv, paddr, size, dir);
+        addr = __map_single(dev, iommu, domain->priv, paddr, size, dir, false,
+                            dma_mask);
        if (addr == bad_dma_address)
                goto out;
-        if (iommu_has_npcache(iommu))
+        if (unlikely(iommu->need_sync))
-                iommu_flush_pages(iommu, domain->id, addr, size);
-        if (iommu->need_sync)
                iommu_completion_wait(iommu);
 out:
@@ -860,7 +1045,8 @@ static void unmap_single(struct device *dev, dma_addr_t dma_addr,
        struct protection_domain *domain;
        u16 devid;
-        if (!get_device_resources(dev, &iommu, &domain, &devid))
+        if (!check_device(dev) ||
+            !get_device_resources(dev, &iommu, &domain, &devid))
                /* device not handled by any AMD IOMMU */
                return;
@@ -868,9 +1054,7 @@ static void unmap_single(struct device *dev, dma_addr_t dma_addr,
        __unmap_single(iommu, domain->priv, dma_addr, size, dir);
-        iommu_flush_pages(iommu, domain->id, dma_addr, size);
+        if (unlikely(iommu->need_sync))
-        if (iommu->need_sync)
                iommu_completion_wait(iommu);
        spin_unlock_irqrestore(&domain->lock, flags);
@@ -909,6 +1093,12 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
        struct scatterlist *s;
        phys_addr_t paddr;
        int mapped_elems = 0;
+        u64 dma_mask;
+        if (!check_device(dev))
+                return 0;
+        dma_mask = *dev->dma_mask;
        get_device_resources(dev, &iommu, &domain, &devid);
@@ -921,19 +1111,17 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
                paddr = sg_phys(s);
                s->dma_address = __map_single(dev, iommu, domain->priv,
-                                              paddr, s->length, dir);
+                                              paddr, s->length, dir, false,
+                                              dma_mask);
                if (s->dma_address) {
                        s->dma_length = s->length;
                        mapped_elems++;
                } else
                        goto unmap;
-                if (iommu_has_npcache(iommu))
-                        iommu_flush_pages(iommu, domain->id, s->dma_address,
-                                          s->dma_length);
        }
-        if (iommu->need_sync)
+        if (unlikely(iommu->need_sync))
                iommu_completion_wait(iommu);
 out:
@@ -967,7 +1155,8 @@ static void unmap_sg(struct device *dev, struct scatterlist *sglist,
        u16 devid;
        int i;
-        if (!get_device_resources(dev, &iommu, &domain, &devid))
+        if (!check_device(dev) ||
+            !get_device_resources(dev, &iommu, &domain, &devid))
                return;
        spin_lock_irqsave(&domain->lock, flags);
@@ -975,12 +1164,10 @@ static void unmap_sg(struct device *dev, struct scatterlist *sglist,
        for_each_sg(sglist, s, nelems, i) {
                __unmap_single(iommu, domain->priv, s->dma_address,
                               s->dma_length, dir);
-                iommu_flush_pages(iommu, domain->id, s->dma_address,
-                                  s->dma_length);
                s->dma_address = s->dma_length = 0;
        }
-        if (iommu->need_sync)
+        if (unlikely(iommu->need_sync))
                iommu_completion_wait(iommu);
        spin_unlock_irqrestore(&domain->lock, flags);
@@ -998,25 +1185,33 @@ static void *alloc_coherent(struct device *dev, size_t size,
        struct protection_domain *domain;
        u16 devid;
        phys_addr_t paddr;
+        u64 dma_mask = dev->coherent_dma_mask;
+        if (!check_device(dev))
+                return NULL;
+        if (!get_device_resources(dev, &iommu, &domain, &devid))
+                flag &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+        flag |= __GFP_ZERO;
        virt_addr = (void *)__get_free_pages(flag, get_order(size));
        if (!virt_addr)
                return 0;
-        memset(virt_addr, 0, size);
        paddr = virt_to_phys(virt_addr);
-        get_device_resources(dev, &iommu, &domain, &devid);
        if (!iommu || !domain) {
                *dma_addr = (dma_addr_t)paddr;
                return virt_addr;
        }
+        if (!dma_mask)
+                dma_mask = *dev->dma_mask;
        spin_lock_irqsave(&domain->lock, flags);
        *dma_addr = __map_single(dev, iommu, domain->priv, paddr,
-                                 size, DMA_BIDIRECTIONAL);
+                                 size, DMA_BIDIRECTIONAL, true, dma_mask);
        if (*dma_addr == bad_dma_address) {
                free_pages((unsigned long)virt_addr, get_order(size));
@@ -1024,10 +1219,7 @@ static void *alloc_coherent(struct device *dev, size_t size,
                goto out;
        }
-        if (iommu_has_npcache(iommu))
+        if (unlikely(iommu->need_sync))
-                iommu_flush_pages(iommu, domain->id, *dma_addr, size);
-        if (iommu->need_sync)
                iommu_completion_wait(iommu);
 out:
@@ -1038,8 +1230,6 @@ out:
 /*
 * The exported free_coherent function for dma_ops.
- * FIXME: fix the generic x86 DMA layer so that it actually calls that
- *        function.
 */
 static void free_coherent(struct device *dev, size_t size,
                          void *virt_addr, dma_addr_t dma_addr)
@@ -1049,6 +1239,9 @@ static void free_coherent(struct device *dev, size_t size,
        struct protection_domain *domain;
        u16 devid;
+        if (!check_device(dev))
+                return;
        get_device_resources(dev, &iommu, &domain, &devid);
        if (!iommu || !domain)
@@ -1057,9 +1250,8 @@ static void free_coherent(struct device *dev, size_t size,
        spin_lock_irqsave(&domain->lock, flags);
        __unmap_single(iommu, domain->priv, dma_addr, size, DMA_BIDIRECTIONAL);
-        iommu_flush_pages(iommu, domain->id, dma_addr, size);
-        if (iommu->need_sync)
+        if (unlikely(iommu->need_sync))
                iommu_completion_wait(iommu);
        spin_unlock_irqrestore(&domain->lock, flags);
@@ -1069,6 +1261,30 @@ free_mem:
 }
 /*
+ * This function is called by the DMA layer to find out if we can handle a
+ * particular device. It is part of the dma_ops.
+ */
+static int amd_iommu_dma_supported(struct device *dev, u64 mask)
+{
+        u16 bdf;
+        struct pci_dev *pcidev;
+        /* No device or no PCI device */
+        if (!dev || dev->bus != &pci_bus_type)
+                return 0;
+        pcidev = to_pci_dev(dev);
+        bdf = calc_devid(pcidev->bus->number, pcidev->devfn);
+        /* Out of our scope? */
+        if (bdf > amd_iommu_last_bdf)
+                return 0;
+        return 1;
+}
+/*
 * The function for pre-allocating protection domains.
 *
 * If the driver core informs the DMA layer if a driver grabs a device
@@ -1097,10 +1313,9 @@ void prealloc_protection_domains(void)
                if (!dma_dom)
                        continue;
                init_unity_mappings_for_device(dma_dom, devid);
-                set_device_domain(iommu, &dma_dom->domain, devid);
+                dma_dom->target_dev = devid;
-                printk(KERN_INFO "AMD IOMMU: Allocated domain %d for device ",
-                       dma_dom->domain.id);
+                list_add_tail(&dma_dom->list, &iommu_pd_list);
-                print_devid(devid, 1);
        }
 }
@@ -1111,6 +1326,7 @@ static struct dma_mapping_ops amd_iommu_dma_ops = {
        .unmap_single = unmap_single,
        .map_sg = map_sg,
        .unmap_sg = unmap_sg,
+        .dma_supported = amd_iommu_dma_supported,
 };
 /*
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index a69cc0f52042..148fcfe22f17 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -22,6 +22,8 @@
 #include <linux/gfp.h>
 #include <linux/list.h>
 #include <linux/sysdev.h>
+#include <linux/interrupt.h>
+#include <linux/msi.h>
 #include <asm/pci-direct.h>
 #include <asm/amd_iommu_types.h>
 #include <asm/amd_iommu.h>
@@ -30,7 +32,6 @@
 /*
 * definitions for the ACPI scanning code
 */
-#define PCI_BUS(x) (((x) >> 8) & 0xff)
 #define IVRS_HEADER_LENGTH 48
 #define ACPI_IVHD_TYPE                  0x10
@@ -121,6 +122,7 @@ LIST_HEAD(amd_iommu_unity_map);		/* a list of required unity mappings
                                           we find in ACPI */
 unsigned amd_iommu_aperture_order = 26; /* size of aperture in power of 2 */
 int amd_iommu_isolate;                  /* if 1, device isolation is enabled */
+bool amd_iommu_unmap_flush;             /* if true, flush on every unmap */
 LIST_HEAD(amd_iommu_list);              /* list of all AMD IOMMUs in the
                                           system */
@@ -234,7 +236,7 @@ static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
 {
        u32 ctrl;
-        ctrl = (u64)readl(iommu->mmio_base + MMIO_CONTROL_OFFSET);
+        ctrl = readl(iommu->mmio_base + MMIO_CONTROL_OFFSET);
        ctrl &= ~(1 << bit);
        writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET);
 }
@@ -242,13 +244,23 @@ static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
 /* Function to enable the hardware */
 void __init iommu_enable(struct amd_iommu *iommu)
 {
-        printk(KERN_INFO "AMD IOMMU: Enabling IOMMU at ");
+        printk(KERN_INFO "AMD IOMMU: Enabling IOMMU "
-        print_devid(iommu->devid, 0);
+               "at %02x:%02x.%x cap 0x%hx\n",
-        printk(" cap 0x%hx\n", iommu->cap_ptr);
+               iommu->dev->bus->number,
+               PCI_SLOT(iommu->dev->devfn),
+               PCI_FUNC(iommu->dev->devfn),
+               iommu->cap_ptr);
        iommu_feature_enable(iommu, CONTROL_IOMMU_EN);
 }
+/* Function to enable IOMMU event logging and event interrupts */
+void __init iommu_enable_event_logging(struct amd_iommu *iommu)
+{
+        iommu_feature_enable(iommu, CONTROL_EVT_LOG_EN);
+        iommu_feature_enable(iommu, CONTROL_EVT_INT_EN);
+}
 /*
 * mapping and unmapping functions for the IOMMU MMIO space. Each AMD IOMMU in
 * the system has one.
@@ -286,6 +298,14 @@ static void __init iommu_unmap_mmio_space(struct amd_iommu *iommu)
 ****************************************************************************/
 /*
+ * This function calculates the length of a given IVHD entry
+ */
+static inline int ivhd_entry_length(u8 *ivhd)
+{
+        return 0x04 << (*ivhd >> 6);
+}
+/*
 * This function reads the last device id the IOMMU has to handle from the PCI
 * capability header for this IOMMU
 */
@@ -329,7 +349,7 @@ static int __init find_last_devid_from_ivhd(struct ivhd_header *h)
                default:
                        break;
                }
-                p += 0x04 << (*p >> 6);
+                p += ivhd_entry_length(p);
        }
        WARN_ON(p != end);
@@ -414,7 +434,32 @@ static u8 * __init alloc_command_buffer(struct amd_iommu *iommu)
 static void __init free_command_buffer(struct amd_iommu *iommu)
 {
-        free_pages((unsigned long)iommu->cmd_buf, get_order(CMD_BUFFER_SIZE));
+        free_pages((unsigned long)iommu->cmd_buf,
+                   get_order(iommu->cmd_buf_size));
+}
+/* allocates the memory where the IOMMU will log its events to */
+static u8 * __init alloc_event_buffer(struct amd_iommu *iommu)
+{
+        u64 entry;
+        iommu->evt_buf = (u8 *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                                get_order(EVT_BUFFER_SIZE));
+        if (iommu->evt_buf == NULL)
+                return NULL;
+        entry = (u64)virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+        memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+                    &entry, sizeof(entry));
+        iommu->evt_buf_size = EVT_BUFFER_SIZE;
+        return iommu->evt_buf;
+}
+static void __init free_event_buffer(struct amd_iommu *iommu)
+{
+        free_pages((unsigned long)iommu->evt_buf, get_order(EVT_BUFFER_SIZE));
 }
 /* sets a specific bit in the device table entry. */
@@ -487,19 +532,21 @@ static void __init set_device_exclusion_range(u16 devid, struct ivmd_header *m)
 */
 static void __init init_iommu_from_pci(struct amd_iommu *iommu)
 {
-        int bus = PCI_BUS(iommu->devid);
-        int dev = PCI_SLOT(iommu->devid);
-        int fn  = PCI_FUNC(iommu->devid);
        int cap_ptr = iommu->cap_ptr;
-        u32 range;
+        u32 range, misc;
-        iommu->cap = read_pci_config(bus, dev, fn, cap_ptr+MMIO_CAP_HDR_OFFSET);
+        pci_read_config_dword(iommu->dev, cap_ptr + MMIO_CAP_HDR_OFFSET,
+                              &iommu->cap);
+        pci_read_config_dword(iommu->dev, cap_ptr + MMIO_RANGE_OFFSET,
+                              &range);
+        pci_read_config_dword(iommu->dev, cap_ptr + MMIO_MISC_OFFSET,
+                              &misc);
-        range = read_pci_config(bus, dev, fn, cap_ptr+MMIO_RANGE_OFFSET);
        iommu->first_device = calc_devid(MMIO_GET_BUS(range),
                                         MMIO_GET_FD(range));
        iommu->last_device = calc_devid(MMIO_GET_BUS(range),
                                        MMIO_GET_LD(range));
+        iommu->evt_msi_num = MMIO_MSI_NUM(misc);
 }
 /*
@@ -604,7 +651,7 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu,
                        break;
                }
-                p += 0x04 << (e->type >> 6);
+                p += ivhd_entry_length(p);
        }
 }
@@ -622,6 +669,7 @@ static int __init init_iommu_devices(struct amd_iommu *iommu)
 static void __init free_iommu_one(struct amd_iommu *iommu)
 {
        free_command_buffer(iommu);
+        free_event_buffer(iommu);
        iommu_unmap_mmio_space(iommu);
 }
@@ -649,8 +697,12 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
        /*
         * Copy data from ACPI table entry to the iommu struct
         */
-        iommu->devid = h->devid;
+        iommu->dev = pci_get_bus_and_slot(PCI_BUS(h->devid), h->devid & 0xff);
+        if (!iommu->dev)
+                return 1;
        iommu->cap_ptr = h->cap_ptr;
+        iommu->pci_seg = h->pci_seg;
        iommu->mmio_phys = h->mmio_phys;
        iommu->mmio_base = iommu_map_mmio_space(h->mmio_phys);
        if (!iommu->mmio_base)
@@ -661,10 +713,18 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
        if (!iommu->cmd_buf)
                return -ENOMEM;
+        iommu->evt_buf = alloc_event_buffer(iommu);
+        if (!iommu->evt_buf)
+                return -ENOMEM;
+        iommu->int_enabled = false;
        init_iommu_from_pci(iommu);
        init_iommu_from_acpi(iommu, h);
        init_iommu_devices(iommu);
+        pci_enable_device(iommu->dev);
        return 0;
 }
@@ -706,6 +766,95 @@ static int __init init_iommu_all(struct acpi_table_header *table)
 /****************************************************************************
 *
+ * The following functions initialize the MSI interrupts for all IOMMUs
+ * in the system. Its a bit challenging because there could be multiple
+ * IOMMUs per PCI BDF but we can call pci_enable_msi(x) only once per
+ * pci_dev.
+ *
+ ****************************************************************************/
+static int __init iommu_setup_msix(struct amd_iommu *iommu)
+{
+        struct amd_iommu *curr;
+        struct msix_entry entries[32]; /* only 32 supported by AMD IOMMU */
+        int nvec = 0, i;
+        list_for_each_entry(curr, &amd_iommu_list, list) {
+                if (curr->dev == iommu->dev) {
+                        entries[nvec].entry = curr->evt_msi_num;
+                        entries[nvec].vector = 0;
+                        curr->int_enabled = true;
+                        nvec++;
+                }
+        }
+        if (pci_enable_msix(iommu->dev, entries, nvec)) {
+                pci_disable_msix(iommu->dev);
+                return 1;
+        }
+        for (i = 0; i < nvec; ++i) {
+                int r = request_irq(entries->vector, amd_iommu_int_handler,
+                                    IRQF_SAMPLE_RANDOM,
+                                    "AMD IOMMU",
+                                    NULL);
+                if (r)
+                        goto out_free;
+        }
+        return 0;
+out_free:
+        for (i -= 1; i >= 0; --i)
+                free_irq(entries->vector, NULL);
+        pci_disable_msix(iommu->dev);
+        return 1;
+}
+static int __init iommu_setup_msi(struct amd_iommu *iommu)
+{
+        int r;
+        struct amd_iommu *curr;
+        list_for_each_entry(curr, &amd_iommu_list, list) {
+                if (curr->dev == iommu->dev)
+                        curr->int_enabled = true;
+        }
+        if (pci_enable_msi(iommu->dev))
+                return 1;
+        r = request_irq(iommu->dev->irq, amd_iommu_int_handler,
+                        IRQF_SAMPLE_RANDOM,
+                        "AMD IOMMU",
+                        NULL);
+        if (r) {
+                pci_disable_msi(iommu->dev);
+                return 1;
+        }
+        return 0;
+}
+static int __init iommu_init_msi(struct amd_iommu *iommu)
+{
+        if (iommu->int_enabled)
+                return 0;
+        if (pci_find_capability(iommu->dev, PCI_CAP_ID_MSIX))
+                return iommu_setup_msix(iommu);
+        else if (pci_find_capability(iommu->dev, PCI_CAP_ID_MSI))
+                return iommu_setup_msi(iommu);
+        return 1;
+}
+/****************************************************************************
+ *
 * The next functions belong to the third pass of parsing the ACPI
 * table. In this last pass the memory mapping requirements are
 * gathered (like exclusion and unity mapping reanges).
@@ -811,7 +960,6 @@ static void init_device_table(void)
        for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) {
                set_dev_entry_bit(devid, DEV_ENTRY_VALID);
                set_dev_entry_bit(devid, DEV_ENTRY_TRANSLATION);
-                set_dev_entry_bit(devid, DEV_ENTRY_NO_PAGE_FAULT);
        }
 }
@@ -825,6 +973,8 @@ static void __init enable_iommus(void)
        list_for_each_entry(iommu, &amd_iommu_list, list) {
                iommu_set_exclusion_range(iommu);
+                iommu_init_msi(iommu);
+                iommu_enable_event_logging(iommu);
                iommu_enable(iommu);
        }
 }
@@ -995,11 +1145,17 @@ int __init amd_iommu_init(void)
        else
                printk("disabled\n");
+        if (amd_iommu_unmap_flush)
+                printk(KERN_INFO "AMD IOMMU: IO/TLB flush on unmap enabled\n");
+        else
+                printk(KERN_INFO "AMD IOMMU: Lazy IO/TLB flushing enabled\n");
 out:
        return ret;
 free:
-        free_pages((unsigned long)amd_iommu_pd_alloc_bitmap, 1);
+        free_pages((unsigned long)amd_iommu_pd_alloc_bitmap,
+                   get_order(MAX_DOMAIN_ID/8));
        free_pages((unsigned long)amd_iommu_pd_table,
                   get_order(rlookup_table_size));
@@ -1057,8 +1213,10 @@ void __init amd_iommu_detect(void)
 static int __init parse_amd_iommu_options(char *str)
 {
        for (; *str; ++str) {
-                if (strcmp(str, "isolate") == 0)
+                if (strncmp(str, "isolate", 7) == 0)
                        amd_iommu_isolate = 1;
+                if (strncmp(str, "fullflush", 11) == 0)
+                        amd_iommu_unmap_flush = true;
        }
        return 1;
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 44e21826db11..9a32b37ee2ee 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -455,11 +455,11 @@ out:
                   force_iommu ||
                   valid_agp ||
                   fallback_aper_force) {
-                printk(KERN_ERR
+                printk(KERN_INFO
                        "Your BIOS doesn't leave a aperture memory hole\n");
-                printk(KERN_ERR
+                printk(KERN_INFO
                        "Please enable the IOMMU option in the BIOS setup\n");
-                printk(KERN_ERR
+                printk(KERN_INFO
                        "This costs you %d MB of RAM\n",
                                32 << fallback_aper_order);
diff --git a/arch/x86/kernel/apic_32.c b/arch/x86/kernel/apic_32.c
index 584272105051..a91c57cb666a 100644
--- a/arch/x86/kernel/apic_32.c
+++ b/arch/x86/kernel/apic_32.c
@@ -60,10 +60,8 @@ unsigned long mp_lapic_addr;
 static int force_enable_local_apic;
 int disable_apic;
-/* Local APIC timer verification ok */
-static int local_apic_timer_verify_ok;
 /* Disable local APIC timer from the kernel commandline or via dmi quirk */
-static int local_apic_timer_disabled;
+static int disable_apic_timer __cpuinitdata;
 /* Local APIC timer works in C2 */
 int local_apic_timer_c2_ok;
 EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
@@ -130,7 +128,11 @@ static inline int lapic_get_version(void)
 */
 static inline int lapic_is_integrated(void)
 {
+#ifdef CONFIG_X86_64
+        return 1;
+#else
        return APIC_INTEGRATED(lapic_get_version());
+#endif
 }
 /*
@@ -244,8 +246,12 @@ int lapic_get_maxlvt(void)
 * Local APIC timer
 */
-/* Clock divisor is set to 16 */
+/* Clock divisor */
+#ifdef CONFG_X86_64
+#define APIC_DIVISOR 1
+#else
 #define APIC_DIVISOR 16
+#endif
 /*
 * This function sets up the local APIC timer, with a timeout of
@@ -253,6 +259,9 @@ int lapic_get_maxlvt(void)
 * this function twice on the boot CPU, once with a bogus timeout
 * value, second time for real. The other (noncalibrating) CPUs
 * call this function only once, with the real, calibrated value.
+ *
+ * We do reads before writes even if unnecessary, to get around the
+ * P5 APIC double write bug.
 */
 static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
 {
@@ -274,14 +283,44 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
         */
        tmp_value = apic_read(APIC_TDCR);
        apic_write(APIC_TDCR,
-                   (tmp_value & ~(APIC_TDR_DIV_1 | APIC_TDR_DIV_TMBASE)) |
+                (tmp_value & ~(APIC_TDR_DIV_1 | APIC_TDR_DIV_TMBASE)) |
-                   APIC_TDR_DIV_16);
+                APIC_TDR_DIV_16);
        if (!oneshot)
                apic_write(APIC_TMICT, clocks / APIC_DIVISOR);
 }
 /*
+ * Setup extended LVT, AMD specific (K8, family 10h)
+ *
+ * Vector mappings are hard coded. On K8 only offset 0 (APIC500) and
+ * MCE interrupts are supported. Thus MCE offset must be set to 0.
+ */
+#define APIC_EILVT_LVTOFF_MCE 0
+#define APIC_EILVT_LVTOFF_IBS 1
+static void setup_APIC_eilvt(u8 lvt_off, u8 vector, u8 msg_type, u8 mask)
+{
+        unsigned long reg = (lvt_off << 4) + APIC_EILVT0;
+        unsigned int  v   = (mask << 16) | (msg_type << 8) | vector;
+        apic_write(reg, v);
+}
+u8 setup_APIC_eilvt_mce(u8 vector, u8 msg_type, u8 mask)
+{
+        setup_APIC_eilvt(APIC_EILVT_LVTOFF_MCE, vector, msg_type, mask);
+        return APIC_EILVT_LVTOFF_MCE;
+}
+u8 setup_APIC_eilvt_ibs(u8 vector, u8 msg_type, u8 mask)
+{
+        setup_APIC_eilvt(APIC_EILVT_LVTOFF_IBS, vector, msg_type, mask);
+        return APIC_EILVT_LVTOFF_IBS;
+}
+/*
 * Program the next event, relative to now
 */
 static int lapic_next_event(unsigned long delta,
@@ -300,8 +339,8 @@ static void lapic_timer_setup(enum clock_event_mode mode,
        unsigned long flags;
        unsigned int v;
-        /* Lapic used for broadcast ? */
+        /* Lapic used as dummy for broadcast ? */
-        if (!local_apic_timer_verify_ok)
+        if (evt->features & CLOCK_EVT_FEAT_DUMMY)
                return;
        local_irq_save(flags);
@@ -514,7 +553,7 @@ static int __init calibrate_APIC_clock(void)
                return -1;
        }
-        local_apic_timer_verify_ok = 1;
+        levt->features &= ~CLOCK_EVT_FEAT_DUMMY;
        /* We trust the pm timer based calibration */
        if (!pm_referenced) {
@@ -548,11 +587,11 @@ static int __init calibrate_APIC_clock(void)
                if (deltaj >= LAPIC_CAL_LOOPS-2 && deltaj <= LAPIC_CAL_LOOPS+2)
                        apic_printk(APIC_VERBOSE, "... jiffies result ok\n");
                else
-                        local_apic_timer_verify_ok = 0;
+                        levt->features |= CLOCK_EVT_FEAT_DUMMY;
        } else
                local_irq_enable();
-        if (!local_apic_timer_verify_ok) {
+        if (levt->features & CLOCK_EVT_FEAT_DUMMY) {
                printk(KERN_WARNING
                       "APIC timer disabled due to verification failure.\n");
                        return -1;
@@ -574,7 +613,8 @@ void __init setup_boot_APIC_clock(void)
         * timer as a dummy clock event source on SMP systems, so the
         * broadcast mechanism is used. On UP systems simply ignore it.
         */
-        if (local_apic_timer_disabled) {
+        if (disable_apic_timer) {
+                printk(KERN_INFO "Disabling APIC timer\n");
                /* No broadcast on UP ! */
                if (num_possible_cpus() > 1) {
                        lapic_clockevent.mult = 1;
@@ -643,7 +683,11 @@ static void local_apic_timer_interrupt(void)
        /*
         * the NMI deadlock-detector uses this.
         */
+#ifdef CONFIG_X86_64
+        add_pda(apic_timer_irqs, 1);
+#else
        per_cpu(irq_stat, cpu).apic_timer_irqs++;
+#endif
        evt->event_handler(evt);
 }
@@ -683,35 +727,6 @@ int setup_profiling_timer(unsigned int multiplier)
 }
 /*
- * Setup extended LVT, AMD specific (K8, family 10h)
- *
- * Vector mappings are hard coded. On K8 only offset 0 (APIC500) and
- * MCE interrupts are supported. Thus MCE offset must be set to 0.
- */
-#define APIC_EILVT_LVTOFF_MCE 0
-#define APIC_EILVT_LVTOFF_IBS 1
-static void setup_APIC_eilvt(u8 lvt_off, u8 vector, u8 msg_type, u8 mask)
-{
-        unsigned long reg = (lvt_off << 4) + APIC_EILVT0;
-        unsigned int  v   = (mask << 16) | (msg_type << 8) | vector;
-        apic_write(reg, v);
-}
-u8 setup_APIC_eilvt_mce(u8 vector, u8 msg_type, u8 mask)
-{
-        setup_APIC_eilvt(APIC_EILVT_LVTOFF_MCE, vector, msg_type, mask);
-        return APIC_EILVT_LVTOFF_MCE;
-}
-u8 setup_APIC_eilvt_ibs(u8 vector, u8 msg_type, u8 mask)
-{
-        setup_APIC_eilvt(APIC_EILVT_LVTOFF_IBS, vector, msg_type, mask);
-        return APIC_EILVT_LVTOFF_IBS;
-}
-/*
 * Local APIC start and shutdown
 */
@@ -756,7 +771,7 @@ void clear_local_APIC(void)
        }
        /* lets not touch this if we didn't frob it */
-#ifdef CONFIG_X86_MCE_P4THERMAL
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(X86_MCE_INTEL)
        if (maxlvt >= 5) {
                v = apic_read(APIC_LVTTHMR);
                apic_write(APIC_LVTTHMR, v | APIC_LVT_MASKED);
@@ -773,10 +788,6 @@ void clear_local_APIC(void)
        if (maxlvt >= 4)
                apic_write(APIC_LVTPC, APIC_LVT_MASKED);
-#ifdef CONFIG_X86_MCE_P4THERMAL
-        if (maxlvt >= 5)
-                apic_write(APIC_LVTTHMR, APIC_LVT_MASKED);
-#endif
        /* Integrated APIC (!82489DX) ? */
        if (lapic_is_integrated()) {
                if (maxlvt > 3)
@@ -791,7 +802,7 @@ void clear_local_APIC(void)
 */
 void disable_local_APIC(void)
 {
-        unsigned long value;
+        unsigned int value;
        clear_local_APIC();
@@ -803,6 +814,7 @@ void disable_local_APIC(void)
        value &= ~APIC_SPIV_APIC_ENABLED;
        apic_write(APIC_SPIV, value);
+#ifdef CONFIG_X86_32
        /*
         * When LAPIC was disabled by the BIOS and enabled by the kernel,
         * restore the disabled state.
@@ -814,6 +826,7 @@ void disable_local_APIC(void)
                l &= ~MSR_IA32_APICBASE_ENABLE;
                wrmsr(MSR_IA32_APICBASE, l, h);
        }
+#endif
 }
 /*
@@ -830,11 +843,15 @@ void lapic_shutdown(void)
                return;
        local_irq_save(flags);
-        clear_local_APIC();
-        if (enabled_via_apicbase)
+#ifdef CONFIG_X86_32
+        if (!enabled_via_apicbase)
+                clear_local_APIC();
+        else
+#endif
                disable_local_APIC();
        local_irq_restore(flags);
 }
@@ -879,6 +896,12 @@ int __init verify_local_APIC(void)
         */
        reg0 = apic_read(APIC_ID);
        apic_printk(APIC_DEBUG, "Getting ID: %x\n", reg0);
+        apic_write(APIC_ID, reg0 ^ APIC_ID_MASK);
+        reg1 = apic_read(APIC_ID);
+        apic_printk(APIC_DEBUG, "Getting ID: %x\n", reg1);
+        apic_write(APIC_ID, reg0);
+        if (reg1 != (reg0 ^ APIC_ID_MASK))
+                return 0;
        /*
         * The next two are just to see if we have sane values.
@@ -904,14 +927,15 @@ void __init sync_Arb_IDs(void)
         */
        if (modern_apic() || boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
                return;
        /*
         * Wait for idle.
         */
        apic_wait_icr_idle();
        apic_printk(APIC_DEBUG, "Synchronizing Arb IDs.\n");
-        apic_write(APIC_ICR,
+        apic_write(APIC_ICR, APIC_DEST_ALLINC |
-                   APIC_DEST_ALLINC | APIC_INT_LEVELTRIG | APIC_DM_INIT);
+                        APIC_INT_LEVELTRIG | APIC_DM_INIT);
 }
 /*
@@ -919,7 +943,7 @@ void __init sync_Arb_IDs(void)
 */
 void __init init_bsp_APIC(void)
 {
-        unsigned long value;
+        unsigned int value;
        /*
         * Don't do the setup now if we have a SMP BIOS as the
@@ -940,11 +964,13 @@ void __init init_bsp_APIC(void)
        value &= ~APIC_VECTOR_MASK;
        value |= APIC_SPIV_APIC_ENABLED;
+#ifdef CONFIG_X86_32
        /* This bit is reserved on P4/Xeon and should be cleared */
        if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) &&
            (boot_cpu_data.x86 == 15))
                value &= ~APIC_SPIV_FOCUS_DISABLED;
        else
+#endif
                value |= APIC_SPIV_FOCUS_DISABLED;
        value |= SPURIOUS_APIC_VECTOR;
        apic_write(APIC_SPIV, value);
@@ -963,6 +989,16 @@ static void __cpuinit lapic_setup_esr(void)
 {
        unsigned long oldvalue, value, maxlvt;
        if (lapic_is_integrated() && !esr_disable) {
+                if (esr_disable) {
+                        /*
+                         * Something untraceable is creating bad interrupts on
+                         * secondary quads ... for the moment, just leave the
+                         * ESR disabled - we can't do anything useful with the
+                         * errors anyway - mbligh
+                         */
+                        printk(KERN_INFO "Leaving ESR disabled.\n");
+                        return;
+                }
                /* !82489DX */
                maxlvt = lapic_get_maxlvt();
                if (maxlvt > 3)         /* Due to the Pentium erratum 3AP. */
@@ -983,16 +1019,7 @@ static void __cpuinit lapic_setup_esr(void)
                                "vector: 0x%08lx  after: 0x%08lx\n",
                                oldvalue, value);
        } else {
-                if (esr_disable)
+                printk(KERN_INFO "No ESR for 82489DX.\n");
-                        /*
-                         * Something untraceable is creating bad interrupts on
-                         * secondary quads ... for the moment, just leave the
-                         * ESR disabled - we can't do anything useful with the
-                         * errors anyway - mbligh
-                         */
-                        printk(KERN_INFO "Leaving ESR disabled.\n");
-                else
-                        printk(KERN_INFO "No ESR for 82489DX.\n");
        }
 }
@@ -1130,13 +1157,17 @@ void __cpuinit setup_local_APIC(void)
 void __cpuinit end_local_APIC_setup(void)
 {
-        unsigned long value;
        lapic_setup_esr();
-        /* Disable the local apic timer */
-        value = apic_read(APIC_LVTT);
+#ifdef CONFIG_X86_32
-        value |= (APIC_LVT_MASKED | LOCAL_TIMER_VECTOR);
+        {
-        apic_write(APIC_LVTT, value);
+                unsigned int value;
+                /* Disable the local apic timer */
+                value = apic_read(APIC_LVTT);
+                value |= (APIC_LVT_MASKED | LOCAL_TIMER_VECTOR);
+                apic_write(APIC_LVTT, value);
+        }
+#endif
        setup_apic_nmi_watchdog(NULL);
        apic_pm_activate();
@@ -1367,6 +1398,7 @@ void smp_error_interrupt(struct pt_regs *regs)
 */
 void __init connect_bsp_APIC(void)
 {
+#ifdef CONFIG_X86_32
        if (pic_mode) {
                /*
                 * Do not trust the local APIC being empty at bootup.
@@ -1381,6 +1413,7 @@ void __init connect_bsp_APIC(void)
                outb(0x70, 0x22);
                outb(0x01, 0x23);
        }
+#endif
        enable_apic_mode();
 }
@@ -1393,6 +1426,9 @@ void __init connect_bsp_APIC(void)
 */
 void disconnect_bsp_APIC(int virt_wire_setup)
 {
+        unsigned int value;
+#ifdef CONFIG_X86_32
        if (pic_mode) {
                /*
                 * Put the board back into PIC mode (has an effect only on
@@ -1404,54 +1440,53 @@ void disconnect_bsp_APIC(int virt_wire_setup)
                                "entering PIC mode.\n");
                outb(0x70, 0x22);
                outb(0x00, 0x23);
-        } else {
+                return;
-                /* Go back to Virtual Wire compatibility mode */
+        }
-                unsigned long value;
+#endif
-                /* For the spurious interrupt use vector F, and enable it */
+        /* Go back to Virtual Wire compatibility mode */
-                value = apic_read(APIC_SPIV);
-                value &= ~APIC_VECTOR_MASK;
-                value |= APIC_SPIV_APIC_ENABLED;
-                value |= 0xf;
-                apic_write(APIC_SPIV, value);
-                if (!virt_wire_setup) {
+        /* For the spurious interrupt use vector F, and enable it */
-                        /*
+        value = apic_read(APIC_SPIV);
-                         * For LVT0 make it edge triggered, active high,
+        value &= ~APIC_VECTOR_MASK;
-                         * external and enabled
+        value |= APIC_SPIV_APIC_ENABLED;
-                         */
+        value |= 0xf;
-                        value = apic_read(APIC_LVT0);
+        apic_write(APIC_SPIV, value);
-                        value &= ~(APIC_MODE_MASK | APIC_SEND_PENDING |
-                                APIC_INPUT_POLARITY | APIC_LVT_REMOTE_IRR |
-                                APIC_LVT_LEVEL_TRIGGER | APIC_LVT_MASKED);
-                        value |= APIC_LVT_REMOTE_IRR | APIC_SEND_PENDING;
-                        value = SET_APIC_DELIVERY_MODE(value, APIC_MODE_EXTINT);
-                        apic_write(APIC_LVT0, value);
-                } else {
-                        /* Disable LVT0 */
-                        apic_write(APIC_LVT0, APIC_LVT_MASKED);
-                }
+        if (!virt_wire_setup) {
                /*
-                 * For LVT1 make it edge triggered, active high, nmi and
+                 * For LVT0 make it edge triggered, active high,
-                 * enabled
+                 * external and enabled
                 */
-                value = apic_read(APIC_LVT1);
+                value = apic_read(APIC_LVT0);
-                value &= ~(
+                value &= ~(APIC_MODE_MASK | APIC_SEND_PENDING |
-                        APIC_MODE_MASK | APIC_SEND_PENDING |
                        APIC_INPUT_POLARITY | APIC_LVT_REMOTE_IRR |
                        APIC_LVT_LEVEL_TRIGGER | APIC_LVT_MASKED);
                value |= APIC_LVT_REMOTE_IRR | APIC_SEND_PENDING;
-                value = SET_APIC_DELIVERY_MODE(value, APIC_MODE_NMI);
+                value = SET_APIC_DELIVERY_MODE(value, APIC_MODE_EXTINT);
-                apic_write(APIC_LVT1, value);
+                apic_write(APIC_LVT0, value);
+        } else {
+                /* Disable LVT0 */
+                apic_write(APIC_LVT0, APIC_LVT_MASKED);
        }
+        /*
+         * For LVT1 make it edge triggered, active high,
+         * nmi and enabled
+         */
+        value = apic_read(APIC_LVT1);
+        value &= ~(APIC_MODE_MASK | APIC_SEND_PENDING |
+                        APIC_INPUT_POLARITY | APIC_LVT_REMOTE_IRR |
+                        APIC_LVT_LEVEL_TRIGGER | APIC_LVT_MASKED);
+        value |= APIC_LVT_REMOTE_IRR | APIC_SEND_PENDING;
+        value = SET_APIC_DELIVERY_MODE(value, APIC_MODE_NMI);
+        apic_write(APIC_LVT1, value);
 }
 void __cpuinit generic_processor_info(int apicid, int version)
 {
        int cpu;
        cpumask_t tmp_map;
-        physid_mask_t phys_cpu;
        /*
         * Validate version
@@ -1464,9 +1499,6 @@ void __cpuinit generic_processor_info(int apicid, int version)
        }
        apic_version[apicid] = version;
-        phys_cpu = apicid_to_cpu_present(apicid);
-        physids_or(phys_cpu_present_map, phys_cpu_present_map, phys_cpu);
        if (num_processors >= NR_CPUS) {
                printk(KERN_WARNING "WARNING: NR_CPUS limit of %i reached."
                        "  Processor ignored.\n", NR_CPUS);
@@ -1477,17 +1509,19 @@ void __cpuinit generic_processor_info(int apicid, int version)
        cpus_complement(tmp_map, cpu_present_map);
        cpu = first_cpu(tmp_map);
-        if (apicid == boot_cpu_physical_apicid)
+        physid_set(apicid, phys_cpu_present_map);
+        if (apicid == boot_cpu_physical_apicid) {
                /*
                 * x86_bios_cpu_apicid is required to have processors listed
                 * in same order as logical cpu numbers. Hence the first
                 * entry is BSP, and so on.
                 */
                cpu = 0;
+        }
        if (apicid > max_physical_apicid)
                max_physical_apicid = apicid;
+#ifdef CONFIG_X86_32
        /*
         * Would be preferable to switch to bigsmp when CONFIG_HOTPLUG_CPU=y
         * but we need to work other dependencies like SMP_SUSPEND etc
@@ -1507,7 +1541,9 @@ void __cpuinit generic_processor_info(int apicid, int version)
                        def_to_bigsmp = 1;
                }
        }
-#ifdef CONFIG_SMP
+#endif
+#if defined(CONFIG_X86_SMP) || defined(CONFIG_X86_64)
        /* are we being called early in kernel startup? */
        if (early_per_cpu_ptr(x86_cpu_to_apicid)) {
                u16 *cpu_to_apicid = early_per_cpu_ptr(x86_cpu_to_apicid);
@@ -1520,6 +1556,7 @@ void __cpuinit generic_processor_info(int apicid, int version)
                per_cpu(x86_bios_cpu_apicid, cpu) = apicid;
        }
 #endif
        cpu_set(cpu, cpu_possible_map);
        cpu_set(cpu, cpu_present_map);
 }
@@ -1530,6 +1567,11 @@ void __cpuinit generic_processor_info(int apicid, int version)
 #ifdef CONFIG_PM
 static struct {
+        /*
+         * 'active' is true if the local APIC was enabled by us and
+         * not the BIOS; this signifies that we are also responsible
+         * for disabling it before entering apm/acpi suspend
+         */
        int active;
        /* r/w apic fields */
        unsigned int apic_id;
@@ -1570,7 +1612,7 @@ static int lapic_suspend(struct sys_device *dev, pm_message_t state)
        apic_pm_state.apic_lvterr = apic_read(APIC_LVTERR);
        apic_pm_state.apic_tmict = apic_read(APIC_TMICT);
        apic_pm_state.apic_tdcr = apic_read(APIC_TDCR);
-#ifdef CONFIG_X86_MCE_P4THERMAL
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(CONFIG_X86_MCE_INTEL)
        if (maxlvt >= 5)
                apic_pm_state.apic_thmr = apic_read(APIC_LVTTHMR);
 #endif
@@ -1594,16 +1636,23 @@ static int lapic_resume(struct sys_device *dev)
        local_irq_save(flags);
-        /*
+#ifdef CONFIG_X86_64
-         * Make sure the APICBASE points to the right address
+        if (x2apic)
-         *
+                enable_x2apic();
-         * FIXME! This will be wrong if we ever support suspend on
+        else
-         * SMP! We'll need to do this as part of the CPU restore!
+#endif
-         */
+        {
-        rdmsr(MSR_IA32_APICBASE, l, h);
+                /*
-        l &= ~MSR_IA32_APICBASE_BASE;
+                 * Make sure the APICBASE points to the right address
-        l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+                 *
-        wrmsr(MSR_IA32_APICBASE, l, h);
+                 * FIXME! This will be wrong if we ever support suspend on
+                 * SMP! We'll need to do this as part of the CPU restore!
+                 */
+                rdmsr(MSR_IA32_APICBASE, l, h);
+                l &= ~MSR_IA32_APICBASE_BASE;
+                l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+                wrmsr(MSR_IA32_APICBASE, l, h);
+        }
        apic_write(APIC_LVTERR, ERROR_APIC_VECTOR | APIC_LVT_MASKED);
        apic_write(APIC_ID, apic_pm_state.apic_id);
@@ -1613,7 +1662,7 @@ static int lapic_resume(struct sys_device *dev)
        apic_write(APIC_SPIV, apic_pm_state.apic_spiv);
        apic_write(APIC_LVT0, apic_pm_state.apic_lvt0);
        apic_write(APIC_LVT1, apic_pm_state.apic_lvt1);
-#ifdef CONFIG_X86_MCE_P4THERMAL
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(CONFIG_X86_MCE_INTEL)
        if (maxlvt >= 5)
                apic_write(APIC_LVTTHMR, apic_pm_state.apic_thmr);
 #endif
@@ -1627,7 +1676,9 @@ static int lapic_resume(struct sys_device *dev)
        apic_write(APIC_LVTERR, apic_pm_state.apic_lvterr);
        apic_write(APIC_ESR, 0);
        apic_read(APIC_ESR);
        local_irq_restore(flags);
        return 0;
 }
@@ -1683,20 +1734,20 @@ static int __init parse_lapic(char *arg)
 }
 early_param("lapic", parse_lapic);
-static int __init parse_nolapic(char *arg)
+static int __init setup_disableapic(char *arg)
 {
        disable_apic = 1;
        setup_clear_cpu_cap(X86_FEATURE_APIC);
        return 0;
 }
-early_param("nolapic", parse_nolapic);
+early_param("disableapic", setup_disableapic);
-static int __init parse_disable_lapic_timer(char *arg)
+/* same as disableapic, for compatibility */
+static int __init setup_nolapic(char *arg)
 {
-        local_apic_timer_disabled = 1;
+        return setup_disableapic(arg);
-        return 0;
 }
-early_param("nolapic_timer", parse_disable_lapic_timer);
+early_param("nolapic", setup_nolapic);
 static int __init parse_lapic_timer_c2_ok(char *arg)
 {
@@ -1705,15 +1756,40 @@ static int __init parse_lapic_timer_c2_ok(char *arg)
 }
 early_param("lapic_timer_c2_ok", parse_lapic_timer_c2_ok);
+static int __init parse_disable_apic_timer(char *arg)
+{
+        disable_apic_timer = 1;
+        return 0;
+}
+early_param("noapictimer", parse_disable_apic_timer);
+static int __init parse_nolapic_timer(char *arg)
+{
+        disable_apic_timer = 1;
+        return 0;
+}
+early_param("nolapic_timer", parse_nolapic_timer);
 static int __init apic_set_verbosity(char *arg)
 {
-        if (!arg)
+        if (!arg)  {
+#ifdef CONFIG_X86_64
+                skip_ioapic_setup = 0;
+                ioapic_force = 1;
+                return 0;
+#endif
                return -EINVAL;
+        }
-        if (strcmp(arg, "debug") == 0)
+        if (strcmp("debug", arg) == 0)
                apic_verbosity = APIC_DEBUG;
-        else if (strcmp(arg, "verbose") == 0)
+        else if (strcmp("verbose", arg) == 0)
                apic_verbosity = APIC_VERBOSE;
+        else {
+                printk(KERN_WARNING "APIC Verbosity level %s not recognised"
+                        " use apic=verbose or apic=debug\n", arg);
+                return -EINVAL;
+        }
        return 0;
 }
diff --git a/arch/x86/kernel/apic_64.c b/arch/x86/kernel/apic_64.c
index 1a6011855af3..53898b65a6ae 100644
--- a/arch/x86/kernel/apic_64.c
+++ b/arch/x86/kernel/apic_64.c
@@ -45,6 +45,7 @@
 #include <mach_ipi.h>
 #include <mach_apic.h>
+/* Disable local APIC timer from the kernel commandline or via dmi quirk */
 static int disable_apic_timer __cpuinitdata;
 static int apic_calibrate_pmtmr __initdata;
 int disable_apic;
@@ -80,6 +81,9 @@ static void lapic_timer_setup(enum clock_event_mode mode,
 static void lapic_timer_broadcast(cpumask_t mask);
 static void apic_pm_activate(void);
+/*
+ * The local apic timer can be used for any function which is CPU local.
+ */
 static struct clock_event_device lapic_clockevent = {
        .name           = "lapic",
        .features       = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT
@@ -106,11 +110,15 @@ static inline int lapic_get_version(void)
 }
 /*
- * Check, if the APIC is integrated or a seperate chip
+ * Check, if the APIC is integrated or a separate chip
 */
 static inline int lapic_is_integrated(void)
 {
+#ifdef CONFIG_X86_64
        return 1;
+#else
+        return APIC_INTEGRATED(lapic_get_version());
+#endif
 }
 /*
@@ -125,6 +133,11 @@ static int modern_apic(void)
        return lapic_get_version() >= 0x14;
 }
+/*
+ * Paravirt kernels also might be using these below ops. So we still
+ * use generic apic_read()/apic_write(), which might be pointing to different
+ * ops in PARAVIRT case.
+ */
 void xapic_wait_icr_idle(void)
 {
        while (apic_read(APIC_ICR) & APIC_ICR_BUSY)
@@ -149,7 +162,7 @@ u32 safe_xapic_wait_icr_idle(void)
 void xapic_icr_write(u32 low, u32 id)
 {
-        apic_write(APIC_ICR2, id << 24);
+        apic_write(APIC_ICR2, SET_APIC_DEST_FIELD(id));
        apic_write(APIC_ICR, low);
 }
@@ -160,7 +173,7 @@ u64 xapic_icr_read(void)
        icr2 = apic_read(APIC_ICR2);
        icr1 = apic_read(APIC_ICR);
-        return (icr1 | ((u64)icr2 << 32));
+        return icr1 | ((u64)icr2 << 32);
 }
 static struct apic_ops xapic_ops = {
@@ -173,7 +186,6 @@ static struct apic_ops xapic_ops = {
 };
 struct apic_ops __read_mostly *apic_ops = &xapic_ops;
 EXPORT_SYMBOL_GPL(apic_ops);
 static void x2apic_wait_icr_idle(void)
@@ -243,6 +255,17 @@ int lapic_get_maxlvt(void)
 }
 /*
+ * Local APIC timer
+ */
+/* Clock divisor */
+#ifdef CONFG_X86_64
+#define APIC_DIVISOR 1
+#else
+#define APIC_DIVISOR 16
+#endif
+/*
 * This function sets up the local APIC timer, with a timeout of
 * 'clocks' APIC bus clock. During calibration we actually call
 * this function twice on the boot CPU, once with a bogus timeout
@@ -252,7 +275,6 @@ int lapic_get_maxlvt(void)
 * We do reads before writes even if unnecessary, to get around the
 * P5 APIC double write bug.
 */
 static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
 {
        unsigned int lvtt_value, tmp_value;
@@ -260,6 +282,9 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
        lvtt_value = LOCAL_TIMER_VECTOR;
        if (!oneshot)
                lvtt_value |= APIC_LVT_TIMER_PERIODIC;
+        if (!lapic_is_integrated())
+                lvtt_value |= SET_APIC_TIMER_BASE(APIC_TIMER_BASE_DIV);
        if (!irqen)
                lvtt_value |= APIC_LVT_MASKED;
@@ -269,12 +294,12 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
         * Divide PICLK by 16
         */
        tmp_value = apic_read(APIC_TDCR);
-        apic_write(APIC_TDCR, (tmp_value
+        apic_write(APIC_TDCR,
-                                & ~(APIC_TDR_DIV_1 | APIC_TDR_DIV_TMBASE))
+                (tmp_value & ~(APIC_TDR_DIV_1 | APIC_TDR_DIV_TMBASE)) |
-                                | APIC_TDR_DIV_16);
+                APIC_TDR_DIV_16);
        if (!oneshot)
-                apic_write(APIC_TMICT, clocks);
+                apic_write(APIC_TMICT, clocks / APIC_DIVISOR);
 }
 /*
@@ -444,7 +469,7 @@ static int __init calibrate_APIC_clock(void)
        lapic_clockevent.min_delta_ns =
                clockevent_delta2ns(0xF, &lapic_clockevent);
-        calibration_result = result / HZ;
+        calibration_result = (result * APIC_DIVISOR) / HZ;
        /*
         * Do a sanity check on the APIC calibration result
@@ -466,10 +491,10 @@ static int __init calibrate_APIC_clock(void)
 void __init setup_boot_APIC_clock(void)
 {
        /*
-         * The local apic timer can be disabled via the kernel commandline.
+         * The local apic timer can be disabled via the kernel
-         * Register the lapic timer as a dummy clock event source on SMP
+         * commandline or from the CPU detection code. Register the lapic
-         * systems, so the broadcast mechanism is used. On UP systems simply
+         * timer as a dummy clock event source on SMP systems, so the
-         * ignore it.
+         * broadcast mechanism is used. On UP systems simply ignore it.
         */
        if (disable_apic_timer) {
                printk(KERN_INFO "Disabling APIC timer\n");
@@ -481,7 +506,9 @@ void __init setup_boot_APIC_clock(void)
                return;
        }
-        printk(KERN_INFO "Using local APIC timer interrupts.\n");
+        apic_printk(APIC_VERBOSE, "Using local APIC timer interrupts.\n"
+                    "calibrating APIC timer ...\n");
        if (calibrate_APIC_clock()) {
                /* No broadcast on UP ! */
                if (num_possible_cpus() > 1)
@@ -500,6 +527,7 @@ void __init setup_boot_APIC_clock(void)
                printk(KERN_WARNING "APIC timer registered as dummy,"
                        " due to nmi_watchdog=%d!\n", nmi_watchdog);
+        /* Setup the lapic or request the broadcast */
        setup_APIC_timer();
 }
@@ -538,7 +566,11 @@ static void local_apic_timer_interrupt(void)
        /*
         * the NMI deadlock-detector uses this.
         */
+#ifdef CONFIG_X86_64
        add_pda(apic_timer_irqs, 1);
+#else
+        per_cpu(irq_stat, cpu).apic_timer_irqs++;
+#endif
        evt->event_handler(evt);
 }
@@ -569,6 +601,7 @@ void smp_apic_timer_interrupt(struct pt_regs *regs)
        irq_enter();
        local_apic_timer_interrupt();
        irq_exit();
        set_irq_regs(old_regs);
 }
@@ -622,6 +655,13 @@ void clear_local_APIC(void)
                apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);
        }
+        /* lets not touch this if we didn't frob it */
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(X86_MCE_INTEL)
+        if (maxlvt >= 5) {
+                v = apic_read(APIC_LVTTHMR);
+                apic_write(APIC_LVTTHMR, v | APIC_LVT_MASKED);
+        }
+#endif
        /*
         * Clean APIC state for other OSs:
         */
@@ -632,8 +672,14 @@ void clear_local_APIC(void)
                apic_write(APIC_LVTERR, APIC_LVT_MASKED);
        if (maxlvt >= 4)
                apic_write(APIC_LVTPC, APIC_LVT_MASKED);
-        apic_write(APIC_ESR, 0);
-        apic_read(APIC_ESR);
+        /* Integrated APIC (!82489DX) ? */
+        if (lapic_is_integrated()) {
+                if (maxlvt > 3)
+                        /* Clear ESR due to Pentium errata 3AP and 11AP */
+                        apic_write(APIC_ESR, 0);
+                apic_read(APIC_ESR);
+        }
 }
 /**
@@ -652,8 +698,28 @@ void disable_local_APIC(void)
        value = apic_read(APIC_SPIV);
        value &= ~APIC_SPIV_APIC_ENABLED;
        apic_write(APIC_SPIV, value);
+#ifdef CONFIG_X86_32
+        /*
+         * When LAPIC was disabled by the BIOS and enabled by the kernel,
+         * restore the disabled state.
+         */
+        if (enabled_via_apicbase) {
+                unsigned int l, h;
+                rdmsr(MSR_IA32_APICBASE, l, h);
+                l &= ~MSR_IA32_APICBASE_ENABLE;
+                wrmsr(MSR_IA32_APICBASE, l, h);
+        }
+#endif
 }
+/*
+ * If Linux enabled the LAPIC against the BIOS default disable it down before
+ * re-entering the BIOS on shutdown.  Otherwise the BIOS may get confused and
+ * not power-off.  Additionally clear all LVT entries before disable_local_APIC
+ * for the case where Linux didn't enable the LAPIC.
+ */
 void lapic_shutdown(void)
 {
        unsigned long flags;
@@ -663,7 +729,13 @@ void lapic_shutdown(void)
        local_irq_save(flags);
-        disable_local_APIC();
+#ifdef CONFIG_X86_32
+        if (!enabled_via_apicbase)
+                clear_local_APIC();
+        else
+#endif
+                disable_local_APIC();
        local_irq_restore(flags);
 }
@@ -734,8 +806,11 @@ int __init verify_local_APIC(void)
 */
 void __init sync_Arb_IDs(void)
 {
-        /* Unsupported on P4 - see Intel Dev. Manual Vol. 3, Ch. 8.6.1 */
+        /*
-        if (modern_apic())
+         * Unsupported on P4 - see Intel Dev. Manual Vol. 3, Ch. 8.6.1 And not
+         * needed on AMD.
+         */
+        if (modern_apic() || boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
                return;
        /*
@@ -744,8 +819,8 @@ void __init sync_Arb_IDs(void)
        apic_wait_icr_idle();
        apic_printk(APIC_DEBUG, "Synchronizing Arb IDs.\n");
-        apic_write(APIC_ICR, APIC_DEST_ALLINC | APIC_INT_LEVELTRIG
+        apic_write(APIC_ICR, APIC_DEST_ALLINC |
-                                | APIC_DM_INIT);
+                        APIC_INT_LEVELTRIG | APIC_DM_INIT);
 }
 /*
@@ -762,8 +837,6 @@ void __init init_bsp_APIC(void)
        if (smp_found_config || !cpu_has_apic)
                return;
-        value = apic_read(APIC_LVR);
        /*
         * Do not trust the local APIC being empty at bootup.
         */
@@ -775,7 +848,15 @@ void __init init_bsp_APIC(void)
        value = apic_read(APIC_SPIV);
        value &= ~APIC_VECTOR_MASK;
        value |= APIC_SPIV_APIC_ENABLED;
-        value |= APIC_SPIV_FOCUS_DISABLED;
+#ifdef CONFIG_X86_32
+        /* This bit is reserved on P4/Xeon and should be cleared */
+        if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) &&
+            (boot_cpu_data.x86 == 15))
+                value &= ~APIC_SPIV_FOCUS_DISABLED;
+        else
+#endif
+                value |= APIC_SPIV_FOCUS_DISABLED;
        value |= SPURIOUS_APIC_VECTOR;
        apic_write(APIC_SPIV, value);
@@ -784,9 +865,50 @@ void __init init_bsp_APIC(void)
         */
        apic_write(APIC_LVT0, APIC_DM_EXTINT);
        value = APIC_DM_NMI;
+        if (!lapic_is_integrated())             /* 82489DX */
+                value |= APIC_LVT_LEVEL_TRIGGER;
        apic_write(APIC_LVT1, value);
 }
+static void __cpuinit lapic_setup_esr(void)
+{
+        unsigned long oldvalue, value, maxlvt;
+        if (lapic_is_integrated() && !esr_disable) {
+                if (esr_disable) {
+                        /*
+                         * Something untraceable is creating bad interrupts on
+                         * secondary quads ... for the moment, just leave the
+                         * ESR disabled - we can't do anything useful with the
+                         * errors anyway - mbligh
+                         */
+                        printk(KERN_INFO "Leaving ESR disabled.\n");
+                        return;
+                }
+                /* !82489DX */
+                maxlvt = lapic_get_maxlvt();
+                if (maxlvt > 3)         /* Due to the Pentium erratum 3AP. */
+                        apic_write(APIC_ESR, 0);
+                oldvalue = apic_read(APIC_ESR);
+                /* enables sending errors */
+                value = ERROR_APIC_VECTOR;
+                apic_write(APIC_LVTERR, value);
+                /*
+                 * spec says clear errors after enabling vector.
+                 */
+                if (maxlvt > 3)
+                        apic_write(APIC_ESR, 0);
+                value = apic_read(APIC_ESR);
+                if (value != oldvalue)
+                        apic_printk(APIC_VERBOSE, "ESR value before enabling "
+                                "vector: 0x%08lx  after: 0x%08lx\n",
+                                oldvalue, value);
+        } else {
+                printk(KERN_INFO "No ESR for 82489DX.\n");
+        }
+}
 /**
 * setup_local_APIC - setup the local APIC
 */
@@ -892,21 +1014,20 @@ void __cpuinit setup_local_APIC(void)
        preempt_enable();
 }
-static void __cpuinit lapic_setup_esr(void)
-{
-        unsigned maxlvt = lapic_get_maxlvt();
-        apic_write(APIC_LVTERR, ERROR_APIC_VECTOR);
-        /*
-         * spec says clear errors after enabling vector.
-         */
-        if (maxlvt > 3)
-                apic_write(APIC_ESR, 0);
-}
 void __cpuinit end_local_APIC_setup(void)
 {
        lapic_setup_esr();
+#ifdef CONFIG_X86_32
+        {
+                unsigned int value;
+                /* Disable the local apic timer */
+                value = apic_read(APIC_LVTT);
+                value |= (APIC_LVT_MASKED | LOCAL_TIMER_VECTOR);
+                apic_write(APIC_LVTT, value);
+        }
+#endif
        setup_apic_nmi_watchdog(NULL);
        apic_pm_activate();
 }
@@ -1108,6 +1229,8 @@ void __init init_apic_mappings(void)
 * This initializes the IO-APIC and APIC hardware if this is
 * a UP kernel.
 */
+int apic_version[MAX_APICS];
 int __init APIC_init_uniprocessor(void)
 {
        if (disable_apic) {
@@ -1209,17 +1332,57 @@ asmlinkage void smp_error_interrupt(void)
 }
 /**
- *  * connect_bsp_APIC - attach the APIC to the interrupt system
+ * connect_bsp_APIC - attach the APIC to the interrupt system
- *   */
+ */
 void __init connect_bsp_APIC(void)
 {
+#ifdef CONFIG_X86_32
+        if (pic_mode) {
+                /*
+                 * Do not trust the local APIC being empty at bootup.
+                 */
+                clear_local_APIC();
+                /*
+                 * PIC mode, enable APIC mode in the IMCR, i.e.  connect BSP's
+                 * local APIC to INT and NMI lines.
+                 */
+                apic_printk(APIC_VERBOSE, "leaving PIC mode, "
+                                "enabling APIC mode.\n");
+                outb(0x70, 0x22);
+                outb(0x01, 0x23);
+        }
+#endif
        enable_apic_mode();
 }
+/**
+ * disconnect_bsp_APIC - detach the APIC from the interrupt system
+ * @virt_wire_setup:    indicates, whether virtual wire mode is selected
+ *
+ * Virtual wire mode is necessary to deliver legacy interrupts even when the
+ * APIC is disabled.
+ */
 void disconnect_bsp_APIC(int virt_wire_setup)
 {
+        unsigned int value;
+#ifdef CONFIG_X86_32
+        if (pic_mode) {
+                /*
+                 * Put the board back into PIC mode (has an effect only on
+                 * certain older boards).  Note that APIC interrupts, including
+                 * IPIs, won't work beyond this point!  The only exception are
+                 * INIT IPIs.
+                 */
+                apic_printk(APIC_VERBOSE, "disabling APIC mode, "
+                                "entering PIC mode.\n");
+                outb(0x70, 0x22);
+                outb(0x00, 0x23);
+                return;
+        }
+#endif
        /* Go back to Virtual Wire compatibility mode */
-        unsigned long value;
        /* For the spurious interrupt use vector F, and enable it */
        value = apic_read(APIC_SPIV);
@@ -1245,7 +1408,10 @@ void disconnect_bsp_APIC(int virt_wire_setup)
                apic_write(APIC_LVT0, APIC_LVT_MASKED);
        }
-        /* For LVT1 make it edge triggered, active high, nmi and enabled */
+        /*
+         * For LVT1 make it edge triggered, active high,
+         * nmi and enabled
+         */
        value = apic_read(APIC_LVT1);
        value &= ~(APIC_MODE_MASK | APIC_SEND_PENDING |
                        APIC_INPUT_POLARITY | APIC_LVT_REMOTE_IRR |
@@ -1260,9 +1426,20 @@ void __cpuinit generic_processor_info(int apicid, int version)
        int cpu;
        cpumask_t tmp_map;
+        /*
+         * Validate version
+         */
+        if (version == 0x0) {
+                printk(KERN_WARNING "BIOS bug, APIC version is 0 for CPU#%d! "
+                                "fixing up to 0x10. (tell your hw vendor)\n",
+                                version);
+                version = 0x10;
+        }
+        apic_version[apicid] = version;
        if (num_processors >= NR_CPUS) {
                printk(KERN_WARNING "WARNING: NR_CPUS limit of %i reached."
-                       " Processor ignored.\n", NR_CPUS);
+                        "  Processor ignored.\n", NR_CPUS);
                return;
        }
@@ -1282,6 +1459,29 @@ void __cpuinit generic_processor_info(int apicid, int version)
        if (apicid > max_physical_apicid)
                max_physical_apicid = apicid;
+#ifdef CONFIG_X86_32
+        /*
+         * Would be preferable to switch to bigsmp when CONFIG_HOTPLUG_CPU=y
+         * but we need to work other dependencies like SMP_SUSPEND etc
+         * before this can be done without some confusion.
+         * if (CPU_HOTPLUG_ENABLED || num_processors > 8)
+         *       - Ashok Raj <ashok.raj@intel.com>
+         */
+        if (max_physical_apicid >= 8) {
+                switch (boot_cpu_data.x86_vendor) {
+                case X86_VENDOR_INTEL:
+                        if (!APIC_XAPIC(version)) {
+                                def_to_bigsmp = 0;
+                                break;
+                        }
+                        /* If P4 and above fall through */
+                case X86_VENDOR_AMD:
+                        def_to_bigsmp = 1;
+                }
+        }
+#endif
+#if defined(CONFIG_X86_SMP) || defined(CONFIG_X86_64)
        /* are we being called early in kernel startup? */
        if (early_per_cpu_ptr(x86_cpu_to_apicid)) {
                u16 *cpu_to_apicid = early_per_cpu_ptr(x86_cpu_to_apicid);
@@ -1293,6 +1493,7 @@ void __cpuinit generic_processor_info(int apicid, int version)
                per_cpu(x86_cpu_to_apicid, cpu) = apicid;
                per_cpu(x86_bios_cpu_apicid, cpu) = apicid;
        }
+#endif
        cpu_set(cpu, cpu_possible_map);
        cpu_set(cpu, cpu_present_map);
@@ -1309,9 +1510,11 @@ int hard_smp_processor_id(void)
 #ifdef CONFIG_PM
 static struct {
-        /* 'active' is true if the local APIC was enabled by us and
+        /*
-           not the BIOS; this signifies that we are also responsible
+         * 'active' is true if the local APIC was enabled by us and
-           for disabling it before entering apm/acpi suspend */
+         * not the BIOS; this signifies that we are also responsible
+         * for disabling it before entering apm/acpi suspend
+         */
        int active;
        /* r/w apic fields */
        unsigned int apic_id;
@@ -1352,10 +1555,11 @@ static int lapic_suspend(struct sys_device *dev, pm_message_t state)
        apic_pm_state.apic_lvterr = apic_read(APIC_LVTERR);
        apic_pm_state.apic_tmict = apic_read(APIC_TMICT);
        apic_pm_state.apic_tdcr = apic_read(APIC_TDCR);
-#ifdef CONFIG_X86_MCE_INTEL
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(CONFIG_X86_MCE_INTEL)
        if (maxlvt >= 5)
                apic_pm_state.apic_thmr = apic_read(APIC_LVTTHMR);
 #endif
        local_irq_save(flags);
        disable_local_APIC();
        local_irq_restore(flags);
@@ -1374,13 +1578,24 @@ static int lapic_resume(struct sys_device *dev)
        maxlvt = lapic_get_maxlvt();
        local_irq_save(flags);
-        if (!x2apic) {
+#ifdef CONFIG_X86_64
+        if (x2apic)
+                enable_x2apic();
+        else
+#endif
+        {
+                /*
+                 * Make sure the APICBASE points to the right address
+                 *
+                 * FIXME! This will be wrong if we ever support suspend on
+                 * SMP! We'll need to do this as part of the CPU restore!
+                 */
                rdmsr(MSR_IA32_APICBASE, l, h);
                l &= ~MSR_IA32_APICBASE_BASE;
                l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
                wrmsr(MSR_IA32_APICBASE, l, h);
-        } else
+        }
-                enable_x2apic();
        apic_write(APIC_LVTERR, ERROR_APIC_VECTOR | APIC_LVT_MASKED);
        apic_write(APIC_ID, apic_pm_state.apic_id);
@@ -1390,7 +1605,7 @@ static int lapic_resume(struct sys_device *dev)
        apic_write(APIC_SPIV, apic_pm_state.apic_spiv);
        apic_write(APIC_LVT0, apic_pm_state.apic_lvt0);
        apic_write(APIC_LVT1, apic_pm_state.apic_lvt1);
-#ifdef CONFIG_X86_MCE_INTEL
+#if defined(CONFIG_X86_MCE_P4THERMAL) || defined(CONFIG_X86_MCE_INTEL)
        if (maxlvt >= 5)
                apic_write(APIC_LVTTHMR, apic_pm_state.apic_thmr);
 #endif
@@ -1404,10 +1619,17 @@ static int lapic_resume(struct sys_device *dev)
        apic_write(APIC_LVTERR, apic_pm_state.apic_lvterr);
        apic_write(APIC_ESR, 0);
        apic_read(APIC_ESR);
        local_irq_restore(flags);
        return 0;
 }
+/*
+ * This device has no shutdown method - fully functioning local APICs
+ * are needed on every CPU up until machine_halt/restart/poweroff.
+ */
 static struct sysdev_class lapic_sysclass = {
        .name           = "lapic",
        .resume         = lapic_resume,
@@ -1533,28 +1755,7 @@ early_param("nox2apic", setup_nox2apic);
 /*
 * APIC command line parameters
 */
-static int __init apic_set_verbosity(char *str)
+static int __init setup_disableapic(char *arg)
-{
-        if (str == NULL)  {
-                skip_ioapic_setup = 0;
-                ioapic_force = 1;
-                return 0;
-        }
-        if (strcmp("debug", str) == 0)
-                apic_verbosity = APIC_DEBUG;
-        else if (strcmp("verbose", str) == 0)
-                apic_verbosity = APIC_VERBOSE;
-        else {
-                printk(KERN_WARNING "APIC Verbosity level %s not recognised"
-                                " use apic=verbose or apic=debug\n", str);
-                return -EINVAL;
-        }
-        return 0;
-}
-early_param("apic", apic_set_verbosity);
-static __init int setup_disableapic(char *str)
 {
        disable_apic = 1;
        setup_clear_cpu_cap(X86_FEATURE_APIC);
@@ -1563,9 +1764,9 @@ static __init int setup_disableapic(char *str)
 early_param("disableapic", setup_disableapic);
 /* same as disableapic, for compatibility */
-static __init int setup_nolapic(char *str)
+static int __init setup_nolapic(char *arg)
 {
-        return setup_disableapic(str);
+        return setup_disableapic(arg);
 }
 early_param("nolapic", setup_nolapic);
@@ -1576,14 +1777,19 @@ static int __init parse_lapic_timer_c2_ok(char *arg)
 }
 early_param("lapic_timer_c2_ok", parse_lapic_timer_c2_ok);
-static __init int setup_noapictimer(char *str)
+static int __init parse_disable_apic_timer(char *arg)
 {
-        if (str[0] != ' ' && str[0] != 0)
-                return 0;
        disable_apic_timer = 1;
-        return 1;
+        return 0;
+}
+early_param("noapictimer", parse_disable_apic_timer);
+static int __init parse_nolapic_timer(char *arg)
+{
+        disable_apic_timer = 1;
+        return 0;
 }
-__setup("noapictimer", setup_noapictimer);
+early_param("nolapic_timer", parse_nolapic_timer);
 static __init int setup_apicpmtimer(char *s)
 {
@@ -1593,6 +1799,31 @@ static __init int setup_apicpmtimer(char *s)
 }
 __setup("apicpmtimer", setup_apicpmtimer);
+static int __init apic_set_verbosity(char *arg)
+{
+        if (!arg)  {
+#ifdef CONFIG_X86_64
+                skip_ioapic_setup = 0;
+                ioapic_force = 1;
+                return 0;
+#endif
+                return -EINVAL;
+        }
+        if (strcmp("debug", arg) == 0)
+                apic_verbosity = APIC_DEBUG;
+        else if (strcmp("verbose", arg) == 0)
+                apic_verbosity = APIC_VERBOSE;
+        else {
+                printk(KERN_WARNING "APIC Verbosity level %s not recognised"
+                        " use apic=verbose or apic=debug\n", arg);
+                return -EINVAL;
+        }
+        return 0;
+}
+early_param("apic", apic_set_verbosity);
 static int __init lapic_insert_resource(void)
 {
        if (!apic_phys)
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 9ee24e6bc4b0..5145a6e72bbb 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -228,12 +228,12 @@
 #include <linux/suspend.h>
 #include <linux/kthread.h>
 #include <linux/jiffies.h>
-#include <linux/smp_lock.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/desc.h>
 #include <asm/i8253.h>
+#include <asm/olpc.h>
 #include <asm/paravirt.h>
 #include <asm/reboot.h>
@@ -2217,7 +2217,7 @@ static int __init apm_init(void)
        dmi_check_system(apm_dmi_table);
-        if (apm_info.bios.version == 0 || paravirt_enabled()) {
+        if (apm_info.bios.version == 0 || paravirt_enabled() || machine_is_olpc()) {
                printk(KERN_INFO "apm: BIOS not found.\n");
                return -ENODEV;
        }
diff --git a/arch/x86/kernel/bios_uv.c b/arch/x86/kernel/bios_uv.c
index c639bd55391c..fdd585f9c53d 100644
--- a/arch/x86/kernel/bios_uv.c
+++ b/arch/x86/kernel/bios_uv.c
@@ -25,11 +25,11 @@ x86_bios_strerror(long status)
 {
        const char *str;
        switch (status) {
-        case  0: str = "Call completed without error"; break;
+        case  0: str = "Call completed without error";  break;
-        case -1: str = "Not implemented"; break;
+        case -1: str = "Not implemented";               break;
-        case -2: str = "Invalid argument"; break;
+        case -2: str = "Invalid argument";              break;
-        case -3: str = "Call completed with error"; break;
+        case -3: str = "Call completed with error";     break;
-        default: str = "Unknown BIOS status code"; break;
+        default: str = "Unknown BIOS status code";      break;
        }
        return str;
 }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 84c4040efa80..7581b62df184 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -572,35 +572,15 @@ void __init early_cpu_init(void)
 /*
 * The NOPL instruction is supposed to exist on all CPUs with
- * family >= 6, unfortunately, that's not true in practice because
+ * family >= 6; unfortunately, that's not true in practice because
 * of early VIA chips and (more importantly) broken virtualizers that
- * are not easy to detect.  Hence, probe for it based on first
+ * are not easy to detect.  In the latter case it doesn't even *fail*
- * principles.
+ * reliably, so probing for it doesn't even work.  Disable it completely
- *
+ * unless we can find a reliable way to detect all the broken cases.
- * Note: no 64-bit chip is known to lack these, but put the code here
- * for consistency with 32 bits, and to make it utterly trivial to
- * diagnose the problem should it ever surface.
 */
 static void __cpuinit detect_nopl(struct cpuinfo_x86 *c)
 {
-        const u32 nopl_signature = 0x888c53b1; /* Random number */
-        u32 has_nopl = nopl_signature;
        clear_cpu_cap(c, X86_FEATURE_NOPL);
-        if (c->x86 >= 6) {
-                asm volatile("\n"
-                             "1:      .byte 0x0f,0x1f,0xc0\n" /* nopl %eax */
-                             "2:\n"
-                             "        .section .fixup,\"ax\"\n"
-                             "3:      xor %0,%0\n"
-                             "        jmp 2b\n"
-                             "        .previous\n"
-                             _ASM_EXTABLE(1b,3b)
-                             : "+a" (has_nopl));
-                if (has_nopl == nopl_signature)
-                        set_cpu_cap(c, X86_FEATURE_NOPL);
-        }
 }
 static void __cpuinit generic_identify(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index f1685fb91fbd..b8e05ee4f736 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -171,7 +171,7 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
        }
        if (c->x86 != 0xF) {
-                printk(KERN_WARNING PFX "Unknown p4-clockmod-capable CPU. Please send an e-mail to <cpufreq@lists.linux.org.uk>\n");
+                printk(KERN_WARNING PFX "Unknown p4-clockmod-capable CPU. Please send an e-mail to <cpufreq@vger.kernel.org>\n");
                return 0;
        }
diff --git a/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c b/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
index 15e13c01cc36..3b5f06423e77 100644
--- a/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
+++ b/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
@@ -26,7 +26,7 @@
 #include <asm/cpufeature.h>
 #define PFX             "speedstep-centrino: "
-#define MAINTAINER      "cpufreq@lists.linux.org.uk"
+#define MAINTAINER      "cpufreq@vger.kernel.org"
 #define dprintk(msg...) \
        cpufreq_debug_printk(CPUFREQ_DEBUG_DRIVER, "speedstep-centrino", msg)
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index cb7d3b6a80eb..4e8d77f01eeb 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -401,12 +401,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
                tmp |= ~((1<<(hi - 1)) - 1);
                if (tmp != mask_lo) {
-                        static int once = 1;
+                        WARN_ONCE(1, KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
-                        if (once) {
-                                printk(KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
-                                once = 0;
-                        }
                        mask_lo = tmp;
                }
        }
diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
index 84c480bb3715..4c4214690dd1 100644
--- a/arch/x86/kernel/cpu/mtrr/if.c
+++ b/arch/x86/kernel/cpu/mtrr/if.c
@@ -405,9 +405,9 @@ static int mtrr_seq_show(struct seq_file *seq, void *offset)
                        }
                        /* RED-PEN: base can be > 32bit */ 
                        len += seq_printf(seq, 
-                                   "reg%02i: base=0x%05lx000 (%4luMB), size=%4lu%cB: %s, count=%d\n",
+                                   "reg%02i: base=0x%06lx000 (%5luMB), size=%5lu%cB, count=%d: %s\n",
                             i, base, base >> (20 - PAGE_SHIFT), size, factor,
-                             mtrr_attrib_to_str(type), mtrr_usage_table[i]);
+                             mtrr_usage_table[i], mtrr_attrib_to_str(type));
                }
        }
        return 0;
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 58ac5d3d4361..c78c04821ea1 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -759,7 +759,8 @@ x86_get_mtrr_mem_range(struct res_range *range, int nr_range,
        /* take out UC ranges */
        for (i = 0; i < num_var_ranges; i++) {
                type = range_state[i].type;
-                if (type != MTRR_TYPE_UNCACHABLE)
+                if (type != MTRR_TYPE_UNCACHABLE &&
+                    type != MTRR_TYPE_WRPROT)
                        continue;
                size = range_state[i].size_pfn;
                if (!size)
@@ -834,7 +835,14 @@ static int __init enable_mtrr_cleanup_setup(char *str)
                enable_mtrr_cleanup = 1;
        return 0;
 }
-early_param("enble_mtrr_cleanup", enable_mtrr_cleanup_setup);
+early_param("enable_mtrr_cleanup", enable_mtrr_cleanup_setup);
+static int __init mtrr_cleanup_debug_setup(char *str)
+{
+        debug_print = 1;
+        return 0;
+}
+early_param("mtrr_cleanup_debug", mtrr_cleanup_debug_setup);
 struct var_mtrr_state {
        unsigned long   range_startk;
@@ -898,6 +906,27 @@ set_var_mtrr_all(unsigned int address_bits)
        }
 }
+static unsigned long to_size_factor(unsigned long sizek, char *factorp)
+{
+        char factor;
+        unsigned long base = sizek;
+        if (base & ((1<<10) - 1)) {
+                /* not MB alignment */
+                factor = 'K';
+        } else if (base & ((1<<20) - 1)){
+                factor = 'M';
+                base >>= 10;
+        } else {
+                factor = 'G';
+                base >>= 20;
+        }
+        *factorp = factor;
+        return base;
+}
 static unsigned int __init
 range_to_mtrr(unsigned int reg, unsigned long range_startk,
              unsigned long range_sizek, unsigned char type)
@@ -919,13 +948,21 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
                        align = max_align;
                sizek = 1 << align;
-                if (debug_print)
+                if (debug_print) {
+                        char start_factor = 'K', size_factor = 'K';
+                        unsigned long start_base, size_base;
+                        start_base = to_size_factor(range_startk, &start_factor),
+                        size_base = to_size_factor(sizek, &size_factor),
                        printk(KERN_DEBUG "Setting variable MTRR %d, "
-                                "base: %ldMB, range: %ldMB, type %s\n",
+                                "base: %ld%cB, range: %ld%cB, type %s\n",
-                                reg, range_startk >> 10, sizek >> 10,
+                                reg, start_base, start_factor,
+                                size_base, size_factor,
                                (type == MTRR_TYPE_UNCACHABLE)?"UC":
                                    ((type == MTRR_TYPE_WRBACK)?"WB":"Other")
                                );
+                }
                save_var_mtrr(reg++, range_startk, sizek, type);
                range_startk += sizek;
                range_sizek -= sizek;
@@ -970,6 +1007,8 @@ range_to_mtrr_with_hole(struct var_mtrr_state *state, unsigned long basek,
        /* try to append some small hole */
        range0_basek = state->range_startk;
        range0_sizek = ALIGN(state->range_sizek, chunk_sizek);
+        /* no increase */
        if (range0_sizek == state->range_sizek) {
                if (debug_print)
                        printk(KERN_DEBUG "rangeX: %016lx - %016lx\n",
@@ -980,13 +1019,40 @@ range_to_mtrr_with_hole(struct var_mtrr_state *state, unsigned long basek,
                return 0;
        }
-        range0_sizek -= chunk_sizek;
+        /* only cut back, when it is not the last */
-        if (range0_sizek && sizek) {
+        if (sizek) {
-            while (range0_basek + range0_sizek > (basek + sizek)) {
+                while (range0_basek + range0_sizek > (basek + sizek)) {
-                range0_sizek -= chunk_sizek;
+                        if (range0_sizek >= chunk_sizek)
-                if (!range0_sizek)
+                                range0_sizek -= chunk_sizek;
-                        break;
+                        else
-            }
+                                range0_sizek = 0;
+                        if (!range0_sizek)
+                                break;
+                }
+        }
+second_try:
+        range_basek = range0_basek + range0_sizek;
+        /* one hole in the middle */
+        if (range_basek > basek && range_basek <= (basek + sizek))
+                second_sizek = range_basek - basek;
+        if (range0_sizek > state->range_sizek) {
+                /* one hole in middle or at end */
+                hole_sizek = range0_sizek - state->range_sizek - second_sizek;
+                /* hole size should be less than half of range0 size */
+                if (hole_sizek >= (range0_sizek >> 1) &&
+                    range0_sizek >= chunk_sizek) {
+                        range0_sizek -= chunk_sizek;
+                        second_sizek = 0;
+                        hole_sizek = 0;
+                        goto second_try;
+                }
        }
        if (range0_sizek) {
@@ -996,50 +1062,28 @@ range_to_mtrr_with_hole(struct var_mtrr_state *state, unsigned long basek,
                                (range0_basek + range0_sizek)<<10);
                state->reg = range_to_mtrr(state->reg, range0_basek,
                                range0_sizek, MTRR_TYPE_WRBACK);
-        }
-        range_basek = range0_basek + range0_sizek;
-        range_sizek = chunk_sizek;
-        if (range_basek + range_sizek > basek &&
-            range_basek + range_sizek <= (basek + sizek)) {
-                /* one hole */
-                second_basek = basek;
-                second_sizek = range_basek + range_sizek - basek;
        }
-        /* if last piece, only could one hole near end */
+        if (range0_sizek < state->range_sizek) {
-        if ((second_basek || !basek) &&
+                /* need to handle left over */
-            range_sizek - (state->range_sizek - range0_sizek) - second_sizek <
-            (chunk_sizek >> 1)) {
-                /*
-                 * one hole in middle (second_sizek is 0) or at end
-                 * (second_sizek is 0 )
-                 */
-                hole_sizek = range_sizek - (state->range_sizek - range0_sizek)
-                                 - second_sizek;
-                hole_basek = range_basek + range_sizek - hole_sizek
-                                 - second_sizek;
-        } else {
-                /* fallback for big hole, or several holes */
                range_sizek = state->range_sizek - range0_sizek;
-                second_basek = 0;
-                second_sizek = 0;
+                if (debug_print)
+                        printk(KERN_DEBUG "range: %016lx - %016lx\n",
+                                 range_basek<<10,
+                                 (range_basek + range_sizek)<<10);
+                state->reg = range_to_mtrr(state->reg, range_basek,
+                                 range_sizek, MTRR_TYPE_WRBACK);
        }
-        if (debug_print)
-                printk(KERN_DEBUG "range: %016lx - %016lx\n", range_basek<<10,
-                         (range_basek + range_sizek)<<10);
-        state->reg = range_to_mtrr(state->reg, range_basek, range_sizek,
-                                         MTRR_TYPE_WRBACK);
        if (hole_sizek) {
+                hole_basek = range_basek - hole_sizek - second_sizek;
                if (debug_print)
                        printk(KERN_DEBUG "hole: %016lx - %016lx\n",
-                                 hole_basek<<10, (hole_basek + hole_sizek)<<10);
+                                 hole_basek<<10,
-                state->reg = range_to_mtrr(state->reg, hole_basek, hole_sizek,
+                                 (hole_basek + hole_sizek)<<10);
-                                                 MTRR_TYPE_UNCACHABLE);
+                state->reg = range_to_mtrr(state->reg, hole_basek,
+                                 hole_sizek, MTRR_TYPE_UNCACHABLE);
        }
        return second_sizek;
@@ -1154,11 +1198,11 @@ struct mtrr_cleanup_result {
 };
 /*
- * gran_size: 1M, 2M, ..., 2G
+ * gran_size: 64K, 128K, 256K, 512K, 1M, 2M, ..., 2G
- * chunk size: gran_size, ..., 4G
+ * chunk size: gran_size, ..., 2G
- * so we need (2+13)*6
+ * so we need (1+16)*8
 */
-#define NUM_RESULT      90
+#define NUM_RESULT      136
 #define PSHIFT          (PAGE_SHIFT - 10)
 static struct mtrr_cleanup_result __initdata result[NUM_RESULT];
@@ -1168,13 +1212,14 @@ static unsigned long __initdata min_loss_pfn[RANGE_NUM];
 static int __init mtrr_cleanup(unsigned address_bits)
 {
        unsigned long extra_remove_base, extra_remove_size;
-        unsigned long i, base, size, def, dummy;
+        unsigned long base, size, def, dummy;
        mtrr_type type;
        int nr_range, nr_range_new;
        u64 chunk_size, gran_size;
        unsigned long range_sums, range_sums_new;
        int index_good;
        int num_reg_good;
+        int i;
        /* extra one for all 0 */
        int num[MTRR_NUM_TYPES + 1];
@@ -1204,6 +1249,8 @@ static int __init mtrr_cleanup(unsigned address_bits)
                        continue;
                if (!size)
                        type = MTRR_NUM_TYPES;
+                if (type == MTRR_TYPE_WRPROT)
+                        type = MTRR_TYPE_UNCACHABLE;
                num[type]++;
        }
@@ -1216,23 +1263,57 @@ static int __init mtrr_cleanup(unsigned address_bits)
                num_var_ranges - num[MTRR_NUM_TYPES])
                return 0;
+        /* print original var MTRRs at first, for debugging: */
+        printk(KERN_DEBUG "original variable MTRRs\n");
+        for (i = 0; i < num_var_ranges; i++) {
+                char start_factor = 'K', size_factor = 'K';
+                unsigned long start_base, size_base;
+                size_base = range_state[i].size_pfn << (PAGE_SHIFT - 10);
+                if (!size_base)
+                        continue;
+                size_base = to_size_factor(size_base, &size_factor),
+                start_base = range_state[i].base_pfn << (PAGE_SHIFT - 10);
+                start_base = to_size_factor(start_base, &start_factor),
+                type = range_state[i].type;
+                printk(KERN_DEBUG "reg %d, base: %ld%cB, range: %ld%cB, type %s\n",
+                        i, start_base, start_factor,
+                        size_base, size_factor,
+                        (type == MTRR_TYPE_UNCACHABLE) ? "UC" :
+                            ((type == MTRR_TYPE_WRPROT) ? "WP" :
+                             ((type == MTRR_TYPE_WRBACK) ? "WB" : "Other"))
+                        );
+        }
        memset(range, 0, sizeof(range));
        extra_remove_size = 0;
-        if (mtrr_tom2) {
+        extra_remove_base = 1 << (32 - PAGE_SHIFT);
-                extra_remove_base = 1 << (32 - PAGE_SHIFT);
+        if (mtrr_tom2)
                extra_remove_size =
                        (mtrr_tom2 >> PAGE_SHIFT) - extra_remove_base;
-        }
        nr_range = x86_get_mtrr_mem_range(range, 0, extra_remove_base,
                                          extra_remove_size);
+        /*
+         * [0, 1M) should always be coverred by var mtrr with WB
+         * and fixed mtrrs should take effective before var mtrr for it
+         */
+        nr_range = add_range_with_merge(range, nr_range, 0,
+                                        (1ULL<<(20 - PAGE_SHIFT)) - 1);
+        /* sort the ranges */
+        sort(range, nr_range, sizeof(struct res_range), cmp_range, NULL);
        range_sums = sum_ranges(range, nr_range);
        printk(KERN_INFO "total RAM coverred: %ldM\n",
               range_sums >> (20 - PAGE_SHIFT));
        if (mtrr_chunk_size && mtrr_gran_size) {
                int num_reg;
+                char gran_factor, chunk_factor, lose_factor;
+                unsigned long gran_base, chunk_base, lose_base;
-                debug_print = 1;
+                debug_print++;
                /* convert ranges to var ranges state */
                num_reg = x86_setup_var_mtrrs(range, nr_range, mtrr_chunk_size,
                                              mtrr_gran_size);
@@ -1256,34 +1337,48 @@ static int __init mtrr_cleanup(unsigned address_bits)
                        result[i].lose_cover_sizek =
                                (range_sums - range_sums_new) << PSHIFT;
-                printk(KERN_INFO "%sgran_size: %ldM \tchunk_size: %ldM \t",
+                gran_base = to_size_factor(result[i].gran_sizek, &gran_factor),
-                         result[i].bad?"*BAD*":" ", result[i].gran_sizek >> 10,
+                chunk_base = to_size_factor(result[i].chunk_sizek, &chunk_factor),
-                         result[i].chunk_sizek >> 10);
+                lose_base = to_size_factor(result[i].lose_cover_sizek, &lose_factor),
-                printk(KERN_CONT "num_reg: %d  \tlose cover RAM: %s%ldM \n",
+                printk(KERN_INFO "%sgran_size: %ld%c \tchunk_size: %ld%c \t",
+                         result[i].bad?"*BAD*":" ",
+                         gran_base, gran_factor, chunk_base, chunk_factor);
+                printk(KERN_CONT "num_reg: %d  \tlose cover RAM: %s%ld%c\n",
                         result[i].num_reg, result[i].bad?"-":"",
-                         result[i].lose_cover_sizek >> 10);
+                         lose_base, lose_factor);
                if (!result[i].bad) {
                        set_var_mtrr_all(address_bits);
                        return 1;
                }
                printk(KERN_INFO "invalid mtrr_gran_size or mtrr_chunk_size, "
                       "will find optimal one\n");
-                debug_print = 0;
+                debug_print--;
                memset(result, 0, sizeof(result[0]));
        }
        i = 0;
        memset(min_loss_pfn, 0xff, sizeof(min_loss_pfn));
        memset(result, 0, sizeof(result));
-        for (gran_size = (1ULL<<20); gran_size < (1ULL<<32); gran_size <<= 1) {
+        for (gran_size = (1ULL<<16); gran_size < (1ULL<<32); gran_size <<= 1) {
-                for (chunk_size = gran_size; chunk_size < (1ULL<<33);
+                char gran_factor;
+                unsigned long gran_base;
+                if (debug_print)
+                        gran_base = to_size_factor(gran_size >> 10, &gran_factor);
+                for (chunk_size = gran_size; chunk_size < (1ULL<<32);
                     chunk_size <<= 1) {
                        int num_reg;
-                        if (debug_print)
+                        if (debug_print) {
-                                printk(KERN_INFO
+                                char chunk_factor;
-                               "\ngran_size: %lldM   chunk_size_size: %lldM\n",
+                                unsigned long chunk_base;
-                                       gran_size >> 20, chunk_size >> 20);
+                                chunk_base = to_size_factor(chunk_size>>10, &chunk_factor),
+                                printk(KERN_INFO "\n");
+                                printk(KERN_INFO "gran_size: %ld%c   chunk_size: %ld%c \n",
+                                       gran_base, gran_factor, chunk_base, chunk_factor);
+                        }
                        if (i >= NUM_RESULT)
                                continue;
@@ -1326,12 +1421,18 @@ static int __init mtrr_cleanup(unsigned address_bits)
        /* print out all */
        for (i = 0; i < NUM_RESULT; i++) {
-                printk(KERN_INFO "%sgran_size: %ldM \tchunk_size: %ldM \t",
+                char gran_factor, chunk_factor, lose_factor;
-                       result[i].bad?"*BAD* ":" ", result[i].gran_sizek >> 10,
+                unsigned long gran_base, chunk_base, lose_base;
-                       result[i].chunk_sizek >> 10);
-                printk(KERN_CONT "num_reg: %d \tlose RAM: %s%ldM\n",
+                gran_base = to_size_factor(result[i].gran_sizek, &gran_factor),
-                       result[i].num_reg, result[i].bad?"-":"",
+                chunk_base = to_size_factor(result[i].chunk_sizek, &chunk_factor),
-                       result[i].lose_cover_sizek >> 10);
+                lose_base = to_size_factor(result[i].lose_cover_sizek, &lose_factor),
+                printk(KERN_INFO "%sgran_size: %ld%c \tchunk_size: %ld%c \t",
+                         result[i].bad?"*BAD*":" ",
+                         gran_base, gran_factor, chunk_base, chunk_factor);
+                printk(KERN_CONT "num_reg: %d  \tlose cover RAM: %s%ld%c\n",
+                         result[i].num_reg, result[i].bad?"-":"",
+                         lose_base, lose_factor);
        }
        /* try to find the optimal index */
@@ -1339,10 +1440,8 @@ static int __init mtrr_cleanup(unsigned address_bits)
                nr_mtrr_spare_reg = num_var_ranges - 1;
        num_reg_good = -1;
        for (i = num_var_ranges - nr_mtrr_spare_reg; i > 0; i--) {
-                if (!min_loss_pfn[i]) {
+                if (!min_loss_pfn[i])
                        num_reg_good = i;
-                        break;
-                }
        }
        index_good = -1;
@@ -1358,21 +1457,26 @@ static int __init mtrr_cleanup(unsigned address_bits)
        }
        if (index_good != -1) {
+                char gran_factor, chunk_factor, lose_factor;
+                unsigned long gran_base, chunk_base, lose_base;
                printk(KERN_INFO "Found optimal setting for mtrr clean up\n");
                i = index_good;
-                printk(KERN_INFO "gran_size: %ldM \tchunk_size: %ldM \t",
+                gran_base = to_size_factor(result[i].gran_sizek, &gran_factor),
-                                result[i].gran_sizek >> 10,
+                chunk_base = to_size_factor(result[i].chunk_sizek, &chunk_factor),
-                                result[i].chunk_sizek >> 10);
+                lose_base = to_size_factor(result[i].lose_cover_sizek, &lose_factor),
-                printk(KERN_CONT "num_reg: %d \tlose RAM: %ldM\n",
+                printk(KERN_INFO "gran_size: %ld%c \tchunk_size: %ld%c \t",
-                                result[i].num_reg,
+                         gran_base, gran_factor, chunk_base, chunk_factor);
-                                result[i].lose_cover_sizek >> 10);
+                printk(KERN_CONT "num_reg: %d  \tlose RAM: %ld%c\n",
+                         result[i].num_reg, lose_base, lose_factor);
                /* convert ranges to var ranges state */
                chunk_size = result[i].chunk_sizek;
                chunk_size <<= 10;
                gran_size = result[i].gran_sizek;
                gran_size <<= 10;
-                debug_print = 1;
+                debug_print++;
                x86_setup_var_mtrrs(range, nr_range, chunk_size, gran_size);
+                debug_print--;
                set_var_mtrr_all(address_bits);
                return 1;
        }
diff --git a/arch/x86/kernel/cpu/perfctr-watchdog.c b/arch/x86/kernel/cpu/perfctr-watchdog.c
index 05cc22dbd4ff..6bff382094f5 100644
--- a/arch/x86/kernel/cpu/perfctr-watchdog.c
+++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
@@ -295,13 +295,19 @@ static int setup_k7_watchdog(unsigned nmi_hz)
        /* setup the timer */
        wrmsr(evntsel_msr, evntsel, 0);
        write_watchdog_counter(perfctr_msr, "K7_PERFCTR0",nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        evntsel |= K7_EVNTSEL_ENABLE;
-        wrmsr(evntsel_msr, evntsel, 0);
+        /* initialize the wd struct before enabling */
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = 0;  /* unused */
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        evntsel |= K7_EVNTSEL_ENABLE;
+        wrmsr(evntsel_msr, evntsel, 0);
        return 1;
 }
@@ -379,13 +385,19 @@ static int setup_p6_watchdog(unsigned nmi_hz)
        wrmsr(evntsel_msr, evntsel, 0);
        nmi_hz = adjust_for_32bit_ctr(nmi_hz);
        write_watchdog_counter32(perfctr_msr, "P6_PERFCTR0",nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        evntsel |= P6_EVNTSEL0_ENABLE;
-        wrmsr(evntsel_msr, evntsel, 0);
+        /* initialize the wd struct before enabling */
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = 0;  /* unused */
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        evntsel |= P6_EVNTSEL0_ENABLE;
+        wrmsr(evntsel_msr, evntsel, 0);
        return 1;
 }
@@ -432,6 +444,27 @@ static const struct wd_ops p6_wd_ops = {
 #define P4_CCCR_ENABLE          (1 << 12)
 #define P4_CCCR_OVF             (1 << 31)
+#define P4_CONTROLS 18
+static unsigned int p4_controls[18] = {
+        MSR_P4_BPU_CCCR0,
+        MSR_P4_BPU_CCCR1,
+        MSR_P4_BPU_CCCR2,
+        MSR_P4_BPU_CCCR3,
+        MSR_P4_MS_CCCR0,
+        MSR_P4_MS_CCCR1,
+        MSR_P4_MS_CCCR2,
+        MSR_P4_MS_CCCR3,
+        MSR_P4_FLAME_CCCR0,
+        MSR_P4_FLAME_CCCR1,
+        MSR_P4_FLAME_CCCR2,
+        MSR_P4_FLAME_CCCR3,
+        MSR_P4_IQ_CCCR0,
+        MSR_P4_IQ_CCCR1,
+        MSR_P4_IQ_CCCR2,
+        MSR_P4_IQ_CCCR3,
+        MSR_P4_IQ_CCCR4,
+        MSR_P4_IQ_CCCR5,
+};
 /*
 * Set up IQ_COUNTER0 to behave like a clock, by having IQ_CCCR0 filter
 * CRU_ESCR0 (with any non-null event selector) through a complemented
@@ -473,6 +506,26 @@ static int setup_p4_watchdog(unsigned nmi_hz)
                evntsel_msr = MSR_P4_CRU_ESCR0;
                cccr_msr = MSR_P4_IQ_CCCR0;
                cccr_val = P4_CCCR_OVF_PMI0 | P4_CCCR_ESCR_SELECT(4);
+                /*
+                 * If we're on the kdump kernel or other situation, we may
+                 * still have other performance counter registers set to
+                 * interrupt and they'll keep interrupting forever because
+                 * of the P4_CCCR_OVF quirk. So we need to ACK all the
+                 * pending interrupts and disable all the registers here,
+                 * before reenabling the NMI delivery. Refer to p4_rearm()
+                 * about the P4_CCCR_OVF quirk.
+                 */
+                if (reset_devices) {
+                        unsigned int low, high;
+                        int i;
+                        for (i = 0; i < P4_CONTROLS; i++) {
+                                rdmsr(p4_controls[i], low, high);
+                                low &= ~(P4_CCCR_ENABLE | P4_CCCR_OVF);
+                                wrmsr(p4_controls[i], low, high);
+                        }
+                }
        } else {
                /* logical cpu 1 */
                perfctr_msr = MSR_P4_IQ_PERFCTR1;
@@ -499,12 +552,17 @@ static int setup_p4_watchdog(unsigned nmi_hz)
        wrmsr(evntsel_msr, evntsel, 0);
        wrmsr(cccr_msr, cccr_val, 0);
        write_watchdog_counter(perfctr_msr, "P4_IQ_COUNTER0", nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        cccr_val |= P4_CCCR_ENABLE;
-        wrmsr(cccr_msr, cccr_val, 0);
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = cccr_msr;
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        cccr_val |= P4_CCCR_ENABLE;
+        wrmsr(cccr_msr, cccr_val, 0);
        return 1;
 }
@@ -620,13 +678,17 @@ static int setup_intel_arch_watchdog(unsigned nmi_hz)
        wrmsr(evntsel_msr, evntsel, 0);
        nmi_hz = adjust_for_32bit_ctr(nmi_hz);
        write_watchdog_counter32(perfctr_msr, "INTEL_ARCH_PERFCTR0", nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        evntsel |= ARCH_PERFMON_EVENTSEL0_ENABLE;
-        wrmsr(evntsel_msr, evntsel, 0);
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = 0;  /* unused */
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        evntsel |= ARCH_PERFMON_EVENTSEL0_ENABLE;
+        wrmsr(evntsel_msr, evntsel, 0);
        intel_arch_wd_ops.checkbit = 1ULL << (eax.split.bit_width - 1);
        return 1;
 }
diff --git a/arch/x86/kernel/cpuid.c b/arch/x86/kernel/cpuid.c
index 8e9cd6a8ec12..6a44d6465991 100644
--- a/arch/x86/kernel/cpuid.c
+++ b/arch/x86/kernel/cpuid.c
@@ -36,7 +36,6 @@
 #include <linux/smp_lock.h>
 #include <linux/major.h>
 #include <linux/fs.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 #include <linux/cpu.h>
 #include <linux/notifier.h>
diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
index 15e6c6bc4a46..e90a60ef10c2 100644
--- a/arch/x86/kernel/crash_dump_64.c
+++ b/arch/x86/kernel/crash_dump_64.c
@@ -7,9 +7,8 @@
 #include <linux/errno.h>
 #include <linux/crash_dump.h>
+#include <linux/uaccess.h>
-#include <asm/uaccess.h>
+#include <linux/io.h>
-#include <asm/io.h>
 /**
 * copy_oldmem_page - copy one page from "oldmem"
@@ -25,7 +24,7 @@
 * in the current kernel. We stitch up a pte, similar to kmap_atomic.
 */
 ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
-                               size_t csize, unsigned long offset, int userbuf)
+                size_t csize, unsigned long offset, int userbuf)
 {
        void  *vaddr;
@@ -33,14 +32,16 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
                return 0;
        vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
+        if (!vaddr)
+                return -ENOMEM;
        if (userbuf) {
-                if (copy_to_user(buf, (vaddr + offset), csize)) {
+                if (copy_to_user(buf, vaddr + offset, csize)) {
                        iounmap(vaddr);
                        return -EFAULT;
                }
        } else
-        memcpy(buf, (vaddr + offset), csize);
+                memcpy(buf, vaddr + offset, csize);
        iounmap(vaddr);
        return csize;
diff --git a/arch/x86/kernel/ds.c b/arch/x86/kernel/ds.c
index ab21c270bfa4..2b69994fd3a8 100644
--- a/arch/x86/kernel/ds.c
+++ b/arch/x86/kernel/ds.c
@@ -479,12 +479,12 @@ static int ds_release(struct task_struct *task, enum ds_qualifier qual)
                goto out;
        kfree(context->buffer[qual]);
-        context->buffer[qual] = 0;
+        context->buffer[qual] = NULL;
        current->mm->total_vm  -= context->pages[qual];
        current->mm->locked_vm -= context->pages[qual];
        context->pages[qual] = 0;
-        context->owner[qual] = 0;
+        context->owner[qual] = NULL;
        /*
         * we put the context twice:
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index 4353cf5e6fac..24bb5faf5efa 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -95,6 +95,20 @@ static void __init nvidia_bugs(int num, int slot, int func)
 }
+#ifdef CONFIG_DMAR
+static void __init intel_g33_dmar(int num, int slot, int func)
+{
+        struct acpi_table_header *dmar_tbl;
+        acpi_status status;
+        status = acpi_get_table(ACPI_SIG_DMAR, 0, &dmar_tbl);
+        if (ACPI_SUCCESS(status)) {
+                printk(KERN_INFO "BIOS BUG: DMAR advertised on Intel G31/G33 chipset -- ignoring\n");
+                dmar_disabled = 1;
+        }
+}
+#endif
 #define QFLAG_APPLY_ONCE        0x1
 #define QFLAG_APPLIED           0x2
 #define QFLAG_DONE              (QFLAG_APPLY_ONCE|QFLAG_APPLIED)
@@ -114,6 +128,10 @@ static struct chipset early_qrk[] __initdata = {
          PCI_CLASS_BRIDGE_PCI, PCI_ANY_ID, QFLAG_APPLY_ONCE, via_bugs },
        { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB,
          PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, fix_hypertransport_config },
+#ifdef CONFIG_DMAR
+        { PCI_VENDOR_ID_INTEL, 0x29c0,
+          PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, intel_g33_dmar },
+#endif
        {}
 };
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 06cc8d4254b1..945a31cdd81f 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -414,9 +414,11 @@ void __init efi_init(void)
        if (memmap.map == NULL)
                printk(KERN_ERR "Could not map the EFI memory map!\n");
        memmap.map_end = memmap.map + (memmap.nr_map * memmap.desc_size);
        if (memmap.desc_size != sizeof(efi_memory_desc_t))
-                printk(KERN_WARNING "Kernel-defined memdesc"
+                printk(KERN_WARNING
-                       "doesn't match the one from EFI!\n");
+                  "Kernel-defined memdesc doesn't match the one from EFI!\n");
        if (add_efi_memmap)
                do_add_efi_memmap();
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 9bfc4d72fb2e..d16084f90649 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -108,12 +108,11 @@ void __init x86_64_start_kernel(char * real_mode_data)
        }
        load_idt((const struct desc_ptr *)&idt_descr);
-        early_printk("Kernel alive\n");
+        if (console_loglevel == 10)
+                early_printk("Kernel alive\n");
        x86_64_init_pda();
-        early_printk("Kernel really alive\n");
        x86_64_start_reservations(real_mode_data);
 }
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index a7010c3a377a..e835b4eea70b 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -172,10 +172,6 @@ num_subarch_entries = (. - subarch_entries) / 4
 *
 * Note that the stack is not yet set up!
 */
-#define PTE_ATTR        0x007           /* PRESENT+RW+USER */
-#define PDE_ATTR        0x067           /* PRESENT+RW+USER+DIRTY+ACCESSED */
-#define PGD_ATTR        0x001           /* PRESENT (no other attributes) */
 default_entry:
 #ifdef CONFIG_X86_PAE
@@ -196,9 +192,9 @@ default_entry:
        movl $pa(pg0), %edi
        movl %edi, pa(init_pg_tables_start)
        movl $pa(swapper_pg_pmd), %edx
-        movl $PTE_ATTR, %eax
+        movl $PTE_IDENT_ATTR, %eax
 10:
-        leal PDE_ATTR(%edi),%ecx                /* Create PMD entry */
+        leal PDE_IDENT_ATTR(%edi),%ecx          /* Create PMD entry */
        movl %ecx,(%edx)                        /* Store PMD entry */
                                                /* Upper half already zero */
        addl $8,%edx
@@ -215,7 +211,7 @@ default_entry:
         * End condition: we must map up to and including INIT_MAP_BEYOND_END
         * bytes beyond the end of our own page tables.
         */
-        leal (INIT_MAP_BEYOND_END+PTE_ATTR)(%edi),%ebp
+        leal (INIT_MAP_BEYOND_END+PTE_IDENT_ATTR)(%edi),%ebp
        cmpl %ebp,%eax
        jb 10b
 1:
@@ -224,7 +220,7 @@ default_entry:
        movl %eax, pa(max_pfn_mapped)
        /* Do early initialization of the fixmap area */
-        movl $pa(swapper_pg_fixmap)+PDE_ATTR,%eax
+        movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
        movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
 #else   /* Not PAE */
@@ -233,9 +229,9 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
        movl $pa(pg0), %edi
        movl %edi, pa(init_pg_tables_start)
        movl $pa(swapper_pg_dir), %edx
-        movl $PTE_ATTR, %eax
+        movl $PTE_IDENT_ATTR, %eax
 10:
-        leal PDE_ATTR(%edi),%ecx                /* Create PDE entry */
+        leal PDE_IDENT_ATTR(%edi),%ecx          /* Create PDE entry */
        movl %ecx,(%edx)                        /* Store identity PDE entry */
        movl %ecx,page_pde_offset(%edx)         /* Store kernel PDE entry */
        addl $4,%edx
@@ -249,7 +245,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
         * bytes beyond the end of our own page tables; the +0x007 is
         * the attribute bits
         */
-        leal (INIT_MAP_BEYOND_END+PTE_ATTR)(%edi),%ebp
+        leal (INIT_MAP_BEYOND_END+PTE_IDENT_ATTR)(%edi),%ebp
        cmpl %ebp,%eax
        jb 10b
        movl %edi,pa(init_pg_tables_end)
@@ -257,7 +253,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
        movl %eax, pa(max_pfn_mapped)
        /* Do early initialization of the fixmap area */
-        movl $pa(swapper_pg_fixmap)+PDE_ATTR,%eax
+        movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
        movl %eax,pa(swapper_pg_dir+0xffc)
 #endif
        jmp 3f
@@ -634,19 +630,19 @@ ENTRY(empty_zero_page)
        /* Page-aligned for the benefit of paravirt? */
        .align PAGE_SIZE_asm
 ENTRY(swapper_pg_dir)
-        .long   pa(swapper_pg_pmd+PGD_ATTR),0           /* low identity map */
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR),0     /* low identity map */
 # if KPMDS == 3
-        .long   pa(swapper_pg_pmd+PGD_ATTR),0
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR),0
-        .long   pa(swapper_pg_pmd+PGD_ATTR+0x1000),0
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR+0x1000),0
-        .long   pa(swapper_pg_pmd+PGD_ATTR+0x2000),0
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR+0x2000),0
 # elif KPMDS == 2
        .long   0,0
-        .long   pa(swapper_pg_pmd+PGD_ATTR),0
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR),0
-        .long   pa(swapper_pg_pmd+PGD_ATTR+0x1000),0
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR+0x1000),0
 # elif KPMDS == 1
        .long   0,0
        .long   0,0
-        .long   pa(swapper_pg_pmd+PGD_ATTR),0
+        .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR),0
 # else
 #  error "Kernel PMDs should be 1, 2 or 3"
 # endif
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index db3280afe886..26cfdc1d7c7f 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -110,7 +110,7 @@ startup_64:
        movq    %rdi, %rax
        shrq    $PMD_SHIFT, %rax
        andq    $(PTRS_PER_PMD - 1), %rax
-        leaq    __PAGE_KERNEL_LARGE_EXEC(%rdi), %rdx
+        leaq    __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
        leaq    level2_spare_pgt(%rip), %rbx
        movq    %rdx, 0(%rbx, %rax, 8)
 ident_complete:
@@ -374,7 +374,7 @@ NEXT_PAGE(level2_ident_pgt)
        /* Since I easily can, map the first 1G.
         * Don't set NX because code runs from these pages.
         */
-        PMDS(0, __PAGE_KERNEL_LARGE_EXEC, PTRS_PER_PMD)
+        PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
 NEXT_PAGE(level2_kernel_pgt)
        /*
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 1cf8c1fcc088..b71e02d42f4f 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -325,7 +325,7 @@ skip:
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ",
                                per_cpu(irq_stat,j).irq_call_count);
-                seq_printf(p, "  function call interrupts\n");
+                seq_printf(p, "  Function call interrupts\n");
                seq_printf(p, "TLB: ");
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ",
diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
index 1f78b238d8d2..f065fe9071b9 100644
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -129,7 +129,7 @@ skip:
                seq_printf(p, "CAL: ");
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ", cpu_pda(j)->irq_call_count);
-                seq_printf(p, "  function call interrupts\n");
+                seq_printf(p, "  Function call interrupts\n");
                seq_printf(p, "TLB: ");
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ", cpu_pda(j)->irq_tlb_count);
diff --git a/arch/x86/kernel/k8.c b/arch/x86/kernel/k8.c
index 7377ccb21335..304d8bad6559 100644
--- a/arch/x86/kernel/k8.c
+++ b/arch/x86/kernel/k8.c
@@ -16,8 +16,9 @@ EXPORT_SYMBOL(num_k8_northbridges);
 static u32 *flush_words;
 struct pci_device_id k8_nb_ids[] = {
-        { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x1103) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
-        { PCI_DEVICE(PCI_VENDOR_ID_AMD, 0x1203) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_11H_NB_MISC) },
        {}
 };
 EXPORT_SYMBOL(k8_nb_ids);
diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
index f2d43bc75514..ff7d3b0124f1 100644
--- a/arch/x86/kernel/kdebugfs.c
+++ b/arch/x86/kernel/kdebugfs.c
@@ -139,6 +139,7 @@ static int __init create_setup_data_nodes(struct dentry *parent)
                if (PageHighMem(pg)) {
                        data = ioremap_cache(pa_data, sizeof(*data));
                        if (!data) {
+                                kfree(node);
                                error = -ENXIO;
                                goto err_dir;
                        }
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index f47f0eb886b8..10435a120d22 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -69,6 +69,9 @@ static int gdb_x86vector = -1;
 */
 void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 {
+#ifndef CONFIG_X86_32
+        u32 *gdb_regs32 = (u32 *)gdb_regs;
+#endif
        gdb_regs[GDB_AX]        = regs->ax;
        gdb_regs[GDB_BX]        = regs->bx;
        gdb_regs[GDB_CX]        = regs->cx;
@@ -76,9 +79,9 @@ void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
        gdb_regs[GDB_SI]        = regs->si;
        gdb_regs[GDB_DI]        = regs->di;
        gdb_regs[GDB_BP]        = regs->bp;
-        gdb_regs[GDB_PS]        = regs->flags;
        gdb_regs[GDB_PC]        = regs->ip;
 #ifdef CONFIG_X86_32
+        gdb_regs[GDB_PS]        = regs->flags;
        gdb_regs[GDB_DS]        = regs->ds;
        gdb_regs[GDB_ES]        = regs->es;
        gdb_regs[GDB_CS]        = regs->cs;
@@ -94,6 +97,9 @@ void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
        gdb_regs[GDB_R13]       = regs->r13;
        gdb_regs[GDB_R14]       = regs->r14;
        gdb_regs[GDB_R15]       = regs->r15;
+        gdb_regs32[GDB_PS]      = regs->flags;
+        gdb_regs32[GDB_CS]      = regs->cs;
+        gdb_regs32[GDB_SS]      = regs->ss;
 #endif
        gdb_regs[GDB_SP]        = regs->sp;
 }
@@ -112,6 +118,9 @@ void pt_regs_to_gdb_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 */
 void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 {
+#ifndef CONFIG_X86_32
+        u32 *gdb_regs32 = (u32 *)gdb_regs;
+#endif
        gdb_regs[GDB_AX]        = 0;
        gdb_regs[GDB_BX]        = 0;
        gdb_regs[GDB_CX]        = 0;
@@ -129,8 +138,10 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
        gdb_regs[GDB_FS]        = 0xFFFF;
        gdb_regs[GDB_GS]        = 0xFFFF;
 #else
-        gdb_regs[GDB_PS]        = *(unsigned long *)(p->thread.sp + 8);
+        gdb_regs32[GDB_PS]      = *(unsigned long *)(p->thread.sp + 8);
-        gdb_regs[GDB_PC]        = 0;
+        gdb_regs32[GDB_CS]      = __KERNEL_CS;
+        gdb_regs32[GDB_SS]      = __KERNEL_DS;
+        gdb_regs[GDB_PC]        = p->thread.ip;
        gdb_regs[GDB_R8]        = 0;
        gdb_regs[GDB_R9]        = 0;
        gdb_regs[GDB_R10]       = 0;
@@ -153,6 +164,9 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p)
 */
 void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 {
+#ifndef CONFIG_X86_32
+        u32 *gdb_regs32 = (u32 *)gdb_regs;
+#endif
        regs->ax                = gdb_regs[GDB_AX];
        regs->bx                = gdb_regs[GDB_BX];
        regs->cx                = gdb_regs[GDB_CX];
@@ -160,9 +174,9 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
        regs->si                = gdb_regs[GDB_SI];
        regs->di                = gdb_regs[GDB_DI];
        regs->bp                = gdb_regs[GDB_BP];
-        regs->flags             = gdb_regs[GDB_PS];
        regs->ip                = gdb_regs[GDB_PC];
 #ifdef CONFIG_X86_32
+        regs->flags             = gdb_regs[GDB_PS];
        regs->ds                = gdb_regs[GDB_DS];
        regs->es                = gdb_regs[GDB_ES];
        regs->cs                = gdb_regs[GDB_CS];
@@ -175,6 +189,9 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
        regs->r13               = gdb_regs[GDB_R13];
        regs->r14               = gdb_regs[GDB_R14];
        regs->r15               = gdb_regs[GDB_R15];
+        regs->flags             = gdb_regs32[GDB_PS];
+        regs->cs                = gdb_regs32[GDB_CS];
+        regs->ss                = gdb_regs32[GDB_SS];
 #endif
 }
@@ -378,10 +395,8 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
                if (remcomInBuffer[0] == 's') {
                        linux_regs->flags |= X86_EFLAGS_TF;
                        kgdb_single_step = 1;
-                        if (kgdb_contthread) {
+                        atomic_set(&kgdb_cpu_doing_single_step,
-                                atomic_set(&kgdb_cpu_doing_single_step,
+                                   raw_smp_processor_id());
-                                           raw_smp_processor_id());
-                        }
                }
                get_debugreg(dr6, 6);
@@ -440,12 +455,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
                return NOTIFY_DONE;
        case DIE_NMI_IPI:
-                if (atomic_read(&kgdb_active) != -1) {
+                /* Just ignore, we will handle the roundup on DIE_NMI. */
-                        /* KGDB CPU roundup */
-                        kgdb_nmicallback(raw_smp_processor_id(), regs);
-                        was_in_debug_nmi[raw_smp_processor_id()] = 1;
-                        touch_nmi_watchdog();
-                }
                return NOTIFY_DONE;
        case DIE_NMIUNKNOWN:
@@ -466,9 +476,15 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
        case DIE_DEBUG:
                if (atomic_read(&kgdb_cpu_doing_single_step) ==
-                        raw_smp_processor_id() &&
+                    raw_smp_processor_id()) {
-                        user_mode(regs))
+                        if (user_mode(regs))
-                        return single_step_cont(regs, args);
+                                return single_step_cont(regs, args);
+                        break;
+                } else if (test_thread_flag(TIF_SINGLESTEP))
+                        /* This means a user thread is single stepping
+                         * a system call which should be ignored
+                         */
+                        return NOTIFY_DONE;
                /* fall through */
        default:
                if (user_mode(regs))
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 8b7a3cf37d2b..478bca986eca 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -178,7 +178,7 @@ static void kvm_flush_tlb(void)
        kvm_deferred_mmu_op(&ftlb, sizeof ftlb);
 }
-static void kvm_release_pt(u32 pfn)
+static void kvm_release_pt(unsigned long pfn)
 {
        struct kvm_mmu_op_release_pt rpt = {
                .header.op = KVM_MMU_OP_RELEASE_PT,
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index abb78a2cc4ad..2c97f07f1c2c 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -299,6 +299,15 @@ void acpi_nmi_disable(void)
                on_each_cpu(__acpi_nmi_disable, NULL, 1);
 }
+/*
+ * This function is called as soon the LAPIC NMI watchdog driver has everything
+ * in place and it's ready to check if the NMIs belong to the NMI watchdog
+ */
+void cpu_nmi_set_wd_enabled(void)
+{
+        __get_cpu_var(wd_enabled) = 1;
+}
 void setup_apic_nmi_watchdog(void *unused)
 {
        if (__get_cpu_var(wd_enabled))
@@ -311,8 +320,6 @@ void setup_apic_nmi_watchdog(void *unused)
        switch (nmi_watchdog) {
        case NMI_LOCAL_APIC:
-                 /* enable it before to avoid race with handler */
-                __get_cpu_var(wd_enabled) = 1;
                if (lapic_watchdog_init(nmi_hz) < 0) {
                        __get_cpu_var(wd_enabled) = 0;
                        return;
diff --git a/arch/x86/kernel/olpc.c b/arch/x86/kernel/olpc.c
index 3e6672274807..7a13fac63a1f 100644
--- a/arch/x86/kernel/olpc.c
+++ b/arch/x86/kernel/olpc.c
@@ -190,12 +190,12 @@ EXPORT_SYMBOL_GPL(olpc_ec_cmd);
 static void __init platform_detect(void)
 {
        size_t propsize;
-        u32 rev;
+        __be32 rev;
        if (ofw("getprop", 4, 1, NULL, "board-revision-int", &rev, 4,
                        &propsize) || propsize != 4) {
                printk(KERN_ERR "ofw: getprop call failed!\n");
-                rev = 0;
+                rev = cpu_to_be32(0);
        }
        olpc_platform_info.boardrev = be32_to_cpu(rev);
 }
@@ -203,7 +203,7 @@ static void __init platform_detect(void)
 static void __init platform_detect(void)
 {
        /* stopgap until OFW support is added to the kernel */
-        olpc_platform_info.boardrev = be32_to_cpu(0xc2);
+        olpc_platform_info.boardrev = 0xc2;
 }
 #endif
diff --git a/arch/x86/kernel/paravirt_patch_32.c b/arch/x86/kernel/paravirt_patch_32.c
index 58262218781b..9fe644f4861d 100644
--- a/arch/x86/kernel/paravirt_patch_32.c
+++ b/arch/x86/kernel/paravirt_patch_32.c
@@ -23,7 +23,7 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
                        start = start_##ops##_##x;              \
                        end = end_##ops##_##x;                  \
                        goto patch_site
-        switch(type) {
+        switch (type) {
                PATCH_SITE(pv_irq_ops, irq_disable);
                PATCH_SITE(pv_irq_ops, irq_enable);
                PATCH_SITE(pv_irq_ops, restore_fl);
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index dcdac6c826e9..080d1d27f37a 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -261,7 +261,7 @@ static void iommu_range_reserve(struct iommu_table *tbl,
                               badbit, tbl, start_addr, npages);
        }
-        set_bit_string(tbl->it_map, index, npages);
+        iommu_area_reserve(tbl->it_map, index, npages);
        spin_unlock_irqrestore(&tbl->it_lock, flags);
 }
@@ -491,6 +491,8 @@ static void* calgary_alloc_coherent(struct device *dev, size_t size,
        npages = size >> PAGE_SHIFT;
        order = get_order(size);
+        flag &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
        /* alloc enough pages (and possibly more) */
        ret = (void *)__get_free_pages(flag, order);
        if (!ret)
@@ -510,8 +512,22 @@ error:
        return ret;
 }
+static void calgary_free_coherent(struct device *dev, size_t size,
+                                  void *vaddr, dma_addr_t dma_handle)
+{
+        unsigned int npages;
+        struct iommu_table *tbl = find_iommu_table(dev);
+        size = PAGE_ALIGN(size);
+        npages = size >> PAGE_SHIFT;
+        iommu_free(tbl, dma_handle, npages);
+        free_pages((unsigned long)vaddr, get_order(size));
+}
 static struct dma_mapping_ops calgary_dma_ops = {
        .alloc_coherent = calgary_alloc_coherent,
+        .free_coherent = calgary_free_coherent,
        .map_single = calgary_map_single,
        .unmap_single = calgary_unmap_single,
        .map_sg = calgary_map_sg,
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 87d4d6964ec2..0a3824e837b4 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -41,11 +41,12 @@ EXPORT_SYMBOL(bad_dma_address);
 /* Dummy device used for NULL arguments (normally ISA). Better would
   be probably a smaller DMA mask, but this is bug-to-bug compatible
   to older i386. */
-struct device fallback_dev = {
+struct device x86_dma_fallback_dev = {
        .bus_id = "fallback device",
        .coherent_dma_mask = DMA_32BIT_MASK,
-        .dma_mask = &fallback_dev.coherent_dma_mask,
+        .dma_mask = &x86_dma_fallback_dev.coherent_dma_mask,
 };
+EXPORT_SYMBOL(x86_dma_fallback_dev);
 int dma_set_mask(struct device *dev, u64 mask)
 {
@@ -82,7 +83,7 @@ void __init dma32_reserve_bootmem(void)
         * using 512M as goal
         */
        align = 64ULL<<20;
-        size = round_up(dma32_bootmem_size, align);
+        size = roundup(dma32_bootmem_size, align);
        dma32_bootmem_ptr = __alloc_bootmem_nopanic(size, align,
                                 512ULL<<20);
        if (dma32_bootmem_ptr)
@@ -133,6 +134,37 @@ unsigned long iommu_num_pages(unsigned long addr, unsigned long len)
 EXPORT_SYMBOL(iommu_num_pages);
 #endif
+void *dma_generic_alloc_coherent(struct device *dev, size_t size,
+                                 dma_addr_t *dma_addr, gfp_t flag)
+{
+        unsigned long dma_mask;
+        struct page *page;
+        dma_addr_t addr;
+        dma_mask = dma_alloc_coherent_mask(dev, flag);
+        flag |= __GFP_ZERO;
+again:
+        page = alloc_pages_node(dev_to_node(dev), flag, get_order(size));
+        if (!page)
+                return NULL;
+        addr = page_to_phys(page);
+        if (!is_buffer_dma_capable(dma_mask, addr, size)) {
+                __free_pages(page, get_order(size));
+                if (dma_mask < DMA_32BIT_MASK && !(flag & GFP_DMA)) {
+                        flag = (flag & ~GFP_DMA32) | GFP_DMA;
+                        goto again;
+                }
+                return NULL;
+        }
+        *dma_addr = addr;
+        return page_address(page);
+}
 /*
 * See <Documentation/x86_64/boot-options.txt> for the iommu kernel parameter
 * documentation.
@@ -241,147 +273,6 @@ int dma_supported(struct device *dev, u64 mask)
 }
 EXPORT_SYMBOL(dma_supported);
-/* Allocate DMA memory on node near device */
-static noinline struct page *
-dma_alloc_pages(struct device *dev, gfp_t gfp, unsigned order)
-{
-        int node;
-        node = dev_to_node(dev);
-        return alloc_pages_node(node, gfp, order);
-}
-/*
- * Allocate memory for a coherent mapping.
- */
-void *
-dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
-                   gfp_t gfp)
-{
-        struct dma_mapping_ops *ops = get_dma_ops(dev);
-        void *memory = NULL;
-        struct page *page;
-        unsigned long dma_mask = 0;
-        dma_addr_t bus;
-        int noretry = 0;
-        /* ignore region specifiers */
-        gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
-        if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
-                return memory;
-        if (!dev) {
-                dev = &fallback_dev;
-                gfp |= GFP_DMA;
-        }
-        dma_mask = dev->coherent_dma_mask;
-        if (dma_mask == 0)
-                dma_mask = (gfp & GFP_DMA) ? DMA_24BIT_MASK : DMA_32BIT_MASK;
-        /* Device not DMA able */
-        if (dev->dma_mask == NULL)
-                return NULL;
-        /* Don't invoke OOM killer or retry in lower 16MB DMA zone */
-        if (gfp & __GFP_DMA)
-                noretry = 1;
-#ifdef CONFIG_X86_64
-        /* Why <=? Even when the mask is smaller than 4GB it is often
-           larger than 16MB and in this case we have a chance of
-           finding fitting memory in the next higher zone first. If
-           not retry with true GFP_DMA. -AK */
-        if (dma_mask <= DMA_32BIT_MASK && !(gfp & GFP_DMA)) {
-                gfp |= GFP_DMA32;
-                if (dma_mask < DMA_32BIT_MASK)
-                        noretry = 1;
-        }
-#endif
- again:
-        page = dma_alloc_pages(dev,
-                noretry ? gfp | __GFP_NORETRY : gfp, get_order(size));
-        if (page == NULL)
-                return NULL;
-        {
-                int high, mmu;
-                bus = page_to_phys(page);
-                memory = page_address(page);
-                high = (bus + size) >= dma_mask;
-                mmu = high;
-                if (force_iommu && !(gfp & GFP_DMA))
-                        mmu = 1;
-                else if (high) {
-                        free_pages((unsigned long)memory,
-                                   get_order(size));
-                        /* Don't use the 16MB ZONE_DMA unless absolutely
-                           needed. It's better to use remapping first. */
-                        if (dma_mask < DMA_32BIT_MASK && !(gfp & GFP_DMA)) {
-                                gfp = (gfp & ~GFP_DMA32) | GFP_DMA;
-                                goto again;
-                        }
-                        /* Let low level make its own zone decisions */
-                        gfp &= ~(GFP_DMA32|GFP_DMA);
-                        if (ops->alloc_coherent)
-                                return ops->alloc_coherent(dev, size,
-                                                           dma_handle, gfp);
-                        return NULL;
-                }
-                memset(memory, 0, size);
-                if (!mmu) {
-                        *dma_handle = bus;
-                        return memory;
-                }
-        }
-        if (ops->alloc_coherent) {
-                free_pages((unsigned long)memory, get_order(size));
-                gfp &= ~(GFP_DMA|GFP_DMA32);
-                return ops->alloc_coherent(dev, size, dma_handle, gfp);
-        }
-        if (ops->map_simple) {
-                *dma_handle = ops->map_simple(dev, virt_to_phys(memory),
-                                              size,
-                                              PCI_DMA_BIDIRECTIONAL);
-                if (*dma_handle != bad_dma_address)
-                        return memory;
-        }
-        if (panic_on_overflow)
-                panic("dma_alloc_coherent: IOMMU overflow by %lu bytes\n",
-                      (unsigned long)size);
-        free_pages((unsigned long)memory, get_order(size));
-        return NULL;
-}
-EXPORT_SYMBOL(dma_alloc_coherent);
-/*
- * Unmap coherent memory.
- * The caller must ensure that the device has finished accessing the mapping.
- */
-void dma_free_coherent(struct device *dev, size_t size,
-                         void *vaddr, dma_addr_t bus)
-{
-        struct dma_mapping_ops *ops = get_dma_ops(dev);
-        int order = get_order(size);
-        WARN_ON(irqs_disabled());       /* for portability */
-        if (dma_release_from_coherent(dev, order, vaddr))
-                return;
-        if (ops->unmap_single)
-                ops->unmap_single(dev, bus, size, 0);
-        free_pages((unsigned long)vaddr, order);
-}
-EXPORT_SYMBOL(dma_free_coherent);
 static int __init pci_iommu_init(void)
 {
        calgary_iommu_init();
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index 49285f8fd4d5..145f1c83369f 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -27,8 +27,8 @@
 #include <linux/scatterlist.h>
 #include <linux/iommu-helper.h>
 #include <linux/sysdev.h>
+#include <linux/io.h>
 #include <asm/atomic.h>
-#include <asm/io.h>
 #include <asm/mtrr.h>
 #include <asm/pgtable.h>
 #include <asm/proto.h>
@@ -80,9 +80,10 @@ AGPEXTERN int agp_memory_reserved;
 AGPEXTERN __u32 *agp_gatt_table;
 static unsigned long next_bit;  /* protected by iommu_bitmap_lock */
-static int need_flush;          /* global flush state. set for each gart wrap */
+static bool need_flush;         /* global flush state. set for each gart wrap */
-static unsigned long alloc_iommu(struct device *dev, int size)
+static unsigned long alloc_iommu(struct device *dev, int size,
+                                 unsigned long align_mask)
 {
        unsigned long offset, flags;
        unsigned long boundary_size;
@@ -90,26 +91,27 @@ static unsigned long alloc_iommu(struct device *dev, int size)
        base_index = ALIGN(iommu_bus_base & dma_get_seg_boundary(dev),
                           PAGE_SIZE) >> PAGE_SHIFT;
-        boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
+        boundary_size = ALIGN((unsigned long long)dma_get_seg_boundary(dev) + 1,
                              PAGE_SIZE) >> PAGE_SHIFT;
        spin_lock_irqsave(&iommu_bitmap_lock, flags);
        offset = iommu_area_alloc(iommu_gart_bitmap, iommu_pages, next_bit,
-                                  size, base_index, boundary_size, 0);
+                                  size, base_index, boundary_size, align_mask);
        if (offset == -1) {
-                need_flush = 1;
+                need_flush = true;
                offset = iommu_area_alloc(iommu_gart_bitmap, iommu_pages, 0,
-                                          size, base_index, boundary_size, 0);
+                                          size, base_index, boundary_size,
+                                          align_mask);
        }
        if (offset != -1) {
                next_bit = offset+size;
                if (next_bit >= iommu_pages) {
                        next_bit = 0;
-                        need_flush = 1;
+                        need_flush = true;
                }
        }
        if (iommu_fullflush)
-                need_flush = 1;
+                need_flush = true;
        spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
        return offset;
@@ -134,7 +136,7 @@ static void flush_gart(void)
        spin_lock_irqsave(&iommu_bitmap_lock, flags);
        if (need_flush) {
                k8_flush_garts();
-                need_flush = 0;
+                need_flush = false;
        }
        spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
 }
@@ -173,7 +175,8 @@ static void dump_leak(void)
               iommu_leak_pages);
        for (i = 0; i < iommu_leak_pages; i += 2) {
                printk(KERN_DEBUG "%lu: ", iommu_pages-i);
-                printk_address((unsigned long) iommu_leak_tab[iommu_pages-i], 0);
+                printk_address((unsigned long) iommu_leak_tab[iommu_pages-i],
+                                0);
                printk(KERN_CONT "%c", (i+1)%2 == 0 ? '\n' : ' ');
        }
        printk(KERN_DEBUG "\n");
@@ -212,34 +215,24 @@ static void iommu_full(struct device *dev, size_t size, int dir)
 static inline int
 need_iommu(struct device *dev, unsigned long addr, size_t size)
 {
-        u64 mask = *dev->dma_mask;
+        return force_iommu ||
-        int high = addr + size > mask;
+                !is_buffer_dma_capable(*dev->dma_mask, addr, size);
-        int mmu = high;
-        if (force_iommu)
-                mmu = 1;
-        return mmu;
 }
 static inline int
 nonforced_iommu(struct device *dev, unsigned long addr, size_t size)
 {
-        u64 mask = *dev->dma_mask;
+        return !is_buffer_dma_capable(*dev->dma_mask, addr, size);
-        int high = addr + size > mask;
-        int mmu = high;
-        return mmu;
 }
 /* Map a single continuous physical area into the IOMMU.
 * Caller needs to check if the iommu is needed and flush.
 */
 static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
-                                size_t size, int dir)
+                                size_t size, int dir, unsigned long align_mask)
 {
        unsigned long npages = iommu_num_pages(phys_mem, size);
-        unsigned long iommu_page = alloc_iommu(dev, npages);
+        unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
        int i;
        if (iommu_page == -1) {
@@ -259,16 +252,6 @@ static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
        return iommu_bus_base + iommu_page*PAGE_SIZE + (phys_mem & ~PAGE_MASK);
 }
-static dma_addr_t
-gart_map_simple(struct device *dev, phys_addr_t paddr, size_t size, int dir)
-{
-        dma_addr_t map = dma_map_area(dev, paddr, size, dir);
-        flush_gart();
-        return map;
-}
 /* Map a single area into the IOMMU */
 static dma_addr_t
 gart_map_single(struct device *dev, phys_addr_t paddr, size_t size, int dir)
@@ -276,12 +259,13 @@ gart_map_single(struct device *dev, phys_addr_t paddr, size_t size, int dir)
        unsigned long bus;
        if (!dev)
-                dev = &fallback_dev;
+                dev = &x86_dma_fallback_dev;
        if (!need_iommu(dev, paddr, size))
                return paddr;
-        bus = gart_map_simple(dev, paddr, size, dir);
+        bus = dma_map_area(dev, paddr, size, dir, 0);
+        flush_gart();
        return bus;
 }
@@ -340,7 +324,7 @@ static int dma_map_sg_nonforce(struct device *dev, struct scatterlist *sg,
                unsigned long addr = sg_phys(s);
                if (nonforced_iommu(dev, addr, s->length)) {
-                        addr = dma_map_area(dev, addr, s->length, dir);
+                        addr = dma_map_area(dev, addr, s->length, dir, 0);
                        if (addr == bad_dma_address) {
                                if (i > 0)
                                        gart_unmap_sg(dev, sg, i, dir);
@@ -362,7 +346,7 @@ static int __dma_map_cont(struct device *dev, struct scatterlist *start,
                          int nelems, struct scatterlist *sout,
                          unsigned long pages)
 {
-        unsigned long iommu_start = alloc_iommu(dev, pages);
+        unsigned long iommu_start = alloc_iommu(dev, pages, 0);
        unsigned long iommu_page = iommu_start;
        struct scatterlist *s;
        int i;
@@ -427,7 +411,7 @@ gart_map_sg(struct device *dev, struct scatterlist *sg, int nents, int dir)
                return 0;
        if (!dev)
-                dev = &fallback_dev;
+                dev = &x86_dma_fallback_dev;
        out = 0;
        start = 0;
@@ -499,6 +483,46 @@ error:
        return 0;
 }
+/* allocate and map a coherent mapping */
+static void *
+gart_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_addr,
+                    gfp_t flag)
+{
+        dma_addr_t paddr;
+        unsigned long align_mask;
+        struct page *page;
+        if (force_iommu && !(flag & GFP_DMA)) {
+                flag &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+                page = alloc_pages(flag | __GFP_ZERO, get_order(size));
+                if (!page)
+                        return NULL;
+                align_mask = (1UL << get_order(size)) - 1;
+                paddr = dma_map_area(dev, page_to_phys(page), size,
+                                     DMA_BIDIRECTIONAL, align_mask);
+                flush_gart();
+                if (paddr != bad_dma_address) {
+                        *dma_addr = paddr;
+                        return page_address(page);
+                }
+                __free_pages(page, get_order(size));
+        } else
+                return dma_generic_alloc_coherent(dev, size, dma_addr, flag);
+        return NULL;
+}
+/* free a coherent mapping */
+static void
+gart_free_coherent(struct device *dev, size_t size, void *vaddr,
+                   dma_addr_t dma_addr)
+{
+        gart_unmap_single(dev, dma_addr, size, DMA_BIDIRECTIONAL);
+        free_pages((unsigned long)vaddr, get_order(size));
+}
 static int no_agp;
 static __init unsigned long check_iommu_size(unsigned long aper, u64 aper_size)
@@ -626,7 +650,6 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        struct pci_dev *dev;
        void *gatt;
        int i, error;
-        unsigned long start_pfn, end_pfn;
        printk(KERN_INFO "PCI-DMA: Disabling AGP.\n");
        aper_size = aper_base = info->aper_size = 0;
@@ -650,13 +673,13 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        info->aper_size = aper_size >> 20;
        gatt_size = (aper_size >> PAGE_SHIFT) * sizeof(u32);
-        gatt = (void *)__get_free_pages(GFP_KERNEL, get_order(gatt_size));
+        gatt = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                        get_order(gatt_size));
        if (!gatt)
                panic("Cannot allocate GATT table");
        if (set_memory_uc((unsigned long)gatt, gatt_size >> PAGE_SHIFT))
                panic("Could not set GART PTEs to uncacheable pages");
-        memset(gatt, 0, gatt_size);
        agp_gatt_table = gatt;
        enable_gart_translations();
@@ -665,19 +688,14 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        if (!error)
                error = sysdev_register(&device_gart);
        if (error)
-                panic("Could not register gart_sysdev -- would corrupt data on next suspend");
+                panic("Could not register gart_sysdev -- "
+                      "would corrupt data on next suspend");
        flush_gart();
        printk(KERN_INFO "PCI-DMA: aperture base @ %x size %u KB\n",
               aper_base, aper_size>>10);
-        /* need to map that range */
-        end_pfn = (aper_base>>PAGE_SHIFT) + (aper_size>>PAGE_SHIFT);
-        if (end_pfn > max_low_pfn_mapped) {
-                start_pfn = (aper_base>>PAGE_SHIFT);
-                init_memory_mapping(start_pfn<<PAGE_SHIFT, end_pfn<<PAGE_SHIFT);
-        }
        return 0;
 nommu:
@@ -687,20 +705,13 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        return -1;
 }
-extern int agp_amd64_init(void);
 static struct dma_mapping_ops gart_dma_ops = {
        .map_single                     = gart_map_single,
-        .map_simple                     = gart_map_simple,
        .unmap_single                   = gart_unmap_single,
-        .sync_single_for_cpu            = NULL,
-        .sync_single_for_device         = NULL,
-        .sync_single_range_for_cpu      = NULL,
-        .sync_single_range_for_device   = NULL,
-        .sync_sg_for_cpu                = NULL,
-        .sync_sg_for_device             = NULL,
        .map_sg                         = gart_map_sg,
        .unmap_sg                       = gart_unmap_sg,
+        .alloc_coherent                 = gart_alloc_coherent,
+        .free_coherent                  = gart_free_coherent,
 };
 void gart_iommu_shutdown(void)
@@ -727,7 +738,8 @@ void __init gart_iommu_init(void)
 {
        struct agp_kern_info info;
        unsigned long iommu_start;
-        unsigned long aper_size;
+        unsigned long aper_base, aper_size;
+        unsigned long start_pfn, end_pfn;
        unsigned long scratch;
        long i;
@@ -759,30 +771,35 @@ void __init gart_iommu_init(void)
            (no_agp && init_k8_gatt(&info) < 0)) {
                if (max_pfn > MAX_DMA32_PFN) {
                        printk(KERN_WARNING "More than 4GB of memory "
-                                          "but GART IOMMU not available.\n"
+                               "but GART IOMMU not available.\n");
-                               KERN_WARNING "falling back to iommu=soft.\n");
+                        printk(KERN_WARNING "falling back to iommu=soft.\n");
                }
                return;
        }
+        /* need to map that range */
+        aper_size = info.aper_size << 20;
+        aper_base = info.aper_base;
+        end_pfn = (aper_base>>PAGE_SHIFT) + (aper_size>>PAGE_SHIFT);
+        if (end_pfn > max_low_pfn_mapped) {
+                start_pfn = (aper_base>>PAGE_SHIFT);
+                init_memory_mapping(start_pfn<<PAGE_SHIFT, end_pfn<<PAGE_SHIFT);
+        }
        printk(KERN_INFO "PCI-DMA: using GART IOMMU.\n");
-        aper_size = info.aper_size * 1024 * 1024;
        iommu_size = check_iommu_size(info.aper_base, aper_size);
        iommu_pages = iommu_size >> PAGE_SHIFT;
-        iommu_gart_bitmap = (void *) __get_free_pages(GFP_KERNEL,
+        iommu_gart_bitmap = (void *) __get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                                      get_order(iommu_pages/8));
        if (!iommu_gart_bitmap)
                panic("Cannot allocate iommu bitmap\n");
-        memset(iommu_gart_bitmap, 0, iommu_pages/8);
 #ifdef CONFIG_IOMMU_LEAK
        if (leak_trace) {
-                iommu_leak_tab = (void *)__get_free_pages(GFP_KERNEL,
+                iommu_leak_tab = (void *)__get_free_pages(GFP_KERNEL|__GFP_ZERO,
                                  get_order(iommu_pages*sizeof(void *)));
-                if (iommu_leak_tab)
+                if (!iommu_leak_tab)
-                        memset(iommu_leak_tab, 0, iommu_pages * 8);
-                else
                        printk(KERN_DEBUG
                               "PCI-DMA: Cannot allocate leak trace area\n");
        }
@@ -792,7 +809,7 @@ void __init gart_iommu_init(void)
         * Out of IOMMU space handling.
         * Reserve some invalid pages at the beginning of the GART.
         */
-        set_bit_string(iommu_gart_bitmap, 0, EMERGENCY_PAGES);
+        iommu_area_reserve(iommu_gart_bitmap, 0, EMERGENCY_PAGES);
        agp_memory_reserved = iommu_size;
        printk(KERN_INFO
@@ -850,7 +867,8 @@ void __init gart_parse_options(char *p)
        if (!strncmp(p, "leak", 4)) {
                leak_trace = 1;
                p += 4;
-                if (*p == '=') ++p;
+                if (*p == '=')
+                        ++p;
                if (isdigit(*p) && get_option(&p, &arg))
                        iommu_leak_pages = arg;
        }
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index 3f91f71cdc3e..c70ab5a5d4c8 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -14,7 +14,7 @@
 static int
 check_addr(char *name, struct device *hwdev, dma_addr_t bus, size_t size)
 {
-        if (hwdev && bus + size > *hwdev->dma_mask) {
+        if (hwdev && !is_buffer_dma_capable(*hwdev->dma_mask, bus, size)) {
                if (*hwdev->dma_mask >= DMA_32BIT_MASK)
                        printk(KERN_ERR
                            "nommu_%s: overflow %Lx+%zu of device mask %Lx\n",
@@ -72,7 +72,15 @@ static int nommu_map_sg(struct device *hwdev, struct scatterlist *sg,
        return nents;
 }
+static void nommu_free_coherent(struct device *dev, size_t size, void *vaddr,
+                                dma_addr_t dma_addr)
+{
+        free_pages((unsigned long)vaddr, get_order(size));
+}
 struct dma_mapping_ops nommu_dma_ops = {
+        .alloc_coherent = dma_generic_alloc_coherent,
+        .free_coherent = nommu_free_coherent,
        .map_single = nommu_map_single,
        .map_sg = nommu_map_sg,
        .is_phys = 1,
diff --git a/arch/x86/kernel/pcspeaker.c b/arch/x86/kernel/pcspeaker.c
index bc1f2d3ea277..a311ffcaad16 100644
--- a/arch/x86/kernel/pcspeaker.c
+++ b/arch/x86/kernel/pcspeaker.c
@@ -1,20 +1,13 @@
 #include <linux/platform_device.h>
-#include <linux/errno.h>
+#include <linux/err.h>
 #include <linux/init.h>
 static __init int add_pcspkr(void)
 {
        struct platform_device *pd;
-        int ret;
-        pd = platform_device_alloc("pcspkr", -1);
+        pd = platform_device_register_simple("pcspkr", -1, NULL, 0);
-        if (!pd)
-                return -ENOMEM;
-        ret = platform_device_add(pd);
+        return IS_ERR(pd) ? PTR_ERR(pd) : 0;
-        if (ret)
-                platform_device_put(pd);
-        return ret;
 }
 device_initcall(add_pcspkr);
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 9f94bb1c8117..c622772744d8 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -184,7 +184,8 @@ static void mwait_idle(void)
 static void poll_idle(void)
 {
        local_irq_enable();
-        cpu_relax();
+        while (!need_resched())
+                cpu_relax();
 }
 /*
@@ -245,6 +246,14 @@ static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
        return 1;
 }
+static cpumask_t c1e_mask = CPU_MASK_NONE;
+static int c1e_detected;
+void c1e_remove_cpu(int cpu)
+{
+        cpu_clear(cpu, c1e_mask);
+}
 /*
 * C1E aware idle routine. We check for C1E active in the interrupt
 * pending message MSR. If we detect C1E, then we handle it the same
@@ -252,9 +261,6 @@ static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
 */
 static void c1e_idle(void)
 {
-        static cpumask_t c1e_mask = CPU_MASK_NONE;
-        static int c1e_detected;
        if (need_resched())
                return;
@@ -264,8 +270,10 @@ static void c1e_idle(void)
                rdmsr(MSR_K8_INT_PENDING_MSG, lo, hi);
                if (lo & K8_INTP_C1E_ACTIVE_MASK) {
                        c1e_detected = 1;
-                        mark_tsc_unstable("TSC halt in C1E");
+                        if (!boot_cpu_has(X86_FEATURE_CONSTANT_TSC))
-                        printk(KERN_INFO "System has C1E enabled\n");
+                                mark_tsc_unstable("TSC halt in AMD C1E");
+                        printk(KERN_INFO "System has AMD C1E enabled\n");
+                        set_cpu_cap(&boot_cpu_data, X86_FEATURE_AMDC1E);
                }
        }
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 1962d27c6b82..205188db9626 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -37,6 +37,7 @@
 #include <linux/tick.h>
 #include <linux/percpu.h>
 #include <linux/prctl.h>
+#include <linux/dmi.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -55,6 +56,7 @@
 #include <asm/tlbflush.h>
 #include <asm/cpu.h>
 #include <asm/kdebug.h>
+#include <asm/idle.h>
 #include <asm/syscalls.h>
 #include <asm/smp.h>
@@ -90,6 +92,7 @@ static void cpu_exit_clear(void)
        cpu_clear(cpu, cpu_callin_map);
        numa_remove_cpu(cpu);
+        c1e_remove_cpu(cpu);
 }
 /* We don't actually take CPU down, just spin without interrupts. */
@@ -161,6 +164,7 @@ void __show_registers(struct pt_regs *regs, int all)
        unsigned long d0, d1, d2, d3, d6, d7;
        unsigned long sp;
        unsigned short ss, gs;
+        const char *board;
        if (user_mode_vm(regs)) {
                sp = regs->sp;
@@ -173,11 +177,15 @@ void __show_registers(struct pt_regs *regs, int all)
        }
        printk("\n");
-        printk("Pid: %d, comm: %s %s (%s %.*s)\n",
+        board = dmi_get_system_info(DMI_PRODUCT_NAME);
+        if (!board)
+                board = "";
+        printk("Pid: %d, comm: %s %s (%s %.*s) %s\n",
                        task_pid_nr(current), current->comm,
                        print_tainted(), init_utsname()->release,
                        (int)strcspn(init_utsname()->version, " "),
-                        init_utsname()->version);
+                        init_utsname()->version, board);
        printk("EIP: %04x:[<%08lx>] EFLAGS: %08lx CPU: %d\n",
                        (u16)regs->cs, regs->ip, regs->flags,
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 08a9df08adba..2a8ccb9238b4 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -37,11 +37,11 @@
 #include <linux/kdebug.h>
 #include <linux/tick.h>
 #include <linux/prctl.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
-#include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
 #include <asm/mmu_context.h>
@@ -89,11 +89,13 @@ void exit_idle(void)
 #ifdef CONFIG_HOTPLUG_CPU
 DECLARE_PER_CPU(int, cpu_state);
-#include <asm/nmi.h>
+#include <linux/nmi.h>
 /* We halt the CPU with physical CPU hotplug */
 static inline void play_dead(void)
 {
        idle_task_exit();
+        c1e_remove_cpu(raw_smp_processor_id());
        mb();
        /* Ack it */
        __get_cpu_var(cpu_state) = CPU_DEAD;
@@ -152,7 +154,7 @@ void cpu_idle(void)
 }
 /* Prints also some state that isn't saved in the pt_regs */
-void __show_regs(struct pt_regs * regs)
+void __show_regs(struct pt_regs *regs)
 {
        unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
        unsigned long d0, d1, d2, d3, d6, d7;
@@ -161,59 +163,61 @@ void __show_regs(struct pt_regs * regs)
        printk("\n");
        print_modules();
-        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+        printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s\n",
                current->pid, current->comm, print_tainted(),
                init_utsname()->release,
                (int)strcspn(init_utsname()->version, " "),
                init_utsname()->version);
-        printk("RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
+        printk(KERN_INFO "RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
        printk_address(regs->ip, 1);
-        printk("RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss, regs->sp,
+        printk(KERN_INFO "RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss,
-                regs->flags);
+                        regs->sp, regs->flags);
-        printk("RAX: %016lx RBX: %016lx RCX: %016lx\n",
+        printk(KERN_INFO "RAX: %016lx RBX: %016lx RCX: %016lx\n",
               regs->ax, regs->bx, regs->cx);
-        printk("RDX: %016lx RSI: %016lx RDI: %016lx\n",
+        printk(KERN_INFO "RDX: %016lx RSI: %016lx RDI: %016lx\n",
               regs->dx, regs->si, regs->di);
-        printk("RBP: %016lx R08: %016lx R09: %016lx\n",
+        printk(KERN_INFO "RBP: %016lx R08: %016lx R09: %016lx\n",
               regs->bp, regs->r8, regs->r9);
-        printk("R10: %016lx R11: %016lx R12: %016lx\n",
+        printk(KERN_INFO "R10: %016lx R11: %016lx R12: %016lx\n",
-               regs->r10, regs->r11, regs->r12); 
+               regs->r10, regs->r11, regs->r12);
-        printk("R13: %016lx R14: %016lx R15: %016lx\n",
+        printk(KERN_INFO "R13: %016lx R14: %016lx R15: %016lx\n",
-               regs->r13, regs->r14, regs->r15); 
+               regs->r13, regs->r14, regs->r15);
-        asm("movl %%ds,%0" : "=r" (ds)); 
+        asm("movl %%ds,%0" : "=r" (ds));
-        asm("movl %%cs,%0" : "=r" (cs)); 
+        asm("movl %%cs,%0" : "=r" (cs));
-        asm("movl %%es,%0" : "=r" (es)); 
+        asm("movl %%es,%0" : "=r" (es));
        asm("movl %%fs,%0" : "=r" (fsindex));
        asm("movl %%gs,%0" : "=r" (gsindex));
        rdmsrl(MSR_FS_BASE, fs);
-        rdmsrl(MSR_GS_BASE, gs); 
+        rdmsrl(MSR_GS_BASE, gs);
-        rdmsrl(MSR_KERNEL_GS_BASE, shadowgs); 
+        rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
        cr0 = read_cr0();
        cr2 = read_cr2();
        cr3 = read_cr3();
        cr4 = read_cr4();
-        printk("FS:  %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n", 
+        printk(KERN_INFO "FS:  %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n",
-               fs,fsindex,gs,gsindex,shadowgs); 
+               fs, fsindex, gs, gsindex, shadowgs);
-        printk("CS:  %04x DS: %04x ES: %04x CR0: %016lx\n", cs, ds, es, cr0); 
+        printk(KERN_INFO "CS:  %04x DS: %04x ES: %04x CR0: %016lx\n", cs, ds,
-        printk("CR2: %016lx CR3: %016lx CR4: %016lx\n", cr2, cr3, cr4);
+                        es, cr0);
+        printk(KERN_INFO "CR2: %016lx CR3: %016lx CR4: %016lx\n", cr2, cr3,
+                        cr4);
        get_debugreg(d0, 0);
        get_debugreg(d1, 1);
        get_debugreg(d2, 2);
-        printk("DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2);
+        printk(KERN_INFO "DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2);
        get_debugreg(d3, 3);
        get_debugreg(d6, 6);
        get_debugreg(d7, 7);
-        printk("DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7);
+        printk(KERN_INFO "DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7);
 }
 void show_regs(struct pt_regs *regs)
 {
-        printk("CPU %d:", smp_processor_id());
+        printk(KERN_INFO "CPU %d:", smp_processor_id());
        __show_regs(regs);
        show_trace(NULL, regs, (void *)(regs + 1), regs->bp);
 }
@@ -322,10 +326,10 @@ void prepare_to_copy(struct task_struct *tsk)
 int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
                unsigned long unused,
-        struct task_struct * p, struct pt_regs * regs)
+        struct task_struct *p, struct pt_regs *regs)
 {
        int err;
-        struct pt_regs * childregs;
+        struct pt_regs *childregs;
        struct task_struct *me = current;
        childregs = ((struct pt_regs *)
@@ -370,10 +374,10 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
                if (test_thread_flag(TIF_IA32))
                        err = do_set_thread_area(p, -1,
                                (struct user_desc __user *)childregs->si, 0);
-                else                    
+                else
-#endif   
+#endif
-                        err = do_arch_prctl(p, ARCH_SET_FS, childregs->r8); 
+                        err = do_arch_prctl(p, ARCH_SET_FS, childregs->r8);
-                if (err) 
+                if (err)
                        goto out;
        }
        err = 0;
@@ -566,7 +570,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        unsigned fsindex, gsindex;
        /* we're going to use this soon, after a few expensive things */
-        if (next_p->fpu_counter>5)
+        if (next_p->fpu_counter > 5)
                prefetch(next->xstate);
        /*
@@ -574,13 +578,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         */
        load_sp0(tss, next);
-        /* 
+        /*
         * Switch DS and ES.
         * This won't pick up thread selector changes, but I guess that is ok.
         */
        savesegment(es, prev->es);
        if (unlikely(next->es | prev->es))
-                loadsegment(es, next->es); 
+                loadsegment(es, next->es);
        savesegment(ds, prev->ds);
        if (unlikely(next->ds | prev->ds))
@@ -606,7 +610,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         */
        arch_leave_lazy_cpu_mode();
-        /* 
+        /*
         * Switch FS and GS.
         *
         * Segment register != 0 always requires a reload.  Also
@@ -615,13 +619,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         */
        if (unlikely(fsindex | next->fsindex | prev->fs)) {
                loadsegment(fs, next->fsindex);
-                /* 
+                /*
                 * Check if the user used a selector != 0; if yes
                 *  clear 64bit base, since overloaded base is always
                 *  mapped to the Null selector
                 */
                if (fsindex)
-                        prev->fs = 0;                           
+                        prev->fs = 0;
        }
        /* when next process has a 64bit base use it */
        if (next->fs)
@@ -631,7 +635,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        if (unlikely(gsindex | next->gsindex | prev->gs)) {
                load_gs_index(next->gsindex);
                if (gsindex)
-                        prev->gs = 0;                           
+                        prev->gs = 0;
        }
        if (next->gs)
                wrmsrl(MSR_KERNEL_GS_BASE, next->gs);
@@ -640,12 +644,12 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        /* Must be after DS reload */
        unlazy_fpu(prev_p);
-        /* 
+        /*
         * Switch the PDA and FPU contexts.
         */
        prev->usersp = read_pda(oldrsp);
        write_pda(oldrsp, next->usersp);
-        write_pda(pcurrent, next_p); 
+        write_pda(pcurrent, next_p);
        write_pda(kernelstack,
                  (unsigned long)task_stack_page(next_p) +
@@ -686,7 +690,7 @@ long sys_execve(char __user *name, char __user * __user *argv,
                char __user * __user *envp, struct pt_regs *regs)
 {
        long error;
-        char * filename;
+        char *filename;
        filename = getname(name);
        error = PTR_ERR(filename);
@@ -744,55 +748,55 @@ asmlinkage long sys_vfork(struct pt_regs *regs)
 unsigned long get_wchan(struct task_struct *p)
 {
        unsigned long stack;
-        u64 fp,ip;
+        u64 fp, ip;
        int count = 0;
-        if (!p || p == current || p->state==TASK_RUNNING)
+        if (!p || p == current || p->state == TASK_RUNNING)
-                return 0; 
+                return 0;
        stack = (unsigned long)task_stack_page(p);
        if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
                return 0;
        fp = *(u64 *)(p->thread.sp);
-        do { 
+        do {
                if (fp < (unsigned long)stack ||
                    fp > (unsigned long)stack+THREAD_SIZE)
-                        return 0; 
+                        return 0;
                ip = *(u64 *)(fp+8);
                if (!in_sched_functions(ip))
                        return ip;
-                fp = *(u64 *)fp; 
+                fp = *(u64 *)fp;
-        } while (count++ < 16); 
+        } while (count++ < 16);
        return 0;
 }
 long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
-{ 
+{
-        int ret = 0; 
+        int ret = 0;
        int doit = task == current;
        int cpu;
-        switch (code) { 
+        switch (code) {
        case ARCH_SET_GS:
                if (addr >= TASK_SIZE_OF(task))
-                        return -EPERM; 
+                        return -EPERM;
                cpu = get_cpu();
-                /* handle small bases via the GDT because that's faster to 
+                /* handle small bases via the GDT because that's faster to
                   switch. */
-                if (addr <= 0xffffffff) {  
+                if (addr <= 0xffffffff) {
-                        set_32bit_tls(task, GS_TLS, addr); 
+                        set_32bit_tls(task, GS_TLS, addr);
-                        if (doit) { 
+                        if (doit) {
                                load_TLS(&task->thread, cpu);
-                                load_gs_index(GS_TLS_SEL); 
+                                load_gs_index(GS_TLS_SEL);
                        }
-                        task->thread.gsindex = GS_TLS_SEL; 
+                        task->thread.gsindex = GS_TLS_SEL;
                        task->thread.gs = 0;
-                } else { 
+                } else {
                        task->thread.gsindex = 0;
                        task->thread.gs = addr;
                        if (doit) {
                                load_gs_index(0);
                                ret = checking_wrmsrl(MSR_KERNEL_GS_BASE, addr);
-                        } 
+                        }
                }
                put_cpu();
                break;
@@ -846,8 +850,7 @@ long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
                                rdmsrl(MSR_KERNEL_GS_BASE, base);
                        else
                                base = task->thread.gs;
-                }
+                } else
-                else
                        base = task->thread.gs;
                ret = put_user(base, (unsigned long __user *)addr);
                break;
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 58ce4b50211b..e375b658efc3 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -14,6 +14,7 @@
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/regset.h>
+#include <linux/tracehook.h>
 #include <linux/user.h>
 #include <linux/elf.h>
 #include <linux/security.h>
@@ -734,7 +735,7 @@ static int ptrace_bts_config(struct task_struct *child,
                goto errout;
        if (cfg.flags & PTRACE_BTS_O_ALLOC) {
-                ds_ovfl_callback_t ovfl = 0;
+                ds_ovfl_callback_t ovfl = NULL;
                unsigned int sig = 0;
                /* we ignore the error in case we were not tracing child */
@@ -748,7 +749,7 @@ static int ptrace_bts_config(struct task_struct *child,
                        ovfl = ptrace_bts_ovfl;
                }
-                error = ds_request_bts(child, /* base = */ 0, cfg.size, ovfl);
+                error = ds_request_bts(child, /* base = */ NULL, cfg.size, ovfl);
                if (error < 0)
                        goto errout;
@@ -1086,7 +1087,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                break;
        case PTRACE_BTS_SIZE:
-                ret = ds_get_bts_index(child, /* pos = */ 0);
+                ret = ds_get_bts_index(child, /* pos = */ NULL);
                break;
        case PTRACE_BTS_GET:
@@ -1469,30 +1470,6 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
        force_sig_info(SIGTRAP, &info, tsk);
 }
-static void syscall_trace(struct pt_regs *regs)
-{
-        if (!(current->ptrace & PT_PTRACED))
-                return;
-#if 0
-        printk("trace %s ip %lx sp %lx ax %d origrax %d caller %lx tiflags %x ptrace %x\n",
-               current->comm,
-               regs->ip, regs->sp, regs->ax, regs->orig_ax, __builtin_return_address(0),
-               current_thread_info()->flags, current->ptrace);
-#endif
-        ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
-                                ? 0x80 : 0));
-        /*
-         * this isn't the same as continuing with a signal, but it will do
-         * for normal use.  strace only continues with a signal if the
-         * stopping signal is not SIGTRAP.  -brl
-         */
-        if (current->exit_code) {
-                send_sig(current->exit_code, current, 1);
-                current->exit_code = 0;
-        }
-}
 #ifdef CONFIG_X86_32
 # define IS_IA32        1
@@ -1526,8 +1503,9 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
        if (unlikely(test_thread_flag(TIF_SYSCALL_EMU)))
                ret = -1L;
-        if (ret || test_thread_flag(TIF_SYSCALL_TRACE))
+        if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) &&
-                syscall_trace(regs);
+            tracehook_report_syscall_entry(regs))
+                ret = -1L;
        if (unlikely(current->audit_context)) {
                if (IS_IA32)
@@ -1553,7 +1531,7 @@ asmregparm void syscall_trace_leave(struct pt_regs *regs)
                audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
        if (test_thread_flag(TIF_SYSCALL_TRACE))
-                syscall_trace(regs);
+                tracehook_report_syscall_exit(regs, 0);
        /*
         * If TIF_SYSCALL_EMU is set, we only get here because of
@@ -1569,6 +1547,6 @@ asmregparm void syscall_trace_leave(struct pt_regs *regs)
         * system call instruction.
         */
        if (test_thread_flag(TIF_SINGLESTEP) &&
-            (current->ptrace & PT_PTRACED))
+            tracehook_consider_fatal_signal(current, SIGTRAP, SIG_DFL))
                send_sigtrap(current, regs, 0);
 }
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 724adfc63cb9..f4c93f1cfc19 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -29,7 +29,11 @@ EXPORT_SYMBOL(pm_power_off);
 static const struct desc_ptr no_idt = {};
 static int reboot_mode;
-enum reboot_type reboot_type = BOOT_KBD;
+/*
+ * Keyboard reset and triple fault may result in INIT, not RESET, which
+ * doesn't work when we're in vmx root mode.  Try ACPI first.
+ */
+enum reboot_type reboot_type = BOOT_ACPI;
 int reboot_force;
 #if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 673f12cf6eb0..46c98efbbf8d 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -223,6 +223,9 @@ unsigned long saved_video_mode;
 #define RAMDISK_LOAD_FLAG               0x4000
 static char __initdata command_line[COMMAND_LINE_SIZE];
+#ifdef CONFIG_CMDLINE_BOOL
+static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+#endif
 #if defined(CONFIG_EDD) || defined(CONFIG_EDD_MODULE)
 struct edd edd;
@@ -665,11 +668,28 @@ void __init setup_arch(char **cmdline_p)
        bss_resource.start = virt_to_phys(&__bss_start);
        bss_resource.end = virt_to_phys(&__bss_stop)-1;
+#ifdef CONFIG_CMDLINE_BOOL
+#ifdef CONFIG_CMDLINE_OVERRIDE
+        strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+#else
+        if (builtin_cmdline[0]) {
+                /* append boot loader cmdline to builtin */
+                strlcat(builtin_cmdline, " ", COMMAND_LINE_SIZE);
+                strlcat(builtin_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+                strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+        }
+#endif
+#endif
        strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
        *cmdline_p = command_line;
        parse_early_param();
+#ifdef CONFIG_X86_64
+        check_efer();
+#endif
 #if defined(CONFIG_VMI) && defined(CONFIG_X86_32)
        /*
         * Must be before kernel pagetables are setup
@@ -738,7 +758,6 @@ void __init setup_arch(char **cmdline_p)
 #else
        num_physpages = max_pfn;
-        check_efer();
        if (cpu_has_x2apic)
                check_x2apic();
diff --git a/arch/x86/kernel/sigframe.h b/arch/x86/kernel/sigframe.h
index 6dd7e2b70a4b..cc673aa55ce4 100644
--- a/arch/x86/kernel/sigframe.h
+++ b/arch/x86/kernel/sigframe.h
@@ -34,4 +34,9 @@ struct rt_sigframe {
        struct siginfo info;
        /* fp state follows here */
 };
+int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+                sigset_t *set, struct pt_regs *regs);
+int ia32_setup_frame(int sig, struct k_sigaction *ka,
+                sigset_t *set, struct pt_regs *regs);
 #endif
diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
index 8d380b699c0c..b21070ea33a4 100644
--- a/arch/x86/kernel/signal_32.c
+++ b/arch/x86/kernel/signal_32.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
+#include <linux/tracehook.h>
 #include <linux/elf.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
@@ -556,8 +557,6 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
         * handler too.
         */
        regs->flags &= ~X86_EFLAGS_TF;
-        if (test_thread_flag(TIF_SINGLESTEP))
-                ptrace_notify(SIGTRAP);
        spin_lock_irq(&current->sighand->siglock);
        sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
@@ -566,6 +565,9 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
+        tracehook_signal_handler(sig, info, ka, regs,
+                                 test_thread_flag(TIF_SINGLESTEP));
        return 0;
 }
@@ -659,5 +661,10 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
        if (thread_info_flags & _TIF_SIGPENDING)
                do_signal(regs);
+        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
+                clear_thread_flag(TIF_NOTIFY_RESUME);
+                tracehook_notify_resume(regs);
+        }
        clear_thread_flag(TIF_IRET);
 }
diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
index 4665b598a376..823a55bf8c39 100644
--- a/arch/x86/kernel/signal_64.c
+++ b/arch/x86/kernel/signal_64.c
@@ -15,17 +15,20 @@
 #include <linux/errno.h>
 #include <linux/wait.h>
 #include <linux/ptrace.h>
+#include <linux/tracehook.h>
 #include <linux/unistd.h>
 #include <linux/stddef.h>
 #include <linux/personality.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 #include <asm/processor.h>
 #include <asm/ucontext.h>
-#include <asm/uaccess.h>
 #include <asm/i387.h>
 #include <asm/proto.h>
 #include <asm/ia32_unistd.h>
 #include <asm/mce.h>
+#include <asm/syscall.h>
 #include <asm/syscalls.h>
 #include "sigframe.h"
@@ -42,11 +45,6 @@
 # define FIX_EFLAGS     __FIX_EFLAGS
 #endif
-int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
-               sigset_t *set, struct pt_regs * regs); 
-int ia32_setup_frame(int sig, struct k_sigaction *ka,
-            sigset_t *set, struct pt_regs * regs); 
 asmlinkage long
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                struct pt_regs *regs)
@@ -66,7 +64,7 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
        /* Always make any pending restarted system calls return -EINTR */
        current_thread_info()->restart_block.fn = do_no_restart_syscall;
-#define COPY(x)         err |= __get_user(regs->x, &sc->x)
+#define COPY(x)         (err |= __get_user(regs->x, &sc->x))
        COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
        COPY(dx); COPY(cx); COPY(ip);
@@ -96,7 +94,7 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
        }
        {
-                struct _fpstate __user * buf;
+                struct _fpstate __user *buf;
                err |= __get_user(buf, &sc->fpstate);
                err |= restore_i387_xstate(buf);
        }
@@ -122,7 +120,7 @@ asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)
        current->blocked = set;
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        
        if (restore_sigcontext(regs, &frame->uc.uc_mcontext, &ax))
                goto badframe;
@@ -132,16 +130,17 @@ asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)
        return ax;
 badframe:
-        signal_fault(regs,frame,"sigreturn");
+        signal_fault(regs, frame, "sigreturn");
        return 0;
-}       
+}
 /*
 * Set up a signal frame.
 */
 static inline int
-setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs, unsigned long mask, struct task_struct *me)
+setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
+                unsigned long mask, struct task_struct *me)
 {
        int err = 0;
@@ -197,7 +196,7 @@ get_stack(struct k_sigaction *ka, struct pt_regs *regs, unsigned long size)
 }
 static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
-                           sigset_t *set, struct pt_regs * regs)
+                           sigset_t *set, struct pt_regs *regs)
 {
        struct rt_sigframe __user *frame;
        void __user *fp = NULL;
@@ -210,19 +209,19 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
                        (unsigned long)fp - sizeof(struct rt_sigframe), 16) - 8;
                if (save_i387_xstate(fp) < 0)
-                        err |= -1; 
+                        err |= -1;
        } else
                frame = get_stack(ka, regs, sizeof(struct rt_sigframe)) - 8;
        if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                goto give_sigsegv;
-        if (ka->sa.sa_flags & SA_SIGINFO) { 
+        if (ka->sa.sa_flags & SA_SIGINFO) {
                err |= copy_siginfo_to_user(&frame->info, info);
                if (err)
                        goto give_sigsegv;
        }
-                
        /* Create the ucontext.  */
        if (cpu_has_xsave)
                err |= __put_user(UC_FP_XSTATE, &frame->uc.uc_flags);
@@ -235,9 +234,9 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        err |= __put_user(me->sas_ss_size, &frame->uc.uc_stack.ss_size);
        err |= setup_sigcontext(&frame->uc.uc_mcontext, regs, set->sig[0], me);
        err |= __put_user(fp, &frame->uc.uc_mcontext.fpstate);
-        if (sizeof(*set) == 16) { 
+        if (sizeof(*set) == 16) {
                __put_user(set->sig[0], &frame->uc.uc_sigmask.sig[0]);
-                __put_user(set->sig[1], &frame->uc.uc_sigmask.sig[1]); 
+                __put_user(set->sig[1], &frame->uc.uc_sigmask.sig[1]);
        } else
                err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
@@ -248,7 +247,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
                err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
        } else {
                /* could use a vstub here */
-                goto give_sigsegv; 
+                goto give_sigsegv;
        }
        if (err)
@@ -256,7 +255,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        /* Set up registers for signal handler */
        regs->di = sig;
-        /* In case the signal handler was declared without prototypes */ 
+        /* In case the signal handler was declared without prototypes */
        regs->ax = 0;
        /* This also works for non SA_SIGINFO handlers because they expect the
@@ -279,37 +278,8 @@ give_sigsegv:
 }
 /*
- * Return -1L or the syscall number that @regs is executing.
- */
-static long current_syscall(struct pt_regs *regs)
-{
-        /*
-         * We always sign-extend a -1 value being set here,
-         * so this is always either -1L or a syscall number.
-         */
-        return regs->orig_ax;
-}
-/*
- * Return a value that is -EFOO if the system call in @regs->orig_ax
- * returned an error.  This only works for @regs from @current.
- */
-static long current_syscall_ret(struct pt_regs *regs)
-{
-#ifdef CONFIG_IA32_EMULATION
-        if (test_thread_flag(TIF_IA32))
-                /*
-                 * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
-                 * and will match correctly in comparisons.
-                 */
-                return (int) regs->ax;
-#endif
-        return regs->ax;
-}
-/*
 * OK, we're invoking a handler
- */     
+ */
 static int
 handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
@@ -318,9 +288,9 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
        int ret;
        /* Are we from a system call? */
-        if (current_syscall(regs) >= 0) {
+        if (syscall_get_nr(current, regs) >= 0) {
                /* If so, check system call restarting.. */
-                switch (current_syscall_ret(regs)) {
+                switch (syscall_get_error(current, regs)) {
                case -ERESTART_RESTARTBLOCK:
                case -ERESTARTNOHAND:
                        regs->ax = -EINTR;
@@ -353,7 +323,7 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
                        ret = ia32_setup_rt_frame(sig, ka, info, oldset, regs);
                else
                        ret = ia32_setup_frame(sig, ka, oldset, regs);
-        } else 
+        } else
 #endif
        ret = setup_rt_frame(sig, ka, info, oldset, regs);
@@ -377,15 +347,16 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
                 * handler too.
                 */
                regs->flags &= ~X86_EFLAGS_TF;
-                if (test_thread_flag(TIF_SINGLESTEP))
-                        ptrace_notify(SIGTRAP);
                spin_lock_irq(&current->sighand->siglock);
-                sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
+                sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
                if (!(ka->sa.sa_flags & SA_NODEFER))
-                        sigaddset(&current->blocked,sig);
+                        sigaddset(&current->blocked, sig);
                recalc_sigpending();
                spin_unlock_irq(&current->sighand->siglock);
+                tracehook_signal_handler(sig, info, ka, regs,
+                                         test_thread_flag(TIF_SINGLESTEP));
        }
        return ret;
@@ -442,9 +413,9 @@ static void do_signal(struct pt_regs *regs)
        }
        /* Did we come from a system call? */
-        if (current_syscall(regs) >= 0) {
+        if (syscall_get_nr(current, regs) >= 0) {
                /* Restart the system call - no handlers present */
-                switch (current_syscall_ret(regs)) {
+                switch (syscall_get_error(current, regs)) {
                case -ERESTARTNOHAND:
                case -ERESTARTSYS:
                case -ERESTARTNOINTR:
@@ -482,17 +453,23 @@ void do_notify_resume(struct pt_regs *regs, void *unused,
        /* deal with pending signal delivery */
        if (thread_info_flags & _TIF_SIGPENDING)
                do_signal(regs);
+        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
+                clear_thread_flag(TIF_NOTIFY_RESUME);
+                tracehook_notify_resume(regs);
+        }
 }
 void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
-{ 
+{
-        struct task_struct *me = current; 
+        struct task_struct *me = current;
        if (show_unhandled_signals && printk_ratelimit()) {
                printk("%s[%d] bad frame in %s frame:%p ip:%lx sp:%lx orax:%lx",
-               me->comm,me->pid,where,frame,regs->ip,regs->sp,regs->orig_ax);
+               me->comm, me->pid, where, frame, regs->ip,
+                   regs->sp, regs->orig_ax);
                print_vma_addr(" in ", regs->ip);
                printk("\n");
        }
-        force_sig(SIGSEGV, me); 
+        force_sig(SIGSEGV, me);
-} 
+}
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index aa804c64b167..2ff0bbcd5bd1 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1313,16 +1313,13 @@ __init void prefill_possible_map(void)
        if (!num_processors)
                num_processors = 1;
-#ifdef CONFIG_HOTPLUG_CPU
        if (additional_cpus == -1) {
                if (disabled_cpus > 0)
                        additional_cpus = disabled_cpus;
                else
                        additional_cpus = 0;
        }
-#else
-        additional_cpus = 0;
-#endif
        possible = num_processors + additional_cpus;
        if (possible > NR_CPUS)
                possible = NR_CPUS;
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index c9288c883e20..6bc211accf08 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -13,16 +13,17 @@
 #include <linux/utsname.h>
 #include <linux/personality.h>
 #include <linux/random.h>
+#include <linux/uaccess.h>
-#include <asm/uaccess.h>
 #include <asm/ia32.h>
 #include <asm/syscalls.h>
-asmlinkage long sys_mmap(unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags,
+asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
-        unsigned long fd, unsigned long off)
+                unsigned long prot, unsigned long flags,
+                unsigned long fd, unsigned long off)
 {
        long error;
-        struct file * file;
+        struct file *file;
        error = -EINVAL;
        if (off & ~PAGE_MASK)
@@ -57,9 +58,9 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                   unmapped base down for this case. This can give
                   conflicts with the heap, but we assume that glibc
                   malloc knows how to fall back to mmap. Give it 1GB
-                   of playground for now. -AK */ 
+                   of playground for now. -AK */
-                *begin = 0x40000000; 
+                *begin = 0x40000000;
-                *end = 0x80000000;              
+                *end = 0x80000000;
                if (current->flags & PF_RANDOMIZE) {
                        new_begin = randomize_range(*begin, *begin + 0x02000000, 0);
                        if (new_begin)
@@ -67,9 +68,9 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                }
        } else {
                *begin = TASK_UNMAPPED_BASE;
-                *end = TASK_SIZE; 
+                *end = TASK_SIZE;
        }
-} 
+}
 unsigned long
 arch_get_unmapped_area(struct file *filp, unsigned long addr,
@@ -79,11 +80,11 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
        struct vm_area_struct *vma;
        unsigned long start_addr;
        unsigned long begin, end;
-        
        if (flags & MAP_FIXED)
                return addr;
-        find_start_end(flags, &begin, &end); 
+        find_start_end(flags, &begin, &end);
        if (len > end)
                return -ENOMEM;
@@ -97,12 +98,12 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
        }
        if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
            && len <= mm->cached_hole_size) {
-                mm->cached_hole_size = 0;
+                mm->cached_hole_size = 0;
                mm->free_area_cache = begin;
        }
        addr = mm->free_area_cache;
-        if (addr < begin) 
+        if (addr < begin)
-                addr = begin; 
+                addr = begin;
        start_addr = addr;
 full_search:
@@ -128,7 +129,7 @@ full_search:
                        return addr;
                }
                if (addr + mm->cached_hole_size < vma->vm_start)
-                        mm->cached_hole_size = vma->vm_start - addr;
+                        mm->cached_hole_size = vma->vm_start - addr;
                addr = vma->vm_end;
        }
@@ -178,7 +179,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                vma = find_vma(mm, addr-len);
                if (!vma || addr <= vma->vm_start)
                        /* remember the address as a hint for next time */
-                        return (mm->free_area_cache = addr-len);
+                        return mm->free_area_cache = addr-len;
        }
        if (mm->mmap_base < len)
@@ -195,7 +196,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                vma = find_vma(mm, addr);
                if (!vma || addr+len <= vma->vm_start)
                        /* remember the address as a hint for next time */
-                        return (mm->free_area_cache = addr);
+                        return mm->free_area_cache = addr;
                /* remember the largest hole we saw so far */
                if (addr + mm->cached_hole_size < vma->vm_start)
@@ -225,13 +226,13 @@ bottomup:
 }
-asmlinkage long sys_uname(struct new_utsname __user * name)
+asmlinkage long sys_uname(struct new_utsname __user *name)
 {
        int err;
        down_read(&uts_sem);
-        err = copy_to_user(name, utsname(), sizeof (*name));
+        err = copy_to_user(name, utsname(), sizeof(*name));
        up_read(&uts_sem);
-        if (personality(current->personality) == PER_LINUX32) 
+        if (personality(current->personality) == PER_LINUX32)
-                err |= copy_to_user(&name->machine, "i686", 5);                 
+                err |= copy_to_user(&name->machine, "i686", 5);
        return err ? -EFAULT : 0;
 }
diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
index b42068fb7b76..2887a789e38f 100644
--- a/arch/x86/kernel/traps_64.c
+++ b/arch/x86/kernel/traps_64.c
@@ -32,6 +32,8 @@
 #include <linux/bug.h>
 #include <linux/nmi.h>
 #include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/io.h>
 #if defined(CONFIG_EDAC)
 #include <linux/edac.h>
@@ -45,9 +47,6 @@
 #include <asm/unwind.h>
 #include <asm/desc.h>
 #include <asm/i387.h>
-#include <asm/nmi.h>
-#include <asm/smp.h>
-#include <asm/io.h>
 #include <asm/pgalloc.h>
 #include <asm/proto.h>
 #include <asm/pda.h>
@@ -85,7 +84,8 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
 void printk_address(unsigned long address, int reliable)
 {
-        printk(" [<%016lx>] %s%pS\n", address, reliable ? "": "? ", (void *) address);
+        printk(" [<%016lx>] %s%pS\n",
+                        address, reliable ?     "" : "? ", (void *) address);
 }
 static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
@@ -98,7 +98,8 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
                [STACKFAULT_STACK - 1] = "#SS",
                [MCE_STACK - 1] = "#MC",
 #if DEBUG_STKSZ > EXCEPTION_STKSZ
-                [N_EXCEPTION_STACKS ... N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
+                [N_EXCEPTION_STACKS ...
+                        N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
 #endif
        };
        unsigned k;
@@ -163,7 +164,7 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
 }
 /*
- * x86-64 can have up to three kernel stacks: 
+ * x86-64 can have up to three kernel stacks:
 * process stack
 * interrupt stack
 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
@@ -219,7 +220,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                const struct stacktrace_ops *ops, void *data)
 {
        const unsigned cpu = get_cpu();
-        unsigned long *irqstack_end = (unsigned long*)cpu_pda(cpu)->irqstackptr;
+        unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
        unsigned used = 0;
        struct thread_info *tinfo;
@@ -237,7 +238,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
        if (!bp) {
                if (task == current) {
                        /* Grab bp right from our regs */
-                        asm("movq %%rbp, %0" : "=r" (bp) :);
+                        asm("movq %%rbp, %0" : "=r" (bp) : );
                } else {
                        /* bp is the last reg pushed by switch_to */
                        bp = *(unsigned long *) task->thread.sp;
@@ -356,11 +357,15 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
        unsigned long *stack;
        int i;
        const int cpu = smp_processor_id();
-        unsigned long *irqstack_end = (unsigned long *) (cpu_pda(cpu)->irqstackptr);
+        unsigned long *irqstack_end =
-        unsigned long *irqstack = (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
+                (unsigned long *) (cpu_pda(cpu)->irqstackptr);
+        unsigned long *irqstack =
+                (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
-        // debugging aid: "show_stack(NULL, NULL);" prints the
+        /*
-        // back trace for this cpu.
+         * debugging aid: "show_stack(NULL, NULL);" prints the
+         * back trace for this cpu.
+         */
        if (sp == NULL) {
                if (task)
@@ -404,7 +409,7 @@ void dump_stack(void)
 #ifdef CONFIG_FRAME_POINTER
        if (!bp)
-                asm("movq %%rbp, %0" : "=r" (bp):);
+                asm("movq %%rbp, %0" : "=r" (bp) : );
 #endif
        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
@@ -414,7 +419,6 @@ void dump_stack(void)
                init_utsname()->version);
        show_trace(NULL, NULL, &stack, bp);
 }
 EXPORT_SYMBOL(dump_stack);
 void show_registers(struct pt_regs *regs)
@@ -492,7 +496,7 @@ unsigned __kprobes long oops_begin(void)
        raw_local_irq_save(flags);
        cpu = smp_processor_id();
        if (!__raw_spin_trylock(&die_lock)) {
-                if (cpu == die_owner) 
+                if (cpu == die_owner)
                        /* nested oops. should stop eventually */;
                else
                        __raw_spin_lock(&die_lock);
@@ -637,7 +641,7 @@ kernel_trap:
 }
 #define DO_ERROR(trapnr, signr, str, name) \
-asmlinkage void do_##name(struct pt_regs * regs, long error_code)       \
+asmlinkage void do_##name(struct pt_regs *regs, long error_code)        \
 {                                                                       \
        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
                                                        == NOTIFY_STOP) \
@@ -647,7 +651,7 @@ asmlinkage void do_##name(struct pt_regs * regs, long error_code)	\
 }
 #define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr)         \
-asmlinkage void do_##name(struct pt_regs * regs, long error_code)       \
+asmlinkage void do_##name(struct pt_regs *regs, long error_code)        \
 {                                                                       \
        siginfo_t info;                                                 \
        info.si_signo = signr;                                          \
@@ -682,7 +686,7 @@ asmlinkage void do_stack_segment(struct pt_regs *regs, long error_code)
        preempt_conditional_cli(regs);
 }
-asmlinkage void do_double_fault(struct pt_regs * regs, long error_code)
+asmlinkage void do_double_fault(struct pt_regs *regs, long error_code)
 {
        static const char str[] = "double fault";
        struct task_struct *tsk = current;
@@ -777,9 +781,10 @@ io_check_error(unsigned char reason, struct pt_regs *regs)
 }
 static notrace __kprobes void
-unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
+unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
 {
-        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) == NOTIFY_STOP)
+        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) ==
+                        NOTIFY_STOP)
                return;
        printk(KERN_EMERG "Uhhuh. NMI received for unknown reason %02x.\n",
                reason);
@@ -881,7 +886,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
        else if (user_mode(eregs))
                regs = task_pt_regs(current);
        /* Exception from kernel and interrupts are enabled. Move to
-           kernel process stack. */
+           kernel process stack. */
        else if (eregs->flags & X86_EFLAGS_IF)
                regs = (struct pt_regs *)(eregs->sp -= sizeof(struct pt_regs));
        if (eregs != regs)
@@ -890,7 +895,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
 }
 /* runs on IST stack. */
-asmlinkage void __kprobes do_debug(struct pt_regs * regs,
+asmlinkage void __kprobes do_debug(struct pt_regs *regs,
                                   unsigned long error_code)
 {
        struct task_struct *tsk = current;
@@ -1034,7 +1039,7 @@ asmlinkage void do_coprocessor_error(struct pt_regs *regs)
 asmlinkage void bad_intr(void)
 {
-        printk("bad interrupt"); 
+        printk("bad interrupt");
 }
 asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
@@ -1046,7 +1051,7 @@ asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
        conditional_sti(regs);
        if (!user_mode(regs) &&
-                kernel_math_error(regs, "kernel simd math error", 19))
+                        kernel_math_error(regs, "kernel simd math error", 19))
                return;
        /*
@@ -1091,7 +1096,7 @@ asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
        force_sig_info(SIGFPE, &info, task);
 }
-asmlinkage void do_spurious_interrupt_bug(struct pt_regs * regs)
+asmlinkage void do_spurious_interrupt_bug(struct pt_regs *regs)
 {
 }
@@ -1148,8 +1153,10 @@ void __init trap_init(void)
        set_intr_gate(0, &divide_error);
        set_intr_gate_ist(1, &debug, DEBUG_STACK);
        set_intr_gate_ist(2, &nmi, NMI_STACK);
-        set_system_gate_ist(3, &int3, DEBUG_STACK); /* int3 can be called from all */
+        /* int3 can be called from all */
-        set_system_gate(4, &overflow); /* int4 can be called from all */
+        set_system_gate_ist(3, &int3, DEBUG_STACK);
+        /* int4 can be called from all */
+        set_system_gate(4, &overflow);
        set_intr_gate(5, &bounds);
        set_intr_gate(6, &invalid_op);
        set_intr_gate(7, &device_not_available);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 8f98e9de1b82..161bb850fc47 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -104,7 +104,7 @@ __setup("notsc", notsc_setup);
 /*
 * Read TSC and the reference counters. Take care of SMI disturbance
 */
-static u64 tsc_read_refs(u64 *pm, u64 *hpet)
+static u64 tsc_read_refs(u64 *p, int hpet)
 {
        u64 t1, t2;
        int i;
@@ -112,9 +112,9 @@ static u64 tsc_read_refs(u64 *pm, u64 *hpet)
        for (i = 0; i < MAX_RETRIES; i++) {
                t1 = get_cycles();
                if (hpet)
-                        *hpet = hpet_readl(HPET_COUNTER) & 0xFFFFFFFF;
+                        *p = hpet_readl(HPET_COUNTER) & 0xFFFFFFFF;
                else
-                        *pm = acpi_pm_read_early();
+                        *p = acpi_pm_read_early();
                t2 = get_cycles();
                if ((t2 - t1) < SMI_TRESHOLD)
                        return t2;
@@ -123,13 +123,59 @@ static u64 tsc_read_refs(u64 *pm, u64 *hpet)
 }
 /*
+ * Calculate the TSC frequency from HPET reference
+ */
+static unsigned long calc_hpet_ref(u64 deltatsc, u64 hpet1, u64 hpet2)
+{
+        u64 tmp;
+        if (hpet2 < hpet1)
+                hpet2 += 0x100000000ULL;
+        hpet2 -= hpet1;
+        tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
+        do_div(tmp, 1000000);
+        do_div(deltatsc, tmp);
+        return (unsigned long) deltatsc;
+}
+/*
+ * Calculate the TSC frequency from PMTimer reference
+ */
+static unsigned long calc_pmtimer_ref(u64 deltatsc, u64 pm1, u64 pm2)
+{
+        u64 tmp;
+        if (!pm1 && !pm2)
+                return ULONG_MAX;
+        if (pm2 < pm1)
+                pm2 += (u64)ACPI_PM_OVRRUN;
+        pm2 -= pm1;
+        tmp = pm2 * 1000000000LL;
+        do_div(tmp, PMTMR_TICKS_PER_SEC);
+        do_div(deltatsc, tmp);
+        return (unsigned long) deltatsc;
+}
+#define CAL_MS          10
+#define CAL_LATCH       (CLOCK_TICK_RATE / (1000 / CAL_MS))
+#define CAL_PIT_LOOPS   1000
+#define CAL2_MS         50
+#define CAL2_LATCH      (CLOCK_TICK_RATE / (1000 / CAL2_MS))
+#define CAL2_PIT_LOOPS  5000
+/*
 * Try to calibrate the TSC against the Programmable
 * Interrupt Timer and return the frequency of the TSC
 * in kHz.
 *
 * Return ULONG_MAX on failure to calibrate.
 */
-static unsigned long pit_calibrate_tsc(void)
+static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
 {
        u64 tsc, t1, t2, delta;
        unsigned long tscmin, tscmax;
@@ -144,8 +190,8 @@ static unsigned long pit_calibrate_tsc(void)
         * (LSB then MSB) to begin countdown.
         */
        outb(0xb0, 0x43);
-        outb((CLOCK_TICK_RATE / (1000 / 50)) & 0xff, 0x42);
+        outb(latch & 0xff, 0x42);
-        outb((CLOCK_TICK_RATE / (1000 / 50)) >> 8, 0x42);
+        outb(latch >> 8, 0x42);
        tsc = t1 = t2 = get_cycles();
@@ -166,31 +212,154 @@ static unsigned long pit_calibrate_tsc(void)
        /*
         * Sanity checks:
         *
-         * If we were not able to read the PIT more than 5000
+         * If we were not able to read the PIT more than loopmin
         * times, then we have been hit by a massive SMI
         *
         * If the maximum is 10 times larger than the minimum,
         * then we got hit by an SMI as well.
         */
-        if (pitcnt < 5000 || tscmax > 10 * tscmin)
+        if (pitcnt < loopmin || tscmax > 10 * tscmin)
                return ULONG_MAX;
        /* Calculate the PIT value */
        delta = t2 - t1;
-        do_div(delta, 50);
+        do_div(delta, ms);
        return delta;
 }
+/*
+ * This reads the current MSB of the PIT counter, and
+ * checks if we are running on sufficiently fast and
+ * non-virtualized hardware.
+ *
+ * Our expectations are:
+ *
+ *  - the PIT is running at roughly 1.19MHz
+ *
+ *  - each IO is going to take about 1us on real hardware,
+ *    but we allow it to be much faster (by a factor of 10) or
+ *    _slightly_ slower (ie we allow up to a 2us read+counter
+ *    update - anything else implies a unacceptably slow CPU
+ *    or PIT for the fast calibration to work.
+ *
+ *  - with 256 PIT ticks to read the value, we have 214us to
+ *    see the same MSB (and overhead like doing a single TSC
+ *    read per MSB value etc).
+ *
+ *  - We're doing 2 reads per loop (LSB, MSB), and we expect
+ *    them each to take about a microsecond on real hardware.
+ *    So we expect a count value of around 100. But we'll be
+ *    generous, and accept anything over 50.
+ *
+ *  - if the PIT is stuck, and we see *many* more reads, we
+ *    return early (and the next caller of pit_expect_msb()
+ *    then consider it a failure when they don't see the
+ *    next expected value).
+ *
+ * These expectations mean that we know that we have seen the
+ * transition from one expected value to another with a fairly
+ * high accuracy, and we didn't miss any events. We can thus
+ * use the TSC value at the transitions to calculate a pretty
+ * good value for the TSC frequencty.
+ */
+static inline int pit_expect_msb(unsigned char val)
+{
+        int count = 0;
+        for (count = 0; count < 50000; count++) {
+                /* Ignore LSB */
+                inb(0x42);
+                if (inb(0x42) != val)
+                        break;
+        }
+        return count > 50;
+}
+/*
+ * How many MSB values do we want to see? We aim for a
+ * 15ms calibration, which assuming a 2us counter read
+ * error should give us roughly 150 ppm precision for
+ * the calibration.
+ */
+#define QUICK_PIT_MS 15
+#define QUICK_PIT_ITERATIONS (QUICK_PIT_MS * PIT_TICK_RATE / 1000 / 256)
+static unsigned long quick_pit_calibrate(void)
+{
+        /* Set the Gate high, disable speaker */
+        outb((inb(0x61) & ~0x02) | 0x01, 0x61);
+        /*
+         * Counter 2, mode 0 (one-shot), binary count
+         *
+         * NOTE! Mode 2 decrements by two (and then the
+         * output is flipped each time, giving the same
+         * final output frequency as a decrement-by-one),
+         * so mode 0 is much better when looking at the
+         * individual counts.
+         */
+        outb(0xb0, 0x43);
+        /* Start at 0xffff */
+        outb(0xff, 0x42);
+        outb(0xff, 0x42);
+        if (pit_expect_msb(0xff)) {
+                int i;
+                u64 t1, t2, delta;
+                unsigned char expect = 0xfe;
+                t1 = get_cycles();
+                for (i = 0; i < QUICK_PIT_ITERATIONS; i++, expect--) {
+                        if (!pit_expect_msb(expect))
+                                goto failed;
+                }
+                t2 = get_cycles();
+                /*
+                 * Make sure we can rely on the second TSC timestamp:
+                 */
+                if (!pit_expect_msb(expect))
+                        goto failed;
+                /*
+                 * Ok, if we get here, then we've seen the
+                 * MSB of the PIT decrement QUICK_PIT_ITERATIONS
+                 * times, and each MSB had many hits, so we never
+                 * had any sudden jumps.
+                 *
+                 * As a result, we can depend on there not being
+                 * any odd delays anywhere, and the TSC reads are
+                 * reliable.
+                 *
+                 * kHz = ticks / time-in-seconds / 1000;
+                 * kHz = (t2 - t1) / (QPI * 256 / PIT_TICK_RATE) / 1000
+                 * kHz = ((t2 - t1) * PIT_TICK_RATE) / (QPI * 256 * 1000)
+                 */
+                delta = (t2 - t1)*PIT_TICK_RATE;
+                do_div(delta, QUICK_PIT_ITERATIONS*256*1000);
+                printk("Fast TSC calibration using PIT\n");
+                return delta;
+        }
+failed:
+        return 0;
+}
 /**
 * native_calibrate_tsc - calibrate the tsc on boot
 */
 unsigned long native_calibrate_tsc(void)
 {
-        u64 tsc1, tsc2, delta, pm1, pm2, hpet1, hpet2;
+        u64 tsc1, tsc2, delta, ref1, ref2;
        unsigned long tsc_pit_min = ULONG_MAX, tsc_ref_min = ULONG_MAX;
-        unsigned long flags;
+        unsigned long flags, latch, ms, fast_calibrate;
-        int hpet = is_hpet_enabled(), i;
+        int hpet = is_hpet_enabled(), i, loopmin;
+        local_irq_save(flags);
+        fast_calibrate = quick_pit_calibrate();
+        local_irq_restore(flags);
+        if (fast_calibrate)
+                return fast_calibrate;
        /*
         * Run 5 calibration loops to get the lowest frequency value
@@ -216,7 +385,13 @@ unsigned long native_calibrate_tsc(void)
         * calibration delay loop as we have to wait for a certain
         * amount of time anyway.
         */
-        for (i = 0; i < 5; i++) {
+        /* Preset PIT loop values */
+        latch = CAL_LATCH;
+        ms = CAL_MS;
+        loopmin = CAL_PIT_LOOPS;
+        for (i = 0; i < 3; i++) {
                unsigned long tsc_pit_khz;
                /*
@@ -226,16 +401,16 @@ unsigned long native_calibrate_tsc(void)
                 * read the end value.
                 */
                local_irq_save(flags);
-                tsc1 = tsc_read_refs(&pm1, hpet ? &hpet1 : NULL);
+                tsc1 = tsc_read_refs(&ref1, hpet);
-                tsc_pit_khz = pit_calibrate_tsc();
+                tsc_pit_khz = pit_calibrate_tsc(latch, ms, loopmin);
-                tsc2 = tsc_read_refs(&pm2, hpet ? &hpet2 : NULL);
+                tsc2 = tsc_read_refs(&ref2, hpet);
                local_irq_restore(flags);
                /* Pick the lowest PIT TSC calibration so far */
                tsc_pit_min = min(tsc_pit_min, tsc_pit_khz);
                /* hpet or pmtimer available ? */
-                if (!hpet && !pm1 && !pm2)
+                if (!hpet && !ref1 && !ref2)
                        continue;
                /* Check, whether the sampling was disturbed by an SMI */
@@ -243,23 +418,41 @@ unsigned long native_calibrate_tsc(void)
                        continue;
                tsc2 = (tsc2 - tsc1) * 1000000LL;
+                if (hpet)
+                        tsc2 = calc_hpet_ref(tsc2, ref1, ref2);
+                else
+                        tsc2 = calc_pmtimer_ref(tsc2, ref1, ref2);
-                if (hpet) {
+                tsc_ref_min = min(tsc_ref_min, (unsigned long) tsc2);
-                        if (hpet2 < hpet1)
-                                hpet2 += 0x100000000ULL;
+                /* Check the reference deviation */
-                        hpet2 -= hpet1;
+                delta = ((u64) tsc_pit_min) * 100;
-                        tsc1 = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
+                do_div(delta, tsc_ref_min);
-                        do_div(tsc1, 1000000);
-                } else {
+                /*
-                        if (pm2 < pm1)
+                 * If both calibration results are inside a 10% window
-                                pm2 += (u64)ACPI_PM_OVRRUN;
+                 * then we can be sure, that the calibration
-                        pm2 -= pm1;
+                 * succeeded. We break out of the loop right away. We
-                        tsc1 = pm2 * 1000000000LL;
+                 * use the reference value, as it is more precise.
-                        do_div(tsc1, PMTMR_TICKS_PER_SEC);
+                 */
+                if (delta >= 90 && delta <= 110) {
+                        printk(KERN_INFO
+                               "TSC: PIT calibration matches %s. %d loops\n",
+                               hpet ? "HPET" : "PMTIMER", i + 1);
+                        return tsc_ref_min;
                }
-                do_div(tsc2, tsc1);
+                /*
-                tsc_ref_min = min(tsc_ref_min, (unsigned long) tsc2);
+                 * Check whether PIT failed more than once. This
+                 * happens in virtualized environments. We need to
+                 * give the virtual PC a slightly longer timeframe for
+                 * the HPET/PMTIMER to make the result precise.
+                 */
+                if (i == 1 && tsc_pit_min == ULONG_MAX) {
+                        latch = CAL2_LATCH;
+                        ms = CAL2_MS;
+                        loopmin = CAL2_PIT_LOOPS;
+                }
        }
        /*
@@ -270,7 +463,7 @@ unsigned long native_calibrate_tsc(void)
                printk(KERN_WARNING "TSC: Unable to calibrate against PIT\n");
                /* We don't have an alternative source, disable TSC */
-                if (!hpet && !pm1 && !pm2) {
+                if (!hpet && !ref1 && !ref2) {
                        printk("TSC: No reference (HPET/PMTIMER) available\n");
                        return 0;
                }
@@ -278,7 +471,7 @@ unsigned long native_calibrate_tsc(void)
                /* The alternative source failed as well, disable TSC */
                if (tsc_ref_min == ULONG_MAX) {
                        printk(KERN_WARNING "TSC: HPET/PMTIMER calibration "
-                               "failed due to SMI disturbance.\n");
+                               "failed.\n");
                        return 0;
                }
@@ -290,44 +483,25 @@ unsigned long native_calibrate_tsc(void)
        }
        /* We don't have an alternative source, use the PIT calibration value */
-        if (!hpet && !pm1 && !pm2) {
+        if (!hpet && !ref1 && !ref2) {
                printk(KERN_INFO "TSC: Using PIT calibration value\n");
                return tsc_pit_min;
        }
        /* The alternative source failed, use the PIT calibration value */
        if (tsc_ref_min == ULONG_MAX) {
-                printk(KERN_WARNING "TSC: HPET/PMTIMER calibration failed due "
+                printk(KERN_WARNING "TSC: HPET/PMTIMER calibration failed. "
-                       "to SMI disturbance. Using PIT calibration\n");
+                       "Using PIT calibration\n");
                return tsc_pit_min;
        }
-        /* Check the reference deviation */
-        delta = ((u64) tsc_pit_min) * 100;
-        do_div(delta, tsc_ref_min);
-        /*
-         * If both calibration results are inside a 5% window, the we
-         * use the lower frequency of those as it is probably the
-         * closest estimate.
-         */
-        if (delta >= 95 && delta <= 105) {
-                printk(KERN_INFO "TSC: PIT calibration confirmed by %s.\n",
-                       hpet ? "HPET" : "PMTIMER");
-                printk(KERN_INFO "TSC: using %s calibration value\n",
-                       tsc_pit_min <= tsc_ref_min ? "PIT" :
-                       hpet ? "HPET" : "PMTIMER");
-                return tsc_pit_min <= tsc_ref_min ? tsc_pit_min : tsc_ref_min;
-        }
-        printk(KERN_WARNING "TSC: PIT calibration deviates from %s: %lu %lu.\n",
-               hpet ? "HPET" : "PMTIMER", tsc_pit_min, tsc_ref_min);
        /*
         * The calibration values differ too much. In doubt, we use
         * the PIT value as we know that there are PMTIMERs around
-         * running at double speed.
+         * running at double speed. At least we let the user know:
         */
+        printk(KERN_WARNING "TSC: PIT calibration deviates from %s: %lu %lu.\n",
+               hpet ? "HPET" : "PMTIMER", tsc_pit_min, tsc_ref_min);
        printk(KERN_INFO "TSC: Using PIT calibration value\n");
        return tsc_pit_min;
 }
diff --git a/arch/x86/kernel/visws_quirks.c b/arch/x86/kernel/visws_quirks.c
index 594ef47f0a63..61a97e616f70 100644
--- a/arch/x86/kernel/visws_quirks.c
+++ b/arch/x86/kernel/visws_quirks.c
@@ -25,45 +25,31 @@
 #include <asm/visws/cobalt.h>
 #include <asm/visws/piix4.h>
 #include <asm/arch_hooks.h>
+#include <asm/io_apic.h>
 #include <asm/fixmap.h>
 #include <asm/reboot.h>
 #include <asm/setup.h>
 #include <asm/e820.h>
-#include <asm/smp.h>
 #include <asm/io.h>
 #include <mach_ipi.h>
 #include "mach_apic.h"
-#include <linux/init.h>
-#include <linux/smp.h>
 #include <linux/kernel_stat.h>
-#include <linux/interrupt.h>
-#include <linux/init.h>
-#include <asm/io.h>
-#include <asm/apic.h>
 #include <asm/i8259.h>
 #include <asm/irq_vectors.h>
-#include <asm/visws/cobalt.h>
 #include <asm/visws/lithium.h>
-#include <asm/visws/piix4.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/pci_ids.h>
 extern int no_broadcast;
-#include <asm/io.h>
 #include <asm/apic.h>
-#include <asm/arch_hooks.h>
-#include <asm/visws/cobalt.h>
-#include <asm/visws/lithium.h>
 char visws_board_type   = -1;
 char visws_board_rev    = -1;
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index 61531d5c9507..8b6c393ab9fd 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -235,7 +235,7 @@ static void vmi_write_ldt_entry(struct desc_struct *dt, int entry,
                                const void *desc)
 {
        u32 *ldt_entry = (u32 *)desc;
-        vmi_ops.write_idt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
+        vmi_ops.write_ldt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
 }
 static void vmi_load_sp0(struct tss_struct *tss,
@@ -393,13 +393,13 @@ static void *vmi_kmap_atomic_pte(struct page *page, enum km_type type)
 }
 #endif
-static void vmi_allocate_pte(struct mm_struct *mm, u32 pfn)
+static void vmi_allocate_pte(struct mm_struct *mm, unsigned long pfn)
 {
        vmi_set_page_type(pfn, VMI_PAGE_L1);
        vmi_ops.allocate_page(pfn, VMI_PAGE_L1, 0, 0, 0);
 }
-static void vmi_allocate_pmd(struct mm_struct *mm, u32 pfn)
+static void vmi_allocate_pmd(struct mm_struct *mm, unsigned long pfn)
 {
        /*
         * This call comes in very early, before mem_map is setup.
@@ -410,20 +410,20 @@ static void vmi_allocate_pmd(struct mm_struct *mm, u32 pfn)
        vmi_ops.allocate_page(pfn, VMI_PAGE_L2, 0, 0, 0);
 }
-static void vmi_allocate_pmd_clone(u32 pfn, u32 clonepfn, u32 start, u32 count)
+static void vmi_allocate_pmd_clone(unsigned long pfn, unsigned long clonepfn, unsigned long start, unsigned long count)
 {
        vmi_set_page_type(pfn, VMI_PAGE_L2 | VMI_PAGE_CLONE);
        vmi_check_page_type(clonepfn, VMI_PAGE_L2);
        vmi_ops.allocate_page(pfn, VMI_PAGE_L2 | VMI_PAGE_CLONE, clonepfn, start, count);
 }
-static void vmi_release_pte(u32 pfn)
+static void vmi_release_pte(unsigned long pfn)
 {
        vmi_ops.release_page(pfn, VMI_PAGE_L1);
        vmi_set_page_type(pfn, VMI_PAGE_NORMAL);
 }
-static void vmi_release_pmd(u32 pfn)
+static void vmi_release_pmd(unsigned long pfn)
 {
        vmi_ops.release_page(pfn, VMI_PAGE_L2);
        vmi_set_page_type(pfn, VMI_PAGE_NORMAL);
diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
index 0c029e8959c7..7766d36983fc 100644
--- a/arch/x86/kernel/vsmp_64.c
+++ b/arch/x86/kernel/vsmp_64.c
@@ -61,7 +61,7 @@ static void vsmp_irq_enable(void)
        native_restore_fl((flags | X86_EFLAGS_IF) & (~X86_EFLAGS_AC));
 }
-static unsigned __init vsmp_patch(u8 type, u16 clobbers, void *ibuf,
+static unsigned __init_or_module vsmp_patch(u8 type, u16 clobbers, void *ibuf,
                                  unsigned long addr, unsigned len)
 {
        switch (type) {
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 0bfe2bd305eb..3da2508eb22a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -711,6 +711,10 @@ static int kvm_age_rmapp(struct kvm *kvm, unsigned long *rmapp)
        u64 *spte;
        int young = 0;
+        /* always return old for EPT */
+        if (!shadow_accessed_mask)
+                return 0;
        spte = rmap_next(kvm, rmapp, NULL);
        while (spte) {
                int _young;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e2ee264740c7..8233b86c778c 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -62,6 +62,7 @@ static int npt = 1;
 module_param(npt, int, S_IRUGO);
 static void kvm_reput_irq(struct vcpu_svm *svm);
+static void svm_flush_tlb(struct kvm_vcpu *vcpu);
 static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
 {
@@ -878,6 +879,10 @@ set:
 static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
        unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
+        unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
+        if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
+                force_new_asid(vcpu);
        vcpu->arch.cr4 = cr4;
        if (!npt_enabled)
@@ -1027,6 +1032,13 @@ static int pf_interception(struct vcpu_svm *svm, struct kvm_run *kvm_run)
                KVMTRACE_3D(TDP_FAULT, &svm->vcpu, error_code,
                            (u32)fault_address, (u32)(fault_address >> 32),
                            handler);
+        /*
+         * FIXME: Tis shouldn't be necessary here, but there is a flush
+         * missing in the MMU code. Until we find this bug, flush the
+         * complete TLB here on an NPF
+         */
+        if (npt_enabled)
+                svm_flush_tlb(&svm->vcpu);
        if (event_injection)
                kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 2a69773e3b26..7041cc52b562 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -3301,8 +3301,7 @@ static int __init vmx_init(void)
                kvm_mmu_set_base_ptes(VMX_EPT_READABLE_MASK |
                        VMX_EPT_WRITABLE_MASK |
                        VMX_EPT_DEFAULT_MT << VMX_EPT_MT_EPTE_SHIFT);
-                kvm_mmu_set_mask_ptes(0ull, VMX_EPT_FAKE_ACCESSED_MASK,
+                kvm_mmu_set_mask_ptes(0ull, 0ull, 0ull, 0ull,
-                                VMX_EPT_FAKE_DIRTY_MASK, 0ull,
                                VMX_EPT_EXECUTABLE_MASK);
                kvm_enable_tdp();
        } else
diff --git a/arch/x86/kvm/vmx.h b/arch/x86/kvm/vmx.h
index b32d4e5b123d..17e25995b65b 100644
--- a/arch/x86/kvm/vmx.h
+++ b/arch/x86/kvm/vmx.h
@@ -355,8 +355,6 @@ enum vmcs_field {
 #define VMX_EPT_READABLE_MASK                   0x1ull
 #define VMX_EPT_WRITABLE_MASK                   0x2ull
 #define VMX_EPT_EXECUTABLE_MASK                 0x4ull
-#define VMX_EPT_FAKE_ACCESSED_MASK              (1ull << 62)
-#define VMX_EPT_FAKE_DIRTY_MASK                 (1ull << 63)
 #define VMX_EPT_IDENTITY_PAGETABLE_ADDR         0xfffbc000ul
diff --git a/arch/x86/lib/msr-on-cpu.c b/arch/x86/lib/msr-on-cpu.c
index 01b868ba82f8..321cf720dbb6 100644
--- a/arch/x86/lib/msr-on-cpu.c
+++ b/arch/x86/lib/msr-on-cpu.c
@@ -16,37 +16,46 @@ static void __rdmsr_on_cpu(void *info)
        rdmsr(rv->msr_no, rv->l, rv->h);
 }
-static void __rdmsr_safe_on_cpu(void *info)
+static void __wrmsr_on_cpu(void *info)
 {
        struct msr_info *rv = info;
-        rv->err = rdmsr_safe(rv->msr_no, &rv->l, &rv->h);
+        wrmsr(rv->msr_no, rv->l, rv->h);
 }
-static int _rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h, int safe)
+int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
 {
-        int err = 0;
+        int err;
        struct msr_info rv;
        rv.msr_no = msr_no;
-        if (safe) {
+        err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
-                err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu,
-                                               &rv, 1);
-                err = err ? err : rv.err;
-        } else {
-                err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
-        }
        *l = rv.l;
        *h = rv.h;
        return err;
 }
-static void __wrmsr_on_cpu(void *info)
+int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
+{
+        int err;
+        struct msr_info rv;
+        rv.msr_no = msr_no;
+        rv.l = l;
+        rv.h = h;
+        err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
+        return err;
+}
+/* These "safe" variants are slower and should be used when the target MSR
+   may not actually exist. */
+static void __rdmsr_safe_on_cpu(void *info)
 {
        struct msr_info *rv = info;
-        wrmsr(rv->msr_no, rv->l, rv->h);
+        rv->err = rdmsr_safe(rv->msr_no, &rv->l, &rv->h);
 }
 static void __wrmsr_safe_on_cpu(void *info)
@@ -56,45 +65,30 @@ static void __wrmsr_safe_on_cpu(void *info)
        rv->err = wrmsr_safe(rv->msr_no, rv->l, rv->h);
 }
-static int _wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h, int safe)
+int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
 {
-        int err = 0;
+        int err;
        struct msr_info rv;
        rv.msr_no = msr_no;
-        rv.l = l;
+        err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu, &rv, 1);
-        rv.h = h;
+        *l = rv.l;
-        if (safe) {
+        *h = rv.h;
-                err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu,
-                                               &rv, 1);
-                err = err ? err : rv.err;
-        } else {
-                err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
-        }
-        return err;
-}
-int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
+        return err ? err : rv.err;
-{
-        return _wrmsr_on_cpu(cpu, msr_no, l, h, 0);
 }
-int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
-{
-        return _rdmsr_on_cpu(cpu, msr_no, l, h, 0);
-}
-/* These "safe" variants are slower and should be used when the target MSR
-   may not actually exist. */
 int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 {
-        return _wrmsr_on_cpu(cpu, msr_no, l, h, 1);
+        int err;
-}
+        struct msr_info rv;
-int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
+        rv.msr_no = msr_no;
-{
+        rv.l = l;
-        return _rdmsr_on_cpu(cpu, msr_no, l, h, 1);
+        rv.h = h;
+        err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu, &rv, 1);
+        return err ? err : rv.err;
 }
 EXPORT_SYMBOL(rdmsr_on_cpu);
diff --git a/arch/x86/lib/string_32.c b/arch/x86/lib/string_32.c
index 94972e7c094d..82004d2bf05e 100644
--- a/arch/x86/lib/string_32.c
+++ b/arch/x86/lib/string_32.c
@@ -22,7 +22,7 @@ char *strcpy(char *dest, const char *src)
                "testb %%al,%%al\n\t"
                "jne 1b"
                : "=&S" (d0), "=&D" (d1), "=&a" (d2)
-                :"0" (src), "1" (dest) : "memory");
+                : "0" (src), "1" (dest) : "memory");
        return dest;
 }
 EXPORT_SYMBOL(strcpy);
@@ -42,7 +42,7 @@ char *strncpy(char *dest, const char *src, size_t count)
                "stosb\n"
                "2:"
                : "=&S" (d0), "=&D" (d1), "=&c" (d2), "=&a" (d3)
-                :"0" (src), "1" (dest), "2" (count) : "memory");
+                : "0" (src), "1" (dest), "2" (count) : "memory");
        return dest;
 }
 EXPORT_SYMBOL(strncpy);
@@ -60,7 +60,7 @@ char *strcat(char *dest, const char *src)
                "testb %%al,%%al\n\t"
                "jne 1b"
                : "=&S" (d0), "=&D" (d1), "=&a" (d2), "=&c" (d3)
-                : "0" (src), "1" (dest), "2" (0), "3" (0xffffffffu): "memory");
+                : "0" (src), "1" (dest), "2" (0), "3" (0xffffffffu) : "memory");
        return dest;
 }
 EXPORT_SYMBOL(strcat);
@@ -105,9 +105,9 @@ int strcmp(const char *cs, const char *ct)
                "2:\tsbbl %%eax,%%eax\n\t"
                "orb $1,%%al\n"
                "3:"
-                :"=a" (res), "=&S" (d0), "=&D" (d1)
+                : "=a" (res), "=&S" (d0), "=&D" (d1)
-                :"1" (cs), "2" (ct)
+                : "1" (cs), "2" (ct)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strcmp);
@@ -130,9 +130,9 @@ int strncmp(const char *cs, const char *ct, size_t count)
                "3:\tsbbl %%eax,%%eax\n\t"
                "orb $1,%%al\n"
                "4:"
-                :"=a" (res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
+                : "=a" (res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
-                :"1" (cs), "2" (ct), "3" (count)
+                : "1" (cs), "2" (ct), "3" (count)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strncmp);
@@ -152,9 +152,9 @@ char *strchr(const char *s, int c)
                "movl $1,%1\n"
                "2:\tmovl %1,%0\n\t"
                "decl %0"
-                :"=a" (res), "=&S" (d0)
+                : "=a" (res), "=&S" (d0)
-                :"1" (s), "0" (c)
+                : "1" (s), "0" (c)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strchr);
@@ -169,9 +169,9 @@ size_t strlen(const char *s)
                "scasb\n\t"
                "notl %0\n\t"
                "decl %0"
-                :"=c" (res), "=&D" (d0)
+                : "=c" (res), "=&D" (d0)
-                :"1" (s), "a" (0), "0" (0xffffffffu)
+                : "1" (s), "a" (0), "0" (0xffffffffu)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strlen);
@@ -189,9 +189,9 @@ void *memchr(const void *cs, int c, size_t count)
                "je 1f\n\t"
                "movl $1,%0\n"
                "1:\tdecl %0"
-                :"=D" (res), "=&c" (d0)
+                : "=D" (res), "=&c" (d0)
-                :"a" (c), "0" (cs), "1" (count)
+                : "a" (c), "0" (cs), "1" (count)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(memchr);
@@ -228,9 +228,9 @@ size_t strnlen(const char *s, size_t count)
                "cmpl $-1,%1\n\t"
                "jne 1b\n"
                "3:\tsubl %2,%0"
-                :"=a" (res), "=&d" (d0)
+                : "=a" (res), "=&d" (d0)
-                :"c" (s), "1" (count)
+                : "c" (s), "1" (count)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strnlen);
diff --git a/arch/x86/lib/strstr_32.c b/arch/x86/lib/strstr_32.c
index 42e8a50303f3..8e2d55f754bf 100644
--- a/arch/x86/lib/strstr_32.c
+++ b/arch/x86/lib/strstr_32.c
@@ -23,9 +23,9 @@ __asm__ __volatile__(
        "jne 1b\n\t"
        "xorl %%eax,%%eax\n\t"
        "2:"
-        :"=a" (__res), "=&c" (d0), "=&S" (d1)
+        : "=a" (__res), "=&c" (d0), "=&S" (d1)
-        :"0" (0), "1" (0xffffffff), "2" (cs), "g" (ct)
+        : "0" (0), "1" (0xffffffff), "2" (cs), "g" (ct)
-        :"dx", "di");
+        : "dx", "di");
 return __res;
 }
diff --git a/arch/x86/mm/discontig_32.c b/arch/x86/mm/discontig_32.c
index 62fa440678d8..847c164725f4 100644
--- a/arch/x86/mm/discontig_32.c
+++ b/arch/x86/mm/discontig_32.c
@@ -328,7 +328,7 @@ void __init initmem_init(unsigned long start_pfn,
        get_memcfg_numa();
-        kva_pages = round_up(calculate_numa_remap_pages(), PTRS_PER_PTE);
+        kva_pages = roundup(calculate_numa_remap_pages(), PTRS_PER_PTE);
        kva_target_pfn = round_down(max_low_pfn - kva_pages, PTRS_PER_PTE);
        do {
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index a20d1fa64b4e..e7277cbcfb40 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -148,8 +148,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
         * we have now. "break" is either changing perms, levels or
         * address space marker.
         */
-        prot = pgprot_val(new_prot) & ~(PTE_PFN_MASK);
+        prot = pgprot_val(new_prot) & PTE_FLAGS_MASK;
-        cur = pgprot_val(st->current_prot) & ~(PTE_PFN_MASK);
+        cur = pgprot_val(st->current_prot) & PTE_FLAGS_MASK;
        if (!st->level) {
                /* First entry */
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 4974e97dedfe..c3789bb19308 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -195,11 +195,30 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base,
        pgd_t *pgd;
        pmd_t *pmd;
        pte_t *pte;
-        unsigned pages_2m = 0, pages_4k = 0;
+        unsigned pages_2m, pages_4k;
+        int mapping_iter;
+        /*
+         * First iteration will setup identity mapping using large/small pages
+         * based on use_pse, with other attributes same as set by
+         * the early code in head_32.S
+         *
+         * Second iteration will setup the appropriate attributes (NX, GLOBAL..)
+         * as desired for the kernel identity mapping.
+         *
+         * This two pass mechanism conforms to the TLB app note which says:
+         *
+         *     "Software should not write to a paging-structure entry in a way
+         *      that would change, for any linear address, both the page size
+         *      and either the page frame or attributes."
+         */
+        mapping_iter = 1;
        if (!cpu_has_pse)
                use_pse = 0;
+repeat:
+        pages_2m = pages_4k = 0;
        pfn = start_pfn;
        pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
        pgd = pgd_base + pgd_idx;
@@ -225,6 +244,13 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base,
                        if (use_pse) {
                                unsigned int addr2;
                                pgprot_t prot = PAGE_KERNEL_LARGE;
+                                /*
+                                 * first pass will use the same initial
+                                 * identity mapping attribute + _PAGE_PSE.
+                                 */
+                                pgprot_t init_prot =
+                                        __pgprot(PTE_IDENT_ATTR |
+                                                 _PAGE_PSE);
                                addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
                                        PAGE_OFFSET + PAGE_SIZE-1;
@@ -234,7 +260,10 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base,
                                        prot = PAGE_KERNEL_LARGE_EXEC;
                                pages_2m++;
-                                set_pmd(pmd, pfn_pmd(pfn, prot));
+                                if (mapping_iter == 1)
+                                        set_pmd(pmd, pfn_pmd(pfn, init_prot));
+                                else
+                                        set_pmd(pmd, pfn_pmd(pfn, prot));
                                pfn += PTRS_PER_PTE;
                                continue;
@@ -246,17 +275,43 @@ static void __init kernel_physical_mapping_init(pgd_t *pgd_base,
                        for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
                             pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
                                pgprot_t prot = PAGE_KERNEL;
+                                /*
+                                 * first pass will use the same initial
+                                 * identity mapping attribute.
+                                 */
+                                pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
                                if (is_kernel_text(addr))
                                        prot = PAGE_KERNEL_EXEC;
                                pages_4k++;
-                                set_pte(pte, pfn_pte(pfn, prot));
+                                if (mapping_iter == 1)
+                                        set_pte(pte, pfn_pte(pfn, init_prot));
+                                else
+                                        set_pte(pte, pfn_pte(pfn, prot));
                        }
                }
        }
-        update_page_count(PG_LEVEL_2M, pages_2m);
+        if (mapping_iter == 1) {
-        update_page_count(PG_LEVEL_4K, pages_4k);
+                /*
+                 * update direct mapping page count only in the first
+                 * iteration.
+                 */
+                update_page_count(PG_LEVEL_2M, pages_2m);
+                update_page_count(PG_LEVEL_4K, pages_4k);
+                /*
+                 * local global flush tlb, which will flush the previous
+                 * mappings present in both small and large page TLB's.
+                 */
+                __flush_tlb_all();
+                /*
+                 * Second iteration will set the actual desired PTE attributes.
+                 */
+                mapping_iter = 2;
+                goto repeat;
+        }
 }
 /*
@@ -459,11 +514,7 @@ static void __init pagetable_init(void)
 {
        pgd_t *pgd_base = swapper_pg_dir;
-        paravirt_pagetable_setup_start(pgd_base);
        permanent_kmaps_init(pgd_base);
-        paravirt_pagetable_setup_done(pgd_base);
 }
 #ifdef CONFIG_ACPI_SLEEP
@@ -723,7 +774,7 @@ void __init setup_bootmem_allocator(void)
        after_init_bootmem = 1;
 }
-static void __init find_early_table_space(unsigned long end)
+static void __init find_early_table_space(unsigned long end, int use_pse)
 {
        unsigned long puds, pmds, ptes, tables, start;
@@ -733,7 +784,7 @@ static void __init find_early_table_space(unsigned long end)
        pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT;
        tables += PAGE_ALIGN(pmds * sizeof(pmd_t));
-        if (cpu_has_pse) {
+        if (use_pse) {
                unsigned long extra;
                extra = end - ((end>>PMD_SHIFT) << PMD_SHIFT);
@@ -773,12 +824,22 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
        pgd_t *pgd_base = swapper_pg_dir;
        unsigned long start_pfn, end_pfn;
        unsigned long big_page_start;
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        /*
+         * For CONFIG_DEBUG_PAGEALLOC, identity mapping will use small pages.
+         * This will simplify cpa(), which otherwise needs to support splitting
+         * large pages into small in interrupt context, etc.
+         */
+        int use_pse = 0;
+#else
+        int use_pse = cpu_has_pse;
+#endif
        /*
         * Find space for the kernel direct mapping tables.
         */
        if (!after_init_bootmem)
-                find_early_table_space(end);
+                find_early_table_space(end, use_pse);
 #ifdef CONFIG_X86_PAE
        set_nx();
@@ -824,7 +885,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
        end_pfn = (end>>PMD_SHIFT) << (PMD_SHIFT - PAGE_SHIFT);
        if (start_pfn < end_pfn)
                kernel_physical_mapping_init(pgd_base, start_pfn, end_pfn,
-                                                cpu_has_pse);
+                                             use_pse);
        /* tail is not big page alignment ? */
        start_pfn = end_pfn;
@@ -987,7 +1048,6 @@ void __init mem_init(void)
        if (boot_cpu_data.wp_works_ok < 0)
                test_wp_bit();
-        cpa_init();
        save_pg_dir();
        zap_low_mappings();
 }
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 1f6806b62eb8..83e13f2d53d2 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -281,7 +281,7 @@ void __init init_extra_mapping_uc(unsigned long phys, unsigned long size)
 void __init cleanup_highmap(void)
 {
        unsigned long vaddr = __START_KERNEL_map;
-        unsigned long end = round_up((unsigned long)_end, PMD_SIZE) - 1;
+        unsigned long end = roundup((unsigned long)_end, PMD_SIZE) - 1;
        pmd_t *pmd = level2_kernel_pgt;
        pmd_t *last_pmd = pmd + PTRS_PER_PMD;
@@ -327,7 +327,8 @@ static __ref void unmap_low_page(void *adr)
 }
 static unsigned long __meminit
-phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end)
+phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end,
+              pgprot_t prot)
 {
        unsigned pages = 0;
        unsigned long last_map_addr = end;
@@ -345,36 +346,43 @@ phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end)
                        break;
                }
+                /*
+                 * We will re-use the existing mapping.
+                 * Xen for example has some special requirements, like mapping
+                 * pagetable pages as RO. So assume someone who pre-setup
+                 * these mappings are more intelligent.
+                 */
                if (pte_val(*pte))
                        continue;
                if (0)
                        printk("   pte=%p addr=%lx pte=%016lx\n",
                               pte, addr, pfn_pte(addr >> PAGE_SHIFT, PAGE_KERNEL).pte);
-                set_pte(pte, pfn_pte(addr >> PAGE_SHIFT, PAGE_KERNEL));
-                last_map_addr = (addr & PAGE_MASK) + PAGE_SIZE;
                pages++;
+                set_pte(pte, pfn_pte(addr >> PAGE_SHIFT, prot));
+                last_map_addr = (addr & PAGE_MASK) + PAGE_SIZE;
        }
        update_page_count(PG_LEVEL_4K, pages);
        return last_map_addr;
 }
 static unsigned long __meminit
-phys_pte_update(pmd_t *pmd, unsigned long address, unsigned long end)
+phys_pte_update(pmd_t *pmd, unsigned long address, unsigned long end,
+                pgprot_t prot)
 {
        pte_t *pte = (pte_t *)pmd_page_vaddr(*pmd);
-        return phys_pte_init(pte, address, end);
+        return phys_pte_init(pte, address, end, prot);
 }
 static unsigned long __meminit
 phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
-                         unsigned long page_size_mask)
+              unsigned long page_size_mask, pgprot_t prot)
 {
        unsigned long pages = 0;
        unsigned long last_map_addr = end;
-        unsigned long start = address;
        int i = pmd_index(address);
@@ -382,6 +390,7 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
                unsigned long pte_phys;
                pmd_t *pmd = pmd_page + pmd_index(address);
                pte_t *pte;
+                pgprot_t new_prot = prot;
                if (address >= end) {
                        if (!after_bootmem) {
@@ -395,27 +404,40 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
                        if (!pmd_large(*pmd)) {
                                spin_lock(&init_mm.page_table_lock);
                                last_map_addr = phys_pte_update(pmd, address,
-                                                                end);
+                                                                end, prot);
                                spin_unlock(&init_mm.page_table_lock);
+                                continue;
                        }
-                        /* Count entries we're using from level2_ident_pgt */
+                        /*
-                        if (start == 0)
+                         * If we are ok with PG_LEVEL_2M mapping, then we will
-                                pages++;
+                         * use the existing mapping,
-                        continue;
+                         *
+                         * Otherwise, we will split the large page mapping but
+                         * use the same existing protection bits except for
+                         * large page, so that we don't violate Intel's TLB
+                         * Application note (317080) which says, while changing
+                         * the page sizes, new and old translations should
+                         * not differ with respect to page frame and
+                         * attributes.
+                         */
+                        if (page_size_mask & (1 << PG_LEVEL_2M))
+                                continue;
+                        new_prot = pte_pgprot(pte_clrhuge(*(pte_t *)pmd));
                }
                if (page_size_mask & (1<<PG_LEVEL_2M)) {
                        pages++;
                        spin_lock(&init_mm.page_table_lock);
                        set_pte((pte_t *)pmd,
-                                pfn_pte(address >> PAGE_SHIFT, PAGE_KERNEL_LARGE));
+                                pfn_pte(address >> PAGE_SHIFT,
+                                        __pgprot(pgprot_val(prot) | _PAGE_PSE)));
                        spin_unlock(&init_mm.page_table_lock);
                        last_map_addr = (address & PMD_MASK) + PMD_SIZE;
                        continue;
                }
                pte = alloc_low_page(&pte_phys);
-                last_map_addr = phys_pte_init(pte, address, end);
+                last_map_addr = phys_pte_init(pte, address, end, new_prot);
                unmap_low_page(pte);
                spin_lock(&init_mm.page_table_lock);
@@ -428,12 +450,12 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end,
 static unsigned long __meminit
 phys_pmd_update(pud_t *pud, unsigned long address, unsigned long end,
-                         unsigned long page_size_mask)
+                unsigned long page_size_mask, pgprot_t prot)
 {
        pmd_t *pmd = pmd_offset(pud, 0);
        unsigned long last_map_addr;
-        last_map_addr = phys_pmd_init(pmd, address, end, page_size_mask);
+        last_map_addr = phys_pmd_init(pmd, address, end, page_size_mask, prot);
        __flush_tlb_all();
        return last_map_addr;
 }
@@ -450,6 +472,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
                unsigned long pmd_phys;
                pud_t *pud = pud_page + pud_index(addr);
                pmd_t *pmd;
+                pgprot_t prot = PAGE_KERNEL;
                if (addr >= end)
                        break;
@@ -461,10 +484,26 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
                }
                if (pud_val(*pud)) {
-                        if (!pud_large(*pud))
+                        if (!pud_large(*pud)) {
                                last_map_addr = phys_pmd_update(pud, addr, end,
-                                                         page_size_mask);
+                                                         page_size_mask, prot);
-                        continue;
+                                continue;
+                        }
+                        /*
+                         * If we are ok with PG_LEVEL_1G mapping, then we will
+                         * use the existing mapping.
+                         *
+                         * Otherwise, we will split the gbpage mapping but use
+                         * the same existing protection  bits except for large
+                         * page, so that we don't violate Intel's TLB
+                         * Application note (317080) which says, while changing
+                         * the page sizes, new and old translations should
+                         * not differ with respect to page frame and
+                         * attributes.
+                         */
+                        if (page_size_mask & (1 << PG_LEVEL_1G))
+                                continue;
+                        prot = pte_pgprot(pte_clrhuge(*(pte_t *)pud));
                }
                if (page_size_mask & (1<<PG_LEVEL_1G)) {
@@ -478,7 +517,8 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
                }
                pmd = alloc_low_page(&pmd_phys);
-                last_map_addr = phys_pmd_init(pmd, addr, end, page_size_mask);
+                last_map_addr = phys_pmd_init(pmd, addr, end, page_size_mask,
+                                              prot);
                unmap_low_page(pmd);
                spin_lock(&init_mm.page_table_lock);
@@ -486,6 +526,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
                spin_unlock(&init_mm.page_table_lock);
        }
        __flush_tlb_all();
        update_page_count(PG_LEVEL_1G, pages);
        return last_map_addr;
@@ -502,27 +543,28 @@ phys_pud_update(pgd_t *pgd, unsigned long addr, unsigned long end,
        return phys_pud_init(pud, addr, end, page_size_mask);
 }
-static void __init find_early_table_space(unsigned long end)
+static void __init find_early_table_space(unsigned long end, int use_pse,
+                                          int use_gbpages)
 {
        unsigned long puds, pmds, ptes, tables, start;
        puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
-        tables = round_up(puds * sizeof(pud_t), PAGE_SIZE);
+        tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
-        if (direct_gbpages) {
+        if (use_gbpages) {
                unsigned long extra;
                extra = end - ((end>>PUD_SHIFT) << PUD_SHIFT);
                pmds = (extra + PMD_SIZE - 1) >> PMD_SHIFT;
        } else
                pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT;
-        tables += round_up(pmds * sizeof(pmd_t), PAGE_SIZE);
+        tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
-        if (cpu_has_pse) {
+        if (use_pse) {
                unsigned long extra;
                extra = end - ((end>>PMD_SHIFT) << PMD_SHIFT);
                ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
        } else
                ptes = (end + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        tables += round_up(ptes * sizeof(pte_t), PAGE_SIZE);
+        tables += roundup(ptes * sizeof(pte_t), PAGE_SIZE);
        /*
         * RED-PEN putting page tables only on node 0 could
@@ -584,6 +626,7 @@ static unsigned long __init kernel_physical_mapping_init(unsigned long start,
                pgd_populate(&init_mm, pgd, __va(pud_phys));
                spin_unlock(&init_mm.page_table_lock);
        }
+        __flush_tlb_all();
        return last_map_addr;
 }
@@ -627,6 +670,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
        struct map_range mr[NR_RANGE_MR];
        int nr_range, i;
+        int use_pse, use_gbpages;
        printk(KERN_INFO "init_memory_mapping\n");
@@ -640,9 +684,21 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
        if (!after_bootmem)
                init_gbpages();
-        if (direct_gbpages)
+#ifdef CONFIG_DEBUG_PAGEALLOC
+        /*
+         * For CONFIG_DEBUG_PAGEALLOC, identity mapping will use small pages.
+         * This will simplify cpa(), which otherwise needs to support splitting
+         * large pages into small in interrupt context, etc.
+         */
+        use_pse = use_gbpages = 0;
+#else
+        use_pse = cpu_has_pse;
+        use_gbpages = direct_gbpages;
+#endif
+        if (use_gbpages)
                page_size_mask |= 1 << PG_LEVEL_1G;
-        if (cpu_has_pse)
+        if (use_pse)
                page_size_mask |= 1 << PG_LEVEL_2M;
        memset(mr, 0, sizeof(mr));
@@ -703,7 +759,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
                         (mr[i].page_size_mask & (1<<PG_LEVEL_2M))?"2M":"4k"));
        if (!after_bootmem)
-                find_early_table_space(end);
+                find_early_table_space(end, use_pse, use_gbpages);
        for (i = 0; i < nr_range; i++)
                last_map_addr = kernel_physical_mapping_init(
@@ -862,8 +918,6 @@ void __init mem_init(void)
                reservedpages << (PAGE_SHIFT-10),
                datasize >> 10,
                initsize >> 10);
-        cpa_init();
 }
 void free_init_pages(char *what, unsigned long begin, unsigned long end)
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index cac6da54203b..6ab3196d12b4 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -83,6 +83,25 @@ int page_is_ram(unsigned long pagenr)
        return 0;
 }
+int pagerange_is_ram(unsigned long start, unsigned long end)
+{
+        int ram_page = 0, not_rampage = 0;
+        unsigned long page_nr;
+        for (page_nr = (start >> PAGE_SHIFT); page_nr < (end >> PAGE_SHIFT);
+             ++page_nr) {
+                if (page_is_ram(page_nr))
+                        ram_page = 1;
+                else
+                        not_rampage = 1;
+                if (ram_page == not_rampage)
+                        return -1;
+        }
+        return ram_page;
+}
 /*
 * Fix up the linear direct mapping of the kernel to avoid cache attribute
 * conflicts.
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index a4dd793d6003..cebcbf152d46 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -79,7 +79,7 @@ static int __init allocate_cachealigned_memnodemap(void)
                return 0;
        addr = 0x8000;
-        nodemap_size = round_up(sizeof(s16) * memnodemapsize, L1_CACHE_BYTES);
+        nodemap_size = roundup(sizeof(s16) * memnodemapsize, L1_CACHE_BYTES);
        nodemap_addr = find_e820_area(addr, max_pfn<<PAGE_SHIFT,
                                      nodemap_size, L1_CACHE_BYTES);
        if (nodemap_addr == -1UL) {
@@ -176,10 +176,10 @@ void __init setup_node_bootmem(int nodeid, unsigned long start,
        unsigned long start_pfn, last_pfn, bootmap_pages, bootmap_size;
        unsigned long bootmap_start, nodedata_phys;
        void *bootmap;
-        const int pgdat_size = round_up(sizeof(pg_data_t), PAGE_SIZE);
+        const int pgdat_size = roundup(sizeof(pg_data_t), PAGE_SIZE);
        int nid;
-        start = round_up(start, ZONE_ALIGN);
+        start = roundup(start, ZONE_ALIGN);
        printk(KERN_INFO "Bootmem setup node %d %016lx-%016lx\n", nodeid,
               start, end);
@@ -210,9 +210,9 @@ void __init setup_node_bootmem(int nodeid, unsigned long start,
        bootmap_pages = bootmem_bootmap_pages(last_pfn - start_pfn);
        nid = phys_to_nid(nodedata_phys);
        if (nid == nodeid)
-                bootmap_start = round_up(nodedata_phys + pgdat_size, PAGE_SIZE);
+                bootmap_start = roundup(nodedata_phys + pgdat_size, PAGE_SIZE);
        else
-                bootmap_start = round_up(start, PAGE_SIZE);
+                bootmap_start = roundup(start, PAGE_SIZE);
        /*
         * SMP_CACHE_BYTES could be enough, but init_bootmem_node like
         * to use that to align to PAGE_SIZE
diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
index d4aa503caaa2..e1d106909218 100644
--- a/arch/x86/mm/pageattr-test.c
+++ b/arch/x86/mm/pageattr-test.c
@@ -32,7 +32,7 @@ enum {
        GPS                     = (1<<30)
 };
-#define PAGE_TESTBIT    __pgprot(_PAGE_UNUSED1)
+#define PAGE_CPA_TEST   __pgprot(_PAGE_CPA_TEST)
 static int pte_testbit(pte_t pte)
 {
@@ -118,6 +118,7 @@ static int pageattr_test(void)
        unsigned int level;
        int i, k;
        int err;
+        unsigned long test_addr;
        if (print)
                printk(KERN_INFO "CPA self-test:\n");
@@ -172,7 +173,8 @@ static int pageattr_test(void)
                        continue;
                }
-                err = change_page_attr_set(addr[i], len[i], PAGE_TESTBIT);
+                test_addr = addr[i];
+                err = change_page_attr_set(&test_addr, len[i], PAGE_CPA_TEST, 0);
                if (err < 0) {
                        printk(KERN_ERR "CPA %d failed %d\n", i, err);
                        failed++;
@@ -204,7 +206,8 @@ static int pageattr_test(void)
                        failed++;
                        continue;
                }
-                err = change_page_attr_clear(addr[i], len[i], PAGE_TESTBIT);
+                test_addr = addr[i];
+                err = change_page_attr_clear(&test_addr, len[i], PAGE_CPA_TEST, 0);
                if (err < 0) {
                        printk(KERN_ERR "CPA reverting failed: %d\n", err);
                        failed++;
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 43e2f8483e4f..a9ec89c3fbca 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -25,15 +25,27 @@
 * The current flushing context - we pass it instead of 5 arguments:
 */
 struct cpa_data {
-        unsigned long   vaddr;
+        unsigned long   *vaddr;
        pgprot_t        mask_set;
        pgprot_t        mask_clr;
        int             numpages;
-        int             flushtlb;
+        int             flags;
        unsigned long   pfn;
        unsigned        force_split : 1;
+        int             curpage;
 };
+/*
+ * Serialize cpa() (for !DEBUG_PAGEALLOC which uses large identity mappings)
+ * using cpa_lock. So that we don't allow any other cpu, with stale large tlb
+ * entries change the page attribute in parallel to some other cpu
+ * splitting a large page entry along with changing the attribute.
+ */
+static DEFINE_SPINLOCK(cpa_lock);
+#define CPA_FLUSHTLB 1
+#define CPA_ARRAY 2
 #ifdef CONFIG_PROC_FS
 static unsigned long direct_pages_count[PG_LEVEL_NUM];
@@ -84,7 +96,7 @@ static inline unsigned long highmap_start_pfn(void)
 static inline unsigned long highmap_end_pfn(void)
 {
-        return __pa(round_up((unsigned long)_end, PMD_SIZE)) >> PAGE_SHIFT;
+        return __pa(roundup((unsigned long)_end, PMD_SIZE)) >> PAGE_SHIFT;
 }
 #endif
@@ -190,6 +202,41 @@ static void cpa_flush_range(unsigned long start, int numpages, int cache)
        }
 }
+static void cpa_flush_array(unsigned long *start, int numpages, int cache)
+{
+        unsigned int i, level;
+        unsigned long *addr;
+        BUG_ON(irqs_disabled());
+        on_each_cpu(__cpa_flush_range, NULL, 1);
+        if (!cache)
+                return;
+        /* 4M threshold */
+        if (numpages >= 1024) {
+                if (boot_cpu_data.x86_model >= 4)
+                        wbinvd();
+                return;
+        }
+        /*
+         * We only need to flush on one CPU,
+         * clflush is a MESI-coherent instruction that
+         * will cause all other CPUs to flush the same
+         * cachelines:
+         */
+        for (i = 0, addr = start; i < numpages; i++, addr++) {
+                pte_t *pte = lookup_address(*addr, &level);
+                /*
+                 * Only flush present addresses:
+                 */
+                if (pte && (pte_val(*pte) & _PAGE_PRESENT))
+                        clflush_cache_range((void *) *addr, PAGE_SIZE);
+        }
+}
 /*
 * Certain areas of memory on x86 require very specific protection flags,
 * for example the BIOS area or kernel text. Callers don't always get this
@@ -398,7 +445,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
                 */
                new_pte = pfn_pte(pte_pfn(old_pte), canon_pgprot(new_prot));
                __set_pmd_pte(kpte, address, new_pte);
-                cpa->flushtlb = 1;
+                cpa->flags |= CPA_FLUSHTLB;
                do_split = 0;
        }
@@ -408,84 +455,6 @@ out_unlock:
        return do_split;
 }
-static LIST_HEAD(page_pool);
-static unsigned long pool_size, pool_pages, pool_low;
-static unsigned long pool_used, pool_failed;
-static void cpa_fill_pool(struct page **ret)
-{
-        gfp_t gfp = GFP_KERNEL;
-        unsigned long flags;
-        struct page *p;
-        /*
-         * Avoid recursion (on debug-pagealloc) and also signal
-         * our priority to get to these pagetables:
-         */
-        if (current->flags & PF_MEMALLOC)
-                return;
-        current->flags |= PF_MEMALLOC;
-        /*
-         * Allocate atomically from atomic contexts:
-         */
-        if (in_atomic() || irqs_disabled() || debug_pagealloc)
-                gfp =  GFP_ATOMIC | __GFP_NORETRY | __GFP_NOWARN;
-        while (pool_pages < pool_size || (ret && !*ret)) {
-                p = alloc_pages(gfp, 0);
-                if (!p) {
-                        pool_failed++;
-                        break;
-                }
-                /*
-                 * If the call site needs a page right now, provide it:
-                 */
-                if (ret && !*ret) {
-                        *ret = p;
-                        continue;
-                }
-                spin_lock_irqsave(&pgd_lock, flags);
-                list_add(&p->lru, &page_pool);
-                pool_pages++;
-                spin_unlock_irqrestore(&pgd_lock, flags);
-        }
-        current->flags &= ~PF_MEMALLOC;
-}
-#define SHIFT_MB                (20 - PAGE_SHIFT)
-#define ROUND_MB_GB             ((1 << 10) - 1)
-#define SHIFT_MB_GB             10
-#define POOL_PAGES_PER_GB       16
-void __init cpa_init(void)
-{
-        struct sysinfo si;
-        unsigned long gb;
-        si_meminfo(&si);
-        /*
-         * Calculate the number of pool pages:
-         *
-         * Convert totalram (nr of pages) to MiB and round to the next
-         * GiB. Shift MiB to Gib and multiply the result by
-         * POOL_PAGES_PER_GB:
-         */
-        if (debug_pagealloc) {
-                gb = ((si.totalram >> SHIFT_MB) + ROUND_MB_GB) >> SHIFT_MB_GB;
-                pool_size = POOL_PAGES_PER_GB * gb;
-        } else {
-                pool_size = 1;
-        }
-        pool_low = pool_size;
-        cpa_fill_pool(NULL);
-        printk(KERN_DEBUG
-               "CPA: page pool initialized %lu of %lu pages preallocated\n",
-               pool_pages, pool_size);
-}
 static int split_large_page(pte_t *kpte, unsigned long address)
 {
        unsigned long flags, pfn, pfninc = 1;
@@ -494,28 +463,15 @@ static int split_large_page(pte_t *kpte, unsigned long address)
        pgprot_t ref_prot;
        struct page *base;
-        /*
+        if (!debug_pagealloc)
-         * Get a page from the pool. The pool list is protected by the
+                spin_unlock(&cpa_lock);
-         * pgd_lock, which we have to take anyway for the split
+        base = alloc_pages(GFP_KERNEL, 0);
-         * operation:
+        if (!debug_pagealloc)
-         */
+                spin_lock(&cpa_lock);
-        spin_lock_irqsave(&pgd_lock, flags);
+        if (!base)
-        if (list_empty(&page_pool)) {
+                return -ENOMEM;
-                spin_unlock_irqrestore(&pgd_lock, flags);
-                base = NULL;
-                cpa_fill_pool(&base);
-                if (!base)
-                        return -ENOMEM;
-                spin_lock_irqsave(&pgd_lock, flags);
-        } else {
-                base = list_first_entry(&page_pool, struct page, lru);
-                list_del(&base->lru);
-                pool_pages--;
-                if (pool_pages < pool_low)
-                        pool_low = pool_pages;
-        }
+        spin_lock_irqsave(&pgd_lock, flags);
        /*
         * Check for races, another CPU might have split this page
         * up for us already:
@@ -572,11 +528,8 @@ out_unlock:
         * If we dropped out via the lookup_address check under
         * pgd_lock then stick the page back into the pool:
         */
-        if (base) {
+        if (base)
-                list_add(&base->lru, &page_pool);
+                __free_page(base);
-                pool_pages++;
-        } else
-                pool_used++;
        spin_unlock_irqrestore(&pgd_lock, flags);
        return 0;
@@ -584,11 +537,16 @@ out_unlock:
 static int __change_page_attr(struct cpa_data *cpa, int primary)
 {
-        unsigned long address = cpa->vaddr;
+        unsigned long address;
        int do_split, err;
        unsigned int level;
        pte_t *kpte, old_pte;
+        if (cpa->flags & CPA_ARRAY)
+                address = cpa->vaddr[cpa->curpage];
+        else
+                address = *cpa->vaddr;
 repeat:
        kpte = lookup_address(address, &level);
        if (!kpte)
@@ -600,7 +558,7 @@ repeat:
                        return 0;
                WARN(1, KERN_WARNING "CPA: called for zero pte. "
                       "vaddr = %lx cpa->vaddr = %lx\n", address,
-                       cpa->vaddr);
+                       *cpa->vaddr);
                return -EINVAL;
        }
@@ -626,7 +584,7 @@ repeat:
                 */
                if (pte_val(old_pte) != pte_val(new_pte)) {
                        set_pte_atomic(kpte, new_pte);
-                        cpa->flushtlb = 1;
+                        cpa->flags |= CPA_FLUSHTLB;
                }
                cpa->numpages = 1;
                return 0;
@@ -650,7 +608,25 @@ repeat:
         */
        err = split_large_page(kpte, address);
        if (!err) {
-                cpa->flushtlb = 1;
+                /*
+                 * Do a global flush tlb after splitting the large page
+                 * and before we do the actual change page attribute in the PTE.
+                 *
+                 * With out this, we violate the TLB application note, that says
+                 * "The TLBs may contain both ordinary and large-page
+                 *  translations for a 4-KByte range of linear addresses. This
+                 *  may occur if software modifies the paging structures so that
+                 *  the page size used for the address range changes. If the two
+                 *  translations differ with respect to page frame or attributes
+                 *  (e.g., permissions), processor behavior is undefined and may
+                 *  be implementation-specific."
+                 *
+                 * We do this global tlb flush inside the cpa_lock, so that we
+                 * don't allow any other cpu, with stale tlb entries change the
+                 * page attribute in parallel, that also falls into the
+                 * just split large page entry.
+                 */
+                flush_tlb_all();
                goto repeat;
        }
@@ -663,6 +639,7 @@ static int cpa_process_alias(struct cpa_data *cpa)
 {
        struct cpa_data alias_cpa;
        int ret = 0;
+        unsigned long temp_cpa_vaddr, vaddr;
        if (cpa->pfn >= max_pfn_mapped)
                return 0;
@@ -675,16 +652,24 @@ static int cpa_process_alias(struct cpa_data *cpa)
         * No need to redo, when the primary call touched the direct
         * mapping already:
         */
-        if (!(within(cpa->vaddr, PAGE_OFFSET,
+        if (cpa->flags & CPA_ARRAY)
+                vaddr = cpa->vaddr[cpa->curpage];
+        else
+                vaddr = *cpa->vaddr;
+        if (!(within(vaddr, PAGE_OFFSET,
                    PAGE_OFFSET + (max_low_pfn_mapped << PAGE_SHIFT))
 #ifdef CONFIG_X86_64
-                || within(cpa->vaddr, PAGE_OFFSET + (1UL<<32),
+                || within(vaddr, PAGE_OFFSET + (1UL<<32),
                    PAGE_OFFSET + (max_pfn_mapped << PAGE_SHIFT))
 #endif
        )) {
                alias_cpa = *cpa;
-                alias_cpa.vaddr = (unsigned long) __va(cpa->pfn << PAGE_SHIFT);
+                temp_cpa_vaddr = (unsigned long) __va(cpa->pfn << PAGE_SHIFT);
+                alias_cpa.vaddr = &temp_cpa_vaddr;
+                alias_cpa.flags &= ~CPA_ARRAY;
                ret = __change_page_attr_set_clr(&alias_cpa, 0);
        }
@@ -696,7 +681,7 @@ static int cpa_process_alias(struct cpa_data *cpa)
         * No need to redo, when the primary call touched the high
         * mapping already:
         */
-        if (within(cpa->vaddr, (unsigned long) _text, (unsigned long) _end))
+        if (within(vaddr, (unsigned long) _text, (unsigned long) _end))
                return 0;
        /*
@@ -707,8 +692,9 @@ static int cpa_process_alias(struct cpa_data *cpa)
                return 0;
        alias_cpa = *cpa;
-        alias_cpa.vaddr =
+        temp_cpa_vaddr = (cpa->pfn << PAGE_SHIFT) + __START_KERNEL_map - phys_base;
-                (cpa->pfn << PAGE_SHIFT) + __START_KERNEL_map - phys_base;
+        alias_cpa.vaddr = &temp_cpa_vaddr;
+        alias_cpa.flags &= ~CPA_ARRAY;
        /*
         * The high mapping range is imprecise, so ignore the return value.
@@ -728,8 +714,15 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
                 * preservation check.
                 */
                cpa->numpages = numpages;
+                /* for array changes, we can't use large page */
+                if (cpa->flags & CPA_ARRAY)
+                        cpa->numpages = 1;
+                if (!debug_pagealloc)
+                        spin_lock(&cpa_lock);
                ret = __change_page_attr(cpa, checkalias);
+                if (!debug_pagealloc)
+                        spin_unlock(&cpa_lock);
                if (ret)
                        return ret;
@@ -746,7 +739,11 @@ static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
                 */
                BUG_ON(cpa->numpages > numpages);
                numpages -= cpa->numpages;
-                cpa->vaddr += cpa->numpages * PAGE_SIZE;
+                if (cpa->flags & CPA_ARRAY)
+                        cpa->curpage++;
+                else
+                        *cpa->vaddr += cpa->numpages * PAGE_SIZE;
        }
        return 0;
 }
@@ -757,9 +754,9 @@ static inline int cache_attr(pgprot_t attr)
                (_PAGE_PAT | _PAGE_PAT_LARGE | _PAGE_PWT | _PAGE_PCD);
 }
-static int change_page_attr_set_clr(unsigned long addr, int numpages,
+static int change_page_attr_set_clr(unsigned long *addr, int numpages,
                                    pgprot_t mask_set, pgprot_t mask_clr,
-                                    int force_split)
+                                    int force_split, int array)
 {
        struct cpa_data cpa;
        int ret, cache, checkalias;
@@ -774,21 +771,38 @@ static int change_page_attr_set_clr(unsigned long addr, int numpages,
                return 0;
        /* Ensure we are PAGE_SIZE aligned */
-        if (addr & ~PAGE_MASK) {
+        if (!array) {
-                addr &= PAGE_MASK;
+                if (*addr & ~PAGE_MASK) {
-                /*
+                        *addr &= PAGE_MASK;
-                 * People should not be passing in unaligned addresses:
+                        /*
-                 */
+                         * People should not be passing in unaligned addresses:
-                WARN_ON_ONCE(1);
+                         */
+                        WARN_ON_ONCE(1);
+                }
+        } else {
+                int i;
+                for (i = 0; i < numpages; i++) {
+                        if (addr[i] & ~PAGE_MASK) {
+                                addr[i] &= PAGE_MASK;
+                                WARN_ON_ONCE(1);
+                        }
+                }
        }
+        /* Must avoid aliasing mappings in the highmem code */
+        kmap_flush_unused();
        cpa.vaddr = addr;
        cpa.numpages = numpages;
        cpa.mask_set = mask_set;
        cpa.mask_clr = mask_clr;
-        cpa.flushtlb = 0;
+        cpa.flags = 0;
+        cpa.curpage = 0;
        cpa.force_split = force_split;
+        if (array)
+                cpa.flags |= CPA_ARRAY;
        /* No alias checking for _NX bit modifications */
        checkalias = (pgprot_val(mask_set) | pgprot_val(mask_clr)) != _PAGE_NX;
@@ -797,7 +811,7 @@ static int change_page_attr_set_clr(unsigned long addr, int numpages,
        /*
         * Check whether we really changed something:
         */
-        if (!cpa.flushtlb)
+        if (!(cpa.flags & CPA_FLUSHTLB))
                goto out;
        /*
@@ -812,27 +826,30 @@ static int change_page_attr_set_clr(unsigned long addr, int numpages,
         * error case we fall back to cpa_flush_all (which uses
         * wbindv):
         */
-        if (!ret && cpu_has_clflush)
+        if (!ret && cpu_has_clflush) {
-                cpa_flush_range(addr, numpages, cache);
+                if (cpa.flags & CPA_ARRAY)
-        else
+                        cpa_flush_array(addr, numpages, cache);
+                else
+                        cpa_flush_range(*addr, numpages, cache);
+        } else
                cpa_flush_all(cache);
 out:
-        cpa_fill_pool(NULL);
        return ret;
 }
-static inline int change_page_attr_set(unsigned long addr, int numpages,
+static inline int change_page_attr_set(unsigned long *addr, int numpages,
-                                       pgprot_t mask)
+                                       pgprot_t mask, int array)
 {
-        return change_page_attr_set_clr(addr, numpages, mask, __pgprot(0), 0);
+        return change_page_attr_set_clr(addr, numpages, mask, __pgprot(0), 0,
+                array);
 }
-static inline int change_page_attr_clear(unsigned long addr, int numpages,
+static inline int change_page_attr_clear(unsigned long *addr, int numpages,
-                                         pgprot_t mask)
+                                         pgprot_t mask, int array)
 {
-        return change_page_attr_set_clr(addr, numpages, __pgprot(0), mask, 0);
+        return change_page_attr_set_clr(addr, numpages, __pgprot(0), mask, 0,
+                array);
 }
 int _set_memory_uc(unsigned long addr, int numpages)
@@ -840,8 +857,8 @@ int _set_memory_uc(unsigned long addr, int numpages)
        /*
         * for now UC MINUS. see comments in ioremap_nocache()
         */
-        return change_page_attr_set(addr, numpages,
+        return change_page_attr_set(&addr, numpages,
-                                    __pgprot(_PAGE_CACHE_UC_MINUS));
+                                    __pgprot(_PAGE_CACHE_UC_MINUS), 0);
 }
 int set_memory_uc(unsigned long addr, int numpages)
@@ -857,10 +874,48 @@ int set_memory_uc(unsigned long addr, int numpages)
 }
 EXPORT_SYMBOL(set_memory_uc);
+int set_memory_array_uc(unsigned long *addr, int addrinarray)
+{
+        unsigned long start;
+        unsigned long end;
+        int i;
+        /*
+         * for now UC MINUS. see comments in ioremap_nocache()
+         */
+        for (i = 0; i < addrinarray; i++) {
+                start = __pa(addr[i]);
+                for (end = start + PAGE_SIZE; i < addrinarray - 1; end += PAGE_SIZE) {
+                        if (end != __pa(addr[i + 1]))
+                                break;
+                        i++;
+                }
+                if (reserve_memtype(start, end, _PAGE_CACHE_UC_MINUS, NULL))
+                        goto out;
+        }
+        return change_page_attr_set(addr, addrinarray,
+                                    __pgprot(_PAGE_CACHE_UC_MINUS), 1);
+out:
+        for (i = 0; i < addrinarray; i++) {
+                unsigned long tmp = __pa(addr[i]);
+                if (tmp == start)
+                        break;
+                for (end = tmp + PAGE_SIZE; i < addrinarray - 1; end += PAGE_SIZE) {
+                        if (end != __pa(addr[i + 1]))
+                                break;
+                        i++;
+                }
+                free_memtype(tmp, end);
+        }
+        return -EINVAL;
+}
+EXPORT_SYMBOL(set_memory_array_uc);
 int _set_memory_wc(unsigned long addr, int numpages)
 {
-        return change_page_attr_set(addr, numpages,
+        return change_page_attr_set(&addr, numpages,
-                                    __pgprot(_PAGE_CACHE_WC));
+                                    __pgprot(_PAGE_CACHE_WC), 0);
 }
 int set_memory_wc(unsigned long addr, int numpages)
@@ -878,8 +933,8 @@ EXPORT_SYMBOL(set_memory_wc);
 int _set_memory_wb(unsigned long addr, int numpages)
 {
-        return change_page_attr_clear(addr, numpages,
+        return change_page_attr_clear(&addr, numpages,
-                                      __pgprot(_PAGE_CACHE_MASK));
+                                      __pgprot(_PAGE_CACHE_MASK), 0);
 }
 int set_memory_wb(unsigned long addr, int numpages)
@@ -890,37 +945,59 @@ int set_memory_wb(unsigned long addr, int numpages)
 }
 EXPORT_SYMBOL(set_memory_wb);
+int set_memory_array_wb(unsigned long *addr, int addrinarray)
+{
+        int i;
+        for (i = 0; i < addrinarray; i++) {
+                unsigned long start = __pa(addr[i]);
+                unsigned long end;
+                for (end = start + PAGE_SIZE; i < addrinarray - 1; end += PAGE_SIZE) {
+                        if (end != __pa(addr[i + 1]))
+                                break;
+                        i++;
+                }
+                free_memtype(start, end);
+        }
+        return change_page_attr_clear(addr, addrinarray,
+                                      __pgprot(_PAGE_CACHE_MASK), 1);
+}
+EXPORT_SYMBOL(set_memory_array_wb);
 int set_memory_x(unsigned long addr, int numpages)
 {
-        return change_page_attr_clear(addr, numpages, __pgprot(_PAGE_NX));
+        return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_NX), 0);
 }
 EXPORT_SYMBOL(set_memory_x);
 int set_memory_nx(unsigned long addr, int numpages)
 {
-        return change_page_attr_set(addr, numpages, __pgprot(_PAGE_NX));
+        return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_NX), 0);
 }
 EXPORT_SYMBOL(set_memory_nx);
 int set_memory_ro(unsigned long addr, int numpages)
 {
-        return change_page_attr_clear(addr, numpages, __pgprot(_PAGE_RW));
+        return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW), 0);
 }
+EXPORT_SYMBOL_GPL(set_memory_ro);
 int set_memory_rw(unsigned long addr, int numpages)
 {
-        return change_page_attr_set(addr, numpages, __pgprot(_PAGE_RW));
+        return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0);
 }
+EXPORT_SYMBOL_GPL(set_memory_rw);
 int set_memory_np(unsigned long addr, int numpages)
 {
-        return change_page_attr_clear(addr, numpages, __pgprot(_PAGE_PRESENT));
+        return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_PRESENT), 0);
 }
 int set_memory_4k(unsigned long addr, int numpages)
 {
-        return change_page_attr_set_clr(addr, numpages, __pgprot(0),
+        return change_page_attr_set_clr(&addr, numpages, __pgprot(0),
-                                        __pgprot(0), 1);
+                                        __pgprot(0), 1, 0);
 }
 int set_pages_uc(struct page *page, int numpages)
@@ -973,22 +1050,38 @@ int set_pages_rw(struct page *page, int numpages)
 static int __set_pages_p(struct page *page, int numpages)
 {
-        struct cpa_data cpa = { .vaddr = (unsigned long) page_address(page),
+        unsigned long tempaddr = (unsigned long) page_address(page);
+        struct cpa_data cpa = { .vaddr = &tempaddr,
                                .numpages = numpages,
                                .mask_set = __pgprot(_PAGE_PRESENT | _PAGE_RW),
-                                .mask_clr = __pgprot(0)};
+                                .mask_clr = __pgprot(0),
+                                .flags = 0};
-        return __change_page_attr_set_clr(&cpa, 1);
+        /*
+         * No alias checking needed for setting present flag. otherwise,
+         * we may need to break large pages for 64-bit kernel text
+         * mappings (this adds to complexity if we want to do this from
+         * atomic context especially). Let's keep it simple!
+         */
+        return __change_page_attr_set_clr(&cpa, 0);
 }
 static int __set_pages_np(struct page *page, int numpages)
 {
-        struct cpa_data cpa = { .vaddr = (unsigned long) page_address(page),
+        unsigned long tempaddr = (unsigned long) page_address(page);
+        struct cpa_data cpa = { .vaddr = &tempaddr,
                                .numpages = numpages,
                                .mask_set = __pgprot(0),
-                                .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW)};
+                                .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW),
+                                .flags = 0};
-        return __change_page_attr_set_clr(&cpa, 1);
+        /*
+         * No alias checking needed for setting not present flag. otherwise,
+         * we may need to break large pages for 64-bit kernel text
+         * mappings (this adds to complexity if we want to do this from
+         * atomic context especially). Let's keep it simple!
+         */
+        return __change_page_attr_set_clr(&cpa, 0);
 }
 void kernel_map_pages(struct page *page, int numpages, int enable)
@@ -1008,11 +1101,8 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
        /*
         * The return value is ignored as the calls cannot fail.
-         * Large pages are kept enabled at boot time, and are
+         * Large pages for identity mappings are not used at boot time
-         * split up quickly with DEBUG_PAGEALLOC. If a splitup
+         * and hence no memory allocations during large page split.
-         * fails here (due to temporary memory shortage) no damage
-         * is done because we just keep the largepage intact up
-         * to the next attempt when it will likely be split up:
         */
        if (enable)
                __set_pages_p(page, numpages);
@@ -1024,53 +1114,8 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
         * but that can deadlock->flush only current cpu:
         */
        __flush_tlb_all();
-        /*
-         * Try to refill the page pool here. We can do this only after
-         * the tlb flush.
-         */
-        cpa_fill_pool(NULL);
 }
-#ifdef CONFIG_DEBUG_FS
-static int dpa_show(struct seq_file *m, void *v)
-{
-        seq_puts(m, "DEBUG_PAGEALLOC\n");
-        seq_printf(m, "pool_size     : %lu\n", pool_size);
-        seq_printf(m, "pool_pages    : %lu\n", pool_pages);
-        seq_printf(m, "pool_low      : %lu\n", pool_low);
-        seq_printf(m, "pool_used     : %lu\n", pool_used);
-        seq_printf(m, "pool_failed   : %lu\n", pool_failed);
-        return 0;
-}
-static int dpa_open(struct inode *inode, struct file *filp)
-{
-        return single_open(filp, dpa_show, NULL);
-}
-static const struct file_operations dpa_fops = {
-        .open           = dpa_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
-static int __init debug_pagealloc_proc_init(void)
-{
-        struct dentry *de;
-        de = debugfs_create_file("debug_pagealloc", 0600, NULL, NULL,
-                                 &dpa_fops);
-        if (!de)
-                return -ENOMEM;
-        return 0;
-}
-__initcall(debug_pagealloc_proc_init);
-#endif
 #ifdef CONFIG_HIBERNATION
 bool kernel_page_present(struct page *page)
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 2a50e0fa64a5..738fd0f24958 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -7,24 +7,24 @@
 * Loosely based on earlier PAT patchset from Eric Biederman and Andi Kleen.
 */
-#include <linux/mm.h>
+#include <linux/seq_file.h>
+#include <linux/bootmem.h>
+#include <linux/debugfs.h>
 #include <linux/kernel.h>
 #include <linux/gfp.h>
+#include <linux/mm.h>
 #include <linux/fs.h>
-#include <linux/bootmem.h>
-#include <linux/debugfs.h>
-#include <linux/seq_file.h>
-#include <asm/msr.h>
+#include <asm/cacheflush.h>
-#include <asm/tlbflush.h>
 #include <asm/processor.h>
-#include <asm/page.h>
+#include <asm/tlbflush.h>
 #include <asm/pgtable.h>
-#include <asm/pat.h>
-#include <asm/e820.h>
-#include <asm/cacheflush.h>
 #include <asm/fcntl.h>
+#include <asm/e820.h>
 #include <asm/mtrr.h>
+#include <asm/page.h>
+#include <asm/msr.h>
+#include <asm/pat.h>
 #include <asm/io.h>
 #ifdef CONFIG_X86_PAT
@@ -46,6 +46,7 @@ early_param("nopat", nopat);
 static int debug_enable;
 static int __init pat_debug_setup(char *str)
 {
        debug_enable = 1;
@@ -145,14 +146,14 @@ static char *cattr_name(unsigned long flags)
 */
 struct memtype {
-        u64 start;
+        u64                     start;
-        u64 end;
+        u64                     end;
-        unsigned long type;
+        unsigned long           type;
-        struct list_head nd;
+        struct list_head        nd;
 };
 static LIST_HEAD(memtype_list);
-static DEFINE_SPINLOCK(memtype_lock);   /* protects memtype list */
+static DEFINE_SPINLOCK(memtype_lock);   /* protects memtype list */
 /*
 * Does intersection of PAT memory type and MTRR memory type and returns
@@ -180,8 +181,8 @@ static unsigned long pat_x_mtrr_type(u64 start, u64 end, unsigned long req_type)
        return req_type;
 }
-static int chk_conflict(struct memtype *new, struct memtype *entry,
+static int
-                        unsigned long *type)
+chk_conflict(struct memtype *new, struct memtype *entry, unsigned long *type)
 {
        if (new->type != entry->type) {
                if (type) {
@@ -211,6 +212,66 @@ static struct memtype *cached_entry;
 static u64 cached_start;
 /*
+ * For RAM pages, mark the pages as non WB memory type using
+ * PageNonWB (PG_arch_1). We allow only one set_memory_uc() or
+ * set_memory_wc() on a RAM page at a time before marking it as WB again.
+ * This is ok, because only one driver will be owning the page and
+ * doing set_memory_*() calls.
+ *
+ * For now, we use PageNonWB to track that the RAM page is being mapped
+ * as non WB. In future, we will have to use one more flag
+ * (or some other mechanism in page_struct) to distinguish between
+ * UC and WC mapping.
+ */
+static int reserve_ram_pages_type(u64 start, u64 end, unsigned long req_type,
+                                  unsigned long *new_type)
+{
+        struct page *page;
+        u64 pfn, end_pfn;
+        for (pfn = (start >> PAGE_SHIFT); pfn < (end >> PAGE_SHIFT); ++pfn) {
+                page = pfn_to_page(pfn);
+                if (page_mapped(page) || PageNonWB(page))
+                        goto out;
+                SetPageNonWB(page);
+        }
+        return 0;
+out:
+        end_pfn = pfn;
+        for (pfn = (start >> PAGE_SHIFT); pfn < end_pfn; ++pfn) {
+                page = pfn_to_page(pfn);
+                ClearPageNonWB(page);
+        }
+        return -EINVAL;
+}
+static int free_ram_pages_type(u64 start, u64 end)
+{
+        struct page *page;
+        u64 pfn, end_pfn;
+        for (pfn = (start >> PAGE_SHIFT); pfn < (end >> PAGE_SHIFT); ++pfn) {
+                page = pfn_to_page(pfn);
+                if (page_mapped(page) || !PageNonWB(page))
+                        goto out;
+                ClearPageNonWB(page);
+        }
+        return 0;
+out:
+        end_pfn = pfn;
+        for (pfn = (start >> PAGE_SHIFT); pfn < end_pfn; ++pfn) {
+                page = pfn_to_page(pfn);
+                SetPageNonWB(page);
+        }
+        return -EINVAL;
+}
+/*
 * req_type typically has one of the:
 * - _PAGE_CACHE_WB
 * - _PAGE_CACHE_WC
@@ -226,14 +287,15 @@ static u64 cached_start;
 * it will return a negative return value.
 */
 int reserve_memtype(u64 start, u64 end, unsigned long req_type,
-                        unsigned long *new_type)
+                    unsigned long *new_type)
 {
        struct memtype *new, *entry;
        unsigned long actual_type;
        struct list_head *where;
+        int is_range_ram;
        int err = 0;
-        BUG_ON(start >= end); /* end is exclusive */
+        BUG_ON(start >= end); /* end is exclusive */
        if (!pat_enabled) {
                /* This is identical to page table setting without PAT */
@@ -266,17 +328,24 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
                        actual_type = _PAGE_CACHE_WB;
                else
                        actual_type = _PAGE_CACHE_UC_MINUS;
-        } else
+        } else {
                actual_type = pat_x_mtrr_type(start, end,
                                              req_type & _PAGE_CACHE_MASK);
+        }
+        is_range_ram = pagerange_is_ram(start, end);
+        if (is_range_ram == 1)
+                return reserve_ram_pages_type(start, end, req_type, new_type);
+        else if (is_range_ram < 0)
+                return -EINVAL;
        new  = kmalloc(sizeof(struct memtype), GFP_KERNEL);
        if (!new)
                return -ENOMEM;
-        new->start = start;
+        new->start      = start;
-        new->end = end;
+        new->end        = end;
-        new->type = actual_type;
+        new->type       = actual_type;
        if (new_type)
                *new_type = actual_type;
@@ -335,6 +404,7 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
                       start, end, cattr_name(new->type), cattr_name(req_type));
                kfree(new);
                spin_unlock(&memtype_lock);
                return err;
        }
@@ -358,6 +428,7 @@ int free_memtype(u64 start, u64 end)
 {
        struct memtype *entry;
        int err = -EINVAL;
+        int is_range_ram;
        if (!pat_enabled)
                return 0;
@@ -366,6 +437,12 @@ int free_memtype(u64 start, u64 end)
        if (is_ISA_range(start, end - 1))
                return 0;
+        is_range_ram = pagerange_is_ram(start, end);
+        if (is_range_ram == 1)
+                return free_ram_pages_type(start, end);
+        else if (is_range_ram < 0)
+                return -EINVAL;
        spin_lock(&memtype_lock);
        list_for_each_entry(entry, &memtype_list, nd) {
                if (entry->start == start && entry->end == end) {
@@ -386,6 +463,7 @@ int free_memtype(u64 start, u64 end)
        }
        dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
        return err;
 }
@@ -492,9 +570,9 @@ int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
 void map_devmem(unsigned long pfn, unsigned long size, pgprot_t vma_prot)
 {
+        unsigned long want_flags = (pgprot_val(vma_prot) & _PAGE_CACHE_MASK);
        u64 addr = (u64)pfn << PAGE_SHIFT;
        unsigned long flags;
-        unsigned long want_flags = (pgprot_val(vma_prot) & _PAGE_CACHE_MASK);
        reserve_memtype(addr, addr + size, want_flags, &flags);
        if (flags != want_flags) {
@@ -514,7 +592,7 @@ void unmap_devmem(unsigned long pfn, unsigned long size, pgprot_t vma_prot)
        free_memtype(addr, addr + size);
 }
-#if defined(CONFIG_DEBUG_FS)
+#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_X86_PAT)
 /* get Nth element of the linked list */
 static struct memtype *memtype_get_idx(loff_t pos)
@@ -537,6 +615,7 @@ static struct memtype *memtype_get_idx(loff_t pos)
        }
        spin_unlock(&memtype_lock);
        kfree(print_entry);
        return NULL;
 }
@@ -567,6 +646,7 @@ static int memtype_seq_show(struct seq_file *seq, void *v)
        seq_printf(seq, "%s @ 0x%Lx-0x%Lx\n", cattr_name(print_entry->type),
                        print_entry->start, print_entry->end);
        kfree(print_entry);
        return 0;
 }
@@ -598,4 +678,4 @@ static int __init pat_memtype_list_init(void)
 late_initcall(pat_memtype_list_init);
-#endif /* CONFIG_DEBUG_FS */
+#endif /* CONFIG_DEBUG_FS && CONFIG_X86_PAT */
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index d50302774fe2..86f2ffc43c3d 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -63,10 +63,8 @@ static inline void pgd_list_del(pgd_t *pgd)
 #define UNSHARED_PTRS_PER_PGD                           \
        (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-static void pgd_ctor(void *p)
+static void pgd_ctor(pgd_t *pgd)
 {
-        pgd_t *pgd = p;
        /* If the pgd points to a shared pagetable level (either the
           ptes in non-PAE, or shared PMD in PAE), then just copy the
           references from swapper_pg_dir. */
@@ -87,7 +85,7 @@ static void pgd_ctor(void *p)
                pgd_list_add(pgd);
 }
-static void pgd_dtor(void *pgd)
+static void pgd_dtor(pgd_t *pgd)
 {
        unsigned long flags; /* can be called from interrupt context */
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index cab0abbd1ebe..0951db9ee519 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -123,7 +123,8 @@ static int __init parse_vmalloc(char *arg)
        if (!arg)
                return -EINVAL;
-        __VMALLOC_RESERVE = memparse(arg, &arg);
+        /* Add VMALLOC_OFFSET to the parsed value due to vm area guard hole*/
+        __VMALLOC_RESERVE = memparse(arg, &arg) + VMALLOC_OFFSET;
        return 0;
 }
 early_param("vmalloc", parse_vmalloc);
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 0227694f7dab..8a5f1614a3d5 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -295,10 +295,12 @@ static void nmi_cpu_shutdown(void *dummy)
 static void nmi_shutdown(void)
 {
-        struct op_msrs *msrs = &get_cpu_var(cpu_msrs);
+        struct op_msrs *msrs;
        nmi_enabled = 0;
        on_each_cpu(nmi_cpu_shutdown, NULL, 1);
        unregister_die_notifier(&profile_exceptions_nb);
+        msrs = &get_cpu_var(cpu_msrs);
        model->shutdown(msrs);
        free_msrs();
        put_cpu_var(cpu_msrs);
diff --git a/arch/x86/oprofile/op_model_p4.c b/arch/x86/oprofile/op_model_p4.c
index 56b4757a1f47..43ac5af338d8 100644
--- a/arch/x86/oprofile/op_model_p4.c
+++ b/arch/x86/oprofile/op_model_p4.c
@@ -10,11 +10,12 @@
 #include <linux/oprofile.h>
 #include <linux/smp.h>
+#include <linux/ptrace.h>
+#include <linux/nmi.h>
 #include <asm/msr.h>
-#include <asm/ptrace.h>
 #include <asm/fixmap.h>
 #include <asm/apic.h>
-#include <asm/nmi.h>
 #include "op_x86_model.h"
 #include "op_counter.h"
@@ -40,7 +41,7 @@ static unsigned int num_controls = NUM_CONTROLS_NON_HT;
 static inline void setup_num_counters(void)
 {
 #ifdef CONFIG_SMP
-        if (smp_num_siblings == 2){
+        if (smp_num_siblings == 2) {
                num_counters = NUM_COUNTERS_HT2;
                num_controls = NUM_CONTROLS_HT2;
        }
@@ -86,7 +87,7 @@ struct p4_event_binding {
 #define CTR_FLAME_2    (1 << 6)
 #define CTR_IQ_5       (1 << 7)
-static struct p4_counter_binding p4_counters [NUM_COUNTERS_NON_HT] = {
+static struct p4_counter_binding p4_counters[NUM_COUNTERS_NON_HT] = {
        { CTR_BPU_0,   MSR_P4_BPU_PERFCTR0,   MSR_P4_BPU_CCCR0 },
        { CTR_MS_0,    MSR_P4_MS_PERFCTR0,    MSR_P4_MS_CCCR0 },
        { CTR_FLAME_0, MSR_P4_FLAME_PERFCTR0, MSR_P4_FLAME_CCCR0 },
@@ -97,32 +98,32 @@ static struct p4_counter_binding p4_counters [NUM_COUNTERS_NON_HT] = {
        { CTR_IQ_5,    MSR_P4_IQ_PERFCTR5,    MSR_P4_IQ_CCCR5 }
 };
-#define NUM_UNUSED_CCCRS        NUM_CCCRS_NON_HT - NUM_COUNTERS_NON_HT
+#define NUM_UNUSED_CCCRS (NUM_CCCRS_NON_HT - NUM_COUNTERS_NON_HT)
 /* p4 event codes in libop/op_event.h are indices into this table. */
 static struct p4_event_binding p4_events[NUM_EVENTS] = {
-        
        { /* BRANCH_RETIRED */
-                0x05, 0x06, 
+                0x05, 0x06,
                { {CTR_IQ_4, MSR_P4_CRU_ESCR2},
                  {CTR_IQ_5, MSR_P4_CRU_ESCR3} }
        },
-        
        { /* MISPRED_BRANCH_RETIRED */
-                0x04, 0x03, 
+                0x04, 0x03,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR0},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR1} }
        },
-        
        { /* TC_DELIVER_MODE */
                0x01, 0x01,
-                { { CTR_MS_0, MSR_P4_TC_ESCR0},  
+                { { CTR_MS_0, MSR_P4_TC_ESCR0},
                  { CTR_MS_2, MSR_P4_TC_ESCR1} }
        },
-        
        { /* BPU_FETCH_REQUEST */
-                0x00, 0x03, 
+                0x00, 0x03,
                { { CTR_BPU_0, MSR_P4_BPU_ESCR0},
                  { CTR_BPU_2, MSR_P4_BPU_ESCR1} }
        },
@@ -146,7 +147,7 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* LOAD_PORT_REPLAY */
-                0x02, 0x04, 
+                0x02, 0x04,
                { { CTR_FLAME_0, MSR_P4_SAAT_ESCR0},
                  { CTR_FLAME_2, MSR_P4_SAAT_ESCR1} }
        },
@@ -170,43 +171,43 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* BSQ_CACHE_REFERENCE */
-                0x07, 0x0c, 
+                0x07, 0x0c,
                { { CTR_BPU_0, MSR_P4_BSU_ESCR0},
                  { CTR_BPU_2, MSR_P4_BSU_ESCR1} }
        },
        { /* IOQ_ALLOCATION */
-                0x06, 0x03, 
+                0x06, 0x03,
                { { CTR_BPU_0, MSR_P4_FSB_ESCR0},
                  { 0, 0 } }
        },
        { /* IOQ_ACTIVE_ENTRIES */
-                0x06, 0x1a, 
+                0x06, 0x1a,
                { { CTR_BPU_2, MSR_P4_FSB_ESCR1},
                  { 0, 0 } }
        },
        { /* FSB_DATA_ACTIVITY */
-                0x06, 0x17, 
+                0x06, 0x17,
                { { CTR_BPU_0, MSR_P4_FSB_ESCR0},
                  { CTR_BPU_2, MSR_P4_FSB_ESCR1} }
        },
        { /* BSQ_ALLOCATION */
-                0x07, 0x05, 
+                0x07, 0x05,
                { { CTR_BPU_0, MSR_P4_BSU_ESCR0},
                  { 0, 0 } }
        },
        { /* BSQ_ACTIVE_ENTRIES */
                0x07, 0x06,
-                { { CTR_BPU_2, MSR_P4_BSU_ESCR1 /* guess */},  
+                { { CTR_BPU_2, MSR_P4_BSU_ESCR1 /* guess */},
                  { 0, 0 } }
        },
        { /* X87_ASSIST */
-                0x05, 0x03, 
+                0x05, 0x03,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR2},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR3} }
        },
@@ -216,21 +217,21 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* PACKED_SP_UOP */
-                0x01, 0x08, 
+                0x01, 0x08,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* PACKED_DP_UOP */
-                0x01, 0x0c, 
+                0x01, 0x0c,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
        { /* SCALAR_SP_UOP */
-                0x01, 0x0a, 
+                0x01, 0x0a,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
@@ -242,31 +243,31 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* 64BIT_MMX_UOP */
-                0x01, 0x02, 
+                0x01, 0x02,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* 128BIT_MMX_UOP */
-                0x01, 0x1a, 
+                0x01, 0x1a,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
        { /* X87_FP_UOP */
-                0x01, 0x04, 
+                0x01, 0x04,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* X87_SIMD_MOVES_UOP */
-                0x01, 0x2e, 
+                0x01, 0x2e,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* MACHINE_CLEAR */
-                0x05, 0x02, 
+                0x05, 0x02,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR2},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR3} }
        },
@@ -276,9 +277,9 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
                { { CTR_BPU_0, MSR_P4_FSB_ESCR0},
                  { CTR_BPU_2, MSR_P4_FSB_ESCR1} }
        },
-  
        { /* TC_MS_XFER */
-                0x00, 0x05, 
+                0x00, 0x05,
                { { CTR_MS_0, MSR_P4_MS_ESCR0},
                  { CTR_MS_2, MSR_P4_MS_ESCR1} }
        },
@@ -308,7 +309,7 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* INSTR_RETIRED */
-                0x04, 0x02, 
+                0x04, 0x02,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR0},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR1} }
        },
@@ -319,14 +320,14 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
                  { CTR_IQ_5, MSR_P4_CRU_ESCR1} }
        },
-        { /* UOP_TYPE */    
+        { /* UOP_TYPE */
-                0x02, 0x02, 
+                0x02, 0x02,
                { { CTR_IQ_4, MSR_P4_RAT_ESCR0},
                  { CTR_IQ_5, MSR_P4_RAT_ESCR1} }
        },
        { /* RETIRED_MISPRED_BRANCH_TYPE */
-                0x02, 0x05, 
+                0x02, 0x05,
                { { CTR_MS_0, MSR_P4_TBPU_ESCR0},
                  { CTR_MS_2, MSR_P4_TBPU_ESCR1} }
        },
@@ -349,8 +350,8 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
 #define ESCR_SET_OS_1(escr, os) ((escr) |= (((os) & 1) << 1))
 #define ESCR_SET_EVENT_SELECT(escr, sel) ((escr) |= (((sel) & 0x3f) << 25))
 #define ESCR_SET_EVENT_MASK(escr, mask) ((escr) |= (((mask) & 0xffff) << 9))
-#define ESCR_READ(escr,high,ev,i) do {rdmsr(ev->bindings[(i)].escr_address, (escr), (high));} while (0)
+#define ESCR_READ(escr, high, ev, i) do {rdmsr(ev->bindings[(i)].escr_address, (escr), (high)); } while (0)
-#define ESCR_WRITE(escr,high,ev,i) do {wrmsr(ev->bindings[(i)].escr_address, (escr), (high));} while (0)
+#define ESCR_WRITE(escr, high, ev, i) do {wrmsr(ev->bindings[(i)].escr_address, (escr), (high)); } while (0)
 #define CCCR_RESERVED_BITS 0x38030FFF
 #define CCCR_CLEAR(cccr) ((cccr) &= CCCR_RESERVED_BITS)
@@ -360,15 +361,15 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
 #define CCCR_SET_PMI_OVF_1(cccr) ((cccr) |= (1<<27))
 #define CCCR_SET_ENABLE(cccr) ((cccr) |= (1<<12))
 #define CCCR_SET_DISABLE(cccr) ((cccr) &= ~(1<<12))
-#define CCCR_READ(low, high, i) do {rdmsr(p4_counters[(i)].cccr_address, (low), (high));} while (0)
+#define CCCR_READ(low, high, i) do {rdmsr(p4_counters[(i)].cccr_address, (low), (high)); } while (0)
-#define CCCR_WRITE(low, high, i) do {wrmsr(p4_counters[(i)].cccr_address, (low), (high));} while (0)
+#define CCCR_WRITE(low, high, i) do {wrmsr(p4_counters[(i)].cccr_address, (low), (high)); } while (0)
 #define CCCR_OVF_P(cccr) ((cccr) & (1U<<31))
 #define CCCR_CLEAR_OVF(cccr) ((cccr) &= (~(1U<<31)))
-#define CTRL_IS_RESERVED(msrs,c) (msrs->controls[(c)].addr ? 1 : 0)
+#define CTRL_IS_RESERVED(msrs, c) (msrs->controls[(c)].addr ? 1 : 0)
-#define CTR_IS_RESERVED(msrs,c) (msrs->counters[(c)].addr ? 1 : 0)
+#define CTR_IS_RESERVED(msrs, c) (msrs->counters[(c)].addr ? 1 : 0)
-#define CTR_READ(l,h,i) do {rdmsr(p4_counters[(i)].counter_address, (l), (h));} while (0)
+#define CTR_READ(l, h, i) do {rdmsr(p4_counters[(i)].counter_address, (l), (h)); } while (0)
-#define CTR_WRITE(l,i) do {wrmsr(p4_counters[(i)].counter_address, -(u32)(l), -1);} while (0)
+#define CTR_WRITE(l, i) do {wrmsr(p4_counters[(i)].counter_address, -(u32)(l), -1); } while (0)
 #define CTR_OVERFLOW_P(ctr) (!((ctr) & 0x80000000))
@@ -380,7 +381,7 @@ static unsigned int get_stagger(void)
 #ifdef CONFIG_SMP
        int cpu = smp_processor_id();
        return (cpu != first_cpu(per_cpu(cpu_sibling_map, cpu)));
-#endif  
+#endif
        return 0;
 }
@@ -395,25 +396,23 @@ static unsigned long reset_value[NUM_COUNTERS_NON_HT];
 static void p4_fill_in_addresses(struct op_msrs * const msrs)
 {
-        unsigned int i; 
+        unsigned int i;
        unsigned int addr, cccraddr, stag;
        setup_num_counters();
        stag = get_stagger();
        /* initialize some registers */
-        for (i = 0; i < num_counters; ++i) {
+        for (i = 0; i < num_counters; ++i)
                msrs->counters[i].addr = 0;
-        }
+        for (i = 0; i < num_controls; ++i)
-        for (i = 0; i < num_controls; ++i) {
                msrs->controls[i].addr = 0;
-        }
-        
        /* the counter & cccr registers we pay attention to */
        for (i = 0; i < num_counters; ++i) {
                addr = p4_counters[VIRT_CTR(stag, i)].counter_address;
                cccraddr = p4_counters[VIRT_CTR(stag, i)].cccr_address;
-                if (reserve_perfctr_nmi(addr)){
+                if (reserve_perfctr_nmi(addr)) {
                        msrs->counters[i].addr = addr;
                        msrs->controls[i].addr = cccraddr;
                }
@@ -447,22 +446,22 @@ static void p4_fill_in_addresses(struct op_msrs * const msrs)
                if (reserve_evntsel_nmi(addr))
                        msrs->controls[i].addr = addr;
        }
-        
        for (addr = MSR_P4_MS_ESCR0 + stag;
-             addr <= MSR_P4_TC_ESCR1; ++i, addr += addr_increment()) { 
+             addr <= MSR_P4_TC_ESCR1; ++i, addr += addr_increment()) {
                if (reserve_evntsel_nmi(addr))
                        msrs->controls[i].addr = addr;
        }
-        
        for (addr = MSR_P4_IX_ESCR0 + stag;
-             addr <= MSR_P4_CRU_ESCR3; ++i, addr += addr_increment()) { 
+             addr <= MSR_P4_CRU_ESCR3; ++i, addr += addr_increment()) {
                if (reserve_evntsel_nmi(addr))
                        msrs->controls[i].addr = addr;
        }
        /* there are 2 remaining non-contiguously located ESCRs */
-        if (num_counters == NUM_COUNTERS_NON_HT) {              
+        if (num_counters == NUM_COUNTERS_NON_HT) {
                /* standard non-HT CPUs handle both remaining ESCRs*/
                if (reserve_evntsel_nmi(MSR_P4_CRU_ESCR5))
                        msrs->controls[i++].addr = MSR_P4_CRU_ESCR5;
@@ -498,20 +497,20 @@ static void pmc_setup_one_p4_counter(unsigned int ctr)
        unsigned int stag;
        stag = get_stagger();
-        
        /* convert from counter *number* to counter *bit* */
        counter_bit = 1 << VIRT_CTR(stag, ctr);
-        
        /* find our event binding structure. */
        if (counter_config[ctr].event <= 0 || counter_config[ctr].event > NUM_EVENTS) {
-                printk(KERN_ERR 
+                printk(KERN_ERR
-                       "oprofile: P4 event code 0x%lx out of range\n", 
+                       "oprofile: P4 event code 0x%lx out of range\n",
                       counter_config[ctr].event);
                return;
        }
-        
        ev = &(p4_events[counter_config[ctr].event - 1]);
-        
        for (i = 0; i < maxbind; i++) {
                if (ev->bindings[i].virt_counter & counter_bit) {
@@ -526,25 +525,24 @@ static void pmc_setup_one_p4_counter(unsigned int ctr)
                                ESCR_SET_OS_1(escr, counter_config[ctr].kernel);
                        }
                        ESCR_SET_EVENT_SELECT(escr, ev->event_select);
-                        ESCR_SET_EVENT_MASK(escr, counter_config[ctr].unit_mask);                       
+                        ESCR_SET_EVENT_MASK(escr, counter_config[ctr].unit_mask);
                        ESCR_WRITE(escr, high, ev, i);
-                       
                        /* modify CCCR */
                        CCCR_READ(cccr, high, VIRT_CTR(stag, ctr));
                        CCCR_CLEAR(cccr);
                        CCCR_SET_REQUIRED_BITS(cccr);
                        CCCR_SET_ESCR_SELECT(cccr, ev->escr_select);
-                        if (stag == 0) {
+                        if (stag == 0)
                                CCCR_SET_PMI_OVF_0(cccr);
-                        } else {
+                        else
                                CCCR_SET_PMI_OVF_1(cccr);
-                        }
                        CCCR_WRITE(cccr, high, VIRT_CTR(stag, ctr));
                        return;
                }
        }
-        printk(KERN_ERR 
+        printk(KERN_ERR
               "oprofile: P4 event code 0x%lx no binding, stag %d ctr %d\n",
               counter_config[ctr].event, stag, ctr);
 }
@@ -559,14 +557,14 @@ static void p4_setup_ctrs(struct op_msrs const * const msrs)
        stag = get_stagger();
        rdmsr(MSR_IA32_MISC_ENABLE, low, high);
-        if (! MISC_PMC_ENABLED_P(low)) {
+        if (!MISC_PMC_ENABLED_P(low)) {
                printk(KERN_ERR "oprofile: P4 PMC not available\n");
                return;
        }
        /* clear the cccrs we will use */
        for (i = 0 ; i < num_counters ; i++) {
-                if (unlikely(!CTRL_IS_RESERVED(msrs,i)))
+                if (unlikely(!CTRL_IS_RESERVED(msrs, i)))
                        continue;
                rdmsr(p4_counters[VIRT_CTR(stag, i)].cccr_address, low, high);
                CCCR_CLEAR(low);
@@ -576,14 +574,14 @@ static void p4_setup_ctrs(struct op_msrs const * const msrs)
        /* clear all escrs (including those outside our concern) */
        for (i = num_counters; i < num_controls; i++) {
-                if (unlikely(!CTRL_IS_RESERVED(msrs,i)))
+                if (unlikely(!CTRL_IS_RESERVED(msrs, i)))
                        continue;
                wrmsr(msrs->controls[i].addr, 0, 0);
        }
        /* setup all counters */
        for (i = 0 ; i < num_counters ; ++i) {
-                if ((counter_config[i].enabled) && (CTRL_IS_RESERVED(msrs,i))) {
+                if ((counter_config[i].enabled) && (CTRL_IS_RESERVED(msrs, i))) {
                        reset_value[i] = counter_config[i].count;
                        pmc_setup_one_p4_counter(i);
                        CTR_WRITE(counter_config[i].count, VIRT_CTR(stag, i));
@@ -603,11 +601,11 @@ static int p4_check_ctrs(struct pt_regs * const regs,
        stag = get_stagger();
        for (i = 0; i < num_counters; ++i) {
-                
-                if (!reset_value[i]) 
+                if (!reset_value[i])
                        continue;
-                /* 
+                /*
                 * there is some eccentricity in the hardware which
                 * requires that we perform 2 extra corrections:
                 *
@@ -616,24 +614,24 @@ static int p4_check_ctrs(struct pt_regs * const regs,
                 *
                 * - write the counter back twice to ensure it gets
                 *   updated properly.
-                 * 
+                 *
                 * the former seems to be related to extra NMIs happening
                 * during the current NMI; the latter is reported as errata
                 * N15 in intel doc 249199-029, pentium 4 specification
                 * update, though their suggested work-around does not
                 * appear to solve the problem.
                 */
-                
                real = VIRT_CTR(stag, i);
                CCCR_READ(low, high, real);
-                CTR_READ(ctr, high, real);
+                CTR_READ(ctr, high, real);
                if (CCCR_OVF_P(low) || CTR_OVERFLOW_P(ctr)) {
                        oprofile_add_sample(regs, i);
-                        CTR_WRITE(reset_value[i], real);
+                        CTR_WRITE(reset_value[i], real);
                        CCCR_CLEAR_OVF(low);
                        CCCR_WRITE(low, high, real);
-                        CTR_WRITE(reset_value[i], real);
+                        CTR_WRITE(reset_value[i], real);
                }
        }
@@ -683,15 +681,16 @@ static void p4_shutdown(struct op_msrs const * const msrs)
        int i;
        for (i = 0 ; i < num_counters ; ++i) {
-                if (CTR_IS_RESERVED(msrs,i))
+                if (CTR_IS_RESERVED(msrs, i))
                        release_perfctr_nmi(msrs->counters[i].addr);
        }
-        /* some of the control registers are specially reserved in
+        /*
+         * some of the control registers are specially reserved in
         * conjunction with the counter registers (hence the starting offset).
         * This saves a few bits.
         */
        for (i = num_counters ; i < num_controls ; ++i) {
-                if (CTRL_IS_RESERVED(msrs,i))
+                if (CTRL_IS_RESERVED(msrs, i))
                        release_evntsel_nmi(msrs->controls[i].addr);
        }
 }
diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
index 6a0fca78c362..22e057665e55 100644
--- a/arch/x86/pci/amd_bus.c
+++ b/arch/x86/pci/amd_bus.c
@@ -580,7 +580,7 @@ static int __cpuinit amd_cpu_notify(struct notifier_block *self,
                                    unsigned long action, void *hcpu)
 {
        int cpu = (long)hcpu;
-        switch(action) {
+        switch (action) {
        case CPU_ONLINE:
        case CPU_ONLINE_FROZEN:
                smp_call_function_single(cpu, enable_pci_io_ecs, NULL, 0);
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index 8e077185e185..006599db0dc7 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -1043,35 +1043,44 @@ static void __init pcibios_fixup_irqs(void)
                if (io_apic_assign_pci_irqs) {
                        int irq;
-                        if (pin) {
+                        if (!pin)
-                                /*
+                                continue;
-                                 * interrupt pins are numbered starting
-                                 * from 1
+                        /*
-                                 */
+                         * interrupt pins are numbered starting from 1
-                                pin--;
+                         */
-                                irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
+                        pin--;
-                                        PCI_SLOT(dev->devfn), pin);
+                        irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
-        /*
+                                PCI_SLOT(dev->devfn), pin);
-         * Busses behind bridges are typically not listed in the MP-table.
+                        /*
-         * In this case we have to look up the IRQ based on the parent bus,
+                         * Busses behind bridges are typically not listed in the
-         * parent slot, and pin number. The SMP code detects such bridged
+                         * MP-table.  In this case we have to look up the IRQ
-         * busses itself so we should get into this branch reliably.
+                         * based on the parent bus, parent slot, and pin number.
-         */
+                         * The SMP code detects such bridged busses itself so we
-                                if (irq < 0 && dev->bus->parent) { /* go back to the bridge */
+                         * should get into this branch reliably.
-                                        struct pci_dev *bridge = dev->bus->self;
+                         */
+                        if (irq < 0 && dev->bus->parent) {
-                                        pin = (pin + PCI_SLOT(dev->devfn)) % 4;
+                                /* go back to the bridge */
-                                        irq = IO_APIC_get_PCI_irq_vector(bridge->bus->number,
+                                struct pci_dev *bridge = dev->bus->self;
-                                                        PCI_SLOT(bridge->devfn), pin);
+                                int bus;
-                                        if (irq >= 0)
-                                                dev_warn(&dev->dev, "using bridge %s INT %c to get IRQ %d\n",
+                                pin = (pin + PCI_SLOT(dev->devfn)) % 4;
-                                                         pci_name(bridge),
+                                bus = bridge->bus->number;
-                                                         'A' + pin, irq);
+                                irq = IO_APIC_get_PCI_irq_vector(bus,
-                                }
+                                                PCI_SLOT(bridge->devfn), pin);
-                                if (irq >= 0) {
+                                if (irq >= 0)
-                                        dev_info(&dev->dev, "PCI->APIC IRQ transform: INT %c -> IRQ %d\n", 'A' + pin, irq);
+                                        dev_warn(&dev->dev,
-                                        dev->irq = irq;
+                                                "using bridge %s INT %c to "
-                                }
+                                                        "get IRQ %d\n",
+                                                 pci_name(bridge),
+                                                 'A' + pin, irq);
+                        }
+                        if (irq >= 0) {
+                                dev_info(&dev->dev,
+                                        "PCI->APIC IRQ transform: INT %c "
+                                                "-> IRQ %d\n",
+                                        'A' + pin, irq);
+                                dev->irq = irq;
                        }
                }
 #endif
diff --git a/arch/x86/power/hibernate_asm_32.S b/arch/x86/power/hibernate_asm_32.S
index 4fc7e872c85e..d1e9b53f9d33 100644
--- a/arch/x86/power/hibernate_asm_32.S
+++ b/arch/x86/power/hibernate_asm_32.S
@@ -1,5 +1,3 @@
-.text
 /*
 * This may not use any stack, nor any variable that is not "NoSave":
 *
@@ -12,17 +10,18 @@
 #include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/asm-offsets.h>
+#include <asm/processor-flags.h>
-        .text
+.text
 ENTRY(swsusp_arch_suspend)
        movl %esp, saved_context_esp
        movl %ebx, saved_context_ebx
        movl %ebp, saved_context_ebp
        movl %esi, saved_context_esi
        movl %edi, saved_context_edi
-        pushfl ; popl saved_context_eflags
+        pushfl
+        popl saved_context_eflags
        call swsusp_save
        ret
@@ -59,7 +58,7 @@ done:
        movl    mmu_cr4_features, %ecx
        jecxz   1f      # cr4 Pentium and higher, skip if zero
        movl    %ecx, %edx
-        andl    $~(1<<7), %edx;  # PGE
+        andl    $~(X86_CR4_PGE), %edx
        movl    %edx, %cr4;  # turn off PGE
 1:
        movl    %cr3, %eax;  # flush TLB
@@ -74,7 +73,8 @@ done:
        movl saved_context_esi, %esi
        movl saved_context_edi, %edi
-        pushl saved_context_eflags ; popfl
+        pushl saved_context_eflags
+        popfl
        xorl    %eax, %eax
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 7b3508952b9c..a27d562a9744 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -844,7 +844,7 @@ static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
 /* Early in boot, while setting up the initial pagetable, assume
   everything is pinned. */
-static __init void xen_alloc_pte_init(struct mm_struct *mm, u32 pfn)
+static __init void xen_alloc_pte_init(struct mm_struct *mm, unsigned long pfn)
 {
 #ifdef CONFIG_FLATMEM
        BUG_ON(mem_map);        /* should only be used early */
@@ -854,7 +854,7 @@ static __init void xen_alloc_pte_init(struct mm_struct *mm, u32 pfn)
 /* Early release_pte assumes that all pts are pinned, since there's
   only init_mm and anything attached to that is pinned. */
-static void xen_release_pte_init(u32 pfn)
+static void xen_release_pte_init(unsigned long pfn)
 {
        make_lowmem_page_readwrite(__va(PFN_PHYS(pfn)));
 }
@@ -870,7 +870,7 @@ static void pin_pagetable_pfn(unsigned cmd, unsigned long pfn)
 /* This needs to make sure the new pte page is pinned iff its being
   attached to a pinned pagetable. */
-static void xen_alloc_ptpage(struct mm_struct *mm, u32 pfn, unsigned level)
+static void xen_alloc_ptpage(struct mm_struct *mm, unsigned long pfn, unsigned level)
 {
        struct page *page = pfn_to_page(pfn);
@@ -888,12 +888,12 @@ static void xen_alloc_ptpage(struct mm_struct *mm, u32 pfn, unsigned level)
        }
 }
-static void xen_alloc_pte(struct mm_struct *mm, u32 pfn)
+static void xen_alloc_pte(struct mm_struct *mm, unsigned long pfn)
 {
        xen_alloc_ptpage(mm, pfn, PT_PTE);
 }
-static void xen_alloc_pmd(struct mm_struct *mm, u32 pfn)
+static void xen_alloc_pmd(struct mm_struct *mm, unsigned long pfn)
 {
        xen_alloc_ptpage(mm, pfn, PT_PMD);
 }
@@ -941,7 +941,7 @@ static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
 }
 /* This should never happen until we're OK to use struct page */
-static void xen_release_ptpage(u32 pfn, unsigned level)
+static void xen_release_ptpage(unsigned long pfn, unsigned level)
 {
        struct page *page = pfn_to_page(pfn);
@@ -955,23 +955,23 @@ static void xen_release_ptpage(u32 pfn, unsigned level)
        }
 }
-static void xen_release_pte(u32 pfn)
+static void xen_release_pte(unsigned long pfn)
 {
        xen_release_ptpage(pfn, PT_PTE);
 }
-static void xen_release_pmd(u32 pfn)
+static void xen_release_pmd(unsigned long pfn)
 {
        xen_release_ptpage(pfn, PT_PMD);
 }
 #if PAGETABLE_LEVELS == 4
-static void xen_alloc_pud(struct mm_struct *mm, u32 pfn)
+static void xen_alloc_pud(struct mm_struct *mm, unsigned long pfn)
 {
        xen_alloc_ptpage(mm, pfn, PT_PUD);
 }
-static void xen_release_pud(u32 pfn)
+static void xen_release_pud(unsigned long pfn)
 {
        xen_release_ptpage(pfn, PT_PUD);
 }
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index b6acc3a0af46..d67901083888 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -42,7 +42,7 @@ char * __init xen_memory_setup(void)
        e820.nr_map = 0;
-        e820_add_region(0, PFN_PHYS(max_pfn), E820_RAM);
+        e820_add_region(0, PFN_PHYS((u64)max_pfn), E820_RAM);
        /*
         * Even though this is normal, usable memory under Xen, reserve
diff --git a/block/cmd-filter.c b/block/cmd-filter.c
index 228b6447e89f..79c14996ac11 100644
--- a/block/cmd-filter.c
+++ b/block/cmd-filter.c
@@ -49,6 +49,7 @@ int blk_verify_command(struct blk_cmd_filter *filter,
 }
 EXPORT_SYMBOL(blk_verify_command);
+#if 0
 /* and now, the sysfs stuff */
 static ssize_t rcf_cmds_show(struct blk_cmd_filter *filter, char *page,
                             int rw)
@@ -233,3 +234,4 @@ void blk_unregister_filter(struct gendisk *disk)
        kobject_put(disk->holder_dir->parent);
 }
 EXPORT_SYMBOL(blk_unregister_filter);
+#endif
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index 0a5f6b2114c5..d672cfe7ca59 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -376,6 +376,8 @@ int braille_register_console(struct console *console, int index,
        console->flags |= CON_ENABLED;
        console->index = index;
        braille_co = console;
+        register_keyboard_notifier(&keyboard_notifier_block);
+        register_vt_notifier(&vt_notifier_block);
        return 0;
 }
@@ -383,15 +385,8 @@ int braille_unregister_console(struct console *console)
 {
        if (braille_co != console)
                return -EINVAL;
+        unregister_keyboard_notifier(&keyboard_notifier_block);
+        unregister_vt_notifier(&vt_notifier_block);
        braille_co = NULL;
        return 0;
 }
-static int __init braille_init(void)
-{
-        register_keyboard_notifier(&keyboard_notifier_block);
-        register_vt_notifier(&vt_notifier_block);
-        return 0;
-}
-console_initcall(braille_init);
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 084109507c9f..8dd3336efd7e 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -165,8 +165,11 @@ static int acpi_bind_one(struct device *dev, acpi_handle handle)
                                "firmware_node");
                ret = sysfs_create_link(&acpi_dev->dev.kobj, &dev->kobj,
                                "physical_node");
-                if (acpi_dev->wakeup.flags.valid)
+                if (acpi_dev->wakeup.flags.valid) {
                        device_set_wakeup_capable(dev, true);
+                        device_set_wakeup_enable(dev,
+                                                acpi_dev->wakeup.state.enabled);
+                }
        }
        return 0;
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 4ebbba2b6b19..bf5b04de02d1 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -377,6 +377,14 @@ acpi_system_wakeup_device_seq_show(struct seq_file *seq, void *offset)
        return 0;
 }
+static void physical_device_enable_wakeup(struct acpi_device *adev)
+{
+        struct device *dev = acpi_get_physical_device(adev->handle);
+        if (dev && device_can_wakeup(dev))
+                device_set_wakeup_enable(dev, adev->wakeup.state.enabled);
+}
 static ssize_t
 acpi_system_write_wakeup_device(struct file *file,
                                const char __user * buffer,
@@ -411,6 +419,7 @@ acpi_system_write_wakeup_device(struct file *file,
                }
        }
        if (found_dev) {
+                physical_device_enable_wakeup(found_dev);
                list_for_each_safe(node, next, &acpi_wakeup_device_list) {
                        struct acpi_device *dev = container_of(node,
                                                               struct
@@ -428,6 +437,7 @@ acpi_system_write_wakeup_device(struct file *file,
                                       dev->pnp.bus_id, found_dev->pnp.bus_id);
                                dev->wakeup.state.enabled =
                                    found_dev->wakeup.state.enabled;
+                                physical_device_enable_wakeup(dev);
                        }
                }
        }
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 11c8c19f0fb7..f17cd4b572f8 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -663,7 +663,7 @@ config HAVE_PATA_PLATFORM
 config PATA_PLATFORM
        tristate "Generic platform device PATA support"
-        depends on EMBEDDED || ARCH_RPC || PPC || HAVE_PATA_PLATFORM
+        depends on EMBEDDED || PPC || HAVE_PATA_PLATFORM
        help
          This option enables support for generic directly connected ATA
          devices commonly found on embedded systems.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 2e1a7cb2ed5f..aeadd00411a1 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -267,8 +267,8 @@ struct ahci_port_priv {
                                                 * per PM slot */
 };
-static int ahci_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int ahci_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int ahci_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static unsigned int ahci_qc_issue(struct ata_queued_cmd *qc);
 static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
@@ -316,6 +316,7 @@ static struct device_attribute *ahci_shost_attrs[] = {
 static struct device_attribute *ahci_sdev_attrs[] = {
        &dev_attr_sw_activity,
+        &dev_attr_unload_heads,
        NULL
 };
@@ -820,10 +821,10 @@ static unsigned ahci_scr_offset(struct ata_port *ap, unsigned int sc_reg)
        return 0;
 }
-static int ahci_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int ahci_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
-        void __iomem *port_mmio = ahci_port_base(ap);
+        void __iomem *port_mmio = ahci_port_base(link->ap);
-        int offset = ahci_scr_offset(ap, sc_reg);
+        int offset = ahci_scr_offset(link->ap, sc_reg);
        if (offset) {
                *val = readl(port_mmio + offset);
@@ -832,10 +833,10 @@ static int ahci_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
        return -EINVAL;
 }
-static int ahci_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
-        void __iomem *port_mmio = ahci_port_base(ap);
+        void __iomem *port_mmio = ahci_port_base(link->ap);
-        int offset = ahci_scr_offset(ap, sc_reg);
+        int offset = ahci_scr_offset(link->ap, sc_reg);
        if (offset) {
                writel(val, port_mmio + offset);
@@ -973,7 +974,7 @@ static void ahci_disable_alpm(struct ata_port *ap)
        writel(PORT_IRQ_PHYRDY, port_mmio + PORT_IRQ_STAT);
        /* go ahead and clean out PhyRdy Change from Serror too */
-        ahci_scr_write(ap, SCR_ERROR, ((1 << 16) | (1 << 18)));
+        ahci_scr_write(&ap->link, SCR_ERROR, ((1 << 16) | (1 << 18)));
        /*
         * Clear flag to indicate that we should ignore all PhyRdy
@@ -1937,8 +1938,8 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat)
        ata_ehi_push_desc(host_ehi, "irq_stat 0x%08x", irq_stat);
        /* AHCI needs SError cleared; otherwise, it might lock up */
-        ahci_scr_read(ap, SCR_ERROR, &serror);
+        ahci_scr_read(&ap->link, SCR_ERROR, &serror);
-        ahci_scr_write(ap, SCR_ERROR, serror);
+        ahci_scr_write(&ap->link, SCR_ERROR, serror);
        host_ehi->serror |= serror;
        /* some controllers set IRQ_IF_ERR on device errors, ignore it */
@@ -2027,7 +2028,7 @@ static void ahci_port_intr(struct ata_port *ap)
        if ((hpriv->flags & AHCI_HFLAG_NO_HOTPLUG) &&
                (status & PORT_IRQ_PHYRDY)) {
                status &= ~PORT_IRQ_PHYRDY;
-                ahci_scr_write(ap, SCR_ERROR, ((1 << 16) | (1 << 18)));
+                ahci_scr_write(&ap->link, SCR_ERROR, ((1 << 16) | (1 << 18)));
        }
        if (unlikely(status & PORT_IRQ_ERROR)) {
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index b1d08a8f5003..e9e32ed6b1a3 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -165,8 +165,10 @@ static void piix_set_dmamode(struct ata_port *ap, struct ata_device *adev);
 static void ich_set_dmamode(struct ata_port *ap, struct ata_device *adev);
 static int ich_pata_cable_detect(struct ata_port *ap);
 static u8 piix_vmw_bmdma_status(struct ata_port *ap);
-static int piix_sidpr_scr_read(struct ata_port *ap, unsigned int reg, u32 *val);
+static int piix_sidpr_scr_read(struct ata_link *link,
-static int piix_sidpr_scr_write(struct ata_port *ap, unsigned int reg, u32 val);
+                               unsigned int reg, u32 *val);
+static int piix_sidpr_scr_write(struct ata_link *link,
+                                unsigned int reg, u32 val);
 #ifdef CONFIG_PM
 static int piix_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg);
 static int piix_pci_device_resume(struct pci_dev *pdev);
@@ -278,12 +280,15 @@ static const struct pci_device_id piix_pci_tbl[] = {
        /* SATA Controller IDE (PCH) */
        { 0x8086, 0x3b20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
        /* SATA Controller IDE (PCH) */
+        { 0x8086, 0x3b21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+        /* SATA Controller IDE (PCH) */
        { 0x8086, 0x3b26, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        /* SATA Controller IDE (PCH) */
+        { 0x8086, 0x3b28, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
+        /* SATA Controller IDE (PCH) */
        { 0x8086, 0x3b2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
        /* SATA Controller IDE (PCH) */
        { 0x8086, 0x3b2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
        { }     /* terminate list */
 };
@@ -582,6 +587,7 @@ static const struct ich_laptop ich_laptop[] = {
        { 0x27DF, 0x1025, 0x0110 },     /* ICH7 on Acer 3682WLMi */
        { 0x27DF, 0x1043, 0x1267 },     /* ICH7 on Asus W5F */
        { 0x27DF, 0x103C, 0x30A1 },     /* ICH7 on HP Compaq nc2400 */
+        { 0x27DF, 0x1071, 0xD221 },     /* ICH7 on Hercules EC-900 */
        { 0x24CA, 0x1025, 0x0061 },     /* ICH4 on ACER Aspire 2023WLMi */
        { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
        { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
@@ -885,23 +891,9 @@ static void ich_set_dmamode(struct ata_port *ap, struct ata_device *adev)
 * Serial ATA Index/Data Pair Superset Registers access
 *
 * Beginning from ICH8, there's a sane way to access SCRs using index
- * and data register pair located at BAR5.  This creates an
+ * and data register pair located at BAR5 which means that we have
- * interesting problem of mapping two SCRs to one port.
+ * separate SCRs for master and slave.  This is handled using libata
- *
+ * slave_link facility.
- * Although they have separate SCRs, the master and slave aren't
- * independent enough to be treated as separate links - e.g. softreset
- * resets both.  Also, there's no protocol defined for hard resetting
- * singled device sharing the virtual port (no defined way to acquire
- * device signature).  This is worked around by merging the SCR values
- * into one sensible value and requesting follow-up SRST after
- * hardreset.
- *
- * SCR merging is perfomed in nibbles which is the unit contents in
- * SCRs are organized.  If two values are equal, the value is used.
- * When they differ, merge table which lists precedence of possible
- * values is consulted and the first match or the last entry when
- * nothing matches is used.  When there's no merge table for the
- * specific nibble, value from the first port is used.
 */
 static const int piix_sidx_map[] = {
        [SCR_STATUS]    = 0,
@@ -909,120 +901,38 @@ static const int piix_sidx_map[] = {
        [SCR_CONTROL]   = 1,
 };
-static void piix_sidpr_sel(struct ata_device *dev, unsigned int reg)
+static void piix_sidpr_sel(struct ata_link *link, unsigned int reg)
 {
-        struct ata_port *ap = dev->link->ap;
+        struct ata_port *ap = link->ap;
        struct piix_host_priv *hpriv = ap->host->private_data;
-        iowrite32(((ap->port_no * 2 + dev->devno) << 8) | piix_sidx_map[reg],
+        iowrite32(((ap->port_no * 2 + link->pmp) << 8) | piix_sidx_map[reg],
                  hpriv->sidpr + PIIX_SIDPR_IDX);
 }
-static int piix_sidpr_read(struct ata_device *dev, unsigned int reg)
+static int piix_sidpr_scr_read(struct ata_link *link,
-{
+                               unsigned int reg, u32 *val)
-        struct piix_host_priv *hpriv = dev->link->ap->host->private_data;
-        piix_sidpr_sel(dev, reg);
-        return ioread32(hpriv->sidpr + PIIX_SIDPR_DATA);
-}
-static void piix_sidpr_write(struct ata_device *dev, unsigned int reg, u32 val)
-{
-        struct piix_host_priv *hpriv = dev->link->ap->host->private_data;
-        piix_sidpr_sel(dev, reg);
-        iowrite32(val, hpriv->sidpr + PIIX_SIDPR_DATA);
-}
-static u32 piix_merge_scr(u32 val0, u32 val1, const int * const *merge_tbl)
-{
-        u32 val = 0;
-        int i, mi;
-        for (i = 0, mi = 0; i < 32 / 4; i++) {
-                u8 c0 = (val0 >> (i * 4)) & 0xf;
-                u8 c1 = (val1 >> (i * 4)) & 0xf;
-                u8 merged = c0;
-                const int *cur;
-                /* if no merge preference, assume the first value */
-                cur = merge_tbl[mi];
-                if (!cur)
-                        goto done;
-                mi++;
-                /* if two values equal, use it */
-                if (c0 == c1)
-                        goto done;
-                /* choose the first match or the last from the merge table */
-                while (*cur != -1) {
-                        if (c0 == *cur || c1 == *cur)
-                                break;
-                        cur++;
-                }
-                if (*cur == -1)
-                        cur--;
-                merged = *cur;
-        done:
-                val |= merged << (i * 4);
-        }
-        return val;
-}
-static int piix_sidpr_scr_read(struct ata_port *ap, unsigned int reg, u32 *val)
 {
-        const int * const sstatus_merge_tbl[] = {
+        struct piix_host_priv *hpriv = link->ap->host->private_data;
-                /* DET */ (const int []){ 1, 3, 0, 4, 3, -1 },
-                /* SPD */ (const int []){ 2, 1, 0, -1 },
-                /* IPM */ (const int []){ 6, 2, 1, 0, -1 },
-                NULL,
-        };
-        const int * const scontrol_merge_tbl[] = {
-                /* DET */ (const int []){ 1, 0, 4, 0, -1 },
-                /* SPD */ (const int []){ 0, 2, 1, 0, -1 },
-                /* IPM */ (const int []){ 0, 1, 2, 3, 0, -1 },
-                NULL,
-        };
-        u32 v0, v1;
        if (reg >= ARRAY_SIZE(piix_sidx_map))
                return -EINVAL;
-        if (!(ap->flags & ATA_FLAG_SLAVE_POSS)) {
+        piix_sidpr_sel(link, reg);
-                *val = piix_sidpr_read(&ap->link.device[0], reg);
+        *val = ioread32(hpriv->sidpr + PIIX_SIDPR_DATA);
-                return 0;
-        }
-        v0 = piix_sidpr_read(&ap->link.device[0], reg);
-        v1 = piix_sidpr_read(&ap->link.device[1], reg);
-        switch (reg) {
-        case SCR_STATUS:
-                *val = piix_merge_scr(v0, v1, sstatus_merge_tbl);
-                break;
-        case SCR_ERROR:
-                *val = v0 | v1;
-                break;
-        case SCR_CONTROL:
-                *val = piix_merge_scr(v0, v1, scontrol_merge_tbl);
-                break;
-        }
        return 0;
 }
-static int piix_sidpr_scr_write(struct ata_port *ap, unsigned int reg, u32 val)
+static int piix_sidpr_scr_write(struct ata_link *link,
+                                unsigned int reg, u32 val)
 {
+        struct piix_host_priv *hpriv = link->ap->host->private_data;
        if (reg >= ARRAY_SIZE(piix_sidx_map))
                return -EINVAL;
-        piix_sidpr_write(&ap->link.device[0], reg, val);
+        piix_sidpr_sel(link, reg);
+        iowrite32(val, hpriv->sidpr + PIIX_SIDPR_DATA);
-        if (ap->flags & ATA_FLAG_SLAVE_POSS)
-                piix_sidpr_write(&ap->link.device[1], reg, val);
        return 0;
 }
@@ -1363,28 +1273,28 @@ static const int *__devinit piix_init_sata_map(struct pci_dev *pdev,
        return map;
 }
-static void __devinit piix_init_sidpr(struct ata_host *host)
+static int __devinit piix_init_sidpr(struct ata_host *host)
 {
        struct pci_dev *pdev = to_pci_dev(host->dev);
        struct piix_host_priv *hpriv = host->private_data;
-        struct ata_device *dev0 = &host->ports[0]->link.device[0];
+        struct ata_link *link0 = &host->ports[0]->link;
        u32 scontrol;
-        int i;
+        int i, rc;
        /* check for availability */
        for (i = 0; i < 4; i++)
                if (hpriv->map[i] == IDE)
-                        return;
+                        return 0;
        if (!(host->ports[0]->flags & PIIX_FLAG_SIDPR))
-                return;
+                return 0;
        if (pci_resource_start(pdev, PIIX_SIDPR_BAR) == 0 ||
            pci_resource_len(pdev, PIIX_SIDPR_BAR) != PIIX_SIDPR_LEN)
-                return;
+                return 0;
        if (pcim_iomap_regions(pdev, 1 << PIIX_SIDPR_BAR, DRV_NAME))
-                return;
+                return 0;
        hpriv->sidpr = pcim_iomap_table(pdev)[PIIX_SIDPR_BAR];
@@ -1392,7 +1302,7 @@ static void __devinit piix_init_sidpr(struct ata_host *host)
         * Give it a test drive by inhibiting power save modes which
         * we'll do anyway.
         */
-        scontrol = piix_sidpr_read(dev0, SCR_CONTROL);
+        piix_sidpr_scr_read(link0, SCR_CONTROL, &scontrol);
        /* if IPM is already 3, SCR access is probably working.  Don't
         * un-inhibit power save modes as BIOS might have inhibited
@@ -1400,18 +1310,30 @@ static void __devinit piix_init_sidpr(struct ata_host *host)
         */
        if ((scontrol & 0xf00) != 0x300) {
                scontrol |= 0x300;
-                piix_sidpr_write(dev0, SCR_CONTROL, scontrol);
+                piix_sidpr_scr_write(link0, SCR_CONTROL, scontrol);
-                scontrol = piix_sidpr_read(dev0, SCR_CONTROL);
+                piix_sidpr_scr_read(link0, SCR_CONTROL, &scontrol);
                if ((scontrol & 0xf00) != 0x300) {
                        dev_printk(KERN_INFO, host->dev, "SCR access via "
                                   "SIDPR is available but doesn't work\n");
-                        return;
+                        return 0;
                }
        }
-        host->ports[0]->ops = &piix_sidpr_sata_ops;
+        /* okay, SCRs available, set ops and ask libata for slave_link */
-        host->ports[1]->ops = &piix_sidpr_sata_ops;
+        for (i = 0; i < 2; i++) {
+                struct ata_port *ap = host->ports[i];
+                ap->ops = &piix_sidpr_sata_ops;
+                if (ap->flags & ATA_FLAG_SLAVE_POSS) {
+                        rc = ata_slave_link_init(ap);
+                        if (rc)
+                                return rc;
+                }
+        }
+        return 0;
 }
 static void piix_iocfg_bit18_quirk(struct pci_dev *pdev)
@@ -1499,7 +1421,7 @@ static int __devinit piix_init_one(struct pci_dev *pdev,
         * off.
         */
        if (pdev->vendor == PCI_VENDOR_ID_INTEL && pdev->device == 0x2652) {
-                int rc = piix_disable_ahci(pdev);
+                rc = piix_disable_ahci(pdev);
                if (rc)
                        return rc;
        }
@@ -1521,7 +1443,9 @@ static int __devinit piix_init_one(struct pci_dev *pdev,
        /* initialize controller */
        if (port_flags & ATA_FLAG_SATA) {
                piix_init_pcs(host, piix_map_db_table[ent->driver_data]);
-                piix_init_sidpr(host);
+                rc = piix_init_sidpr(host);
+                if (rc)
+                        return rc;
        }
        /* apply IOCFG bit18 quirk */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 79e3a8e7a84a..1ee9499bd343 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -163,6 +163,67 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
+/*
+ * Iterator helpers.  Don't use directly.
+ *
+ * LOCKING:
+ * Host lock or EH context.
+ */
+struct ata_link *__ata_port_next_link(struct ata_port *ap,
+                                      struct ata_link *link, bool dev_only)
+{
+        /* NULL link indicates start of iteration */
+        if (!link) {
+                if (dev_only && sata_pmp_attached(ap))
+                        return ap->pmp_link;
+                return &ap->link;
+        }
+        /* we just iterated over the host master link, what's next? */
+        if (link == &ap->link) {
+                if (!sata_pmp_attached(ap)) {
+                        if (unlikely(ap->slave_link) && !dev_only)
+                                return ap->slave_link;
+                        return NULL;
+                }
+                return ap->pmp_link;
+        }
+        /* slave_link excludes PMP */
+        if (unlikely(link == ap->slave_link))
+                return NULL;
+        /* iterate to the next PMP link */
+        if (++link < ap->pmp_link + ap->nr_pmp_links)
+                return link;
+        return NULL;
+}
+/**
+ *      ata_dev_phys_link - find physical link for a device
+ *      @dev: ATA device to look up physical link for
+ *
+ *      Look up physical link which @dev is attached to.  Note that
+ *      this is different from @dev->link only when @dev is on slave
+ *      link.  For all other cases, it's the same as @dev->link.
+ *
+ *      LOCKING:
+ *      Don't care.
+ *
+ *      RETURNS:
+ *      Pointer to the found physical link.
+ */
+struct ata_link *ata_dev_phys_link(struct ata_device *dev)
+{
+        struct ata_port *ap = dev->link->ap;
+        if (!ap->slave_link)
+                return dev->link;
+        if (!dev->devno)
+                return &ap->link;
+        return ap->slave_link;
+}
 /**
 *      ata_force_cbl - force cable type according to libata.force
 *      @ap: ATA port of interest
@@ -206,7 +267,8 @@ void ata_force_cbl(struct ata_port *ap)
 *      the host link and all fan-out ports connected via PMP.  If the
 *      device part is specified as 0 (e.g. 1.00:), it specifies the
 *      first fan-out link not the host link.  Device number 15 always
- *      points to the host link whether PMP is attached or not.
+ *      points to the host link whether PMP is attached or not.  If the
+ *      controller has slave link, device number 16 points to it.
 *
 *      LOCKING:
 *      EH context.
@@ -214,12 +276,11 @@ void ata_force_cbl(struct ata_port *ap)
 static void ata_force_link_limits(struct ata_link *link)
 {
        bool did_spd = false;
-        int linkno, i;
+        int linkno = link->pmp;
+        int i;
        if (ata_is_host_link(link))
-                linkno = 15;
+                linkno += 15;
-        else
-                linkno = link->pmp;
        for (i = ata_force_tbl_size - 1; i >= 0; i--) {
                const struct ata_force_ent *fe = &ata_force_tbl[i];
@@ -266,9 +327,9 @@ static void ata_force_xfermask(struct ata_device *dev)
        int alt_devno = devno;
        int i;
-        /* allow n.15 for the first device attached to host port */
+        /* allow n.15/16 for devices attached to host port */
-        if (ata_is_host_link(dev->link) && devno == 0)
+        if (ata_is_host_link(dev->link))
-                alt_devno = 15;
+                alt_devno += 15;
        for (i = ata_force_tbl_size - 1; i >= 0; i--) {
                const struct ata_force_ent *fe = &ata_force_tbl[i];
@@ -320,9 +381,9 @@ static void ata_force_horkage(struct ata_device *dev)
        int alt_devno = devno;
        int i;
-        /* allow n.15 for the first device attached to host port */
+        /* allow n.15/16 for devices attached to host port */
-        if (ata_is_host_link(dev->link) && devno == 0)
+        if (ata_is_host_link(dev->link))
-                alt_devno = 15;
+                alt_devno += 15;
        for (i = 0; i < ata_force_tbl_size; i++) {
                const struct ata_force_ent *fe = &ata_force_tbl[i];
@@ -2681,7 +2742,7 @@ static void sata_print_link_status(struct ata_link *link)
                return;
        sata_scr_read(link, SCR_CONTROL, &scontrol);
-        if (ata_link_online(link)) {
+        if (ata_phys_link_online(link)) {
                tmp = (sstatus >> 4) & 0xf;
                ata_link_printk(link, KERN_INFO,
                                "SATA link up %s (SStatus %X SControl %X)\n",
@@ -3372,6 +3433,12 @@ int ata_wait_ready(struct ata_link *link, unsigned long deadline,
        unsigned long nodev_deadline = ata_deadline(start, ATA_TMOUT_FF_WAIT);
        int warned = 0;
+        /* Slave readiness can't be tested separately from master.  On
+         * M/S emulation configuration, this function should be called
+         * only on the master and it will handle both master and slave.
+         */
+        WARN_ON(link == link->ap->slave_link);
        if (time_after(nodev_deadline, deadline))
                nodev_deadline = deadline;
@@ -3593,7 +3660,7 @@ int ata_std_prereset(struct ata_link *link, unsigned long deadline)
        }
        /* no point in trying softreset on offline link */
-        if (ata_link_offline(link))
+        if (ata_phys_link_offline(link))
                ehc->i.action &= ~ATA_EH_SOFTRESET;
        return 0;
@@ -3671,7 +3738,7 @@ int sata_link_hardreset(struct ata_link *link, const unsigned long *timing,
        if (rc)
                goto out;
        /* if link is offline nothing more to do */
-        if (ata_link_offline(link))
+        if (ata_phys_link_offline(link))
                goto out;
        /* Link is online.  From this point, -ENODEV too is an error. */
@@ -4868,10 +4935,8 @@ int sata_scr_valid(struct ata_link *link)
 int sata_scr_read(struct ata_link *link, int reg, u32 *val)
 {
        if (ata_is_host_link(link)) {
-                struct ata_port *ap = link->ap;
                if (sata_scr_valid(link))
-                        return ap->ops->scr_read(ap, reg, val);
+                        return link->ap->ops->scr_read(link, reg, val);
                return -EOPNOTSUPP;
        }
@@ -4897,10 +4962,8 @@ int sata_scr_read(struct ata_link *link, int reg, u32 *val)
 int sata_scr_write(struct ata_link *link, int reg, u32 val)
 {
        if (ata_is_host_link(link)) {
-                struct ata_port *ap = link->ap;
                if (sata_scr_valid(link))
-                        return ap->ops->scr_write(ap, reg, val);
+                        return link->ap->ops->scr_write(link, reg, val);
                return -EOPNOTSUPP;
        }
@@ -4925,13 +4988,12 @@ int sata_scr_write(struct ata_link *link, int reg, u32 val)
 int sata_scr_write_flush(struct ata_link *link, int reg, u32 val)
 {
        if (ata_is_host_link(link)) {
-                struct ata_port *ap = link->ap;
                int rc;
                if (sata_scr_valid(link)) {
-                        rc = ap->ops->scr_write(ap, reg, val);
+                        rc = link->ap->ops->scr_write(link, reg, val);
                        if (rc == 0)
-                                rc = ap->ops->scr_read(ap, reg, &val);
+                                rc = link->ap->ops->scr_read(link, reg, &val);
                        return rc;
                }
                return -EOPNOTSUPP;
@@ -4941,7 +5003,7 @@ int sata_scr_write_flush(struct ata_link *link, int reg, u32 val)
 }
 /**
- *      ata_link_online - test whether the given link is online
+ *      ata_phys_link_online - test whether the given link is online
 *      @link: ATA link to test
 *
 *      Test whether @link is online.  Note that this function returns
@@ -4952,20 +5014,20 @@ int sata_scr_write_flush(struct ata_link *link, int reg, u32 val)
 *      None.
 *
 *      RETURNS:
- *      1 if the port online status is available and online.
+ *      True if the port online status is available and online.
 */
-int ata_link_online(struct ata_link *link)
+bool ata_phys_link_online(struct ata_link *link)
 {
        u32 sstatus;
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
            (sstatus & 0xf) == 0x3)
-                return 1;
+                return true;
-        return 0;
+        return false;
 }
 /**
- *      ata_link_offline - test whether the given link is offline
+ *      ata_phys_link_offline - test whether the given link is offline
 *      @link: ATA link to test
 *
 *      Test whether @link is offline.  Note that this function
@@ -4976,16 +5038,68 @@ int ata_link_online(struct ata_link *link)
 *      None.
 *
 *      RETURNS:
- *      1 if the port offline status is available and offline.
+ *      True if the port offline status is available and offline.
 */
-int ata_link_offline(struct ata_link *link)
+bool ata_phys_link_offline(struct ata_link *link)
 {
        u32 sstatus;
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
            (sstatus & 0xf) != 0x3)
-                return 1;
+                return true;
-        return 0;
+        return false;
+}
+/**
+ *      ata_link_online - test whether the given link is online
+ *      @link: ATA link to test
+ *
+ *      Test whether @link is online.  This is identical to
+ *      ata_phys_link_online() when there's no slave link.  When
+ *      there's a slave link, this function should only be called on
+ *      the master link and will return true if any of M/S links is
+ *      online.
+ *
+ *      LOCKING:
+ *      None.
+ *
+ *      RETURNS:
+ *      True if the port online status is available and online.
+ */
+bool ata_link_online(struct ata_link *link)
+{
+        struct ata_link *slave = link->ap->slave_link;
+        WARN_ON(link == slave); /* shouldn't be called on slave link */
+        return ata_phys_link_online(link) ||
+                (slave && ata_phys_link_online(slave));
+}
+/**
+ *      ata_link_offline - test whether the given link is offline
+ *      @link: ATA link to test
+ *
+ *      Test whether @link is offline.  This is identical to
+ *      ata_phys_link_offline() when there's no slave link.  When
+ *      there's a slave link, this function should only be called on
+ *      the master link and will return true if both M/S links are
+ *      offline.
+ *
+ *      LOCKING:
+ *      None.
+ *
+ *      RETURNS:
+ *      True if the port offline status is available and offline.
+ */
+bool ata_link_offline(struct ata_link *link)
+{
+        struct ata_link *slave = link->ap->slave_link;
+        WARN_ON(link == slave); /* shouldn't be called on slave link */
+        return ata_phys_link_offline(link) &&
+                (!slave || ata_phys_link_offline(slave));
 }
 #ifdef CONFIG_PM
@@ -5127,11 +5241,11 @@ int ata_port_start(struct ata_port *ap)
 */
 void ata_dev_init(struct ata_device *dev)
 {
-        struct ata_link *link = dev->link;
+        struct ata_link *link = ata_dev_phys_link(dev);
        struct ata_port *ap = link->ap;
        unsigned long flags;
-        /* SATA spd limit is bound to the first device */
+        /* SATA spd limit is bound to the attached device, reset together */
        link->sata_spd_limit = link->hw_sata_spd_limit;
        link->sata_spd = 0;
@@ -5264,6 +5378,7 @@ struct ata_port *ata_port_alloc(struct ata_host *host)
        INIT_WORK(&ap->scsi_rescan_task, ata_scsi_dev_rescan);
        INIT_LIST_HEAD(&ap->eh_done_q);
        init_waitqueue_head(&ap->eh_wait_q);
+        init_completion(&ap->park_req_pending);
        init_timer_deferrable(&ap->fastdrain_timer);
        ap->fastdrain_timer.function = ata_eh_fastdrain_timerfn;
        ap->fastdrain_timer.data = (unsigned long)ap;
@@ -5294,6 +5409,7 @@ static void ata_host_release(struct device *gendev, void *res)
                        scsi_host_put(ap->scsi_host);
                kfree(ap->pmp_link);
+                kfree(ap->slave_link);
                kfree(ap);
                host->ports[i] = NULL;
        }
@@ -5414,6 +5530,68 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
        return host;
 }
+/**
+ *      ata_slave_link_init - initialize slave link
+ *      @ap: port to initialize slave link for
+ *
+ *      Create and initialize slave link for @ap.  This enables slave
+ *      link handling on the port.
+ *
+ *      In libata, a port contains links and a link contains devices.
+ *      There is single host link but if a PMP is attached to it,
+ *      there can be multiple fan-out links.  On SATA, there's usually
+ *      a single device connected to a link but PATA and SATA
+ *      controllers emulating TF based interface can have two - master
+ *      and slave.
+ *
+ *      However, there are a few controllers which don't fit into this
+ *      abstraction too well - SATA controllers which emulate TF
+ *      interface with both master and slave devices but also have
+ *      separate SCR register sets for each device.  These controllers
+ *      need separate links for physical link handling
+ *      (e.g. onlineness, link speed) but should be treated like a
+ *      traditional M/S controller for everything else (e.g. command
+ *      issue, softreset).
+ *
+ *      slave_link is libata's way of handling this class of
+ *      controllers without impacting core layer too much.  For
+ *      anything other than physical link handling, the default host
+ *      link is used for both master and slave.  For physical link
+ *      handling, separate @ap->slave_link is used.  All dirty details
+ *      are implemented inside libata core layer.  From LLD's POV, the
+ *      only difference is that prereset, hardreset and postreset are
+ *      called once more for the slave link, so the reset sequence
+ *      looks like the following.
+ *
+ *      prereset(M) -> prereset(S) -> hardreset(M) -> hardreset(S) ->
+ *      softreset(M) -> postreset(M) -> postreset(S)
+ *
+ *      Note that softreset is called only for the master.  Softreset
+ *      resets both M/S by definition, so SRST on master should handle
+ *      both (the standard method will work just fine).
+ *
+ *      LOCKING:
+ *      Should be called before host is registered.
+ *
+ *      RETURNS:
+ *      0 on success, -errno on failure.
+ */
+int ata_slave_link_init(struct ata_port *ap)
+{
+        struct ata_link *link;
+        WARN_ON(ap->slave_link);
+        WARN_ON(ap->flags & ATA_FLAG_PMP);
+        link = kzalloc(sizeof(*link), GFP_KERNEL);
+        if (!link)
+                return -ENOMEM;
+        ata_link_init(ap, link, 1);
+        ap->slave_link = link;
+        return 0;
+}
 static void ata_host_stop(struct device *gendev, void *res)
 {
        struct ata_host *host = dev_get_drvdata(gendev);
@@ -5640,6 +5818,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
                /* init sata_spd_limit to the current value */
                sata_link_init_spd(&ap->link);
+                if (ap->slave_link)
+                        sata_link_init_spd(ap->slave_link);
                /* print per-port info to dmesg */
                xfer_mask = ata_pack_xfermask(ap->pio_mask, ap->mwdma_mask,
@@ -6260,10 +6440,12 @@ EXPORT_SYMBOL_GPL(ata_base_port_ops);
 EXPORT_SYMBOL_GPL(sata_port_ops);
 EXPORT_SYMBOL_GPL(ata_dummy_port_ops);
 EXPORT_SYMBOL_GPL(ata_dummy_port_info);
+EXPORT_SYMBOL_GPL(__ata_port_next_link);
 EXPORT_SYMBOL_GPL(ata_std_bios_param);
 EXPORT_SYMBOL_GPL(ata_host_init);
 EXPORT_SYMBOL_GPL(ata_host_alloc);
 EXPORT_SYMBOL_GPL(ata_host_alloc_pinfo);
+EXPORT_SYMBOL_GPL(ata_slave_link_init);
 EXPORT_SYMBOL_GPL(ata_host_start);
 EXPORT_SYMBOL_GPL(ata_host_register);
 EXPORT_SYMBOL_GPL(ata_host_activate);
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c1db2f234d2e..f2dd99122bd6 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -79,6 +79,8 @@ enum {
         */
        ATA_EH_PRERESET_TIMEOUT         = 10000,
        ATA_EH_FASTDRAIN_INTERVAL       =  3000,
+        ATA_EH_UA_TRIES                 = 5,
 };
 /* The following table determines how we sequence resets.  Each entry
@@ -1357,6 +1359,37 @@ static int ata_eh_read_log_10h(struct ata_device *dev,
 }
 /**
+ *      atapi_eh_tur - perform ATAPI TEST_UNIT_READY
+ *      @dev: target ATAPI device
+ *      @r_sense_key: out parameter for sense_key
+ *
+ *      Perform ATAPI TEST_UNIT_READY.
+ *
+ *      LOCKING:
+ *      EH context (may sleep).
+ *
+ *      RETURNS:
+ *      0 on success, AC_ERR_* mask on failure.
+ */
+static unsigned int atapi_eh_tur(struct ata_device *dev, u8 *r_sense_key)
+{
+        u8 cdb[ATAPI_CDB_LEN] = { TEST_UNIT_READY, 0, 0, 0, 0, 0 };
+        struct ata_taskfile tf;
+        unsigned int err_mask;
+        ata_tf_init(dev, &tf);
+        tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+        tf.command = ATA_CMD_PACKET;
+        tf.protocol = ATAPI_PROT_NODATA;
+        err_mask = ata_exec_internal(dev, &tf, cdb, DMA_NONE, NULL, 0, 0);
+        if (err_mask == AC_ERR_DEV)
+                *r_sense_key = tf.feature >> 4;
+        return err_mask;
+}
+/**
 *      atapi_eh_request_sense - perform ATAPI REQUEST_SENSE
 *      @dev: device to perform REQUEST_SENSE to
 *      @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long)
@@ -1756,7 +1789,7 @@ static unsigned int ata_eh_speed_down_verdict(struct ata_device *dev)
 static unsigned int ata_eh_speed_down(struct ata_device *dev,
                                unsigned int eflags, unsigned int err_mask)
 {
-        struct ata_link *link = dev->link;
+        struct ata_link *link = ata_dev_phys_link(dev);
        int xfer_ok = 0;
        unsigned int verdict;
        unsigned int action = 0;
@@ -1880,7 +1913,8 @@ static void ata_eh_link_autopsy(struct ata_link *link)
        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
                struct ata_queued_cmd *qc = __ata_qc_from_tag(ap, tag);
-                if (!(qc->flags & ATA_QCFLAG_FAILED) || qc->dev->link != link)
+                if (!(qc->flags & ATA_QCFLAG_FAILED) ||
+                    ata_dev_phys_link(qc->dev) != link)
                        continue;
                /* inherit upper level err_mask */
@@ -1967,6 +2001,23 @@ void ata_eh_autopsy(struct ata_port *ap)
        ata_port_for_each_link(link, ap)
                ata_eh_link_autopsy(link);
+        /* Handle the frigging slave link.  Autopsy is done similarly
+         * but actions and flags are transferred over to the master
+         * link and handled from there.
+         */
+        if (ap->slave_link) {
+                struct ata_eh_context *mehc = &ap->link.eh_context;
+                struct ata_eh_context *sehc = &ap->slave_link->eh_context;
+                ata_eh_link_autopsy(ap->slave_link);
+                ata_eh_about_to_do(ap->slave_link, NULL, ATA_EH_ALL_ACTIONS);
+                mehc->i.action          |= sehc->i.action;
+                mehc->i.dev_action[1]   |= sehc->i.dev_action[1];
+                mehc->i.flags           |= sehc->i.flags;
+                ata_eh_done(ap->slave_link, NULL, ATA_EH_ALL_ACTIONS);
+        }
        /* Autopsy of fanout ports can affect host link autopsy.
         * Perform host link autopsy last.
         */
@@ -2001,7 +2052,8 @@ static void ata_eh_link_report(struct ata_link *link)
        for (tag = 0; tag < ATA_MAX_QUEUE; tag++) {
                struct ata_queued_cmd *qc = __ata_qc_from_tag(ap, tag);
-                if (!(qc->flags & ATA_QCFLAG_FAILED) || qc->dev->link != link ||
+                if (!(qc->flags & ATA_QCFLAG_FAILED) ||
+                    ata_dev_phys_link(qc->dev) != link ||
                    ((qc->flags & ATA_QCFLAG_QUIET) &&
                     qc->err_mask == AC_ERR_DEV))
                        continue;
@@ -2068,7 +2120,7 @@ static void ata_eh_link_report(struct ata_link *link)
                char cdb_buf[70] = "";
                if (!(qc->flags & ATA_QCFLAG_FAILED) ||
-                    qc->dev->link != link || !qc->err_mask)
+                    ata_dev_phys_link(qc->dev) != link || !qc->err_mask)
                        continue;
                if (qc->dma_dir != DMA_NONE) {
@@ -2160,12 +2212,14 @@ void ata_eh_report(struct ata_port *ap)
 }
 static int ata_do_reset(struct ata_link *link, ata_reset_fn_t reset,
-                        unsigned int *classes, unsigned long deadline)
+                        unsigned int *classes, unsigned long deadline,
+                        bool clear_classes)
 {
        struct ata_device *dev;
-        ata_link_for_each_dev(dev, link)
+        if (clear_classes)
-                classes[dev->devno] = ATA_DEV_UNKNOWN;
+                ata_link_for_each_dev(dev, link)
+                        classes[dev->devno] = ATA_DEV_UNKNOWN;
        return reset(link, classes, deadline);
 }
@@ -2187,17 +2241,20 @@ int ata_eh_reset(struct ata_link *link, int classify,
                 ata_reset_fn_t hardreset, ata_postreset_fn_t postreset)
 {
        struct ata_port *ap = link->ap;
+        struct ata_link *slave = ap->slave_link;
        struct ata_eh_context *ehc = &link->eh_context;
+        struct ata_eh_context *sehc = &slave->eh_context;
        unsigned int *classes = ehc->classes;
        unsigned int lflags = link->flags;
        int verbose = !(ehc->i.flags & ATA_EHI_QUIET);
        int max_tries = 0, try = 0;
+        struct ata_link *failed_link;
        struct ata_device *dev;
        unsigned long deadline, now;
        ata_reset_fn_t reset;
        unsigned long flags;
        u32 sstatus;
-        int nr_known, rc;
+        int nr_unknown, rc;
        /*
         * Prepare to reset
@@ -2252,8 +2309,30 @@ int ata_eh_reset(struct ata_link *link, int classify,
        }
        if (prereset) {
-                rc = prereset(link,
+                unsigned long deadline = ata_deadline(jiffies,
-                              ata_deadline(jiffies, ATA_EH_PRERESET_TIMEOUT));
+                                                      ATA_EH_PRERESET_TIMEOUT);
+                if (slave) {
+                        sehc->i.action &= ~ATA_EH_RESET;
+                        sehc->i.action |= ehc->i.action;
+                }
+                rc = prereset(link, deadline);
+                /* If present, do prereset on slave link too.  Reset
+                 * is skipped iff both master and slave links report
+                 * -ENOENT or clear ATA_EH_RESET.
+                 */
+                if (slave && (rc == 0 || rc == -ENOENT)) {
+                        int tmp;
+                        tmp = prereset(slave, deadline);
+                        if (tmp != -ENOENT)
+                                rc = tmp;
+                        ehc->i.action |= sehc->i.action;
+                }
                if (rc) {
                        if (rc == -ENOENT) {
                                ata_link_printk(link, KERN_DEBUG,
@@ -2302,25 +2381,51 @@ int ata_eh_reset(struct ata_link *link, int classify,
                else
                        ehc->i.flags |= ATA_EHI_DID_SOFTRESET;
-                rc = ata_do_reset(link, reset, classes, deadline);
+                rc = ata_do_reset(link, reset, classes, deadline, true);
-                if (rc && rc != -EAGAIN)
+                if (rc && rc != -EAGAIN) {
+                        failed_link = link;
                        goto fail;
+                }
+                /* hardreset slave link if existent */
+                if (slave && reset == hardreset) {
+                        int tmp;
+                        if (verbose)
+                                ata_link_printk(slave, KERN_INFO,
+                                                "hard resetting link\n");
+                        ata_eh_about_to_do(slave, NULL, ATA_EH_RESET);
+                        tmp = ata_do_reset(slave, reset, classes, deadline,
+                                           false);
+                        switch (tmp) {
+                        case -EAGAIN:
+                                rc = -EAGAIN;
+                        case 0:
+                                break;
+                        default:
+                                failed_link = slave;
+                                rc = tmp;
+                                goto fail;
+                        }
+                }
+                /* perform follow-up SRST if necessary */
                if (reset == hardreset &&
                    ata_eh_followup_srst_needed(link, rc, classes)) {
-                        /* okay, let's do follow-up softreset */
                        reset = softreset;
                        if (!reset) {
                                ata_link_printk(link, KERN_ERR,
                                                "follow-up softreset required "
                                                "but no softreset avaliable\n");
+                                failed_link = link;
                                rc = -EINVAL;
                                goto fail;
                        }
                        ata_eh_about_to_do(link, NULL, ATA_EH_RESET);
-                        rc = ata_do_reset(link, reset, classes, deadline);
+                        rc = ata_do_reset(link, reset, classes, deadline, true);
                }
        } else {
                if (verbose)
@@ -2341,7 +2446,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
                dev->pio_mode = XFER_PIO_0;
                dev->flags &= ~ATA_DFLAG_SLEEPING;
-                if (ata_link_offline(link))
+                if (ata_phys_link_offline(ata_dev_phys_link(dev)))
                        continue;
                /* apply class override */
@@ -2354,6 +2459,8 @@ int ata_eh_reset(struct ata_link *link, int classify,
        /* record current link speed */
        if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0)
                link->sata_spd = (sstatus >> 4) & 0xf;
+        if (slave && sata_scr_read(slave, SCR_STATUS, &sstatus) == 0)
+                slave->sata_spd = (sstatus >> 4) & 0xf;
        /* thaw the port */
        if (ata_is_host_link(link))
@@ -2366,12 +2473,17 @@ int ata_eh_reset(struct ata_link *link, int classify,
         * reset and here.  This race is mediated by cross checking
         * link onlineness and classification result later.
         */
-        if (postreset)
+        if (postreset) {
                postreset(link, classes);
+                if (slave)
+                        postreset(slave, classes);
+        }
        /* clear cached SError */
        spin_lock_irqsave(link->ap->lock, flags);
        link->eh_info.serror = 0;
+        if (slave)
+                slave->eh_info.serror = 0;
        spin_unlock_irqrestore(link->ap->lock, flags);
        /* Make sure onlineness and classification result correspond.
@@ -2381,19 +2493,21 @@ int ata_eh_reset(struct ata_link *link, int classify,
         * link onlineness and classification result, those conditions
         * can be reliably detected and retried.
         */
-        nr_known = 0;
+        nr_unknown = 0;
        ata_link_for_each_dev(dev, link) {
                /* convert all ATA_DEV_UNKNOWN to ATA_DEV_NONE */
-                if (classes[dev->devno] == ATA_DEV_UNKNOWN)
+                if (classes[dev->devno] == ATA_DEV_UNKNOWN) {
                        classes[dev->devno] = ATA_DEV_NONE;
-                else
+                        if (ata_phys_link_online(ata_dev_phys_link(dev)))
-                        nr_known++;
+                                nr_unknown++;
+                }
        }
-        if (classify && !nr_known && ata_link_online(link)) {
+        if (classify && nr_unknown) {
                if (try < max_tries) {
                        ata_link_printk(link, KERN_WARNING, "link online but "
                                       "device misclassified, retrying\n");
+                        failed_link = link;
                        rc = -EAGAIN;
                        goto fail;
                }
@@ -2404,6 +2518,8 @@ int ata_eh_reset(struct ata_link *link, int classify,
        /* reset successful, schedule revalidation */
        ata_eh_done(link, NULL, ATA_EH_RESET);
+        if (slave)
+                ata_eh_done(slave, NULL, ATA_EH_RESET);
        ehc->last_reset = jiffies;
        ehc->i.action |= ATA_EH_REVALIDATE;
@@ -2411,6 +2527,8 @@ int ata_eh_reset(struct ata_link *link, int classify,
 out:
        /* clear hotplug flag */
        ehc->i.flags &= ~ATA_EHI_HOTPLUGGED;
+        if (slave)
+                sehc->i.flags &= ~ATA_EHI_HOTPLUGGED;
        spin_lock_irqsave(ap->lock, flags);
        ap->pflags &= ~ATA_PFLAG_RESETTING;
@@ -2431,7 +2549,7 @@ int ata_eh_reset(struct ata_link *link, int classify,
        if (time_before(now, deadline)) {
                unsigned long delta = deadline - now;
-                ata_link_printk(link, KERN_WARNING,
+                ata_link_printk(failed_link, KERN_WARNING,
                        "reset failed (errno=%d), retrying in %u secs\n",
                        rc, DIV_ROUND_UP(jiffies_to_msecs(delta), 1000));
@@ -2439,13 +2557,92 @@ int ata_eh_reset(struct ata_link *link, int classify,
                        delta = schedule_timeout_uninterruptible(delta);
        }
-        if (rc == -EPIPE || try == max_tries - 1)
+        if (try == max_tries - 1) {
                sata_down_spd_limit(link);
+                if (slave)
+                        sata_down_spd_limit(slave);
+        } else if (rc == -EPIPE)
+                sata_down_spd_limit(failed_link);
        if (hardreset)
                reset = hardreset;
        goto retry;
 }
+static inline void ata_eh_pull_park_action(struct ata_port *ap)
+{
+        struct ata_link *link;
+        struct ata_device *dev;
+        unsigned long flags;
+        /*
+         * This function can be thought of as an extended version of
+         * ata_eh_about_to_do() specially crafted to accommodate the
+         * requirements of ATA_EH_PARK handling. Since the EH thread
+         * does not leave the do {} while () loop in ata_eh_recover as
+         * long as the timeout for a park request to *one* device on
+         * the port has not expired, and since we still want to pick
+         * up park requests to other devices on the same port or
+         * timeout updates for the same device, we have to pull
+         * ATA_EH_PARK actions from eh_info into eh_context.i
+         * ourselves at the beginning of each pass over the loop.
+         *
+         * Additionally, all write accesses to &ap->park_req_pending
+         * through INIT_COMPLETION() (see below) or complete_all()
+         * (see ata_scsi_park_store()) are protected by the host lock.
+         * As a result we have that park_req_pending.done is zero on
+         * exit from this function, i.e. when ATA_EH_PARK actions for
+         * *all* devices on port ap have been pulled into the
+         * respective eh_context structs. If, and only if,
+         * park_req_pending.done is non-zero by the time we reach
+         * wait_for_completion_timeout(), another ATA_EH_PARK action
+         * has been scheduled for at least one of the devices on port
+         * ap and we have to cycle over the do {} while () loop in
+         * ata_eh_recover() again.
+         */
+        spin_lock_irqsave(ap->lock, flags);
+        INIT_COMPLETION(ap->park_req_pending);
+        ata_port_for_each_link(link, ap) {
+                ata_link_for_each_dev(dev, link) {
+                        struct ata_eh_info *ehi = &link->eh_info;
+                        link->eh_context.i.dev_action[dev->devno] |=
+                                ehi->dev_action[dev->devno] & ATA_EH_PARK;
+                        ata_eh_clear_action(link, dev, ehi, ATA_EH_PARK);
+                }
+        }
+        spin_unlock_irqrestore(ap->lock, flags);
+}
+static void ata_eh_park_issue_cmd(struct ata_device *dev, int park)
+{
+        struct ata_eh_context *ehc = &dev->link->eh_context;
+        struct ata_taskfile tf;
+        unsigned int err_mask;
+        ata_tf_init(dev, &tf);
+        if (park) {
+                ehc->unloaded_mask |= 1 << dev->devno;
+                tf.command = ATA_CMD_IDLEIMMEDIATE;
+                tf.feature = 0x44;
+                tf.lbal = 0x4c;
+                tf.lbam = 0x4e;
+                tf.lbah = 0x55;
+        } else {
+                ehc->unloaded_mask &= ~(1 << dev->devno);
+                tf.command = ATA_CMD_CHK_POWER;
+        }
+        tf.flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR;
+        tf.protocol |= ATA_PROT_NODATA;
+        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
+        if (park && (err_mask || tf.lbal != 0xc4)) {
+                ata_dev_printk(dev, KERN_ERR, "head unload failed!\n");
+                ehc->unloaded_mask &= ~(1 << dev->devno);
+        }
+}
 static int ata_eh_revalidate_and_attach(struct ata_link *link,
                                        struct ata_device **r_failed_dev)
 {
@@ -2472,7 +2669,7 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                if ((action & ATA_EH_REVALIDATE) && ata_dev_enabled(dev)) {
                        WARN_ON(dev->class == ATA_DEV_PMP);
-                        if (ata_link_offline(link)) {
+                        if (ata_phys_link_offline(ata_dev_phys_link(dev))) {
                                rc = -EIO;
                                goto err;
                        }
@@ -2610,6 +2807,53 @@ int ata_set_mode(struct ata_link *link, struct ata_device **r_failed_dev)
        return rc;
 }
+/**
+ *      atapi_eh_clear_ua - Clear ATAPI UNIT ATTENTION after reset
+ *      @dev: ATAPI device to clear UA for
+ *
+ *      Resets and other operations can make an ATAPI device raise
+ *      UNIT ATTENTION which causes the next operation to fail.  This
+ *      function clears UA.
+ *
+ *      LOCKING:
+ *      EH context (may sleep).
+ *
+ *      RETURNS:
+ *      0 on success, -errno on failure.
+ */
+static int atapi_eh_clear_ua(struct ata_device *dev)
+{
+        int i;
+        for (i = 0; i < ATA_EH_UA_TRIES; i++) {
+                u8 sense_buffer[SCSI_SENSE_BUFFERSIZE];
+                u8 sense_key = 0;
+                unsigned int err_mask;
+                err_mask = atapi_eh_tur(dev, &sense_key);
+                if (err_mask != 0 && err_mask != AC_ERR_DEV) {
+                        ata_dev_printk(dev, KERN_WARNING, "TEST_UNIT_READY "
+                                "failed (err_mask=0x%x)\n", err_mask);
+                        return -EIO;
+                }
+                if (!err_mask || sense_key != UNIT_ATTENTION)
+                        return 0;
+                err_mask = atapi_eh_request_sense(dev, sense_buffer, sense_key);
+                if (err_mask) {
+                        ata_dev_printk(dev, KERN_WARNING, "failed to clear "
+                                "UNIT ATTENTION (err_mask=0x%x)\n", err_mask);
+                        return -EIO;
+                }
+        }
+        ata_dev_printk(dev, KERN_WARNING,
+                "UNIT ATTENTION persists after %d tries\n", ATA_EH_UA_TRIES);
+        return 0;
+}
 static int ata_link_nr_enabled(struct ata_link *link)
 {
        struct ata_device *dev;
@@ -2697,7 +2941,7 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
                        /* This is the last chance, better to slow
                         * down than lose it.
                         */
-                        sata_down_spd_limit(dev->link);
+                        sata_down_spd_limit(ata_dev_phys_link(dev));
                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                }
        }
@@ -2707,7 +2951,7 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
                ata_dev_disable(dev);
                /* detach if offline */
-                if (ata_link_offline(dev->link))
+                if (ata_phys_link_offline(ata_dev_phys_link(dev)))
                        ata_eh_detach_dev(dev);
                /* schedule probe if necessary */
@@ -2755,7 +2999,7 @@ int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
        struct ata_device *dev;
        int nr_failed_devs;
        int rc;
-        unsigned long flags;
+        unsigned long flags, deadline;
        DPRINTK("ENTER\n");
@@ -2829,6 +3073,56 @@ int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
                }
        }
+        do {
+                unsigned long now;
+                /*
+                 * clears ATA_EH_PARK in eh_info and resets
+                 * ap->park_req_pending
+                 */
+                ata_eh_pull_park_action(ap);
+                deadline = jiffies;
+                ata_port_for_each_link(link, ap) {
+                        ata_link_for_each_dev(dev, link) {
+                                struct ata_eh_context *ehc = &link->eh_context;
+                                unsigned long tmp;
+                                if (dev->class != ATA_DEV_ATA)
+                                        continue;
+                                if (!(ehc->i.dev_action[dev->devno] &
+                                      ATA_EH_PARK))
+                                        continue;
+                                tmp = dev->unpark_deadline;
+                                if (time_before(deadline, tmp))
+                                        deadline = tmp;
+                                else if (time_before_eq(tmp, jiffies))
+                                        continue;
+                                if (ehc->unloaded_mask & (1 << dev->devno))
+                                        continue;
+                                ata_eh_park_issue_cmd(dev, 1);
+                        }
+                }
+                now = jiffies;
+                if (time_before_eq(deadline, now))
+                        break;
+                deadline = wait_for_completion_timeout(&ap->park_req_pending,
+                                                       deadline - now);
+        } while (deadline);
+        ata_port_for_each_link(link, ap) {
+                ata_link_for_each_dev(dev, link) {
+                        if (!(link->eh_context.unloaded_mask &
+                              (1 << dev->devno)))
+                                continue;
+                        ata_eh_park_issue_cmd(dev, 0);
+                        ata_eh_done(link, dev, ATA_EH_PARK);
+                }
+        }
        /* the rest */
        ata_port_for_each_link(link, ap) {
                struct ata_eh_context *ehc = &link->eh_context;
@@ -2852,6 +3146,20 @@ int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
                        ehc->i.flags &= ~ATA_EHI_SETMODE;
                }
+                /* If reset has been issued, clear UA to avoid
+                 * disrupting the current users of the device.
+                 */
+                if (ehc->i.flags & ATA_EHI_DID_RESET) {
+                        ata_link_for_each_dev(dev, link) {
+                                if (dev->class != ATA_DEV_ATAPI)
+                                        continue;
+                                rc = atapi_eh_clear_ua(dev);
+                                if (rc)
+                                        goto dev_fail;
+                        }
+                }
+                /* configure link power saving */
                if (ehc->i.action & ATA_EH_LPM)
                        ata_link_for_each_dev(dev, link)
                                ata_dev_enable_pm(dev, ap->pm_policy);
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index b9d3ba423cb2..fccd5e496c62 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -183,6 +183,105 @@ DEVICE_ATTR(link_power_management_policy, S_IRUGO | S_IWUSR,
                ata_scsi_lpm_show, ata_scsi_lpm_put);
 EXPORT_SYMBOL_GPL(dev_attr_link_power_management_policy);
+static ssize_t ata_scsi_park_show(struct device *device,
+                                  struct device_attribute *attr, char *buf)
+{
+        struct scsi_device *sdev = to_scsi_device(device);
+        struct ata_port *ap;
+        struct ata_link *link;
+        struct ata_device *dev;
+        unsigned long flags;
+        unsigned int uninitialized_var(msecs);
+        int rc = 0;
+        ap = ata_shost_to_port(sdev->host);
+        spin_lock_irqsave(ap->lock, flags);
+        dev = ata_scsi_find_dev(ap, sdev);
+        if (!dev) {
+                rc = -ENODEV;
+                goto unlock;
+        }
+        if (dev->flags & ATA_DFLAG_NO_UNLOAD) {
+                rc = -EOPNOTSUPP;
+                goto unlock;
+        }
+        link = dev->link;
+        if (ap->pflags & ATA_PFLAG_EH_IN_PROGRESS &&
+            link->eh_context.unloaded_mask & (1 << dev->devno) &&
+            time_after(dev->unpark_deadline, jiffies))
+                msecs = jiffies_to_msecs(dev->unpark_deadline - jiffies);
+        else
+                msecs = 0;
+unlock:
+        spin_unlock_irq(ap->lock);
+        return rc ? rc : snprintf(buf, 20, "%u\n", msecs);
+}
+static ssize_t ata_scsi_park_store(struct device *device,
+                                   struct device_attribute *attr,
+                                   const char *buf, size_t len)
+{
+        struct scsi_device *sdev = to_scsi_device(device);
+        struct ata_port *ap;
+        struct ata_device *dev;
+        long int input;
+        unsigned long flags;
+        int rc;
+        rc = strict_strtol(buf, 10, &input);
+        if (rc || input < -2)
+                return -EINVAL;
+        if (input > ATA_TMOUT_MAX_PARK) {
+                rc = -EOVERFLOW;
+                input = ATA_TMOUT_MAX_PARK;
+        }
+        ap = ata_shost_to_port(sdev->host);
+        spin_lock_irqsave(ap->lock, flags);
+        dev = ata_scsi_find_dev(ap, sdev);
+        if (unlikely(!dev)) {
+                rc = -ENODEV;
+                goto unlock;
+        }
+        if (dev->class != ATA_DEV_ATA) {
+                rc = -EOPNOTSUPP;
+                goto unlock;
+        }
+        if (input >= 0) {
+                if (dev->flags & ATA_DFLAG_NO_UNLOAD) {
+                        rc = -EOPNOTSUPP;
+                        goto unlock;
+                }
+                dev->unpark_deadline = ata_deadline(jiffies, input);
+                dev->link->eh_info.dev_action[dev->devno] |= ATA_EH_PARK;
+                ata_port_schedule_eh(ap);
+                complete(&ap->park_req_pending);
+        } else {
+                switch (input) {
+                case -1:
+                        dev->flags &= ~ATA_DFLAG_NO_UNLOAD;
+                        break;
+                case -2:
+                        dev->flags |= ATA_DFLAG_NO_UNLOAD;
+                        break;
+                }
+        }
+unlock:
+        spin_unlock_irqrestore(ap->lock, flags);
+        return rc ? rc : len;
+}
+DEVICE_ATTR(unload_heads, S_IRUGO | S_IWUSR,
+            ata_scsi_park_show, ata_scsi_park_store);
+EXPORT_SYMBOL_GPL(dev_attr_unload_heads);
 static void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq)
 {
        cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
@@ -269,6 +368,12 @@ DEVICE_ATTR(sw_activity, S_IWUGO | S_IRUGO, ata_scsi_activity_show,
                        ata_scsi_activity_store);
 EXPORT_SYMBOL_GPL(dev_attr_sw_activity);
+struct device_attribute *ata_common_sdev_attrs[] = {
+        &dev_attr_unload_heads,
+        NULL
+};
+EXPORT_SYMBOL_GPL(ata_common_sdev_attrs);
 static void ata_scsi_invalid_field(struct scsi_cmnd *cmd,
                                   void (*done)(struct scsi_cmnd *))
 {
@@ -954,6 +1059,9 @@ static int atapi_drain_needed(struct request *rq)
 static int ata_scsi_dev_config(struct scsi_device *sdev,
                               struct ata_device *dev)
 {
+        if (!ata_id_has_unload(dev->id))
+                dev->flags |= ATA_DFLAG_NO_UNLOAD;
        /* configure max sectors */
        blk_queue_max_sectors(sdev->request_queue, dev->max_sectors);
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index ade5c75b6144..e96de96e3020 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -70,6 +70,7 @@ extern int atapi_passthru16;
 extern int libata_fua;
 extern int libata_noacpi;
 extern int libata_allow_tpm;
+extern struct ata_link *ata_dev_phys_link(struct ata_device *dev);
 extern void ata_force_cbl(struct ata_port *ap);
 extern u64 ata_tf_to_lba(const struct ata_taskfile *tf);
 extern u64 ata_tf_to_lba48(const struct ata_taskfile *tf);
@@ -107,6 +108,8 @@ extern void ata_qc_issue(struct ata_queued_cmd *qc);
 extern void __ata_qc_complete(struct ata_queued_cmd *qc);
 extern int atapi_check_dma(struct ata_queued_cmd *qc);
 extern void swap_buf_le16(u16 *buf, unsigned int buf_words);
+extern bool ata_phys_link_online(struct ata_link *link);
+extern bool ata_phys_link_offline(struct ata_link *link);
 extern void ata_dev_init(struct ata_device *dev);
 extern void ata_link_init(struct ata_port *ap, struct ata_link *link, int pmp);
 extern int sata_link_init_spd(struct ata_link *link);
diff --git a/drivers/ata/pata_bf54x.c b/drivers/ata/pata_bf54x.c
index d3932901a3b3..1266924c11f9 100644
--- a/drivers/ata/pata_bf54x.c
+++ b/drivers/ata/pata_bf54x.c
@@ -1632,6 +1632,8 @@ static int __devinit bfin_atapi_probe(struct platform_device *pdev)
                return -ENODEV;
        }
+        dev_set_drvdata(&pdev->dev, host);
        return 0;
 }
@@ -1648,6 +1650,7 @@ static int __devexit bfin_atapi_remove(struct platform_device *pdev)
        struct ata_host *host = dev_get_drvdata(dev);
        ata_host_detach(host);
+        dev_set_drvdata(&pdev->dev, NULL);
        peripheral_free_list(atapi_io_port);
@@ -1655,27 +1658,44 @@ static int __devexit bfin_atapi_remove(struct platform_device *pdev)
 }
 #ifdef CONFIG_PM
-int bfin_atapi_suspend(struct platform_device *pdev, pm_message_t state)
+static int bfin_atapi_suspend(struct platform_device *pdev, pm_message_t state)
 {
-        return 0;
+        struct ata_host *host = dev_get_drvdata(&pdev->dev);
+        if (host)
+                return ata_host_suspend(host, state);
+        else
+                return 0;
 }
-int bfin_atapi_resume(struct platform_device *pdev)
+static int bfin_atapi_resume(struct platform_device *pdev)
 {
+        struct ata_host *host = dev_get_drvdata(&pdev->dev);
+        int ret;
+        if (host) {
+                ret = bfin_reset_controller(host);
+                if (ret) {
+                        printk(KERN_ERR DRV_NAME ": Error during HW init\n");
+                        return ret;
+                }
+                ata_host_resume(host);
+        }
        return 0;
 }
+#else
+#define bfin_atapi_suspend NULL
+#define bfin_atapi_resume NULL
 #endif
 static struct platform_driver bfin_atapi_driver = {
        .probe                  = bfin_atapi_probe,
        .remove                 = __devexit_p(bfin_atapi_remove),
+        .suspend                = bfin_atapi_suspend,
+        .resume                 = bfin_atapi_resume,
        .driver = {
                .name           = DRV_NAME,
                .owner          = THIS_MODULE,
-#ifdef CONFIG_PM
-                .suspend        = bfin_atapi_suspend,
-                .resume         = bfin_atapi_resume,
-#endif
        },
 };
diff --git a/drivers/ata/pata_sil680.c b/drivers/ata/pata_sil680.c
index e970b227fbce..a598bb36aafc 100644
--- a/drivers/ata/pata_sil680.c
+++ b/drivers/ata/pata_sil680.c
@@ -230,7 +230,7 @@ static u8 sil680_init_chip(struct pci_dev *pdev, int *try_mmio)
                tmpbyte & 1, tmpbyte & 0x30);
        *try_mmio = 0;
-#ifdef CONFIG_PPC_MERGE
+#ifdef CONFIG_PPC
        if (machine_is(cell))
                *try_mmio = (tmpbyte & 1) || pci_resource_start(pdev, 5);
 #endif
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 3924e7209a44..1a56db92ff7a 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -469,10 +469,10 @@ static bool sata_fsl_qc_fill_rtf(struct ata_queued_cmd *qc)
        return true;
 }
-static int sata_fsl_scr_write(struct ata_port *ap, unsigned int sc_reg_in,
+static int sata_fsl_scr_write(struct ata_link *link,
-                               u32 val)
+                              unsigned int sc_reg_in, u32 val)
 {
-        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
+        struct sata_fsl_host_priv *host_priv = link->ap->host->private_data;
        void __iomem *ssr_base = host_priv->ssr_base;
        unsigned int sc_reg;
@@ -493,10 +493,10 @@ static int sata_fsl_scr_write(struct ata_port *ap, unsigned int sc_reg_in,
        return 0;
 }
-static int sata_fsl_scr_read(struct ata_port *ap, unsigned int sc_reg_in,
+static int sata_fsl_scr_read(struct ata_link *link,
-                        u32 *val)
+                             unsigned int sc_reg_in, u32 *val)
 {
-        struct sata_fsl_host_priv *host_priv = ap->host->private_data;
+        struct sata_fsl_host_priv *host_priv = link->ap->host->private_data;
        void __iomem *ssr_base = host_priv->ssr_base;
        unsigned int sc_reg;
@@ -645,12 +645,12 @@ static int sata_fsl_port_start(struct ata_port *ap)
         * Workaround for 8315DS board 3gbps link-up issue,
         * currently limit SATA port to GEN1 speed
         */
-        sata_fsl_scr_read(ap, SCR_CONTROL, &temp);
+        sata_fsl_scr_read(&ap->link, SCR_CONTROL, &temp);
        temp &= ~(0xF << 4);
        temp |= (0x1 << 4);
-        sata_fsl_scr_write(ap, SCR_CONTROL, temp);
+        sata_fsl_scr_write(&ap->link, SCR_CONTROL, temp);
-        sata_fsl_scr_read(ap, SCR_CONTROL, &temp);
+        sata_fsl_scr_read(&ap->link, SCR_CONTROL, &temp);
        dev_printk(KERN_WARNING, dev, "scr_control, speed limited to %x\n",
                        temp);
 #endif
@@ -868,7 +868,7 @@ issue_srst:
                        ioread32(CQ + hcr_base),
                        ioread32(CA + hcr_base), ioread32(CC + hcr_base));
-                sata_fsl_scr_read(ap, SCR_ERROR, &Serror);
+                sata_fsl_scr_read(&ap->link, SCR_ERROR, &Serror);
                DPRINTK("HStatus = 0x%x\n", ioread32(hcr_base + HSTATUS));
                DPRINTK("HControl = 0x%x\n", ioread32(hcr_base + HCONTROL));
@@ -972,9 +972,9 @@ static void sata_fsl_error_intr(struct ata_port *ap)
         * Handle & Clear SError
         */
-        sata_fsl_scr_read(ap, SCR_ERROR, &SError);
+        sata_fsl_scr_read(&ap->link, SCR_ERROR, &SError);
        if (unlikely(SError & 0xFFFF0000)) {
-                sata_fsl_scr_write(ap, SCR_ERROR, SError);
+                sata_fsl_scr_write(&ap->link, SCR_ERROR, SError);
        }
        DPRINTK("error_intr,hStat=0x%x,CE=0x%x,DE =0x%x,SErr=0x%x\n",
@@ -1091,7 +1091,7 @@ static void sata_fsl_host_intr(struct ata_port *ap)
        hstatus = ioread32(hcr_base + HSTATUS);
-        sata_fsl_scr_read(ap, SCR_ERROR, &SError);
+        sata_fsl_scr_read(&ap->link, SCR_ERROR, &SError);
        if (unlikely(SError & 0xFFFF0000)) {
                DPRINTK("serror @host_intr : 0x%x\n", SError);
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index 3ead02fe379e..fbbd87c96f10 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -96,6 +96,7 @@ enum {
        PORT_SCR                = 0x20,
        /* HOST_CTL bits */
+        HCTL_LEDEN              = (1 << 3),  /* enable LED operation */
        HCTL_IRQOFF             = (1 << 8),  /* global IRQ off */
        HCTL_FTHD0              = (1 << 10), /* fifo threshold 0 */
        HCTL_FTHD1              = (1 << 11), /* fifo threshold 1*/
@@ -268,9 +269,9 @@ static void inic_reset_port(void __iomem *port_base)
        writeb(0xff, port_base + PORT_IRQ_STAT);
 }
-static int inic_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val)
+static int inic_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val)
 {
-        void __iomem *scr_addr = inic_port_base(ap) + PORT_SCR;
+        void __iomem *scr_addr = inic_port_base(link->ap) + PORT_SCR;
        void __iomem *addr;
        if (unlikely(sc_reg >= ARRAY_SIZE(scr_map)))
@@ -285,9 +286,9 @@ static int inic_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val)
        return 0;
 }
-static int inic_scr_write(struct ata_port *ap, unsigned sc_reg, u32 val)
+static int inic_scr_write(struct ata_link *link, unsigned sc_reg, u32 val)
 {
-        void __iomem *scr_addr = inic_port_base(ap) + PORT_SCR;
+        void __iomem *scr_addr = inic_port_base(link->ap) + PORT_SCR;
        if (unlikely(sc_reg >= ARRAY_SIZE(scr_map)))
                return -EINVAL;
@@ -540,7 +541,7 @@ static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
        void __iomem *port_base = inic_port_base(ap);
        /* fire up the ADMA engine */
-        writew(HCTL_FTHD0, port_base + HOST_CTL);
+        writew(HCTL_FTHD0 | HCTL_LEDEN, port_base + HOST_CTL);
        writew(IDMA_CTL_GO, port_base + PORT_IDMA_CTL);
        writeb(0, port_base + PORT_CPB_PTQFIFO);
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index c815f8ecf6e6..2b24ae58b52e 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -493,10 +493,10 @@ struct mv_hw_ops {
        void (*reset_bus)(struct ata_host *host, void __iomem *mmio);
 };
-static int mv_scr_read(struct ata_port *ap, unsigned int sc_reg_in, u32 *val);
+static int mv_scr_read(struct ata_link *link, unsigned int sc_reg_in, u32 *val);
-static int mv_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val);
+static int mv_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val);
-static int mv5_scr_read(struct ata_port *ap, unsigned int sc_reg_in, u32 *val);
+static int mv5_scr_read(struct ata_link *link, unsigned int sc_reg_in, u32 *val);
-static int mv5_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val);
+static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val);
 static int mv_port_start(struct ata_port *ap);
 static void mv_port_stop(struct ata_port *ap);
 static int mv_qc_defer(struct ata_queued_cmd *qc);
@@ -1070,23 +1070,23 @@ static unsigned int mv_scr_offset(unsigned int sc_reg_in)
        return ofs;
 }
-static int mv_scr_read(struct ata_port *ap, unsigned int sc_reg_in, u32 *val)
+static int mv_scr_read(struct ata_link *link, unsigned int sc_reg_in, u32 *val)
 {
        unsigned int ofs = mv_scr_offset(sc_reg_in);
        if (ofs != 0xffffffffU) {
-                *val = readl(mv_ap_base(ap) + ofs);
+                *val = readl(mv_ap_base(link->ap) + ofs);
                return 0;
        } else
                return -EINVAL;
 }
-static int mv_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val)
+static int mv_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
 {
        unsigned int ofs = mv_scr_offset(sc_reg_in);
        if (ofs != 0xffffffffU) {
-                writelfl(val, mv_ap_base(ap) + ofs);
+                writelfl(val, mv_ap_base(link->ap) + ofs);
                return 0;
        } else
                return -EINVAL;
@@ -2251,11 +2251,11 @@ static unsigned int mv5_scr_offset(unsigned int sc_reg_in)
        return ofs;
 }
-static int mv5_scr_read(struct ata_port *ap, unsigned int sc_reg_in, u32 *val)
+static int mv5_scr_read(struct ata_link *link, unsigned int sc_reg_in, u32 *val)
 {
-        struct mv_host_priv *hpriv = ap->host->private_data;
+        struct mv_host_priv *hpriv = link->ap->host->private_data;
        void __iomem *mmio = hpriv->base;
-        void __iomem *addr = mv5_phy_base(mmio, ap->port_no);
+        void __iomem *addr = mv5_phy_base(mmio, link->ap->port_no);
        unsigned int ofs = mv5_scr_offset(sc_reg_in);
        if (ofs != 0xffffffffU) {
@@ -2265,11 +2265,11 @@ static int mv5_scr_read(struct ata_port *ap, unsigned int sc_reg_in, u32 *val)
                return -EINVAL;
 }
-static int mv5_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val)
+static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
 {
-        struct mv_host_priv *hpriv = ap->host->private_data;
+        struct mv_host_priv *hpriv = link->ap->host->private_data;
        void __iomem *mmio = hpriv->base;
-        void __iomem *addr = mv5_phy_base(mmio, ap->port_no);
+        void __iomem *addr = mv5_phy_base(mmio, link->ap->port_no);
        unsigned int ofs = mv5_scr_offset(sc_reg_in);
        if (ofs != 0xffffffffU) {
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 1e1f3f3757ae..fae3841de0d8 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -302,13 +302,15 @@ static void nv_ck804_host_stop(struct ata_host *host);
 static irqreturn_t nv_generic_interrupt(int irq, void *dev_instance);
 static irqreturn_t nv_nf2_interrupt(int irq, void *dev_instance);
 static irqreturn_t nv_ck804_interrupt(int irq, void *dev_instance);
-static int nv_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int nv_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int nv_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int nv_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static void nv_nf2_freeze(struct ata_port *ap);
 static void nv_nf2_thaw(struct ata_port *ap);
 static void nv_ck804_freeze(struct ata_port *ap);
 static void nv_ck804_thaw(struct ata_port *ap);
+static int nv_hardreset(struct ata_link *link, unsigned int *class,
+                        unsigned long deadline);
 static int nv_adma_slave_config(struct scsi_device *sdev);
 static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
 static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
@@ -403,28 +405,45 @@ static struct scsi_host_template nv_swncq_sht = {
        .slave_configure        = nv_swncq_slave_config,
 };
-static struct ata_port_operations nv_generic_ops = {
+/* OSDL bz3352 reports that some nv controllers can't determine device
+ * signature reliably and nv_hardreset is implemented to work around
+ * the problem.  This was reported on nf3 and it's unclear whether any
+ * other controllers are affected.  However, the workaround has been
+ * applied to all variants and there isn't much to gain by trying to
+ * find out exactly which ones are affected at this point especially
+ * because NV has moved over to ahci for newer controllers.
+ */
+static struct ata_port_operations nv_common_ops = {
        .inherits               = &ata_bmdma_port_ops,
-        .hardreset              = ATA_OP_NULL,
+        .hardreset              = nv_hardreset,
        .scr_read               = nv_scr_read,
        .scr_write              = nv_scr_write,
 };
+/* OSDL bz11195 reports that link doesn't come online after hardreset
+ * on generic nv's and there have been several other similar reports
+ * on linux-ide.  Disable hardreset for generic nv's.
+ */
+static struct ata_port_operations nv_generic_ops = {
+        .inherits               = &nv_common_ops,
+        .hardreset              = ATA_OP_NULL,
+};
 static struct ata_port_operations nv_nf2_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
        .freeze                 = nv_nf2_freeze,
        .thaw                   = nv_nf2_thaw,
 };
 static struct ata_port_operations nv_ck804_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
        .freeze                 = nv_ck804_freeze,
        .thaw                   = nv_ck804_thaw,
        .host_stop              = nv_ck804_host_stop,
 };
 static struct ata_port_operations nv_adma_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
        .check_atapi_dma        = nv_adma_check_atapi_dma,
        .sff_tf_read            = nv_adma_tf_read,
@@ -448,7 +467,7 @@ static struct ata_port_operations nv_adma_ops = {
 };
 static struct ata_port_operations nv_swncq_ops = {
-        .inherits               = &nv_generic_ops,
+        .inherits               = &nv_common_ops,
        .qc_defer               = ata_std_qc_defer,
        .qc_prep                = nv_swncq_qc_prep,
@@ -1492,21 +1511,21 @@ static irqreturn_t nv_ck804_interrupt(int irq, void *dev_instance)
        return ret;
 }
-static int nv_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int nv_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = ioread32(ap->ioaddr.scr_addr + (sc_reg * 4));
+        *val = ioread32(link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
-static int nv_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int nv_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        iowrite32(val, ap->ioaddr.scr_addr + (sc_reg * 4));
+        iowrite32(val, link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
@@ -1586,6 +1605,21 @@ static void nv_mcp55_thaw(struct ata_port *ap)
        ata_sff_thaw(ap);
 }
+static int nv_hardreset(struct ata_link *link, unsigned int *class,
+                        unsigned long deadline)
+{
+        int rc;
+        /* SATA hardreset fails to retrieve proper device signature on
+         * some controllers.  Request follow up SRST.  For more info,
+         * see http://bugzilla.kernel.org/show_bug.cgi?id=3352
+         */
+        rc = sata_sff_hardreset(link, class, deadline);
+        if (rc)
+                return rc;
+        return -EAGAIN;
+}
 static void nv_adma_error_handler(struct ata_port *ap)
 {
        struct nv_adma_port_priv *pp = ap->private_data;
@@ -2184,9 +2218,9 @@ static void nv_swncq_host_interrupt(struct ata_port *ap, u16 fis)
        if (!pp->qc_active)
                return;
-        if (ap->ops->scr_read(ap, SCR_ERROR, &serror))
+        if (ap->ops->scr_read(&ap->link, SCR_ERROR, &serror))
                return;
-        ap->ops->scr_write(ap, SCR_ERROR, serror);
+        ap->ops->scr_write(&ap->link, SCR_ERROR, serror);
        if (ata_stat & ATA_ERR) {
                ata_ehi_clear_desc(ehi);
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 030665ba76b7..750d8cdc00cd 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -137,8 +137,8 @@ struct pdc_port_priv {
        dma_addr_t              pkt_dma;
 };
-static int pdc_sata_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int pdc_sata_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int pdc_sata_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int pdc_sata_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static int pdc_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static int pdc_common_port_start(struct ata_port *ap);
 static int pdc_sata_port_start(struct ata_port *ap);
@@ -386,19 +386,21 @@ static int pdc_sata_cable_detect(struct ata_port *ap)
        return ATA_CBL_SATA;
 }
-static int pdc_sata_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int pdc_sata_scr_read(struct ata_link *link,
+                             unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = readl(ap->ioaddr.scr_addr + (sc_reg * 4));
+        *val = readl(link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
-static int pdc_sata_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int pdc_sata_scr_write(struct ata_link *link,
+                              unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        writel(val, ap->ioaddr.scr_addr + (sc_reg * 4));
+        writel(val, link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
@@ -731,7 +733,7 @@ static void pdc_error_intr(struct ata_port *ap, struct ata_queued_cmd *qc,
        if (sata_scr_valid(&ap->link)) {
                u32 serror;
-                pdc_sata_scr_read(ap, SCR_ERROR, &serror);
+                pdc_sata_scr_read(&ap->link, SCR_ERROR, &serror);
                ehi->serror |= serror;
        }
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index 1600107047cf..a000c86ac859 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -111,8 +111,8 @@ struct qs_port_priv {
        qs_state_t              state;
 };
-static int qs_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int qs_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int qs_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static int qs_port_start(struct ata_port *ap);
 static void qs_host_stop(struct ata_host *host);
@@ -242,11 +242,11 @@ static int qs_prereset(struct ata_link *link, unsigned long deadline)
        return ata_sff_prereset(link, deadline);
 }
-static int qs_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int qs_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = readl(ap->ioaddr.scr_addr + (sc_reg * 8));
+        *val = readl(link->ap->ioaddr.scr_addr + (sc_reg * 8));
        return 0;
 }
@@ -256,11 +256,11 @@ static void qs_error_handler(struct ata_port *ap)
        ata_std_error_handler(ap);
 }
-static int qs_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        writel(val, ap->ioaddr.scr_addr + (sc_reg * 8));
+        writel(val, link->ap->ioaddr.scr_addr + (sc_reg * 8));
        return 0;
 }
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 88bf4212590f..031d7b7dee34 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -115,8 +115,8 @@ static int sil_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static int sil_pci_device_resume(struct pci_dev *pdev);
 #endif
 static void sil_dev_config(struct ata_device *dev);
-static int sil_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int sil_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static int sil_set_mode(struct ata_link *link, struct ata_device **r_failed);
 static void sil_freeze(struct ata_port *ap);
 static void sil_thaw(struct ata_port *ap);
@@ -317,9 +317,9 @@ static inline void __iomem *sil_scr_addr(struct ata_port *ap,
        return NULL;
 }
-static int sil_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
-        void __iomem *mmio = sil_scr_addr(ap, sc_reg);
+        void __iomem *mmio = sil_scr_addr(link->ap, sc_reg);
        if (mmio) {
                *val = readl(mmio);
@@ -328,9 +328,9 @@ static int sil_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
        return -EINVAL;
 }
-static int sil_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
-        void __iomem *mmio = sil_scr_addr(ap, sc_reg);
+        void __iomem *mmio = sil_scr_addr(link->ap, sc_reg);
        if (mmio) {
                writel(val, mmio);
@@ -352,8 +352,8 @@ static void sil_host_intr(struct ata_port *ap, u32 bmdma2)
                 * controllers continue to assert IRQ as long as
                 * SError bits are pending.  Clear SError immediately.
                 */
-                sil_scr_read(ap, SCR_ERROR, &serror);
+                sil_scr_read(&ap->link, SCR_ERROR, &serror);
-                sil_scr_write(ap, SCR_ERROR, serror);
+                sil_scr_write(&ap->link, SCR_ERROR, serror);
                /* Sometimes spurious interrupts occur, double check
                 * it's PHYRDY CHG.
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index 84ffcc26a74b..4621807a1a6a 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -340,8 +340,8 @@ struct sil24_port_priv {
 };
 static void sil24_dev_config(struct ata_device *dev);
-static int sil24_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val);
+static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val);
-static int sil24_scr_write(struct ata_port *ap, unsigned sc_reg, u32 val);
+static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val);
 static int sil24_qc_defer(struct ata_queued_cmd *qc);
 static void sil24_qc_prep(struct ata_queued_cmd *qc);
 static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc);
@@ -504,9 +504,9 @@ static int sil24_scr_map[] = {
        [SCR_ACTIVE]    = 3,
 };
-static int sil24_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val)
+static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val)
 {
-        void __iomem *scr_addr = sil24_port_base(ap) + PORT_SCONTROL;
+        void __iomem *scr_addr = sil24_port_base(link->ap) + PORT_SCONTROL;
        if (sc_reg < ARRAY_SIZE(sil24_scr_map)) {
                void __iomem *addr;
@@ -517,9 +517,9 @@ static int sil24_scr_read(struct ata_port *ap, unsigned sc_reg, u32 *val)
        return -EINVAL;
 }
-static int sil24_scr_write(struct ata_port *ap, unsigned sc_reg, u32 val)
+static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val)
 {
-        void __iomem *scr_addr = sil24_port_base(ap) + PORT_SCONTROL;
+        void __iomem *scr_addr = sil24_port_base(link->ap) + PORT_SCONTROL;
        if (sc_reg < ARRAY_SIZE(sil24_scr_map)) {
                void __iomem *addr;
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index 1010b3069bd5..9c43b4e7c4a6 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -64,8 +64,8 @@ enum {
 };
 static int sis_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
-static int sis_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int sis_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int sis_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int sis_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static const struct pci_device_id sis_pci_tbl[] = {
        { PCI_VDEVICE(SI, 0x0180), sis_180 },   /* SiS 964/180 */
@@ -134,10 +134,11 @@ static unsigned int get_scr_cfg_addr(struct ata_port *ap, unsigned int sc_reg)
        return addr;
 }
-static u32 sis_scr_cfg_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static u32 sis_scr_cfg_read(struct ata_link *link,
+                            unsigned int sc_reg, u32 *val)
 {
-        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        struct pci_dev *pdev = to_pci_dev(link->ap->host->dev);
-        unsigned int cfg_addr = get_scr_cfg_addr(ap, sc_reg);
+        unsigned int cfg_addr = get_scr_cfg_addr(link->ap, sc_reg);
        u32 val2 = 0;
        u8 pmr;
@@ -158,10 +159,11 @@ static u32 sis_scr_cfg_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
        return 0;
 }
-static int sis_scr_cfg_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int sis_scr_cfg_write(struct ata_link *link,
+                             unsigned int sc_reg, u32 val)
 {
-        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        struct pci_dev *pdev = to_pci_dev(link->ap->host->dev);
-        unsigned int cfg_addr = get_scr_cfg_addr(ap, sc_reg);
+        unsigned int cfg_addr = get_scr_cfg_addr(link->ap, sc_reg);
        u8 pmr;
        if (sc_reg == SCR_ERROR) /* doesn't exist in PCI cfg space */
@@ -178,8 +180,9 @@ static int sis_scr_cfg_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
        return 0;
 }
-static int sis_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int sis_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
+        struct ata_port *ap = link->ap;
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
        u8 pmr;
@@ -187,7 +190,7 @@ static int sis_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
                return -EINVAL;
        if (ap->flags & SIS_FLAG_CFGSCR)
-                return sis_scr_cfg_read(ap, sc_reg, val);
+                return sis_scr_cfg_read(link, sc_reg, val);
        pci_read_config_byte(pdev, SIS_PMR, &pmr);
@@ -202,8 +205,9 @@ static int sis_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
        return 0;
 }
-static int sis_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int sis_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
+        struct ata_port *ap = link->ap;
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
        u8 pmr;
@@ -213,7 +217,7 @@ static int sis_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
        pci_read_config_byte(pdev, SIS_PMR, &pmr);
        if (ap->flags & SIS_FLAG_CFGSCR)
-                return sis_scr_cfg_write(ap, sc_reg, val);
+                return sis_scr_cfg_write(link, sc_reg, val);
        else {
                iowrite32(val, ap->ioaddr.scr_addr + (sc_reg * 4));
                if ((pdev->device == 0x0182) || (pdev->device == 0x0183) ||
diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
index fb13b82aacba..609d147813ae 100644
--- a/drivers/ata/sata_svw.c
+++ b/drivers/ata/sata_svw.c
@@ -123,20 +123,22 @@ static int k2_sata_check_atapi_dma(struct ata_queued_cmd *qc)
        }
 }
-static int k2_sata_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int k2_sata_scr_read(struct ata_link *link,
+                            unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = readl(ap->ioaddr.scr_addr + (sc_reg * 4));
+        *val = readl(link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
-static int k2_sata_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int k2_sata_scr_write(struct ata_link *link,
+                             unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        writel(val, ap->ioaddr.scr_addr + (sc_reg * 4));
+        writel(val, link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
index db529b849948..019575bb3e08 100644
--- a/drivers/ata/sata_uli.c
+++ b/drivers/ata/sata_uli.c
@@ -57,8 +57,8 @@ struct uli_priv {
 };
 static int uli_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
-static int uli_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int uli_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int uli_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int uli_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static const struct pci_device_id uli_pci_tbl[] = {
        { PCI_VDEVICE(AL, 0x5289), uli_5289 },
@@ -107,39 +107,39 @@ static unsigned int get_scr_cfg_addr(struct ata_port *ap, unsigned int sc_reg)
        return hpriv->scr_cfg_addr[ap->port_no] + (4 * sc_reg);
 }
-static u32 uli_scr_cfg_read(struct ata_port *ap, unsigned int sc_reg)
+static u32 uli_scr_cfg_read(struct ata_link *link, unsigned int sc_reg)
 {
-        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        struct pci_dev *pdev = to_pci_dev(link->ap->host->dev);
-        unsigned int cfg_addr = get_scr_cfg_addr(ap, sc_reg);
+        unsigned int cfg_addr = get_scr_cfg_addr(link->ap, sc_reg);
        u32 val;
        pci_read_config_dword(pdev, cfg_addr, &val);
        return val;
 }
-static void uli_scr_cfg_write(struct ata_port *ap, unsigned int scr, u32 val)
+static void uli_scr_cfg_write(struct ata_link *link, unsigned int scr, u32 val)
 {
-        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        struct pci_dev *pdev = to_pci_dev(link->ap->host->dev);
-        unsigned int cfg_addr = get_scr_cfg_addr(ap, scr);
+        unsigned int cfg_addr = get_scr_cfg_addr(link->ap, scr);
        pci_write_config_dword(pdev, cfg_addr, val);
 }
-static int uli_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int uli_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = uli_scr_cfg_read(ap, sc_reg);
+        *val = uli_scr_cfg_read(link, sc_reg);
        return 0;
 }
-static int uli_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int uli_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL) //SCR_CONTROL=2, SCR_ERROR=1, SCR_STATUS=0
                return -EINVAL;
-        uli_scr_cfg_write(ap, sc_reg, val);
+        uli_scr_cfg_write(link, sc_reg, val);
        return 0;
 }
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 96deeb354e16..1cfa74535d91 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -68,8 +68,8 @@ enum {
 };
 static int svia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
-static int svia_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+static int svia_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
-static int svia_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
+static int svia_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
 static void svia_noop_freeze(struct ata_port *ap);
 static int vt6420_prereset(struct ata_link *link, unsigned long deadline);
 static int vt6421_pata_cable_detect(struct ata_port *ap);
@@ -152,19 +152,19 @@ MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, svia_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
-static int svia_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int svia_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = ioread32(ap->ioaddr.scr_addr + (4 * sc_reg));
+        *val = ioread32(link->ap->ioaddr.scr_addr + (4 * sc_reg));
        return 0;
 }
-static int svia_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int svia_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        iowrite32(val, ap->ioaddr.scr_addr + (4 * sc_reg));
+        iowrite32(val, link->ap->ioaddr.scr_addr + (4 * sc_reg));
        return 0;
 }
@@ -210,20 +210,20 @@ static int vt6420_prereset(struct ata_link *link, unsigned long deadline)
                goto skip_scr;
        /* Resume phy.  This is the old SATA resume sequence */
-        svia_scr_write(ap, SCR_CONTROL, 0x300);
+        svia_scr_write(link, SCR_CONTROL, 0x300);
-        svia_scr_read(ap, SCR_CONTROL, &scontrol); /* flush */
+        svia_scr_read(link, SCR_CONTROL, &scontrol); /* flush */
        /* wait for phy to become ready, if necessary */
        do {
                msleep(200);
-                svia_scr_read(ap, SCR_STATUS, &sstatus);
+                svia_scr_read(link, SCR_STATUS, &sstatus);
                if ((sstatus & 0xf) != 1)
                        break;
        } while (time_before(jiffies, timeout));
        /* open code sata_print_link_status() */
-        svia_scr_read(ap, SCR_STATUS, &sstatus);
+        svia_scr_read(link, SCR_STATUS, &sstatus);
-        svia_scr_read(ap, SCR_CONTROL, &scontrol);
+        svia_scr_read(link, SCR_CONTROL, &scontrol);
        online = (sstatus & 0xf) == 0x3;
@@ -232,7 +232,7 @@ static int vt6420_prereset(struct ata_link *link, unsigned long deadline)
                        online ? "up" : "down", sstatus, scontrol);
        /* SStatus is read one more time */
-        svia_scr_read(ap, SCR_STATUS, &sstatus);
+        svia_scr_read(link, SCR_STATUS, &sstatus);
        if (!online) {
                /* tell EH to bail */
diff --git a/drivers/ata/sata_vsc.c b/drivers/ata/sata_vsc.c
index f3d635c0a2e9..c57cdff9e6bd 100644
--- a/drivers/ata/sata_vsc.c
+++ b/drivers/ata/sata_vsc.c
@@ -98,20 +98,22 @@ enum {
                              VSC_SATA_INT_PHY_CHANGE),
 };
-static int vsc_sata_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
+static int vsc_sata_scr_read(struct ata_link *link,
+                             unsigned int sc_reg, u32 *val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        *val = readl(ap->ioaddr.scr_addr + (sc_reg * 4));
+        *val = readl(link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
-static int vsc_sata_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
+static int vsc_sata_scr_write(struct ata_link *link,
+                              unsigned int sc_reg, u32 val)
 {
        if (sc_reg > SCR_CONTROL)
                return -EINVAL;
-        writel(val, ap->ioaddr.scr_addr + (sc_reg * 4));
+        writel(val, link->ap->ioaddr.scr_addr + (sc_reg * 4));
        return 0;
 }
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 1e55a658e6ce..32f3a8ed8d3d 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -256,7 +256,6 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
                BT_ERR("%s urb %p submission failed (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
-                kfree(buf);
        }
        usb_free_urb(urb);
@@ -298,7 +297,6 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
                BT_ERR("%s urb %p submission failed (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
-                kfree(buf);
        }
        usb_free_urb(urb);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 6a010681ecf3..af472e052732 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,14 +102,19 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
        /* Broadcom BCM2046 */
+        { USB_DEVICE(0x0a5c, 0x2146), .driver_info = BTUSB_RESET },
        { USB_DEVICE(0x0a5c, 0x2151), .driver_info = BTUSB_RESET },
+        /* Apple MacBook Pro with Broadcom chip */
+        { USB_DEVICE(0x05ac, 0x820f), .driver_info = BTUSB_RESET },
        /* IBM/Lenovo ThinkPad with Broadcom chip */
        { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
        { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
        /* Targus ACB10US */
        { USB_DEVICE(0x0a5c, 0x2100), .driver_info = BTUSB_RESET },
+        { USB_DEVICE(0x0a5c, 0x2154), .driver_info = BTUSB_RESET },
        /* ANYCOM Bluetooth USB-200 and USB-250 */
        { USB_DEVICE(0x0a5c, 0x2111), .driver_info = BTUSB_RESET },
@@ -147,6 +152,9 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
        { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
+        /* Belkin F8T016 device */
+        { USB_DEVICE(0x050d, 0x016a), .driver_info = BTUSB_RESET },
        /* Digianswer devices */
        { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
        { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
@@ -169,6 +177,7 @@ static struct usb_device_id blacklist_table[] = {
 struct btusb_data {
        struct hci_dev       *hdev;
        struct usb_device    *udev;
+        struct usb_interface *intf;
        struct usb_interface *isoc;
        spinlock_t lock;
@@ -267,7 +276,6 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev)
                BT_ERR("%s urb %p submission failed (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
-                kfree(buf);
        }
        usb_free_urb(urb);
@@ -350,7 +358,6 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev)
                BT_ERR("%s urb %p submission failed (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
-                kfree(buf);
        }
        usb_free_urb(urb);
@@ -471,7 +478,6 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev)
                BT_ERR("%s urb %p submission failed (%d)",
                                                hdev->name, urb, -err);
                usb_unanchor_urb(urb);
-                kfree(buf);
        }
        usb_free_urb(urb);
@@ -516,7 +522,7 @@ static int btusb_open(struct hci_dev *hdev)
        err = btusb_submit_intr_urb(hdev);
        if (err < 0) {
-                clear_bit(BTUSB_INTR_RUNNING, &hdev->flags);
+                clear_bit(BTUSB_INTR_RUNNING, &data->flags);
                clear_bit(HCI_RUNNING, &hdev->flags);
        }
@@ -532,8 +538,10 @@ static int btusb_close(struct hci_dev *hdev)
        if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
                return 0;
+        cancel_work_sync(&data->work);
        clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
-        usb_kill_anchored_urbs(&data->intr_anchor);
+        usb_kill_anchored_urbs(&data->isoc_anchor);
        clear_bit(BTUSB_BULK_RUNNING, &data->flags);
        usb_kill_anchored_urbs(&data->bulk_anchor);
@@ -821,6 +829,7 @@ static int btusb_probe(struct usb_interface *intf,
        }
        data->udev = interface_to_usbdev(intf);
+        data->intf = intf;
        spin_lock_init(&data->lock);
@@ -889,7 +898,7 @@ static int btusb_probe(struct usb_interface *intf,
        if (data->isoc) {
                err = usb_driver_claim_interface(&btusb_driver,
-                                                        data->isoc, NULL);
+                                                        data->isoc, data);
                if (err < 0) {
                        hci_free_dev(hdev);
                        kfree(data);
@@ -921,13 +930,22 @@ static void btusb_disconnect(struct usb_interface *intf)
        hdev = data->hdev;
-        if (data->isoc)
+        __hci_dev_hold(hdev);
-                usb_driver_release_interface(&btusb_driver, data->isoc);
-        usb_set_intfdata(intf, NULL);
+        usb_set_intfdata(data->intf, NULL);
+        if (data->isoc)
+                usb_set_intfdata(data->isoc, NULL);
        hci_unregister_dev(hdev);
+        if (intf == data->isoc)
+                usb_driver_release_interface(&btusb_driver, data->intf);
+        else if (data->isoc)
+                usb_driver_release_interface(&btusb_driver, data->isoc);
+        __hci_dev_put(hdev);
        hci_free_dev(hdev);
 }
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 4bada0e8b812..46f507531177 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -116,7 +116,9 @@ struct agp_bridge_driver {
        struct agp_memory *(*alloc_by_type) (size_t, int);
        void (*free_by_type)(struct agp_memory *);
        void *(*agp_alloc_page)(struct agp_bridge_data *);
+        int (*agp_alloc_pages)(struct agp_bridge_data *, struct agp_memory *, size_t);
        void (*agp_destroy_page)(void *, int flags);
+        void (*agp_destroy_pages)(struct agp_memory *);
        int (*agp_type_to_mask_type) (struct agp_bridge_data *, int);
        void (*chipset_flush)(struct agp_bridge_data *);
 };
@@ -277,7 +279,10 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type);
 struct agp_memory *agp_generic_alloc_by_type(size_t page_count, int type);
 void agp_generic_free_by_type(struct agp_memory *curr);
 void *agp_generic_alloc_page(struct agp_bridge_data *bridge);
+int agp_generic_alloc_pages(struct agp_bridge_data *agp_bridge,
+                            struct agp_memory *memory, size_t page_count);
 void agp_generic_destroy_page(void *addr, int flags);
+void agp_generic_destroy_pages(struct agp_memory *memory);
 void agp_free_key(int key);
 int agp_num_entries(void);
 u32 agp_collect_device_status(struct agp_bridge_data *bridge, u32 mode, u32 command);
diff --git a/drivers/char/agp/alpha-agp.c b/drivers/char/agp/alpha-agp.c
index 5da89f6c6c25..5ea4da8e9954 100644
--- a/drivers/char/agp/alpha-agp.c
+++ b/drivers/char/agp/alpha-agp.c
@@ -143,7 +143,9 @@ struct agp_bridge_driver alpha_core_agp_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index e280531843be..603a986e96af 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -386,7 +386,9 @@ static const struct agp_bridge_driver amd_irongate_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 7495c522d8e4..2812ee2b165a 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -224,7 +224,9 @@ static const struct agp_bridge_driver amd_8151_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 6ecbcafb34b1..ae2791b926b9 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -418,7 +418,9 @@ static const struct agp_bridge_driver ati_generic_bridge = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index 8ca6f262ef85..453543a1f293 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -335,7 +335,9 @@ static const struct agp_bridge_driver efficeon_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 118dbde25dc7..10d6cbd7c05e 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -201,14 +201,22 @@ void agp_free_memory(struct agp_memory *curr)
                return;
        }
        if (curr->page_count != 0) {
-                for (i = 0; i < curr->page_count; i++) {
+                if (curr->bridge->driver->agp_destroy_pages) {
-                        curr->memory[i] = (unsigned long)gart_to_virt(curr->memory[i]);
+                        curr->bridge->driver->agp_destroy_pages(curr);
-                        curr->bridge->driver->agp_destroy_page((void *)curr->memory[i],
+                } else {
-                                                               AGP_PAGE_DESTROY_UNMAP);
-                }
+                        for (i = 0; i < curr->page_count; i++) {
-                for (i = 0; i < curr->page_count; i++) {
+                                curr->memory[i] = (unsigned long)gart_to_virt(
-                        curr->bridge->driver->agp_destroy_page((void *)curr->memory[i],
+                                        curr->memory[i]);
-                                                               AGP_PAGE_DESTROY_FREE);
+                                curr->bridge->driver->agp_destroy_page(
+                                        (void *)curr->memory[i],
+                                        AGP_PAGE_DESTROY_UNMAP);
+                        }
+                        for (i = 0; i < curr->page_count; i++) {
+                                curr->bridge->driver->agp_destroy_page(
+                                        (void *)curr->memory[i],
+                                        AGP_PAGE_DESTROY_FREE);
+                        }
                }
        }
        agp_free_key(curr->key);
@@ -264,6 +272,15 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
        if (new == NULL)
                return NULL;
+        if (bridge->driver->agp_alloc_pages) {
+                if (bridge->driver->agp_alloc_pages(bridge, new, page_count)) {
+                        agp_free_memory(new);
+                        return NULL;
+                }
+                new->bridge = bridge;
+                return new;
+        }
        for (i = 0; i < page_count; i++) {
                void *addr = bridge->driver->agp_alloc_page(bridge);
@@ -1203,6 +1220,39 @@ EXPORT_SYMBOL(agp_generic_alloc_user);
 * against a maximum value.
 */
+int agp_generic_alloc_pages(struct agp_bridge_data *bridge, struct agp_memory *mem, size_t num_pages)
+{
+        struct page * page;
+        int i, ret = -ENOMEM;
+        for (i = 0; i < num_pages; i++) {
+                page = alloc_page(GFP_KERNEL | GFP_DMA32);
+                /* agp_free_memory() needs gart address */
+                if (page == NULL)
+                        goto out;
+#ifndef CONFIG_X86
+                map_page_into_agp(page);
+#endif
+                get_page(page);
+                atomic_inc(&agp_bridge->current_memory_agp);
+                /* set_memory_array_uc() needs virtual address */
+                mem->memory[i] = (unsigned long)page_address(page);
+                mem->page_count++;
+        }
+#ifdef CONFIG_X86
+        set_memory_array_uc(mem->memory, num_pages);
+#endif
+        ret = 0;
+out:
+        for (i = 0; i < mem->page_count; i++)
+                mem->memory[i] = virt_to_gart((void *)mem->memory[i]);
+        return ret;
+}
+EXPORT_SYMBOL(agp_generic_alloc_pages);
 void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 {
        struct page * page;
@@ -1219,6 +1269,37 @@ void *agp_generic_alloc_page(struct agp_bridge_data *bridge)
 }
 EXPORT_SYMBOL(agp_generic_alloc_page);
+void agp_generic_destroy_pages(struct agp_memory *mem)
+{
+        int i;
+        void *addr;
+        struct page *page;
+        if (!mem)
+                return;
+        for (i = 0; i < mem->page_count; i++)
+                mem->memory[i] = (unsigned long)gart_to_virt(mem->memory[i]);
+#ifdef CONFIG_X86
+        set_memory_array_wb(mem->memory, mem->page_count);
+#endif
+        for (i = 0; i < mem->page_count; i++) {
+                addr = (void *)mem->memory[i];
+                page = virt_to_page(addr);
+#ifndef CONFIG_X86
+                unmap_page_from_agp(page);
+#endif
+                put_page(page);
+                free_page((unsigned long)addr);
+                atomic_dec(&agp_bridge->current_memory_agp);
+                mem->memory[i] = 0;
+        }
+}
+EXPORT_SYMBOL(agp_generic_destroy_pages);
 void agp_generic_destroy_page(void *addr, int flags)
 {
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 80d7317f85c9..183ac3fe44fb 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -435,7 +435,9 @@ const struct agp_bridge_driver hp_zx1_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
        .cant_use_aperture      = true,
 };
diff --git a/drivers/char/agp/i460-agp.c b/drivers/char/agp/i460-agp.c
index e587eebebc67..10da687d131a 100644
--- a/drivers/char/agp/i460-agp.c
+++ b/drivers/char/agp/i460-agp.c
@@ -575,7 +575,9 @@ const struct agp_bridge_driver intel_i460_driver = {
        .insert_memory          = i460_insert_memory_small_io_page,
        .remove_memory          = i460_remove_memory_small_io_page,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
 #endif
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 016fdf0623a4..043e36628d6d 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -1711,7 +1711,9 @@ static const struct agp_bridge_driver intel_generic_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1736,7 +1738,9 @@ static const struct agp_bridge_driver intel_810_driver = {
        .alloc_by_type          = intel_i810_alloc_by_type,
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1760,7 +1764,9 @@ static const struct agp_bridge_driver intel_815_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1785,7 +1791,9 @@ static const struct agp_bridge_driver intel_830_driver = {
        .alloc_by_type          = intel_i830_alloc_by_type,
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
        .chipset_flush          = intel_i830_chipset_flush,
 };
@@ -1810,7 +1818,9 @@ static const struct agp_bridge_driver intel_820_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1834,7 +1844,9 @@ static const struct agp_bridge_driver intel_830mp_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1858,7 +1870,9 @@ static const struct agp_bridge_driver intel_840_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1882,7 +1896,9 @@ static const struct agp_bridge_driver intel_845_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
        .chipset_flush          = intel_i830_chipset_flush,
 };
@@ -1907,7 +1923,9 @@ static const struct agp_bridge_driver intel_850_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1931,7 +1949,9 @@ static const struct agp_bridge_driver intel_860_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -1956,7 +1976,9 @@ static const struct agp_bridge_driver intel_915_driver = {
        .alloc_by_type          = intel_i830_alloc_by_type,
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
        .chipset_flush          = intel_i915_chipset_flush,
 };
@@ -1982,7 +2004,9 @@ static const struct agp_bridge_driver intel_i965_driver = {
        .alloc_by_type          = intel_i830_alloc_by_type,
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
        .chipset_flush          = intel_i915_chipset_flush,
 };
@@ -2007,7 +2031,9 @@ static const struct agp_bridge_driver intel_7505_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -2032,7 +2058,9 @@ static const struct agp_bridge_driver intel_g33_driver = {
        .alloc_by_type          = intel_i830_alloc_by_type,
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
        .chipset_flush          = intel_i915_chipset_flush,
 };
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index eaceb61ba2dc..dc70d3771811 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -312,7 +312,9 @@ static const struct agp_bridge_driver nvidia_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index 8c42dcc5958c..f2492ecf0824 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -224,7 +224,9 @@ static const struct agp_bridge_driver parisc_agp_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
        .cant_use_aperture      = true,
 };
diff --git a/drivers/char/agp/sis-agp.c b/drivers/char/agp/sis-agp.c
index 2587ef96a960..6c3837a0184d 100644
--- a/drivers/char/agp/sis-agp.c
+++ b/drivers/char/agp/sis-agp.c
@@ -140,7 +140,9 @@ static struct agp_bridge_driver sis_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 2fb27fe4c10c..6224df8b7f0a 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -437,7 +437,9 @@ static const struct agp_bridge_driver sworks_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index eef72709ec53..0f004b65ec03 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -509,7 +509,9 @@ const struct agp_bridge_driver uninorth_agp_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
        .cant_use_aperture      = true,
 };
@@ -534,7 +536,9 @@ const struct agp_bridge_driver u3_agp_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
        .cant_use_aperture      = true,
        .needs_scratch_page     = true,
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 7b36476dff41..9f4d49e1b59a 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -190,7 +190,9 @@ static const struct agp_bridge_driver via_agp3_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
@@ -214,7 +216,9 @@ static const struct agp_bridge_driver via_driver = {
        .alloc_by_type          = agp_generic_alloc_by_type,
        .free_by_type           = agp_generic_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
+        .agp_alloc_pages        = agp_generic_alloc_pages,
        .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_destroy_pages      = agp_generic_destroy_pages,
        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index daeb8f766971..e4dce8709541 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -695,13 +695,23 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
 {
        struct tty_driver *p, *res = NULL;
        int tty_line = 0;
+        int len;
        char *str;
+        for (str = name; *str; str++)
+                if ((*str >= '0' && *str <= '9') || *str == ',')
+                        break;
+        if (!*str)
+                return NULL;
+        len = str - name;
+        tty_line = simple_strtoul(str, &str, 10);
        mutex_lock(&tty_mutex);
        /* Search through the tty devices to look for a match */
        list_for_each_entry(p, &tty_drivers, tty_drivers) {
-                str = name + strlen(p->name);
+                if (strncmp(name, p->name, len) != 0)
-                tty_line = simple_strtoul(str, &str, 10);
+                        continue;
                if (*str == ',')
                        str++;
                if (*str == '\0')
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index 4eee533f3f4a..71d2ac4e3f46 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -178,11 +178,13 @@ static int verify_pmtmr_rate(void)
 /* Number of monotonicity checks to perform during initialization */
 #define ACPI_PM_MONOTONICITY_CHECKS 10
+/* Number of reads we try to get two different values */
+#define ACPI_PM_READ_CHECKS 10000
 static int __init init_acpi_pm_clocksource(void)
 {
        cycle_t value1, value2;
-        unsigned int i, j, good = 0;
+        unsigned int i, j = 0;
        if (!pmtmr_ioport)
                return -ENODEV;
@@ -192,29 +194,26 @@ static int __init init_acpi_pm_clocksource(void)
        /* "verify" this timing source: */
        for (j = 0; j < ACPI_PM_MONOTONICITY_CHECKS; j++) {
+                udelay(100 * j);
                value1 = clocksource_acpi_pm.read();
-                for (i = 0; i < 10000; i++) {
+                for (i = 0; i < ACPI_PM_READ_CHECKS; i++) {
                        value2 = clocksource_acpi_pm.read();
                        if (value2 == value1)
                                continue;
                        if (value2 > value1)
-                                good++;
                                break;
                        if ((value2 < value1) && ((value2) < 0xFFF))
-                                good++;
                                break;
                        printk(KERN_INFO "PM-Timer had inconsistent results:"
                               " 0x%#llx, 0x%#llx - aborting.\n",
                               value1, value2);
                        return -EINVAL;
                }
-                udelay(300 * i);
+                if (i == ACPI_PM_READ_CHECKS) {
-        }
+                        printk(KERN_INFO "PM-Timer failed consistency check "
+                               " (0x%#llx) - aborting.\n", value1);
-        if (good != ACPI_PM_MONOTONICITY_CHECKS) {
+                        return -ENODEV;
-                printk(KERN_INFO "PM-Timer failed consistency check "
+                }
-                       " (0x%#llx) - aborting.\n", value1);
-                return -ENODEV;
        }
        if (verify_pmtmr_rate() != 0)
diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index ee827a7f7c6a..b6ad3ac5916e 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1157,6 +1157,8 @@ static int aead_authenc_givencrypt(
        edesc->desc.hdr = ctx->desc_hdr_template | DESC_HDR_MODE0_ENCRYPT;
        memcpy(req->giv, ctx->iv, crypto_aead_ivsize(authenc));
+        /* avoid consecutive packets going out with same IV */
+        *(__be64 *)req->giv ^= cpu_to_be64(req->seq);
        return ipsec_esp(edesc, areq, req->giv, req->seq,
                         ipsec_esp_encrypt_done);
@@ -1449,6 +1451,8 @@ static int talitos_probe(struct of_device *ofdev,
        priv->ofdev = ofdev;
+        INIT_LIST_HEAD(&priv->alg_list);
        tasklet_init(&priv->done_task, talitos_done, (unsigned long)dev);
        tasklet_init(&priv->error_task, talitos_error, (unsigned long)dev);
@@ -1575,8 +1579,6 @@ static int talitos_probe(struct of_device *ofdev,
        }
        /* register crypto algorithms the device supports */
-        INIT_LIST_HEAD(&priv->alg_list);
        for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
                if (hw_supports(dev, driver_algs[i].desc_hdr_template)) {
                        struct talitos_crypto_alg *t_alg;
diff --git a/drivers/dma/dw_dmac.c b/drivers/dma/dw_dmac.c
index 94df91771243..0778d99aea7c 100644
--- a/drivers/dma/dw_dmac.c
+++ b/drivers/dma/dw_dmac.c
@@ -364,7 +364,7 @@ static void dw_dma_tasklet(unsigned long data)
        int i;
        status_block = dma_readl(dw, RAW.BLOCK);
-        status_xfer = dma_readl(dw, RAW.BLOCK);
+        status_xfer = dma_readl(dw, RAW.XFER);
        status_err = dma_readl(dw, RAW.ERROR);
        dev_vdbg(dw->dma.dev, "tasklet: status_block=%x status_err=%x\n",
diff --git a/drivers/hwmon/abituguru3.c b/drivers/hwmon/abituguru3.c
index d568c65c1370..d9e7a49d6cbf 100644
--- a/drivers/hwmon/abituguru3.c
+++ b/drivers/hwmon/abituguru3.c
@@ -279,7 +279,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                { "OTES1 Fan",          36, 2, 60, 1, 0 },
                { NULL, 0, 0, 0, 0, 0 } }
        },
-        { 0x0011, NULL /* Abit AT8 32X, need DMI string */, {
+        { 0x0011, "AT8 32X(ATI RD580-ULI M1575)", {
                { "CPU Core",            0, 0, 10, 1, 0 },
                { "DDR",                 1, 0, 20, 1, 0 },
                { "DDR VTT",             2, 0, 10, 1, 0 },
@@ -303,6 +303,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                { "SYS Fan",            34, 2, 60, 1, 0 },
                { "AUX1 Fan",           35, 2, 60, 1, 0 },
                { "AUX2 Fan",           36, 2, 60, 1, 0 },
+                { "AUX3 Fan",           37, 2, 60, 1, 0 },
                { NULL, 0, 0, 0, 0, 0 } }
        },
        { 0x0012, NULL /* Abit AN8 32X, need DMI string */, {
diff --git a/drivers/hwmon/ad7414.c b/drivers/hwmon/ad7414.c
index ce8d94fbfd7e..bfda8c80ef24 100644
--- a/drivers/hwmon/ad7414.c
+++ b/drivers/hwmon/ad7414.c
@@ -69,7 +69,7 @@ static inline int ad7414_write(struct i2c_client *client, u8 reg, u8 value)
        return i2c_smbus_write_byte_data(client, reg, value);
 }
-struct ad7414_data *ad7414_update_device(struct device *dev)
+static struct ad7414_data *ad7414_update_device(struct device *dev)
 {
        struct i2c_client *client = to_i2c_client(dev);
        struct ad7414_data *data = i2c_get_clientdata(client);
diff --git a/drivers/hwmon/atxp1.c b/drivers/hwmon/atxp1.c
index d191118ba0cb..d6b490d3e36f 100644
--- a/drivers/hwmon/atxp1.c
+++ b/drivers/hwmon/atxp1.c
@@ -31,7 +31,7 @@
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("System voltages control via Attansic ATXP1");
-MODULE_VERSION("0.6.2");
+MODULE_VERSION("0.6.3");
 MODULE_AUTHOR("Sebastian Witt <se.witt@gmx.net>");
 #define ATXP1_VID       0x00
@@ -289,16 +289,16 @@ static int atxp1_detect(struct i2c_client *new_client, int kind,
        if (!((i2c_smbus_read_byte_data(new_client, 0x3e) == 0) &&
             (i2c_smbus_read_byte_data(new_client, 0x3f) == 0) &&
             (i2c_smbus_read_byte_data(new_client, 0xfe) == 0) &&
-             (i2c_smbus_read_byte_data(new_client, 0xff) == 0) )) {
+             (i2c_smbus_read_byte_data(new_client, 0xff) == 0)))
+                return -ENODEV;
-                /* No vendor ID, now checking if registers 0x10,0x11 (non-existent)
+        /* No vendor ID, now checking if registers 0x10,0x11 (non-existent)
-                 * showing the same as register 0x00 */
+         * showing the same as register 0x00 */
-                temp = i2c_smbus_read_byte_data(new_client, 0x00);
+        temp = i2c_smbus_read_byte_data(new_client, 0x00);
-                if (!((i2c_smbus_read_byte_data(new_client, 0x10) == temp) &&
+        if (!((i2c_smbus_read_byte_data(new_client, 0x10) == temp) &&
-                         (i2c_smbus_read_byte_data(new_client, 0x11) == temp) ))
+              (i2c_smbus_read_byte_data(new_client, 0x11) == temp)))
-                        return -ENODEV;
+                return -ENODEV;
-        }
        /* Get VRM */
        temp = vid_which_vrm();
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 30cdb0956779..d793cc011990 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -46,6 +46,8 @@
 #include <linux/err.h>
 #include <linux/mutex.h>
 #include <linux/sysfs.h>
+#include <linux/string.h>
+#include <linux/dmi.h>
 #include <asm/io.h>
 #define DRVNAME "it87"
@@ -236,6 +238,8 @@ struct it87_sio_data {
        /* Values read from Super-I/O config space */
        u8 revision;
        u8 vid_value;
+        /* Values set based on DMI strings */
+        u8 skip_pwm;
 };
 /* For each registered chip, we need to keep some data in memory.
@@ -273,10 +277,10 @@ struct it87_data {
 static inline int has_16bit_fans(const struct it87_data *data)
 {
        /* IT8705F Datasheet 0.4.1, 3h == Version G.
-           IT8712F Datasheet 0.9.1, section 8.3.5 indicates 7h == Version I.
+           IT8712F Datasheet 0.9.1, section 8.3.5 indicates 8h == Version J.
           These are the first revisions with 16bit tachometer support. */
        return (data->type == it87 && data->revision >= 0x03)
-            || (data->type == it8712 && data->revision >= 0x07)
+            || (data->type == it8712 && data->revision >= 0x08)
            || data->type == it8716
            || data->type == it8718;
 }
@@ -964,6 +968,7 @@ static int __init it87_find(unsigned short *address,
 {
        int err = -ENODEV;
        u16 chip_type;
+        const char *board_vendor, *board_name;
        superio_enter();
        chip_type = force_id ? force_id : superio_inw(DEVID);
@@ -1022,6 +1027,24 @@ static int __init it87_find(unsigned short *address,
                        pr_info("it87: in7 is VCCH (+5V Stand-By)\n");
        }
+        /* Disable specific features based on DMI strings */
+        board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
+        board_name = dmi_get_system_info(DMI_BOARD_NAME);
+        if (board_vendor && board_name) {
+                if (strcmp(board_vendor, "nVIDIA") == 0
+                 && strcmp(board_name, "FN68PT") == 0) {
+                        /* On the Shuttle SN68PT, FAN_CTL2 is apparently not
+                           connected to a fan, but to something else. One user
+                           has reported instant system power-off when changing
+                           the PWM2 duty cycle, so we disable it.
+                           I use the board name string as the trigger in case
+                           the same board is ever used in other systems. */
+                        pr_info("it87: Disabling pwm2 due to "
+                                "hardware constraints\n");
+                        sio_data->skip_pwm = (1 << 1);
+                }
+        }
 exit:
        superio_exit();
        return err;
@@ -1168,25 +1191,33 @@ static int __devinit it87_probe(struct platform_device *pdev)
        }
        if (enable_pwm_interface) {
-                if ((err = device_create_file(dev,
+                if (!(sio_data->skip_pwm & (1 << 0))) {
-                     &sensor_dev_attr_pwm1_enable.dev_attr))
+                        if ((err = device_create_file(dev,
-                 || (err = device_create_file(dev,
+                             &sensor_dev_attr_pwm1_enable.dev_attr))
-                     &sensor_dev_attr_pwm2_enable.dev_attr))
+                         || (err = device_create_file(dev,
-                 || (err = device_create_file(dev,
+                             &sensor_dev_attr_pwm1.dev_attr))
-                     &sensor_dev_attr_pwm3_enable.dev_attr))
+                         || (err = device_create_file(dev,
-                 || (err = device_create_file(dev,
+                             &dev_attr_pwm1_freq)))
-                     &sensor_dev_attr_pwm1.dev_attr))
+                                goto ERROR4;
-                 || (err = device_create_file(dev,
+                }
-                     &sensor_dev_attr_pwm2.dev_attr))
+                if (!(sio_data->skip_pwm & (1 << 1))) {
-                 || (err = device_create_file(dev,
+                        if ((err = device_create_file(dev,
-                     &sensor_dev_attr_pwm3.dev_attr))
+                             &sensor_dev_attr_pwm2_enable.dev_attr))
-                 || (err = device_create_file(dev,
+                         || (err = device_create_file(dev,
-                     &dev_attr_pwm1_freq))
+                             &sensor_dev_attr_pwm2.dev_attr))
-                 || (err = device_create_file(dev,
+                         || (err = device_create_file(dev,
-                     &dev_attr_pwm2_freq))
+                             &dev_attr_pwm2_freq)))
-                 || (err = device_create_file(dev,
+                                goto ERROR4;
-                     &dev_attr_pwm3_freq)))
+                }
-                        goto ERROR4;
+                if (!(sio_data->skip_pwm & (1 << 2))) {
+                        if ((err = device_create_file(dev,
+                             &sensor_dev_attr_pwm3_enable.dev_attr))
+                         || (err = device_create_file(dev,
+                             &sensor_dev_attr_pwm3.dev_attr))
+                         || (err = device_create_file(dev,
+                             &dev_attr_pwm3_freq)))
+                                goto ERROR4;
+                }
        }
        if (data->type == it8712 || data->type == it8716
@@ -1546,6 +1577,7 @@ static int __init sm_it87_init(void)
        unsigned short isa_address=0;
        struct it87_sio_data sio_data;
+        memset(&sio_data, 0, sizeof(struct it87_sio_data));
        err = it87_find(&isa_address, &sio_data);
        if (err)
                return err;
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 22f6d5c00d80..0e7b1c6724aa 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -180,7 +180,7 @@ static const struct i2c_algorithm i2c_powermac_algorithm = {
 };
-static int i2c_powermac_remove(struct platform_device *dev)
+static int __devexit i2c_powermac_remove(struct platform_device *dev)
 {
        struct i2c_adapter      *adapter = platform_get_drvdata(dev);
        struct pmac_i2c_bus     *bus = i2c_get_adapdata(adapter);
@@ -200,7 +200,7 @@ static int i2c_powermac_remove(struct platform_device *dev)
 }
-static int __devexit i2c_powermac_probe(struct platform_device *dev)
+static int __devinit i2c_powermac_probe(struct platform_device *dev)
 {
        struct pmac_i2c_bus *bus = dev->dev.platform_data;
        struct device_node *parent = NULL;
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index af4491fa7e34..307d976c9b69 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -583,8 +583,10 @@ static int __init i2c_dev_init(void)
                goto out;
        i2c_dev_class = class_create(THIS_MODULE, "i2c-dev");
-        if (IS_ERR(i2c_dev_class))
+        if (IS_ERR(i2c_dev_class)) {
+                res = PTR_ERR(i2c_dev_class);
                goto out_unreg_chrdev;
+        }
        res = i2c_add_driver(&i2cdev_driver);
        if (res)
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index fc735ab08ff4..052879a6f853 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -292,6 +292,20 @@ config IDE_GENERIC
        tristate "generic/default IDE chipset support"
        depends on ALPHA || X86 || IA64 || M32R || MIPS
        help
+          This is the generic IDE driver.  This driver attaches to the
+          fixed legacy ports (e.g. on PCs 0x1f0/0x170, 0x1e8/0x168 and
+          so on).  Please note that if this driver is built into the
+          kernel or loaded before other ATA (IDE or libata) drivers
+          and the controller is located at legacy ports, this driver
+          may grab those ports and thus can prevent the controller
+          specific driver from attaching.
+          Also, currently, IDE generic doesn't allow IRQ sharing
+          meaning that the IRQs it grabs won't be available to other
+          controllers sharing those IRQs which usually makes drivers
+          for those controllers fail.  Generally, it's not a good idea
+          to load IDE generic driver on modern systems.
          If unsure, say N.
 config BLK_DEV_PLATFORM
@@ -766,10 +780,6 @@ config BLK_DEV_IDEDMA_PMAC
          to transfer data to and from memory.  Saying Y is safe and improves
          performance.
-config BLK_DEV_IDE_SWARM
-        tristate "IDE for Sibyte evaluation boards"
-        depends on SIBYTE_SB1xxx_SOC
 config BLK_DEV_IDE_AU1XXX
       bool "IDE for AMD Alchemy Au1200"
       depends on SOC_AU1200
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index f1489999cf91..f16bb4667238 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1661,7 +1661,9 @@ static int ide_cdrom_probe_capabilities(ide_drive_t *drive)
                cdi->mask &= ~CDC_PLAY_AUDIO;
        mechtype = buf[8 + 6] >> 5;
-        if (mechtype == mechtype_caddy || mechtype == mechtype_popup)
+        if (mechtype == mechtype_caddy ||
+            mechtype == mechtype_popup ||
+            (drive->atapi_flags & IDE_AFLAG_NO_AUTOCLOSE))
                cdi->mask |= CDC_CLOSE_TRAY;
        if (cdi->sanyo_slot > 0) {
@@ -1859,6 +1861,8 @@ static const struct cd_list_entry ide_cd_quirks_list[] = {
        { "MATSHITADVD-ROM SR-8176", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
        { "MATSHITADVD-ROM SR-8174", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
        { "Optiarc DVD RW AD-5200A", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
+        { "Optiarc DVD RW AD-7200A", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
+        { "Optiarc DVD RW AD-7543A", NULL,   IDE_AFLAG_NO_AUTOCLOSE          },
        { NULL, NULL, 0 }
 };
@@ -1933,7 +1937,6 @@ static void ide_cd_remove(ide_drive_t *drive)
        ide_proc_unregister_driver(drive, info->driver);
-        blk_unregister_filter(info->disk);
        del_gendisk(info->disk);
        ide_cd_put(info);
@@ -2159,7 +2162,6 @@ static int ide_cd_probe(ide_drive_t *drive)
        g->fops = &idecd_ops;
        g->flags |= GENHD_FL_REMOVABLE;
        add_disk(g);
-        blk_register_filter(g);
        return 0;
 out_free_cd:
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index adc682755857..3fa07c0aeaa4 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -211,7 +211,7 @@ int ide_build_dmatable (ide_drive_t *drive, struct request *rq)
                                xcount = bcount & 0xffff;
                                if (is_trm290)
                                        xcount = ((xcount >> 2) - 1) << 16;
-                                if (xcount == 0x0000) {
+                                else if (xcount == 0x0000) {
        /* 
         * Most chipsets correctly interpret a length of 0x0000 as 64KB,
         * but at least one (e.g. CS5530) misinterprets it as zero (!).
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 994e41099b42..a51a30e9eab3 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1492,7 +1492,7 @@ static struct device_attribute *ide_port_attrs[] = {
 static int ide_sysfs_register_port(ide_hwif_t *hwif)
 {
-        int i, rc;
+        int i, uninitialized_var(rc);
        for (i = 0; ide_port_attrs[i]; i++) {
                rc = device_create_file(hwif->portdev, ide_port_attrs[i]);
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1bce84b56630..3833189144ed 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -2338,7 +2338,7 @@ static void idetape_get_inquiry_results(ide_drive_t *drive)
 {
        idetape_tape_t *tape = drive->driver_data;
        struct ide_atapi_pc pc;
-        char fw_rev[6], vendor_id[10], product_id[18];
+        char fw_rev[4], vendor_id[8], product_id[16];
        idetape_create_inquiry_cmd(&pc);
        if (idetape_queue_pc_tail(drive, &pc)) {
@@ -2350,11 +2350,11 @@ static void idetape_get_inquiry_results(ide_drive_t *drive)
        memcpy(product_id, &pc.buf[16], 16);
        memcpy(fw_rev, &pc.buf[32], 4);
-        ide_fixstring(vendor_id, 10, 0);
+        ide_fixstring(vendor_id, 8, 0);
-        ide_fixstring(product_id, 18, 0);
+        ide_fixstring(product_id, 16, 0);
-        ide_fixstring(fw_rev, 6, 0);
+        ide_fixstring(fw_rev, 4, 0);
-        printk(KERN_INFO "ide-tape: %s <-> %s: %s %s rev %s\n",
+        printk(KERN_INFO "ide-tape: %s <-> %s: %.8s %.16s rev %.4s\n",
                        drive->name, tape->name, vendor_id, product_id, fw_rev);
 }
diff --git a/drivers/ide/mips/Makefile b/drivers/ide/mips/Makefile
index 677c7b2bac92..5873fa0b8769 100644
--- a/drivers/ide/mips/Makefile
+++ b/drivers/ide/mips/Makefile
@@ -1,4 +1,3 @@
-obj-$(CONFIG_BLK_DEV_IDE_SWARM)         += swarm.o
 obj-$(CONFIG_BLK_DEV_IDE_AU1XXX)        += au1xxx-ide.o
 EXTRA_CFLAGS    := -Idrivers/ide
diff --git a/drivers/ide/mips/swarm.c b/drivers/ide/mips/swarm.c
deleted file mode 100644
index badf79fc9e3a..000000000000
--- a/drivers/ide/mips/swarm.c
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * Copyright (C) 2001, 2002, 2003 Broadcom Corporation
- * Copyright (C) 2004 MontaVista Software Inc.
- *      Author: Manish Lachwani, mlachwani@mvista.com
- * Copyright (C) 2004  MIPS Technologies, Inc.  All rights reserved.
- *      Author: Maciej W. Rozycki <macro@mips.com>
- * Copyright (c) 2006, 2008  Maciej W. Rozycki
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- */
-/*
- *  Derived loosely from ide-pmac.c, so:
- *  Copyright (C) 1998 Paul Mackerras.
- *  Copyright (C) 1995-1998 Mark Lord
- */
-/*
- * Boards with SiByte processors so far have supported IDE devices via
- * the Generic Bus, PCI bus, and built-in PCMCIA interface.  In all
- * cases, byte-swapping must be avoided for these devices (whereas
- * other PCI devices, for example, will require swapping).  Any
- * SiByte-targetted kernel including IDE support will include this
- * file.  Probing of a Generic Bus for an IDE device is controlled by
- * the definition of "SIBYTE_HAVE_IDE", which is provided by
- * <asm/sibyte/board.h> for Broadcom boards.
- */
-#include <linux/ide.h>
-#include <linux/ioport.h>
-#include <linux/kernel.h>
-#include <linux/types.h>
-#include <linux/platform_device.h>
-#include <asm/io.h>
-#include <asm/sibyte/board.h>
-#include <asm/sibyte/sb1250_genbus.h>
-#include <asm/sibyte/sb1250_regs.h>
-#define DRV_NAME "ide-swarm"
-static char swarm_ide_string[] = DRV_NAME;
-static struct resource swarm_ide_resource = {
-        .name   = "SWARM GenBus IDE",
-        .flags  = IORESOURCE_MEM,
-};
-static struct platform_device *swarm_ide_dev;
-static const struct ide_port_info swarm_port_info = {
-        .name                   = DRV_NAME,
-        .host_flags             = IDE_HFLAG_MMIO | IDE_HFLAG_NO_DMA,
-};
-/*
- * swarm_ide_probe - if the board header indicates the existence of
- * Generic Bus IDE, allocate a HWIF for it.
- */
-static int __devinit swarm_ide_probe(struct device *dev)
-{
-        u8 __iomem *base;
-        struct ide_host *host;
-        phys_t offset, size;
-        int i, rc;
-        hw_regs_t hw, *hws[] = { &hw, NULL, NULL, NULL };
-        if (!SIBYTE_HAVE_IDE)
-                return -ENODEV;
-        base = ioremap(A_IO_EXT_BASE, 0x800);
-        offset = __raw_readq(base + R_IO_EXT_REG(R_IO_EXT_START_ADDR, IDE_CS));
-        size = __raw_readq(base + R_IO_EXT_REG(R_IO_EXT_MULT_SIZE, IDE_CS));
-        iounmap(base);
-        offset = G_IO_START_ADDR(offset) << S_IO_ADDRBASE;
-        size = (G_IO_MULT_SIZE(size) + 1) << S_IO_REGSIZE;
-        if (offset < A_PHYS_GENBUS || offset >= A_PHYS_GENBUS_END) {
-                printk(KERN_INFO DRV_NAME
-                       ": IDE interface at GenBus disabled\n");
-                return -EBUSY;
-        }
-        printk(KERN_INFO DRV_NAME ": IDE interface at GenBus slot %i\n",
-               IDE_CS);
-        swarm_ide_resource.start = offset;
-        swarm_ide_resource.end = offset + size - 1;
-        if (request_resource(&iomem_resource, &swarm_ide_resource)) {
-                printk(KERN_ERR DRV_NAME
-                       ": can't request I/O memory resource\n");
-                return -EBUSY;
-        }
-        base = ioremap(offset, size);
-        for (i = 0; i <= 7; i++)
-                hw.io_ports_array[i] =
-                                (unsigned long)(base + ((0x1f0 + i) << 5));
-        hw.io_ports.ctl_addr =
-                                (unsigned long)(base + (0x3f6 << 5));
-        hw.irq = K_INT_GB_IDE;
-        hw.chipset = ide_generic;
-        rc = ide_host_add(&swarm_port_info, hws, &host);
-        if (rc)
-                goto err;
-        dev_set_drvdata(dev, host);
-        return 0;
-err:
-        release_resource(&swarm_ide_resource);
-        iounmap(base);
-        return rc;
-}
-static struct device_driver swarm_ide_driver = {
-        .name   = swarm_ide_string,
-        .bus    = &platform_bus_type,
-        .probe  = swarm_ide_probe,
-};
-static void swarm_ide_platform_release(struct device *device)
-{
-        struct platform_device *pldev;
-        /* free device */
-        pldev = to_platform_device(device);
-        kfree(pldev);
-}
-static int __devinit swarm_ide_init_module(void)
-{
-        struct platform_device *pldev;
-        int err;
-        printk(KERN_INFO "SWARM IDE driver\n");
-        if (driver_register(&swarm_ide_driver)) {
-                printk(KERN_ERR "Driver registration failed\n");
-                err = -ENODEV;
-                goto out;
-        }
-        if (!(pldev = kzalloc(sizeof (*pldev), GFP_KERNEL))) {
-                err = -ENOMEM;
-                goto out_unregister_driver;
-        }
-        pldev->name             = swarm_ide_string;
-        pldev->id               = 0;
-        pldev->dev.release      = swarm_ide_platform_release;
-        if (platform_device_register(pldev)) {
-                err = -ENODEV;
-                goto out_free_pldev;
-        }
-        if (!pldev->dev.driver) {
-                /*
-                 * The driver was not bound to this device, there was
-                 * no hardware at this address. Unregister it, as the
-                 * release fuction will take care of freeing the
-                 * allocated structure
-                 */
-                platform_device_unregister (pldev);
-        }
-        swarm_ide_dev = pldev;
-        return 0;
-out_free_pldev:
-        kfree(pldev);
-out_unregister_driver:
-        driver_unregister(&swarm_ide_driver);
-out:
-        return err;
-}
-module_init(swarm_ide_init_module);
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index eb107eef0dbc..c37ab1743819 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -613,6 +613,14 @@ static int check_in_drive_list(ide_drive_t *drive, const char **list)
        return 0;
 }
+static struct hpt_info *hpt3xx_get_info(struct device *dev)
+{
+        struct ide_host *host   = dev_get_drvdata(dev);
+        struct hpt_info *info   = (struct hpt_info *)host->host_priv;
+        return dev == host->dev[1] ? info + 1 : info;
+}
 /*
 * The Marvell bridge chips used on the HighPoint SATA cards do not seem
 * to support the UltraDMA modes 1, 2, and 3 as well as any MWDMA modes...
@@ -621,9 +629,7 @@ static int check_in_drive_list(ide_drive_t *drive, const char **list)
 static u8 hpt3xx_udma_filter(ide_drive_t *drive)
 {
        ide_hwif_t *hwif        = HWIF(drive);
-        struct pci_dev *dev     = to_pci_dev(hwif->dev);
+        struct hpt_info *info   = hpt3xx_get_info(hwif->dev);
-        struct ide_host *host   = pci_get_drvdata(dev);
-        struct hpt_info *info   = host->host_priv + (hwif->dev == host->dev[1]);
        u8 mask                 = hwif->ultra_mask;
        switch (info->chip_type) {
@@ -662,9 +668,7 @@ static u8 hpt3xx_udma_filter(ide_drive_t *drive)
 static u8 hpt3xx_mdma_filter(ide_drive_t *drive)
 {
        ide_hwif_t *hwif        = HWIF(drive);
-        struct pci_dev *dev     = to_pci_dev(hwif->dev);
+        struct hpt_info *info   = hpt3xx_get_info(hwif->dev);
-        struct ide_host *host   = pci_get_drvdata(dev);
-        struct hpt_info *info   = host->host_priv + (hwif->dev == host->dev[1]);
        switch (info->chip_type) {
        case HPT372 :
@@ -700,8 +704,7 @@ static void hpt3xx_set_mode(ide_drive_t *drive, const u8 speed)
 {
        ide_hwif_t *hwif        = drive->hwif;
        struct pci_dev *dev     = to_pci_dev(hwif->dev);
-        struct ide_host *host   = pci_get_drvdata(dev);
+        struct hpt_info *info   = hpt3xx_get_info(hwif->dev);
-        struct hpt_info *info   = host->host_priv + (hwif->dev == host->dev[1]);
        struct hpt_timings *t   = info->timings;
        u8  itr_addr            = 0x40 + (drive->dn * 4);
        u32 old_itr             = 0;
@@ -744,8 +747,7 @@ static void hpt3xx_maskproc(ide_drive_t *drive, int mask)
 {
        ide_hwif_t *hwif        = HWIF(drive);
        struct pci_dev  *dev    = to_pci_dev(hwif->dev);
-        struct ide_host *host   = pci_get_drvdata(dev);
+        struct hpt_info *info   = hpt3xx_get_info(hwif->dev);
-        struct hpt_info *info   = host->host_priv + (hwif->dev == host->dev[1]);
        if (drive->quirk_list) {
                if (info->chip_type >= HPT370) {
@@ -973,8 +975,7 @@ static int __devinit hpt37x_calibrate_dpll(struct pci_dev *dev, u16 f_low, u16 f
 static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev)
 {
        unsigned long io_base   = pci_resource_start(dev, 4);
-        struct ide_host *host   = pci_get_drvdata(dev);
+        struct hpt_info *info   = hpt3xx_get_info(&dev->dev);
-        struct hpt_info *info   = host->host_priv + (&dev->dev == host->dev[1]);
        const char *name        = DRV_NAME;
        u8 pci_clk,  dpll_clk   = 0;    /* PCI and DPLL clock in MHz */
        u8 chip_type;
@@ -1217,8 +1218,7 @@ static unsigned int __devinit init_chipset_hpt366(struct pci_dev *dev)
 static u8 hpt3xx_cable_detect(ide_hwif_t *hwif)
 {
        struct pci_dev  *dev    = to_pci_dev(hwif->dev);
-        struct ide_host *host   = pci_get_drvdata(dev);
+        struct hpt_info *info   = hpt3xx_get_info(hwif->dev);
-        struct hpt_info *info   = host->host_priv + (hwif->dev == host->dev[1]);
        u8 chip_type            = info->chip_type;
        u8 scr1 = 0, ata66      = hwif->channel ? 0x01 : 0x02;
@@ -1262,8 +1262,7 @@ static u8 hpt3xx_cable_detect(ide_hwif_t *hwif)
 static void __devinit init_hwif_hpt366(ide_hwif_t *hwif)
 {
        struct pci_dev *dev     = to_pci_dev(hwif->dev);
-        struct ide_host *host   = pci_get_drvdata(dev);
+        struct hpt_info *info   = hpt3xx_get_info(hwif->dev);
-        struct hpt_info *info   = host->host_priv + (hwif->dev == host->dev[1]);
        int serialize           = HPT_SERIALIZE_IO;
        u8  chip_type           = info->chip_type;
        u8  new_mcr, old_mcr    = 0;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f29dbb767e87..9559248f265b 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1342,6 +1342,12 @@ static __be32 convert_access(int acc)
 static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
 {
        struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(wr->wr.fast_reg.page_list);
+        int i;
+        for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
+                wr->wr.fast_reg.page_list->page_list[i] =
+                        cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
+                                    MLX4_MTT_FLAG_PRESENT);
        fseg->flags             = convert_access(wr->wr.fast_reg.access_flags);
        fseg->mem_key           = cpu_to_be32(wr->wr.fast_reg.rkey);
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 9f0b964b2c99..499d3cf83e1f 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1956,13 +1956,6 @@ static int mini_cm_reject(struct nes_cm_core *cm_core,
                return ret;
        cleanup_retrans_entry(cm_node);
        cm_node->state = NES_CM_STATE_CLOSED;
-        ret = send_fin(cm_node, NULL);
-        if (cm_node->accept_pend) {
-                BUG_ON(!cm_node->listener);
-                atomic_dec(&cm_node->listener->pend_accepts_cnt);
-                BUG_ON(atomic_read(&cm_node->listener->pend_accepts_cnt) < 0);
-        }
        ret = send_reset(cm_node, NULL);
        return ret;
@@ -2383,6 +2376,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
                        atomic_inc(&cm_disconnects);
                        cm_event.event = IW_CM_EVENT_DISCONNECT;
                        if (last_ae == NES_AEQE_AEID_LLP_CONNECTION_RESET) {
+                                issued_disconnect_reset = 1;
                                cm_event.status = IW_CM_EVENT_STATUS_RESET;
                                nes_debug(NES_DBG_CM, "Generating a CM "
                                        "Disconnect Event (status reset) for "
@@ -2508,7 +2502,6 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
                nes_debug(NES_DBG_CM, "Call close API\n");
                g_cm_core->api->close(g_cm_core, nesqp->cm_node);
-                nesqp->cm_node = NULL;
        }
        return ret;
@@ -2837,6 +2830,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        cm_node->apbvt_set = 1;
        nesqp->cm_node = cm_node;
        cm_node->nesqp = nesqp;
+        nes_add_ref(&nesqp->ibqp);
        return 0;
 }
@@ -3167,7 +3161,6 @@ static void cm_event_connect_error(struct nes_cm_event *event)
        if (ret)
                printk(KERN_ERR "%s[%u] OFA CM event_handler returned, "
                        "ret=%d\n", __func__, __LINE__, ret);
-        nes_rem_ref(&nesqp->ibqp);
        cm_id->rem_ref(cm_id);
        rem_ref_cm_node(event->cm_node->cm_core, event->cm_node);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index b0ffc9abe8c0..05eb41b8ab63 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -293,6 +293,7 @@ struct ipoib_dev_priv {
        struct delayed_work pkey_poll_task;
        struct delayed_work mcast_task;
+        struct work_struct carrier_on_task;
        struct work_struct flush_light;
        struct work_struct flush_normal;
        struct work_struct flush_heavy;
@@ -464,6 +465,7 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port);
 void ipoib_dev_cleanup(struct net_device *dev);
 void ipoib_mcast_join_task(struct work_struct *work);
+void ipoib_mcast_carrier_on_task(struct work_struct *work);
 void ipoib_mcast_send(struct net_device *dev, void *mgid, struct sk_buff *skb);
 void ipoib_mcast_restart_task(struct work_struct *work);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 7e9e218738fa..e9ca3cb57d52 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -404,7 +404,7 @@ static void path_rec_completion(int status,
        struct net_device *dev = path->dev;
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_ah *ah = NULL;
-        struct ipoib_ah *old_ah;
+        struct ipoib_ah *old_ah = NULL;
        struct ipoib_neigh *neigh, *tn;
        struct sk_buff_head skqueue;
        struct sk_buff *skb;
@@ -428,12 +428,12 @@ static void path_rec_completion(int status,
        spin_lock_irqsave(&priv->lock, flags);
-        old_ah   = path->ah;
-        path->ah = ah;
        if (ah) {
                path->pathrec = *pathrec;
+                old_ah   = path->ah;
+                path->ah = ah;
                ipoib_dbg(priv, "created address handle %p for LID 0x%04x, SL %d\n",
                          ah, be16_to_cpu(pathrec->dlid), pathrec->sl);
@@ -1075,6 +1075,7 @@ static void ipoib_setup(struct net_device *dev)
        INIT_DELAYED_WORK(&priv->pkey_poll_task, ipoib_pkey_poll);
        INIT_DELAYED_WORK(&priv->mcast_task,   ipoib_mcast_join_task);
+        INIT_WORK(&priv->carrier_on_task, ipoib_mcast_carrier_on_task);
        INIT_WORK(&priv->flush_light,   ipoib_ib_dev_flush_light);
        INIT_WORK(&priv->flush_normal,   ipoib_ib_dev_flush_normal);
        INIT_WORK(&priv->flush_heavy,   ipoib_ib_dev_flush_heavy);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ac33c8f3ea85..aae28620a6e5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -366,6 +366,21 @@ static int ipoib_mcast_sendonly_join(struct ipoib_mcast *mcast)
        return ret;
 }
+void ipoib_mcast_carrier_on_task(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   carrier_on_task);
+        /*
+         * Take rtnl_lock to avoid racing with ipoib_stop() and
+         * turning the carrier back on while a device is being
+         * removed.
+         */
+        rtnl_lock();
+        netif_carrier_on(priv->dev);
+        rtnl_unlock();
+}
 static int ipoib_mcast_join_complete(int status,
                                     struct ib_sa_multicast *multicast)
 {
@@ -392,16 +407,12 @@ static int ipoib_mcast_join_complete(int status,
                                           &priv->mcast_task, 0);
                mutex_unlock(&mcast_mutex);
-                if (mcast == priv->broadcast) {
+                /*
-                        /*
+                 * Defer carrier on work to ipoib_workqueue to avoid a
-                         * Take RTNL lock here to avoid racing with
+                 * deadlock on rtnl_lock here.
-                         * ipoib_stop() and turning the carrier back
+                 */
-                         * on while a device is being removed.
+                if (mcast == priv->broadcast)
-                         */
+                        queue_work(ipoib_workqueue, &priv->carrier_on_task);
-                        rtnl_lock();
-                        netif_carrier_on(dev);
-                        rtnl_unlock();
-                }
                return 0;
        }
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 18f4d7f6ce6d..2998a6ac9ae4 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -351,8 +351,9 @@ static int report_tp_state(struct bcm5974 *dev, int size)
 #define BCM5974_WELLSPRING_MODE_REQUEST_VALUE           0x300
 #define BCM5974_WELLSPRING_MODE_REQUEST_INDEX           0
 #define BCM5974_WELLSPRING_MODE_VENDOR_VALUE            0x01
+#define BCM5974_WELLSPRING_MODE_NORMAL_VALUE            0x08
-static int bcm5974_wellspring_mode(struct bcm5974 *dev)
+static int bcm5974_wellspring_mode(struct bcm5974 *dev, bool on)
 {
        char *data = kmalloc(8, GFP_KERNEL);
        int retval = 0, size;
@@ -377,7 +378,9 @@ static int bcm5974_wellspring_mode(struct bcm5974 *dev)
        }
        /* apply the mode switch */
-        data[0] = BCM5974_WELLSPRING_MODE_VENDOR_VALUE;
+        data[0] = on ?
+                BCM5974_WELLSPRING_MODE_VENDOR_VALUE :
+                BCM5974_WELLSPRING_MODE_NORMAL_VALUE;
        /* write configuration */
        size = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
@@ -392,7 +395,8 @@ static int bcm5974_wellspring_mode(struct bcm5974 *dev)
                goto out;
        }
-        dprintk(2, "bcm5974: switched to wellspring mode.\n");
+        dprintk(2, "bcm5974: switched to %s mode.\n",
+                on ? "wellspring" : "normal");
 out:
        kfree(data);
@@ -481,7 +485,7 @@ exit:
 */
 static int bcm5974_start_traffic(struct bcm5974 *dev)
 {
-        if (bcm5974_wellspring_mode(dev)) {
+        if (bcm5974_wellspring_mode(dev, true)) {
                dprintk(1, "bcm5974: mode switch failed\n");
                goto error;
        }
@@ -504,6 +508,7 @@ static void bcm5974_pause_traffic(struct bcm5974 *dev)
 {
        usb_kill_urb(dev->tp_urb);
        usb_kill_urb(dev->bt_urb);
+        bcm5974_wellspring_mode(dev, false);
 }
 /*
diff --git a/drivers/input/touchscreen/jornada720_ts.c b/drivers/input/touchscreen/jornada720_ts.c
index bf44f9d68342..c8b7e8a45c4d 100644
--- a/drivers/input/touchscreen/jornada720_ts.c
+++ b/drivers/input/touchscreen/jornada720_ts.c
@@ -119,8 +119,8 @@ static int __devinit jornada720_ts_probe(struct platform_device *pdev)
        input_dev->id.bustype = BUS_HOST;
        input_dev->dev.parent = &pdev->dev;
-        input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
+        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
-        input_dev->keybit[LONG(BTN_TOUCH)] = BIT(BTN_TOUCH);
+        input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
        input_set_abs_params(input_dev, ABS_X, 270, 3900, 0, 0);
        input_set_abs_params(input_dev, ABS_Y, 180, 3700, 0, 0);
diff --git a/drivers/leds/leds-fsg.c b/drivers/leds/leds-fsg.c
index be0e12144b8b..34935155c1c0 100644
--- a/drivers/leds/leds-fsg.c
+++ b/drivers/leds/leds-fsg.c
@@ -161,6 +161,16 @@ static int fsg_led_probe(struct platform_device *pdev)
 {
        int ret;
+        /* Map the LED chip select address space */
+        latch_address = (unsigned short *) ioremap(IXP4XX_EXP_BUS_BASE(2), 512);
+        if (!latch_address) {
+                ret = -ENOMEM;
+                goto failremap;
+        }
+        latch_value = 0xffff;
+        *latch_address = latch_value;
        ret = led_classdev_register(&pdev->dev, &fsg_wlan_led);
        if (ret < 0)
                goto failwlan;
@@ -185,20 +195,8 @@ static int fsg_led_probe(struct platform_device *pdev)
        if (ret < 0)
                goto failring;
-        /* Map the LED chip select address space */
-        latch_address = (unsigned short *) ioremap(IXP4XX_EXP_BUS_BASE(2), 512);
-        if (!latch_address) {
-                ret = -ENOMEM;
-                goto failremap;
-        }
-        latch_value = 0xffff;
-        *latch_address = latch_value;
        return ret;
- failremap:
-        led_classdev_unregister(&fsg_ring_led);
 failring:
        led_classdev_unregister(&fsg_sync_led);
 failsync:
@@ -210,14 +208,14 @@ static int fsg_led_probe(struct platform_device *pdev)
 failwan:
        led_classdev_unregister(&fsg_wlan_led);
 failwlan:
+        iounmap(latch_address);
+ failremap:
        return ret;
 }
 static int fsg_led_remove(struct platform_device *pdev)
 {
-        iounmap(latch_address);
        led_classdev_unregister(&fsg_wlan_led);
        led_classdev_unregister(&fsg_wan_led);
        led_classdev_unregister(&fsg_sata_led);
@@ -225,6 +223,8 @@ static int fsg_led_remove(struct platform_device *pdev)
        led_classdev_unregister(&fsg_sync_led);
        led_classdev_unregister(&fsg_ring_led);
+        iounmap(latch_address);
        return 0;
 }
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 146c06972863..f508729123b5 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -248,11 +248,10 @@ static int __devinit pca955x_probe(struct i2c_client *client,
                                        const struct i2c_device_id *id)
 {
        struct pca955x_led *pca955x;
-        int i;
-        int err = -ENODEV;
        struct pca955x_chipdef *chip;
        struct i2c_adapter *adapter;
        struct led_platform_data *pdata;
+        int i, err;
        chip = &pca955x_chipdefs[id->driver_data];
        adapter = to_i2c_adapter(client->dev.parent);
@@ -282,43 +281,41 @@ static int __devinit pca955x_probe(struct i2c_client *client,
                }
        }
+        pca955x = kzalloc(sizeof(*pca955x) * chip->bits, GFP_KERNEL);
+        if (!pca955x)
+                return -ENOMEM;
+        i2c_set_clientdata(client, pca955x);
        for (i = 0; i < chip->bits; i++) {
-                pca955x = kzalloc(sizeof(struct pca955x_led), GFP_KERNEL);
+                pca955x[i].chipdef = chip;
-                if (!pca955x) {
+                pca955x[i].client = client;
-                        err = -ENOMEM;
+                pca955x[i].led_num = i;
-                        goto exit;
-                }
-                pca955x->chipdef = chip;
-                pca955x->client = client;
-                pca955x->led_num = i;
                /* Platform data can specify LED names and default triggers */
                if (pdata) {
                        if (pdata->leds[i].name)
-                                snprintf(pca955x->name, 32, "pca955x:%s",
+                                snprintf(pca955x[i].name,
-                                                        pdata->leds[i].name);
+                                         sizeof(pca955x[i].name), "pca955x:%s",
+                                         pdata->leds[i].name);
                        if (pdata->leds[i].default_trigger)
-                                pca955x->led_cdev.default_trigger =
+                                pca955x[i].led_cdev.default_trigger =
                                        pdata->leds[i].default_trigger;
                } else {
-                        snprintf(pca955x->name, 32, "pca955x:%d", i);
+                        snprintf(pca955x[i].name, sizeof(pca955x[i].name),
+                                 "pca955x:%d", i);
                }
-                spin_lock_init(&pca955x->lock);
-                pca955x->led_cdev.name = pca955x->name;
+                spin_lock_init(&pca955x[i].lock);
-                pca955x->led_cdev.brightness_set =
-                                pca955x_led_set;
-                /*
+                pca955x[i].led_cdev.name = pca955x[i].name;
-                 * Client data is a pointer to the _first_ pca955x_led
+                pca955x[i].led_cdev.brightness_set = pca955x_led_set;
-                 * struct
-                 */
-                if (i == 0)
-                        i2c_set_clientdata(client, pca955x);
-                INIT_WORK(&(pca955x->work), pca955x_led_work);
+                INIT_WORK(&pca955x[i].work, pca955x_led_work);
-                led_classdev_register(&client->dev, &(pca955x->led_cdev));
+                err = led_classdev_register(&client->dev, &pca955x[i].led_cdev);
+                if (err < 0)
+                        goto exit;
        }
        /* Turn off LEDs */
@@ -336,23 +333,32 @@ static int __devinit pca955x_probe(struct i2c_client *client,
        pca955x_write_psc(client, 1, 0);
        return 0;
 exit:
+        while (i--) {
+                led_classdev_unregister(&pca955x[i].led_cdev);
+                cancel_work_sync(&pca955x[i].work);
+        }
+        kfree(pca955x);
+        i2c_set_clientdata(client, NULL);
        return err;
 }
 static int __devexit pca955x_remove(struct i2c_client *client)
 {
        struct pca955x_led *pca955x = i2c_get_clientdata(client);
-        int leds = pca955x->chipdef->bits;
        int i;
-        for (i = 0; i < leds; i++) {
+        for (i = 0; i < pca955x->chipdef->bits; i++) {
-                led_classdev_unregister(&(pca955x->led_cdev));
+                led_classdev_unregister(&pca955x[i].led_cdev);
-                cancel_work_sync(&(pca955x->work));
+                cancel_work_sync(&pca955x[i].work);
-                kfree(pca955x);
-                pca955x = pca955x + 1;
        }
+        kfree(pca955x);
+        i2c_set_clientdata(client, NULL);
        return 0;
 }
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 71dd65aa31b6..c2fcf28b4c70 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -63,6 +63,7 @@ struct multipath {
        const char *hw_handler_name;
        struct work_struct activate_path;
+        struct pgpath *pgpath_to_activate;
        unsigned nr_priority_groups;
        struct list_head priority_groups;
        unsigned pg_init_required;      /* pg_init needs calling? */
@@ -146,6 +147,7 @@ static struct priority_group *alloc_priority_group(void)
 static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
 {
+        unsigned long flags;
        struct pgpath *pgpath, *tmp;
        struct multipath *m = ti->private;
@@ -154,6 +156,10 @@ static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
                if (m->hw_handler_name)
                        scsi_dh_detach(bdev_get_queue(pgpath->path.dev->bdev));
                dm_put_device(ti, pgpath->path.dev);
+                spin_lock_irqsave(&m->lock, flags);
+                if (m->pgpath_to_activate == pgpath)
+                        m->pgpath_to_activate = NULL;
+                spin_unlock_irqrestore(&m->lock, flags);
                free_pgpath(pgpath);
        }
 }
@@ -421,6 +427,7 @@ static void process_queued_ios(struct work_struct *work)
                __choose_pgpath(m);
        pgpath = m->current_pgpath;
+        m->pgpath_to_activate = m->current_pgpath;
        if ((pgpath && !m->queue_io) ||
            (!pgpath && !m->queue_if_no_path))
@@ -1093,8 +1100,15 @@ static void activate_path(struct work_struct *work)
        int ret;
        struct multipath *m =
                container_of(work, struct multipath, activate_path);
-        struct dm_path *path = &m->current_pgpath->path;
+        struct dm_path *path;
+        unsigned long flags;
+        spin_lock_irqsave(&m->lock, flags);
+        path = &m->pgpath_to_activate->path;
+        m->pgpath_to_activate = NULL;
+        spin_unlock_irqrestore(&m->lock, flags);
+        if (!path)
+                return;
        ret = scsi_dh_activate(bdev_get_queue(path->dev->bdev));
        pg_init_done(path, ret);
 }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index bca448e11878..ace998ce59f6 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -837,12 +837,14 @@ static int dm_merge_bvec(struct request_queue *q,
        struct dm_table *map = dm_get_table(md);
        struct dm_target *ti;
        sector_t max_sectors;
-        int max_size;
+        int max_size = 0;
        if (unlikely(!map))
-                return 0;
+                goto out;
        ti = dm_table_find_target(map, bvm->bi_sector);
+        if (!dm_target_is_valid(ti))
+                goto out_table;
        /*
         * Find maximum amount of I/O that won't need splitting
@@ -861,14 +863,16 @@ static int dm_merge_bvec(struct request_queue *q,
        if (max_size && ti->type->merge)
                max_size = ti->type->merge(ti, bvm, biovec, max_size);
+out_table:
+        dm_table_put(map);
+out:
        /*
         * Always allow an entire first page
         */
        if (max_size <= biovec->bv_len && !(bvm->bi_size >> SECTOR_SHIFT))
                max_size = biovec->bv_len;
-        dm_table_put(map);
        return max_size;
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4790c83d78d0..deeac4b44173 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5761,7 +5761,11 @@ void md_do_sync(mddev_t *mddev)
                                         * time 'round when curr_resync == 2
                                         */
                                        continue;
-                                prepare_to_wait(&resync_wait, &wq, TASK_UNINTERRUPTIBLE);
+                                /* We need to wait 'interruptible' so as not to
+                                 * contribute to the load average, and not to
+                                 * be caught by 'softlockup'
+                                 */
+                                prepare_to_wait(&resync_wait, &wq, TASK_INTERRUPTIBLE);
                                if (!kthread_should_stop() &&
                                    mddev2->curr_resync >= mddev->curr_resync) {
                                        printk(KERN_INFO "md: delaying %s of %s"
@@ -5769,6 +5773,8 @@ void md_do_sync(mddev_t *mddev)
                                               " share one or more physical units)\n",
                                               desc, mdname(mddev), mdname(mddev2));
                                        mddev_put(mddev2);
+                                        if (signal_pending(current))
+                                                flush_signals(current);
                                        schedule();
                                        finish_wait(&resync_wait, &wq);
                                        goto try_again;
diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 216025cf5d4b..2c5b6282b569 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -10,6 +10,7 @@
 #include "dvb_frontend.h"
 #define XC2028_DEFAULT_FIRMWARE "xc3028-v27.fw"
+#define XC3028L_DEFAULT_FIRMWARE "xc3028L-v36.fw"
 /*      Dmoduler                IF (kHz) */
 #define XC3028_FE_DEFAULT       0               /* Don't load SCODE */
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
index 4eed783f4bce..a127a4175c40 100644
--- a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -491,6 +491,7 @@ static struct s5h1420_config skystar2_rev2_7_s5h1420_config = {
        .demod_address = 0x53,
        .invert = 1,
        .repeated_start_workaround = 1,
+        .serial_mpeg = 1,
 };
 static struct itd1000_config skystar2_rev2_7_itd1000_config = {
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 069d847ba887..0c733c66a441 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -364,15 +364,16 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
                                       enum dmx_success success)
 {
        struct dmxdev_filter *dmxdevfilter = filter->priv;
+        unsigned long flags;
        int ret;
        if (dmxdevfilter->buffer.error) {
                wake_up(&dmxdevfilter->buffer.queue);
                return 0;
        }
-        spin_lock(&dmxdevfilter->dev->lock);
+        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
        if (dmxdevfilter->state != DMXDEV_STATE_GO) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                return 0;
        }
        del_timer(&dmxdevfilter->timer);
@@ -391,7 +392,7 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
        }
        if (dmxdevfilter->params.sec.flags & DMX_ONESHOT)
                dmxdevfilter->state = DMXDEV_STATE_DONE;
-        spin_unlock(&dmxdevfilter->dev->lock);
+        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
        wake_up(&dmxdevfilter->buffer.queue);
        return 0;
 }
@@ -403,11 +404,12 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
 {
        struct dmxdev_filter *dmxdevfilter = feed->priv;
        struct dvb_ringbuffer *buffer;
+        unsigned long flags;
        int ret;
-        spin_lock(&dmxdevfilter->dev->lock);
+        spin_lock_irqsave(&dmxdevfilter->dev->lock, flags);
        if (dmxdevfilter->params.pes.output == DMX_OUT_DECODER) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                return 0;
        }
@@ -417,7 +419,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
        else
                buffer = &dmxdevfilter->dev->dvr_buffer;
        if (buffer->error) {
-                spin_unlock(&dmxdevfilter->dev->lock);
+                spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
                wake_up(&buffer->queue);
                return 0;
        }
@@ -428,7 +430,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
                dvb_ringbuffer_flush(buffer);
                buffer->error = ret;
        }
-        spin_unlock(&dmxdevfilter->dev->lock);
+        spin_unlock_irqrestore(&dmxdevfilter->dev->lock, flags);
        wake_up(&buffer->queue);
        return 0;
 }
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index e2eca0b1fe7c..a2c1fd5d2f67 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -399,7 +399,9 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
 void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                              size_t count)
 {
-        spin_lock(&demux->lock);
+        unsigned long flags;
+        spin_lock_irqsave(&demux->lock, flags);
        while (count--) {
                if (buf[0] == 0x47)
@@ -407,16 +409,17 @@ void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
                buf += 188;
        }
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter_packets);
 void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
+        unsigned long flags;
        int p = 0, i, j;
-        spin_lock(&demux->lock);
+        spin_lock_irqsave(&demux->lock, flags);
        if (demux->tsbufp) {
                i = demux->tsbufp;
@@ -449,17 +452,18 @@ void dvb_dmx_swfilter(struct dvb_demux *demux, const u8 *buf, size_t count)
        }
 bailout:
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter);
 void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
 {
+        unsigned long flags;
        int p = 0, i, j;
        u8 tmppack[188];
-        spin_lock(&demux->lock);
+        spin_lock_irqsave(&demux->lock, flags);
        if (demux->tsbufp) {
                i = demux->tsbufp;
@@ -500,7 +504,7 @@ void dvb_dmx_swfilter_204(struct dvb_demux *demux, const u8 *buf, size_t count)
        }
 bailout:
-        spin_unlock(&demux->lock);
+        spin_unlock_irqrestore(&demux->lock, flags);
 }
 EXPORT_SYMBOL(dvb_dmx_swfilter_204);
diff --git a/drivers/media/dvb/frontends/s5h1420.c b/drivers/media/dvb/frontends/s5h1420.c
index 747d3fa2e5e5..2e9fd2893ede 100644
--- a/drivers/media/dvb/frontends/s5h1420.c
+++ b/drivers/media/dvb/frontends/s5h1420.c
@@ -59,7 +59,7 @@ struct s5h1420_state {
         * it does not support repeated-start, workaround: write addr-1
         * and then read
         */
-        u8 shadow[255];
+        u8 shadow[256];
 };
 static u32 s5h1420_getsymbolrate(struct s5h1420_state* state);
@@ -94,8 +94,11 @@ static u8 s5h1420_readreg(struct s5h1420_state *state, u8 reg)
                if (ret != 3)
                        return ret;
        } else {
-                ret = i2c_transfer(state->i2c, &msg[1], 2);
+                ret = i2c_transfer(state->i2c, &msg[1], 1);
-                if (ret != 2)
+                if (ret != 1)
+                        return ret;
+                ret = i2c_transfer(state->i2c, &msg[2], 1);
+                if (ret != 1)
                        return ret;
        }
@@ -823,7 +826,7 @@ static int s5h1420_init (struct dvb_frontend* fe)
        struct s5h1420_state* state = fe->demodulator_priv;
        /* disable power down and do reset */
-        state->CON_1_val = 0x10;
+        state->CON_1_val = state->config->serial_mpeg << 4;
        s5h1420_writereg(state, 0x02, state->CON_1_val);
        msleep(10);
        s5h1420_reset(state);
diff --git a/drivers/media/dvb/frontends/s5h1420.h b/drivers/media/dvb/frontends/s5h1420.h
index 4c913f142bc4..ff308136d865 100644
--- a/drivers/media/dvb/frontends/s5h1420.h
+++ b/drivers/media/dvb/frontends/s5h1420.h
@@ -32,10 +32,12 @@ struct s5h1420_config
        u8 demod_address;
        /* does the inversion require inversion? */
-        u8 invert : 1;
+        u8 invert:1;
-        u8 repeated_start_workaround : 1;
+        u8 repeated_start_workaround:1;
-        u8 cdclk_polarity : 1; /* 1 == falling edge, 0 == raising edge */
+        u8 cdclk_polarity:1; /* 1 == falling edge, 0 == raising edge */
+        u8 serial_mpeg:1;
 };
 #if defined(CONFIG_DVB_S5H1420) || (defined(CONFIG_DVB_S5H1420_MODULE) && defined(MODULE))
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index cc5efb643f33..9da260fe3fd1 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -40,6 +40,8 @@ struct usb_device_id smsusb_id_table[] = {
                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_OKEMO_B },
        { USB_DEVICE(0x2040, 0x5500),
                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+        { USB_DEVICE(0x2040, 0x5510),
+                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
        { USB_DEVICE(0x2040, 0x5580),
                .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
        { USB_DEVICE(0x2040, 0x5590),
@@ -87,7 +89,7 @@ static struct sms_board sms_boards[] = {
                .fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-nova-b-dvbt-01.fw",
        },
        [SMS1XXX_BOARD_HAUPPAUGE_WINDHAM] = {
-                .name   = "Hauppauge WinTV-Nova-T-MiniStick",
+                .name   = "Hauppauge WinTV MiniStick",
                .type   = SMS_NOVA_B0,
                .fw[DEVICE_MODE_DVBT_BDA] = "sms1xxx-hcw-55xxx-dvbt-01.fw",
        },
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index ecbfa1b39b70..3e9e0dcd217e 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -968,7 +968,7 @@ config VIDEO_PXA27x
 config VIDEO_SH_MOBILE_CEU
        tristate "SuperH Mobile CEU Interface driver"
-        depends on VIDEO_DEV
+        depends on VIDEO_DEV && HAS_DMA
        select SOC_CAMERA
        select VIDEOBUF_DMA_CONTIG
        ---help---
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 6ae4cc860efe..933eaef41ead 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3431,7 +3431,7 @@ static int radio_open(struct inode *inode, struct file *file)
        dprintk("bttv: open minor=%d\n",minor);
        for (i = 0; i < bttv_num; i++) {
-                if (bttvs[i].radio_dev->minor == minor) {
+                if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) {
                        btv = &bttvs[i];
                        break;
                }
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index c149b7d712e5..5405c30dbb04 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/mm.h>
 #include <linux/pci.h>
 #include <linux/i2c.h>
 #include <linux/interrupt.h>
diff --git a/drivers/media/video/cpia2/cpia2_usb.c b/drivers/media/video/cpia2/cpia2_usb.c
index a4574740350d..a8a199047cbd 100644
--- a/drivers/media/video/cpia2/cpia2_usb.c
+++ b/drivers/media/video/cpia2/cpia2_usb.c
@@ -632,7 +632,7 @@ int cpia2_usb_transfer_cmd(struct camera_data *cam,
 static int submit_urbs(struct camera_data *cam)
 {
        struct urb *urb;
-        int fx, err, i;
+        int fx, err, i, j;
        for(i=0; i<NUM_SBUF; ++i) {
                if (cam->sbuf[i].data)
@@ -657,6 +657,9 @@ static int submit_urbs(struct camera_data *cam)
                }
                urb = usb_alloc_urb(FRAMES_PER_DESC, GFP_KERNEL);
                if (!urb) {
+                        ERR("%s: usb_alloc_urb error!\n", __func__);
+                        for (j = 0; j < i; j++)
+                                usb_free_urb(cam->sbuf[j].urb);
                        return -ENOMEM;
                }
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index 8fe5f38c4d7c..3cb9734ec07b 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -163,7 +163,7 @@ static const struct cx18_card cx18_card_h900 = {
        },
        .audio_inputs = {
                { CX18_CARD_INPUT_AUD_TUNER,
-                  CX18_AV_AUDIO8, 0 },
+                  CX18_AV_AUDIO5, 0 },
                { CX18_CARD_INPUT_LINE_IN1,
                  CX18_AV_AUDIO_SERIAL1, 0 },
        },
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 3c006103c1eb..ac3292d7646c 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -117,10 +117,10 @@ static void em28xx_audio_isocirq(struct urb *urb)
                        if (oldptr + length >= runtime->buffer_size) {
                                unsigned int cnt =
-                                    runtime->buffer_size - oldptr - 1;
+                                    runtime->buffer_size - oldptr;
                                memcpy(runtime->dma_area + oldptr * stride, cp,
                                       cnt * stride);
-                                memcpy(runtime->dma_area, cp + cnt,
+                                memcpy(runtime->dma_area, cp + cnt * stride,
                                       length * stride - cnt * stride);
                        } else {
                                memcpy(runtime->dma_area + oldptr * stride, cp,
@@ -161,8 +161,14 @@ static int em28xx_init_audio_isoc(struct em28xx *dev)
                memset(dev->adev->transfer_buffer[i], 0x80, sb_size);
                urb = usb_alloc_urb(EM28XX_NUM_AUDIO_PACKETS, GFP_ATOMIC);
-                if (!urb)
+                if (!urb) {
+                        em28xx_errdev("usb_alloc_urb failed!\n");
+                        for (j = 0; j < i; j++) {
+                                usb_free_urb(dev->adev->urb[j]);
+                                kfree(dev->adev->transfer_buffer[j]);
+                        }
                        return -ENOMEM;
+                }
                urb->dev = dev->udev;
                urb->context = dev;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 452da70e719f..de943cf6c169 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -93,28 +93,6 @@ struct em28xx_board em28xx_boards[] = {
                        .amux     = 0,
                } },
        },
-        [EM2800_BOARD_KWORLD_USB2800] = {
-                .name         = "Kworld USB2800",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
-                .is_em2800    = 1,
-                .vchannels    = 3,
-                .tuner_type   = TUNER_PHILIPS_FCV1236D,
-                .tda9887_conf = TDA9887_PRESENT,
-                .decoder      = EM28XX_SAA7113,
-                .input          = { {
-                        .type     = EM28XX_VMUX_TELEVISION,
-                        .vmux     = SAA7115_COMPOSITE2,
-                        .amux     = 0,
-                }, {
-                        .type     = EM28XX_VMUX_COMPOSITE1,
-                        .vmux     = SAA7115_COMPOSITE0,
-                        .amux     = 1,
-                }, {
-                        .type     = EM28XX_VMUX_SVIDEO,
-                        .vmux     = SAA7115_SVIDEO3,
-                        .amux     = 1,
-                } },
-        },
        [EM2820_BOARD_KWORLD_PVRTV2800RF] = {
                .name         = "Kworld PVR TV 2800 RF",
                .is_em2800    = 0,
@@ -599,7 +577,7 @@ struct em28xx_board em28xx_boards[] = {
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
-                        .amux     = 1,
+                        .amux     = 3,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
@@ -952,22 +930,23 @@ struct em28xx_board em28xx_boards[] = {
        },
        [EM2880_BOARD_KWORLD_DVB_310U] = {
                .name         = "KWorld DVB-T 310U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                .vchannels    = 3,
                .tuner_type   = TUNER_XC2028,
+                .has_dvb      = 1,
+                .mts_firmware = 1,
                .decoder      = EM28XX_TVP5150,
                .input          = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
-                        .amux     = 0,
+                        .amux     = EM28XX_AMUX_VIDEO,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
-                        .amux     = 1,
+                        .amux     = EM28XX_AMUX_AC97_LINE_IN,
-                }, {
+                }, {    /* S-video has not been tested yet */
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
-                        .amux     = 1,
+                        .amux     = EM28XX_AMUX_AC97_LINE_IN,
                } },
        },
        [EM2881_BOARD_DNT_DA2_HYBRID] = {
@@ -1282,6 +1261,7 @@ static struct em28xx_reg_seq em2882_terratec_hybrid_xs_digital[] = {
 static struct em28xx_hash_table em28xx_eeprom_hash [] = {
        /* P/N: SA 60002070465 Tuner: TVF7533-MF */
        {0x6ce05a8f, EM2820_BOARD_PROLINK_PLAYTV_USB2, TUNER_YMEC_TVF_5533MF},
+        {0x966a0441, EM2880_BOARD_KWORLD_DVB_310U, TUNER_XC2028},
 };
 /* I2C devicelist hash table for devices with generic USB IDs */
@@ -1552,9 +1532,12 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                /* djh - Not sure which demod we need here */
                ctl->demod = XC3028_FE_DEFAULT;
                break;
+        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
+                ctl->demod = XC3028_FE_DEFAULT;
+                ctl->fname = XC3028L_DEFAULT_FIRMWARE;
+                break;
        case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_950:
        case EM2880_BOARD_PINNACLE_PCTV_HD_PRO:
-        case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
                /* FIXME: Better to specify the needed IF */
                ctl->demod = XC3028_FE_DEFAULT;
                break;
@@ -1764,6 +1747,20 @@ void em28xx_card_setup(struct em28xx *dev)
                break;
        case EM2820_BOARD_UNKNOWN:
        case EM2800_BOARD_UNKNOWN:
+                /*
+                 * The K-WORLD DVB-T 310U is detected as an MSI Digivox AD.
+                 *
+                 * This occurs because they share identical USB vendor and
+                 * product IDs.
+                 *
+                 * What we do here is look up the EEPROM hash of the K-WORLD
+                 * and if it is found then we decide that we do not have
+                 * a DIGIVOX and reset the device to the K-WORLD instead.
+                 *
+                 * This solution is only valid if they do not share eeprom
+                 * hash identities which has not been determined as yet.
+                 */
+        case EM2880_BOARD_MSI_DIGIVOX_AD:
                if (!em28xx_hint_board(dev))
                        em28xx_set_model(dev);
                break;
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index 4b992bc0083c..d2b1a1a52689 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -452,6 +452,15 @@ static int dvb_init(struct em28xx *dev)
                        goto out_free;
                }
                break;
+        case EM2880_BOARD_KWORLD_DVB_310U:
+                dvb->frontend = dvb_attach(zl10353_attach,
+                                                &em28xx_zl10353_with_xc3028,
+                                                &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
        default:
                printk(KERN_ERR "%s/2: The frontend of your DVB/ATSC card"
                                " isn't supported yet\n",
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 7be69284da03..ac95c55887df 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -459,6 +459,7 @@ static int create_urbs(struct gspca_dev *gspca_dev,
                urb = usb_alloc_urb(npkt, GFP_KERNEL);
                if (!urb) {
                        err("usb_alloc_urb failed");
+                        destroy_urbs(gspca_dev);
                        return -ENOMEM;
                }
                urb->transfer_buffer = usb_buffer_alloc(gspca_dev->dev,
@@ -468,8 +469,8 @@ static int create_urbs(struct gspca_dev *gspca_dev,
                if (urb->transfer_buffer == NULL) {
                        usb_free_urb(urb);
-                        destroy_urbs(gspca_dev);
                        err("usb_buffer_urb failed");
+                        destroy_urbs(gspca_dev);
                        return -ENOMEM;
                }
                gspca_dev->urb[n] = urb;
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index d4be51843286..ba865b7f1ed8 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -1063,6 +1063,7 @@ static __devinitdata struct usb_device_id device_table[] = {
        {USB_DEVICE(0x093a, 0x2621), .driver_info = SENSOR_PAC7302},
        {USB_DEVICE(0x093a, 0x2624), .driver_info = SENSOR_PAC7302},
        {USB_DEVICE(0x093a, 0x2626), .driver_info = SENSOR_PAC7302},
+        {USB_DEVICE(0x093a, 0x262a), .driver_info = SENSOR_PAC7302},
        {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index 5dd78c6766ea..12b81ae526b7 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -232,7 +232,7 @@ static struct ctrl sd_ctrls[] = {
 static struct v4l2_pix_format vga_mode[] = {
        {160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
                .bytesperline = 160,
-                .sizeimage = 160 * 120 * 5 / 4,
+                .sizeimage = 160 * 120,
                .colorspace = V4L2_COLORSPACE_SRGB,
                .priv = 2 | MODE_RAW},
        {160, 120, V4L2_PIX_FMT_SN9C10X, V4L2_FIELD_NONE,
@@ -264,7 +264,7 @@ static struct v4l2_pix_format sif_mode[] = {
                .priv = 1 | MODE_REDUCED_SIF},
        {176, 144, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
                .bytesperline = 176,
-                .sizeimage = 176 * 144 * 5 / 4,
+                .sizeimage = 176 * 144,
                .colorspace = V4L2_COLORSPACE_SRGB,
                .priv = 1 | MODE_RAW},
        {176, 144, V4L2_PIX_FMT_SN9C10X, V4L2_FIELD_NONE,
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index d75b1d20b318..572b0f363b64 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -707,6 +707,7 @@ static void i2c_w8(struct gspca_dev *gspca_dev,
                        0x08, 0,                /* value, index */
                        gspca_dev->usb_buf, 8,
                        500);
+        msleep(2);
 }
 /* read 5 bytes in gspca_dev->usb_buf */
@@ -976,13 +977,13 @@ static int sd_init(struct gspca_dev *gspca_dev)
        case BRIDGE_SN9C105:
                if (regF1 != 0x11)
                        return -ENODEV;
-                reg_w(gspca_dev, 0x02, regGpio, 2);
+                reg_w(gspca_dev, 0x01, regGpio, 2);
                break;
        case BRIDGE_SN9C120:
                if (regF1 != 0x12)
                        return -ENODEV;
                regGpio[1] = 0x70;
-                reg_w(gspca_dev, 0x02, regGpio, 2);
+                reg_w(gspca_dev, 0x01, regGpio, 2);
                break;
        default:
 /*      case BRIDGE_SN9C110: */
@@ -1183,7 +1184,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
        static const __u8 CA[] = { 0x28, 0xd8, 0x14, 0xec };
        static const __u8 CE[] = { 0x32, 0xdd, 0x2d, 0xdd };    /* MI0360 */
        static const __u8 CE_ov76xx[] =
-                        { 0x32, 0xdd, 0x32, 0xdd };     /* OV7630/48 */
+                                { 0x32, 0xdd, 0x32, 0xdd };
        sn9c1xx = sn_tb[(int) sd->sensor];
        configure_gpio(gspca_dev, sn9c1xx);
@@ -1223,8 +1224,15 @@ static void sd_start(struct gspca_dev *gspca_dev)
        reg_w(gspca_dev, 0x20, gamma_def, sizeof gamma_def);
        for (i = 0; i < 8; i++)
                reg_w(gspca_dev, 0x84, reg84, sizeof reg84);
+        switch (sd->sensor) {
+        case SENSOR_OV7660:
+                reg_w1(gspca_dev, 0x9a, 0x05);
+                break;
+        default:
                reg_w1(gspca_dev, 0x9a, 0x08);
                reg_w1(gspca_dev, 0x99, 0x59);
+                break;
+        }
        mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
        if (mode)
@@ -1275,8 +1283,8 @@ static void sd_start(struct gspca_dev *gspca_dev)
 /*                      reg1 = 0x44; */
 /*                      reg1 = 0x46;    (done) */
                } else {
-                        reg17 = 0x22;   /* 640 MCKSIZE */
+                        reg17 = 0xa2;   /* 640 */
-                        reg1 = 0x06;
+                        reg1 = 0x44;
                }
                break;
        }
@@ -1285,6 +1293,7 @@ static void sd_start(struct gspca_dev *gspca_dev)
        switch (sd->sensor) {
        case SENSOR_OV7630:
        case SENSOR_OV7648:
+        case SENSOR_OV7660:
                reg_w(gspca_dev, 0xce, CE_ov76xx, 4);
                break;
        default:
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index cfbc9ebc5c5d..95fcfcb9e31b 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -225,7 +225,7 @@ static int i2c_read(struct gspca_dev *gspca_dev, __u16 reg, __u8 mode)
        reg_w_val(gspca_dev->dev, 0x8802, (mode | 0x01));
        do {
                reg_r(gspca_dev, 0x8803, 1);
-                if (!gspca_dev->usb_buf)
+                if (!gspca_dev->usb_buf[0])
                        break;
        } while (--retry);
        if (retry == 0)
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 8d7c27e6ac77..d61ef727e0c2 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -6576,8 +6576,8 @@ static int setlightfreq(struct gspca_dev *gspca_dev)
                 cs2102_60HZ, cs2102_60HZScale},
 /* SENSOR_CS2102K 1 */
                {cs2102_NoFliker, cs2102_NoFlikerScale,
-                 cs2102_50HZ, cs2102_50HZScale,
+                 NULL, NULL, /* currently disabled */
-                 cs2102_60HZ, cs2102_60HZScale},
+                 NULL, NULL},
 /* SENSOR_GC0305 2 */
                {gc0305_NoFliker, gc0305_NoFliker,
                 gc0305_50HZ, gc0305_50HZ,
diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
index 3d3c48db45d9..c6852402c5e9 100644
--- a/drivers/media/video/ov511.c
+++ b/drivers/media/video/ov511.c
@@ -3591,7 +3591,7 @@ static int
 ov51x_init_isoc(struct usb_ov511 *ov)
 {
        struct urb *urb;
-        int fx, err, n, size;
+        int fx, err, n, i, size;
        PDEBUG(3, "*** Initializing capture ***");
@@ -3662,6 +3662,8 @@ ov51x_init_isoc(struct usb_ov511 *ov)
                urb = usb_alloc_urb(FRAMES_PER_DESC, GFP_KERNEL);
                if (!urb) {
                        err("init isoc: usb_alloc_urb ret. NULL");
+                        for (i = 0; i < n; i++)
+                                usb_free_urb(ov->sbuf[i].urb);
                        return -ENOMEM;
                }
                ov->sbuf[n].urb = urb;
@@ -5651,7 +5653,7 @@ static ssize_t show_exposure(struct device *cd,
        if (!ov->dev)
                return -ENODEV;
        sensor_get_exposure(ov, &exp);
-        return sprintf(buf, "%d\n", exp >> 8);
+        return sprintf(buf, "%d\n", exp);
 }
 static DEVICE_ATTR(exposure, S_IRUGO, show_exposure, NULL);
diff --git a/drivers/media/video/pvrusb2/pvrusb2-devattr.c b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
index 88e175168438..cbe2a3417851 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-devattr.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
@@ -489,6 +489,8 @@ static const struct pvr2_device_desc pvr2_device_751xx = {
 struct usb_device_id pvr2_device_table[] = {
        { USB_DEVICE(0x2040, 0x2900),
          .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
+        { USB_DEVICE(0x2040, 0x2950), /* Logically identical to 2900 */
+          .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
        { USB_DEVICE(0x2040, 0x2400),
          .driver_info = (kernel_ulong_t)&pvr2_device_24xxx},
        { USB_DEVICE(0x1164, 0x0622),
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index b1d09d8e2b85..92b83feae366 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -669,7 +669,7 @@ static void s2255_fillbuff(struct s2255_dev *dev, struct s2255_buffer *buf,
                (unsigned long)vbuf, pos);
        /* tell v4l buffer was filled */
-        buf->vb.field_count++;
+        buf->vb.field_count = dev->frame_count[chn] * 2;
        do_gettimeofday(&ts);
        buf->vb.ts = ts;
        buf->vb.state = VIDEOBUF_DONE;
@@ -1268,6 +1268,7 @@ static int vidioc_streamon(struct file *file, void *priv, enum v4l2_buf_type i)
        dev->last_frame[chn] = -1;
        dev->bad_payload[chn] = 0;
        dev->cur_frame[chn] = 0;
+        dev->frame_count[chn] = 0;
        for (j = 0; j < SYS_FRAMES; j++) {
                dev->buffer[chn].frame[j].ulState = 0;
                dev->buffer[chn].frame[j].cur_size = 0;
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 6ef3e5297de8..feab12aa2c7b 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -592,7 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video_device *video,
        if (ctrl == NULL)
                return -EINVAL;
-        data = kmalloc(8, GFP_KERNEL);
+        data = kmalloc(ctrl->info->size, GFP_KERNEL);
        if (data == NULL)
                return -ENOMEM;
diff --git a/drivers/media/video/w9968cf.c b/drivers/media/video/w9968cf.c
index 168baabe4659..11edf79f57be 100644
--- a/drivers/media/video/w9968cf.c
+++ b/drivers/media/video/w9968cf.c
@@ -911,7 +911,6 @@ static int w9968cf_start_transfer(struct w9968cf_device* cam)
        for (i = 0; i < W9968CF_URBS; i++) {
                urb = usb_alloc_urb(W9968CF_ISO_PACKETS, GFP_KERNEL);
-                cam->urb[i] = urb;
                if (!urb) {
                        for (j = 0; j < i; j++)
                                usb_free_urb(cam->urb[j]);
@@ -919,6 +918,7 @@ static int w9968cf_start_transfer(struct w9968cf_device* cam)
                        return -ENOMEM;
                }
+                cam->urb[i] = urb;
                urb->dev = udev;
                urb->context = (void*)cam;
                urb->pipe = usb_rcvisocpipe(udev, 1);
diff --git a/drivers/media/video/wm8739.c b/drivers/media/video/wm8739.c
index 95c79ad80487..54ac3fe26ec2 100644
--- a/drivers/media/video/wm8739.c
+++ b/drivers/media/video/wm8739.c
@@ -274,10 +274,8 @@ static int wm8739_probe(struct i2c_client *client,
                        client->addr << 1, client->adapter->name);
        state = kmalloc(sizeof(struct wm8739_state), GFP_KERNEL);
-        if (state == NULL) {
+        if (state == NULL)
-                kfree(client);
                return -ENOMEM;
-        }
        state->vol_l = 0x17; /* 0dB */
        state->vol_r = 0x17; /* 0dB */
        state->muted = 0;
diff --git a/drivers/media/video/zoran_card.c b/drivers/media/video/zoran_card.c
index d842a7cb99d2..3282be730298 100644
--- a/drivers/media/video/zoran_card.c
+++ b/drivers/media/video/zoran_card.c
@@ -988,7 +988,7 @@ zoran_open_init_params (struct zoran *zr)
        zr->v4l_grab_seq = 0;
        zr->v4l_settings.width = 192;
        zr->v4l_settings.height = 144;
-        zr->v4l_settings.format = &zoran_formats[4];    /* YUY2 - YUV-4:2:2 packed */
+        zr->v4l_settings.format = &zoran_formats[7];    /* YUY2 - YUV-4:2:2 packed */
        zr->v4l_settings.bytesperline =
            zr->v4l_settings.width *
            ((zr->v4l_settings.format->depth + 7) / 8);
diff --git a/drivers/media/video/zoran_driver.c b/drivers/media/video/zoran_driver.c
index ec6f59674b10..2dab9eea4def 100644
--- a/drivers/media/video/zoran_driver.c
+++ b/drivers/media/video/zoran_driver.c
@@ -134,7 +134,7 @@ const struct zoran_format zoran_formats[] = {
        }, {
                .name = "16-bit RGB BE",
                ZFMT(-1,
-                     V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB),
+                     V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB),
                .depth = 16,
                .flags = ZORAN_FORMAT_CAPTURE |
                         ZORAN_FORMAT_OVERLAY,
@@ -2737,7 +2737,8 @@ zoran_do_ioctl (struct inode *inode,
                                    fh->v4l_settings.format->fourcc;
                                fmt->fmt.pix.colorspace =
                                    fh->v4l_settings.format->colorspace;
-                                fmt->fmt.pix.bytesperline = 0;
+                                fmt->fmt.pix.bytesperline =
+                                    fh->v4l_settings.bytesperline;
                                if (BUZ_MAX_HEIGHT <
                                    (fh->v4l_settings.height * 2))
                                        fmt->fmt.pix.field =
@@ -2833,13 +2834,6 @@ zoran_do_ioctl (struct inode *inode,
                                fmt->fmt.pix.pixelformat,
                                (char *) &printformat);
-                        if (fmt->fmt.pix.bytesperline > 0) {
-                                dprintk(5,
-                                        KERN_ERR "%s: bpl not supported\n",
-                                        ZR_DEVNAME(zr));
-                                return -EINVAL;
-                        }
                        /* we can be requested to do JPEG/raw playback/capture */
                        if (!
                            (fmt->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ||
@@ -2923,6 +2917,7 @@ zoran_do_ioctl (struct inode *inode,
                                fh->jpg_buffers.buffer_size =
                                    zoran_v4l2_calc_bufsize(&fh->
                                                            jpg_settings);
+                                fmt->fmt.pix.bytesperline = 0;
                                fmt->fmt.pix.sizeimage =
                                    fh->jpg_buffers.buffer_size;
@@ -2979,6 +2974,8 @@ zoran_do_ioctl (struct inode *inode,
                                /* tell the user the
                                 * results/missing stuff */
+                                fmt->fmt.pix.bytesperline =
+                                        fh->v4l_settings.bytesperline;
                                fmt->fmt.pix.sizeimage =
                                        fh->v4l_settings.height *
                                        fh->v4l_settings.bytesperline;
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index a38005008a20..cea46906408e 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -185,7 +185,7 @@ static void memstick_free(struct device *dev)
 }
 static struct class memstick_host_class = {
-        .name       = "memstick_host",
+        .name        = "memstick_host",
        .dev_release = memstick_free
 };
@@ -264,7 +264,7 @@ EXPORT_SYMBOL(memstick_new_req);
 * @sg - TPC argument
 */
 void memstick_init_req_sg(struct memstick_request *mrq, unsigned char tpc,
-                          struct scatterlist *sg)
+                          const struct scatterlist *sg)
 {
        mrq->tpc = tpc;
        if (tpc & 8)
@@ -294,7 +294,7 @@ EXPORT_SYMBOL(memstick_init_req_sg);
 * user supplied buffer.
 */
 void memstick_init_req(struct memstick_request *mrq, unsigned char tpc,
-                       void *buf, size_t length)
+                       const void *buf, size_t length)
 {
        mrq->tpc = tpc;
        if (tpc & 8)
@@ -439,7 +439,7 @@ static void memstick_check(struct work_struct *work)
        if (!host->card) {
                if (memstick_power_on(host))
                        goto out_power_off;
-        } else
+        } else if (host->card->stop)
                host->card->stop(host->card);
        card = memstick_alloc_card(host);
@@ -458,7 +458,7 @@ static void memstick_check(struct work_struct *work)
                            || !(host->card->check(host->card))) {
                                device_unregister(&host->card->dev);
                                host->card = NULL;
-                        } else
+                        } else if (host->card->start)
                                host->card->start(host->card);
                }
diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
index 44b1817f2f2f..d2d2318dafa4 100644
--- a/drivers/memstick/core/mspro_block.c
+++ b/drivers/memstick/core/mspro_block.c
@@ -30,6 +30,8 @@ module_param(major, int, 0644);
 #define MSPRO_BLOCK_SIGNATURE        0xa5c3
 #define MSPRO_BLOCK_MAX_ATTRIBUTES   41
+#define MSPRO_BLOCK_PART_SHIFT 3
 enum {
        MSPRO_BLOCK_ID_SYSINFO         = 0x10,
        MSPRO_BLOCK_ID_MODELNAME       = 0x15,
@@ -195,7 +197,7 @@ static int mspro_block_bd_open(struct inode *inode, struct file *filp)
 static int mspro_block_disk_release(struct gendisk *disk)
 {
        struct mspro_block_data *msb = disk->private_data;
-        int disk_id = disk->first_minor >> MEMSTICK_PART_SHIFT;
+        int disk_id = disk->first_minor >> MSPRO_BLOCK_PART_SHIFT;
        mutex_lock(&mspro_block_disk_lock);
@@ -877,6 +879,7 @@ static int mspro_block_switch_interface(struct memstick_dev *card)
        struct mspro_block_data *msb = memstick_get_drvdata(card);
        int rc = 0;
+try_again:
        if (msb->caps & MEMSTICK_CAP_PAR4)
                rc = mspro_block_set_interface(card, MEMSTICK_SYS_PAR4);
        else
@@ -930,6 +933,18 @@ static int mspro_block_switch_interface(struct memstick_dev *card)
                rc = memstick_set_rw_addr(card);
                if (!rc)
                        rc = mspro_block_set_interface(card, msb->system);
+                if (!rc) {
+                        msleep(150);
+                        rc = mspro_block_wait_for_ced(card);
+                        if (rc)
+                                return rc;
+                        if (msb->caps & MEMSTICK_CAP_PAR8) {
+                                msb->caps &= ~MEMSTICK_CAP_PAR8;
+                                goto try_again;
+                        }
+                }
        }
        return rc;
 }
@@ -1117,14 +1132,16 @@ static int mspro_block_init_card(struct memstick_dev *card)
                return -EIO;
        msb->caps = host->caps;
-        rc = mspro_block_switch_interface(card);
+        msleep(150);
+        rc = mspro_block_wait_for_ced(card);
        if (rc)
                return rc;
-        msleep(200);
+        rc = mspro_block_switch_interface(card);
-        rc = mspro_block_wait_for_ced(card);
        if (rc)
                return rc;
        dev_dbg(&card->dev, "card activated\n");
        if (msb->system != MEMSTICK_SYS_SERIAL)
                msb->caps |= MEMSTICK_CAP_AUTO_GET_INT;
@@ -1192,12 +1209,12 @@ static int mspro_block_init_disk(struct memstick_dev *card)
        if (rc)
                return rc;
-        if ((disk_id << MEMSTICK_PART_SHIFT) > 255) {
+        if ((disk_id << MSPRO_BLOCK_PART_SHIFT) > 255) {
                rc = -ENOSPC;
                goto out_release_id;
        }
-        msb->disk = alloc_disk(1 << MEMSTICK_PART_SHIFT);
+        msb->disk = alloc_disk(1 << MSPRO_BLOCK_PART_SHIFT);
        if (!msb->disk) {
                rc = -ENOMEM;
                goto out_release_id;
@@ -1220,7 +1237,7 @@ static int mspro_block_init_disk(struct memstick_dev *card)
                                   MSPRO_BLOCK_MAX_PAGES * msb->page_size);
        msb->disk->major = major;
-        msb->disk->first_minor = disk_id << MEMSTICK_PART_SHIFT;
+        msb->disk->first_minor = disk_id << MSPRO_BLOCK_PART_SHIFT;
        msb->disk->fops = &ms_block_bdops;
        msb->usage_count = 1;
        msb->disk->private_data = msb;
@@ -1416,7 +1433,7 @@ out_unlock:
 static struct memstick_device_id mspro_block_id_tbl[] = {
        {MEMSTICK_MATCH_ALL, MEMSTICK_TYPE_PRO, MEMSTICK_CATEGORY_STORAGE_DUO,
-         MEMSTICK_CLASS_GENERIC_DUO},
+         MEMSTICK_CLASS_DUO},
        {}
 };
diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
index 3485c63d20b0..2fb95a5b72eb 100644
--- a/drivers/memstick/host/jmb38x_ms.c
+++ b/drivers/memstick/host/jmb38x_ms.c
@@ -81,6 +81,8 @@ struct jmb38x_ms {
 #define TPC_CODE_SZ_MASK       0x00000700
 #define TPC_DATA_SZ_MASK       0x00000007
+#define HOST_CONTROL_TDELAY_EN 0x00040000
+#define HOST_CONTROL_HW_OC_P   0x00010000
 #define HOST_CONTROL_RESET_REQ 0x00008000
 #define HOST_CONTROL_REI       0x00004000
 #define HOST_CONTROL_LED       0x00000400
@@ -88,6 +90,7 @@ struct jmb38x_ms {
 #define HOST_CONTROL_RESET     0x00000100
 #define HOST_CONTROL_POWER_EN  0x00000080
 #define HOST_CONTROL_CLOCK_EN  0x00000040
+#define HOST_CONTROL_REO       0x00000008
 #define HOST_CONTROL_IF_SHIFT  4
 #define HOST_CONTROL_IF_SERIAL 0x0
@@ -133,11 +136,15 @@ struct jmb38x_ms {
 #define PAD_PU_PD_ON_MS_SOCK1 0x0f0f0000
 #define CLOCK_CONTROL_40MHZ   0x00000001
-#define CLOCK_CONTROL_50MHZ   0x00000002
+#define CLOCK_CONTROL_50MHZ   0x0000000a
 #define CLOCK_CONTROL_60MHZ   0x00000008
 #define CLOCK_CONTROL_62_5MHZ 0x0000000c
 #define CLOCK_CONTROL_OFF     0x00000000
+#define PCI_CTL_CLOCK_DLY_ADDR   0x000000b0
+#define PCI_CTL_CLOCK_DLY_MASK_A 0x00000f00
+#define PCI_CTL_CLOCK_DLY_MASK_B 0x0000f000
 enum {
        CMD_READY    = 0x01,
        FIFO_READY   = 0x02,
@@ -367,8 +374,7 @@ static int jmb38x_ms_issue_cmd(struct memstick_host *msh)
                return host->req->error;
        }
-        dev_dbg(&msh->dev, "control %08x\n",
+        dev_dbg(&msh->dev, "control %08x\n", readl(host->addr + HOST_CONTROL));
-                readl(host->addr + HOST_CONTROL));
        dev_dbg(&msh->dev, "status %08x\n", readl(host->addr + INT_STATUS));
        dev_dbg(&msh->dev, "hstatus %08x\n", readl(host->addr + STATUS));
@@ -637,7 +643,7 @@ static int jmb38x_ms_reset(struct jmb38x_ms_host *host)
                ndelay(20);
        }
        dev_dbg(&host->chip->pdev->dev, "reset_req timeout\n");
-        return -EIO;
+        /* return -EIO; */
 reset_next:
        writel(HOST_CONTROL_RESET | HOST_CONTROL_CLOCK_EN
@@ -680,7 +686,9 @@ static int jmb38x_ms_set_param(struct memstick_host *msh,
                        host_ctl = 7;
                        host_ctl |= HOST_CONTROL_POWER_EN
-                                 | HOST_CONTROL_CLOCK_EN;
+                                    | HOST_CONTROL_CLOCK_EN
+                                    | HOST_CONTROL_HW_OC_P
+                                    | HOST_CONTROL_TDELAY_EN;
                        writel(host_ctl, host->addr + HOST_CONTROL);
                        writel(host->id ? PAD_PU_PD_ON_MS_SOCK1
@@ -704,33 +712,40 @@ static int jmb38x_ms_set_param(struct memstick_host *msh,
                break;
        case MEMSTICK_INTERFACE:
                host_ctl &= ~(3 << HOST_CONTROL_IF_SHIFT);
+                pci_read_config_dword(host->chip->pdev,
+                                      PCI_CTL_CLOCK_DLY_ADDR,
+                                      &clock_delay);
+                clock_delay &= host->id ? ~PCI_CTL_CLOCK_DLY_MASK_B
+                                        : ~PCI_CTL_CLOCK_DLY_MASK_A;
                if (value == MEMSTICK_SERIAL) {
                        host_ctl &= ~HOST_CONTROL_FAST_CLK;
+                        host_ctl &= ~HOST_CONTROL_REO;
                        host_ctl |= HOST_CONTROL_IF_SERIAL
                                    << HOST_CONTROL_IF_SHIFT;
                        host_ctl |= HOST_CONTROL_REI;
                        clock_ctl = CLOCK_CONTROL_40MHZ;
-                        clock_delay = 0;
                } else if (value == MEMSTICK_PAR4) {
-                        host_ctl |= HOST_CONTROL_FAST_CLK;
+                        host_ctl |= HOST_CONTROL_FAST_CLK | HOST_CONTROL_REO;
                        host_ctl |= HOST_CONTROL_IF_PAR4
                                    << HOST_CONTROL_IF_SHIFT;
                        host_ctl &= ~HOST_CONTROL_REI;
                        clock_ctl = CLOCK_CONTROL_40MHZ;
-                        clock_delay = 4;
+                        clock_delay |= host->id ? (4 << 12) : (4 << 8);
                } else if (value == MEMSTICK_PAR8) {
                        host_ctl |= HOST_CONTROL_FAST_CLK;
                        host_ctl |= HOST_CONTROL_IF_PAR8
                                    << HOST_CONTROL_IF_SHIFT;
-                        host_ctl &= ~HOST_CONTROL_REI;
+                        host_ctl &= ~(HOST_CONTROL_REI | HOST_CONTROL_REO);
-                        clock_ctl = CLOCK_CONTROL_60MHZ;
+                        clock_ctl = CLOCK_CONTROL_50MHZ;
-                        clock_delay = 0;
                } else
                        return -EINVAL;
                writel(host_ctl, host->addr + HOST_CONTROL);
                writel(clock_ctl, host->addr + CLOCK_CONTROL);
-                writel(clock_delay, host->addr + CLOCK_DELAY);
+                pci_write_config_dword(host->chip->pdev,
+                                       PCI_CTL_CLOCK_DLY_ADDR,
+                                       clock_delay);
                break;
        };
        return 0;
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 10c44d3fe01a..68dc8d9eb24e 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -21,7 +21,7 @@ config MFD_SM501
 config MFD_SM501_GPIO
        bool "Export GPIO via GPIO layer"
-        depends on MFD_SM501 && HAVE_GPIO_LIB
+        depends on MFD_SM501 && GPIOLIB
         ---help---
         This option uses the gpio library layer to export the 64 GPIO
         lines on the SM501. The platform data is used to supply the
@@ -29,7 +29,7 @@ config MFD_SM501_GPIO
 config MFD_ASIC3
        bool "Support for Compaq ASIC3"
-        depends on GENERIC_HARDIRQS && HAVE_GPIO_LIB && ARM
+        depends on GENERIC_HARDIRQS && GPIOLIB && ARM
         ---help---
          This driver supports the ASIC3 multifunction chip found on many
          PDAs (mainly iPAQ and HTC based ones)
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index bc2a807f210d..ba5aa2008273 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -312,7 +312,6 @@ static int __init asic3_irq_probe(struct platform_device *pdev)
        struct asic3 *asic = platform_get_drvdata(pdev);
        unsigned long clksel = 0;
        unsigned int irq, irq_base;
-        int map_size;
        int ret;
        ret = platform_get_irq(pdev, 0);
@@ -534,6 +533,7 @@ static int __init asic3_probe(struct platform_device *pdev)
        struct asic3 *asic;
        struct resource *mem;
        unsigned long clksel;
+        int map_size;
        int ret = 0;
        asic = kzalloc(sizeof(struct asic3), GFP_KERNEL);
diff --git a/drivers/misc/eeepc-laptop.c b/drivers/misc/eeepc-laptop.c
index facdb9893c84..1ee8501e90f1 100644
--- a/drivers/misc/eeepc-laptop.c
+++ b/drivers/misc/eeepc-laptop.c
@@ -450,12 +450,14 @@ static int eeepc_get_fan_pwm(void)
        int value = 0;
        read_acpi_int(NULL, EEEPC_EC_FAN_PWM, &value);
+        value = value * 255 / 100;
        return (value);
 }
 static void eeepc_set_fan_pwm(int value)
 {
-        value = SENSORS_LIMIT(value, 0, 100);
+        value = SENSORS_LIMIT(value, 0, 255);
+        value = value * 100 / 255;
        ec_write(EEEPC_EC_SC02, value);
 }
@@ -520,15 +522,23 @@ static ssize_t show_sys_hwmon(int (*get)(void), char *buf)
        static SENSOR_DEVICE_ATTR(_name, _mode, show_##_name, store_##_name, 0);
 EEEPC_CREATE_SENSOR_ATTR(fan1_input, S_IRUGO, eeepc_get_fan_rpm, NULL);
-EEEPC_CREATE_SENSOR_ATTR(fan1_pwm, S_IRUGO | S_IWUSR,
+EEEPC_CREATE_SENSOR_ATTR(pwm1, S_IRUGO | S_IWUSR,
                         eeepc_get_fan_pwm, eeepc_set_fan_pwm);
 EEEPC_CREATE_SENSOR_ATTR(pwm1_enable, S_IRUGO | S_IWUSR,
                         eeepc_get_fan_ctrl, eeepc_set_fan_ctrl);
+static ssize_t
+show_name(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "eeepc\n");
+}
+static SENSOR_DEVICE_ATTR(name, S_IRUGO, show_name, NULL, 0);
 static struct attribute *hwmon_attributes[] = {
-        &sensor_dev_attr_fan1_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm1.dev_attr.attr,
        &sensor_dev_attr_fan1_input.dev_attr.attr,
        &sensor_dev_attr_pwm1_enable.dev_attr.attr,
+        &sensor_dev_attr_name.dev_attr.attr,
        NULL
 };
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 23c91f5f6b61..d61cee796efd 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -445,6 +445,9 @@ static void __exit gru_exit(void)
        int order = get_order(sizeof(struct gru_state) *
                              GRU_CHIPLETS_PER_BLADE);
+        if (!IS_UV())
+                return;
        for (i = 0; i < GRU_CHIPLETS_PER_BLADE; i++)
                free_irq(IRQ_GRU + i, NULL);
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 6986f3926244..ebc8b9d77613 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -615,14 +615,19 @@ static struct mmc_driver mmc_driver = {
 static int __init mmc_blk_init(void)
 {
-        int res = -ENOMEM;
+        int res;
        res = register_blkdev(MMC_BLOCK_MAJOR, "mmc");
        if (res)
                goto out;
-        return mmc_register_driver(&mmc_driver);
+        res = mmc_register_driver(&mmc_driver);
+        if (res)
+                goto out2;
+        return 0;
+ out2:
+        unregister_blkdev(MMC_BLOCK_MAJOR, "mmc");
 out:
        return res;
 }
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index f26b01d811ae..b92b172074ee 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -1040,7 +1040,7 @@ static const struct mmc_test_case mmc_test_cases[] = {
 };
-static struct mutex mmc_test_lock;
+static DEFINE_MUTEX(mmc_test_lock);
 static void mmc_test_run(struct mmc_test_card *test, int testcase)
 {
@@ -1171,8 +1171,6 @@ static int mmc_test_probe(struct mmc_card *card)
        if ((card->type != MMC_TYPE_MMC) && (card->type != MMC_TYPE_SD))
                return -ENODEV;
-        mutex_init(&mmc_test_lock);
        ret = device_create_file(&card->dev, &dev_attr_test);
        if (ret)
                return ret;
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 0bd06f5bd62f..00008967ef7a 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -195,7 +195,9 @@ static int atmci_regs_show(struct seq_file *s, void *v)
        /* Grab a more or less consistent snapshot */
        spin_lock_irq(&host->mmc->lock);
+        clk_enable(host->mck);
        memcpy_fromio(buf, host->regs, MCI_REGS_SIZE);
+        clk_disable(host->mck);
        spin_unlock_irq(&host->mmc->lock);
        seq_printf(s, "MR:\t0x%08x%s%s CLKDIV=%u\n",
@@ -216,6 +218,8 @@ static int atmci_regs_show(struct seq_file *s, void *v)
        atmci_show_status_reg(s, "SR", buf[MCI_SR / 4]);
        atmci_show_status_reg(s, "IMR", buf[MCI_IMR / 4]);
+        kfree(buf);
        return 0;
 }
@@ -237,7 +241,6 @@ static void atmci_init_debugfs(struct atmel_mci *host)
        struct mmc_host *mmc;
        struct dentry   *root;
        struct dentry   *node;
-        struct resource *res;
        mmc = host->mmc;
        root = mmc->debugfs_root;
@@ -251,9 +254,6 @@ static void atmci_init_debugfs(struct atmel_mci *host)
        if (!node)
                goto err;
-        res = platform_get_resource(host->pdev, IORESOURCE_MEM, 0);
-        node->d_inode->i_size = res->end - res->start + 1;
        node = debugfs_create_file("req", S_IRUSR, root, host, &atmci_req_fops);
        if (!node)
                goto err;
@@ -426,8 +426,6 @@ static u32 atmci_submit_data(struct mmc_host *mmc, struct mmc_data *data)
        host->sg = NULL;
        host->data = data;
-        mci_writel(host, BLKR, MCI_BCNT(data->blocks)
-                        | MCI_BLKLEN(data->blksz));
        dev_vdbg(&mmc->class_dev, "BLKR=0x%08x\n",
                        MCI_BCNT(data->blocks) | MCI_BLKLEN(data->blksz));
@@ -483,6 +481,10 @@ static void atmci_request(struct mmc_host *mmc, struct mmc_request *mrq)
                if (data->blocks > 1 && data->blksz & 3)
                        goto fail;
                atmci_set_timeout(host, data);
+                /* Must set block count/size before sending command */
+                mci_writel(host, BLKR, MCI_BCNT(data->blocks)
+                                | MCI_BLKLEN(data->blksz));
        }
        iflags = MCI_CMDRDY;
@@ -1059,6 +1061,10 @@ static int __init atmci_probe(struct platform_device *pdev)
                        host->present = !gpio_get_value(host->detect_pin);
                }
        }
+        if (!gpio_is_valid(host->detect_pin))
+                mmc->caps |= MMC_CAP_NEEDS_POLL;
        if (gpio_is_valid(host->wp_pin)) {
                if (gpio_request(host->wp_pin, "mmc_wp")) {
                        dev_dbg(&mmc->class_dev, "no WP pin available\n");
diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
index 9e647a06054f..ba2b4240a86a 100644
--- a/drivers/mmc/host/tmio_mmc.h
+++ b/drivers/mmc/host/tmio_mmc.h
@@ -159,10 +159,10 @@ static inline void tmio_mmc_kunmap_atomic(struct tmio_mmc_host *host,
 #define STATUS_TO_TEXT(a) \
        do { \
                if (status & TMIO_STAT_##a) \
-                        printf(#a); \
+                        printk(#a); \
        } while (0)
-void debug_status(u32 status)
+void pr_debug_status(u32 status)
 {
        printk(KERN_DEBUG "status: %08x = ", status);
        STATUS_TO_TEXT(CARD_REMOVE);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index c3c579f98ed0..dfacd31f7ed0 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6597,7 +6597,7 @@ struct flash_spec {
 struct bnx2_irq {
        irq_handler_t   handler;
-        u16             vector;
+        unsigned int    vector;
        u8              requested;
        char            name[16];
 };
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 453115acaad2..5cf78d612c45 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2738,9 +2738,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
                nic->flags |= wol_magic;
        /* ack any pending wake events, disable PME */
-        err = pci_enable_wake(pdev, 0, 0);
+        pci_pme_active(pdev, false);
-        if (err)
-                DPRINTK(PROBE, ERR, "Error clearing wake event\n");
        strcpy(netdev->name, "eth%d");
        if((err = register_netdev(netdev))) {
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 9d6edf3e73f9..d04eef53571e 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -144,6 +144,8 @@ static s32 e1000_host_if_read_cookie(struct e1000_hw *hw, u8 *buffer);
 static u8 e1000_calculate_mng_checksum(char *buffer, u32 length);
 static s32 e1000_configure_kmrn_for_10_100(struct e1000_hw *hw, u16 duplex);
 static s32 e1000_configure_kmrn_for_1000(struct e1000_hw *hw);
+static s32 e1000_do_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data);
+static s32 e1000_do_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data);
 /* IGP cable length table */
 static const
@@ -168,6 +170,8 @@ u16 e1000_igp_2_cable_length_table[IGP02E1000_AGC_LENGTH_TABLE_SIZE] =
      83, 89, 95, 100, 105, 109, 113, 116, 119, 122, 124,
      104, 109, 114, 118, 121, 124};
+static DEFINE_SPINLOCK(e1000_eeprom_lock);
 /******************************************************************************
 * Set the phy type member in the hw struct.
 *
@@ -4904,6 +4908,15 @@ static s32 e1000_spi_eeprom_ready(struct e1000_hw *hw)
 *****************************************************************************/
 s32 e1000_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
 {
+    s32 ret;
+    spin_lock(&e1000_eeprom_lock);
+    ret = e1000_do_read_eeprom(hw, offset, words, data);
+    spin_unlock(&e1000_eeprom_lock);
+    return ret;
+}
+static s32 e1000_do_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
+{
    struct e1000_eeprom_info *eeprom = &hw->eeprom;
    u32 i = 0;
@@ -5236,6 +5249,16 @@ s32 e1000_update_eeprom_checksum(struct e1000_hw *hw)
 *****************************************************************************/
 s32 e1000_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
 {
+    s32 ret;
+    spin_lock(&e1000_eeprom_lock);
+    ret = e1000_do_write_eeprom(hw, offset, words, data);
+    spin_unlock(&e1000_eeprom_lock);
+    return ret;
+}
+static s32 e1000_do_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words, u16 *data)
+{
    struct e1000_eeprom_info *eeprom = &hw->eeprom;
    s32 status = 0;
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index ac4e506b4f88..5ea6b60fa377 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -257,7 +257,6 @@ struct e1000_adapter {
        struct net_device *netdev;
        struct pci_dev *pdev;
        struct net_device_stats net_stats;
-        spinlock_t stats_lock;      /* prevent concurrent stats updates */
        /* structs defined in e1000_hw.h */
        struct e1000_hw hw;
@@ -284,6 +283,8 @@ struct e1000_adapter {
        unsigned long led_status;
        unsigned int flags;
+        struct work_struct downshift_task;
+        struct work_struct update_phy_task;
 };
 struct e1000_info {
@@ -305,6 +306,7 @@ struct e1000_info {
 #define FLAG_HAS_CTRLEXT_ON_LOAD          (1 << 5)
 #define FLAG_HAS_SWSM_ON_LOAD             (1 << 6)
 #define FLAG_HAS_JUMBO_FRAMES             (1 << 7)
+#define FLAG_READ_ONLY_NVM                (1 << 8)
 #define FLAG_IS_ICH                       (1 << 9)
 #define FLAG_HAS_SMART_POWER_DOWN         (1 << 11)
 #define FLAG_IS_QUAD_PORT_A               (1 << 12)
@@ -385,6 +387,7 @@ extern bool e1000e_enable_mng_pass_thru(struct e1000_hw *hw);
 extern bool e1000e_get_laa_state_82571(struct e1000_hw *hw);
 extern void e1000e_set_laa_state_82571(struct e1000_hw *hw, bool state);
+extern void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw);
 extern void e1000e_set_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw,
                                                 bool state);
 extern void e1000e_igp3_phy_powerdown_workaround_ich8lan(struct e1000_hw *hw);
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index e21c9e0f3738..33a3ff17b5d0 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -432,6 +432,10 @@ static void e1000_get_regs(struct net_device *netdev,
        regs_buff[11] = er32(TIDV);
        regs_buff[12] = adapter->hw.phy.type;  /* PHY type (IGP=1, M88=0) */
+        /* ethtool doesn't use anything past this point, so all this
+         * code is likely legacy junk for apps that may or may not
+         * exist */
        if (hw->phy.type == e1000_phy_m88) {
                e1e_rphy(hw, M88E1000_PHY_SPEC_STATUS, &phy_data);
                regs_buff[13] = (u32)phy_data; /* cable length */
@@ -447,7 +451,7 @@ static void e1000_get_regs(struct net_device *netdev,
                regs_buff[22] = adapter->phy_stats.receive_errors;
                regs_buff[23] = regs_buff[13]; /* mdix mode */
        }
-        regs_buff[21] = adapter->phy_stats.idle_errors;  /* phy idle errors */
+        regs_buff[21] = 0; /* was idle_errors */
        e1e_rphy(hw, PHY_1000T_STATUS, &phy_data);
        regs_buff[24] = (u32)phy_data;  /* phy local receiver status */
        regs_buff[25] = regs_buff[24];  /* phy remote receiver status */
@@ -529,6 +533,9 @@ static int e1000_set_eeprom(struct net_device *netdev,
        if (eeprom->magic != (adapter->pdev->vendor | (adapter->pdev->device << 16)))
                return -EFAULT;
+        if (adapter->flags & FLAG_READ_ONLY_NVM)
+                return -EINVAL;
        max_len = hw->nvm.word_size * 2;
        first_word = eeprom->offset >> 1;
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 9e38452a738c..bcd2bc477af2 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -58,6 +58,7 @@
 #define ICH_FLASH_HSFCTL                0x0006
 #define ICH_FLASH_FADDR                 0x0008
 #define ICH_FLASH_FDATA0                0x0010
+#define ICH_FLASH_PR0                   0x0074
 #define ICH_FLASH_READ_COMMAND_TIMEOUT  500
 #define ICH_FLASH_WRITE_COMMAND_TIMEOUT 500
@@ -150,6 +151,19 @@ union ich8_hws_flash_regacc {
        u16 regval;
 };
+/* ICH Flash Protected Region */
+union ich8_flash_protected_range {
+        struct ich8_pr {
+                u32 base:13;     /* 0:12 Protected Range Base */
+                u32 reserved1:2; /* 13:14 Reserved */
+                u32 rpe:1;       /* 15 Read Protection Enable */
+                u32 limit:13;    /* 16:28 Protected Range Limit */
+                u32 reserved2:2; /* 29:30 Reserved */
+                u32 wpe:1;       /* 31 Write Protection Enable */
+        } range;
+        u32 regval;
+};
 static s32 e1000_setup_link_ich8lan(struct e1000_hw *hw);
 static void e1000_clear_hw_cntrs_ich8lan(struct e1000_hw *hw);
 static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw);
@@ -366,6 +380,9 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
        return 0;
 }
+static DEFINE_MUTEX(nvm_mutex);
+static pid_t nvm_owner = -1;
 /**
 *  e1000_acquire_swflag_ich8lan - Acquire software control flag
 *  @hw: pointer to the HW structure
@@ -379,6 +396,15 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        u32 extcnf_ctrl;
        u32 timeout = PHY_CFG_TIMEOUT;
+        might_sleep();
+        if (!mutex_trylock(&nvm_mutex)) {
+                WARN(1, KERN_ERR "e1000e mutex contention. Owned by pid %d\n",
+                     nvm_owner);
+                mutex_lock(&nvm_mutex);
+        }
+        nvm_owner = current->pid;
        while (timeout) {
                extcnf_ctrl = er32(EXTCNF_CTRL);
                extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
@@ -393,6 +419,8 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        if (!timeout) {
                hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                nvm_owner = -1;
+                mutex_unlock(&nvm_mutex);
                return -E1000_ERR_CONFIG;
        }
@@ -414,6 +442,9 @@ static void e1000_release_swflag_ich8lan(struct e1000_hw *hw)
        extcnf_ctrl = er32(EXTCNF_CTRL);
        extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        nvm_owner = -1;
+        mutex_unlock(&nvm_mutex);
 }
 /**
@@ -1284,6 +1315,7 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
         * programming failed.
         */
        if (ret_val) {
+                /* Possibly read-only, see e1000e_write_protect_nvm_ich8lan() */
                hw_dbg(hw, "Flash commit failed.\n");
                e1000_release_swflag_ich8lan(hw);
                return ret_val;
@@ -1374,6 +1406,49 @@ static s32 e1000_validate_nvm_checksum_ich8lan(struct e1000_hw *hw)
 }
 /**
+ *  e1000e_write_protect_nvm_ich8lan - Make the NVM read-only
+ *  @hw: pointer to the HW structure
+ *
+ *  To prevent malicious write/erase of the NVM, set it to be read-only
+ *  so that the hardware ignores all write/erase cycles of the NVM via
+ *  the flash control registers.  The shadow-ram copy of the NVM will
+ *  still be updated, however any updates to this copy will not stick
+ *  across driver reloads.
+ **/
+void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw)
+{
+        union ich8_flash_protected_range pr0;
+        union ich8_hws_flash_status hsfsts;
+        u32 gfpreg;
+        s32 ret_val;
+        ret_val = e1000_acquire_swflag_ich8lan(hw);
+        if (ret_val)
+                return;
+        gfpreg = er32flash(ICH_FLASH_GFPREG);
+        /* Write-protect GbE Sector of NVM */
+        pr0.regval = er32flash(ICH_FLASH_PR0);
+        pr0.range.base = gfpreg & FLASH_GFPREG_BASE_MASK;
+        pr0.range.limit = ((gfpreg >> 16) & FLASH_GFPREG_BASE_MASK);
+        pr0.range.wpe = true;
+        ew32flash(ICH_FLASH_PR0, pr0.regval);
+        /*
+         * Lock down a subset of GbE Flash Control Registers, e.g.
+         * PR0 to prevent the write-protection from being lifted.
+         * Once FLOCKDN is set, the registers protected by it cannot
+         * be written until FLOCKDN is cleared by a hardware reset.
+         */
+        hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
+        hsfsts.hsf_status.flockdn = true;
+        ew32flash(ICH_FLASH_HSFSTS, hsfsts.regval);
+        e1000_release_swflag_ich8lan(hw);
+}
+/**
 *  e1000_write_flash_data_ich8lan - Writes bytes to the NVM
 *  @hw: pointer to the HW structure
 *  @offset: The offset (in bytes) of the byte/word to read.
@@ -1720,6 +1795,9 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
        ew32(CTRL, (ctrl | E1000_CTRL_RST));
        msleep(20);
+        /* release the swflag because it is not reset by hardware reset */
+        e1000_release_swflag_ich8lan(hw);
        ret_val = e1000e_get_auto_rd_done(hw);
        if (ret_val) {
                /*
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index d266510c8a94..b81c4237b5d3 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -47,7 +47,7 @@
 #include "e1000.h"
-#define DRV_VERSION "0.3.3.3-k2"
+#define DRV_VERSION "0.3.3.3-k6"
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
@@ -1115,6 +1115,14 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
        writel(0, adapter->hw.hw_addr + rx_ring->tail);
 }
+static void e1000e_downshift_workaround(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                        struct e1000_adapter, downshift_task);
+        e1000e_gig_downshift_workaround_ich8lan(&adapter->hw);
+}
 /**
 * e1000_intr_msi - Interrupt Handler
 * @irq: interrupt number
@@ -1139,7 +1147,7 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
                 */
                if ((adapter->flags & FLAG_LSC_GIG_SPEED_DROP) &&
                    (!(er32(STATUS) & E1000_STATUS_LU)))
-                        e1000e_gig_downshift_workaround_ich8lan(hw);
+                        schedule_work(&adapter->downshift_task);
                /*
                 * 80003ES2LAN workaround-- For packet buffer work-around on
@@ -1205,7 +1213,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
                 */
                if ((adapter->flags & FLAG_LSC_GIG_SPEED_DROP) &&
                    (!(er32(STATUS) & E1000_STATUS_LU)))
-                        e1000e_gig_downshift_workaround_ich8lan(hw);
+                        schedule_work(&adapter->downshift_task);
                /*
                 * 80003ES2LAN workaround--
@@ -2592,8 +2600,6 @@ static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
        /* Explicitly disable IRQ since the NIC can be in any state. */
        e1000_irq_disable(adapter);
-        spin_lock_init(&adapter->stats_lock);
        set_bit(__E1000_DOWN, &adapter->state);
        return 0;
@@ -2912,6 +2918,21 @@ static int e1000_set_mac(struct net_device *netdev, void *p)
        return 0;
 }
+/**
+ * e1000e_update_phy_task - work thread to update phy
+ * @work: pointer to our work struct
+ *
+ * this worker thread exists because we must acquire a
+ * semaphore to read the phy, which we could msleep while
+ * waiting for it, and we can't msleep in a timer.
+ **/
+static void e1000e_update_phy_task(struct work_struct *work)
+{
+        struct e1000_adapter *adapter = container_of(work,
+                                        struct e1000_adapter, update_phy_task);
+        e1000_get_phy_info(&adapter->hw);
+}
 /*
 * Need to wait a few seconds after link up to get diagnostic information from
 * the phy
@@ -2919,7 +2940,7 @@ static int e1000_set_mac(struct net_device *netdev, void *p)
 static void e1000_update_phy_info(unsigned long data)
 {
        struct e1000_adapter *adapter = (struct e1000_adapter *) data;
-        e1000_get_phy_info(&adapter->hw);
+        schedule_work(&adapter->update_phy_task);
 }
 /**
@@ -2930,10 +2951,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 {
        struct e1000_hw *hw = &adapter->hw;
        struct pci_dev *pdev = adapter->pdev;
-        unsigned long irq_flags;
-        u16 phy_tmp;
-#define PHY_IDLE_ERROR_COUNT_MASK 0x00FF
        /*
         * Prevent stats update while adapter is being reset, or if the pci
@@ -2944,14 +2961,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
        if (pci_channel_offline(pdev))
                return;
-        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
-        /*
-         * these counters are modified from e1000_adjust_tbi_stats,
-         * called from the interrupt context, so they must only
-         * be written while holding adapter->stats_lock
-         */
        adapter->stats.crcerrs += er32(CRCERRS);
        adapter->stats.gprc += er32(GPRC);
        adapter->stats.gorc += er32(GORCL);
@@ -3022,21 +3031,10 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
        /* Tx Dropped needs to be maintained elsewhere */
-        /* Phy Stats */
-        if (hw->phy.media_type == e1000_media_type_copper) {
-                if ((adapter->link_speed == SPEED_1000) &&
-                   (!e1e_rphy(hw, PHY_1000T_STATUS, &phy_tmp))) {
-                        phy_tmp &= PHY_IDLE_ERROR_COUNT_MASK;
-                        adapter->phy_stats.idle_errors += phy_tmp;
-                }
-        }
        /* Management Stats */
        adapter->stats.mgptc += er32(MGTPTC);
        adapter->stats.mgprc += er32(MGTPRC);
        adapter->stats.mgpdc += er32(MGTPDC);
-        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 /**
@@ -3048,10 +3046,6 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
        struct e1000_hw *hw = &adapter->hw;
        struct e1000_phy_regs *phy = &adapter->phy_regs;
        int ret_val;
-        unsigned long irq_flags;
-        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
        if ((er32(STATUS) & E1000_STATUS_LU) &&
            (adapter->hw.phy.media_type == e1000_media_type_copper)) {
@@ -3082,8 +3076,6 @@ static void e1000_phy_read_status(struct e1000_adapter *adapter)
                phy->stat1000 = 0;
                phy->estatus = (ESTATUS_1000_TFULL | ESTATUS_1000_THALF);
        }
-        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 static void e1000_print_link_info(struct e1000_adapter *adapter)
@@ -4467,6 +4459,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        adapter->bd_number = cards_found++;
+        e1000e_check_options(adapter);
        /* setup adapter struct */
        err = e1000_sw_init(adapter);
        if (err)
@@ -4482,6 +4476,10 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        if (err)
                goto err_hw_init;
+        if ((adapter->flags & FLAG_IS_ICH) &&
+            (adapter->flags & FLAG_READ_ONLY_NVM))
+                e1000e_write_protect_nvm_ich8lan(&adapter->hw);
        hw->mac.ops.get_bus_info(&adapter->hw);
        adapter->hw.phy.autoneg_wait_to_complete = 0;
@@ -4572,8 +4570,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        INIT_WORK(&adapter->reset_task, e1000_reset_task);
        INIT_WORK(&adapter->watchdog_task, e1000_watchdog_task);
+        INIT_WORK(&adapter->downshift_task, e1000e_downshift_workaround);
-        e1000e_check_options(adapter);
+        INIT_WORK(&adapter->update_phy_task, e1000e_update_phy_task);
        /* Initialize link parameters. User can change them with ethtool */
        adapter->hw.mac.autoneg = 1;
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index ed912e023a72..d91dbf7ba434 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -133,6 +133,15 @@ E1000_PARAM(SmartPowerDownEnable, "Enable PHY smart power down");
 */
 E1000_PARAM(KumeranLockLoss, "Enable Kumeran lock loss workaround");
+/*
+ * Write Protect NVM
+ *
+ * Valid Range: 0, 1
+ *
+ * Default Value: 1 (enabled)
+ */
+E1000_PARAM(WriteProtectNVM, "Write-protect NVM [WARNING: disabling this can lead to corrupted NVM]");
 struct e1000_option {
        enum { enable_option, range_option, list_option } type;
        const char *name;
@@ -388,4 +397,25 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
                                                                       opt.def);
                }
        }
+        { /* Write-protect NVM */
+                const struct e1000_option opt = {
+                        .type = enable_option,
+                        .name = "Write-protect NVM",
+                        .err  = "defaulting to Enabled",
+                        .def  = OPTION_ENABLED
+                };
+                if (adapter->flags & FLAG_IS_ICH) {
+                        if (num_WriteProtectNVM > bd) {
+                                unsigned int write_protect_nvm = WriteProtectNVM[bd];
+                                e1000_validate_option(&write_protect_nvm, &opt,
+                                                      adapter);
+                                if (write_protect_nvm)
+                                        adapter->flags |= FLAG_READ_ONLY_NVM;
+                        } else {
+                                if (opt.def)
+                                        adapter->flags |= FLAG_READ_ONLY_NVM;
+                        }
+                }
+        }
 }
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 0b6ecef9a849..eeb55ed2152d 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5643,6 +5643,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                dev->dev_addr[4] = (np->orig_mac[0] >>  8) & 0xff;
                dev->dev_addr[5] = (np->orig_mac[0] >>  0) & 0xff;
                writel(txreg|NVREG_TRANSMITPOLL_MAC_ADDR_REV, base + NvRegTransmitPoll);
+                printk(KERN_DEBUG "nv_probe: set workaround bit for reversed mac addr\n");
        }
        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
@@ -5890,14 +5891,12 @@ static void nv_restore_phy(struct net_device *dev)
        }
 }
-static void __devexit nv_remove(struct pci_dev *pci_dev)
+static void nv_restore_mac_addr(struct pci_dev *pci_dev)
 {
        struct net_device *dev = pci_get_drvdata(pci_dev);
        struct fe_priv *np = netdev_priv(dev);
        u8 __iomem *base = get_hwbase(dev);
-        unregister_netdev(dev);
        /* special op: write back the misordered MAC address - otherwise
         * the next nv_probe would see a wrong address.
         */
@@ -5905,6 +5904,15 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
        writel(np->orig_mac[1], base + NvRegMacAddrB);
        writel(readl(base + NvRegTransmitPoll) & ~NVREG_TRANSMITPOLL_MAC_ADDR_REV,
               base + NvRegTransmitPoll);
+}
+static void __devexit nv_remove(struct pci_dev *pci_dev)
+{
+        struct net_device *dev = pci_get_drvdata(pci_dev);
+        unregister_netdev(dev);
+        nv_restore_mac_addr(pci_dev);
        /* restore any phy related changes */
        nv_restore_phy(dev);
@@ -5975,6 +5983,8 @@ static void nv_shutdown(struct pci_dev *pdev)
        if (netif_running(dev))
                nv_close(dev);
+        nv_restore_mac_addr(pdev);
        pci_disable_device(pdev);
        if (system_state == SYSTEM_POWER_OFF) {
                if (pci_enable_wake(pdev, PCI_D3cold, np->wolenabled))
diff --git a/drivers/net/hp-plus.c b/drivers/net/hp-plus.c
index 8239939554bc..fbbd3e660c27 100644
--- a/drivers/net/hp-plus.c
+++ b/drivers/net/hp-plus.c
@@ -139,7 +139,7 @@ static int __init do_hpp_probe(struct net_device *dev)
 #ifndef MODULE
 struct net_device * __init hp_plus_probe(int unit)
 {
-        struct net_device *dev = alloc_ei_netdev();
+        struct net_device *dev = alloc_eip_netdev();
        int err;
        if (!dev)
@@ -284,7 +284,7 @@ hpp_open(struct net_device *dev)
        int option_reg;
        int retval;
-        if ((retval = request_irq(dev->irq, ei_interrupt, 0, dev->name, dev))) {
+        if ((retval = request_irq(dev->irq, eip_interrupt, 0, dev->name, dev))) {
            return retval;
        }
@@ -302,7 +302,7 @@ hpp_open(struct net_device *dev)
        /* Select the operational page. */
        outw(Perf_Page, ioaddr + HP_PAGING);
-        ei_open(dev);
+        eip_open(dev);
        return 0;
 }
@@ -313,7 +313,7 @@ hpp_close(struct net_device *dev)
        int option_reg = inw(ioaddr + HPP_OPTION);
        free_irq(dev->irq, dev);
-        ei_close(dev);
+        eip_close(dev);
        outw((option_reg & ~EnableIRQ) | MemDisable | NICReset | ChipReset,
                 ioaddr + HPP_OPTION);
diff --git a/drivers/net/mlx4/mr.c b/drivers/net/mlx4/mr.c
index 62071d9c4a55..d1dd5b48dbd1 100644
--- a/drivers/net/mlx4/mr.c
+++ b/drivers/net/mlx4/mr.c
@@ -67,11 +67,10 @@ struct mlx4_mpt_entry {
 #define MLX4_MPT_FLAG_PHYSICAL      (1 <<  9)
 #define MLX4_MPT_FLAG_REGION        (1 <<  8)
-#define MLX4_MPT_PD_FLAG_FAST_REG   (1 << 26)
+#define MLX4_MPT_PD_FLAG_FAST_REG   (1 << 27)
+#define MLX4_MPT_PD_FLAG_RAE        (1 << 28)
 #define MLX4_MPT_PD_FLAG_EN_INV     (3 << 24)
-#define MLX4_MTT_FLAG_PRESENT           1
 #define MLX4_MPT_STATUS_SW              0xF0
 #define MLX4_MPT_STATUS_HW              0x00
@@ -348,7 +347,10 @@ int mlx4_mr_enable(struct mlx4_dev *dev, struct mlx4_mr *mr)
        if (mr->mtt.order >= 0 && mr->mtt.page_shift == 0) {
                /* fast register MR in free state */
                mpt_entry->flags    |= cpu_to_be32(MLX4_MPT_FLAG_FREE);
-                mpt_entry->pd_flags |= cpu_to_be32(MLX4_MPT_PD_FLAG_FAST_REG);
+                mpt_entry->pd_flags |= cpu_to_be32(MLX4_MPT_PD_FLAG_FAST_REG |
+                                                   MLX4_MPT_PD_FLAG_RAE);
+                mpt_entry->mtt_sz    = cpu_to_be32((1 << mr->mtt.order) *
+                                                   MLX4_MTT_ENTRY_PER_SEG);
        } else {
                mpt_entry->flags    |= cpu_to_be32(MLX4_MPT_FLAG_SW_OWNS);
        }
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index e4765b713aba..e3be81eba8a4 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -5984,6 +5984,56 @@ static void niu_netif_start(struct niu *np)
        niu_enable_interrupts(np, 1);
 }
+static void niu_reset_buffers(struct niu *np)
+{
+        int i, j, k, err;
+        if (np->rx_rings) {
+                for (i = 0; i < np->num_rx_rings; i++) {
+                        struct rx_ring_info *rp = &np->rx_rings[i];
+                        for (j = 0, k = 0; j < MAX_RBR_RING_SIZE; j++) {
+                                struct page *page;
+                                page = rp->rxhash[j];
+                                while (page) {
+                                        struct page *next =
+                                                (struct page *) page->mapping;
+                                        u64 base = page->index;
+                                        base = base >> RBR_DESCR_ADDR_SHIFT;
+                                        rp->rbr[k++] = cpu_to_le32(base);
+                                        page = next;
+                                }
+                        }
+                        for (; k < MAX_RBR_RING_SIZE; k++) {
+                                err = niu_rbr_add_page(np, rp, GFP_ATOMIC, k);
+                                if (unlikely(err))
+                                        break;
+                        }
+                        rp->rbr_index = rp->rbr_table_size - 1;
+                        rp->rcr_index = 0;
+                        rp->rbr_pending = 0;
+                        rp->rbr_refill_pending = 0;
+                }
+        }
+        if (np->tx_rings) {
+                for (i = 0; i < np->num_tx_rings; i++) {
+                        struct tx_ring_info *rp = &np->tx_rings[i];
+                        for (j = 0; j < MAX_TX_RING_SIZE; j++) {
+                                if (rp->tx_buffs[j].skb)
+                                        (void) release_tx_packet(np, rp, j);
+                        }
+                        rp->pending = MAX_TX_RING_SIZE;
+                        rp->prod = 0;
+                        rp->cons = 0;
+                        rp->wrap_bit = 0;
+                }
+        }
+}
 static void niu_reset_task(struct work_struct *work)
 {
        struct niu *np = container_of(work, struct niu, reset_task);
@@ -6006,6 +6056,12 @@ static void niu_reset_task(struct work_struct *work)
        niu_stop_hw(np);
+        spin_unlock_irqrestore(&np->lock, flags);
+        niu_reset_buffers(np);
+        spin_lock_irqsave(&np->lock, flags);
        err = niu_init_hw(np);
        if (!err) {
                np->timer.expires = jiffies + HZ;
diff --git a/drivers/net/wireless/ath9k/beacon.c b/drivers/net/wireless/ath9k/beacon.c
index caf569401a34..00a0eaa08866 100644
--- a/drivers/net/wireless/ath9k/beacon.c
+++ b/drivers/net/wireless/ath9k/beacon.c
@@ -209,6 +209,7 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id)
        unsigned int curlen;
        struct ath_txq *cabq;
        struct ath_txq *mcastq;
+        struct ieee80211_tx_info *info;
        avp = sc->sc_vaps[if_id];
        mcastq = &avp->av_mcastq;
@@ -232,6 +233,18 @@ static struct ath_buf *ath_beacon_generate(struct ath_softc *sc, int if_id)
         */
        curlen = skb->len;
+        info = IEEE80211_SKB_CB(skb);
+        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                /*
+                 * TODO: make sure the seq# gets assigned properly (vs. other
+                 * TX frames)
+                 */
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+                sc->seq_no += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(sc->seq_no);
+        }
        /* XXX: spin_lock_bh should not be used here, but sparse bitches
         * otherwise. We should fix sparse :) */
        spin_lock_bh(&mcastq->axq_lock);
diff --git a/drivers/net/wireless/ath9k/core.c b/drivers/net/wireless/ath9k/core.c
index f6c45288d0e7..87e37bc39145 100644
--- a/drivers/net/wireless/ath9k/core.c
+++ b/drivers/net/wireless/ath9k/core.c
@@ -294,8 +294,6 @@ static int ath_stop(struct ath_softc *sc)
         * hardware is gone (invalid).
         */
-        if (!sc->sc_invalid)
-                ath9k_hw_set_interrupts(ah, 0);
        ath_draintxq(sc, false);
        if (!sc->sc_invalid) {
                ath_stoprecv(sc);
@@ -797,6 +795,12 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
        if (ah->ah_caps.hw_caps & ATH9K_HW_CAP_HT)
                sc->sc_imask |= ATH9K_INT_CST;
+        /* Note: We disable MIB interrupts for now as we don't yet
+         * handle processing ANI, otherwise you will get an interrupt
+         * storm after about 7 hours of usage making the system unusable
+         * with huge latency. Once we do have ANI processing included
+         * we can re-enable this interrupt. */
+#if 0
        /*
         * Enable MIB interrupts when there are hardware phy counters.
         * Note we only do this (at the moment) for station mode.
@@ -804,6 +808,7 @@ int ath_open(struct ath_softc *sc, struct ath9k_channel *initial_chan)
        if (ath9k_hw_phycounters(ah) &&
            ((sc->sc_opmode == ATH9K_M_STA) || (sc->sc_opmode == ATH9K_M_IBSS)))
                sc->sc_imask |= ATH9K_INT_MIB;
+#endif
        /*
         * Some hardware processes the TIM IE and fires an
         * interrupt when the TIM bit is set.  For hardware
@@ -1336,6 +1341,8 @@ void ath_deinit(struct ath_softc *sc)
        DPRINTF(sc, ATH_DBG_CONFIG, "%s\n", __func__);
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
        ath_stop(sc);
        if (!sc->sc_invalid)
                ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
diff --git a/drivers/net/wireless/ath9k/core.h b/drivers/net/wireless/ath9k/core.h
index 673b3d81133a..2f84093331ee 100644
--- a/drivers/net/wireless/ath9k/core.h
+++ b/drivers/net/wireless/ath9k/core.h
@@ -974,7 +974,6 @@ struct ath_softc {
        u32 sc_keymax;          /* size of key cache */
        DECLARE_BITMAP(sc_keymap, ATH_KEYMAX);  /* key use bit map */
        u8 sc_splitmic;         /* split TKIP MIC keys */
-        int sc_keytype;
        /* RX */
        struct list_head sc_rxbuf;
@@ -992,6 +991,7 @@ struct ath_softc {
        u32 sc_txintrperiod;    /* tx interrupt batching */
        int sc_haltype2q[ATH9K_WME_AC_VO+1]; /* HAL WME AC -> h/w qnum */
        u32 sc_ant_tx[8];       /* recent tx frames/antenna */
+        u16 seq_no; /* TX sequence number */
        /* Beacon */
        struct ath9k_tx_queue_info sc_beacon_qi;
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index c5107f269f24..acebdf1d20a8 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -206,8 +206,6 @@ static int ath_key_config(struct ath_softc *sc,
        if (!ret)
                return -EIO;
-        if (mac)
-                sc->sc_keytype = hk.kv_type;
        return 0;
 }
@@ -369,6 +367,20 @@ static int ath9k_tx(struct ieee80211_hw *hw,
 {
        struct ath_softc *sc = hw->priv;
        int hdrlen, padsize;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        /*
+         * As a temporary workaround, assign seq# here; this will likely need
+         * to be cleaned up to work better with Beacon transmission and virtual
+         * BSSes.
+         */
+        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+                if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
+                        sc->seq_no += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(sc->seq_no);
+        }
        /* Add the padding after the header if this is not already done */
        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
@@ -764,7 +776,6 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
        case DISABLE_KEY:
                ath_key_delete(sc, key);
                clear_bit(key->keyidx, sc->sc_keymap);
-                sc->sc_keytype = ATH9K_CIPHER_CLR;
                break;
        default:
                ret = -EINVAL;
@@ -1400,10 +1411,17 @@ static void ath_pci_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
        struct ath_softc *sc = hw->priv;
+        enum ath9k_int status;
-        if (pdev->irq)
+        if (pdev->irq) {
+                ath9k_hw_set_interrupts(sc->sc_ah, 0);
+                /* clear the ISR */
+                ath9k_hw_getisr(sc->sc_ah, &status);
+                sc->sc_invalid = 1;
                free_irq(pdev->irq, sc);
+        }
        ath_detach(sc);
        pci_iounmap(pdev, sc->mem);
        pci_release_region(pdev, 0);
        pci_disable_device(pdev);
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 550129f717e2..8b332e11a656 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -315,11 +315,11 @@ static int ath_tx_prepare(struct ath_softc *sc,
                txctl->keyix = tx_info->control.hw_key->hw_key_idx;
                txctl->frmlen += tx_info->control.icv_len;
-                if (sc->sc_keytype == ATH9K_CIPHER_WEP)
+                if (tx_info->control.hw_key->alg == ALG_WEP)
                        txctl->keytype = ATH9K_KEY_TYPE_WEP;
-                else if (sc->sc_keytype == ATH9K_CIPHER_TKIP)
+                else if (tx_info->control.hw_key->alg == ALG_TKIP)
                        txctl->keytype = ATH9K_KEY_TYPE_TKIP;
-                else if (sc->sc_keytype == ATH9K_CIPHER_AES_CCM)
+                else if (tx_info->control.hw_key->alg == ALG_CCMP)
                        txctl->keytype = ATH9K_KEY_TYPE_AES;
        }
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index fec5645944a4..34ae125d5384 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -43,23 +43,6 @@ static bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
        return 0;
 }
-/* Update the rfkill state */
-static void b43_rfkill_update_state(struct b43_wldev *dev)
-{
-        struct b43_rfkill *rfk = &(dev->wl->rfkill);
-        if (!dev->radio_hw_enable) {
-                rfk->rfkill->state = RFKILL_STATE_HARD_BLOCKED;
-                return;
-        }
-        if (!dev->phy.radio_on)
-                rfk->rfkill->state = RFKILL_STATE_SOFT_BLOCKED;
-        else
-                rfk->rfkill->state = RFKILL_STATE_UNBLOCKED;
-}
 /* The poll callback for the hardware button. */
 static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
 {
@@ -77,7 +60,6 @@ static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
        if (unlikely(enabled != dev->radio_hw_enable)) {
                dev->radio_hw_enable = enabled;
                report_change = 1;
-                b43_rfkill_update_state(dev);
                b43info(wl, "Radio hardware status changed to %s\n",
                        enabled ? "ENABLED" : "DISABLED");
        }
diff --git a/drivers/net/wireless/b43legacy/rfkill.c b/drivers/net/wireless/b43legacy/rfkill.c
index 476add97e974..b32bf6a94f19 100644
--- a/drivers/net/wireless/b43legacy/rfkill.c
+++ b/drivers/net/wireless/b43legacy/rfkill.c
@@ -44,23 +44,6 @@ static bool b43legacy_is_hw_radio_enabled(struct b43legacy_wldev *dev)
        return 0;
 }
-/* Update the rfkill state */
-static void b43legacy_rfkill_update_state(struct b43legacy_wldev *dev)
-{
-        struct b43legacy_rfkill *rfk = &(dev->wl->rfkill);
-        if (!dev->radio_hw_enable) {
-                rfk->rfkill->state = RFKILL_STATE_HARD_BLOCKED;
-                return;
-        }
-        if (!dev->phy.radio_on)
-                rfk->rfkill->state = RFKILL_STATE_SOFT_BLOCKED;
-        else
-                rfk->rfkill->state = RFKILL_STATE_UNBLOCKED;
-}
 /* The poll callback for the hardware button. */
 static void b43legacy_rfkill_poll(struct input_polled_dev *poll_dev)
 {
@@ -78,7 +61,6 @@ static void b43legacy_rfkill_poll(struct input_polled_dev *poll_dev)
        if (unlikely(enabled != dev->radio_hw_enable)) {
                dev->radio_hw_enable = enabled;
                report_change = 1;
-                b43legacy_rfkill_update_state(dev);
                b43legacyinfo(wl, "Radio hardware status changed to %s\n",
                        enabled ? "ENABLED" : "DISABLED");
        }
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index da8b7433e3a6..a60ae86bd5c9 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -58,6 +58,7 @@ static struct usb_device_id usb_ids[] = {
        { USB_DEVICE(0x0586, 0x3407), .driver_info = DEVICE_ZD1211 },
        { USB_DEVICE(0x129b, 0x1666), .driver_info = DEVICE_ZD1211 },
        { USB_DEVICE(0x157e, 0x300a), .driver_info = DEVICE_ZD1211 },
+        { USB_DEVICE(0x0105, 0x145f), .driver_info = DEVICE_ZD1211 },
        /* ZD1211B */
        { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B },
        { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B },
diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
index 40337a06c18a..146ca9cd1567 100644
--- a/drivers/pci/hotplug/fakephp.c
+++ b/drivers/pci/hotplug/fakephp.c
@@ -320,15 +320,15 @@ static int disable_slot(struct hotplug_slot *slot)
                        return -ENODEV;
                }
+                /* remove the device from the pci core */
+                pci_remove_bus_device(dev);
                /* queue work item to blow away this sysfs entry and other
                 * parts.
                 */
                INIT_WORK(&dslot->remove_work, remove_slot_worker);
                queue_work(dummyphp_wq, &dslot->remove_work);
-                /* blow away this sysfs entry and other parts. */
-                remove_slot(dslot);
                pci_dev_put(dev);
        }
        return 0;
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index ab31f5ba665d..9d934ddee956 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -258,7 +258,7 @@ static int pcie_poll_cmd(struct controller *ctrl)
                        return 1;
                }
        }
-        while (timeout > 1000) {
+        while (timeout > 0) {
                msleep(10);
                timeout -= 10;
                if (!pciehp_readw(ctrl, SLOTSTATUS, &slot_status)) {
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 9c718583a237..77baff022f71 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/stat.h>
 #include <linux/topology.h>
@@ -484,6 +485,21 @@ pci_mmap_legacy_mem(struct kobject *kobj, struct bin_attribute *attr,
 #endif /* HAVE_PCI_LEGACY */
 #ifdef HAVE_PCI_MMAP
+static int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma)
+{
+        unsigned long nr, start, size;
+        nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+        start = vma->vm_pgoff;
+        size = pci_resource_len(pdev, resno) >> PAGE_SHIFT;
+        if (start < size && size - start >= nr)
+                return 1;
+        WARN(1, "process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",
+                current->comm, start, start+nr, pci_name(pdev), resno, size);
+        return 0;
+}
 /**
 * pci_mmap_resource - map a PCI resource into user memory space
 * @kobj: kobject for mapping
@@ -510,6 +526,9 @@ pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr,
        if (i >= PCI_ROM_RESOURCE)
                return -ENODEV;
+        if (!pci_mmap_fits(pdev, i, vma))
+                return -EINVAL;
        /* pci_mmap_page_range() expects the same kind of entry as coming
         * from /proc/bus/pci/ which is a "user visible" value. If this is
         * different from the resource itself, arch will do necessary fixup.
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 9a7c9e1408a4..851f5b83cdbc 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -527,7 +527,7 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
                 */
                pci_read_config_dword(child_dev, child_pos + PCI_EXP_DEVCAP,
                        &reg32);
-                if (!(reg32 & PCI_EXP_DEVCAP_RBER && !aspm_force)) {
+                if (!(reg32 & PCI_EXP_DEVCAP_RBER) && !aspm_force) {
                        printk("Pre-1.1 PCIe device detected, "
                                "disable ASPM for %s. It can be enabled forcedly"
                                " with 'pcie_aspm=force'\n", pci_name(pdev));
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index cce2f4cb1fbf..36698e57b97f 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -304,6 +304,9 @@ static int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                } else {
                        res->start = l64;
                        res->end = l64 + sz64;
+                        printk(KERN_DEBUG "PCI: %s reg %x 64bit mmio: [%llx, %llx]\n",
+                                pci_name(dev), pos, (unsigned long long)res->start,
+                                (unsigned long long)res->end);
                }
        } else {
                sz = pci_size(l, sz, mask);
@@ -313,6 +316,9 @@ static int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                res->start = l;
                res->end = l + sz;
+                printk(KERN_DEBUG "PCI: %s reg %x %s: [%llx, %llx]\n", pci_name(dev),
+                        pos, (res->flags & IORESOURCE_IO) ? "io port":"32bit mmio",
+                        (unsigned long long)res->start, (unsigned long long)res->end);
        }
 out:
@@ -383,7 +389,9 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
                        res->start = base;
                if (!res->end)
                        res->end = limit + 0xfff;
-                printk(KERN_INFO "PCI: bridge %s io port: [%llx, %llx]\n", pci_name(dev), res->start, res->end);
+                printk(KERN_DEBUG "PCI: bridge %s io port: [%llx, %llx]\n",
+                        pci_name(dev), (unsigned long long) res->start,
+                        (unsigned long long) res->end);
        }
        res = child->resource[1];
@@ -395,7 +403,9 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
                res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM;
                res->start = base;
                res->end = limit + 0xfffff;
-                printk(KERN_INFO "PCI: bridge %s 32bit mmio: [%llx, %llx]\n", pci_name(dev), res->start, res->end);
+                printk(KERN_DEBUG "PCI: bridge %s 32bit mmio: [%llx, %llx]\n",
+                        pci_name(dev), (unsigned long long) res->start,
+                        (unsigned long long) res->end);
        }
        res = child->resource[2];
@@ -431,7 +441,9 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
                res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM | IORESOURCE_PREFETCH;
                res->start = base;
                res->end = limit + 0xfffff;
-                printk(KERN_INFO "PCI: bridge %s %sbit mmio pref: [%llx, %llx]\n", pci_name(dev), (res->flags & PCI_PREF_RANGE_TYPE_64)?"64":"32",res->start, res->end);
+                printk(KERN_DEBUG "PCI: bridge %s %sbit mmio pref: [%llx, %llx]\n",
+                        pci_name(dev), (res->flags & PCI_PREF_RANGE_TYPE_64) ? "64" : "32",
+                        (unsigned long long) res->start, (unsigned long long) res->end);
        }
 }
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index 3b3b5f178797..4edfc4731bd4 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -162,7 +162,7 @@ EXPORT_SYMBOL(pci_find_slot);
 * time.
 */
 struct pci_dev *pci_find_device(unsigned int vendor, unsigned int device,
-                                const struct pci_dev *from)
+                                struct pci_dev *from)
 {
        struct pci_dev *pdev;
@@ -263,7 +263,7 @@ static int match_pci_dev_by_id(struct device *dev, void *data)
 * this file.
 */
 static struct pci_dev *pci_get_dev_by_id(const struct pci_device_id *id,
-                                         const struct pci_dev *from)
+                                         struct pci_dev *from)
 {
        struct device *dev;
        struct device *dev_start = NULL;
@@ -303,7 +303,7 @@ static struct pci_dev *pci_get_dev_by_id(const struct pci_device_id *id,
 */
 struct pci_dev *pci_get_subsys(unsigned int vendor, unsigned int device,
                               unsigned int ss_vendor, unsigned int ss_device,
-                               const struct pci_dev *from)
+                               struct pci_dev *from)
 {
        struct pci_dev *pdev;
        struct pci_device_id *id;
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 1aad599816f7..3abbfad9ddab 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -540,7 +540,11 @@ static void pci_bus_dump_res(struct pci_bus *bus)
                if (!res)
                        continue;
-                printk(KERN_INFO "bus: %02x index %x %s: [%llx, %llx]\n", bus->number, i, (res->flags & IORESOURCE_IO)? "io port":"mmio", res->start, res->end);
+                printk(KERN_INFO "bus: %02x index %x %s: [%llx, %llx]\n",
+                        bus->number, i,
+                        (res->flags & IORESOURCE_IO) ? "io port" : "mmio",
+                        (unsigned long long) res->start,
+                        (unsigned long long) res->end);
        }
 }
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 4174d9656e35..34c83d3ca0fa 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -427,6 +427,18 @@ static int pcmcia_device_probe(struct device * dev)
        p_drv = to_pcmcia_drv(dev->driver);
        s = p_dev->socket;
+        /* The PCMCIA code passes the match data in via dev->driver_data
+         * which is an ugly hack. Once the driver probe is called it may
+         * and often will overwrite the match data so we must save it first
+         *
+         * handle pseudo multifunction devices:
+         * there are at most two pseudo multifunction devices.
+         * if we're matching against the first, schedule a
+         * call which will then check whether there are two
+         * pseudo devices, and if not, add the second one.
+         */
+        did = p_dev->dev.driver_data;
        ds_dbg(1, "trying to bind %s to %s\n", p_dev->dev.bus_id,
               p_drv->drv.name);
@@ -455,21 +467,14 @@ static int pcmcia_device_probe(struct device * dev)
                goto put_module;
        }
-        /* handle pseudo multifunction devices:
-         * there are at most two pseudo multifunction devices.
-         * if we're matching against the first, schedule a
-         * call which will then check whether there are two
-         * pseudo devices, and if not, add the second one.
-         */
-        did = p_dev->dev.driver_data;
        if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
            (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
                pcmcia_add_device_later(p_dev->socket, 0);
- put_module:
+put_module:
        if (ret)
                module_put(p_drv->owner);
- put_dev:
+put_dev:
        if (ret)
                put_device(dev);
        return (ret);
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index c48f3f69bdaf..da3972153226 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -748,7 +748,9 @@ int soc_common_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops
                add_timer(&skt->poll_timer);
-                device_create_file(&skt->socket.dev, &dev_attr_status);
+                ret = device_create_file(&skt->socket.dev, &dev_attr_status);
+                if (ret)
+                        goto out_err_8;
        }
        dev_set_drvdata(dev, sinfo);
@@ -758,6 +760,8 @@ int soc_common_drv_pcmcia_probe(struct device *dev, struct pcmcia_low_level *ops
        do {
                skt = &sinfo->skt[i];
+                device_remove_file(&skt->socket.dev, &dev_attr_status);
+ out_err_8:
                del_timer_sync(&skt->poll_timer);
                pcmcia_unregister_socket(&skt->socket);
diff --git a/drivers/pnp/Makefile b/drivers/pnp/Makefile
index 26f5abc9c3f7..e83f34f1b5ba 100644
--- a/drivers/pnp/Makefile
+++ b/drivers/pnp/Makefile
@@ -2,12 +2,15 @@
 # Makefile for the Linux Plug-and-Play Support.
 #
-obj-y           := core.o card.o driver.o resource.o manager.o support.o interface.o quirks.o system.o
+obj-y           := core.o card.o driver.o resource.o manager.o support.o interface.o quirks.o
 obj-$(CONFIG_PNPACPI)           += pnpacpi/
 obj-$(CONFIG_PNPBIOS)           += pnpbios/
 obj-$(CONFIG_ISAPNP)            += isapnp/
+# pnp_system_init goes after pnpacpi/pnpbios init
+obj-y                           += system.o
 ifeq ($(CONFIG_PNP_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
 endif
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index c1b9ea34977b..53561d72b4ee 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -268,7 +268,7 @@ static int __init pnpacpi_init(void)
        return 0;
 }
-subsys_initcall(pnpacpi_init);
+fs_initcall(pnpacpi_init);
 static int __init pnpacpi_setup(char *str)
 {
diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c
index 19a4be1a9a31..662dfcddedc6 100644
--- a/drivers/pnp/pnpbios/core.c
+++ b/drivers/pnp/pnpbios/core.c
@@ -571,7 +571,7 @@ static int __init pnpbios_init(void)
        return 0;
 }
-subsys_initcall(pnpbios_init);
+fs_initcall(pnpbios_init);
 static int __init pnpbios_thread_init(void)
 {
diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
index f118252f3a9f..52e2743b04ec 100644
--- a/drivers/rtc/rtc-dev.c
+++ b/drivers/rtc/rtc-dev.c
@@ -422,6 +422,12 @@ done:
        return err;
 }
+static int rtc_dev_fasync(int fd, struct file *file, int on)
+{
+        struct rtc_device *rtc = file->private_data;
+        return fasync_helper(fd, file, on, &rtc->async_queue);
+}
 static int rtc_dev_release(struct inode *inode, struct file *file)
 {
        struct rtc_device *rtc = file->private_data;
@@ -434,16 +440,13 @@ static int rtc_dev_release(struct inode *inode, struct file *file)
        if (rtc->ops->release)
                rtc->ops->release(rtc->dev.parent);
+        if (file->f_flags & FASYNC)
+                rtc_dev_fasync(-1, file, 0);
        clear_bit_unlock(RTC_DEV_BUSY, &rtc->flags);
        return 0;
 }
-static int rtc_dev_fasync(int fd, struct file *file, int on)
-{
-        struct rtc_device *rtc = file->private_data;
-        return fasync_helper(fd, file, on, &rtc->async_queue);
-}
 static const struct file_operations rtc_dev_fops = {
        .owner          = THIS_MODULE,
        .llseek         = no_llseek,
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index e0ce65fca4e7..9a50f245774b 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -113,7 +113,8 @@ ccwgroup_release (struct device *dev)
        for (i = 0; i < gdev->count; i++) {
                if (gdev->cdev[i]) {
-                        dev_set_drvdata(&gdev->cdev[i]->dev, NULL);
+                        if (dev_get_drvdata(&gdev->cdev[i]->dev) == gdev)
+                                dev_set_drvdata(&gdev->cdev[i]->dev, NULL);
                        put_device(&gdev->cdev[i]->dev);
                }
        }
@@ -296,6 +297,7 @@ error:
                        if (dev_get_drvdata(&gdev->cdev[i]->dev) == gdev)
                                dev_set_drvdata(&gdev->cdev[i]->dev, NULL);
                        put_device(&gdev->cdev[i]->dev);
+                        gdev->cdev[i] = NULL;
                }
        mutex_unlock(&gdev->reg_mutex);
        put_device(&gdev->dev);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 5954b905e3ca..326f4cc7f92c 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -174,6 +174,7 @@ cio_start_key (struct subchannel *sch,	/* subchannel structure */
        CIO_TRACE_EVENT(4, sch->dev.bus_id);
        orb = &to_io_private(sch)->orb;
+        memset(orb, 0, sizeof(union orb));
        /* sch is always under 2G. */
        orb->cmd.intparm = (u32)(addr_t)sch;
        orb->cmd.fmt = 1;
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 1679e2f91c94..a0b6b46e7466 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -447,51 +447,36 @@ void qdio_print_subchannel_info(struct qdio_irq *irq_ptr,
 {
        char s[80];
-        sprintf(s, "%s sc:%x ", cdev->dev.bus_id, irq_ptr->schid.sch_no);
+        sprintf(s, "qdio: %s ", dev_name(&cdev->dev));
        switch (irq_ptr->qib.qfmt) {
        case QDIO_QETH_QFMT:
-                sprintf(s + strlen(s), "OSADE ");
+                sprintf(s + strlen(s), "OSA ");
                break;
        case QDIO_ZFCP_QFMT:
                sprintf(s + strlen(s), "ZFCP ");
                break;
        case QDIO_IQDIO_QFMT:
-                sprintf(s + strlen(s), "HiperSockets ");
+                sprintf(s + strlen(s), "HS ");
                break;
        }
-        sprintf(s + strlen(s), "using: ");
+        sprintf(s + strlen(s), "on SC %x using ", irq_ptr->schid.sch_no);
+        sprintf(s + strlen(s), "AI:%d ", is_thinint_irq(irq_ptr));
-        if (!is_thinint_irq(irq_ptr))
+        sprintf(s + strlen(s), "QEBSM:%d ", (irq_ptr->sch_token) ? 1 : 0);
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "PCI:%d ",
-        sprintf(s + strlen(s), "AdapterInterrupts ");
+                (irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED) ? 1 : 0);
-        if (!(irq_ptr->sch_token != 0))
+        sprintf(s + strlen(s), "TDD:%d ", css_general_characteristics.aif_tdd);
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "SIGA:");
-        sprintf(s + strlen(s), "QEBSM ");
+        sprintf(s + strlen(s), "%s", (irq_ptr->siga_flag.input) ? "R" : " ");
-        if (!(irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED))
+        sprintf(s + strlen(s), "%s", (irq_ptr->siga_flag.output) ? "W" : " ");
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "%s", (irq_ptr->siga_flag.sync) ? "S" : " ");
-        sprintf(s + strlen(s), "OutboundPCI ");
+        sprintf(s + strlen(s), "%s",
-        if (!css_general_characteristics.aif_tdd)
+                (!irq_ptr->siga_flag.no_sync_ti) ? "A" : " ");
-                sprintf(s + strlen(s), "no");
+        sprintf(s + strlen(s), "%s",
-        sprintf(s + strlen(s), "TDD\n");
+                (!irq_ptr->siga_flag.no_sync_out_ti) ? "O" : " ");
-        printk(KERN_INFO "qdio: %s", s);
+        sprintf(s + strlen(s), "%s",
+                (!irq_ptr->siga_flag.no_sync_out_pci) ? "P" : " ");
-        memset(s, 0, sizeof(s));
-        sprintf(s, "%s SIGA required: ", cdev->dev.bus_id);
-        if (irq_ptr->siga_flag.input)
-                sprintf(s + strlen(s), "Read ");
-        if (irq_ptr->siga_flag.output)
-                sprintf(s + strlen(s), "Write ");
-        if (irq_ptr->siga_flag.sync)
-                sprintf(s + strlen(s), "Sync ");
-        if (!irq_ptr->siga_flag.no_sync_ti)
-                sprintf(s + strlen(s), "SyncAI ");
-        if (!irq_ptr->siga_flag.no_sync_out_ti)
-                sprintf(s + strlen(s), "SyncOutAI ");
-        if (!irq_ptr->siga_flag.no_sync_out_pci)
-                sprintf(s + strlen(s), "SyncOutPCI");
        sprintf(s + strlen(s), "\n");
-        printk(KERN_INFO "qdio: %s", s);
+        printk(KERN_INFO "%s", s);
 }
 int __init qdio_setup_init(void)
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index 391dd29749f8..51b6a05f4d12 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -152,10 +152,8 @@ static int zfcp_ccw_set_offline(struct ccw_device *ccw_device)
 */
 static int zfcp_ccw_notify(struct ccw_device *ccw_device, int event)
 {
-        struct zfcp_adapter *adapter;
+        struct zfcp_adapter *adapter = dev_get_drvdata(&ccw_device->dev);
-        down(&zfcp_data.config_sema);
-        adapter = dev_get_drvdata(&ccw_device->dev);
        switch (event) {
        case CIO_GONE:
                dev_warn(&adapter->ccw_device->dev, "device gone\n");
@@ -174,8 +172,6 @@ static int zfcp_ccw_notify(struct ccw_device *ccw_device, int event)
                                        89, NULL);
                break;
        }
-        zfcp_erp_wait(adapter);
-        up(&zfcp_data.config_sema);
        return 1;
 }
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index e984469bb98b..56196c98c07b 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -39,18 +39,6 @@ struct zfcp_gpn_ft {
        struct scatterlist sg_resp[ZFCP_GPN_FT_BUFFERS];
 };
-static struct zfcp_port *zfcp_get_port_by_did(struct zfcp_adapter *adapter,
-                                              u32 d_id)
-{
-        struct zfcp_port *port;
-        list_for_each_entry(port, &adapter->port_list_head, list)
-                if ((port->d_id == d_id) &&
-                    !atomic_test_mask(ZFCP_STATUS_COMMON_REMOVE, &port->status))
-                        return port;
-        return NULL;
-}
 static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
                                   struct fcp_rscn_element *elem)
 {
@@ -341,12 +329,13 @@ void zfcp_test_link(struct zfcp_port *port)
        zfcp_port_get(port);
        retval = zfcp_fc_adisc(port);
-        if (retval == 0 || retval == -EBUSY)
+        if (retval == 0)
                return;
        /* send of ADISC was not possible */
        zfcp_port_put(port);
-        zfcp_erp_port_forced_reopen(port, 0, 65, NULL);
+        if (retval != -EBUSY)
+                zfcp_erp_port_forced_reopen(port, 0, 65, NULL);
 }
 static int zfcp_scan_get_nameserver(struct zfcp_adapter *adapter)
@@ -363,7 +352,6 @@ static int zfcp_scan_get_nameserver(struct zfcp_adapter *adapter)
                if (ret)
                        return ret;
                zfcp_erp_wait(adapter);
-                zfcp_port_put(adapter->nameserver_port);
        }
        return !atomic_test_mask(ZFCP_STATUS_COMMON_UNBLOCKED,
                                  &adapter->nameserver_port->status);
@@ -475,7 +463,7 @@ static int zfcp_scan_eval_gpn_ft(struct zfcp_gpn_ft *gpn_ft)
        struct zfcp_adapter *adapter = ct->port->adapter;
        struct zfcp_port *port, *tmp;
        u32 d_id;
-        int ret = 0, x;
+        int ret = 0, x, last = 0;
        if (ct->status)
                return -EIO;
@@ -492,19 +480,24 @@ static int zfcp_scan_eval_gpn_ft(struct zfcp_gpn_ft *gpn_ft)
        down(&zfcp_data.config_sema);
        /* first entry is the header */
-        for (x = 1; x < ZFCP_GPN_FT_MAX_ENTRIES; x++) {
+        for (x = 1; x < ZFCP_GPN_FT_MAX_ENTRIES && !last; x++) {
                if (x % (ZFCP_GPN_FT_ENTRIES + 1))
                        acc++;
                else
                        acc = sg_virt(++sg);
+                last = acc->control & 0x80;
                d_id = acc->port_id[0] << 16 | acc->port_id[1] << 8 |
                       acc->port_id[2];
                /* skip the adapter's port and known remote ports */
-                if (acc->wwpn == fc_host_port_name(adapter->scsi_host) ||
+                if (acc->wwpn == fc_host_port_name(adapter->scsi_host))
-                     zfcp_get_port_by_did(adapter, d_id))
+                        continue;
+                port = zfcp_get_port_by_wwpn(adapter, acc->wwpn);
+                if (port) {
+                        zfcp_port_get(port);
                        continue;
+                }
                port = zfcp_port_enqueue(adapter, acc->wwpn,
                                         ZFCP_STATUS_PORT_DID_DID |
@@ -513,8 +506,6 @@ static int zfcp_scan_eval_gpn_ft(struct zfcp_gpn_ft *gpn_ft)
                        ret = PTR_ERR(port);
                else
                        zfcp_erp_port_reopen(port, 0, 149, NULL);
-                if (acc->control & 0x80) /* last entry */
-                        break;
        }
        zfcp_erp_wait(adapter);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 19c1ca913874..49dbeb754e5f 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -710,10 +710,10 @@ static void zfcp_fsf_exchange_port_data_handler(struct zfcp_fsf_req *req)
 static int zfcp_fsf_sbal_check(struct zfcp_qdio_queue *queue)
 {
-        spin_lock(&queue->lock);
+        spin_lock_bh(&queue->lock);
        if (atomic_read(&queue->count))
                return 1;
-        spin_unlock(&queue->lock);
+        spin_unlock_bh(&queue->lock);
        return 0;
 }
@@ -722,13 +722,13 @@ static int zfcp_fsf_req_sbal_get(struct zfcp_adapter *adapter)
        long ret;
        struct zfcp_qdio_queue *req_q = &adapter->req_q;
-        spin_unlock(&req_q->lock);
+        spin_unlock_bh(&req_q->lock);
        ret = wait_event_interruptible_timeout(adapter->request_wq,
                                        zfcp_fsf_sbal_check(req_q), 5 * HZ);
        if (ret > 0)
                return 0;
-        spin_lock(&req_q->lock);
+        spin_lock_bh(&req_q->lock);
        return -EIO;
 }
@@ -870,14 +870,14 @@ int zfcp_fsf_status_read(struct zfcp_adapter *adapter)
        volatile struct qdio_buffer_element *sbale;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_UNSOLICITED_STATUS,
                                  ZFCP_REQ_NO_QTCB,
                                  adapter->pool.fsf_req_status_read);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -910,7 +910,7 @@ failed_buf:
        zfcp_fsf_req_free(req);
        zfcp_hba_dbf_event_fsf_unsol("fail", adapter, NULL);
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -988,7 +988,7 @@ struct zfcp_fsf_req *zfcp_fsf_abort_fcp_command(unsigned long old_req_id,
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_ABORT_FCP_CMND,
                                  req_flags, adapter->pool.fsf_req_abort);
-        if (unlikely(IS_ERR(req)))
+        if (IS_ERR(req))
                goto out;
        if (unlikely(!(atomic_read(&unit->status) &
@@ -1106,13 +1106,13 @@ int zfcp_fsf_send_ct(struct zfcp_send_ct *ct, mempool_t *pool,
        struct zfcp_fsf_req *req;
        int ret = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_SEND_GENERIC,
                                  ZFCP_REQ_AUTO_CLEANUP, pool);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                ret = PTR_ERR(req);
                goto out;
        }
@@ -1148,7 +1148,7 @@ failed_send:
        if (erp_action)
                erp_action->fsf_req = NULL;
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return ret;
 }
@@ -1223,7 +1223,7 @@ int zfcp_fsf_send_els(struct zfcp_send_els *els)
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_SEND_ELS,
                                  ZFCP_REQ_AUTO_CLEANUP, NULL);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                ret = PTR_ERR(req);
                goto out;
        }
@@ -1263,14 +1263,14 @@ int zfcp_fsf_exchange_config_data(struct zfcp_erp_action *erp_action)
        struct zfcp_adapter *adapter = erp_action->adapter;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (!atomic_read(&adapter->req_q.count))
                goto out;
        req = zfcp_fsf_req_create(adapter,
                                  FSF_QTCB_EXCHANGE_CONFIG_DATA,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1295,7 +1295,7 @@ int zfcp_fsf_exchange_config_data(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -1306,13 +1306,13 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter,
        struct zfcp_fsf_req *req = NULL;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_CONFIG_DATA,
                                  0, NULL);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1334,7 +1334,7 @@ int zfcp_fsf_exchange_config_data_sync(struct zfcp_adapter *adapter,
        zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
        retval = zfcp_fsf_req_send(req);
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        if (!retval)
                wait_event(req->completion_wq,
                           req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
@@ -1359,13 +1359,13 @@ int zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action)
        if (!(adapter->adapter_features & FSF_FEATURE_HBAAPI_MANAGEMENT))
                return -EOPNOTSUPP;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (!atomic_read(&adapter->req_q.count))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1385,7 +1385,7 @@ int zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -1405,13 +1405,13 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter,
        if (!(adapter->adapter_features & FSF_FEATURE_HBAAPI_MANAGEMENT))
                return -EOPNOTSUPP;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (!atomic_read(&adapter->req_q.count))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_EXCHANGE_PORT_DATA, 0,
                                  NULL);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1427,7 +1427,7 @@ int zfcp_fsf_exchange_port_data_sync(struct zfcp_adapter *adapter,
        zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
        retval = zfcp_fsf_req_send(req);
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        if (!retval)
                wait_event(req->completion_wq,
                           req->status & ZFCP_STATUS_FSFREQ_COMPLETED);
@@ -1531,7 +1531,7 @@ int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action)
        struct zfcp_fsf_req *req;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
@@ -1539,7 +1539,7 @@ int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action)
                                  FSF_QTCB_OPEN_PORT_WITH_DID,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1562,7 +1562,7 @@ int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -1603,14 +1603,14 @@ int zfcp_fsf_close_port(struct zfcp_erp_action *erp_action)
        struct zfcp_fsf_req *req;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_CLOSE_PORT,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1633,7 +1633,7 @@ int zfcp_fsf_close_port(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -1700,14 +1700,14 @@ int zfcp_fsf_close_physical_port(struct zfcp_erp_action *erp_action)
        struct zfcp_fsf_req *req;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_CLOSE_PHYSICAL_PORT,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1731,7 +1731,7 @@ int zfcp_fsf_close_physical_port(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -1875,14 +1875,14 @@ int zfcp_fsf_open_unit(struct zfcp_erp_action *erp_action)
        struct zfcp_fsf_req *req;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_OPEN_LUN,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1910,7 +1910,7 @@ int zfcp_fsf_open_unit(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -1965,13 +1965,13 @@ int zfcp_fsf_close_unit(struct zfcp_erp_action *erp_action)
        struct zfcp_fsf_req *req;
        int retval = -EIO;
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_CLOSE_LUN,
                                  ZFCP_REQ_AUTO_CLEANUP,
                                  adapter->pool.fsf_req_erp);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -1995,7 +1995,7 @@ int zfcp_fsf_close_unit(struct zfcp_erp_action *erp_action)
                erp_action->fsf_req = NULL;
        }
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        return retval;
 }
@@ -2228,7 +2228,7 @@ int zfcp_fsf_send_fcp_command_task(struct zfcp_adapter *adapter,
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_FCP_CMND, req_flags,
                                  adapter->pool.fsf_req_scsi);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = PTR_ERR(req);
                goto out;
        }
@@ -2351,7 +2351,7 @@ struct zfcp_fsf_req *zfcp_fsf_send_fcp_ctm(struct zfcp_adapter *adapter,
                goto out;
        req = zfcp_fsf_req_create(adapter, FSF_QTCB_FCP_CMND, req_flags,
                                  adapter->pool.fsf_req_scsi);
-        if (unlikely(IS_ERR(req)))
+        if (IS_ERR(req))
                goto out;
        req->status |= ZFCP_STATUS_FSFREQ_TASK_MANAGEMENT;
@@ -2417,12 +2417,12 @@ struct zfcp_fsf_req *zfcp_fsf_control_file(struct zfcp_adapter *adapter,
                return ERR_PTR(-EINVAL);
        }
-        spin_lock(&adapter->req_q.lock);
+        spin_lock_bh(&adapter->req_q.lock);
        if (zfcp_fsf_req_sbal_get(adapter))
                goto out;
        req = zfcp_fsf_req_create(adapter, fsf_cfdc->command, 0, NULL);
-        if (unlikely(IS_ERR(req))) {
+        if (IS_ERR(req)) {
                retval = -EPERM;
                goto out;
        }
@@ -2447,7 +2447,7 @@ struct zfcp_fsf_req *zfcp_fsf_control_file(struct zfcp_adapter *adapter,
        zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
        retval = zfcp_fsf_req_send(req);
 out:
-        spin_unlock(&adapter->req_q.lock);
+        spin_unlock_bh(&adapter->req_q.lock);
        if (!retval) {
                wait_event(req->completion_wq,
diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
index d6dbd653fde9..69d632d851d9 100644
--- a/drivers/s390/scsi/zfcp_qdio.c
+++ b/drivers/s390/scsi/zfcp_qdio.c
@@ -423,9 +423,9 @@ void zfcp_qdio_close(struct zfcp_adapter *adapter)
        /* clear QDIOUP flag, thus do_QDIO is not called during qdio_shutdown */
        req_q = &adapter->req_q;
-        spin_lock(&req_q->lock);
+        spin_lock_bh(&req_q->lock);
        atomic_clear_mask(ZFCP_STATUS_ADAPTER_QDIOUP, &adapter->status);
-        spin_unlock(&req_q->lock);
+        spin_unlock_bh(&req_q->lock);
        qdio_shutdown(adapter->ccw_device, QDIO_FLAG_CLEANUP_USING_CLEAR);
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index c7f06298bd3c..4e0322b1c1ea 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -63,7 +63,7 @@ comment "SCSI support type (disk, tape, CD-ROM)"
 config BLK_DEV_SD
        tristate "SCSI disk support"
        depends on SCSI
-        select CRC_T10DIF
+        select CRC_T10DIF if BLK_DEV_INTEGRITY
        ---help---
          If you want to use SCSI hard disks, Fibre Channel disks,
          Serial ATA (SATA) or Parallel ATA (PATA) hard disks,
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 994da56fffed..708e475896b9 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -425,7 +425,7 @@ static int alua_check_sense(struct scsi_device *sdev,
                        /*
                         * LUN Not Accessible - ALUA state transition
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0b)
                        /*
                         * LUN Not Accessible -- Target port in standby state
@@ -447,18 +447,18 @@ static int alua_check_sense(struct scsi_device *sdev,
                        /*
                         * Power On, Reset, or Bus Device Reset, just retry.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                if (sense_hdr->asc == 0x2a && sense_hdr->ascq == 0x06) {
                        /*
                         * ALUA state changed
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                }
                if (sense_hdr->asc == 0x2a && sense_hdr->ascq == 0x07) {
                        /*
                         * Implicit ALUA state transition failed
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                }
                break;
        }
@@ -490,7 +490,7 @@ static int alua_stpg(struct scsi_device *sdev, int state,
                if (!err)
                        return SCSI_DH_IO;
                err = alua_check_sense(sdev, &sense_hdr);
-                if (retry > 0 && err == NEEDS_RETRY) {
+                if (retry > 0 && err == ADD_TO_MLQUEUE) {
                        retry--;
                        goto retry;
                }
@@ -535,7 +535,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_dh_data *h)
                        return SCSI_DH_IO;
                err = alua_check_sense(sdev, &sense_hdr);
-                if (err == NEEDS_RETRY)
+                if (err == ADD_TO_MLQUEUE)
                        goto retry;
                sdev_printk(KERN_INFO, sdev,
                            "%s: rtpg sense code %02x/%02x/%02x\n",
diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c
index b9d23e9e9a44..ef693e8412e9 100644
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -439,7 +439,7 @@ static int clariion_check_sense(struct scsi_device *sdev,
                         * Unit Attention Code. This is the first IO
                         * to the new path, so just retry.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                break;
        }
@@ -514,7 +514,7 @@ retry:
                        return SCSI_DH_IO;
                err = clariion_check_sense(sdev, &sshdr);
-                if (retry > 0 && err == NEEDS_RETRY) {
+                if (retry > 0 && err == ADD_TO_MLQUEUE) {
                        retry--;
                        goto retry;
                }
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 2dee69da35cf..6e2f130d56de 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -551,7 +551,7 @@ static int rdac_check_sense(struct scsi_device *sdev,
                         *
                         * Just retry and wait.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                break;
        case ILLEGAL_REQUEST:
                if (sense_hdr->asc == 0x94 && sense_hdr->ascq == 0x01) {
@@ -568,7 +568,7 @@ static int rdac_check_sense(struct scsi_device *sdev,
                        /*
                         * Power On, Reset, or Bus Device Reset, just retry.
                         */
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                break;
        }
        /* success just means we do not care what scsi-ml does */
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 48ee8c7f5bdd..e1872989710a 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -294,10 +294,10 @@ static void sas_ata_post_internal(struct ata_queued_cmd *qc)
        }
 }
-static int sas_ata_scr_write(struct ata_port *ap, unsigned int sc_reg_in,
+static int sas_ata_scr_write(struct ata_link *link, unsigned int sc_reg_in,
                              u32 val)
 {
-        struct domain_device *dev = ap->private_data;
+        struct domain_device *dev = link->ap->private_data;
        SAS_DPRINTK("STUB %s\n", __func__);
        switch (sc_reg_in) {
@@ -319,10 +319,10 @@ static int sas_ata_scr_write(struct ata_port *ap, unsigned int sc_reg_in,
        return 0;
 }
-static int sas_ata_scr_read(struct ata_port *ap, unsigned int sc_reg_in,
+static int sas_ata_scr_read(struct ata_link *link, unsigned int sc_reg_in,
                            u32 *val)
 {
-        struct domain_device *dev = ap->private_data;
+        struct domain_device *dev = link->ap->private_data;
        SAS_DPRINTK("STUB %s\n", __func__);
        switch (sc_reg_in) {
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 45a3b93eed57..bf41887cdd65 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1834,7 +1834,6 @@ clear_risc_ints:
                WRT_REG_WORD(&reg->isp.hccr, HCCR_CLR_HOST_INT);
        }
        spin_unlock_irq(&ha->hardware_lock);
-        ha->isp_ops->enable_intrs(ha);
 fail:
        return ret;
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 26afe44265c7..6d0f0e5f2827 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1740,6 +1740,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
        if (ret)
                goto probe_failed;
+        ha->isp_ops->enable_intrs(ha);
        scsi_scan_host(host);
        qla2x00_alloc_sysfs_attr(ha);
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 4a1cf6377f6c..905350896725 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -914,6 +914,7 @@ static inline int load_cmd(struct scsi_cmnd *Cmnd, struct Command_Entry *cmd,
                                ds[i].d_count = sg_dma_len(s);
                        }
                        sg_count -= n;
+                        sg = s;
                }
        } else {
                cmd->dataseg[0].d_base = 0;
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 880051c89bde..39ce3aba1dac 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -391,7 +391,7 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
        case HARDWARE_ERROR:
                if (scmd->device->retry_hwerror)
-                        return NEEDS_RETRY;
+                        return ADD_TO_MLQUEUE;
                else
                        return SUCCESS;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ff5d56b3ee4d..62307bd794a9 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -852,7 +852,7 @@ static void scsi_end_bidi_request(struct scsi_cmnd *cmd)
 void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 {
        int result = cmd->result;
-        int this_count = scsi_bufflen(cmd);
+        int this_count;
        struct request_queue *q = cmd->device->request_queue;
        struct request *req = cmd->request;
        int error = 0;
@@ -908,6 +908,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
         */
        if (scsi_end_request(cmd, error, good_bytes, result == 0) == NULL)
                return;
+        this_count = blk_rq_bytes(req);
        /* good_bytes = 0, or (inclusive) there were leftovers and
         * result = 0, so scsi_end_request couldn't retry.
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 84b4879cff11..34d0de6cd511 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1080,7 +1080,8 @@ static int scsi_probe_and_add_lun(struct scsi_target *starget,
         * PDT=1Fh none (no FDD connected to the requested logical unit)
         */
        if (((result[0] >> 5) == 1 || starget->pdt_1f_for_no_lun) &&
-             (result[0] & 0x1f) == 0x1f) {
+            (result[0] & 0x1f) == 0x1f &&
+            !scsi_is_wlun(lun)) {
                SCSI_LOG_SCAN_BUS(3, printk(KERN_INFO
                                        "scsi scan: peripheral device type"
                                        " of 31, no device added\n"));
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 2a2bc89aba83..e5e7d7856454 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1875,7 +1875,6 @@ static int sd_probe(struct device *dev)
        dev_set_drvdata(dev, sdkp);
        add_disk(gd);
-        blk_register_filter(gd);
        sd_dif_config_host(sdkp);
        sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
@@ -1909,7 +1908,6 @@ static int sd_remove(struct device *dev)
        struct scsi_disk *sdkp = dev_get_drvdata(dev);
        device_del(&sdkp->dev);
-        blk_unregister_filter(sdkp->disk);
        del_gendisk(sdkp->disk);
        sd_shutdown(dev);
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 3292965bfd84..27f5bfd1def3 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -656,7 +656,6 @@ static int sr_probe(struct device *dev)
        dev_set_drvdata(dev, cd);
        disk->flags |= GENHD_FL_REMOVABLE;
        add_disk(disk);
-        blk_register_filter(disk);
        sdev_printk(KERN_DEBUG, sdev,
                    "Attached scsi CD-ROM %s\n", cd->cdi.name);
@@ -895,7 +894,6 @@ static int sr_remove(struct device *dev)
 {
        struct scsi_cd *cd = dev_get_drvdata(dev);
-        blk_unregister_filter(cd->disk);
        del_gendisk(cd->disk);
        mutex_lock(&sr_ref_mutex);
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index 3a6da80b081c..61fb8b6d19af 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -131,7 +131,8 @@ struct atmel_uart_char {
 struct atmel_uart_port {
        struct uart_port        uart;           /* uart */
        struct clk              *clk;           /* uart clock */
-        unsigned short          suspended;      /* is port suspended? */
+        int                     may_wakeup;     /* cached value of device_may_wakeup for times we need to disable it */
+        u32                     backup_imr;     /* IMR saved during suspend */
        int                     break_active;   /* break being received */
        short                   use_dma_rx;     /* enable PDC receiver */
@@ -984,8 +985,15 @@ static void atmel_serial_pm(struct uart_port *port, unsigned int state,
                 * This is called on uart_open() or a resume event.
                 */
                clk_enable(atmel_port->clk);
+                /* re-enable interrupts if we disabled some on suspend */
+                UART_PUT_IER(port, atmel_port->backup_imr);
                break;
        case 3:
+                /* Back up the interrupt mask and disable all interrupts */
+                atmel_port->backup_imr = UART_GET_IMR(port);
+                UART_PUT_IDR(port, -1);
                /*
                 * Disable the peripheral clock for this serial port.
                 * This is called on uart_close() or a suspend event.
@@ -1475,13 +1483,12 @@ static int atmel_serial_suspend(struct platform_device *pdev,
                        cpu_relax();
        }
-        if (device_may_wakeup(&pdev->dev)
+        /* we can not wake up if we're running on slow clock */
-            && !atmel_serial_clk_will_stop())
+        atmel_port->may_wakeup = device_may_wakeup(&pdev->dev);
-                enable_irq_wake(port->irq);
+        if (atmel_serial_clk_will_stop())
-        else {
+                device_set_wakeup_enable(&pdev->dev, 0);
-                uart_suspend_port(&atmel_uart, port);
-                atmel_port->suspended = 1;
+        uart_suspend_port(&atmel_uart, port);
-        }
        return 0;
 }
@@ -1491,11 +1498,8 @@ static int atmel_serial_resume(struct platform_device *pdev)
        struct uart_port *port = platform_get_drvdata(pdev);
        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
-        if (atmel_port->suspended) {
+        uart_resume_port(&atmel_uart, port);
-                uart_resume_port(&atmel_uart, port);
+        device_set_wakeup_enable(&pdev->dev, atmel_port->may_wakeup);
-                atmel_port->suspended = 0;
-        } else
-                disable_irq_wake(port->irq);
        return 0;
 }
@@ -1513,6 +1517,8 @@ static int __devinit atmel_serial_probe(struct platform_device *pdev)
        BUILD_BUG_ON(!is_power_of_2(ATMEL_SERIAL_RINGSIZE));
        port = &atmel_ports[pdev->id];
+        port->backup_imr = 0;
        atmel_init_port(port, pdev);
        if (!atmel_use_dma_rx(&port->uart)) {
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 6a29f9330a73..3f90f1bbbbcd 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -127,8 +127,13 @@
 #define  UCR3_RXDSEN     (1<<6)  /* Receive status interrupt enable */
 #define  UCR3_AIRINTEN   (1<<5)  /* Async IR wake interrupt enable */
 #define  UCR3_AWAKEN     (1<<4)  /* Async wake interrupt enable */
-#define  UCR3_REF25      (1<<3)  /* Ref freq 25 MHz */
+#ifdef CONFIG_ARCH_IMX
-#define  UCR3_REF30      (1<<2)  /* Ref Freq 30 MHz */
+#define  UCR3_REF25      (1<<3)  /* Ref freq 25 MHz, only on mx1 */
+#define  UCR3_REF30      (1<<2)  /* Ref Freq 30 MHz, only on mx1 */
+#endif
+#if defined CONFIG_ARCH_MX2 || defined CONFIG_ARCH_MX3
+#define  UCR3_RXDMUXSEL  (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
+#endif
 #define  UCR3_INVT       (1<<1)  /* Inverted Infrared transmission */
 #define  UCR3_BPEN       (1<<0)  /* Preset registers enable */
 #define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
@@ -445,7 +450,7 @@ static irqreturn_t imx_int(int irq, void *dev_id)
                        readl(sport->port.membase + UCR1) & UCR1_TXMPTYEN)
                imx_txint(irq, dev_id);
-        if (sts & USR1_RTSS)
+        if (sts & USR1_RTSD)
                imx_rtsint(irq, dev_id);
        return IRQ_HANDLED;
@@ -598,6 +603,12 @@ static int imx_startup(struct uart_port *port)
        temp |= (UCR2_RXEN | UCR2_TXEN);
        writel(temp, sport->port.membase + UCR2);
+#if defined CONFIG_ARCH_MX2 || defined CONFIG_ARCH_MX3
+        temp = readl(sport->port.membase + UCR3);
+        temp |= UCR3_RXDMUXSEL;
+        writel(temp, sport->port.membase + UCR3);
+#endif
        /*
         * Enable modem status interrupts
         */
@@ -1133,13 +1144,19 @@ static int serial_imx_probe(struct platform_device *pdev)
        if(pdata && (pdata->flags & IMXUART_HAVE_RTSCTS))
                sport->have_rtscts = 1;
-        if (pdata->init)
+        if (pdata->init) {
-                pdata->init(pdev);
+                ret = pdata->init(pdev);
+                if (ret)
+                        goto clkput;
+        }
        uart_add_one_port(&imx_reg, &sport->port);
        platform_set_drvdata(pdev, &sport->port);
        return 0;
+clkput:
+        clk_put(sport->clk);
+        clk_disable(sport->clk);
 unmap:
        iounmap(sport->port.membase);
 free:
diff --git a/drivers/spi/orion_spi.c b/drivers/spi/orion_spi.c
index c4eaacd6e553..b872bfaf4bd2 100644
--- a/drivers/spi/orion_spi.c
+++ b/drivers/spi/orion_spi.c
@@ -427,7 +427,7 @@ static int orion_spi_transfer(struct spi_device *spi, struct spi_message *m)
                        goto msg_rejected;
                }
-                if (t->speed_hz < orion_spi->min_speed) {
+                if (t->speed_hz && t->speed_hz < orion_spi->min_speed) {
                        dev_err(&spi->dev,
                                "message rejected : "
                                "device min speed (%d Hz) exceeds "
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 34c7c9875681..d47d3636227f 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -47,9 +47,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
 #define MAX_BUSES 3
-#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
+#define DMA_INT_MASK            (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
-#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
+#define RESET_DMA_CHANNEL       (DCSR_NODESC | DMA_INT_MASK)
-#define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
+#define IS_DMA_ALIGNED(x)       ((((u32)(x)) & 0x07) == 0)
+#define MAX_DMA_LEN             8191
 /*
 * for testing SSCR1 changes that require SSP restart, basically
@@ -144,7 +145,6 @@ struct driver_data {
        size_t tx_map_len;
        u8 n_bytes;
        u32 dma_width;
-        int cs_change;
        int (*write)(struct driver_data *drv_data);
        int (*read)(struct driver_data *drv_data);
        irqreturn_t (*transfer_handler)(struct driver_data *drv_data);
@@ -406,8 +406,45 @@ static void giveback(struct driver_data *drv_data)
                                        struct spi_transfer,
                                        transfer_list);
+        /* Delay if requested before any change in chip select */
+        if (last_transfer->delay_usecs)
+                udelay(last_transfer->delay_usecs);
+        /* Drop chip select UNLESS cs_change is true or we are returning
+         * a message with an error, or next message is for another chip
+         */
        if (!last_transfer->cs_change)
                drv_data->cs_control(PXA2XX_CS_DEASSERT);
+        else {
+                struct spi_message *next_msg;
+                /* Holding of cs was hinted, but we need to make sure
+                 * the next message is for the same chip.  Don't waste
+                 * time with the following tests unless this was hinted.
+                 *
+                 * We cannot postpone this until pump_messages, because
+                 * after calling msg->complete (below) the driver that
+                 * sent the current message could be unloaded, which
+                 * could invalidate the cs_control() callback...
+                 */
+                /* get a pointer to the next message, if any */
+                spin_lock_irqsave(&drv_data->lock, flags);
+                if (list_empty(&drv_data->queue))
+                        next_msg = NULL;
+                else
+                        next_msg = list_entry(drv_data->queue.next,
+                                        struct spi_message, queue);
+                spin_unlock_irqrestore(&drv_data->lock, flags);
+                /* see if the next and current messages point
+                 * to the same chip
+                 */
+                if (next_msg && next_msg->spi != msg->spi)
+                        next_msg = NULL;
+                if (!next_msg || msg->state == ERROR_STATE)
+                        drv_data->cs_control(PXA2XX_CS_DEASSERT);
+        }
        msg->state = NULL;
        if (msg->complete)
@@ -490,10 +527,9 @@ static void dma_transfer_complete(struct driver_data *drv_data)
        msg->actual_length += drv_data->len -
                                (drv_data->rx_end - drv_data->rx);
-        /* Release chip select if requested, transfer delays are
+        /* Transfer delays and chip select release are
-         * handled in pump_transfers */
+         * handled in pump_transfers or giveback
-        if (drv_data->cs_change)
+         */
-                drv_data->cs_control(PXA2XX_CS_DEASSERT);
        /* Move to next transfer */
        msg->state = next_transfer(drv_data);
@@ -602,10 +638,9 @@ static void int_transfer_complete(struct driver_data *drv_data)
        drv_data->cur_msg->actual_length += drv_data->len -
                                (drv_data->rx_end - drv_data->rx);
-        /* Release chip select if requested, transfer delays are
+        /* Transfer delays and chip select release are
-         * handled in pump_transfers */
+         * handled in pump_transfers or giveback
-        if (drv_data->cs_change)
+         */
-                drv_data->cs_control(PXA2XX_CS_DEASSERT);
        /* Move to next transfer */
        drv_data->cur_msg->state = next_transfer(drv_data);
@@ -840,23 +875,40 @@ static void pump_transfers(unsigned long data)
                return;
        }
-        /* Delay if requested at end of transfer*/
+        /* Delay if requested at end of transfer before CS change */
        if (message->state == RUNNING_STATE) {
                previous = list_entry(transfer->transfer_list.prev,
                                        struct spi_transfer,
                                        transfer_list);
                if (previous->delay_usecs)
                        udelay(previous->delay_usecs);
+                /* Drop chip select only if cs_change is requested */
+                if (previous->cs_change)
+                        drv_data->cs_control(PXA2XX_CS_DEASSERT);
        }
-        /* Check transfer length */
+        /* Check for transfers that need multiple DMA segments */
-        if (transfer->len > 8191)
+        if (transfer->len > MAX_DMA_LEN && chip->enable_dma) {
-        {
-                dev_warn(&drv_data->pdev->dev, "pump_transfers: transfer "
+                /* reject already-mapped transfers; PIO won't always work */
-                                "length greater than 8191\n");
+                if (message->is_dma_mapped
-                message->status = -EINVAL;
+                                || transfer->rx_dma || transfer->tx_dma) {
-                giveback(drv_data);
+                        dev_err(&drv_data->pdev->dev,
-                return;
+                                "pump_transfers: mapped transfer length "
+                                "of %u is greater than %d\n",
+                                transfer->len, MAX_DMA_LEN);
+                        message->status = -EINVAL;
+                        giveback(drv_data);
+                        return;
+                }
+                /* warn ... we force this to PIO mode */
+                if (printk_ratelimit())
+                        dev_warn(&message->spi->dev, "pump_transfers: "
+                                "DMA disabled for transfer length %ld "
+                                "greater than %d\n",
+                                (long)drv_data->len, MAX_DMA_LEN);
        }
        /* Setup the transfer state based on the type of transfer */
@@ -878,7 +930,6 @@ static void pump_transfers(unsigned long data)
        drv_data->len = transfer->len & DCMD_LENGTH;
        drv_data->write = drv_data->tx ? chip->write : null_writer;
        drv_data->read = drv_data->rx ? chip->read : null_reader;
-        drv_data->cs_change = transfer->cs_change;
        /* Change speed and bit per word on a per transfer */
        cr0 = chip->cr0;
@@ -925,7 +976,7 @@ static void pump_transfers(unsigned long data)
                                                        &dma_thresh))
                                if (printk_ratelimit())
                                        dev_warn(&message->spi->dev,
-                                                "pump_transfer: "
+                                                "pump_transfers: "
                                                "DMA burst size reduced to "
                                                "match bits_per_word\n");
                }
@@ -939,8 +990,23 @@ static void pump_transfers(unsigned long data)
        message->state = RUNNING_STATE;
-        /* Try to map dma buffer and do a dma transfer if successful */
+        /* Try to map dma buffer and do a dma transfer if successful, but
-        if ((drv_data->dma_mapped = map_dma_buffers(drv_data))) {
+         * only if the length is non-zero and less than MAX_DMA_LEN.
+         *
+         * Zero-length non-descriptor DMA is illegal on PXA2xx; force use
+         * of PIO instead.  Care is needed above because the transfer may
+         * have have been passed with buffers that are already dma mapped.
+         * A zero-length transfer in PIO mode will not try to write/read
+         * to/from the buffers
+         *
+         * REVISIT large transfers are exactly where we most want to be
+         * using DMA.  If this happens much, split those transfers into
+         * multiple DMA segments rather than forcing PIO.
+         */
+        drv_data->dma_mapped = 0;
+        if (drv_data->len > 0 && drv_data->len <= MAX_DMA_LEN)
+                drv_data->dma_mapped = map_dma_buffers(drv_data);
+        if (drv_data->dma_mapped) {
                /* Ensure we have the correct interrupt handler */
                drv_data->transfer_handler = dma_transfer;
diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index 070c6219e2d6..ac0e3e4b3c54 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -267,16 +267,13 @@ int mpc83xx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
        cs->hw_mode |= SPMODE_LEN(bits_per_word);
        if ((mpc83xx_spi->spibrg / hz) > 64) {
+                cs->hw_mode |= SPMODE_DIV16;
                pm = mpc83xx_spi->spibrg / (hz * 64);
                if (pm > 16) {
-                        cs->hw_mode |= SPMODE_DIV16;
+                        dev_err(&spi->dev, "Requested speed is too "
-                        pm /= 16;
+                                "low: %d Hz. Will use %d Hz instead.\n",
-                        if (pm > 16) {
+                                hz, mpc83xx_spi->spibrg / 1024);
-                                dev_err(&spi->dev, "Requested speed is too "
+                        pm = 16;
-                                        "low: %d Hz. Will use %d Hz instead.\n",
-                                        hz, mpc83xx_spi->spibrg / 1024);
-                                pm = 16;
-                        }
                }
        } else
                pm = mpc83xx_spi->spibrg / (hz * 4);
@@ -315,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
        if (t->bits_per_word)
                bits_per_word = t->bits_per_word;
        len = t->len;
-        if (bits_per_word > 8)
+        if (bits_per_word > 8) {
+                /* invalid length? */
+                if (len & 1)
+                        return -EINVAL;
                len /= 2;
-        if (bits_per_word > 16)
+        }
+        if (bits_per_word > 16) {
+                /* invalid length? */
+                if (len & 1)
+                        return -EINVAL;
                len /= 2;
+        }
        mpc83xx_spi->count = len;
        INIT_COMPLETION(mpc83xx_spi->done);
        /* enable rx ints */
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 98abc73c1a1d..3eb414b84a9d 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -430,7 +430,7 @@ static int s3c24xx_spi_resume(struct platform_device *pdev)
 #endif
 MODULE_ALIAS("platform:s3c2410-spi");
-static struct platform_driver s3c24xx_spidrv = {
+static struct platform_driver s3c24xx_spi_driver = {
        .remove         = __exit_p(s3c24xx_spi_remove),
        .suspend        = s3c24xx_spi_suspend,
        .resume         = s3c24xx_spi_resume,
@@ -442,12 +442,12 @@ static struct platform_driver s3c24xx_spidrv = {
 static int __init s3c24xx_spi_init(void)
 {
-        return platform_driver_probe(&s3c24xx_spidrv, s3c24xx_spi_probe);
+        return platform_driver_probe(&s3c24xx_spi_driver, s3c24xx_spi_probe);
 }
 static void __exit s3c24xx_spi_exit(void)
 {
-        platform_driver_unregister(&s3c24xx_spidrv);
+        platform_driver_unregister(&s3c24xx_spi_driver);
 }
 module_init(s3c24xx_spi_init);
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 87ab2443e66d..0ffabf5c0b60 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -471,6 +471,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #endif
                        break;
                case SSB_BUSTYPE_SSB:
+                        dev->dma_mask = &dev->coherent_dma_mask;
                        break;
                }
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 8abd4e59bf4a..8ab389dca2b9 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1876,7 +1876,8 @@ int usb_add_hcd(struct usb_hcd *hcd,
                 * with IRQF_SHARED. As usb_hcd_irq() will always disable
                 * interrupts we can remove it here.
                 */
-                irqflags &= ~IRQF_DISABLED;
+                if (irqflags & IRQF_SHARED)
+                        irqflags &= ~IRQF_DISABLED;
                snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
                                hcd->driver->description, hcd->self.busnum);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 6a5cb018383d..d99963873e37 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2683,35 +2683,17 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                                USB_PORT_STAT_C_ENABLE);
 #endif
-        /* Try to use the debounce delay for protection against
-         * port-enable changes caused, for example, by EMI.
-         */
-        if (portchange & (USB_PORT_STAT_C_CONNECTION |
-                                USB_PORT_STAT_C_ENABLE)) {
-                status = hub_port_debounce(hub, port1);
-                if (status < 0) {
-                        if (printk_ratelimit())
-                                dev_err (hub_dev, "connect-debounce failed, "
-                                                "port %d disabled\n", port1);
-                        portstatus &= ~USB_PORT_STAT_CONNECTION;
-                } else {
-                        portstatus = status;
-                }
-        }
        /* Try to resuscitate an existing device */
        udev = hdev->children[port1-1];
        if ((portstatus & USB_PORT_STAT_CONNECTION) && udev &&
                        udev->state != USB_STATE_NOTATTACHED) {
                usb_lock_device(udev);
                if (portstatus & USB_PORT_STAT_ENABLE) {
                        status = 0;             /* Nothing to do */
-                } else if (!udev->persist_enabled) {
-                        status = -ENODEV;       /* Mustn't resuscitate */
 #ifdef CONFIG_USB_SUSPEND
-                } else if (udev->state == USB_STATE_SUSPENDED) {
+                } else if (udev->state == USB_STATE_SUSPENDED &&
+                                udev->persist_enabled) {
                        /* For a suspended device, treat this as a
                         * remote wakeup event.
                         */
@@ -2726,7 +2708,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
 #endif
                } else {
-                        status = usb_reset_device(udev);
+                        status = -ENODEV;       /* Don't resuscitate */
                }
                usb_unlock_device(udev);
@@ -2741,6 +2723,19 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                usb_disconnect(&hdev->children[port1-1]);
        clear_bit(port1, hub->change_bits);
+        if (portchange & (USB_PORT_STAT_C_CONNECTION |
+                                USB_PORT_STAT_C_ENABLE)) {
+                status = hub_port_debounce(hub, port1);
+                if (status < 0) {
+                        if (printk_ratelimit())
+                                dev_err(hub_dev, "connect-debounce failed, "
+                                                "port %d disabled\n", port1);
+                        portstatus &= ~USB_PORT_STAT_CONNECTION;
+                } else {
+                        portstatus = status;
+                }
+        }
        /* Return now if debouncing failed or nothing is connected */
        if (!(portstatus & USB_PORT_STAT_CONNECTION)) {
@@ -2748,7 +2743,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                if ((wHubCharacteristics & HUB_CHAR_LPSM) < 2
                                && !(portstatus & (1 << USB_PORT_FEAT_POWER)))
                        set_port_feature(hdev, port1, USB_PORT_FEAT_POWER);
- 
                if (portstatus & USB_PORT_STAT_ENABLE)
                        goto done;
                return;
diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
index 1cfccf102a2d..45ad556169f1 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.c
+++ b/drivers/usb/gadget/fsl_usb2_udc.c
@@ -223,7 +223,7 @@ static int dr_controller_setup(struct fsl_udc *udc)
        fsl_writel(tmp, &dr_regs->endpointlistaddr);
        VDBG("vir[qh_base] is %p phy[qh_base] is 0x%8x reg is 0x%8x",
-                (int)udc->ep_qh, (int)tmp,
+                udc->ep_qh, (int)tmp,
                fsl_readl(&dr_regs->endpointlistaddr));
        /* Config PHY interface */
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 574c53831a05..bb54cca4c543 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -787,7 +787,7 @@ static void dma_channel_claim(struct omap_ep *ep, unsigned channel)
                        omap_set_dma_dest_params(ep->lch,
                                OMAP_DMA_PORT_TIPB,
                                OMAP_DMA_AMODE_CONSTANT,
-                                (unsigned long) io_v2p(UDC_DATA_DMA),
+                                UDC_DATA_DMA,
                                0, 0);
                }
        } else {
@@ -804,7 +804,7 @@ static void dma_channel_claim(struct omap_ep *ep, unsigned channel)
                        omap_set_dma_src_params(ep->lch,
                                OMAP_DMA_PORT_TIPB,
                                OMAP_DMA_AMODE_CONSTANT,
-                                (unsigned long) io_v2p(UDC_DATA_DMA),
+                                UDC_DATA_DMA,
                                0, 0);
                        /* EMIFF or SDRC */
                        omap_set_dma_dest_burst_mode(ep->lch,
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index d9d53f289caf..8409e0705d63 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -145,16 +145,6 @@ static int handshake (struct ehci_hcd *ehci, void __iomem *ptr,
        return -ETIMEDOUT;
 }
-static int handshake_on_error_set_halt(struct ehci_hcd *ehci, void __iomem *ptr,
-                                       u32 mask, u32 done, int usec)
-{
-        int error = handshake(ehci, ptr, mask, done, usec);
-        if (error)
-                ehci_to_hcd(ehci)->state = HC_STATE_HALT;
-        return error;
-}
 /* force HC to halt state from unknown (EHCI spec section 2.3) */
 static int ehci_halt (struct ehci_hcd *ehci)
 {
@@ -173,6 +163,22 @@ static int ehci_halt (struct ehci_hcd *ehci)
                          STS_HALT, STS_HALT, 16 * 125);
 }
+static int handshake_on_error_set_halt(struct ehci_hcd *ehci, void __iomem *ptr,
+                                       u32 mask, u32 done, int usec)
+{
+        int error;
+        error = handshake(ehci, ptr, mask, done, usec);
+        if (error) {
+                ehci_halt(ehci);
+                ehci_to_hcd(ehci)->state = HC_STATE_HALT;
+                ehci_err(ehci, "force halt; handhake %p %08x %08x -> %d\n",
+                        ptr, mask, done, error);
+        }
+        return error;
+}
 /* put TDI/ARC silicon into EHCI mode */
 static void tdi_reset (struct ehci_hcd *ehci)
 {
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index b7853c8bac0f..4a0c5a78b2ed 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -437,6 +437,9 @@ static int enable_periodic (struct ehci_hcd *ehci)
        u32     cmd;
        int     status;
+        if (ehci->periodic_sched++)
+                return 0;
        /* did clearing PSE did take effect yet?
         * takes effect only at frame boundaries...
         */
@@ -461,6 +464,9 @@ static int disable_periodic (struct ehci_hcd *ehci)
        u32     cmd;
        int     status;
+        if (--ehci->periodic_sched)
+                return 0;
        /* did setting PSE not take effect yet?
         * takes effect only at frame boundaries...
         */
@@ -544,13 +550,10 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                : (qh->usecs * 8);
        /* maybe enable periodic schedule processing */
-        if (!ehci->periodic_sched++)
+        return enable_periodic(ehci);
-                return enable_periodic (ehci);
-        return 0;
 }
-static void qh_unlink_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
+static int qh_unlink_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
        unsigned        i;
        unsigned        period;
@@ -586,9 +589,7 @@ static void qh_unlink_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
        qh_put (qh);
        /* maybe turn off periodic schedule */
-        ehci->periodic_sched--;
+        return disable_periodic(ehci);
-        if (!ehci->periodic_sched)
-                (void) disable_periodic (ehci);
 }
 static void intr_deschedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
@@ -1562,9 +1563,7 @@ itd_link_urb (
        urb->hcpriv = NULL;
        timer_action (ehci, TIMER_IO_WATCHDOG);
-        if (unlikely (!ehci->periodic_sched++))
+        return enable_periodic(ehci);
-                return enable_periodic (ehci);
-        return 0;
 }
 #define ISO_ERRS (EHCI_ISOC_BUF_ERR | EHCI_ISOC_BABBLE | EHCI_ISOC_XACTERR)
@@ -1642,7 +1641,7 @@ itd_complete (
        ehci_urb_done(ehci, urb, 0);
        retval = true;
        urb = NULL;
-        ehci->periodic_sched--;
+        (void) disable_periodic(ehci);
        ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
        if (unlikely (list_empty (&stream->td_list))) {
@@ -1951,9 +1950,7 @@ sitd_link_urb (
        urb->hcpriv = NULL;
        timer_action (ehci, TIMER_IO_WATCHDOG);
-        if (!ehci->periodic_sched++)
+        return enable_periodic(ehci);
-                return enable_periodic (ehci);
-        return 0;
 }
 /*-------------------------------------------------------------------------*/
@@ -2019,7 +2016,7 @@ sitd_complete (
        ehci_urb_done(ehci, urb, 0);
        retval = true;
        urb = NULL;
-        ehci->periodic_sched--;
+        (void) disable_periodic(ehci);
        ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
        if (list_empty (&stream->td_list)) {
@@ -2243,8 +2240,7 @@ restart:
                        if (unlikely (modified)) {
                                if (likely(ehci->periodic_sched > 0))
                                        goto restart;
-                                /* maybe we can short-circuit this scan! */
+                                /* short-circuit this scan */
-                                disable_periodic(ehci);
                                now_uframe = clock;
                                break;
                        }
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index a0017486ad4e..58b2b8fc9439 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -9,6 +9,7 @@ comment "Enable Host or Gadget support to see Inventra options"
 # (M)HDRC = (Multipoint) Highspeed Dual-Role Controller
 config USB_MUSB_HDRC
        depends on (USB || USB_GADGET) && HAVE_CLK
+        depends on !SUPERH
        select TWL4030_USB if MACH_OMAP_3430SDP
        tristate 'Inventra Highspeed Dual Role Controller (TI, ...)'
        help
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index c5b8f0296fcf..128e949db47c 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -100,8 +100,8 @@
 #include <linux/io.h>
 #ifdef  CONFIG_ARM
-#include <asm/arch/hardware.h>
+#include <mach/hardware.h>
-#include <asm/arch/memory.h>
+#include <mach/memory.h>
 #include <asm/mach-types.h>
 #endif
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 298b22e6ad0d..9d2dcb121c5e 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -35,8 +35,8 @@
 #include <linux/io.h>
 #include <asm/mach-types.h>
-#include <asm/arch/hardware.h>
+#include <mach/hardware.h>
-#include <asm/arch/mux.h>
+#include <mach/mux.h>
 #include "musb_core.h"
 #include "omap2430.h"
diff --git a/drivers/usb/musb/omap2430.h b/drivers/usb/musb/omap2430.h
index 786a62071f72..dc7670718cd2 100644
--- a/drivers/usb/musb/omap2430.h
+++ b/drivers/usb/musb/omap2430.h
@@ -11,8 +11,8 @@
 #define __MUSB_OMAP243X_H__
 #if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3430)
-#include <asm/arch/hardware.h>
+#include <mach/hardware.h>
-#include <asm/arch/usb.h>
+#include <mach/usb.h>
 /*
 * OMAP2430-specific definitions
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index 442cba69cce5..1279553381e3 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -72,6 +72,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
        { USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */
        { USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
+        { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
        { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
        { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
        { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
@@ -83,6 +84,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
        { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
        { USB_DEVICE(0x10c4, 0x8293) }, /* Telegesys ETRX2USB */
+        { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
@@ -93,6 +95,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
        { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
        { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
+        { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
        { } /* Terminating Entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 984f6eff4c47..3dc93b542b30 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -654,6 +654,9 @@ static struct usb_device_id id_table_combined [] = {
                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
        { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
        { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
        { },                                    /* Optional parameter entry */
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 382265bba969..8a5b6df3a976 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -750,6 +750,7 @@
 #define PAPOUCH_VID                     0x5050  /* Vendor ID */
 #define PAPOUCH_TMU_PID                 0x0400  /* TMU USB Thermometer */
+#define PAPOUCH_QUIDO4x4_PID            0x0900  /* Quido 4/4 Module */
 /*
 * ACG Identification Technologies GmbH products (http://www.acg.de/).
@@ -838,6 +839,10 @@
 /* Rig Expert Ukraine devices */
 #define FTDI_REU_TINY_PID               0xED22  /* RigExpert Tiny */
+/* Domintell products  http://www.domintell.com */
+#define FTDI_DOMINTELL_DGQG_PID 0xEF50  /* Master */
+#define FTDI_DOMINTELL_DUSB_PID 0xEF51  /* DUSB01 module */
 /* Commands */
 #define FTDI_SIO_RESET          0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL     1 /* Set the modem control register */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 9f9cd36455f4..73f8277f88f2 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -218,6 +218,7 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
 #define ZTE_PRODUCT_MF628                       0x0015
+#define ZTE_PRODUCT_CDMA_TECH                   0xfffe
 static struct usb_device_id option_ids[] = {
        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
@@ -347,6 +348,7 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
        { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
+        { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 706033753adb..ea1a103c99be 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -14,7 +14,7 @@
  Whom based his on the Keyspan driver by Hugh Blemings <hugh@blemings.org>
 */
-#define DRIVER_VERSION "v.1.2.13a"
+#define DRIVER_VERSION "v.1.3.2"
 #define DRIVER_AUTHOR "Kevin Lloyd <klloyd@sierrawireless.com>"
 #define DRIVER_DESC "USB Driver for Sierra Wireless USB modems"
@@ -30,9 +30,6 @@
 #define SWIMS_USB_REQUEST_SetPower      0x00
 #define SWIMS_USB_REQUEST_SetNmea       0x07
-#define SWIMS_USB_REQUEST_SetMode       0x0B
-#define SWIMS_USB_REQUEST_GetSwocInfo   0x0A
-#define SWIMS_SET_MODE_Modem            0x0001
 /* per port private data */
 #define N_IN_URB        4
@@ -163,7 +160,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
        { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
        { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
-        { USB_DEVICE(0x0f30, 0x1b1d) }, /* Sierra Wireless MC5720 */
+        { USB_DEVICE(0x03f0, 0x1b1d) }, /* HP ev2200 a.k.a MC5720 */
        { USB_DEVICE(0x1199, 0x0020) }, /* Sierra Wireless MC5725 */
        { USB_DEVICE(0x1199, 0x0024) }, /* Sierra Wireless MC5727 */
        { USB_DEVICE(0x1199, 0x0220) }, /* Sierra Wireless MC5725 */
@@ -175,6 +172,8 @@ static struct usb_device_id id_table [] = {
         /* Sierra Wireless Device */
        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x0025, 0xFF, 0xFF, 0xFF) },
        { USB_DEVICE(0x1199, 0x0026) }, /* Sierra Wireless Device */
+        { USB_DEVICE(0x1199, 0x0027) }, /* Sierra Wireless Device */
+        { USB_DEVICE(0x1199, 0x0028) }, /* Sierra Wireless Device */
        { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
        { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 */
@@ -187,6 +186,7 @@ static struct usb_device_id id_table [] = {
        { USB_DEVICE(0x1199, 0x6821) }, /* Sierra Wireless AirCard 875U */
        { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780 */
        { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781 */
+        { USB_DEVICE(0x1199, 0x683A) }, /* Sierra Wireless MC8785 */
        { USB_DEVICE(0x1199, 0x683B) }, /* Sierra Wireless MC8785 Composite */
        { USB_DEVICE(0x1199, 0x683C) }, /* Sierra Wireless MC8790 */
        { USB_DEVICE(0x1199, 0x683D) }, /* Sierra Wireless MC8790 */
@@ -204,6 +204,8 @@ static struct usb_device_id id_table [] = {
        /* Sierra Wireless Device */
        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6890, 0xFF, 0xFF, 0xFF)},
        /* Sierra Wireless Device */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6891, 0xFF, 0xFF, 0xFF)},
+        /* Sierra Wireless Device */
        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
        { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index e39c779e4160..9a3e495c769c 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1744,7 +1744,7 @@ static int ti_download_firmware(struct ti_device *tdev, int type)
        if (buffer) {
                memcpy(buffer, fw_p->data, fw_p->size);
                memset(buffer + fw_p->size, 0xff, buffer_size - fw_p->size);
-                ti_do_download(dev, pipe, buffer, fw_p->size);
+                status = ti_do_download(dev, pipe, buffer, fw_p->size);
                kfree(buffer);
        }
        release_firmware(fw_p);
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index b157c48e8b78..4f7f9e3ae0a4 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -733,7 +733,9 @@ int usb_serial_probe(struct usb_interface *interface,
            ((le16_to_cpu(dev->descriptor.idVendor) == ATEN_VENDOR_ID) &&
             (le16_to_cpu(dev->descriptor.idProduct) == ATEN_PRODUCT_ID)) ||
            ((le16_to_cpu(dev->descriptor.idVendor) == ALCOR_VENDOR_ID) &&
-             (le16_to_cpu(dev->descriptor.idProduct) == ALCOR_PRODUCT_ID))) {
+             (le16_to_cpu(dev->descriptor.idProduct) == ALCOR_PRODUCT_ID)) ||
+            ((le16_to_cpu(dev->descriptor.idVendor) == SIEMENS_VENDOR_ID) &&
+             (le16_to_cpu(dev->descriptor.idProduct) == SIEMENS_PRODUCT_ID_EF81))) {
                if (interface != dev->actconfig->interface[0]) {
                        /* check out the endpoints of the other interface*/
                        iface_desc = dev->actconfig->interface[0]->cur_altsetting;
diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
index c76034672c18..3d9249632ae1 100644
--- a/drivers/usb/storage/Kconfig
+++ b/drivers/usb/storage/Kconfig
@@ -146,18 +146,6 @@ config USB_STORAGE_KARMA
          on the resulting scsi device node returns the Karma to normal
          operation.
-config USB_STORAGE_SIERRA
-        bool "Sierra Wireless TRU-Install Feature Support"
-        depends on USB_STORAGE
-        help
-          Say Y here to include additional code to support Sierra Wireless
-          products with the TRU-Install feature (e.g., AC597E, AC881U).
-          This code switches the Sierra Wireless device from being in
-          Mass Storage mode to Modem mode. It also has the ability to
-          support host software upgrades should full Linux support be added
-          to TRU-Install.
 config USB_STORAGE_CYPRESS_ATACB
        bool "SAT emulation on Cypress USB/ATA Bridge with ATACB"
        depends on USB_STORAGE
diff --git a/drivers/usb/storage/Makefile b/drivers/usb/storage/Makefile
index bc3415b475c9..7f8beb5366ae 100644
--- a/drivers/usb/storage/Makefile
+++ b/drivers/usb/storage/Makefile
@@ -21,11 +21,10 @@ usb-storage-obj-$(CONFIG_USB_STORAGE_JUMPSHOT)	+= jumpshot.o
 usb-storage-obj-$(CONFIG_USB_STORAGE_ALAUDA)    += alauda.o
 usb-storage-obj-$(CONFIG_USB_STORAGE_ONETOUCH)  += onetouch.o
 usb-storage-obj-$(CONFIG_USB_STORAGE_KARMA)     += karma.o
-usb-storage-obj-$(CONFIG_USB_STORAGE_SIERRA)    += sierra_ms.o
 usb-storage-obj-$(CONFIG_USB_STORAGE_CYPRESS_ATACB) += cypress_atacb.o
 usb-storage-objs :=     scsiglue.o protocol.o transport.o usb.o \
-                        initializers.o $(usb-storage-obj-y)
+                        initializers.o sierra_ms.o $(usb-storage-obj-y)
 ifneq ($(CONFIG_USB_LIBUSUAL),)
        obj-$(CONFIG_USB)       += libusual.o
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ba412e68d474..cd155475cb6e 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -160,6 +160,13 @@ UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0592,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_MAX_SECTORS_64 ),
+/* Reported by Filip Joelsson <filip@blueturtle.nu> */
+UNUSUAL_DEV(  0x0421, 0x005d, 0x0001, 0x0600,
+                "Nokia",
+                "Nokia 3110c",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
 /* Reported by Mario Rettig <mariorettig@web.de> */
 UNUSUAL_DEV(  0x0421, 0x042e, 0x0100, 0x0100,
                "Nokia",
@@ -232,6 +239,20 @@ UNUSUAL_DEV(  0x0421, 0x04b9, 0x0551, 0x0551,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY ),
+/* Reported by Richard Nauber <RichardNauber@web.de> */
+UNUSUAL_DEV(  0x0421, 0x04fa, 0x0601, 0x0601,
+                "Nokia",
+                "6300",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
+/* Patch for Nokia 5310 capacity */
+UNUSUAL_DEV(  0x0421, 0x006a, 0x0000, 0x0591,
+        "Nokia",
+        "5310",
+        US_SC_DEVICE, US_PR_DEVICE, NULL,
+        US_FL_FIX_CAPACITY ),
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
                "SMSC",
@@ -987,6 +1008,13 @@ UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                US_FL_FIX_CAPACITY ),
+/* Reported by Adrian Pilchowiec <adi1981@epf.pl> */
+UNUSUAL_DEV(  0x071b, 0x3203, 0x0000, 0x0000,
+                "RockChip",
+                "MP3",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_NO_WP_DETECT | US_FL_MAX_SECTORS_64),
 /* Reported by Massimiliano Ghilardi <massimiliano.ghilardi@gmail.com>
 * This USB MP3/AVI player device fails and disconnects if more than 128
 * sectors (64kB) are read/written in a single command, and may be present
@@ -1576,7 +1604,6 @@ UNUSUAL_DEV(  0x10d6, 0x2200, 0x0100, 0x0100,
                US_SC_DEVICE, US_PR_DEVICE, NULL,
                0),
-#ifdef CONFIG_USB_STORAGE_SIERRA
 /* Reported by Kevin Lloyd <linux@sierrawireless.com>
 * Entry is needed for the initializer function override,
 * which instructs the device to load as a modem
@@ -1587,7 +1614,6 @@ UNUSUAL_DEV(  0x1199, 0x0fff, 0x0000, 0x9999,
                "USB MMC Storage",
                US_SC_DEVICE, US_PR_DEVICE, sierra_ms_init,
                0),
-#endif
 /* Reported by Jaco Kroon <jaco@kroon.co.za>
 * The usb-storage module found on the Digitech GNX4 (and supposedly other
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 73679aa506de..27016fd2cad1 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -102,9 +102,7 @@
 #ifdef CONFIG_USB_STORAGE_CYPRESS_ATACB
 #include "cypress_atacb.h"
 #endif
-#ifdef CONFIG_USB_STORAGE_SIERRA
 #include "sierra_ms.h"
-#endif
 /* Some informational data */
 MODULE_AUTHOR("Matthew Dharm <mdharm-usb@one-eyed-alien.net>");
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 5a24c6411d34..75dac578104f 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -208,6 +208,36 @@ static unsigned long compute_hozval(unsigned long xres, unsigned long lcdcon2)
        return value;
 }
+static void atmel_lcdfb_stop_nowait(struct atmel_lcdfb_info *sinfo)
+{
+        /* Turn off the LCD controller and the DMA controller */
+        lcdc_writel(sinfo, ATMEL_LCDC_PWRCON,
+                        sinfo->guard_time << ATMEL_LCDC_GUARDT_OFFSET);
+        /* Wait for the LCDC core to become idle */
+        while (lcdc_readl(sinfo, ATMEL_LCDC_PWRCON) & ATMEL_LCDC_BUSY)
+                msleep(10);
+        lcdc_writel(sinfo, ATMEL_LCDC_DMACON, 0);
+}
+static void atmel_lcdfb_stop(struct atmel_lcdfb_info *sinfo)
+{
+        atmel_lcdfb_stop_nowait(sinfo);
+        /* Wait for DMA engine to become idle... */
+        while (lcdc_readl(sinfo, ATMEL_LCDC_DMACON) & ATMEL_LCDC_DMABUSY)
+                msleep(10);
+}
+static void atmel_lcdfb_start(struct atmel_lcdfb_info *sinfo)
+{
+        lcdc_writel(sinfo, ATMEL_LCDC_DMACON, sinfo->default_dmacon);
+        lcdc_writel(sinfo, ATMEL_LCDC_PWRCON,
+                (sinfo->guard_time << ATMEL_LCDC_GUARDT_OFFSET)
+                | ATMEL_LCDC_PWR);
+}
 static void atmel_lcdfb_update_dma(struct fb_info *info,
                               struct fb_var_screeninfo *var)
 {
@@ -420,26 +450,8 @@ static void atmel_lcdfb_reset(struct atmel_lcdfb_info *sinfo)
 {
        might_sleep();
-        /* LCD power off */
+        atmel_lcdfb_stop(sinfo);
-        lcdc_writel(sinfo, ATMEL_LCDC_PWRCON, sinfo->guard_time << ATMEL_LCDC_GUARDT_OFFSET);
+        atmel_lcdfb_start(sinfo);
-        /* wait for the LCDC core to become idle */
-        while (lcdc_readl(sinfo, ATMEL_LCDC_PWRCON) & ATMEL_LCDC_BUSY)
-                msleep(10);
-        /* DMA disable */
-        lcdc_writel(sinfo, ATMEL_LCDC_DMACON, 0);
-        /* wait for DMA engine to become idle */
-        while (lcdc_readl(sinfo, ATMEL_LCDC_DMACON) & ATMEL_LCDC_DMABUSY)
-                msleep(10);
-        /* LCD power on */
-        lcdc_writel(sinfo, ATMEL_LCDC_PWRCON,
-                (sinfo->guard_time << ATMEL_LCDC_GUARDT_OFFSET) | ATMEL_LCDC_PWR);
-        /* DMA enable */
-        lcdc_writel(sinfo, ATMEL_LCDC_DMACON, sinfo->default_dmacon);
 }
 /**
@@ -471,14 +483,7 @@ static int atmel_lcdfb_set_par(struct fb_info *info)
                 info->var.xres, info->var.yres,
                 info->var.xres_virtual, info->var.yres_virtual);
-        /* Turn off the LCD controller and the DMA controller */
+        atmel_lcdfb_stop_nowait(sinfo);
-        lcdc_writel(sinfo, ATMEL_LCDC_PWRCON, sinfo->guard_time << ATMEL_LCDC_GUARDT_OFFSET);
-        /* Wait for the LCDC core to become idle */
-        while (lcdc_readl(sinfo, ATMEL_LCDC_PWRCON) & ATMEL_LCDC_BUSY)
-                msleep(10);
-        lcdc_writel(sinfo, ATMEL_LCDC_DMACON, 0);
        if (info->var.bits_per_pixel == 1)
                info->fix.visual = FB_VISUAL_MONO01;
@@ -583,13 +588,7 @@ static int atmel_lcdfb_set_par(struct fb_info *info)
        while (lcdc_readl(sinfo, ATMEL_LCDC_DMACON) & ATMEL_LCDC_DMABUSY)
                msleep(10);
-        dev_dbg(info->device, "  * re-enable DMA engine\n");
+        atmel_lcdfb_start(sinfo);
-        /* ...and enable it with updated configuration */
-        lcdc_writel(sinfo, ATMEL_LCDC_DMACON, sinfo->default_dmacon);
-        dev_dbg(info->device, "  * re-enable LCDC core\n");
-        lcdc_writel(sinfo, ATMEL_LCDC_PWRCON,
-                (sinfo->guard_time << ATMEL_LCDC_GUARDT_OFFSET) | ATMEL_LCDC_PWR);
        dev_dbg(info->device, "  * DONE\n");
@@ -1032,11 +1031,20 @@ static int atmel_lcdfb_suspend(struct platform_device *pdev, pm_message_t mesg)
        struct fb_info *info = platform_get_drvdata(pdev);
        struct atmel_lcdfb_info *sinfo = info->par;
+        /*
+         * We don't want to handle interrupts while the clock is
+         * stopped. It may take forever.
+         */
+        lcdc_writel(sinfo, ATMEL_LCDC_IDR, ~0UL);
        sinfo->saved_lcdcon = lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
        lcdc_writel(sinfo, ATMEL_LCDC_CONTRAST_CTR, 0);
        if (sinfo->atmel_lcdfb_power_control)
                sinfo->atmel_lcdfb_power_control(0);
+        atmel_lcdfb_stop(sinfo);
        atmel_lcdfb_stop_clock(sinfo);
        return 0;
 }
@@ -1046,9 +1054,15 @@ static int atmel_lcdfb_resume(struct platform_device *pdev)
        struct atmel_lcdfb_info *sinfo = info->par;
        atmel_lcdfb_start_clock(sinfo);
+        atmel_lcdfb_start(sinfo);
        if (sinfo->atmel_lcdfb_power_control)
                sinfo->atmel_lcdfb_power_control(1);
        lcdc_writel(sinfo, ATMEL_LCDC_CONTRAST_CTR, sinfo->saved_lcdcon);
+        /* Enable FIFO & DMA errors */
+        lcdc_writel(sinfo, ATMEL_LCDC_IER, ATMEL_LCDC_UFLWI
+                        | ATMEL_LCDC_OWRI | ATMEL_LCDC_MERI);
        return 0;
 }
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index c6299e8a041d..9cbff84b787d 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2400,11 +2400,15 @@ static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
        if (!fbcon_is_inactive(vc, info)) {
                if (ops->blank_state != blank) {
+                        int ret = 1;
                        ops->blank_state = blank;
                        fbcon_cursor(vc, blank ? CM_ERASE : CM_DRAW);
                        ops->cursor_flash = (!blank);
-                        if (fb_blank(info, blank))
+                        if (info->fbops->fb_blank)
+                                ret = info->fbops->fb_blank(blank, info);
+                        if (ret)
                                fbcon_generic_blank(vc, info, blank);
                }
diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
index a6e38e9ea73f..89a346880ec0 100644
--- a/drivers/video/console/fbcon.h
+++ b/drivers/video/console/fbcon.h
@@ -110,7 +110,7 @@ static inline int mono_col(const struct fb_info *info)
        __u32 max_len;
        max_len = max(info->var.green.length, info->var.red.length);
        max_len = max(info->var.blue.length, max_len);
-        return ~(0xfff << (max_len & 0xff));
+        return (~(0xfff << max_len)) & 0xff;
 }
 static inline int attr_col_ec(int shift, struct vc_data *vc,
diff --git a/drivers/watchdog/geodewdt.c b/drivers/watchdog/geodewdt.c
index 614a5c7017b6..6799a6de66fe 100644
--- a/drivers/watchdog/geodewdt.c
+++ b/drivers/watchdog/geodewdt.c
@@ -130,8 +130,8 @@ static ssize_t geodewdt_write(struct file *file, const char __user *data,
        return len;
 }
-static int geodewdt_ioctl(struct inode *inode, struct file *file,
+static long geodewdt_ioctl(struct file *file, unsigned int cmd,
-                                unsigned int cmd, unsigned long arg)
+                                unsigned long arg)
 {
        void __user *argp = (void __user *)arg;
        int __user *p = argp;
@@ -198,7 +198,7 @@ static const struct file_operations geodewdt_fops = {
        .owner          = THIS_MODULE,
        .llseek         = no_llseek,
        .write          = geodewdt_write,
-        .ioctl          = geodewdt_ioctl,
+        .unlocked_ioctl = geodewdt_ioctl,
        .open           = geodewdt_open,
        .release        = geodewdt_release,
 };
diff --git a/drivers/watchdog/ibmasr.c b/drivers/watchdog/ibmasr.c
index b82405cfb4cd..89fcefcc8510 100644
--- a/drivers/watchdog/ibmasr.c
+++ b/drivers/watchdog/ibmasr.c
@@ -85,7 +85,6 @@ static void __asr_toggle(void)
        outb(reg & ~asr_toggle_mask, asr_write_addr);
        reg = inb(asr_read_addr);
-        spin_unlock(&asr_lock);
 }
 static void asr_toggle(void)
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 0ed84162437b..6d9f3d4a9987 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -173,8 +173,8 @@ static const struct watchdog_info ident = {
        .identity = "PNX4008 Watchdog",
 };
-static long pnx4008_wdt_ioctl(struct inode *inode, struct file *file,
+static long pnx4008_wdt_ioctl(struct file *file, unsigned int cmd,
-                                        unsigned int cmd, unsigned long arg)
+                                unsigned long arg)
 {
        int ret = -ENOTTY;
        int time;
diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c
index 6756bcb009ed..c9c73b69c5e5 100644
--- a/drivers/watchdog/rc32434_wdt.c
+++ b/drivers/watchdog/rc32434_wdt.c
@@ -182,8 +182,8 @@ static ssize_t rc32434_wdt_write(struct file *file, const char *data,
        return 0;
 }
-static int rc32434_wdt_ioctl(struct inode *inode, struct file *file,
+static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
-        unsigned int cmd, unsigned long arg)
+                                unsigned long arg)
 {
        void __user *argp = (void __user *)arg;
        int new_timeout;
@@ -242,7 +242,7 @@ static struct file_operations rc32434_wdt_fops = {
        .owner          = THIS_MODULE,
        .llseek         = no_llseek,
        .write          = rc32434_wdt_write,
-        .ioctl          = rc32434_wdt_ioctl,
+        .unlocked_ioctl = rc32434_wdt_ioctl,
        .open           = rc32434_wdt_open,
        .release        = rc32434_wdt_release,
 };
diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 9108efa73e7d..bf92802f2bbe 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -144,8 +144,8 @@ static int rdc321x_wdt_release(struct inode *inode, struct file *file)
        return 0;
 }
-static int rdc321x_wdt_ioctl(struct inode *inode, struct file *file,
+static long rdc321x_wdt_ioctl(struct file *file, unsigned int cmd,
-                                unsigned int cmd, unsigned long arg)
+                                unsigned long arg)
 {
        void __user *argp = (void __user *)arg;
        unsigned int value;
@@ -204,7 +204,7 @@ static ssize_t rdc321x_wdt_write(struct file *file, const char __user *buf,
 static const struct file_operations rdc321x_wdt_fops = {
        .owner          = THIS_MODULE,
        .llseek         = no_llseek,
-        .ioctl          = rdc321x_wdt_ioctl,
+        .unlocked_ioctl = rdc321x_wdt_ioctl,
        .open           = rdc321x_wdt_open,
        .write          = rdc321x_wdt_write,
        .release        = rdc321x_wdt_release,
diff --git a/drivers/watchdog/wdt285.c b/drivers/watchdog/wdt285.c
index db362c34958b..191ea6302107 100644
--- a/drivers/watchdog/wdt285.c
+++ b/drivers/watchdog/wdt285.c
@@ -115,8 +115,8 @@ static int watchdog_release(struct inode *inode, struct file *file)
        return 0;
 }
-static ssize_t watchdog_write(struct file *file, const char *data,
+static ssize_t watchdog_write(struct file *file, const char __user *data,
-                                                size_t len, loff_t *ppos)
+                              size_t len, loff_t *ppos)
 {
        /*
         *      Refresh the timer.
@@ -133,21 +133,22 @@ static const struct watchdog_info ident = {
 };
 static long watchdog_ioctl(struct file *file, unsigned int cmd,
-                                                        unsigned long arg)
+                           unsigned long arg)
 {
        unsigned int new_margin;
+        int __user *int_arg = (int __user *)arg;
        int ret = -ENOTTY;
        switch (cmd) {
        case WDIOC_GETSUPPORT:
                ret = 0;
-                if (copy_to_user((void *)arg, &ident, sizeof(ident)))
+                if (copy_to_user((void __user *)arg, &ident, sizeof(ident)))
                        ret = -EFAULT;
                break;
        case WDIOC_GETSTATUS:
        case WDIOC_GETBOOTSTATUS:
-                ret = put_user(0, (int *)arg);
+                ret = put_user(0, int_arg);
                break;
        case WDIOC_KEEPALIVE:
@@ -156,7 +157,7 @@ static long watchdog_ioctl(struct file *file, unsigned int cmd,
                break;
        case WDIOC_SETTIMEOUT:
-                ret = get_user(new_margin, (int *)arg);
+                ret = get_user(new_margin, int_arg);
                if (ret)
                        break;
@@ -171,7 +172,7 @@ static long watchdog_ioctl(struct file *file, unsigned int cmd,
                watchdog_ping();
                /* Fall */
        case WDIOC_GETTIMEOUT:
-                ret = put_user(soft_margin, (int *)arg);
+                ret = put_user(soft_margin, int_arg);
                break;
        }
        return ret;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index c95295c65045..e83aa5ebe861 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -626,8 +626,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
        return NULL;
 error:
-        if (fid)
+        p9_client_clunk(fid);
-                p9_client_clunk(fid);
        return ERR_PTR(result);
 }
diff --git a/fs/bfs/dir.c b/fs/bfs/dir.c
index 87ee5ccee348..ed8feb052df9 100644
--- a/fs/bfs/dir.c
+++ b/fs/bfs/dir.c
@@ -125,8 +125,8 @@ static int bfs_create(struct inode *dir, struct dentry *dentry, int mode,
                                                        inode->i_ino);
        if (err) {
                inode_dec_link_count(inode);
-                iput(inode);
                mutex_unlock(&info->bfs_lock);
+                iput(inode);
                return err;
        }
        mutex_unlock(&info->bfs_lock);
diff --git a/fs/dcache.c b/fs/dcache.c
index 80e93956aced..e7a1a99b7464 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1395,6 +1395,10 @@ struct dentry * __d_lookup(struct dentry * parent, struct qstr * name)
                if (dentry->d_parent != parent)
                        goto next;
+                /* non-existing due to RCU? */
+                if (d_unhashed(dentry))
+                        goto next;
                /*
                 * It is safe to compare names since d_move() cannot
                 * change the qstr (protected by d_lock).
@@ -1410,10 +1414,8 @@ struct dentry * __d_lookup(struct dentry * parent, struct qstr * name)
                                goto next;
                }
-                if (!d_unhashed(dentry)) {
+                atomic_inc(&dentry->d_count);
-                        atomic_inc(&dentry->d_count);
+                found = dentry;
-                        found = dentry;
-                }
                spin_unlock(&dentry->d_lock);
                break;
 next:
diff --git a/fs/exec.c b/fs/exec.c
index 32993beecbe9..cecee501ce78 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -752,11 +752,11 @@ static int exec_mmap(struct mm_struct *mm)
        tsk->active_mm = mm;
        activate_mm(active_mm, mm);
        task_unlock(tsk);
-        mm_update_next_owner(old_mm);
        arch_pick_mmap_layout(mm);
        if (old_mm) {
                up_read(&old_mm->mmap_sem);
                BUG_ON(active_mm != old_mm);
+                mm_update_next_owner(old_mm);
                mmput(old_mm);
                return 0;
        }
diff --git a/fs/inotify_user.c b/fs/inotify_user.c
index 60249429a253..d85c7d931cdf 100644
--- a/fs/inotify_user.c
+++ b/fs/inotify_user.c
@@ -323,7 +323,7 @@ out:
 }
 /*
- * remove_kevent - cleans up and ultimately frees the given kevent
+ * remove_kevent - cleans up the given kevent
 *
 * Caller must hold dev->ev_mutex.
 */
@@ -334,7 +334,13 @@ static void remove_kevent(struct inotify_device *dev,
        dev->event_count--;
        dev->queue_size -= sizeof(struct inotify_event) + kevent->event.len;
+}
+/*
+ * free_kevent - frees the given kevent.
+ */
+static void free_kevent(struct inotify_kernel_event *kevent)
+{
        kfree(kevent->name);
        kmem_cache_free(event_cachep, kevent);
 }
@@ -350,6 +356,7 @@ static void inotify_dev_event_dequeue(struct inotify_device *dev)
                struct inotify_kernel_event *kevent;
                kevent = inotify_dev_get_event(dev);
                remove_kevent(dev, kevent);
+                free_kevent(kevent);
        }
 }
@@ -433,17 +440,15 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
        dev = file->private_data;
        while (1) {
-                int events;
                prepare_to_wait(&dev->wq, &wait, TASK_INTERRUPTIBLE);
                mutex_lock(&dev->ev_mutex);
-                events = !list_empty(&dev->events);
+                if (!list_empty(&dev->events)) {
-                mutex_unlock(&dev->ev_mutex);
-                if (events) {
                        ret = 0;
                        break;
                }
+                mutex_unlock(&dev->ev_mutex);
                if (file->f_flags & O_NONBLOCK) {
                        ret = -EAGAIN;
@@ -462,7 +467,6 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
        if (ret)
                return ret;
-        mutex_lock(&dev->ev_mutex);
        while (1) {
                struct inotify_kernel_event *kevent;
@@ -481,6 +485,13 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
                        }
                        break;
                }
+                remove_kevent(dev, kevent);
+                /*
+                 * Must perform the copy_to_user outside the mutex in order
+                 * to avoid a lock order reversal with mmap_sem.
+                 */
+                mutex_unlock(&dev->ev_mutex);
                if (copy_to_user(buf, &kevent->event, event_size)) {
                        ret = -EFAULT;
@@ -498,7 +509,9 @@ static ssize_t inotify_read(struct file *file, char __user *buf,
                        count -= kevent->event.len;
                }
-                remove_kevent(dev, kevent);
+                free_kevent(kevent);
+                mutex_lock(&dev->ev_mutex);
        }
        mutex_unlock(&dev->ev_mutex);
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 506c24fb5078..a53da1466277 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -594,7 +594,7 @@ static int ocfs2_direct_IO_get_blocks(struct inode *inode, sector_t iblock,
                goto bail;
        }
-        if (!ocfs2_sparse_alloc(OCFS2_SB(inode->i_sb)) && !p_blkno) {
+        if (!ocfs2_sparse_alloc(OCFS2_SB(inode->i_sb)) && !p_blkno && create) {
                ocfs2_error(inode->i_sb,
                            "Inode %llu has a hole at block %llu\n",
                            (unsigned long long)OCFS2_I(inode)->ip_blkno,
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 7d6b34e201db..ecc3330972e5 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -499,9 +499,9 @@ int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
                if (!size)
                        continue;
                if (from + size > get_capacity(disk)) {
-                        printk(KERN_ERR " %s: p%d exceeds device capacity\n",
+                        printk(KERN_WARNING
+                                "%s: p%d exceeds device capacity\n",
                                disk->disk_name, p);
-                        continue;
                }
                res = add_partition(disk, p, from, size, state->parts[p].flags);
                if (res) {
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index bca0f81eb687..7821589a17d5 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -547,8 +547,8 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
        for (tmp = dir->subdir; tmp; tmp = tmp->next)
                if (strcmp(tmp->name, dp->name) == 0) {
-                        printk(KERN_WARNING "proc_dir_entry '%s' already "
+                        printk(KERN_WARNING "proc_dir_entry '%s/%s' already registered\n",
-                                        "registered\n", dp->name);
+                                dir->name, dp->name);
                        dump_stack();
                        break;
                }
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 00f10a2dcf12..29e20c6b1f7f 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -183,6 +183,9 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
                "SReclaimable: %8lu kB\n"
                "SUnreclaim:   %8lu kB\n"
                "PageTables:   %8lu kB\n"
+#ifdef CONFIG_QUICKLIST
+                "Quicklists:   %8lu kB\n"
+#endif
                "NFS_Unstable: %8lu kB\n"
                "Bounce:       %8lu kB\n"
                "WritebackTmp: %8lu kB\n"
@@ -190,8 +193,7 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
                "Committed_AS: %8lu kB\n"
                "VmallocTotal: %8lu kB\n"
                "VmallocUsed:  %8lu kB\n"
-                "VmallocChunk: %8lu kB\n"
+                "VmallocChunk: %8lu kB\n",
-                "Quicklists:   %8lu kB\n",
                K(i.totalram),
                K(i.freeram),
                K(i.bufferram),
@@ -216,6 +218,9 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
                K(global_page_state(NR_SLAB_RECLAIMABLE)),
                K(global_page_state(NR_SLAB_UNRECLAIMABLE)),
                K(global_page_state(NR_PAGETABLE)),
+#ifdef CONFIG_QUICKLIST
+                K(quicklist_total_size()),
+#endif
                K(global_page_state(NR_UNSTABLE_NFS)),
                K(global_page_state(NR_BOUNCE)),
                K(global_page_state(NR_WRITEBACK_TEMP)),
@@ -223,8 +228,7 @@ static int meminfo_read_proc(char *page, char **start, off_t off,
                K(committed),
                (unsigned long)VMALLOC_TOTAL >> 10,
                vmi.used >> 10,
-                vmi.largest_chunk >> 10,
+                vmi.largest_chunk >> 10
-                K(quicklist_total_size())
                );
                len += hugetlb_report_meminfo(page + len);
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index 52312ec93ff4..5145cb9125af 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -58,7 +58,7 @@ const struct inode_operations ramfs_file_inode_operations = {
 * size 0 on the assumption that it's going to be used for an mmap of shared
 * memory
 */
-static int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
+int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
 {
        struct pagevec lru_pvec;
        unsigned long npages, xpages, loop, limit;
diff --git a/fs/splice.c b/fs/splice.c
index 1bbc6f4bb09c..a1e701c27156 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -898,6 +898,9 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
        if (unlikely(!(out->f_mode & FMODE_WRITE)))
                return -EBADF;
+        if (unlikely(out->f_flags & O_APPEND))
+                return -EINVAL;
        ret = rw_verify_area(WRITE, out, ppos, len);
        if (unlikely(ret < 0))
                return ret;
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index b9cb77473758..d7f7645779f2 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -538,7 +538,7 @@ void dbg_dump_node(const struct ubifs_info *c, const void *node)
                printk(KERN_DEBUG "\t%d orphan inode numbers:\n", n);
                for (i = 0; i < n; i++)
                        printk(KERN_DEBUG "\t  ino %llu\n",
-                               le64_to_cpu(orph->inos[i]));
+                               (unsigned long long)le64_to_cpu(orph->inos[i]));
                break;
        }
        default:
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 2b267c9a1806..526c01ec8003 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -426,7 +426,7 @@ static int ubifs_readdir(struct file *file, void *dirent, filldir_t filldir)
        while (1) {
                dbg_gen("feed '%s', ino %llu, new f_pos %#x",
-                        dent->name, le64_to_cpu(dent->inum),
+                        dent->name, (unsigned long long)le64_to_cpu(dent->inum),
                        key_hash_flash(c, &dent->key));
                ubifs_assert(dent->ch.sqnum > ubifs_inode(dir)->creat_sqnum);
diff --git a/fs/ubifs/find.c b/fs/ubifs/find.c
index e045c8b55423..47814cde2407 100644
--- a/fs/ubifs/find.c
+++ b/fs/ubifs/find.c
@@ -507,7 +507,6 @@ int ubifs_find_free_space(struct ubifs_info *c, int min_space, int *free,
                rsvd_idx_lebs = 0;
        lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
               c->lst.taken_empty_lebs;
-        ubifs_assert(lebs + c->lst.idx_lebs >= c->min_idx_lebs);
        if (rsvd_idx_lebs < lebs)
                /*
                 * OK to allocate an empty LEB, but we still don't want to go
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 13f1019c859f..02aba36fe3d4 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -334,15 +334,15 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
                err = move_nodes(c, sleb);
                if (err)
-                        goto out;
+                        goto out_inc_seq;
                err = gc_sync_wbufs(c);
                if (err)
-                        goto out;
+                        goto out_inc_seq;
                err = ubifs_change_one_lp(c, lnum, c->leb_size, 0, 0, 0, 0);
                if (err)
-                        goto out;
+                        goto out_inc_seq;
                /* Allow for races with TNC */
                c->gced_lnum = lnum;
@@ -369,6 +369,14 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
 out:
        ubifs_scan_destroy(sleb);
        return err;
+out_inc_seq:
+        /* We may have moved at least some nodes so allow for races with TNC */
+        c->gced_lnum = lnum;
+        smp_wmb();
+        c->gc_seq += 1;
+        smp_wmb();
+        goto out;
 }
 /**
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 7562464ac83f..3f4902060c7a 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1024,14 +1024,13 @@ static int mount_ubifs(struct ubifs_info *c)
                goto out_dereg;
        }
+        sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
        if (!mounted_read_only) {
                err = alloc_wbufs(c);
                if (err)
                        goto out_cbuf;
                /* Create background thread */
-                sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num,
-                        c->vi.vol_id);
                c->bgt = kthread_create(ubifs_bg_thread, c, c->bgt_name);
                if (!c->bgt)
                        c->bgt = ERR_PTR(-EINVAL);
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index 7da209ab9378..7634c5970887 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -1476,7 +1476,7 @@ again:
        }
        err = fallible_read_node(c, key, &zbr, node);
-        if (maybe_leb_gced(c, zbr.lnum, gc_seq1)) {
+        if (err <= 0 || maybe_leb_gced(c, zbr.lnum, gc_seq1)) {
                /*
                 * The node may have been GC'ed out from under us so try again
                 * while keeping the TNC mutex locked.
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 0ed6e146a0d9..eb91f3b70320 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -211,6 +211,7 @@ const struct file_operations udf_file_operations = {
        .release                = udf_release_file,
        .fsync                  = udf_fsync_file,
        .splice_read            = generic_file_splice_read,
+        .llseek                 = generic_file_llseek,
 };
 const struct inode_operations udf_file_inode_operations = {
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index eb9cfa23dc3d..a4f2b3ce45b0 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -76,11 +76,24 @@ struct inode *udf_new_inode(struct inode *dir, int mode, int *err)
        *err = -ENOSPC;
        iinfo = UDF_I(inode);
-        iinfo->i_unique = 0;
+        if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_EXTENDED_FE)) {
-        iinfo->i_lenExtents = 0;
+                iinfo->i_efe = 1;
-        iinfo->i_next_alloc_block = 0;
+                if (UDF_VERS_USE_EXTENDED_FE > sbi->s_udfrev)
-        iinfo->i_next_alloc_goal = 0;
+                        sbi->s_udfrev = UDF_VERS_USE_EXTENDED_FE;
-        iinfo->i_strat4096 = 0;
+                iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize -
+                                            sizeof(struct extendedFileEntry),
+                                            GFP_KERNEL);
+        } else {
+                iinfo->i_efe = 0;
+                iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize -
+                                            sizeof(struct fileEntry),
+                                            GFP_KERNEL);
+        }
+        if (!iinfo->i_ext.i_data) {
+                iput(inode);
+                *err = -ENOMEM;
+                return NULL;
+        }
        block = udf_new_block(dir->i_sb, NULL,
                              dinfo->i_location.partitionReferenceNum,
@@ -111,6 +124,7 @@ struct inode *udf_new_inode(struct inode *dir, int mode, int *err)
                lvhd->uniqueID = cpu_to_le64(uniqueID);
                mark_buffer_dirty(sbi->s_lvid_bh);
        }
+        mutex_unlock(&sbi->s_alloc_mutex);
        inode->i_mode = mode;
        inode->i_uid = current->fsuid;
        if (dir->i_mode & S_ISGID) {
@@ -129,25 +143,6 @@ struct inode *udf_new_inode(struct inode *dir, int mode, int *err)
        iinfo->i_lenEAttr = 0;
        iinfo->i_lenAlloc = 0;
        iinfo->i_use = 0;
-        if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_EXTENDED_FE)) {
-                iinfo->i_efe = 1;
-                if (UDF_VERS_USE_EXTENDED_FE > sbi->s_udfrev)
-                        sbi->s_udfrev = UDF_VERS_USE_EXTENDED_FE;
-                iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize -
-                                            sizeof(struct extendedFileEntry),
-                                            GFP_KERNEL);
-        } else {
-                iinfo->i_efe = 0;
-                iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize -
-                                            sizeof(struct fileEntry),
-                                            GFP_KERNEL);
-        }
-        if (!iinfo->i_ext.i_data) {
-                iput(inode);
-                *err = -ENOMEM;
-                mutex_unlock(&sbi->s_alloc_mutex);
-                return NULL;
-        }
        if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_AD_IN_ICB))
                iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
        else if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_SHORT_AD))
@@ -158,7 +153,6 @@ struct inode *udf_new_inode(struct inode *dir, int mode, int *err)
                iinfo->i_crtime = current_fs_time(inode->i_sb);
        insert_inode_hash(inode);
        mark_inode_dirty(inode);
-        mutex_unlock(&sbi->s_alloc_mutex);
        if (DQUOT_ALLOC_INODE(inode)) {
                DQUOT_DROP(inode);
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index f42f80a3b1fa..a44d68eb50b5 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1338,6 +1338,10 @@ __xfs_get_blocks(
        offset = (xfs_off_t)iblock << inode->i_blkbits;
        ASSERT(bh_result->b_size >= (1 << inode->i_blkbits));
        size = bh_result->b_size;
+        if (!create && direct && offset >= i_size_read(inode))
+                return 0;
        error = xfs_iomap(XFS_I(inode), offset, size,
                             create ? flags : BMAPI_READ, &iomap, &niomap);
        if (error)
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 73c65f19e549..18d3c8487835 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -1302,9 +1302,29 @@ xfs_fs_remount(
                        mp->m_flags &= ~XFS_MOUNT_BARRIER;
                        break;
                default:
+                        /*
+                         * Logically we would return an error here to prevent
+                         * users from believing they might have changed
+                         * mount options using remount which can't be changed.
+                         *
+                         * But unfortunately mount(8) adds all options from
+                         * mtab and fstab to the mount arguments in some cases
+                         * so we can't blindly reject options, but have to
+                         * check for each specified option if it actually
+                         * differs from the currently set option and only
+                         * reject it if that's the case.
+                         *
+                         * Until that is implemented we return success for
+                         * every remount request, and silently ignore all
+                         * options that we can't actually change.
+                         */
+#if 0
                        printk(KERN_INFO
        "XFS: mount option \"%s\" not supported for remount\n", p);
                        return -EINVAL;
+#else
+                        return 0;
+#endif
                }
        }
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 608c30c3f76b..002fc2617c8e 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -732,6 +732,7 @@ xfs_buf_item_init(
        bip->bli_item.li_ops = &xfs_buf_item_ops;
        bip->bli_item.li_mountp = mp;
        bip->bli_buf = bp;
+        xfs_buf_hold(bp);
        bip->bli_format.blf_type = XFS_LI_BUF;
        bip->bli_format.blf_blkno = (__int64_t)XFS_BUF_ADDR(bp);
        bip->bli_format.blf_len = (ushort)BTOBB(XFS_BUF_COUNT(bp));
@@ -867,6 +868,21 @@ xfs_buf_item_dirty(
        return (bip->bli_flags & XFS_BLI_DIRTY);
 }
+STATIC void
+xfs_buf_item_free(
+        xfs_buf_log_item_t      *bip)
+{
+#ifdef XFS_TRANS_DEBUG
+        kmem_free(bip->bli_orig);
+        kmem_free(bip->bli_logged);
+#endif /* XFS_TRANS_DEBUG */
+#ifdef XFS_BLI_TRACE
+        ktrace_free(bip->bli_trace);
+#endif
+        kmem_zone_free(xfs_buf_item_zone, bip);
+}
 /*
 * This is called when the buf log item is no longer needed.  It should
 * free the buf log item associated with the given buffer and clear
@@ -887,18 +903,8 @@ xfs_buf_item_relse(
            (XFS_BUF_IODONE_FUNC(bp) != NULL)) {
                XFS_BUF_CLR_IODONE_FUNC(bp);
        }
+        xfs_buf_rele(bp);
-#ifdef XFS_TRANS_DEBUG
+        xfs_buf_item_free(bip);
-        kmem_free(bip->bli_orig);
-        bip->bli_orig = NULL;
-        kmem_free(bip->bli_logged);
-        bip->bli_logged = NULL;
-#endif /* XFS_TRANS_DEBUG */
-#ifdef XFS_BLI_TRACE
-        ktrace_free(bip->bli_trace);
-#endif
-        kmem_zone_free(xfs_buf_item_zone, bip);
 }
@@ -1120,6 +1126,7 @@ xfs_buf_iodone(
        ASSERT(bip->bli_buf == bp);
+        xfs_buf_rele(bp);
        mp = bip->bli_item.li_mountp;
        /*
@@ -1136,18 +1143,7 @@ xfs_buf_iodone(
         * xfs_trans_delete_ail() drops the AIL lock.
         */
        xfs_trans_delete_ail(mp, (xfs_log_item_t *)bip);
+        xfs_buf_item_free(bip);
-#ifdef XFS_TRANS_DEBUG
-        kmem_free(bip->bli_orig);
-        bip->bli_orig = NULL;
-        kmem_free(bip->bli_logged);
-        bip->bli_logged = NULL;
-#endif /* XFS_TRANS_DEBUG */
-#ifdef XFS_BLI_TRACE
-        ktrace_free(bip->bli_trace);
-#endif
-        kmem_zone_free(xfs_buf_item_zone, bip);
 }
 #if defined(XFS_BLI_TRACE)
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 760f4c5b5160..75b0cd4da0ea 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -149,7 +149,14 @@ xfs_swap_extents(
        sbp = &sxp->sx_stat;
-        xfs_lock_two_inodes(ip, tip, lock_flags);
+        /*
+         * we have to do two separate lock calls here to keep lockdep
+         * happy. If we try to get all the locks in one call, lock will
+         * report false positives when we drop the ILOCK and regain them
+         * below.
+         */
+        xfs_lock_two_inodes(ip, tip, XFS_IOLOCK_EXCL);
+        xfs_lock_two_inodes(ip, tip, XFS_ILOCK_EXCL);
        locked = 1;
        /* Verify that both files have the same format */
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 00e80df9dd9d..dbd9cef852ec 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -4118,7 +4118,7 @@ xfs_iext_indirect_to_direct(
        ASSERT(nextents <= XFS_LINEAR_EXTS);
        size = nextents * sizeof(xfs_bmbt_rec_t);
-        xfs_iext_irec_compact_full(ifp);
+        xfs_iext_irec_compact_pages(ifp);
        ASSERT(ifp->if_real_bytes == XFS_IEXT_BUFSZ);
        ep = ifp->if_u1.if_ext_irec->er_extbuf;
@@ -4449,8 +4449,7 @@ xfs_iext_irec_remove(
 * compaction policy is as follows:
 *
 *    Full Compaction: Extents fit into a single page (or inline buffer)
- *    Full Compaction: Extents occupy less than 10% of allocated space
+ * Partial Compaction: Extents occupy less than 50% of allocated space
- * Partial Compaction: Extents occupy > 10% and < 50% of allocated space
 *      No Compaction: Extents occupy at least 50% of allocated space
 */
 void
@@ -4471,8 +4470,6 @@ xfs_iext_irec_compact(
                xfs_iext_direct_to_inline(ifp, nextents);
        } else if (nextents <= XFS_LINEAR_EXTS) {
                xfs_iext_indirect_to_direct(ifp);
-        } else if (nextents < (nlists * XFS_LINEAR_EXTS) >> 3) {
-                xfs_iext_irec_compact_full(ifp);
        } else if (nextents < (nlists * XFS_LINEAR_EXTS) >> 1) {
                xfs_iext_irec_compact_pages(ifp);
        }
@@ -4496,7 +4493,7 @@ xfs_iext_irec_compact_pages(
                erp_next = erp + 1;
                if (erp_next->er_extcount <=
                    (XFS_LINEAR_EXTS - erp->er_extcount)) {
-                        memmove(&erp->er_extbuf[erp->er_extcount],
+                        memcpy(&erp->er_extbuf[erp->er_extcount],
                                erp_next->er_extbuf, erp_next->er_extcount *
                                sizeof(xfs_bmbt_rec_t));
                        erp->er_extcount += erp_next->er_extcount;
@@ -4516,91 +4513,6 @@ xfs_iext_irec_compact_pages(
 }
 /*
- * Fully compact the extent records managed by the indirection array.
- */
-void
-xfs_iext_irec_compact_full(
-        xfs_ifork_t     *ifp)                   /* inode fork pointer */
-{
-        xfs_bmbt_rec_host_t *ep, *ep_next;      /* extent record pointers */
-        xfs_ext_irec_t  *erp, *erp_next;        /* extent irec pointers */
-        int             erp_idx = 0;            /* extent irec index */
-        int             ext_avail;              /* empty entries in ex list */
-        int             ext_diff;               /* number of exts to add */
-        int             nlists;                 /* number of irec's (ex lists) */
-        ASSERT(ifp->if_flags & XFS_IFEXTIREC);
-        nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ;
-        erp = ifp->if_u1.if_ext_irec;
-        ep = &erp->er_extbuf[erp->er_extcount];
-        erp_next = erp + 1;
-        ep_next = erp_next->er_extbuf;
-        while (erp_idx < nlists - 1) {
-                /*
-                 * Check how many extent records are available in this irec.
-                 * If there is none skip the whole exercise.
-                 */
-                ext_avail = XFS_LINEAR_EXTS - erp->er_extcount;
-                if (ext_avail) {
-                        /*
-                         * Copy over as many as possible extent records into
-                         * the previous page.
-                         */
-                        ext_diff = MIN(ext_avail, erp_next->er_extcount);
-                        memcpy(ep, ep_next, ext_diff * sizeof(xfs_bmbt_rec_t));
-                        erp->er_extcount += ext_diff;
-                        erp_next->er_extcount -= ext_diff;
-                        /*
-                         * If the next irec is empty now we can simply
-                         * remove it.
-                         */
-                        if (erp_next->er_extcount == 0) {
-                                /*
-                                 * Free page before removing extent record
-                                 * so er_extoffs don't get modified in
-                                 * xfs_iext_irec_remove.
-                                 */
-                                kmem_free(erp_next->er_extbuf);
-                                erp_next->er_extbuf = NULL;
-                                xfs_iext_irec_remove(ifp, erp_idx + 1);
-                                erp = &ifp->if_u1.if_ext_irec[erp_idx];
-                                nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ;
-                        /*
-                         * If the next irec is not empty move up the content
-                         * that has not been copied to the previous page to
-                         * the beggining of this one.
-                         */
-                        } else {
-                                memmove(erp_next->er_extbuf, &ep_next[ext_diff],
-                                        erp_next->er_extcount *
-                                        sizeof(xfs_bmbt_rec_t));
-                                ep_next = erp_next->er_extbuf;
-                                memset(&ep_next[erp_next->er_extcount], 0,
-                                        (XFS_LINEAR_EXTS -
-                                                erp_next->er_extcount) *
-                                        sizeof(xfs_bmbt_rec_t));
-                        }
-                }
-                if (erp->er_extcount == XFS_LINEAR_EXTS) {
-                        erp_idx++;
-                        if (erp_idx < nlists)
-                                erp = &ifp->if_u1.if_ext_irec[erp_idx];
-                        else
-                                break;
-                }
-                ep = &erp->er_extbuf[erp->er_extcount];
-                erp_next = erp + 1;
-                ep_next = erp_next->er_extbuf;
-        }
-}
-/*
 * This is called to update the er_extoff field in the indirection
 * array when extents have been added or removed from one of the
 * extent lists. erp_idx contains the irec index to begin updating
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index ccba14eb9dbe..503ea89e8b9a 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -124,16 +124,27 @@ STATIC void	xlog_verify_tail_lsn(xlog_t *log, xlog_in_core_t *iclog,
 STATIC int      xlog_iclogs_empty(xlog_t *log);
 #if defined(XFS_LOG_TRACE)
+#define XLOG_TRACE_LOGGRANT_SIZE        2048
+#define XLOG_TRACE_ICLOG_SIZE           256
+void
+xlog_trace_loggrant_alloc(xlog_t *log)
+{
+        log->l_grant_trace = ktrace_alloc(XLOG_TRACE_LOGGRANT_SIZE, KM_NOFS);
+}
+void
+xlog_trace_loggrant_dealloc(xlog_t *log)
+{
+        ktrace_free(log->l_grant_trace);
+}
 void
 xlog_trace_loggrant(xlog_t *log, xlog_ticket_t *tic, xfs_caddr_t string)
 {
        unsigned long cnts;
-        if (!log->l_grant_trace) {
-                log->l_grant_trace = ktrace_alloc(2048, KM_NOSLEEP);
-                if (!log->l_grant_trace)
-                        return;
-        }
        /* ticket counts are 1 byte each */
        cnts = ((unsigned long)tic->t_ocnt) | ((unsigned long)tic->t_cnt) << 8;
@@ -157,10 +168,20 @@ xlog_trace_loggrant(xlog_t *log, xlog_ticket_t *tic, xfs_caddr_t string)
 }
 void
+xlog_trace_iclog_alloc(xlog_in_core_t *iclog)
+{
+        iclog->ic_trace = ktrace_alloc(XLOG_TRACE_ICLOG_SIZE, KM_NOFS);
+}
+void
+xlog_trace_iclog_dealloc(xlog_in_core_t *iclog)
+{
+        ktrace_free(iclog->ic_trace);
+}
+void
 xlog_trace_iclog(xlog_in_core_t *iclog, uint state)
 {
-        if (!iclog->ic_trace)
-                iclog->ic_trace = ktrace_alloc(256, KM_NOFS);
        ktrace_enter(iclog->ic_trace,
                     (void *)((unsigned long)state),
                     (void *)((unsigned long)current_pid()),
@@ -170,8 +191,15 @@ xlog_trace_iclog(xlog_in_core_t *iclog, uint state)
                     (void *)NULL, (void *)NULL);
 }
 #else
+#define xlog_trace_loggrant_alloc(log)
+#define xlog_trace_loggrant_dealloc(log)
 #define xlog_trace_loggrant(log,tic,string)
+#define xlog_trace_iclog_alloc(iclog)
+#define xlog_trace_iclog_dealloc(iclog)
 #define xlog_trace_iclog(iclog,state)
 #endif /* XFS_LOG_TRACE */
@@ -1009,7 +1037,7 @@ xlog_iodone(xfs_buf_t *bp)
         * layer, it means the underlyin device no longer supports
         * barrier I/O. Warn loudly and turn off barriers.
         */
-        if ((l->l_mp->m_flags & XFS_MOUNT_BARRIER) && !XFS_BUF_ORDERED(bp)) {
+        if ((l->l_mp->m_flags & XFS_MOUNT_BARRIER) && !XFS_BUF_ISORDERED(bp)) {
                l->l_mp->m_flags &= ~XFS_MOUNT_BARRIER;
                xfs_fs_cmn_err(CE_WARN, l->l_mp,
                                "xlog_iodone: Barriers are no longer supported"
@@ -1231,6 +1259,7 @@ xlog_alloc_log(xfs_mount_t	*mp,
        spin_lock_init(&log->l_grant_lock);
        sv_init(&log->l_flush_wait, 0, "flush_wait");
+        xlog_trace_loggrant_alloc(log);
        /* log record size must be multiple of BBSIZE; see xlog_rec_header_t */
        ASSERT((XFS_BUF_SIZE(bp) & BBMASK) == 0);
@@ -1285,6 +1314,8 @@ xlog_alloc_log(xfs_mount_t	*mp,
                sv_init(&iclog->ic_force_wait, SV_DEFAULT, "iclog-force");
                sv_init(&iclog->ic_write_wait, SV_DEFAULT, "iclog-write");
+                xlog_trace_iclog_alloc(iclog);
                iclogp = &iclog->ic_next;
        }
        *iclogp = log->l_iclog;                 /* complete ring */
@@ -1565,11 +1596,7 @@ xlog_dealloc_log(xlog_t *log)
                sv_destroy(&iclog->ic_force_wait);
                sv_destroy(&iclog->ic_write_wait);
                xfs_buf_free(iclog->ic_bp);
-#ifdef XFS_LOG_TRACE
+                xlog_trace_iclog_dealloc(iclog);
-                if (iclog->ic_trace != NULL) {
-                        ktrace_free(iclog->ic_trace);
-                }
-#endif
                next_iclog = iclog->ic_next;
                kmem_free(iclog);
                iclog = next_iclog;
@@ -1578,14 +1605,7 @@ xlog_dealloc_log(xlog_t *log)
        spinlock_destroy(&log->l_grant_lock);
        xfs_buf_free(log->l_xbuf);
-#ifdef XFS_LOG_TRACE
+        xlog_trace_loggrant_dealloc(log);
-        if (log->l_trace != NULL) {
-                ktrace_free(log->l_trace);
-        }
-        if (log->l_grant_trace != NULL) {
-                ktrace_free(log->l_grant_trace);
-        }
-#endif
        log->l_mp->m_log = NULL;
        kmem_free(log);
 }       /* xlog_dealloc_log */
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index c8a5b22ee3e3..e7d8f84443fa 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -448,7 +448,6 @@ typedef struct log {
        int                     l_grant_write_bytes;
 #ifdef XFS_LOG_TRACE
-        struct ktrace           *l_trace;
        struct ktrace           *l_grant_trace;
 #endif
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index aa238c8fbd7a..8b6812f66a15 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1838,6 +1838,12 @@ again:
 #endif
 }
+/*
+ * xfs_lock_two_inodes() can only be used to lock one type of lock
+ * at a time - the iolock or the ilock, but not both at once. If
+ * we lock both at once, lockdep will report false positives saying
+ * we have violated locking orders.
+ */
 void
 xfs_lock_two_inodes(
        xfs_inode_t             *ip0,
@@ -1848,6 +1854,8 @@ xfs_lock_two_inodes(
        int                     attempts = 0;
        xfs_log_item_t          *lp;
+        if (lock_mode & (XFS_IOLOCK_SHARED|XFS_IOLOCK_EXCL))
+                ASSERT((lock_mode & (XFS_ILOCK_SHARED|XFS_ILOCK_EXCL)) == 0);
        ASSERT(ip0->i_ino != ip1->i_ino);
        if (ip0->i_ino > ip1->i_ino) {
@@ -3152,6 +3160,13 @@ error1:	/* Just cancel transaction */
 /*
 * Zero file bytes between startoff and endoff inclusive.
 * The iolock is held exclusive and no blocks are buffered.
+ *
+ * This function is used by xfs_free_file_space() to zero
+ * partial blocks when the range to free is not block aligned.
+ * When unreserving space with boundaries that are not block
+ * aligned we round up the start and round down the end
+ * boundaries and then use this function to zero the parts of
+ * the blocks that got dropped during the rounding.
 */
 STATIC int
 xfs_zero_remaining_bytes(
@@ -3168,6 +3183,17 @@ xfs_zero_remaining_bytes(
        int                     nimap;
        int                     error = 0;
+        /*
+         * Avoid doing I/O beyond eof - it's not necessary
+         * since nothing can read beyond eof.  The space will
+         * be zeroed when the file is extended anyway.
+         */
+        if (startoff >= ip->i_size)
+                return 0;
+        if (endoff > ip->i_size)
+                endoff = ip->i_size;
        bp = xfs_buf_get_noaddr(mp->m_sb.sb_blocksize,
                                XFS_IS_REALTIME_INODE(ip) ?
                                mp->m_rtdev_targp : mp->m_ddev_targp);
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index a3f738cffdb6..edc6ba82e090 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -97,6 +97,16 @@ extern void warn_slowpath(const char *file, const int line,
        unlikely(__ret_warn_once);                              \
 })
+#define WARN_ONCE(condition, format...) ({                      \
+        static int __warned;                                    \
+        int __ret_warn_once = !!(condition);                    \
+                                                                \
+        if (unlikely(__ret_warn_once))                          \
+                if (WARN(!__warned, format))                    \
+                        __warned = 1;                           \
+        unlikely(__ret_warn_once);                              \
+})
 #define WARN_ON_RATELIMIT(condition, state)                     \
                WARN_ON((condition) && __ratelimit(state))
diff --git a/include/asm-mips/cevt-r4k.h b/include/asm-mips/cevt-r4k.h
new file mode 100644
index 000000000000..fa4328f9124f
--- /dev/null
+++ b/include/asm-mips/cevt-r4k.h
@@ -0,0 +1,46 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2008 Kevin D. Kissell
+ */
+/*
+ * Definitions used for common event timer implementation
+ * for MIPS 4K-type processors and their MIPS MT variants.
+ * Avoids unsightly extern declarations in C files.
+ */
+#ifndef __ASM_CEVT_R4K_H
+#define __ASM_CEVT_R4K_H
+DECLARE_PER_CPU(struct clock_event_device, mips_clockevent_device);
+void mips_event_handler(struct clock_event_device *dev);
+int c0_compare_int_usable(void);
+void mips_set_clock_mode(enum clock_event_mode, struct clock_event_device *);
+irqreturn_t c0_compare_interrupt(int, void *);
+extern struct irqaction c0_compare_irqaction;
+extern int cp0_timer_irq_installed;
+/*
+ * Possibly handle a performance counter interrupt.
+ * Return true if the timer interrupt should not be checked
+ */
+static inline int handle_perf_irq(int r2)
+{
+        /*
+         * The performance counter overflow interrupt may be shared with the
+         * timer interrupt (cp0_perfcount_irq < 0). If it is and a
+         * performance counter has overflowed (perf_irq() == IRQ_HANDLED)
+         * and we can't reliably determine if a counter interrupt has also
+         * happened (!r2) then don't check for a timer interrupt.
+         */
+        return (cp0_perfcount_irq < 0) &&
+                perf_irq() == IRQ_HANDLED &&
+                !r2;
+}
+#endif /* __ASM_CEVT_R4K_H */
diff --git a/include/asm-mips/irqflags.h b/include/asm-mips/irqflags.h
index 881e8866501d..701ec0ba8fa9 100644
--- a/include/asm-mips/irqflags.h
+++ b/include/asm-mips/irqflags.h
@@ -38,8 +38,17 @@ __asm__(
        "       .set    pop                                             \n"
        "       .endm");
+extern void smtc_ipi_replay(void);
 static inline void raw_local_irq_enable(void)
 {
+#ifdef CONFIG_MIPS_MT_SMTC
+        /*
+         * SMTC kernel needs to do a software replay of queued
+         * IPIs, at the cost of call overhead on each local_irq_enable()
+         */
+        smtc_ipi_replay();
+#endif
        __asm__ __volatile__(
                "raw_local_irq_enable"
                : /* no outputs */
@@ -47,6 +56,7 @@ static inline void raw_local_irq_enable(void)
                : "memory");
 }
 /*
 * For cli() we have to insert nops to make sure that the new value
 * has actually arrived in the status register before the end of this
@@ -185,15 +195,14 @@ __asm__(
        "       .set    pop                                             \n"
        "       .endm                                                   \n");
-extern void smtc_ipi_replay(void);
 static inline void raw_local_irq_restore(unsigned long flags)
 {
        unsigned long __tmp1;
-#ifdef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
+#ifdef CONFIG_MIPS_MT_SMTC
        /*
-         * CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY does prompt replay of deferred
+         * SMTC kernel needs to do a software replay of queued
         * IPIs, at the cost of branch and call overhead on each
         * local_irq_restore()
         */
@@ -208,6 +217,17 @@ static inline void raw_local_irq_restore(unsigned long flags)
                : "memory");
 }
+static inline void __raw_local_irq_restore(unsigned long flags)
+{
+        unsigned long __tmp1;
+        __asm__ __volatile__(
+                "raw_local_irq_restore\t%0"
+                : "=r" (__tmp1)
+                : "0" (flags)
+                : "memory");
+}
 static inline int raw_irqs_disabled_flags(unsigned long flags)
 {
 #ifdef CONFIG_MIPS_MT_SMTC
diff --git a/include/asm-mips/mipsregs.h b/include/asm-mips/mipsregs.h
index a46f8e258e6b..979866000da4 100644
--- a/include/asm-mips/mipsregs.h
+++ b/include/asm-mips/mipsregs.h
@@ -1462,7 +1462,7 @@ set_c0_##name(unsigned int set)					\
 {                                                               \
        unsigned int res;                                       \
        unsigned int omt;                                       \
-        unsigned int flags;                                     \
+        unsigned long flags;                                    \
                                                                \
        local_irq_save(flags);                                  \
        omt = __dmt();                                          \
@@ -1480,7 +1480,7 @@ clear_c0_##name(unsigned int clear)				\
 {                                                               \
        unsigned int res;                                       \
        unsigned int omt;                                       \
-        unsigned int flags;                                     \
+        unsigned long flags;                                    \
                                                                \
        local_irq_save(flags);                                  \
        omt = __dmt();                                          \
@@ -1498,7 +1498,7 @@ change_c0_##name(unsigned int change, unsigned int new)		\
 {                                                               \
        unsigned int res;                                       \
        unsigned int omt;                                       \
-        unsigned int flags;                                     \
+        unsigned long flags;                                    \
                                                                \
        local_irq_save(flags);                                  \
                                                                \
diff --git a/include/asm-mips/pgtable-32.h b/include/asm-mips/pgtable-32.h
index 4396e9ffd418..55813d6150c7 100644
--- a/include/asm-mips/pgtable-32.h
+++ b/include/asm-mips/pgtable-32.h
@@ -57,7 +57,7 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
 #define PMD_ORDER       1
 #define PTE_ORDER       0
-#define PTRS_PER_PGD    ((PAGE_SIZE << PGD_ORDER) / sizeof(pgd_t))
+#define PTRS_PER_PGD    (USER_PTRS_PER_PGD * 2)
 #define PTRS_PER_PTE    ((PAGE_SIZE << PTE_ORDER) / sizeof(pte_t))
 #define USER_PTRS_PER_PGD       (0x80000000UL/PGDIR_SIZE)
diff --git a/include/asm-mips/smtc.h b/include/asm-mips/smtc.h
index 3639b28f80db..ea60bf08dcb0 100644
--- a/include/asm-mips/smtc.h
+++ b/include/asm-mips/smtc.h
@@ -6,6 +6,7 @@
 */
 #include <asm/mips_mt.h>
+#include <asm/smtc_ipi.h>
 /*
 * System-wide SMTC status information
@@ -38,14 +39,15 @@ struct mm_struct;
 struct task_struct;
 void smtc_get_new_mmu_context(struct mm_struct *mm, unsigned long cpu);
+void self_ipi(struct smtc_ipi *);
 void smtc_flush_tlb_asid(unsigned long asid);
-extern int mipsmt_build_cpu_map(int startslot);
+extern int smtc_build_cpu_map(int startslot);
-extern void mipsmt_prepare_cpus(void);
+extern void smtc_prepare_cpus(int cpus);
 extern void smtc_smp_finish(void);
 extern void smtc_boot_secondary(int cpu, struct task_struct *t);
 extern void smtc_cpus_done(void);
 /*
 * Sharing the TLB between multiple VPEs means that the
 * "random" index selection function is not allowed to
diff --git a/include/asm-mips/sn/mapped_kernel.h b/include/asm-mips/sn/mapped_kernel.h
index c3dd5d0d525f..721496a0bb92 100644
--- a/include/asm-mips/sn/mapped_kernel.h
+++ b/include/asm-mips/sn/mapped_kernel.h
@@ -5,6 +5,8 @@
 #ifndef __ASM_SN_MAPPED_KERNEL_H
 #define __ASM_SN_MAPPED_KERNEL_H
+#include <linux/mmzone.h>
 /*
 * Note on how mapped kernels work: the text and data section is
 * compiled at cksseg segment (LOADADDR = 0xc001c000), and the
@@ -29,10 +31,8 @@
 #define MAPPED_ADDR_RO_TO_PHYS(x)       (x - REP_BASE)
 #define MAPPED_ADDR_RW_TO_PHYS(x)       (x - REP_BASE - 16777216)
-#define MAPPED_KERN_RO_PHYSBASE(n) \
+#define MAPPED_KERN_RO_PHYSBASE(n) (hub_data(n)->kern_vars.kv_ro_baseaddr)
-                        (PLAT_NODE_DATA(n)->kern_vars.kv_ro_baseaddr)
+#define MAPPED_KERN_RW_PHYSBASE(n) (hub_data(n)->kern_vars.kv_rw_baseaddr)
-#define MAPPED_KERN_RW_PHYSBASE(n) \
-                        (PLAT_NODE_DATA(n)->kern_vars.kv_rw_baseaddr)
 #define MAPPED_KERN_RO_TO_PHYS(x) \
                                ((unsigned long)MAPPED_ADDR_RO_TO_PHYS(x) | \
diff --git a/include/asm-mips/stackframe.h b/include/asm-mips/stackframe.h
index 051e1af0bb95..4c37c4e5f72e 100644
--- a/include/asm-mips/stackframe.h
+++ b/include/asm-mips/stackframe.h
@@ -297,14 +297,31 @@
 #ifdef CONFIG_MIPS_MT_SMTC
                .set    mips32r2
                /*
-                 * This may not really be necessary if ints are already
+                 * We need to make sure the read-modify-write
-                 * inhibited here.
+                 * of Status below isn't perturbed by an interrupt
+                 * or cross-TC access, so we need to do at least a DMT,
+                 * protected by an interrupt-inhibit. But setting IXMT
+                 * also creates a few-cycle window where an IPI could
+                 * be queued and not be detected before potentially
+                 * returning to a WAIT or user-mode loop. It must be
+                 * replayed.
+                 *
+                 * We're in the middle of a context switch, and
+                 * we can't dispatch it directly without trashing
+                 * some registers, so we'll try to detect this unlikely
+                 * case and program a software interrupt in the VPE,
+                 * as would be done for a cross-VPE IPI.  To accomodate
+                 * the handling of that case, we're doing a DVPE instead
+                 * of just a DMT here to protect against other threads.
+                 * This is a lot of cruft to cover a tiny window.
+                 * If you can find a better design, implement it!
+                 *
                 */
                mfc0    v0, CP0_TCSTATUS
                ori     v0, TCSTATUS_IXMT
                mtc0    v0, CP0_TCSTATUS
                _ehb
-                DMT     5                               # dmt a1
+                DVPE    5                               # dvpe a1
                jal     mips_ihb
 #endif /* CONFIG_MIPS_MT_SMTC */
                mfc0    a0, CP0_STATUS
@@ -325,17 +342,50 @@
 */
                LONG_L  v1, PT_TCSTATUS(sp)
                _ehb
-                mfc0    v0, CP0_TCSTATUS
+                mfc0    a0, CP0_TCSTATUS
                andi    v1, TCSTATUS_IXMT
-                /* We know that TCStatua.IXMT should be set from above */
+                bnez    v1, 0f
-                xori    v0, v0, TCSTATUS_IXMT
-                or      v0, v0, v1
+/*
-                mtc0    v0, CP0_TCSTATUS
+ * We'd like to detect any IPIs queued in the tiny window
-                _ehb
+ * above and request an software interrupt to service them
-                andi    a1, a1, VPECONTROL_TE
+ * when we ERET.
+ *
+ * Computing the offset into the IPIQ array of the executing
+ * TC's IPI queue in-line would be tedious.  We use part of
+ * the TCContext register to hold 16 bits of offset that we
+ * can add in-line to find the queue head.
+ */
+                mfc0    v0, CP0_TCCONTEXT
+                la      a2, IPIQ
+                srl     v0, v0, 16
+                addu    a2, a2, v0
+                LONG_L  v0, 0(a2)
+                beqz    v0, 0f
+/*
+ * If we have a queue, provoke dispatch within the VPE by setting C_SW1
+ */
+                mfc0    v0, CP0_CAUSE
+                ori     v0, v0, C_SW1
+                mtc0    v0, CP0_CAUSE
+0:
+                /*
+                 * This test should really never branch but
+                 * let's be prudent here.  Having atomized
+                 * the shared register modifications, we can
+                 * now EVPE, and must do so before interrupts
+                 * are potentially re-enabled.
+                 */
+                andi    a1, a1, MVPCONTROL_EVP
                beqz    a1, 1f
-                emt
+                evpe
 1:
+                /* We know that TCStatua.IXMT should be set from above */
+                xori    a0, a0, TCSTATUS_IXMT
+                or      a0, a0, v1
+                mtc0    a0, CP0_TCSTATUS
+                _ehb
                .set    mips0
 #endif /* CONFIG_MIPS_MT_SMTC */
                LONG_L  v1, PT_EPC(sp)
diff --git a/include/asm-x86/acpi.h b/include/asm-x86/acpi.h
index bd76299586b3..392e17336be1 100644
--- a/include/asm-x86/acpi.h
+++ b/include/asm-x86/acpi.h
@@ -140,6 +140,8 @@ static inline unsigned int acpi_processor_cstate_check(unsigned int max_cstate)
            boot_cpu_data.x86_model <= 0x05 &&
            boot_cpu_data.x86_mask < 0x0A)
                return 1;
+        else if (boot_cpu_has(X86_FEATURE_AMDC1E))
+                return 1;
        else
                return max_cstate;
 }
diff --git a/include/asm-x86/amd_iommu.h b/include/asm-x86/amd_iommu.h
index 783f43e58052..041d0db7da27 100644
--- a/include/asm-x86/amd_iommu.h
+++ b/include/asm-x86/amd_iommu.h
@@ -20,10 +20,13 @@
 #ifndef ASM_X86__AMD_IOMMU_H
 #define ASM_X86__AMD_IOMMU_H
+#include <linux/irqreturn.h>
 #ifdef CONFIG_AMD_IOMMU
 extern int amd_iommu_init(void);
 extern int amd_iommu_init_dma_ops(void);
 extern void amd_iommu_detect(void);
+extern irqreturn_t amd_iommu_int_handler(int irq, void *data);
 #else
 static inline int amd_iommu_init(void) { return -ENODEV; }
 static inline void amd_iommu_detect(void) { }
diff --git a/include/asm-x86/amd_iommu_types.h b/include/asm-x86/amd_iommu_types.h
index 1ffa4e53c989..b3085869a17b 100644
--- a/include/asm-x86/amd_iommu_types.h
+++ b/include/asm-x86/amd_iommu_types.h
@@ -37,6 +37,7 @@
 /* Capability offsets used by the driver */
 #define MMIO_CAP_HDR_OFFSET     0x00
 #define MMIO_RANGE_OFFSET       0x0c
+#define MMIO_MISC_OFFSET        0x10
 /* Masks, shifts and macros to parse the device range capability */
 #define MMIO_RANGE_LD_MASK      0xff000000
@@ -48,6 +49,7 @@
 #define MMIO_GET_LD(x)  (((x) & MMIO_RANGE_LD_MASK) >> MMIO_RANGE_LD_SHIFT)
 #define MMIO_GET_FD(x)  (((x) & MMIO_RANGE_FD_MASK) >> MMIO_RANGE_FD_SHIFT)
 #define MMIO_GET_BUS(x) (((x) & MMIO_RANGE_BUS_MASK) >> MMIO_RANGE_BUS_SHIFT)
+#define MMIO_MSI_NUM(x) ((x) & 0x1f)
 /* Flag masks for the AMD IOMMU exclusion range */
 #define MMIO_EXCL_ENABLE_MASK 0x01ULL
@@ -69,6 +71,25 @@
 /* MMIO status bits */
 #define MMIO_STATUS_COM_WAIT_INT_MASK   0x04
+/* event logging constants */
+#define EVENT_ENTRY_SIZE        0x10
+#define EVENT_TYPE_SHIFT        28
+#define EVENT_TYPE_MASK         0xf
+#define EVENT_TYPE_ILL_DEV      0x1
+#define EVENT_TYPE_IO_FAULT     0x2
+#define EVENT_TYPE_DEV_TAB_ERR  0x3
+#define EVENT_TYPE_PAGE_TAB_ERR 0x4
+#define EVENT_TYPE_ILL_CMD      0x5
+#define EVENT_TYPE_CMD_HARD_ERR 0x6
+#define EVENT_TYPE_IOTLB_INV_TO 0x7
+#define EVENT_TYPE_INV_DEV_REQ  0x8
+#define EVENT_DEVID_MASK        0xffff
+#define EVENT_DEVID_SHIFT       0
+#define EVENT_DOMID_MASK        0xffff
+#define EVENT_DOMID_SHIFT       0
+#define EVENT_FLAGS_MASK        0xfff
+#define EVENT_FLAGS_SHIFT       0x10
 /* feature control bits */
 #define CONTROL_IOMMU_EN        0x00ULL
 #define CONTROL_HT_TUN_EN       0x01ULL
@@ -109,6 +130,8 @@
 #define DEV_ENTRY_NMI_PASS      0xba
 #define DEV_ENTRY_LINT0_PASS    0xbe
 #define DEV_ENTRY_LINT1_PASS    0xbf
+#define DEV_ENTRY_MODE_MASK     0x07
+#define DEV_ENTRY_MODE_SHIFT    0x09
 /* constants to configure the command buffer */
 #define CMD_BUFFER_SIZE    8192
@@ -116,6 +139,10 @@
 #define MMIO_CMD_SIZE_SHIFT 56
 #define MMIO_CMD_SIZE_512 (0x9ULL << MMIO_CMD_SIZE_SHIFT)
+/* constants for event buffer handling */
+#define EVT_BUFFER_SIZE         8192 /* 512 entries */
+#define EVT_LEN_MASK            (0x9ULL << 56)
 #define PAGE_MODE_1_LEVEL 0x01
 #define PAGE_MODE_2_LEVEL 0x02
 #define PAGE_MODE_3_LEVEL 0x03
@@ -134,6 +161,7 @@
 #define IOMMU_MAP_SIZE_L3 (1ULL << 39)
 #define IOMMU_PTE_P  (1ULL << 0)
+#define IOMMU_PTE_TV (1ULL << 1)
 #define IOMMU_PTE_U  (1ULL << 59)
 #define IOMMU_PTE_FC (1ULL << 60)
 #define IOMMU_PTE_IR (1ULL << 61)
@@ -159,6 +187,9 @@
 #define MAX_DOMAIN_ID 65536
+/* FIXME: move this macro to <linux/pci.h> */
+#define PCI_BUS(x) (((x) >> 8) & 0xff)
 /*
 * This structure contains generic data for  IOMMU protection domains
 * independent of their use.
@@ -196,6 +227,15 @@ struct dma_ops_domain {
         * just calculate its address in constant time.
         */
        u64 **pte_pages;
+        /* This will be set to true when TLB needs to be flushed */
+        bool need_flush;
+        /*
+         * if this is a preallocated domain, keep the device for which it was
+         * preallocated in this variable
+         */
+        u16 target_dev;
 };
 /*
@@ -208,8 +248,9 @@ struct amd_iommu {
        /* locks the accesses to the hardware */
        spinlock_t lock;
-        /* device id of this IOMMU */
+        /* Pointer to PCI device of this IOMMU */
-        u16 devid;
+        struct pci_dev *dev;
        /*
         * Capability pointer. There could be more than one IOMMU per PCI
         * device function if there are more than one AMD IOMMU capability
@@ -225,6 +266,9 @@ struct amd_iommu {
        /* capabilities of that IOMMU read from ACPI */
        u32 cap;
+        /* pci domain of this IOMMU */
+        u16 pci_seg;
        /* first device this IOMMU handles. read from PCI */
        u16 first_device;
        /* last device this IOMMU handles. read from PCI */
@@ -240,9 +284,19 @@ struct amd_iommu {
        /* size of command buffer */
        u32 cmd_buf_size;
+        /* event buffer virtual address */
+        u8 *evt_buf;
+        /* size of event buffer */
+        u32 evt_buf_size;
+        /* MSI number for event interrupt */
+        u16 evt_msi_num;
        /* if one, we need to send a completion wait command */
        int need_sync;
+        /* true if interrupts for this IOMMU are already enabled */
+        bool int_enabled;
        /* default dma_ops domain for that IOMMU */
        struct dma_ops_domain *default_dom;
 };
@@ -322,6 +376,12 @@ extern unsigned long *amd_iommu_pd_alloc_bitmap;
 /* will be 1 if device isolation is enabled */
 extern int amd_iommu_isolate;
+/*
+ * If true, the addresses will be flushed on unmap time, not when
+ * they are reused
+ */
+extern bool amd_iommu_unmap_flush;
 /* takes a PCI device id and prints it out in a readable form */
 static inline void print_devid(u16 devid, int nl)
 {
diff --git a/include/asm-x86/apic.h b/include/asm-x86/apic.h
index 1311c82b165b..d76a0839abe9 100644
--- a/include/asm-x86/apic.h
+++ b/include/asm-x86/apic.h
@@ -134,9 +134,7 @@ static inline void ack_x2APIC_irq(void)
 static inline void ack_APIC_irq(void)
 {
        /*
-         * ack_APIC_irq() actually gets compiled as a single instruction:
+         * ack_APIC_irq() actually gets compiled as a single instruction
-         * - a single rmw on Pentium/82489DX
-         * - a single write on P6+ cores (CONFIG_X86_GOOD_APIC)
         * ... yummie.
         */
diff --git a/include/asm-x86/asm.h b/include/asm-x86/asm.h
index 2439ae49e8ac..e1355f44d7c3 100644
--- a/include/asm-x86/asm.h
+++ b/include/asm-x86/asm.h
@@ -20,17 +20,22 @@
 #define _ASM_PTR        __ASM_SEL(.long, .quad)
 #define _ASM_ALIGN      __ASM_SEL(.balign 4, .balign 8)
-#define _ASM_MOV_UL     __ASM_SIZE(mov)
+#define _ASM_MOV        __ASM_SIZE(mov)
 #define _ASM_INC        __ASM_SIZE(inc)
 #define _ASM_DEC        __ASM_SIZE(dec)
 #define _ASM_ADD        __ASM_SIZE(add)
 #define _ASM_SUB        __ASM_SIZE(sub)
 #define _ASM_XADD       __ASM_SIZE(xadd)
 #define _ASM_AX         __ASM_REG(ax)
 #define _ASM_BX         __ASM_REG(bx)
 #define _ASM_CX         __ASM_REG(cx)
 #define _ASM_DX         __ASM_REG(dx)
+#define _ASM_SP         __ASM_REG(sp)
+#define _ASM_BP         __ASM_REG(bp)
+#define _ASM_SI         __ASM_REG(si)
+#define _ASM_DI         __ASM_REG(di)
 /* Exception table entry */
 # define _ASM_EXTABLE(from,to) \
diff --git a/include/asm-x86/bitops.h b/include/asm-x86/bitops.h
index 61989b93b475..451a74762bd4 100644
--- a/include/asm-x86/bitops.h
+++ b/include/asm-x86/bitops.h
@@ -424,16 +424,6 @@ static inline int fls(int x)
 #undef ADDR
-static inline void set_bit_string(unsigned long *bitmap,
-                unsigned long i, int len)
-{
-        unsigned long end = i + len;
-        while (i < end) {
-                __set_bit(i, bitmap);
-                i++;
-        }
-}
 #ifdef __KERNEL__
 #include <asm-generic/bitops/sched.h>
diff --git a/include/asm-x86/cacheflush.h b/include/asm-x86/cacheflush.h
index 59859cb28a36..68840ef1b35a 100644
--- a/include/asm-x86/cacheflush.h
+++ b/include/asm-x86/cacheflush.h
@@ -24,6 +24,8 @@
 #define copy_from_user_page(vma, page, vaddr, dst, src, len)    \
        memcpy((dst), (src), (len))
+#define PG_non_WB                               PG_arch_1
+PAGEFLAG(NonWB, non_WB)
 /*
 * The set_memory_* API can be used to change various attributes of a virtual
@@ -66,6 +68,9 @@ int set_memory_rw(unsigned long addr, int numpages);
 int set_memory_np(unsigned long addr, int numpages);
 int set_memory_4k(unsigned long addr, int numpages);
+int set_memory_array_uc(unsigned long *addr, int addrinarray);
+int set_memory_array_wb(unsigned long *addr, int addrinarray);
 /*
 * For legacy compatibility with the old APIs, a few functions
 * are provided that work on a "struct page".
@@ -96,8 +101,6 @@ int set_pages_rw(struct page *page, int numpages);
 void clflush_cache_range(void *addr, unsigned int size);
-void cpa_init(void);
 #ifdef CONFIG_DEBUG_RODATA
 void mark_rodata_ro(void);
 extern const int rodata_test_data;
diff --git a/include/asm-x86/cpufeature.h b/include/asm-x86/cpufeature.h
index 8d45690bef5f..adfeae6586e1 100644
--- a/include/asm-x86/cpufeature.h
+++ b/include/asm-x86/cpufeature.h
@@ -80,6 +80,7 @@
 #define X86_FEATURE_UP          (3*32+ 9) /* smp kernel running on up */
 #define X86_FEATURE_FXSAVE_LEAK (3*32+10) /* "" FXSAVE leaks FOP/FIP/FOP */
 #define X86_FEATURE_ARCH_PERFMON (3*32+11) /* Intel Architectural PerfMon */
+#define X86_FEATURE_NOPL        (3*32+20) /* The NOPL (0F 1F) instructions */
 #define X86_FEATURE_PEBS        (3*32+12) /* Precise-Event Based Sampling */
 #define X86_FEATURE_BTS         (3*32+13) /* Branch Trace Store */
 #define X86_FEATURE_SYSCALL32   (3*32+14) /* "" syscall in ia32 userspace */
@@ -89,6 +90,7 @@
 #define X86_FEATURE_LFENCE_RDTSC (3*32+18) /* "" Lfence synchronizes RDTSC */
 #define X86_FEATURE_11AP        (3*32+19) /* "" Bad local APIC aka 11AP */
 #define X86_FEATURE_NOPL        (3*32+20) /* The NOPL (0F 1F) instructions */
+#define X86_FEATURE_AMDC1E      (3*32+21) /* AMD C1E detected */
 #define X86_FEATURE_XTOPOLOGY   (3*32+21) /* cpu topology enum extensions */
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
diff --git a/include/asm-x86/dma-mapping.h b/include/asm-x86/dma-mapping.h
index 5d200e78bd81..219c33d6361c 100644
--- a/include/asm-x86/dma-mapping.h
+++ b/include/asm-x86/dma-mapping.h
@@ -9,12 +9,12 @@
 #include <linux/scatterlist.h>
 #include <asm/io.h>
 #include <asm/swiotlb.h>
+#include <asm-generic/dma-coherent.h>
 extern dma_addr_t bad_dma_address;
 extern int iommu_merge;
-extern struct device fallback_dev;
+extern struct device x86_dma_fallback_dev;
 extern int panic_on_overflow;
-extern int force_iommu;
 struct dma_mapping_ops {
        int             (*mapping_error)(struct device *dev,
@@ -25,9 +25,6 @@ struct dma_mapping_ops {
                                void *vaddr, dma_addr_t dma_handle);
        dma_addr_t      (*map_single)(struct device *hwdev, phys_addr_t ptr,
                                size_t size, int direction);
-        /* like map_single, but doesn't check the device mask */
-        dma_addr_t      (*map_simple)(struct device *hwdev, phys_addr_t ptr,
-                                size_t size, int direction);
        void            (*unmap_single)(struct device *dev, dma_addr_t addr,
                                size_t size, int direction);
        void            (*sync_single_for_cpu)(struct device *hwdev,
@@ -68,7 +65,7 @@ static inline struct dma_mapping_ops *get_dma_ops(struct device *dev)
                return dma_ops;
        else
                return dev->archdata.dma_ops;
-#endif
+#endif /* ASM_X86__DMA_MAPPING_H */
 }
 /* Make sure we keep the same behaviour */
@@ -87,17 +84,14 @@ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+#define dma_is_consistent(d, h) (1)
-void *dma_alloc_coherent(struct device *dev, size_t size,
-                           dma_addr_t *dma_handle, gfp_t flag);
-void dma_free_coherent(struct device *dev, size_t size,
-                         void *vaddr, dma_addr_t dma_handle);
 extern int dma_supported(struct device *hwdev, u64 mask);
 extern int dma_set_mask(struct device *dev, u64 mask);
+extern void *dma_generic_alloc_coherent(struct device *dev, size_t size,
+                                        dma_addr_t *dma_addr, gfp_t flag);
 static inline dma_addr_t
 dma_map_single(struct device *hwdev, void *ptr, size_t size,
               int direction)
@@ -247,7 +241,68 @@ static inline int dma_get_cache_alignment(void)
        return boot_cpu_data.x86_clflush_size;
 }
-#define dma_is_consistent(d, h) (1)
+static inline unsigned long dma_alloc_coherent_mask(struct device *dev,
+                                                    gfp_t gfp)
+{
+        unsigned long dma_mask = 0;
-#include <asm-generic/dma-coherent.h>
+        dma_mask = dev->coherent_dma_mask;
-#endif /* ASM_X86__DMA_MAPPING_H */
+        if (!dma_mask)
+                dma_mask = (gfp & GFP_DMA) ? DMA_24BIT_MASK : DMA_32BIT_MASK;
+        return dma_mask;
+}
+static inline gfp_t dma_alloc_coherent_gfp_flags(struct device *dev, gfp_t gfp)
+{
+#ifdef CONFIG_X86_64
+        unsigned long dma_mask = dma_alloc_coherent_mask(dev, gfp);
+        if (dma_mask <= DMA_32BIT_MASK && !(gfp & GFP_DMA))
+                gfp |= GFP_DMA32;
+#endif
+       return gfp;
+}
+static inline void *
+dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
+                gfp_t gfp)
+{
+        struct dma_mapping_ops *ops = get_dma_ops(dev);
+        void *memory;
+        gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+        if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
+                return memory;
+        if (!dev) {
+                dev = &x86_dma_fallback_dev;
+                gfp |= GFP_DMA;
+        }
+        if (!is_device_dma_capable(dev))
+                return NULL;
+        if (!ops->alloc_coherent)
+                return NULL;
+        return ops->alloc_coherent(dev, size, dma_handle,
+                                   dma_alloc_coherent_gfp_flags(dev, gfp));
+}
+static inline void dma_free_coherent(struct device *dev, size_t size,
+                                     void *vaddr, dma_addr_t bus)
+{
+        struct dma_mapping_ops *ops = get_dma_ops(dev);
+        WARN_ON(irqs_disabled());       /* for portability */
+        if (dma_release_from_coherent(dev, get_order(size), vaddr))
+                return;
+        if (ops->free_coherent)
+                ops->free_coherent(dev, size, vaddr, bus);
+}
+#endif
diff --git a/include/asm-x86/elf.h b/include/asm-x86/elf.h
index cd678b2d6a74..5c4745bec906 100644
--- a/include/asm-x86/elf.h
+++ b/include/asm-x86/elf.h
@@ -148,8 +148,9 @@ do {						\
 static inline void start_ia32_thread(struct pt_regs *regs, u32 ip, u32 sp)
 {
-        asm volatile("movl %0,%%fs" :: "r" (0));
+        loadsegment(fs, 0);
-        asm volatile("movl %0,%%es; movl %0,%%ds" : : "r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
+        loadsegment(es, __USER32_DS);
        load_gs_index(0);
        regs->ip = ip;
        regs->sp = sp;
diff --git a/include/asm-x86/futex.h b/include/asm-x86/futex.h
index 45dc24d84186..06b924ef6fa5 100644
--- a/include/asm-x86/futex.h
+++ b/include/asm-x86/futex.h
@@ -25,7 +25,7 @@
        asm volatile("1:\tmovl  %2, %0\n"                       \
                     "\tmovl\t%0, %3\n"                         \
                     "\t" insn "\n"                             \
-                     "2:\tlock; cmpxchgl %3, %2\n"              \
+                     "2:\t" LOCK_PREFIX "cmpxchgl %3, %2\n"     \
                     "\tjnz\t1b\n"                              \
                     "3:\t.section .fixup,\"ax\"\n"             \
                     "4:\tmov\t%5, %1\n"                        \
@@ -64,7 +64,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
                __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
                break;
        case FUTEX_OP_ADD:
-                __futex_atomic_op1("lock; xaddl %0, %2", ret, oldval,
+                __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
                                   uaddr, oparg);
                break;
        case FUTEX_OP_OR:
@@ -122,7 +122,7 @@ static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
        if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
                return -EFAULT;
-        asm volatile("1:\tlock; cmpxchgl %3, %1\n"
+        asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
                     "2:\t.section .fixup, \"ax\"\n"
                     "3:\tmov     %2, %0\n"
                     "\tjmp     2b\n"
diff --git a/include/asm-x86/gart.h b/include/asm-x86/gart.h
index 07f445844146..605edb39ef9e 100644
--- a/include/asm-x86/gart.h
+++ b/include/asm-x86/gart.h
@@ -29,6 +29,8 @@ extern int fix_aperture;
 #define AMD64_GARTCACHECTL      0x9c
 #define AMD64_GARTEN            (1<<0)
+extern int agp_amd64_init(void);
 static inline void enable_gart_translation(struct pci_dev *dev, u64 addr)
 {
        u32 tmp, ctl;
@@ -52,15 +54,15 @@ static inline int aperture_valid(u64 aper_base, u32 aper_size, u32 min_size)
                return 0;
        if (aper_base + aper_size > 0x100000000ULL) {
-                printk(KERN_ERR "Aperture beyond 4GB. Ignoring.\n");
+                printk(KERN_INFO "Aperture beyond 4GB. Ignoring.\n");
                return 0;
        }
        if (e820_any_mapped(aper_base, aper_base + aper_size, E820_RAM)) {
-                printk(KERN_ERR "Aperture pointing to e820 RAM. Ignoring.\n");
+                printk(KERN_INFO "Aperture pointing to e820 RAM. Ignoring.\n");
                return 0;
        }
        if (aper_size < min_size) {
-                printk(KERN_ERR "Aperture too small (%d MB) than (%d MB)\n",
+                printk(KERN_INFO "Aperture too small (%d MB) than (%d MB)\n",
                                 aper_size>>20, min_size>>20);
                return 0;
        }
diff --git a/include/asm-x86/idle.h b/include/asm-x86/idle.h
index dc9c7944847b..baa3f783d27d 100644
--- a/include/asm-x86/idle.h
+++ b/include/asm-x86/idle.h
@@ -10,4 +10,6 @@ void idle_notifier_register(struct notifier_block *n);
 void enter_idle(void);
 void exit_idle(void);
+void c1e_remove_cpu(int cpu);
 #endif /* ASM_X86__IDLE_H */
diff --git a/include/asm-x86/iommu.h b/include/asm-x86/iommu.h
index e86f44148c66..546ad3110fea 100644
--- a/include/asm-x86/iommu.h
+++ b/include/asm-x86/iommu.h
@@ -6,6 +6,7 @@ extern void no_iommu_init(void);
 extern struct dma_mapping_ops nommu_dma_ops;
 extern int force_iommu, no_iommu;
 extern int iommu_detected;
+extern int dmar_disabled;
 extern unsigned long iommu_num_pages(unsigned long addr, unsigned long len);
diff --git a/include/asm-x86/kgdb.h b/include/asm-x86/kgdb.h
index 83a7ee228ab1..d283863354de 100644
--- a/include/asm-x86/kgdb.h
+++ b/include/asm-x86/kgdb.h
@@ -39,12 +39,13 @@ enum regnames {
        GDB_FS,                 /* 14 */
        GDB_GS,                 /* 15 */
 };
+#define NUMREGBYTES             ((GDB_GS+1)*4)
 #else /* ! CONFIG_X86_32 */
-enum regnames {
+enum regnames64 {
        GDB_AX,                 /* 0 */
-        GDB_DX,                 /* 1 */
+        GDB_BX,                 /* 1 */
        GDB_CX,                 /* 2 */
-        GDB_BX,                 /* 3 */
+        GDB_DX,                 /* 3 */
        GDB_SI,                 /* 4 */
        GDB_DI,                 /* 5 */
        GDB_BP,                 /* 6 */
@@ -58,18 +59,15 @@ enum regnames {
        GDB_R14,                /* 14 */
        GDB_R15,                /* 15 */
        GDB_PC,                 /* 16 */
-        GDB_PS,                 /* 17 */
 };
-#endif /* CONFIG_X86_32 */
-/*
+enum regnames32 {
- * Number of bytes of registers:
+        GDB_PS = 34,
- */
+        GDB_CS,
-#ifdef CONFIG_X86_32
+        GDB_SS,
-# define NUMREGBYTES            64
+};
-#else
+#define NUMREGBYTES             ((GDB_SS+1)*4)
-# define NUMREGBYTES            ((GDB_PS+1)*8)
+#endif /* CONFIG_X86_32 */
-#endif
 static inline void arch_kgdb_breakpoint(void)
 {
diff --git a/include/asm-x86/mach-rdc321x/gpio.h b/include/asm-x86/mach-rdc321x/gpio.h
index 6184561980f2..94b6cdf532e2 100644
--- a/include/asm-x86/mach-rdc321x/gpio.h
+++ b/include/asm-x86/mach-rdc321x/gpio.h
@@ -1,6 +1,8 @@
 #ifndef ASM_X86__MACH_RDC321X__GPIO_H
 #define ASM_X86__MACH_RDC321X__GPIO_H
+#include <linux/kernel.h>
 extern int rdc_gpio_get_value(unsigned gpio);
 extern void rdc_gpio_set_value(unsigned gpio, int value);
 extern int rdc_gpio_direction_input(unsigned gpio);
@@ -18,6 +20,7 @@ static inline int gpio_request(unsigned gpio, const char *label)
 static inline void gpio_free(unsigned gpio)
 {
+        might_sleep();
        rdc_gpio_free(gpio);
 }
diff --git a/include/asm-x86/mmu.h b/include/asm-x86/mmu.h
index a30d7a9c8297..9d5aff14334a 100644
--- a/include/asm-x86/mmu.h
+++ b/include/asm-x86/mmu.h
@@ -7,14 +7,9 @@
 /*
 * The x86 doesn't have a mmu context, but
 * we put the segment information here.
- *
- * cpu_vm_mask is used to optimize ldt flushing.
 */
 typedef struct {
        void *ldt;
-#ifdef CONFIG_X86_64
-        rwlock_t ldtlock;
-#endif
        int size;
        struct mutex lock;
        void *vdso;
diff --git a/include/asm-x86/mpspec.h b/include/asm-x86/mpspec.h
index 118da365e371..be2241a818f1 100644
--- a/include/asm-x86/mpspec.h
+++ b/include/asm-x86/mpspec.h
@@ -5,11 +5,12 @@
 #include <asm/mpspec_def.h>
+extern int apic_version[MAX_APICS];
 #ifdef CONFIG_X86_32
 #include <mach_mpspec.h>
 extern unsigned int def_to_bigsmp;
-extern int apic_version[MAX_APICS];
 extern u8 apicid_2_node[];
 extern int pic_mode;
diff --git a/include/asm-x86/nmi.h b/include/asm-x86/nmi.h
index f8b76f383904..d5e715f024dc 100644
--- a/include/asm-x86/nmi.h
+++ b/include/asm-x86/nmi.h
@@ -34,6 +34,7 @@ extern void stop_apic_nmi_watchdog(void *);
 extern void disable_timer_nmi_watchdog(void);
 extern void enable_timer_nmi_watchdog(void);
 extern int nmi_watchdog_tick(struct pt_regs *regs, unsigned reason);
+extern void cpu_nmi_set_wd_enabled(void);
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
diff --git a/include/asm-x86/page.h b/include/asm-x86/page.h
index 79544e6ffb8b..c91574776751 100644
--- a/include/asm-x86/page.h
+++ b/include/asm-x86/page.h
@@ -57,6 +57,7 @@ typedef struct { pgdval_t pgd; } pgd_t;
 typedef struct { pgprotval_t pgprot; } pgprot_t;
 extern int page_is_ram(unsigned long pagenr);
+extern int pagerange_is_ram(unsigned long start, unsigned long end);
 extern int devmem_is_allowed(unsigned long pagenr);
 extern void map_devmem(unsigned long pfn, unsigned long size,
                       pgprot_t vma_prot);
diff --git a/include/asm-x86/page_32.h b/include/asm-x86/page_32.h
index f32062a821c5..72f7305682c6 100644
--- a/include/asm-x86/page_32.h
+++ b/include/asm-x86/page_32.h
@@ -89,9 +89,6 @@ extern int nx_enabled;
 extern unsigned int __VMALLOC_RESERVE;
 extern int sysctl_legacy_va_layout;
-#define VMALLOC_RESERVE         ((unsigned long)__VMALLOC_RESERVE)
-#define MAXMEM                  (-__PAGE_OFFSET - __VMALLOC_RESERVE)
 extern void find_low_pfn_range(void);
 extern unsigned long init_memory_mapping(unsigned long start,
                                         unsigned long end);
diff --git a/include/asm-x86/paravirt.h b/include/asm-x86/paravirt.h
index cba612c89e06..d7d358a43996 100644
--- a/include/asm-x86/paravirt.h
+++ b/include/asm-x86/paravirt.h
@@ -252,13 +252,13 @@ struct pv_mmu_ops {
         * Hooks for allocating/releasing pagetable pages when they're
         * attached to a pagetable
         */
-        void (*alloc_pte)(struct mm_struct *mm, u32 pfn);
+        void (*alloc_pte)(struct mm_struct *mm, unsigned long pfn);
-        void (*alloc_pmd)(struct mm_struct *mm, u32 pfn);
+        void (*alloc_pmd)(struct mm_struct *mm, unsigned long pfn);
-        void (*alloc_pmd_clone)(u32 pfn, u32 clonepfn, u32 start, u32 count);
+        void (*alloc_pmd_clone)(unsigned long pfn, unsigned long clonepfn, unsigned long start, unsigned long count);
-        void (*alloc_pud)(struct mm_struct *mm, u32 pfn);
+        void (*alloc_pud)(struct mm_struct *mm, unsigned long pfn);
-        void (*release_pte)(u32 pfn);
+        void (*release_pte)(unsigned long pfn);
-        void (*release_pmd)(u32 pfn);
+        void (*release_pmd)(unsigned long pfn);
-        void (*release_pud)(u32 pfn);
+        void (*release_pud)(unsigned long pfn);
        /* Pagetable manipulation functions */
        void (*set_pte)(pte_t *ptep, pte_t pteval);
@@ -986,35 +986,35 @@ static inline void paravirt_pgd_free(struct mm_struct *mm, pgd_t *pgd)
        PVOP_VCALL2(pv_mmu_ops.pgd_free, mm, pgd);
 }
-static inline void paravirt_alloc_pte(struct mm_struct *mm, unsigned pfn)
+static inline void paravirt_alloc_pte(struct mm_struct *mm, unsigned long pfn)
 {
        PVOP_VCALL2(pv_mmu_ops.alloc_pte, mm, pfn);
 }
-static inline void paravirt_release_pte(unsigned pfn)
+static inline void paravirt_release_pte(unsigned long pfn)
 {
        PVOP_VCALL1(pv_mmu_ops.release_pte, pfn);
 }
-static inline void paravirt_alloc_pmd(struct mm_struct *mm, unsigned pfn)
+static inline void paravirt_alloc_pmd(struct mm_struct *mm, unsigned long pfn)
 {
        PVOP_VCALL2(pv_mmu_ops.alloc_pmd, mm, pfn);
 }
-static inline void paravirt_alloc_pmd_clone(unsigned pfn, unsigned clonepfn,
+static inline void paravirt_alloc_pmd_clone(unsigned long pfn, unsigned long clonepfn,
-                                            unsigned start, unsigned count)
+                                            unsigned long start, unsigned long count)
 {
        PVOP_VCALL4(pv_mmu_ops.alloc_pmd_clone, pfn, clonepfn, start, count);
 }
-static inline void paravirt_release_pmd(unsigned pfn)
+static inline void paravirt_release_pmd(unsigned long pfn)
 {
        PVOP_VCALL1(pv_mmu_ops.release_pmd, pfn);
 }
-static inline void paravirt_alloc_pud(struct mm_struct *mm, unsigned pfn)
+static inline void paravirt_alloc_pud(struct mm_struct *mm, unsigned long pfn)
 {
        PVOP_VCALL2(pv_mmu_ops.alloc_pud, mm, pfn);
 }
-static inline void paravirt_release_pud(unsigned pfn)
+static inline void paravirt_release_pud(unsigned long pfn)
 {
        PVOP_VCALL1(pv_mmu_ops.release_pud, pfn);
 }
diff --git a/include/asm-x86/pgtable-2level.h b/include/asm-x86/pgtable-2level.h
index 60440b191626..81762081dcd8 100644
--- a/include/asm-x86/pgtable-2level.h
+++ b/include/asm-x86/pgtable-2level.h
@@ -53,9 +53,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *xp)
 #define native_ptep_get_and_clear(xp) native_local_ptep_get_and_clear(xp)
 #endif
-#define pte_page(x)             pfn_to_page(pte_pfn(x))
 #define pte_none(x)             (!(x).pte_low)
-#define pte_pfn(x)              (pte_val(x) >> PAGE_SHIFT)
 /*
 * Bits 0, 6 and 7 are taken, split up the 29 bits of offset
diff --git a/include/asm-x86/pgtable-3level.h b/include/asm-x86/pgtable-3level.h
index e713bd5f39a6..75f4276b5ddb 100644
--- a/include/asm-x86/pgtable-3level.h
+++ b/include/asm-x86/pgtable-3level.h
@@ -151,18 +151,11 @@ static inline int pte_same(pte_t a, pte_t b)
        return a.pte_low == b.pte_low && a.pte_high == b.pte_high;
 }
-#define pte_page(x)     pfn_to_page(pte_pfn(x))
 static inline int pte_none(pte_t pte)
 {
        return !pte.pte_low && !pte.pte_high;
 }
-static inline unsigned long pte_pfn(pte_t pte)
-{
-        return (pte_val(pte) & PTE_PFN_MASK) >> PAGE_SHIFT;
-}
 /*
 * Bits 0, 6 and 7 are taken in the low part of the pte,
 * put the 32 bits of offset into the high part.
diff --git a/include/asm-x86/pgtable.h b/include/asm-x86/pgtable.h
index 57d919a2d79d..ed932453ef26 100644
--- a/include/asm-x86/pgtable.h
+++ b/include/asm-x86/pgtable.h
@@ -19,6 +19,7 @@
 #define _PAGE_BIT_UNUSED3       11
 #define _PAGE_BIT_PAT_LARGE     12      /* On 2MB or 1GB pages */
 #define _PAGE_BIT_SPECIAL       _PAGE_BIT_UNUSED1
+#define _PAGE_BIT_CPA_TEST      _PAGE_BIT_UNUSED1
 #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
 #define _PAGE_PRESENT   (_AT(pteval_t, 1) << _PAGE_BIT_PRESENT)
@@ -36,6 +37,7 @@
 #define _PAGE_PAT       (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
 #define _PAGE_SPECIAL   (_AT(pteval_t, 1) << _PAGE_BIT_SPECIAL)
+#define _PAGE_CPA_TEST  (_AT(pteval_t, 1) << _PAGE_BIT_CPA_TEST)
 #define __HAVE_ARCH_PTE_SPECIAL
 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
@@ -130,6 +132,17 @@
 #define __S110  PAGE_SHARED_EXEC
 #define __S111  PAGE_SHARED_EXEC
+/*
+ * early identity mapping  pte attrib macros.
+ */
+#ifdef CONFIG_X86_64
+#define __PAGE_KERNEL_IDENT_LARGE_EXEC  __PAGE_KERNEL_LARGE_EXEC
+#else
+#define PTE_IDENT_ATTR   0x003          /* PRESENT+RW */
+#define PDE_IDENT_ATTR   0x063          /* PRESENT+RW+DIRTY+ACCESSED */
+#define PGD_IDENT_ATTR   0x001          /* PRESENT (no other attributes) */
+#endif
 #ifndef __ASSEMBLY__
 /*
@@ -186,6 +199,13 @@ static inline int pte_special(pte_t pte)
        return pte_val(pte) & _PAGE_SPECIAL;
 }
+static inline unsigned long pte_pfn(pte_t pte)
+{
+        return (pte_val(pte) & PTE_PFN_MASK) >> PAGE_SHIFT;
+}
+#define pte_page(pte)   pfn_to_page(pte_pfn(pte))
 static inline int pmd_large(pmd_t pte)
 {
        return (pmd_val(pte) & (_PAGE_PSE | _PAGE_PRESENT)) ==
diff --git a/include/asm-x86/pgtable_32.h b/include/asm-x86/pgtable_32.h
index 45c8235400fe..8de702dc7d62 100644
--- a/include/asm-x86/pgtable_32.h
+++ b/include/asm-x86/pgtable_32.h
@@ -57,8 +57,7 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
 * area for the same reason. ;)
 */
 #define VMALLOC_OFFSET  (8 * 1024 * 1024)
-#define VMALLOC_START   (((unsigned long)high_memory + 2 * VMALLOC_OFFSET - 1) \
+#define VMALLOC_START   ((unsigned long)high_memory + VMALLOC_OFFSET)
-                         & ~(VMALLOC_OFFSET - 1))
 #ifdef CONFIG_X86_PAE
 #define LAST_PKMAP 512
 #else
@@ -74,6 +73,8 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
 # define VMALLOC_END    (FIXADDR_START - 2 * PAGE_SIZE)
 #endif
+#define MAXMEM  (VMALLOC_END - PAGE_OFFSET - __VMALLOC_RESERVE)
 /*
 * Define this if things work differently on an i386 and an i486:
 * it will (on an i486) warn about kernel memory accesses that are
diff --git a/include/asm-x86/pgtable_64.h b/include/asm-x86/pgtable_64.h
index e3dcf7a08a0b..fde9770e53d1 100644
--- a/include/asm-x86/pgtable_64.h
+++ b/include/asm-x86/pgtable_64.h
@@ -175,8 +175,6 @@ static inline int pmd_bad(pmd_t pmd)
 #define pte_present(x)  (pte_val((x)) & (_PAGE_PRESENT | _PAGE_PROTNONE))
 #define pages_to_mb(x)  ((x) >> (20 - PAGE_SHIFT))   /* FIXME: is this right? */
-#define pte_page(x)     pfn_to_page(pte_pfn((x)))
-#define pte_pfn(x)      ((pte_val((x)) & __PHYSICAL_MASK) >> PAGE_SHIFT)
 /*
 * Macro to mark a page protection value as "uncacheable".
diff --git a/include/asm-x86/ptrace.h b/include/asm-x86/ptrace.h
index 33a034be8b5c..d64a61097165 100644
--- a/include/asm-x86/ptrace.h
+++ b/include/asm-x86/ptrace.h
@@ -250,6 +250,11 @@ static inline unsigned long frame_pointer(struct pt_regs *regs)
        return regs->bp;
 }
+static inline unsigned long user_stack_pointer(struct pt_regs *regs)
+{
+        return regs->sp;
+}
 /*
 * These are defined as per linux/ptrace.h, which see.
 */
diff --git a/include/asm-x86/resume-trace.h b/include/asm-x86/resume-trace.h
index 519a8ecbfc95..e39376d7de50 100644
--- a/include/asm-x86/resume-trace.h
+++ b/include/asm-x86/resume-trace.h
@@ -7,7 +7,7 @@
 do {                                                            \
        if (pm_trace_enabled) {                                 \
                const void *tracedata;                          \
-                asm volatile(_ASM_MOV_UL " $1f,%0\n"            \
+                asm volatile(_ASM_MOV " $1f,%0\n"               \
                             ".section .tracedata,\"a\"\n"      \
                             "1:\t.word %c1\n\t"                \
                             _ASM_PTR " %c2\n"                  \
diff --git a/include/asm-x86/spinlock.h b/include/asm-x86/spinlock.h
index 5d08fa280fdf..93adae338ac6 100644
--- a/include/asm-x86/spinlock.h
+++ b/include/asm-x86/spinlock.h
@@ -97,7 +97,7 @@ static __always_inline int __ticket_spin_trylock(raw_spinlock_t *lock)
                     "jne 1f\n\t"
                     "movw %w0,%w1\n\t"
                     "incb %h1\n\t"
-                     "lock ; cmpxchgw %w1,%2\n\t"
+                     LOCK_PREFIX "cmpxchgw %w1,%2\n\t"
                     "1:"
                     "sete %b1\n\t"
                     "movzbl %b1,%0\n\t"
@@ -135,7 +135,7 @@ static __always_inline void __ticket_spin_lock(raw_spinlock_t *lock)
        int inc = 0x00010000;
        int tmp;
-        asm volatile("lock ; xaddl %0, %1\n"
+        asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
                     "movzwl %w0, %2\n\t"
                     "shrl $16, %0\n\t"
                     "1:\t"
@@ -162,7 +162,7 @@ static __always_inline int __ticket_spin_trylock(raw_spinlock_t *lock)
                     "cmpl %0,%1\n\t"
                     "jne 1f\n\t"
                     "addl $0x00010000, %1\n\t"
-                     "lock ; cmpxchgl %1,%2\n\t"
+                     LOCK_PREFIX "cmpxchgl %1,%2\n\t"
                     "1:"
                     "sete %b1\n\t"
                     "movzbl %b1,%0\n\t"
diff --git a/include/asm-x86/syscall.h b/include/asm-x86/syscall.h
new file mode 100644
index 000000000000..04c47dc5597c
--- /dev/null
+++ b/include/asm-x86/syscall.h
@@ -0,0 +1,211 @@
+/*
+ * Access to user system call parameters and results
+ *
+ * Copyright (C) 2008 Red Hat, Inc.  All rights reserved.
+ *
+ * This copyrighted material is made available to anyone wishing to use,
+ * modify, copy, or redistribute it subject to the terms and conditions
+ * of the GNU General Public License v.2.
+ *
+ * See asm-generic/syscall.h for descriptions of what we must do here.
+ */
+#ifndef _ASM_SYSCALL_H
+#define _ASM_SYSCALL_H  1
+#include <linux/sched.h>
+#include <linux/err.h>
+static inline long syscall_get_nr(struct task_struct *task,
+                                  struct pt_regs *regs)
+{
+        /*
+         * We always sign-extend a -1 value being set here,
+         * so this is always either -1L or a syscall number.
+         */
+        return regs->orig_ax;
+}
+static inline void syscall_rollback(struct task_struct *task,
+                                    struct pt_regs *regs)
+{
+        regs->ax = regs->orig_ax;
+}
+static inline long syscall_get_error(struct task_struct *task,
+                                     struct pt_regs *regs)
+{
+        unsigned long error = regs->ax;
+#ifdef CONFIG_IA32_EMULATION
+        /*
+         * TS_COMPAT is set for 32-bit syscall entries and then
+         * remains set until we return to user mode.
+         */
+        if (task_thread_info(task)->status & TS_COMPAT)
+                /*
+                 * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
+                 * and will match correctly in comparisons.
+                 */
+                error = (long) (int) error;
+#endif
+        return IS_ERR_VALUE(error) ? error : 0;
+}
+static inline long syscall_get_return_value(struct task_struct *task,
+                                            struct pt_regs *regs)
+{
+        return regs->ax;
+}
+static inline void syscall_set_return_value(struct task_struct *task,
+                                            struct pt_regs *regs,
+                                            int error, long val)
+{
+        regs->ax = (long) error ?: val;
+}
+#ifdef CONFIG_X86_32
+static inline void syscall_get_arguments(struct task_struct *task,
+                                         struct pt_regs *regs,
+                                         unsigned int i, unsigned int n,
+                                         unsigned long *args)
+{
+        BUG_ON(i + n > 6);
+        memcpy(args, &regs->bx + i, n * sizeof(args[0]));
+}
+static inline void syscall_set_arguments(struct task_struct *task,
+                                         struct pt_regs *regs,
+                                         unsigned int i, unsigned int n,
+                                         const unsigned long *args)
+{
+        BUG_ON(i + n > 6);
+        memcpy(&regs->bx + i, args, n * sizeof(args[0]));
+}
+#else    /* CONFIG_X86_64 */
+static inline void syscall_get_arguments(struct task_struct *task,
+                                         struct pt_regs *regs,
+                                         unsigned int i, unsigned int n,
+                                         unsigned long *args)
+{
+# ifdef CONFIG_IA32_EMULATION
+        if (task_thread_info(task)->status & TS_COMPAT)
+                switch (i + n) {
+                case 6:
+                        if (!n--) break;
+                        *args++ = regs->bp;
+                case 5:
+                        if (!n--) break;
+                        *args++ = regs->di;
+                case 4:
+                        if (!n--) break;
+                        *args++ = regs->si;
+                case 3:
+                        if (!n--) break;
+                        *args++ = regs->dx;
+                case 2:
+                        if (!n--) break;
+                        *args++ = regs->cx;
+                case 1:
+                        if (!n--) break;
+                        *args++ = regs->bx;
+                case 0:
+                        if (!n--) break;
+                default:
+                        BUG();
+                        break;
+                }
+        else
+# endif
+                switch (i + n) {
+                case 6:
+                        if (!n--) break;
+                        *args++ = regs->r9;
+                case 5:
+                        if (!n--) break;
+                        *args++ = regs->r8;
+                case 4:
+                        if (!n--) break;
+                        *args++ = regs->r10;
+                case 3:
+                        if (!n--) break;
+                        *args++ = regs->dx;
+                case 2:
+                        if (!n--) break;
+                        *args++ = regs->si;
+                case 1:
+                        if (!n--) break;
+                        *args++ = regs->di;
+                case 0:
+                        if (!n--) break;
+                default:
+                        BUG();
+                        break;
+                }
+}
+static inline void syscall_set_arguments(struct task_struct *task,
+                                         struct pt_regs *regs,
+                                         unsigned int i, unsigned int n,
+                                         const unsigned long *args)
+{
+# ifdef CONFIG_IA32_EMULATION
+        if (task_thread_info(task)->status & TS_COMPAT)
+                switch (i + n) {
+                case 6:
+                        if (!n--) break;
+                        regs->bp = *args++;
+                case 5:
+                        if (!n--) break;
+                        regs->di = *args++;
+                case 4:
+                        if (!n--) break;
+                        regs->si = *args++;
+                case 3:
+                        if (!n--) break;
+                        regs->dx = *args++;
+                case 2:
+                        if (!n--) break;
+                        regs->cx = *args++;
+                case 1:
+                        if (!n--) break;
+                        regs->bx = *args++;
+                case 0:
+                        if (!n--) break;
+                default:
+                        BUG();
+                }
+        else
+# endif
+                switch (i + n) {
+                case 6:
+                        if (!n--) break;
+                        regs->r9 = *args++;
+                case 5:
+                        if (!n--) break;
+                        regs->r8 = *args++;
+                case 4:
+                        if (!n--) break;
+                        regs->r10 = *args++;
+                case 3:
+                        if (!n--) break;
+                        regs->dx = *args++;
+                case 2:
+                        if (!n--) break;
+                        regs->si = *args++;
+                case 1:
+                        if (!n--) break;
+                        regs->di = *args++;
+                case 0:
+                        if (!n--) break;
+                default:
+                        BUG();
+                }
+}
+#endif  /* CONFIG_X86_32 */
+#endif  /* _ASM_SYSCALL_H */
diff --git a/include/asm-x86/thread_info.h b/include/asm-x86/thread_info.h
index 30586f2ee558..3f4e52bb77f5 100644
--- a/include/asm-x86/thread_info.h
+++ b/include/asm-x86/thread_info.h
@@ -71,6 +71,7 @@ struct thread_info {
 * Warning: layout of LSW is hardcoded in entry.S
 */
 #define TIF_SYSCALL_TRACE       0       /* syscall trace active */
+#define TIF_NOTIFY_RESUME       1       /* callback before returning to user */
 #define TIF_SIGPENDING          2       /* signal pending */
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_SINGLESTEP          4       /* reenable singlestep on user return*/
@@ -93,6 +94,7 @@ struct thread_info {
 #define TIF_BTS_TRACE_TS        27      /* record scheduling event timestamps */
 #define _TIF_SYSCALL_TRACE      (1 << TIF_SYSCALL_TRACE)
+#define _TIF_NOTIFY_RESUME      (1 << TIF_NOTIFY_RESUME)
 #define _TIF_SIGPENDING         (1 << TIF_SIGPENDING)
 #define _TIF_SINGLESTEP         (1 << TIF_SINGLESTEP)
 #define _TIF_NEED_RESCHED       (1 << TIF_NEED_RESCHED)
@@ -133,7 +135,7 @@ struct thread_info {
 /* Only used for 64 bit */
 #define _TIF_DO_NOTIFY_MASK                                             \
-        (_TIF_SIGPENDING|_TIF_MCE_NOTIFY)
+        (_TIF_SIGPENDING|_TIF_MCE_NOTIFY|_TIF_NOTIFY_RESUME)
 /* flags to check in __switch_to() */
 #define _TIF_WORK_CTXSW                                                 \
diff --git a/include/asm-x86/uaccess_64.h b/include/asm-x86/uaccess_64.h
index 5cfd2951c9e7..c96c1f5d07a2 100644
--- a/include/asm-x86/uaccess_64.h
+++ b/include/asm-x86/uaccess_64.h
@@ -7,6 +7,7 @@
 #include <linux/compiler.h>
 #include <linux/errno.h>
 #include <linux/prefetch.h>
+#include <linux/lockdep.h>
 #include <asm/page.h>
 /*
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 1ce19c1ef0e9..a26ebd25bac1 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -667,6 +667,15 @@ static inline int ata_id_has_dword_io(const u16 *id)
        return 0;
 }
+static inline int ata_id_has_unload(const u16 *id)
+{
+        if (ata_id_major_version(id) >= 7 &&
+            (id[ATA_ID_CFSSE] & 0xC000) == 0x4000 &&
+            id[ATA_ID_CFSSE] & (1 << 13))
+                return 1;
+        return 0;
+}
 static inline int ata_id_current_chs_valid(const u16 *id)
 {
        /* For ATA-1 devices, if the INITIALIZE DEVICE PARAMETERS command
@@ -745,7 +754,7 @@ static inline int ata_ok(u8 status)
 static inline int lba_28_ok(u64 block, u32 n_block)
 {
        /* check the ending block number */
-        return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
+        return ((block + n_block) < ((u64)1 << 28)) && (n_block <= 256);
 }
 static inline int lba_48_ok(u64 block, u32 n_block)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 44710d7e7bff..53ea933cf60b 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -843,8 +843,6 @@ extern int blkdev_issue_flush(struct block_device *, sector_t *);
 */
 extern int blk_verify_command(struct blk_cmd_filter *filter,
                              unsigned char *cmd, int has_write_perm);
-extern int blk_register_filter(struct gendisk *disk);
-extern void blk_unregister_filter(struct gendisk *disk);
 extern void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter);
 #define MAX_PHYS_SEGMENTS 128
diff --git a/arch/arm/include/asm/cnt32_to_63.h b/include/linux/cnt32_to_63.h
index 480c873fa746..8c0f9505b48c 100644
--- a/arch/arm/include/asm/cnt32_to_63.h
+++ b/include/linux/cnt32_to_63.h
@@ -1,5 +1,5 @@
 /*
- *  include/asm/cnt32_to_63.h -- extend a 32-bit counter to 63 bits
+ *  Extend a 32-bit counter to 63 bits
 *
 *  Author:     Nicolas Pitre
 *  Created:    December 3, 2006
@@ -10,15 +10,30 @@
 * as published by the Free Software Foundation.
 */
-#ifndef __INCLUDE_CNT32_TO_63_H__
+#ifndef __LINUX_CNT32_TO_63_H__
-#define __INCLUDE_CNT32_TO_63_H__
+#define __LINUX_CNT32_TO_63_H__
 #include <linux/compiler.h>
-#include <asm/types.h>
+#include <linux/types.h>
 #include <asm/byteorder.h>
-/*
+/* this is used only to give gcc a clue about good code generation */
- * Prototype: u64 cnt32_to_63(u32 cnt)
+union cnt32_to_63 {
+        struct {
+#if defined(__LITTLE_ENDIAN)
+                u32 lo, hi;
+#elif defined(__BIG_ENDIAN)
+                u32 hi, lo;
+#endif
+        };
+        u64 val;
+};
+/**
+ * cnt32_to_63 - Expand a 32-bit counter to a 63-bit counter
+ * @cnt_lo: The low part of the counter
+ *
 * Many hardware clock counters are only 32 bits wide and therefore have
 * a relatively short period making wrap-arounds rather frequent.  This
 * is a problem when implementing sched_clock() for example, where a 64-bit
@@ -51,26 +66,13 @@
 * clear-bit instruction. Otherwise caller must remember to clear the top
 * bit explicitly.
 */
-/* this is used only to give gcc a clue about good code generation */
-typedef union {
-        struct {
-#if defined(__LITTLE_ENDIAN)
-                u32 lo, hi;
-#elif defined(__BIG_ENDIAN)
-                u32 hi, lo;
-#endif
-        };
-        u64 val;
-} cnt32_to_63_t;
 #define cnt32_to_63(cnt_lo) \
 ({ \
-        static volatile u32 __m_cnt_hi = 0; \
+        static volatile u32 __m_cnt_hi; \
-        cnt32_to_63_t __x; \
+        union cnt32_to_63 __x; \
        __x.hi = __m_cnt_hi; \
        __x.lo = (cnt_lo); \
-        if (unlikely((s32)(__x.hi ^ __x.lo) < 0)) \
+        if (unlikely((s32)(__x.hi ^ __x.lo) < 0)) \
                __m_cnt_hi = __x.hi = (__x.hi ^ 0x80000000) + (__x.hi >> 31); \
        __x.val; \
 })
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 952e0f857ac9..ba9114ec5d3a 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -48,6 +48,11 @@ static inline int is_device_dma_capable(struct device *dev)
        return dev->dma_mask != NULL && *dev->dma_mask != DMA_MASK_NONE;
 }
+static inline int is_buffer_dma_capable(u64 mask, dma_addr_t addr, size_t size)
+{
+        return addr + size <= mask;
+}
 #ifdef CONFIG_HAS_DMA
 #include <asm/dma-mapping.h>
 #else
@@ -58,6 +63,13 @@ static inline int is_device_dma_capable(struct device *dev)
 #define dma_sync_single         dma_sync_single_for_cpu
 #define dma_sync_sg             dma_sync_sg_for_cpu
+static inline u64 dma_get_mask(struct device *dev)
+{
+        if (dev && dev->dma_mask && *dev->dma_mask)
+                return *dev->dma_mask;
+        return DMA_32BIT_MASK;
+}
 extern u64 dma_get_required_mask(struct device *dev);
 static inline unsigned int dma_get_max_seg_size(struct device *dev)
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 6d93dce61cbb..2f245fe63bda 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -47,14 +47,22 @@ enum hrtimer_restart {
 *      HRTIMER_CB_IRQSAFE:             Callback may run in hardirq context
 *      HRTIMER_CB_IRQSAFE_NO_RESTART:  Callback may run in hardirq context and
 *                                      does not restart the timer
- *      HRTIMER_CB_IRQSAFE_NO_SOFTIRQ:  Callback must run in hardirq context
+ *      HRTIMER_CB_IRQSAFE_PERCPU:      Callback must run in hardirq context
- *                                      Special mode for tick emultation
+ *                                      Special mode for tick emulation and
+ *                                      scheduler timer. Such timers are per
+ *                                      cpu and not allowed to be migrated on
+ *                                      cpu unplug.
+ *      HRTIMER_CB_IRQSAFE_UNLOCKED:    Callback should run in hardirq context
+ *                                      with timer->base lock unlocked
+ *                                      used for timers which call wakeup to
+ *                                      avoid lock order problems with rq->lock
 */
 enum hrtimer_cb_mode {
        HRTIMER_CB_SOFTIRQ,
        HRTIMER_CB_IRQSAFE,
        HRTIMER_CB_IRQSAFE_NO_RESTART,
-        HRTIMER_CB_IRQSAFE_NO_SOFTIRQ,
+        HRTIMER_CB_IRQSAFE_PERCPU,
+        HRTIMER_CB_IRQSAFE_UNLOCKED,
 };
 /*
@@ -67,9 +75,10 @@ enum hrtimer_cb_mode {
 * 0x02         callback function running
 * 0x04         callback pending (high resolution mode)
 *
- * Special case:
+ * Special cases:
 * 0x03         callback function running and enqueued
 *              (was requeued on another CPU)
+ * 0x09         timer was migrated on CPU hotunplug
 * The "callback function running and enqueued" status is only possible on
 * SMP. It happens for example when a posix timer expired and the callback
 * queued a signal. Between dropping the lock which protects the posix timer
@@ -87,6 +96,7 @@ enum hrtimer_cb_mode {
 #define HRTIMER_STATE_ENQUEUED  0x01
 #define HRTIMER_STATE_CALLBACK  0x02
 #define HRTIMER_STATE_PENDING   0x04
+#define HRTIMER_STATE_MIGRATE   0x08
 /**
 * struct hrtimer - the basic hrtimer structure
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 1524829f73f2..6514db8fd2e4 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -366,7 +366,9 @@ enum {
        /* Currently on a filemark */
        IDE_AFLAG_FILEMARK              = (1 << 25),
        /* 0 = no tape is loaded, so we don't rewind after ejecting */
-        IDE_AFLAG_MEDIUM_PRESENT        = (1 << 26)
+        IDE_AFLAG_MEDIUM_PRESENT        = (1 << 26),
+        IDE_AFLAG_NO_AUTOCLOSE          = (1 << 27),
 };
 struct ide_drive_s {
diff --git a/include/linux/iommu-helper.h b/include/linux/iommu-helper.h
index c975caf75385..a6d0586e2bf7 100644
--- a/include/linux/iommu-helper.h
+++ b/include/linux/iommu-helper.h
@@ -1,6 +1,20 @@
+#ifndef _LINUX_IOMMU_HELPER_H
+#define _LINUX_IOMMU_HELPER_H
+static inline unsigned long iommu_device_max_index(unsigned long size,
+                                                   unsigned long offset,
+                                                   u64 dma_mask)
+{
+        if (size + offset > dma_mask)
+                return dma_mask - offset + 1;
+        else
+                return size;
+}
 extern int iommu_is_span_boundary(unsigned int index, unsigned int nr,
                                  unsigned long shift,
                                  unsigned long boundary_size);
+extern void iommu_area_reserve(unsigned long *map, unsigned long i, int len);
 extern unsigned long iommu_area_alloc(unsigned long *map, unsigned long size,
                                      unsigned long start, unsigned int nr,
                                      unsigned long shift,
@@ -8,3 +22,5 @@ extern unsigned long iommu_area_alloc(unsigned long *map, unsigned long size,
                                      unsigned long align_mask);
 extern void iommu_area_free(unsigned long *map, unsigned long start,
                            unsigned int nr);
+#endif
diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index fded376b94e3..ee9bcc6f32b6 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -162,9 +162,9 @@ extern struct resource * __devm_request_region(struct device *dev,
                                struct resource *parent, resource_size_t start,
                                resource_size_t n, const char *name);
-#define devm_release_region(start,n) \
+#define devm_release_region(dev, start, n) \
        __devm_release_region(dev, &ioport_resource, (start), (n))
-#define devm_release_mem_region(start,n) \
+#define devm_release_mem_region(dev, start, n) \
        __devm_release_region(dev, &iomem_resource, (start), (n))
 extern void __devm_release_region(struct device *dev, struct resource *parent,
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 225bfc5bd9ec..947cf84e555d 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -146,6 +146,7 @@ enum {
        ATA_DFLAG_SPUNDOWN      = (1 << 14), /* XXX: for spindown_compat */
        ATA_DFLAG_SLEEPING      = (1 << 15), /* device is sleeping */
        ATA_DFLAG_DUBIOUS_XFER  = (1 << 16), /* data transfer not verified */
+        ATA_DFLAG_NO_UNLOAD     = (1 << 17), /* device doesn't support unload */
        ATA_DFLAG_INIT_MASK     = (1 << 24) - 1,
        ATA_DFLAG_DETACH        = (1 << 24),
@@ -244,6 +245,7 @@ enum {
        ATA_TMOUT_BOOT          = 30000,        /* heuristic */
        ATA_TMOUT_BOOT_QUICK    =  7000,        /* heuristic */
        ATA_TMOUT_INTERNAL_QUICK = 5000,
+        ATA_TMOUT_MAX_PARK      = 30000,
        /* FIXME: GoVault needs 2s but we can't afford that without
         * parallel probing.  800ms is enough for iVDR disk
@@ -319,8 +321,11 @@ enum {
        ATA_EH_RESET            = ATA_EH_SOFTRESET | ATA_EH_HARDRESET,
        ATA_EH_ENABLE_LINK      = (1 << 3),
        ATA_EH_LPM              = (1 << 4),  /* link power management action */
+        ATA_EH_PARK             = (1 << 5), /* unload heads and stop I/O */
-        ATA_EH_PERDEV_MASK      = ATA_EH_REVALIDATE,
+        ATA_EH_PERDEV_MASK      = ATA_EH_REVALIDATE | ATA_EH_PARK,
+        ATA_EH_ALL_ACTIONS      = ATA_EH_REVALIDATE | ATA_EH_RESET |
+                                  ATA_EH_ENABLE_LINK | ATA_EH_LPM,
        /* ata_eh_info->flags */
        ATA_EHI_HOTPLUGGED      = (1 << 0),  /* could have been hotplugged */
@@ -452,6 +457,7 @@ enum link_pm {
        MEDIUM_POWER,
 };
 extern struct device_attribute dev_attr_link_power_management_policy;
+extern struct device_attribute dev_attr_unload_heads;
 extern struct device_attribute dev_attr_em_message_type;
 extern struct device_attribute dev_attr_em_message;
 extern struct device_attribute dev_attr_sw_activity;
@@ -554,8 +560,8 @@ struct ata_ering {
 struct ata_device {
        struct ata_link         *link;
        unsigned int            devno;          /* 0 or 1 */
-        unsigned long           flags;          /* ATA_DFLAG_xxx */
        unsigned int            horkage;        /* List of broken features */
+        unsigned long           flags;          /* ATA_DFLAG_xxx */
        struct scsi_device      *sdev;          /* attached SCSI device */
 #ifdef CONFIG_ATA_ACPI
        acpi_handle             acpi_handle;
@@ -564,6 +570,7 @@ struct ata_device {
        /* n_sector is used as CLEAR_OFFSET, read comment above CLEAR_OFFSET */
        u64                     n_sectors;      /* size of device, if ATA */
        unsigned int            class;          /* ATA_DEV_xxx */
+        unsigned long           unpark_deadline;
        u8                      pio_mode;
        u8                      dma_mode;
@@ -621,6 +628,7 @@ struct ata_eh_context {
                                               [ATA_EH_CMD_TIMEOUT_TABLE_SIZE];
        unsigned int            classes[ATA_MAX_DEVICES];
        unsigned int            did_probe_mask;
+        unsigned int            unloaded_mask;
        unsigned int            saved_ncq_enabled;
        u8                      saved_xfer_mode[ATA_MAX_DEVICES];
        /* timestamp for the last reset attempt or success */
@@ -688,7 +696,8 @@ struct ata_port {
        unsigned int            qc_active;
        int                     nr_active_links; /* #links with active qcs */
-        struct ata_link         link;   /* host default link */
+        struct ata_link         link;           /* host default link */
+        struct ata_link         *slave_link;    /* see ata_slave_link_init() */
        int                     nr_pmp_links;   /* nr of available PMP links */
        struct ata_link         *pmp_link;      /* array of PMP links */
@@ -709,6 +718,7 @@ struct ata_port {
        struct list_head        eh_done_q;
        wait_queue_head_t       eh_wait_q;
        int                     eh_tries;
+        struct completion       park_req_pending;
        pm_message_t            pm_mesg;
        int                     *pm_result;
@@ -772,8 +782,8 @@ struct ata_port_operations {
        /*
         * Optional features
         */
-        int  (*scr_read)(struct ata_port *ap, unsigned int sc_reg, u32 *val);
+        int  (*scr_read)(struct ata_link *link, unsigned int sc_reg, u32 *val);
-        int  (*scr_write)(struct ata_port *ap, unsigned int sc_reg, u32 val);
+        int  (*scr_write)(struct ata_link *link, unsigned int sc_reg, u32 val);
        void (*pmp_attach)(struct ata_port *ap);
        void (*pmp_detach)(struct ata_port *ap);
        int  (*enable_pm)(struct ata_port *ap, enum link_pm policy);
@@ -895,6 +905,7 @@ extern void ata_port_disable(struct ata_port *);
 extern struct ata_host *ata_host_alloc(struct device *dev, int max_ports);
 extern struct ata_host *ata_host_alloc_pinfo(struct device *dev,
                        const struct ata_port_info * const * ppi, int n_ports);
+extern int ata_slave_link_init(struct ata_port *ap);
 extern int ata_host_start(struct ata_host *host);
 extern int ata_host_register(struct ata_host *host,
                             struct scsi_host_template *sht);
@@ -920,8 +931,8 @@ extern int sata_scr_valid(struct ata_link *link);
 extern int sata_scr_read(struct ata_link *link, int reg, u32 *val);
 extern int sata_scr_write(struct ata_link *link, int reg, u32 val);
 extern int sata_scr_write_flush(struct ata_link *link, int reg, u32 val);
-extern int ata_link_online(struct ata_link *link);
+extern bool ata_link_online(struct ata_link *link);
-extern int ata_link_offline(struct ata_link *link);
+extern bool ata_link_offline(struct ata_link *link);
 #ifdef CONFIG_PM
 extern int ata_host_suspend(struct ata_host *host, pm_message_t mesg);
 extern void ata_host_resume(struct ata_host *host);
@@ -1098,6 +1109,7 @@ extern void ata_std_error_handler(struct ata_port *ap);
 */
 extern const struct ata_port_operations ata_base_port_ops;
 extern const struct ata_port_operations sata_port_ops;
+extern struct device_attribute *ata_common_sdev_attrs[];
 #define ATA_BASE_SHT(drv_name)                                  \
        .module                 = THIS_MODULE,                  \
@@ -1112,7 +1124,8 @@ extern const struct ata_port_operations sata_port_ops;
        .proc_name              = drv_name,                     \
        .slave_configure        = ata_scsi_slave_config,        \
        .slave_destroy          = ata_scsi_slave_destroy,       \
-        .bios_param             = ata_std_bios_param
+        .bios_param             = ata_std_bios_param,           \
+        .sdev_attrs             = ata_common_sdev_attrs
 #define ATA_NCQ_SHT(drv_name)                                   \
        ATA_BASE_SHT(drv_name),                                 \
@@ -1134,7 +1147,7 @@ static inline bool sata_pmp_attached(struct ata_port *ap)
 static inline int ata_is_host_link(const struct ata_link *link)
 {
-        return link == &link->ap->link;
+        return link == &link->ap->link || link == link->ap->slave_link;
 }
 #else /* CONFIG_SATA_PMP */
 static inline bool sata_pmp_supported(struct ata_port *ap)
@@ -1167,7 +1180,7 @@ static inline int sata_srst_pmp(struct ata_link *link)
        printk("%sata%u: "fmt, lv, (ap)->print_id , ##args)
 #define ata_link_printk(link, lv, fmt, args...) do { \
-        if (sata_pmp_attached((link)->ap)) \
+        if (sata_pmp_attached((link)->ap) || (link)->ap->slave_link)    \
                printk("%sata%u.%02u: "fmt, lv, (link)->ap->print_id,   \
                       (link)->pmp , ##args); \
        else \
@@ -1265,34 +1278,17 @@ static inline int ata_link_active(struct ata_link *link)
        return ata_tag_valid(link->active_tag) || link->sactive;
 }
-static inline struct ata_link *ata_port_first_link(struct ata_port *ap)
+extern struct ata_link *__ata_port_next_link(struct ata_port *ap,
-{
+                                             struct ata_link *link,
-        if (sata_pmp_attached(ap))
+                                             bool dev_only);
-                return ap->pmp_link;
-        return &ap->link;
-}
-static inline struct ata_link *ata_port_next_link(struct ata_link *link)
-{
-        struct ata_port *ap = link->ap;
-        if (ata_is_host_link(link)) {
-                if (!sata_pmp_attached(ap))
-                        return NULL;
-                return ap->pmp_link;
-        }
-        if (++link < ap->nr_pmp_links + ap->pmp_link)
-                return link;
-        return NULL;
-}
-#define __ata_port_for_each_link(lk, ap) \
+#define __ata_port_for_each_link(link, ap) \
-        for ((lk) = &(ap)->link; (lk); (lk) = ata_port_next_link(lk))
+        for ((link) = __ata_port_next_link((ap), NULL, false); (link); \
+             (link) = __ata_port_next_link((ap), (link), false))
 #define ata_port_for_each_link(link, ap) \
-        for ((link) = ata_port_first_link(ap); (link); \
+        for ((link) = __ata_port_next_link((ap), NULL, true); (link); \
-             (link) = ata_port_next_link(link))
+             (link) = __ata_port_next_link((ap), (link), true))
 #define ata_link_for_each_dev(dev, link) \
        for ((dev) = (link)->device; \
diff --git a/include/linux/memstick.h b/include/linux/memstick.h
index a9f998a3f48b..d0c37e682234 100644
--- a/include/linux/memstick.h
+++ b/include/linux/memstick.h
@@ -21,30 +21,30 @@
 struct ms_status_register {
        unsigned char reserved;
        unsigned char interrupt;
-#define MEMSTICK_INT_CMDNAK             0x0001
+#define MEMSTICK_INT_CMDNAK 0x01
-#define MEMSTICK_INT_IOREQ              0x0008
+#define MEMSTICK_INT_IOREQ  0x08
-#define MEMSTICK_INT_IOBREQ             0x0010
+#define MEMSTICK_INT_IOBREQ 0x10
-#define MEMSTICK_INT_BREQ               0x0020
+#define MEMSTICK_INT_BREQ   0x20
-#define MEMSTICK_INT_ERR                0x0040
+#define MEMSTICK_INT_ERR    0x40
-#define MEMSTICK_INT_CED                0x0080
+#define MEMSTICK_INT_CED    0x80
        unsigned char status0;
-#define MEMSTICK_STATUS0_WP             0x0001
+#define MEMSTICK_STATUS0_WP  0x01
-#define MEMSTICK_STATUS0_SL             0x0002
+#define MEMSTICK_STATUS0_SL  0x02
-#define MEMSTICK_STATUS0_BF             0x0010
+#define MEMSTICK_STATUS0_BF  0x10
-#define MEMSTICK_STATUS0_BE             0x0020
+#define MEMSTICK_STATUS0_BE  0x20
-#define MEMSTICK_STATUS0_FB0            0x0040
+#define MEMSTICK_STATUS0_FB0 0x40
-#define MEMSTICK_STATUS0_MB             0x0080
+#define MEMSTICK_STATUS0_MB  0x80
        unsigned char status1;
-#define MEMSTICK_STATUS1_UCFG           0x0001
+#define MEMSTICK_STATUS1_UCFG 0x01
-#define MEMSTICK_STATUS1_FGER           0x0002
+#define MEMSTICK_STATUS1_FGER 0x02
-#define MEMSTICK_STATUS1_UCEX           0x0004
+#define MEMSTICK_STATUS1_UCEX 0x04
-#define MEMSTICK_STATUS1_EXER           0x0008
+#define MEMSTICK_STATUS1_EXER 0x08
-#define MEMSTICK_STATUS1_UCDT           0x0010
+#define MEMSTICK_STATUS1_UCDT 0x10
-#define MEMSTICK_STATUS1_DTER           0x0020
+#define MEMSTICK_STATUS1_DTER 0x20
-#define MEMSTICK_STATUS1_FBI            0x0040
+#define MEMSTICK_STATUS1_FB1  0x40
-#define MEMSTICK_STATUS1_MB             0x0080
+#define MEMSTICK_STATUS1_MB   0x80
 } __attribute__((packed));
 struct ms_id_register {
@@ -56,32 +56,32 @@ struct ms_id_register {
 struct ms_param_register {
        unsigned char system;
-#define MEMSTICK_SYS_ATEN 0xc0
-#define MEMSTICK_SYS_BAMD 0x80
 #define MEMSTICK_SYS_PAM  0x08
+#define MEMSTICK_SYS_BAMD 0x80
        unsigned char block_address_msb;
        unsigned short block_address;
        unsigned char cp;
-#define MEMSTICK_CP_BLOCK               0x0000
+#define MEMSTICK_CP_BLOCK     0x00
-#define MEMSTICK_CP_PAGE                0x0020
+#define MEMSTICK_CP_PAGE      0x20
-#define MEMSTICK_CP_EXTRA               0x0040
+#define MEMSTICK_CP_EXTRA     0x40
-#define MEMSTICK_CP_OVERWRITE           0x0080
+#define MEMSTICK_CP_OVERWRITE 0x80
        unsigned char page_address;
 } __attribute__((packed));
 struct ms_extra_data_register {
        unsigned char  overwrite_flag;
-#define MEMSTICK_OVERWRITE_UPDATA       0x0010
+#define MEMSTICK_OVERWRITE_UDST  0x10
-#define MEMSTICK_OVERWRITE_PAGE         0x0060
+#define MEMSTICK_OVERWRITE_PGST1 0x20
-#define MEMSTICK_OVERWRITE_BLOCK        0x0080
+#define MEMSTICK_OVERWRITE_PGST0 0x40
+#define MEMSTICK_OVERWRITE_BKST  0x80
        unsigned char  management_flag;
-#define MEMSTICK_MANAGEMENT_SYSTEM      0x0004
+#define MEMSTICK_MANAGEMENT_SYSFLG 0x04
-#define MEMSTICK_MANAGEMENT_TRANS_TABLE 0x0008
+#define MEMSTICK_MANAGEMENT_ATFLG  0x08
-#define MEMSTICK_MANAGEMENT_COPY        0x0010
+#define MEMSTICK_MANAGEMENT_SCMS1  0x10
-#define MEMSTICK_MANAGEMENT_ACCESS      0x0020
+#define MEMSTICK_MANAGEMENT_SCMS0  0x20
        unsigned short logical_address;
 } __attribute__((packed));
@@ -96,9 +96,9 @@ struct ms_register {
 struct mspro_param_register {
        unsigned char  system;
-#define MEMSTICK_SYS_SERIAL 0x80
 #define MEMSTICK_SYS_PAR4   0x00
 #define MEMSTICK_SYS_PAR8   0x40
+#define MEMSTICK_SYS_SERIAL 0x80
        unsigned short data_count;
        unsigned int   data_address;
@@ -147,7 +147,7 @@ struct ms_register_addr {
        unsigned char w_length;
 } __attribute__((packed));
-enum {
+enum memstick_tpc {
        MS_TPC_READ_MG_STATUS   = 0x01,
        MS_TPC_READ_LONG_DATA   = 0x02,
        MS_TPC_READ_SHORT_DATA  = 0x03,
@@ -167,7 +167,7 @@ enum {
        MS_TPC_SET_CMD          = 0x0e
 };
-enum {
+enum memstick_command {
        MS_CMD_BLOCK_END       = 0x33,
        MS_CMD_RESET           = 0x3c,
        MS_CMD_BLOCK_WRITE     = 0x55,
@@ -201,8 +201,6 @@ enum {
 /*** Driver structures and functions ***/
-#define MEMSTICK_PART_SHIFT 3
 enum memstick_param { MEMSTICK_POWER = 1, MEMSTICK_INTERFACE };
 #define MEMSTICK_POWER_OFF 0
@@ -215,24 +213,27 @@ enum memstick_param { MEMSTICK_POWER = 1, MEMSTICK_INTERFACE };
 struct memstick_host;
 struct memstick_driver;
+struct memstick_device_id {
+        unsigned char match_flags;
 #define MEMSTICK_MATCH_ALL            0x01
+        unsigned char type;
 #define MEMSTICK_TYPE_LEGACY          0xff
 #define MEMSTICK_TYPE_DUO             0x00
 #define MEMSTICK_TYPE_PRO             0x01
+        unsigned char category;
 #define MEMSTICK_CATEGORY_STORAGE     0xff
 #define MEMSTICK_CATEGORY_STORAGE_DUO 0x00
+#define MEMSTICK_CATEGORY_IO          0x01
+#define MEMSTICK_CATEGORY_IO_PRO      0x10
-#define MEMSTICK_CLASS_GENERIC        0xff
-#define MEMSTICK_CLASS_GENERIC_DUO    0x00
-struct memstick_device_id {
-        unsigned char match_flags;
-        unsigned char type;
-        unsigned char category;
        unsigned char class;
+#define MEMSTICK_CLASS_FLASH          0xff
+#define MEMSTICK_CLASS_DUO            0x00
+#define MEMSTICK_CLASS_ROM            0x01
+#define MEMSTICK_CLASS_RO             0x02
+#define MEMSTICK_CLASS_WP             0x03
 };
 struct memstick_request {
@@ -319,9 +320,9 @@ void memstick_suspend_host(struct memstick_host *host);
 void memstick_resume_host(struct memstick_host *host);
 void memstick_init_req_sg(struct memstick_request *mrq, unsigned char tpc,
-                          struct scatterlist *sg);
+                          const struct scatterlist *sg);
 void memstick_init_req(struct memstick_request *mrq, unsigned char tpc,
-                       void *buf, size_t length);
+                       const void *buf, size_t length);
 int memstick_next_req(struct memstick_host *host,
                      struct memstick_request **mrq);
 void memstick_new_req(struct memstick_host *host);
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 655ea0d1ee14..b2f944468313 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -141,6 +141,10 @@ enum {
        MLX4_STAT_RATE_OFFSET   = 5
 };
+enum {
+        MLX4_MTT_FLAG_PRESENT           = 1
+};
 static inline u64 mlx4_fw_ver(u64 major, u64 minor, u64 subminor)
 {
        return (major << 32) | (minor << 16) | subminor;
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 443bc7cd8c62..428328a05fa1 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -751,8 +751,9 @@ static inline int zonelist_node_idx(struct zoneref *zoneref)
 *
 * This function returns the next zone at or below a given zone index that is
 * within the allowed nodemask using a cursor as the starting point for the
- * search. The zoneref returned is a cursor that is used as the next starting
+ * search. The zoneref returned is a cursor that represents the current zone
- * point for future calls to next_zones_zonelist().
+ * being examined. It should be advanced by one before calling
+ * next_zones_zonelist again.
 */
 struct zoneref *next_zones_zonelist(struct zoneref *z,
                                        enum zone_type highest_zoneidx,
@@ -768,9 +769,8 @@ struct zoneref *next_zones_zonelist(struct zoneref *z,
 *
 * This function returns the first zone at or below a given zone index that is
 * within the allowed nodemask. The zoneref returned is a cursor that can be
- * used to iterate the zonelist with next_zones_zonelist. The cursor should
+ * used to iterate the zonelist with next_zones_zonelist by advancing it by
- * not be used by the caller as it does not match the value of the zone
+ * one before calling.
- * returned.
 */
 static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
                                        enum zone_type highest_zoneidx,
@@ -795,7 +795,7 @@ static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
 #define for_each_zone_zonelist_nodemask(zone, z, zlist, highidx, nodemask) \
        for (z = first_zones_zonelist(zlist, highidx, nodemask, &zone); \
                zone;                                                   \
-                z = next_zones_zonelist(z, highidx, nodemask, &zone))   \
+                z = next_zones_zonelist(++z, highidx, nodemask, &zone)) \
 /**
 * for_each_zone_zonelist - helper macro to iterate over valid zones in a zonelist at or below a given zone index
diff --git a/include/linux/pci.h b/include/linux/pci.h
index c0e14008a3c2..98dc6243a706 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -534,7 +534,7 @@ extern void pci_sort_breadthfirst(void);
 #ifdef CONFIG_PCI_LEGACY
 struct pci_dev __deprecated *pci_find_device(unsigned int vendor,
                                             unsigned int device,
-                                             const struct pci_dev *from);
+                                             struct pci_dev *from);
 struct pci_dev __deprecated *pci_find_slot(unsigned int bus,
                                           unsigned int devfn);
 #endif /* CONFIG_PCI_LEGACY */
@@ -550,7 +550,7 @@ struct pci_dev *pci_get_device(unsigned int vendor, unsigned int device,
                                struct pci_dev *from);
 struct pci_dev *pci_get_subsys(unsigned int vendor, unsigned int device,
                                unsigned int ss_vendor, unsigned int ss_device,
-                                const struct pci_dev *from);
+                                struct pci_dev *from);
 struct pci_dev *pci_get_slot(struct pci_bus *bus, unsigned int devfn);
 struct pci_dev *pci_get_bus_and_slot(unsigned int bus, unsigned int devfn);
 struct pci_dev *pci_get_class(unsigned int class, struct pci_dev *from);
@@ -816,7 +816,7 @@ _PCI_NOP_ALL(write,)
 static inline struct pci_dev *pci_find_device(unsigned int vendor,
                                              unsigned int device,
-                                              const struct pci_dev *from)
+                                              struct pci_dev *from)
 {
        return NULL;
 }
@@ -838,7 +838,7 @@ static inline struct pci_dev *pci_get_subsys(unsigned int vendor,
                                             unsigned int device,
                                             unsigned int ss_vendor,
                                             unsigned int ss_device,
-                                             const struct pci_dev *from)
+                                             struct pci_dev *from)
 {
        return NULL;
 }
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index f1624b396754..c114103af987 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -497,6 +497,16 @@
 #define PCI_DEVICE_ID_AMD_K8_NB_ADDRMAP 0x1101
 #define PCI_DEVICE_ID_AMD_K8_NB_MEMCTL  0x1102
 #define PCI_DEVICE_ID_AMD_K8_NB_MISC    0x1103
+#define PCI_DEVICE_ID_AMD_10H_NB_HT     0x1200
+#define PCI_DEVICE_ID_AMD_10H_NB_MAP    0x1201
+#define PCI_DEVICE_ID_AMD_10H_NB_DRAM   0x1202
+#define PCI_DEVICE_ID_AMD_10H_NB_MISC   0x1203
+#define PCI_DEVICE_ID_AMD_10H_NB_LINK   0x1204
+#define PCI_DEVICE_ID_AMD_11H_NB_HT     0x1300
+#define PCI_DEVICE_ID_AMD_11H_NB_MAP    0x1301
+#define PCI_DEVICE_ID_AMD_11H_NB_DRAM   0x1302
+#define PCI_DEVICE_ID_AMD_11H_NB_MISC   0x1303
+#define PCI_DEVICE_ID_AMD_11H_NB_LINK   0x1304
 #define PCI_DEVICE_ID_AMD_LANCE         0x2000
 #define PCI_DEVICE_ID_AMD_LANCE_HOME    0x2001
 #define PCI_DEVICE_ID_AMD_SCSI          0x2020
diff --git a/include/linux/pnp.h b/include/linux/pnp.h
index 1ce54b63085d..be764e514e35 100644
--- a/include/linux/pnp.h
+++ b/include/linux/pnp.h
@@ -21,7 +21,14 @@ struct pnp_dev;
 /*
 * Resource Management
 */
+#ifdef CONFIG_PNP
 struct resource *pnp_get_resource(struct pnp_dev *, unsigned int, unsigned int);
+#else
+static inline struct resource *pnp_get_resource(struct pnp_dev *dev, unsigned int type, unsigned int num)
+{
+        return NULL;
+}
+#endif
 static inline int pnp_resource_valid(struct resource *res)
 {
diff --git a/include/linux/ramfs.h b/include/linux/ramfs.h
index b160fb18e8d6..37aaf2b39863 100644
--- a/include/linux/ramfs.h
+++ b/include/linux/ramfs.h
@@ -6,6 +6,7 @@ extern int ramfs_get_sb(struct file_system_type *fs_type,
         int flags, const char *dev_name, void *data, struct vfsmount *mnt);
 #ifndef CONFIG_MMU
+extern int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize);
 extern unsigned long ramfs_nommu_get_unmapped_area(struct file *file,
                                                   unsigned long addr,
                                                   unsigned long len,
diff --git a/include/linux/smb.h b/include/linux/smb.h
index caa43b2370cb..82fefddc5987 100644
--- a/include/linux/smb.h
+++ b/include/linux/smb.h
@@ -11,7 +11,9 @@
 #include <linux/types.h>
 #include <linux/magic.h>
+#ifdef __KERNEL__
 #include <linux/time.h>
+#endif
 enum smb_protocol { 
        SMB_PROTOCOL_NONE, 
diff --git a/include/linux/stacktrace.h b/include/linux/stacktrace.h
index 5da9794b2d78..b106fd8e0d5c 100644
--- a/include/linux/stacktrace.h
+++ b/include/linux/stacktrace.h
@@ -1,6 +1,8 @@
 #ifndef __LINUX_STACKTRACE_H
 #define __LINUX_STACKTRACE_H
+struct task_struct;
 #ifdef CONFIG_STACKTRACE
 struct stack_trace {
        unsigned int nr_entries, max_entries;
diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index b3d3e27c6299..c3626c0ba9d3 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -596,4 +596,5 @@ int p9_idpool_check(int id, struct p9_idpool *p);
 int p9_error_init(void);
 int p9_errstr2errno(char *, int);
 int p9_trans_fd_init(void);
+void p9_trans_fd_exit(void);
 #endif /* NET_9P_H */
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index 0db3a4038dc0..3ca737120a90 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -26,6 +26,8 @@
 #ifndef NET_9P_TRANSPORT_H
 #define NET_9P_TRANSPORT_H
+#include <linux/module.h>
 /**
 * enum p9_trans_status - different states of underlying transports
 * @Connected: transport is connected and healthy
@@ -91,9 +93,12 @@ struct p9_trans_module {
        int maxsize;            /* max message size of transport */
        int def;                /* this transport should be default */
        struct p9_trans * (*create)(const char *, char *, int, unsigned char);
+        struct module *owner;
 };
 void v9fs_register_trans(struct p9_trans_module *m);
-struct p9_trans_module *v9fs_match_trans(const substring_t *name);
+void v9fs_unregister_trans(struct p9_trans_module *m);
-struct p9_trans_module *v9fs_default_trans(void);
+struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name);
+struct p9_trans_module *v9fs_get_default_trans(void);
+void v9fs_put_trans(struct p9_trans_module *m);
 #endif /* NET_9P_TRANSPORT_H */
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 18024b8cecb8..208fe5a38546 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -702,7 +702,7 @@ static inline int nla_len(const struct nlattr *nla)
 */
 static inline int nla_ok(const struct nlattr *nla, int remaining)
 {
-        return remaining >= sizeof(*nla) &&
+        return remaining >= (int) sizeof(*nla) &&
               nla->nla_len >= sizeof(*nla) &&
               nla->nla_len <= remaining;
 }
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 24811732bdb2..029a54a02396 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -227,6 +227,9 @@ struct sctp_chunk *sctp_make_abort_violation(const struct sctp_association *,
                                   const struct sctp_chunk *,
                                   const __u8 *,
                                   const size_t );
+struct sctp_chunk *sctp_make_violation_paramlen(const struct sctp_association *,
+                                   const struct sctp_chunk *,
+                                   struct sctp_paramhdr *);
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *,
                                  const struct sctp_transport *,
                                  const void *payload,
diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
index 5c40cc537d4c..192f8716aa9e 100644
--- a/include/scsi/scsi.h
+++ b/include/scsi/scsi.h
@@ -309,6 +309,20 @@ struct scsi_lun {
 };
 /*
+ * The Well Known LUNS (SAM-3) in our int representation of a LUN
+ */
+#define SCSI_W_LUN_BASE 0xc100
+#define SCSI_W_LUN_REPORT_LUNS (SCSI_W_LUN_BASE + 1)
+#define SCSI_W_LUN_ACCESS_CONTROL (SCSI_W_LUN_BASE + 2)
+#define SCSI_W_LUN_TARGET_LOG_PAGE (SCSI_W_LUN_BASE + 3)
+static inline int scsi_is_wlun(unsigned int lun)
+{
+        return (lun & 0xff00) == SCSI_W_LUN_BASE;
+}
+/*
 *  MESSAGE CODES
 */
diff --git a/init/main.c b/init/main.c
index f6f7042331dc..3820323c4c84 100644
--- a/init/main.c
+++ b/init/main.c
@@ -708,7 +708,7 @@ int do_one_initcall(initcall_t fn)
        int result;
        if (initcall_debug) {
-                print_fn_descriptor_symbol("calling  %s\n", fn);
+                printk("calling  %pF\n", fn);
                t0 = ktime_get();
        }
@@ -718,8 +718,8 @@ int do_one_initcall(initcall_t fn)
                t1 = ktime_get();
                delta = ktime_sub(t1, t0);
-                print_fn_descriptor_symbol("initcall %s", fn);
+                printk("initcall %pF returned %d after %Ld msecs\n",
-                printk(" returned %d after %Ld msecs\n", result,
+                        fn, result,
                        (unsigned long long) delta.tv64 >> 20);
        }
@@ -737,8 +737,7 @@ int do_one_initcall(initcall_t fn)
                local_irq_enable();
        }
        if (msgbuf[0]) {
-                print_fn_descriptor_symbol(KERN_WARNING "initcall %s", fn);
+                printk("initcall %pF returned with %s\n", fn, msgbuf);
-                printk(" returned with %s\n", msgbuf);
        }
        return result;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 13932abde159..a0123d75ec9a 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2738,14 +2738,15 @@ void cgroup_fork_callbacks(struct task_struct *child)
 */
 void cgroup_mm_owner_callbacks(struct task_struct *old, struct task_struct *new)
 {
-        struct cgroup *oldcgrp, *newcgrp;
+        struct cgroup *oldcgrp, *newcgrp = NULL;
        if (need_mm_owner_callback) {
                int i;
                for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                        struct cgroup_subsys *ss = subsys[i];
                        oldcgrp = task_cgroup(old, ss->subsys_id);
-                        newcgrp = task_cgroup(new, ss->subsys_id);
+                        if (new)
+                                newcgrp = task_cgroup(new, ss->subsys_id);
                        if (oldcgrp == newcgrp)
                                continue;
                        if (ss->mm_owner_changed)
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index f227bc172690..827cd9adccb2 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -843,37 +843,25 @@ static void cpuset_change_cpumask(struct task_struct *tsk,
 /**
 * update_tasks_cpumask - Update the cpumasks of tasks in the cpuset.
 * @cs: the cpuset in which each task's cpus_allowed mask needs to be changed
+ * @heap: if NULL, defer allocating heap memory to cgroup_scan_tasks()
 *
 * Called with cgroup_mutex held
 *
 * The cgroup_scan_tasks() function will scan all the tasks in a cgroup,
 * calling callback functions for each.
 *
- * Return 0 if successful, -errno if not.
+ * No return value. It's guaranteed that cgroup_scan_tasks() always returns 0
+ * if @heap != NULL.
 */
-static int update_tasks_cpumask(struct cpuset *cs)
+static void update_tasks_cpumask(struct cpuset *cs, struct ptr_heap *heap)
 {
        struct cgroup_scanner scan;
-        struct ptr_heap heap;
-        int retval;
-        /*
-         * cgroup_scan_tasks() will initialize heap->gt for us.
-         * heap_init() is still needed here for we should not change
-         * cs->cpus_allowed when heap_init() fails.
-         */
-        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
-        if (retval)
-                return retval;
        scan.cg = cs->css.cgroup;
        scan.test_task = cpuset_test_cpumask;
        scan.process_task = cpuset_change_cpumask;
-        scan.heap = &heap;
+        scan.heap = heap;
-        retval = cgroup_scan_tasks(&scan);
+        cgroup_scan_tasks(&scan);
-        heap_free(&heap);
-        return retval;
 }
 /**
@@ -883,6 +871,7 @@ static int update_tasks_cpumask(struct cpuset *cs)
 */
 static int update_cpumask(struct cpuset *cs, const char *buf)
 {
+        struct ptr_heap heap;
        struct cpuset trialcs;
        int retval;
        int is_load_balanced;
@@ -917,6 +906,10 @@ static int update_cpumask(struct cpuset *cs, const char *buf)
        if (cpus_equal(cs->cpus_allowed, trialcs.cpus_allowed))
                return 0;
+        retval = heap_init(&heap, PAGE_SIZE, GFP_KERNEL, NULL);
+        if (retval)
+                return retval;
        is_load_balanced = is_sched_load_balance(&trialcs);
        mutex_lock(&callback_mutex);
@@ -927,9 +920,9 @@ static int update_cpumask(struct cpuset *cs, const char *buf)
         * Scan tasks in the cpuset, and update the cpumasks of any
         * that need an update.
         */
-        retval = update_tasks_cpumask(cs);
+        update_tasks_cpumask(cs, &heap);
-        if (retval < 0)
-                return retval;
+        heap_free(&heap);
        if (is_load_balanced)
                async_rebuild_sched_domains();
@@ -1965,7 +1958,7 @@ static void scan_for_empty_cpusets(const struct cpuset *root)
                     nodes_empty(cp->mems_allowed))
                        remove_tasks_in_empty_cpuset(cp);
                else {
-                        update_tasks_cpumask(cp);
+                        update_tasks_cpumask(cp, NULL);
                        update_tasks_nodemask(cp, &oldmems);
                }
        }
diff --git a/kernel/dma-coherent.c b/kernel/dma-coherent.c
index c1d4d5b4c61c..f013a0c2e111 100644
--- a/kernel/dma-coherent.c
+++ b/kernel/dma-coherent.c
@@ -124,6 +124,7 @@ int dma_alloc_from_coherent(struct device *dev, ssize_t size,
        }
        return (mem != NULL);
 }
+EXPORT_SYMBOL(dma_alloc_from_coherent);
 /**
 * dma_release_from_coherent() - try to free the memory allocated from per-device coherent memory pool
@@ -151,3 +152,4 @@ int dma_release_from_coherent(struct device *dev, int order, void *vaddr)
        }
        return 0;
 }
+EXPORT_SYMBOL(dma_release_from_coherent);
diff --git a/kernel/exit.c b/kernel/exit.c
index 16395644a98f..85a83c831856 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -583,8 +583,6 @@ mm_need_new_owner(struct mm_struct *mm, struct task_struct *p)
         * If there are other users of the mm and the owner (us) is exiting
         * we need to find a new owner to take on the responsibility.
         */
-        if (!mm)
-                return 0;
        if (atomic_read(&mm->mm_users) <= 1)
                return 0;
        if (mm->owner != p)
@@ -627,6 +625,16 @@ retry:
        } while_each_thread(g, c);
        read_unlock(&tasklist_lock);
+        /*
+         * We found no owner yet mm_users > 1: this implies that we are
+         * most likely racing with swapoff (try_to_unuse()) or /proc or
+         * ptrace or page migration (get_task_mm()).  Mark owner as NULL,
+         * so that subsystems can understand the callback and take action.
+         */
+        down_write(&mm->mmap_sem);
+        cgroup_mm_owner_callbacks(mm->owner, NULL);
+        mm->owner = NULL;
+        up_write(&mm->mmap_sem);
        return;
 assign_new_owner:
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index b8e4dce80a74..cdec83e722fa 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -672,13 +672,14 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
                         */
                        BUG_ON(timer->function(timer) != HRTIMER_NORESTART);
                        return 1;
-                case HRTIMER_CB_IRQSAFE_NO_SOFTIRQ:
+                case HRTIMER_CB_IRQSAFE_PERCPU:
+                case HRTIMER_CB_IRQSAFE_UNLOCKED:
                        /*
                         * This is solely for the sched tick emulation with
                         * dynamic tick support to ensure that we do not
                         * restart the tick right on the edge and end up with
                         * the tick timer in the softirq ! The calling site
-                         * takes care of this.
+                         * takes care of this. Also used for hrtimer sleeper !
                         */
                        debug_hrtimer_deactivate(timer);
                        return 1;
@@ -1245,7 +1246,8 @@ static void __run_hrtimer(struct hrtimer *timer)
        timer_stats_account_hrtimer(timer);
        fn = timer->function;
-        if (timer->cb_mode == HRTIMER_CB_IRQSAFE_NO_SOFTIRQ) {
+        if (timer->cb_mode == HRTIMER_CB_IRQSAFE_PERCPU ||
+            timer->cb_mode == HRTIMER_CB_IRQSAFE_UNLOCKED) {
                /*
                 * Used for scheduler timers, avoid lock inversion with
                 * rq->lock and tasklist_lock.
@@ -1452,7 +1454,7 @@ void hrtimer_init_sleeper(struct hrtimer_sleeper *sl, struct task_struct *task)
        sl->timer.function = hrtimer_wakeup;
        sl->task = task;
 #ifdef CONFIG_HIGH_RES_TIMERS
-        sl->timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        sl->timer.cb_mode = HRTIMER_CB_IRQSAFE_UNLOCKED;
 #endif
 }
@@ -1591,29 +1593,95 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
 #ifdef CONFIG_HOTPLUG_CPU
-static void migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
+static int migrate_hrtimer_list(struct hrtimer_clock_base *old_base,
-                                struct hrtimer_clock_base *new_base)
+                                struct hrtimer_clock_base *new_base, int dcpu)
 {
        struct hrtimer *timer;
        struct rb_node *node;
+        int raise = 0;
        while ((node = rb_first(&old_base->active))) {
                timer = rb_entry(node, struct hrtimer, node);
                BUG_ON(hrtimer_callback_running(timer));
                debug_hrtimer_deactivate(timer);
-                __remove_hrtimer(timer, old_base, HRTIMER_STATE_INACTIVE, 0);
+                /*
+                 * Should not happen. Per CPU timers should be
+                 * canceled _before_ the migration code is called
+                 */
+                if (timer->cb_mode == HRTIMER_CB_IRQSAFE_PERCPU) {
+                        __remove_hrtimer(timer, old_base,
+                                         HRTIMER_STATE_INACTIVE, 0);
+                        WARN(1, "hrtimer (%p %p)active but cpu %d dead\n",
+                             timer, timer->function, dcpu);
+                        continue;
+                }
+                /*
+                 * Mark it as STATE_MIGRATE not INACTIVE otherwise the
+                 * timer could be seen as !active and just vanish away
+                 * under us on another CPU
+                 */
+                __remove_hrtimer(timer, old_base, HRTIMER_STATE_MIGRATE, 0);
                timer->base = new_base;
                /*
                 * Enqueue the timer. Allow reprogramming of the event device
                 */
                enqueue_hrtimer(timer, new_base, 1);
+#ifdef CONFIG_HIGH_RES_TIMERS
+                /*
+                 * Happens with high res enabled when the timer was
+                 * already expired and the callback mode is
+                 * HRTIMER_CB_IRQSAFE_UNLOCKED (hrtimer_sleeper). The
+                 * enqueue code does not move them to the soft irq
+                 * pending list for performance/latency reasons, but
+                 * in the migration state, we need to do that
+                 * otherwise we end up with a stale timer.
+                 */
+                if (timer->state == HRTIMER_STATE_MIGRATE) {
+                        timer->state = HRTIMER_STATE_PENDING;
+                        list_add_tail(&timer->cb_entry,
+                                      &new_base->cpu_base->cb_pending);
+                        raise = 1;
+                }
+#endif
+                /* Clear the migration state bit */
+                timer->state &= ~HRTIMER_STATE_MIGRATE;
+        }
+        return raise;
+}
+#ifdef CONFIG_HIGH_RES_TIMERS
+static int migrate_hrtimer_pending(struct hrtimer_cpu_base *old_base,
+                                   struct hrtimer_cpu_base *new_base)
+{
+        struct hrtimer *timer;
+        int raise = 0;
+        while (!list_empty(&old_base->cb_pending)) {
+                timer = list_entry(old_base->cb_pending.next,
+                                   struct hrtimer, cb_entry);
+                __remove_hrtimer(timer, timer->base, HRTIMER_STATE_PENDING, 0);
+                timer->base = &new_base->clock_base[timer->base->index];
+                list_add_tail(&timer->cb_entry, &new_base->cb_pending);
+                raise = 1;
        }
+        return raise;
+}
+#else
+static int migrate_hrtimer_pending(struct hrtimer_cpu_base *old_base,
+                                   struct hrtimer_cpu_base *new_base)
+{
+        return 0;
 }
+#endif
 static void migrate_hrtimers(int cpu)
 {
        struct hrtimer_cpu_base *old_base, *new_base;
-        int i;
+        int i, raise = 0;
        BUG_ON(cpu_online(cpu));
        old_base = &per_cpu(hrtimer_bases, cpu);
@@ -1626,14 +1694,21 @@ static void migrate_hrtimers(int cpu)
        spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
        for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
-                migrate_hrtimer_list(&old_base->clock_base[i],
+                if (migrate_hrtimer_list(&old_base->clock_base[i],
-                                     &new_base->clock_base[i]);
+                                         &new_base->clock_base[i], cpu))
+                        raise = 1;
        }
+        if (migrate_hrtimer_pending(old_base, new_base))
+                raise = 1;
        spin_unlock(&old_base->lock);
        spin_unlock(&new_base->lock);
        local_irq_enable();
        put_cpu_var(hrtimer_bases);
+        if (raise)
+                hrtimer_raise_softirq();
 }
 #endif /* CONFIG_HOTPLUG_CPU */
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 59f3f0df35d4..aef265325cd3 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -753,8 +753,14 @@ static struct page *kimage_alloc_page(struct kimage *image,
                        *old = addr | (*old & ~PAGE_MASK);
                        /* The old page I have found cannot be a
-                         * destination page, so return it.
+                         * destination page, so return it if it's
+                         * gfp_flags honor the ones passed in.
                         */
+                        if (!(gfp_mask & __GFP_HIGHMEM) &&
+                            PageHighMem(old_page)) {
+                                kimage_free_pages(old_page);
+                                continue;
+                        }
                        addr = old_addr;
                        page = old_page;
                        break;
diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index eaa21fc9ad1d..e4dcfb2272a4 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -488,7 +488,7 @@ static int write_mem_msg(int binary)
                if (err)
                        return err;
                if (CACHE_FLUSH_IS_SAFE)
-                        flush_icache_range(addr, addr + length + 1);
+                        flush_icache_range(addr, addr + length);
                return 0;
        }
@@ -590,6 +590,7 @@ static void kgdb_wait(struct pt_regs *regs)
        /* Signal the primary CPU that we are done: */
        atomic_set(&cpu_in_kgdb[cpu], 0);
+        touch_softlockup_watchdog();
        clocksource_touch_watchdog();
        local_irq_restore(flags);
 }
@@ -1432,6 +1433,7 @@ acquirelock:
            atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
                atomic_set(&kgdb_active, -1);
+                touch_softlockup_watchdog();
                clocksource_touch_watchdog();
                local_irq_restore(flags);
@@ -1462,7 +1464,7 @@ acquirelock:
         * Get the passive CPU lock which will hold all the non-primary
         * CPU in a spin state while the debugger is active
         */
-        if (!kgdb_single_step || !kgdb_contthread) {
+        if (!kgdb_single_step) {
                for (i = 0; i < NR_CPUS; i++)
                        atomic_set(&passive_cpu_wait[i], 1);
        }
@@ -1475,7 +1477,7 @@ acquirelock:
 #ifdef CONFIG_SMP
        /* Signal the other CPUs to enter kgdb_wait() */
-        if ((!kgdb_single_step || !kgdb_contthread) && kgdb_do_roundup)
+        if ((!kgdb_single_step) && kgdb_do_roundup)
                kgdb_roundup_cpus(flags);
 #endif
@@ -1494,7 +1496,7 @@ acquirelock:
        kgdb_post_primary_code(ks->linux_regs, ks->ex_vector, ks->err_code);
        kgdb_deactivate_sw_breakpoints();
        kgdb_single_step = 0;
-        kgdb_contthread = NULL;
+        kgdb_contthread = current;
        exception_level = 0;
        /* Talk to debugger with gdbserial protocol */
@@ -1508,7 +1510,7 @@ acquirelock:
        kgdb_info[ks->cpu].task = NULL;
        atomic_set(&cpu_in_kgdb[ks->cpu], 0);
-        if (!kgdb_single_step || !kgdb_contthread) {
+        if (!kgdb_single_step) {
                for (i = NR_CPUS-1; i >= 0; i--)
                        atomic_set(&passive_cpu_wait[i], 0);
                /*
@@ -1524,6 +1526,7 @@ acquirelock:
 kgdb_restore:
        /* Free kgdb_active */
        atomic_set(&kgdb_active, -1);
+        touch_softlockup_watchdog();
        clocksource_touch_watchdog();
        local_irq_restore(flags);
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index e36d5798cbff..5131e5471169 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -441,7 +441,7 @@ static struct k_itimer * alloc_posix_timer(void)
                return tmr;
        if (unlikely(!(tmr->sigq = sigqueue_alloc()))) {
                kmem_cache_free(posix_timers_cache, tmr);
-                tmr = NULL;
+                return NULL;
        }
        memset(&tmr->sigq->info, 0, sizeof(siginfo_t));
        return tmr;
diff --git a/kernel/sched.c b/kernel/sched.c
index cc1f81b50b82..ad1962dc0aa2 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -201,7 +201,7 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime)
        hrtimer_init(&rt_b->rt_period_timer,
                        CLOCK_MONOTONIC, HRTIMER_MODE_REL);
        rt_b->rt_period_timer.function = sched_rt_period_timer;
-        rt_b->rt_period_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        rt_b->rt_period_timer.cb_mode = HRTIMER_CB_IRQSAFE_UNLOCKED;
 }
 static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
@@ -1087,7 +1087,7 @@ hotplug_hrtick(struct notifier_block *nfb, unsigned long action, void *hcpu)
        return NOTIFY_DONE;
 }
-static void init_hrtick(void)
+static __init void init_hrtick(void)
 {
        hotcpu_notifier(hotplug_hrtick, 0);
 }
@@ -1119,7 +1119,7 @@ static void init_rq_hrtick(struct rq *rq)
        hrtimer_init(&rq->hrtick_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
        rq->hrtick_timer.function = hrtick;
-        rq->hrtick_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        rq->hrtick_timer.cb_mode = HRTIMER_CB_IRQSAFE_PERCPU;
 }
 #else
 static inline void hrtick_clear(struct rq *rq)
@@ -8909,6 +8909,9 @@ static int sched_rt_global_constraints(void)
        u64 rt_runtime, rt_period;
        int ret = 0;
+        if (sysctl_sched_rt_period <= 0)
+                return -EINVAL;
        rt_period = ktime_to_ns(tg->rt_bandwidth.rt_period);
        rt_runtime = tg->rt_bandwidth.rt_runtime;
@@ -8925,6 +8928,9 @@ static int sched_rt_global_constraints(void)
        unsigned long flags;
        int i;
+        if (sysctl_sched_rt_period <= 0)
+                return -EINVAL;
        spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags);
        for_each_possible_cpu(i) {
                struct rt_rq *rt_rq = &cpu_rq(i)->rt;
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 552310798dad..1113157b2058 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -350,6 +350,7 @@ static void __enable_runtime(struct rq *rq)
                spin_lock(&rt_rq->rt_runtime_lock);
                rt_rq->rt_runtime = rt_b->rt_runtime;
                rt_rq->rt_time = 0;
+                rt_rq->rt_throttled = 0;
                spin_unlock(&rt_rq->rt_runtime_lock);
                spin_unlock(&rt_b->rt_runtime_lock);
        }
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 1876b526c778..f8d968063cea 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -72,6 +72,16 @@ void clockevents_set_mode(struct clock_event_device *dev,
 }
 /**
+ * clockevents_shutdown - shutdown the device and clear next_event
+ * @dev:        device to shutdown
+ */
+void clockevents_shutdown(struct clock_event_device *dev)
+{
+        clockevents_set_mode(dev, CLOCK_EVT_MODE_SHUTDOWN);
+        dev->next_event.tv64 = KTIME_MAX;
+}
+/**
 * clockevents_program_event - Reprogram the clock event device.
 * @expires:    absolute expiry time (monotonic clock)
 *
@@ -206,7 +216,7 @@ void clockevents_exchange_device(struct clock_event_device *old,
        if (new) {
                BUG_ON(new->mode != CLOCK_EVT_MODE_UNUSED);
-                clockevents_set_mode(new, CLOCK_EVT_MODE_SHUTDOWN);
+                clockevents_shutdown(new);
        }
        local_irq_restore(flags);
 }
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 2f5a38294bf9..cb01cd8f919b 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -235,9 +235,9 @@ static void tick_do_broadcast_on_off(void *why)
        case CLOCK_EVT_NOTIFY_BROADCAST_FORCE:
                if (!cpu_isset(cpu, tick_broadcast_mask)) {
                        cpu_set(cpu, tick_broadcast_mask);
-                        if (td->mode == TICKDEV_MODE_PERIODIC)
+                        if (tick_broadcast_device.mode ==
-                                clockevents_set_mode(dev,
+                            TICKDEV_MODE_PERIODIC)
-                                                     CLOCK_EVT_MODE_SHUTDOWN);
+                                clockevents_shutdown(dev);
                }
                if (*reason == CLOCK_EVT_NOTIFY_BROADCAST_FORCE)
                        tick_broadcast_force = 1;
@@ -246,7 +246,8 @@ static void tick_do_broadcast_on_off(void *why)
                if (!tick_broadcast_force &&
                    cpu_isset(cpu, tick_broadcast_mask)) {
                        cpu_clear(cpu, tick_broadcast_mask);
-                        if (td->mode == TICKDEV_MODE_PERIODIC)
+                        if (tick_broadcast_device.mode ==
+                            TICKDEV_MODE_PERIODIC)
                                tick_setup_periodic(dev, 0);
                }
                break;
@@ -254,7 +255,7 @@ static void tick_do_broadcast_on_off(void *why)
        if (cpus_empty(tick_broadcast_mask)) {
                if (!bc_stopped)
-                        clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
+                        clockevents_shutdown(bc);
        } else if (bc_stopped) {
                if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
                        tick_broadcast_start_periodic(bc);
@@ -306,7 +307,7 @@ void tick_shutdown_broadcast(unsigned int *cpup)
        if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC) {
                if (bc && cpus_empty(tick_broadcast_mask))
-                        clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
+                        clockevents_shutdown(bc);
        }
        spin_unlock_irqrestore(&tick_broadcast_lock, flags);
@@ -321,7 +322,7 @@ void tick_suspend_broadcast(void)
        bc = tick_broadcast_device.evtdev;
        if (bc)
-                clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
+                clockevents_shutdown(bc);
        spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 }
@@ -576,4 +577,12 @@ void tick_shutdown_broadcast_oneshot(unsigned int *cpup)
        spin_unlock_irqrestore(&tick_broadcast_lock, flags);
 }
+/*
+ * Check, whether the broadcast device is in one shot mode
+ */
+int tick_broadcast_oneshot_active(void)
+{
+        return tick_broadcast_device.mode == TICKDEV_MODE_ONESHOT;
+}
 #endif
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index c4777193d567..df12434b43ca 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -33,7 +33,7 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device);
 */
 ktime_t tick_next_period;
 ktime_t tick_period;
-int tick_do_timer_cpu __read_mostly = -1;
+int tick_do_timer_cpu __read_mostly = TICK_DO_TIMER_BOOT;
 DEFINE_SPINLOCK(tick_device_lock);
 /*
@@ -109,7 +109,8 @@ void tick_setup_periodic(struct clock_event_device *dev, int broadcast)
        if (!tick_device_is_functional(dev))
                return;
-        if (dev->features & CLOCK_EVT_FEAT_PERIODIC) {
+        if ((dev->features & CLOCK_EVT_FEAT_PERIODIC) &&
+            !tick_broadcast_oneshot_active()) {
                clockevents_set_mode(dev, CLOCK_EVT_MODE_PERIODIC);
        } else {
                unsigned long seq;
@@ -148,7 +149,7 @@ static void tick_setup_device(struct tick_device *td,
                 * If no cpu took the do_timer update, assign it to
                 * this cpu:
                 */
-                if (tick_do_timer_cpu == -1) {
+                if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) {
                        tick_do_timer_cpu = cpu;
                        tick_next_period = ktime_get();
                        tick_period = ktime_set(0, NSEC_PER_SEC / HZ);
@@ -249,7 +250,7 @@ static int tick_check_new_device(struct clock_event_device *newdev)
         * not give it back to the clockevents layer !
         */
        if (tick_is_broadcast_device(curdev)) {
-                clockevents_set_mode(curdev, CLOCK_EVT_MODE_SHUTDOWN);
+                clockevents_shutdown(curdev);
                curdev = NULL;
        }
        clockevents_exchange_device(curdev, newdev);
@@ -300,7 +301,8 @@ static void tick_shutdown(unsigned int *cpup)
        if (*cpup == tick_do_timer_cpu) {
                int cpu = first_cpu(cpu_online_map);
-                tick_do_timer_cpu = (cpu != NR_CPUS) ? cpu : -1;
+                tick_do_timer_cpu = (cpu != NR_CPUS) ? cpu :
+                        TICK_DO_TIMER_NONE;
        }
        spin_unlock_irqrestore(&tick_device_lock, flags);
 }
@@ -311,7 +313,7 @@ static void tick_suspend(void)
        unsigned long flags;
        spin_lock_irqsave(&tick_device_lock, flags);
-        clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_SHUTDOWN);
+        clockevents_shutdown(td->evtdev);
        spin_unlock_irqrestore(&tick_device_lock, flags);
 }
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 0ffc2918ea6f..469248782c23 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -1,6 +1,10 @@
 /*
 * tick internal variable and functions used by low/high res code
 */
+#define TICK_DO_TIMER_NONE      -1
+#define TICK_DO_TIMER_BOOT      -2
 DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
 extern spinlock_t tick_device_lock;
 extern ktime_t tick_next_period;
@@ -10,6 +14,8 @@ extern int tick_do_timer_cpu __read_mostly;
 extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
 extern void tick_handle_periodic(struct clock_event_device *dev);
+extern void clockevents_shutdown(struct clock_event_device *dev);
 /*
 * NO_HZ / high resolution timer shared code
 */
@@ -29,6 +35,7 @@ extern void tick_broadcast_oneshot_control(unsigned long reason);
 extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
 extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
+extern int tick_broadcast_oneshot_active(void);
 # else /* BROADCAST */
 static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 {
@@ -37,6 +44,7 @@ static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
 static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
 static inline void tick_broadcast_switch_to_oneshot(void) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
+static inline int tick_broadcast_oneshot_active(void) { return 0; }
 # endif /* !BROADCAST */
 #else /* !ONESHOT */
@@ -66,6 +74,7 @@ static inline int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
 {
        return 0;
 }
+static inline int tick_broadcast_oneshot_active(void) { return 0; }
 #endif /* !TICK_ONESHOT */
 /*
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index a87b0468568b..cb02324bdb88 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -75,6 +75,9 @@ static void tick_do_update_jiffies64(ktime_t now)
                                                           incr * ticks);
                }
                do_timer(++ticks);
+                /* Keep the tick_next_period variable up to date */
+                tick_next_period = ktime_add(last_jiffies_update, tick_period);
        }
        write_sequnlock(&xtime_lock);
 }
@@ -221,7 +224,7 @@ void tick_nohz_stop_sched_tick(int inidle)
         */
        if (unlikely(!cpu_online(cpu))) {
                if (cpu == tick_do_timer_cpu)
-                        tick_do_timer_cpu = -1;
+                        tick_do_timer_cpu = TICK_DO_TIMER_NONE;
        }
        if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
@@ -303,7 +306,7 @@ void tick_nohz_stop_sched_tick(int inidle)
                 * invoked.
                 */
                if (cpu == tick_do_timer_cpu)
-                        tick_do_timer_cpu = -1;
+                        tick_do_timer_cpu = TICK_DO_TIMER_NONE;
                ts->idle_sleeps++;
@@ -468,7 +471,7 @@ static void tick_nohz_handler(struct clock_event_device *dev)
         * this duty, then the jiffies update is still serialized by
         * xtime_lock.
         */
-        if (unlikely(tick_do_timer_cpu == -1))
+        if (unlikely(tick_do_timer_cpu == TICK_DO_TIMER_NONE))
                tick_do_timer_cpu = cpu;
        /* Check, if the jiffies need an update */
@@ -570,7 +573,7 @@ static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer)
         * this duty, then the jiffies update is still serialized by
         * xtime_lock.
         */
-        if (unlikely(tick_do_timer_cpu == -1))
+        if (unlikely(tick_do_timer_cpu == TICK_DO_TIMER_NONE))
                tick_do_timer_cpu = cpu;
 #endif
@@ -622,7 +625,7 @@ void tick_setup_sched_timer(void)
         */
        hrtimer_init(&ts->sched_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        ts->sched_timer.function = tick_sched_timer;
-        ts->sched_timer.cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        ts->sched_timer.cb_mode = HRTIMER_CB_IRQSAFE_PERCPU;
        /* Get the next period (per cpu) */
        ts->sched_timer.expires = tick_init_jiffy_update();
diff --git a/kernel/trace/trace_sysprof.c b/kernel/trace/trace_sysprof.c
index bb948e52ce20..db58fb66a135 100644
--- a/kernel/trace/trace_sysprof.c
+++ b/kernel/trace/trace_sysprof.c
@@ -202,7 +202,7 @@ static void start_stack_timer(int cpu)
        hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
        hrtimer->function = stack_trace_timer_fn;
-        hrtimer->cb_mode = HRTIMER_CB_IRQSAFE_NO_SOFTIRQ;
+        hrtimer->cb_mode = HRTIMER_CB_IRQSAFE_PERCPU;
        hrtimer_start(hrtimer, ns_to_ktime(sample_period), HRTIMER_MODE_REL);
 }
diff --git a/lib/iommu-helper.c b/lib/iommu-helper.c
index a3b8d4c3f77a..5d90074dca75 100644
--- a/lib/iommu-helper.c
+++ b/lib/iommu-helper.c
@@ -30,8 +30,7 @@ again:
        return index;
 }
-static inline void set_bit_area(unsigned long *map, unsigned long i,
+void iommu_area_reserve(unsigned long *map, unsigned long i, int len)
-                                int len)
 {
        unsigned long end = i + len;
        while (i < end) {
@@ -64,7 +63,7 @@ again:
                        start = index + 1;
                        goto again;
                }
-                set_bit_area(map, index, nr);
+                iommu_area_reserve(map, index, nr);
        }
        return index;
 }
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 876ba6d5b670..8d2688ff1352 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -422,9 +422,12 @@ static size_t sg_copy_buffer(struct scatterlist *sgl, unsigned int nents,
 {
        unsigned int offset = 0;
        struct sg_mapping_iter miter;
+        unsigned long flags;
        sg_miter_start(&miter, sgl, nents, SG_MITER_ATOMIC);
+        local_irq_save(flags);
        while (sg_miter_next(&miter) && offset < buflen) {
                unsigned int len;
@@ -442,6 +445,7 @@ static size_t sg_copy_buffer(struct scatterlist *sgl, unsigned int nents,
        sg_miter_stop(&miter);
+        local_irq_restore(flags);
        return offset;
 }
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 977edbdbc1de..f8eebd489149 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -274,13 +274,14 @@ cleanup1:
 }
 static int
-address_needs_mapping(struct device *hwdev, dma_addr_t addr)
+address_needs_mapping(struct device *hwdev, dma_addr_t addr, size_t size)
 {
-        dma_addr_t mask = 0xffffffff;
+        return !is_buffer_dma_capable(dma_get_mask(hwdev), addr, size);
-        /* If the device has a mask, use it, otherwise default to 32 bits */
+}
-        if (hwdev && hwdev->dma_mask)
-                mask = *hwdev->dma_mask;
+static int is_swiotlb_buffer(char *addr)
-        return (addr & ~mask) != 0;
+{
+        return addr >= io_tlb_start && addr < io_tlb_end;
 }
 /*
@@ -467,15 +468,8 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
        void *ret;
        int order = get_order(size);
-        /*
-         * XXX fix me: the DMA API should pass us an explicit DMA mask
-         * instead, or use ZONE_DMA32 (ia64 overloads ZONE_DMA to be a ~32
-         * bit range instead of a 16MB one).
-         */
-        flags |= GFP_DMA;
        ret = (void *)__get_free_pages(flags, order);
-        if (ret && address_needs_mapping(hwdev, virt_to_bus(ret))) {
+        if (ret && address_needs_mapping(hwdev, virt_to_bus(ret), size)) {
                /*
                 * The allocated memory isn't reachable by the device.
                 * Fall back on swiotlb_map_single().
@@ -490,19 +484,16 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                 * swiotlb_map_single(), which will grab memory from
                 * the lowest available address range.
                 */
-                dma_addr_t handle;
+                ret = map_single(hwdev, NULL, size, DMA_FROM_DEVICE);
-                handle = swiotlb_map_single(NULL, NULL, size, DMA_FROM_DEVICE);
+                if (!ret)
-                if (swiotlb_dma_mapping_error(hwdev, handle))
                        return NULL;
-                ret = bus_to_virt(handle);
        }
        memset(ret, 0, size);
        dev_addr = virt_to_bus(ret);
        /* Confirm address can be DMA'd by device */
-        if (address_needs_mapping(hwdev, dev_addr)) {
+        if (address_needs_mapping(hwdev, dev_addr, size)) {
                printk("hwdev DMA mask = 0x%016Lx, dev_addr = 0x%016Lx\n",
                       (unsigned long long)*hwdev->dma_mask,
                       (unsigned long long)dev_addr);
@@ -518,12 +509,11 @@ swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
                      dma_addr_t dma_handle)
 {
        WARN_ON(irqs_disabled());
-        if (!(vaddr >= (void *)io_tlb_start
+        if (!is_swiotlb_buffer(vaddr))
-                    && vaddr < (void *)io_tlb_end))
                free_pages((unsigned long) vaddr, get_order(size));
        else
                /* DMA_TO_DEVICE to avoid memcpy in unmap_single */
-                swiotlb_unmap_single (hwdev, dma_handle, size, DMA_TO_DEVICE);
+                unmap_single(hwdev, vaddr, size, DMA_TO_DEVICE);
 }
 static void
@@ -567,7 +557,7 @@ swiotlb_map_single_attrs(struct device *hwdev, void *ptr, size_t size,
         * we can safely return the device addr and not worry about bounce
         * buffering it.
         */
-        if (!address_needs_mapping(hwdev, dev_addr) && !swiotlb_force)
+        if (!address_needs_mapping(hwdev, dev_addr, size) && !swiotlb_force)
                return dev_addr;
        /*
@@ -584,7 +574,7 @@ swiotlb_map_single_attrs(struct device *hwdev, void *ptr, size_t size,
        /*
         * Ensure that the address returned is DMA'ble
         */
-        if (address_needs_mapping(hwdev, dev_addr))
+        if (address_needs_mapping(hwdev, dev_addr, size))
                panic("map_single: bounce buffer is not DMA'ble");
        return dev_addr;
@@ -612,7 +602,7 @@ swiotlb_unmap_single_attrs(struct device *hwdev, dma_addr_t dev_addr,
        char *dma_addr = bus_to_virt(dev_addr);
        BUG_ON(dir == DMA_NONE);
-        if (dma_addr >= io_tlb_start && dma_addr < io_tlb_end)
+        if (is_swiotlb_buffer(dma_addr))
                unmap_single(hwdev, dma_addr, size, dir);
        else if (dir == DMA_FROM_DEVICE)
                dma_mark_clean(dma_addr, size);
@@ -642,7 +632,7 @@ swiotlb_sync_single(struct device *hwdev, dma_addr_t dev_addr,
        char *dma_addr = bus_to_virt(dev_addr);
        BUG_ON(dir == DMA_NONE);
-        if (dma_addr >= io_tlb_start && dma_addr < io_tlb_end)
+        if (is_swiotlb_buffer(dma_addr))
                sync_single(hwdev, dma_addr, size, dir, target);
        else if (dir == DMA_FROM_DEVICE)
                dma_mark_clean(dma_addr, size);
@@ -673,7 +663,7 @@ swiotlb_sync_single_range(struct device *hwdev, dma_addr_t dev_addr,
        char *dma_addr = bus_to_virt(dev_addr) + offset;
        BUG_ON(dir == DMA_NONE);
-        if (dma_addr >= io_tlb_start && dma_addr < io_tlb_end)
+        if (is_swiotlb_buffer(dma_addr))
                sync_single(hwdev, dma_addr, size, dir, target);
        else if (dir == DMA_FROM_DEVICE)
                dma_mark_clean(dma_addr, size);
@@ -727,7 +717,8 @@ swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, int nelems,
        for_each_sg(sgl, sg, nelems, i) {
                addr = SG_ENT_VIRT_ADDRESS(sg);
                dev_addr = virt_to_bus(addr);
-                if (swiotlb_force || address_needs_mapping(hwdev, dev_addr)) {
+                if (swiotlb_force ||
+                    address_needs_mapping(hwdev, dev_addr, sg->length)) {
                        void *map = map_single(hwdev, addr, sg->length, dir);
                        if (!map) {
                                /* Don't panic here, we expect map_sg users
diff --git a/mm/highmem.c b/mm/highmem.c
index e16e1523b688..b36b83b920ff 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -70,6 +70,7 @@ static DECLARE_WAIT_QUEUE_HEAD(pkmap_map_wait);
 static void flush_all_zero_pkmaps(void)
 {
        int i;
+        int need_flush = 0;
        flush_cache_kmaps();
@@ -101,8 +102,10 @@ static void flush_all_zero_pkmaps(void)
                          &pkmap_page_table[i]);
                set_page_address(page, NULL);
+                need_flush = 1;
        }
-        flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP));
+        if (need_flush)
+                flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP));
 }
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 0f1f7a7374ba..36896f3eb7f5 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -250,6 +250,14 @@ static struct mem_cgroup *mem_cgroup_from_cont(struct cgroup *cont)
 struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p)
 {
+        /*
+         * mm_update_next_owner() may clear mm->owner to NULL
+         * if it races with swapoff, page migration, etc.
+         * So this can be called with p == NULL.
+         */
+        if (unlikely(!p))
+                return NULL;
        return container_of(task_subsys_state(p, mem_cgroup_subsys_id),
                                struct mem_cgroup, css);
 }
@@ -549,6 +557,11 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
        if (likely(!memcg)) {
                rcu_read_lock();
                mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
+                if (unlikely(!mem)) {
+                        rcu_read_unlock();
+                        kmem_cache_free(page_cgroup_cache, pc);
+                        return 0;
+                }
                /*
                 * For every charge from the cgroup, increment reference count
                 */
@@ -801,11 +814,16 @@ int mem_cgroup_shrink_usage(struct mm_struct *mm, gfp_t gfp_mask)
        rcu_read_lock();
        mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
+        if (unlikely(!mem)) {
+                rcu_read_unlock();
+                return 0;
+        }
        css_get(&mem->css);
        rcu_read_unlock();
        do {
                progress = try_to_free_mem_cgroup_pages(mem, gfp_mask);
+                progress += res_counter_check_under_limit(&mem->res);
        } while (!progress && --retry);
        css_put(&mem->css);
diff --git a/mm/mmzone.c b/mm/mmzone.c
index 486ed595ee6f..16ce8b955dcf 100644
--- a/mm/mmzone.c
+++ b/mm/mmzone.c
@@ -69,6 +69,6 @@ struct zoneref *next_zones_zonelist(struct zoneref *z,
                                (z->zone && !zref_in_nodemask(z, nodes)))
                        z++;
-        *zone = zonelist_zone(z++);
+        *zone = zonelist_zone(z);
        return z;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e293c58bea58..27b8681139fd 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -268,13 +268,14 @@ void prep_compound_page(struct page *page, unsigned long order)
 {
        int i;
        int nr_pages = 1 << order;
+        struct page *p = page + 1;
        set_compound_page_dtor(page, free_compound_page);
        set_compound_order(page, order);
        __SetPageHead(page);
-        for (i = 1; i < nr_pages; i++) {
+        for (i = 1; i < nr_pages; i++, p++) {
-                struct page *p = page + i;
+                if (unlikely((i & (MAX_ORDER_NR_PAGES - 1)) == 0))
+                        p = pfn_to_page(page_to_pfn(page) + i);
                __SetPageTail(p);
                p->first_page = page;
        }
@@ -284,6 +285,7 @@ static void destroy_compound_page(struct page *page, unsigned long order)
 {
        int i;
        int nr_pages = 1 << order;
+        struct page *p = page + 1;
        if (unlikely(compound_order(page) != order))
                bad_page(page);
@@ -291,8 +293,9 @@ static void destroy_compound_page(struct page *page, unsigned long order)
        if (unlikely(!PageHead(page)))
                        bad_page(page);
        __ClearPageHead(page);
-        for (i = 1; i < nr_pages; i++) {
+        for (i = 1; i < nr_pages; i++, p++) {
-                struct page *p = page + i;
+                if (unlikely((i & (MAX_ORDER_NR_PAGES - 1)) == 0))
+                        p = pfn_to_page(page_to_pfn(page) + i);
                if (unlikely(!PageTail(p) |
                                (p->first_page != page)))
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index c69f84fe038d..b70a7fec1ff6 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -114,8 +114,10 @@ __test_page_isolated_in_pageblock(unsigned long pfn, unsigned long end_pfn)
 int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn)
 {
-        unsigned long pfn;
+        unsigned long pfn, flags;
        struct page *page;
+        struct zone *zone;
+        int ret;
        pfn = start_pfn;
        /*
@@ -131,7 +133,9 @@ int test_pages_isolated(unsigned long start_pfn, unsigned long end_pfn)
        if (pfn < end_pfn)
                return -EBUSY;
        /* Check all pages are free or Marked as ISOLATED */
-        if (__test_page_isolated_in_pageblock(start_pfn, end_pfn))
+        zone = page_zone(pfn_to_page(pfn));
-                return 0;
+        spin_lock_irqsave(&zone->lock, flags);
-        return -EBUSY;
+        ret = __test_page_isolated_in_pageblock(start_pfn, end_pfn);
+        spin_unlock_irqrestore(&zone->lock, flags);
+        return ret ? 0 : -EBUSY;
 }
diff --git a/mm/slob.c b/mm/slob.c
index 4c82dd41f32e..cb675d126791 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -514,9 +514,11 @@ size_t ksize(const void *block)
                return 0;
        sp = (struct slob_page *)virt_to_page(block);
-        if (slob_page(sp))
+        if (slob_page(sp)) {
-                return ((slob_t *)block - 1)->units + SLOB_UNIT;
+                int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-        else
+                unsigned int *m = (unsigned int *)(block - align);
+                return SLOB_UNITS(*m) * SLOB_UNIT;
+        } else
                return sp->page.private;
 }
diff --git a/mm/slub.c b/mm/slub.c
index fb486d5540f8..0c83e6afe7b2 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1932,6 +1932,7 @@ init_kmem_cache_node(struct kmem_cache_node *n, struct kmem_cache *s)
        INIT_LIST_HEAD(&n->partial);
 #ifdef CONFIG_SLUB_DEBUG
        atomic_long_set(&n->nr_slabs, 0);
+        atomic_long_set(&n->total_objects, 0);
        INIT_LIST_HEAD(&n->full);
 #endif
 }
diff --git a/mm/tiny-shmem.c b/mm/tiny-shmem.c
index ae532f501943..8d7a27a6335c 100644
--- a/mm/tiny-shmem.c
+++ b/mm/tiny-shmem.c
@@ -65,31 +65,31 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
        if (!dentry)
                goto put_memory;
+        error = -ENFILE;
+        file = get_empty_filp();
+        if (!file)
+                goto put_dentry;
        error = -ENOSPC;
        inode = ramfs_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);
        if (!inode)
-                goto put_dentry;
+                goto close_file;
        d_instantiate(dentry, inode);
-        error = -ENFILE;
+        inode->i_size = size;
-        file = alloc_file(shm_mnt, dentry, FMODE_WRITE | FMODE_READ,
-                        &ramfs_file_operations);
-        if (!file)
-                goto put_dentry;
        inode->i_nlink = 0;     /* It is unlinked */
+        init_file(file, shm_mnt, dentry, FMODE_WRITE | FMODE_READ,
+                        &ramfs_file_operations);
-        /* notify everyone as to the change of file size */
+#ifndef CONFIG_MMU
-        error = do_truncate(dentry, size, 0, file);
+        error = ramfs_nommu_expand_for_mapping(inode, size);
-        if (error < 0)
+        if (error)
                goto close_file;
+#endif
        return file;
 close_file:
        put_filp(file);
-        return ERR_PTR(error);
 put_dentry:
        dput(dentry);
 put_memory:
diff --git a/net/9p/client.c b/net/9p/client.c
index 2ffe40cf2f01..10e320307ec0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -75,7 +75,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
        int option;
        int ret = 0;
-        clnt->trans_mod = v9fs_default_trans();
        clnt->dotu = 1;
        clnt->msize = 8192;
@@ -108,7 +107,7 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                        clnt->msize = option;
                        break;
                case Opt_trans:
-                        clnt->trans_mod = v9fs_match_trans(&args[0]);
+                        clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
                        break;
                case Opt_legacy:
                        clnt->dotu = 0;
@@ -117,6 +116,10 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                        continue;
                }
        }
+        if (!clnt->trans_mod)
+                clnt->trans_mod = v9fs_get_default_trans();
        kfree(options);
        return ret;
 }
@@ -150,6 +153,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
        if (!clnt)
                return ERR_PTR(-ENOMEM);
+        clnt->trans_mod = NULL;
        clnt->trans = NULL;
        spin_lock_init(&clnt->lock);
        INIT_LIST_HEAD(&clnt->fidlist);
@@ -235,6 +239,8 @@ void p9_client_destroy(struct p9_client *clnt)
                clnt->trans = NULL;
        }
+        v9fs_put_trans(clnt->trans_mod);
        list_for_each_entry_safe(fid, fidptr, &clnt->fidlist, flist)
                p9_fid_destroy(fid);
diff --git a/net/9p/conv.c b/net/9p/conv.c
index 44547201f5bc..5ad3a3bd73b2 100644
--- a/net/9p/conv.c
+++ b/net/9p/conv.c
@@ -451,8 +451,10 @@ p9_put_data(struct cbuf *bufp, const char *data, int count,
                   unsigned char **pdata)
 {
        *pdata = buf_alloc(bufp, count);
+        if (*pdata == NULL)
+                return -ENOMEM;
        memmove(*pdata, data, count);
-        return count;
+        return 0;
 }
 static int
@@ -460,6 +462,8 @@ p9_put_user_data(struct cbuf *bufp, const char __user *data, int count,
                   unsigned char **pdata)
 {
        *pdata = buf_alloc(bufp, count);
+        if (*pdata == NULL)
+                return -ENOMEM;
        return copy_from_user(*pdata, data, count);
 }
diff --git a/net/9p/mod.c b/net/9p/mod.c
index bdee1fb7cc62..1084feb24cb0 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -31,6 +31,7 @@
 #include <linux/parser.h>
 #include <net/9p/transport.h>
 #include <linux/list.h>
+#include <linux/spinlock.h>
 #ifdef CONFIG_NET_9P_DEBUG
 unsigned int p9_debug_level = 0;        /* feature-rific global debug level  */
@@ -44,8 +45,8 @@ MODULE_PARM_DESC(debug, "9P debugging level");
 *
 */
+static DEFINE_SPINLOCK(v9fs_trans_lock);
 static LIST_HEAD(v9fs_trans_list);
-static struct p9_trans_module *v9fs_default_transport;
 /**
 * v9fs_register_trans - register a new transport with 9p
@@ -54,48 +55,87 @@ static struct p9_trans_module *v9fs_default_transport;
 */
 void v9fs_register_trans(struct p9_trans_module *m)
 {
+        spin_lock(&v9fs_trans_lock);
        list_add_tail(&m->list, &v9fs_trans_list);
-        if (m->def)
+        spin_unlock(&v9fs_trans_lock);
-                v9fs_default_transport = m;
 }
 EXPORT_SYMBOL(v9fs_register_trans);
 /**
- * v9fs_match_trans - match transport versus registered transports
+ * v9fs_unregister_trans - unregister a 9p transport
+ * @m: the transport to remove
+ *
+ */
+void v9fs_unregister_trans(struct p9_trans_module *m)
+{
+        spin_lock(&v9fs_trans_lock);
+        list_del_init(&m->list);
+        spin_unlock(&v9fs_trans_lock);
+}
+EXPORT_SYMBOL(v9fs_unregister_trans);
+/**
+ * v9fs_get_trans_by_name - get transport with the matching name
 * @name: string identifying transport
 *
 */
-struct p9_trans_module *v9fs_match_trans(const substring_t *name)
+struct p9_trans_module *v9fs_get_trans_by_name(const substring_t *name)
 {
-        struct list_head *p;
+        struct p9_trans_module *t, *found = NULL;
-        struct p9_trans_module *t = NULL;
+        spin_lock(&v9fs_trans_lock);
-        list_for_each(p, &v9fs_trans_list) {
-                t = list_entry(p, struct p9_trans_module, list);
+        list_for_each_entry(t, &v9fs_trans_list, list)
-                if (strncmp(t->name, name->from, name->to-name->from) == 0)
+                if (strncmp(t->name, name->from, name->to-name->from) == 0 &&
-                        return t;
+                    try_module_get(t->owner)) {
-        }
+                        found = t;
-        return NULL;
+                        break;
+                }
+        spin_unlock(&v9fs_trans_lock);
+        return found;
 }
-EXPORT_SYMBOL(v9fs_match_trans);
+EXPORT_SYMBOL(v9fs_get_trans_by_name);
 /**
- * v9fs_default_trans - returns pointer to default transport
+ * v9fs_get_default_trans - get the default transport
 *
 */
-struct p9_trans_module *v9fs_default_trans(void)
+struct p9_trans_module *v9fs_get_default_trans(void)
 {
-        if (v9fs_default_transport)
+        struct p9_trans_module *t, *found = NULL;
-                return v9fs_default_transport;
-        else if (!list_empty(&v9fs_trans_list))
+        spin_lock(&v9fs_trans_lock);
-                return list_first_entry(&v9fs_trans_list,
-                                        struct p9_trans_module, list);
+        list_for_each_entry(t, &v9fs_trans_list, list)
-        else
+                if (t->def && try_module_get(t->owner)) {
-                return NULL;
+                        found = t;
+                        break;
+                }
+        if (!found)
+                list_for_each_entry(t, &v9fs_trans_list, list)
+                        if (try_module_get(t->owner)) {
+                                found = t;
+                                break;
+                        }
+        spin_unlock(&v9fs_trans_lock);
+        return found;
 }
-EXPORT_SYMBOL(v9fs_default_trans);
+EXPORT_SYMBOL(v9fs_get_default_trans);
+/**
+ * v9fs_put_trans - put trans
+ * @m: transport to put
+ *
+ */
+void v9fs_put_trans(struct p9_trans_module *m)
+{
+        if (m)
+                module_put(m->owner);
+}
 /**
 * v9fs_init - Initialize module
@@ -120,6 +160,8 @@ static int __init init_p9(void)
 static void __exit exit_p9(void)
 {
        printk(KERN_INFO "Unloading 9P2000 support\n");
+        p9_trans_fd_exit();
 }
 module_init(init_p9)
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index cdf137af7adc..d652baf5ff91 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -151,7 +151,6 @@ struct p9_mux_poll_task {
 * @trans: reference to transport instance for this connection
 * @tagpool: id accounting for transactions
 * @err: error state
- * @equeue: event wait_q (?)
 * @req_list: accounting for requests which have been sent
 * @unsent_req_list: accounting for requests that haven't been sent
 * @rcall: current response &p9_fcall structure
@@ -178,7 +177,6 @@ struct p9_conn {
        struct p9_trans *trans;
        struct p9_idpool *tagpool;
        int err;
-        wait_queue_head_t equeue;
        struct list_head req_list;
        struct list_head unsent_req_list;
        struct p9_fcall *rcall;
@@ -240,22 +238,6 @@ static int p9_conn_rpcnb(struct p9_conn *m, struct p9_fcall *tc,
 static void p9_conn_cancel(struct p9_conn *m, int err);
-static int p9_mux_global_init(void)
-{
-        int i;
-        for (i = 0; i < ARRAY_SIZE(p9_mux_poll_tasks); i++)
-                p9_mux_poll_tasks[i].task = NULL;
-        p9_mux_wq = create_workqueue("v9fs");
-        if (!p9_mux_wq) {
-                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
-                return -ENOMEM;
-        }
-        return 0;
-}
 static u16 p9_mux_get_tag(struct p9_conn *m)
 {
        int tag;
@@ -409,11 +391,11 @@ static void p9_mux_poll_stop(struct p9_conn *m)
 static struct p9_conn *p9_conn_create(struct p9_trans *trans)
 {
        int i, n;
-        struct p9_conn *m, *mtmp;
+        struct p9_conn *m;
        P9_DPRINTK(P9_DEBUG_MUX, "transport %p msize %d\n", trans,
                                                                trans->msize);
-        m = kmalloc(sizeof(struct p9_conn), GFP_KERNEL);
+        m = kzalloc(sizeof(struct p9_conn), GFP_KERNEL);
        if (!m)
                return ERR_PTR(-ENOMEM);
@@ -424,25 +406,14 @@ static struct p9_conn *p9_conn_create(struct p9_trans *trans)
        m->trans = trans;
        m->tagpool = p9_idpool_create();
        if (IS_ERR(m->tagpool)) {
-                mtmp = ERR_PTR(-ENOMEM);
                kfree(m);
-                return mtmp;
+                return ERR_PTR(-ENOMEM);
        }
-        m->err = 0;
-        init_waitqueue_head(&m->equeue);
        INIT_LIST_HEAD(&m->req_list);
        INIT_LIST_HEAD(&m->unsent_req_list);
-        m->rcall = NULL;
-        m->rpos = 0;
-        m->rbuf = NULL;
-        m->wpos = m->wsize = 0;
-        m->wbuf = NULL;
        INIT_WORK(&m->rq, p9_read_work);
        INIT_WORK(&m->wq, p9_write_work);
-        m->wsched = 0;
-        memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
-        m->poll_task = NULL;
        n = p9_mux_poll_start(m);
        if (n) {
                kfree(m);
@@ -463,10 +434,8 @@ static struct p9_conn *p9_conn_create(struct p9_trans *trans)
        for (i = 0; i < ARRAY_SIZE(m->poll_waddr); i++) {
                if (IS_ERR(m->poll_waddr[i])) {
                        p9_mux_poll_stop(m);
-                        mtmp = (void *)m->poll_waddr;   /* the error code */
                        kfree(m);
-                        m = mtmp;
+                        return (void *)m->poll_waddr;   /* the error code */
-                        break;
                }
        }
@@ -483,18 +452,13 @@ static void p9_conn_destroy(struct p9_conn *m)
 {
        P9_DPRINTK(P9_DEBUG_MUX, "mux %p prev %p next %p\n", m,
                m->mux_list.prev, m->mux_list.next);
-        p9_conn_cancel(m, -ECONNRESET);
-        if (!list_empty(&m->req_list)) {
-                /* wait until all processes waiting on this session exit */
-                P9_DPRINTK(P9_DEBUG_MUX,
-                        "mux %p waiting for empty request queue\n", m);
-                wait_event_timeout(m->equeue, (list_empty(&m->req_list)), 5000);
-                P9_DPRINTK(P9_DEBUG_MUX, "mux %p request queue empty: %d\n", m,
-                        list_empty(&m->req_list));
-        }
        p9_mux_poll_stop(m);
+        cancel_work_sync(&m->rq);
+        cancel_work_sync(&m->wq);
+        p9_conn_cancel(m, -ECONNRESET);
        m->trans = NULL;
        p9_idpool_destroy(m->tagpool);
        kfree(m);
@@ -840,8 +804,6 @@ static void p9_read_work(struct work_struct *work)
                                        (*req->cb) (req, req->cba);
                                else
                                        kfree(req->rcall);
-                                wake_up(&m->equeue);
                        }
                } else {
                        if (err >= 0 && rcall->id != P9_RFLUSH)
@@ -908,8 +870,10 @@ static struct p9_req *p9_send_request(struct p9_conn *m,
        else
                n = p9_mux_get_tag(m);
-        if (n < 0)
+        if (n < 0) {
+                kfree(req);
                return ERR_PTR(-ENOMEM);
+        }
        p9_set_tag(tc, n);
@@ -984,8 +948,6 @@ static void p9_mux_flush_cb(struct p9_req *freq, void *a)
                        (*req->cb) (req, req->cba);
                else
                        kfree(req->rcall);
-                wake_up(&m->equeue);
        }
        kfree(freq->tcall);
@@ -1191,8 +1153,6 @@ void p9_conn_cancel(struct p9_conn *m, int err)
                else
                        kfree(req->rcall);
        }
-        wake_up(&m->equeue);
 }
 /**
@@ -1370,7 +1330,6 @@ p9_fd_poll(struct p9_trans *trans, struct poll_table_struct *pt)
 {
        int ret, n;
        struct p9_trans_fd *ts = NULL;
-        mm_segment_t oldfs;
        if (trans && trans->status == Connected)
                ts = trans->priv;
@@ -1384,24 +1343,17 @@ p9_fd_poll(struct p9_trans *trans, struct poll_table_struct *pt)
        if (!ts->wr->f_op || !ts->wr->f_op->poll)
                return -EIO;
-        oldfs = get_fs();
-        set_fs(get_ds());
        ret = ts->rd->f_op->poll(ts->rd, pt);
        if (ret < 0)
-                goto end;
+                return ret;
        if (ts->rd != ts->wr) {
                n = ts->wr->f_op->poll(ts->wr, pt);
-                if (n < 0) {
+                if (n < 0)
-                        ret = n;
+                        return n;
-                        goto end;
-                }
                ret = (ret & ~POLLOUT) | (n & ~POLLIN);
        }
-end:
-        set_fs(oldfs);
        return ret;
 }
@@ -1629,6 +1581,7 @@ static struct p9_trans_module p9_tcp_trans = {
        .maxsize = MAX_SOCK_BUF,
        .def = 1,
        .create = p9_trans_create_tcp,
+        .owner = THIS_MODULE,
 };
 static struct p9_trans_module p9_unix_trans = {
@@ -1636,6 +1589,7 @@ static struct p9_trans_module p9_unix_trans = {
        .maxsize = MAX_SOCK_BUF,
        .def = 0,
        .create = p9_trans_create_unix,
+        .owner = THIS_MODULE,
 };
 static struct p9_trans_module p9_fd_trans = {
@@ -1643,14 +1597,20 @@ static struct p9_trans_module p9_fd_trans = {
        .maxsize = MAX_SOCK_BUF,
        .def = 0,
        .create = p9_trans_create_fd,
+        .owner = THIS_MODULE,
 };
 int p9_trans_fd_init(void)
 {
-        int ret = p9_mux_global_init();
+        int i;
-        if (ret) {
-                printk(KERN_WARNING "9p: starting mux failed\n");
+        for (i = 0; i < ARRAY_SIZE(p9_mux_poll_tasks); i++)
-                return ret;
+                p9_mux_poll_tasks[i].task = NULL;
+        p9_mux_wq = create_workqueue("v9fs");
+        if (!p9_mux_wq) {
+                printk(KERN_WARNING "v9fs: mux: creating workqueue failed\n");
+                return -ENOMEM;
        }
        v9fs_register_trans(&p9_tcp_trans);
@@ -1659,4 +1619,12 @@ int p9_trans_fd_init(void)
        return 0;
 }
-EXPORT_SYMBOL(p9_trans_fd_init);
+void p9_trans_fd_exit(void)
+{
+        v9fs_unregister_trans(&p9_tcp_trans);
+        v9fs_unregister_trans(&p9_unix_trans);
+        v9fs_unregister_trans(&p9_fd_trans);
+        destroy_workqueue(p9_mux_wq);
+}
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 42adc052b149..94912e077a55 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -528,6 +528,7 @@ static struct p9_trans_module p9_virtio_trans = {
        .create = p9_virtio_create,
        .maxsize = PAGE_SIZE*16,
        .def = 0,
+        .owner = THIS_MODULE,
 };
 /* The standard init function */
@@ -545,6 +546,7 @@ static int __init p9_virtio_init(void)
 static void __exit p9_virtio_cleanup(void)
 {
        unregister_virtio_driver(&p9_virtio_drv);
+        v9fs_unregister_trans(&p9_virtio_trans);
 }
 module_init(p9_virtio_init);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 01c83e2a4c19..28c71574a781 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -317,6 +317,9 @@ void ax25_destroy_socket(ax25_cb *ax25)
                                /* Queue the unaccepted socket for death */
                                sock_orphan(skb->sk);
+                                /* 9A4GL: hack to release unaccepted sockets */
+                                skb->sk->sk_state = TCP_LISTEN;
                                ax25_start_heartbeat(sax25);
                                sax25->state = AX25_STATE_0;
                        }
diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
index cdc7e751ef36..96e4b9273250 100644
--- a/net/ax25/ax25_std_timer.c
+++ b/net/ax25/ax25_std_timer.c
@@ -39,9 +39,11 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
        switch (ax25->state) {
        case AX25_STATE_0:
-                if (!sk ||
+                /* Magic here: If we listen() and a new link dies before it
-                    sock_flag(sk, SOCK_DESTROY) ||
+                   is accepted() it isn't 'dead' so doesn't get removed. */
-                    sock_flag(sk, SOCK_DEAD)) {
+                if (!sk || sock_flag(sk, SOCK_DESTROY) ||
+                    (sk->sk_state == TCP_LISTEN &&
+                     sock_flag(sk, SOCK_DEAD))) {
                        if (sk) {
                                sock_hold(sk);
                                ax25_destroy_socket(ax25);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f5b21cb93699..278a3ace14f6 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -164,6 +164,9 @@ static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *
 {
        int ret;
+        if (!test_bit(HCI_UP, &hdev->flags))
+                return -ENETDOWN;
        /* Serialize all requests */
        hci_req_lock(hdev);
        ret = __hci_request(hdev, req, opt, timeout);
diff --git a/net/core/dev.c b/net/core/dev.c
index e719ed29310f..0ae08d3f57e7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -122,6 +122,7 @@
 #include <linux/if_arp.h>
 #include <linux/if_vlan.h>
 #include <linux/ip.h>
+#include <net/ip.h>
 #include <linux/ipv6.h>
 #include <linux/in.h>
 #include <linux/jhash.h>
@@ -1667,7 +1668,7 @@ static u16 simple_tx_hash(struct net_device *dev, struct sk_buff *skb)
 {
        u32 addr1, addr2, ports;
        u32 hash, ihl;
-        u8 ip_proto;
+        u8 ip_proto = 0;
        if (unlikely(!simple_tx_hashrnd_initialized)) {
                get_random_bytes(&simple_tx_hashrnd, 4);
@@ -1676,7 +1677,8 @@ static u16 simple_tx_hash(struct net_device *dev, struct sk_buff *skb)
        switch (skb->protocol) {
        case __constant_htons(ETH_P_IP):
-                ip_proto = ip_hdr(skb)->protocol;
+                if (!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)))
+                        ip_proto = ip_hdr(skb)->protocol;
                addr1 = ip_hdr(skb)->saddr;
                addr2 = ip_hdr(skb)->daddr;
                ihl = ip_hdr(skb)->ihl;
@@ -2916,6 +2918,12 @@ int netdev_set_master(struct net_device *slave, struct net_device *master)
        return 0;
 }
+static void dev_change_rx_flags(struct net_device *dev, int flags)
+{
+        if (dev->flags & IFF_UP && dev->change_rx_flags)
+                dev->change_rx_flags(dev, flags);
+}
 static int __dev_set_promiscuity(struct net_device *dev, int inc)
 {
        unsigned short old_flags = dev->flags;
@@ -2953,8 +2961,7 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
                                current->uid, current->gid,
                                audit_get_sessionid(current));
-                if (dev->change_rx_flags)
+                dev_change_rx_flags(dev, IFF_PROMISC);
-                        dev->change_rx_flags(dev, IFF_PROMISC);
        }
        return 0;
 }
@@ -3020,8 +3027,7 @@ int dev_set_allmulti(struct net_device *dev, int inc)
                }
        }
        if (dev->flags ^ old_flags) {
-                if (dev->change_rx_flags)
+                dev_change_rx_flags(dev, IFF_ALLMULTI);
-                        dev->change_rx_flags(dev, IFF_ALLMULTI);
                dev_set_rx_mode(dev);
        }
        return 0;
@@ -3345,8 +3351,8 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
         *      Load in the correct multicast list now the flags have changed.
         */
-        if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
+        if ((old_flags ^ flags) & IFF_MULTICAST)
-                dev->change_rx_flags(dev, IFF_MULTICAST);
+                dev_change_rx_flags(dev, IFF_MULTICAST);
        dev_set_rx_mode(dev);
@@ -3806,14 +3812,11 @@ static int dev_new_index(struct net *net)
 }
 /* Delayed registration/unregisteration */
-static DEFINE_SPINLOCK(net_todo_list_lock);
 static LIST_HEAD(net_todo_list);
 static void net_set_todo(struct net_device *dev)
 {
-        spin_lock(&net_todo_list_lock);
        list_add_tail(&dev->todo_list, &net_todo_list);
-        spin_unlock(&net_todo_list_lock);
 }
 static void rollback_registered(struct net_device *dev)
@@ -4140,33 +4143,24 @@ static void netdev_wait_allrefs(struct net_device *dev)
 *      free_netdev(y1);
 *      free_netdev(y2);
 *
- * We are invoked by rtnl_unlock() after it drops the semaphore.
+ * We are invoked by rtnl_unlock().
 * This allows us to deal with problems:
 * 1) We can delete sysfs objects which invoke hotplug
 *    without deadlocking with linkwatch via keventd.
 * 2) Since we run with the RTNL semaphore not held, we can sleep
 *    safely in order to wait for the netdev refcnt to drop to zero.
+ *
+ * We must not return until all unregister events added during
+ * the interval the lock was held have been completed.
 */
-static DEFINE_MUTEX(net_todo_run_mutex);
 void netdev_run_todo(void)
 {
        struct list_head list;
-        /* Need to guard against multiple cpu's getting out of order. */
-        mutex_lock(&net_todo_run_mutex);
-        /* Not safe to do outside the semaphore.  We must not return
-         * until all unregister events invoked by the local processor
-         * have been completed (either by this todo run, or one on
-         * another cpu).
-         */
-        if (list_empty(&net_todo_list))
-                goto out;
        /* Snapshot list, allow later requests */
-        spin_lock(&net_todo_list_lock);
        list_replace_init(&net_todo_list, &list);
-        spin_unlock(&net_todo_list_lock);
+        __rtnl_unlock();
        while (!list_empty(&list)) {
                struct net_device *dev
@@ -4198,9 +4192,6 @@ void netdev_run_todo(void)
                /* Free network device */
                kobject_put(&dev->dev.kobj);
        }
-out:
-        mutex_unlock(&net_todo_run_mutex);
 }
 static struct net_device_stats *internal_stats(struct net_device *dev)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 71edb8b36341..d6381c2a4693 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -73,7 +73,7 @@ void __rtnl_unlock(void)
 void rtnl_unlock(void)
 {
-        mutex_unlock(&rtnl_mutex);
+        /* This fellow will unlock it for us. */
        netdev_run_todo();
 }
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index bfcbd148a89d..c209e054a634 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -150,7 +150,11 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                ca->snd_cwnd_cents -= 128;
                tp->snd_cwnd_cnt = 0;
        }
+        /* check when cwnd has not been incremented for a while */
+        if (increment == 0 && odd == 0 && tp->snd_cwnd_cnt >= tp->snd_cwnd) {
+                tp->snd_cwnd++;
+                tp->snd_cwnd_cnt = 0;
+        }
        /* clamp down slowstart cwnd to ssthresh value. */
        if (is_slowstart)
                tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 67ccce2a96bd..7abc6b80d47d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4879,7 +4879,8 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                        goto no_ack;
                        }
-                        __tcp_ack_snd_check(sk, 0);
+                        if (!copied_early || tp->rcv_nxt != tp->rcv_wup)
+                                __tcp_ack_snd_check(sk, 0);
 no_ack:
 #ifdef CONFIG_NET_DMA
                        if (copied_early)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1b4fee20fc93..011478e46c40 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -618,7 +618,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                        ];
        } rep;
        struct ip_reply_arg arg;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(skb->dst->dev);
        memset(&rep.th, 0, sizeof(struct tcphdr));
        memset(&arg, 0, sizeof(arg));
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 8e42fbbd5761..57e26fa66185 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -951,6 +951,27 @@ int udp_disconnect(struct sock *sk, int flags)
        return 0;
 }
+static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        int is_udplite = IS_UDPLITE(sk);
+        int rc;
+        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
+                /* Note that an ENOMEM error is charged twice */
+                if (rc == -ENOMEM)
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+                                         is_udplite);
+                goto drop;
+        }
+        return 0;
+drop:
+        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        kfree_skb(skb);
+        return -1;
+}
 /* returns:
 *  -1: error
 *   0: success
@@ -989,9 +1010,7 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                    up->encap_rcv != NULL) {
                        int ret;
-                        bh_unlock_sock(sk);
                        ret = (*up->encap_rcv)(sk, skb);
-                        bh_lock_sock(sk);
                        if (ret <= 0) {
                                UDP_INC_STATS_BH(sock_net(sk),
                                                 UDP_MIB_INDATAGRAMS,
@@ -1044,17 +1063,16 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                        goto drop;
        }
-        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+        rc = 0;
-                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
-                        UDP_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_RCVBUFERRORS, is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
-        }
-        return 0;
+        bh_lock_sock(sk);
+        if (!sock_owned_by_user(sk))
+                rc = __udp_queue_rcv_skb(sk, skb);
+        else
+                sk_add_backlog(sk, skb);
+        bh_unlock_sock(sk);
+        return rc;
 drop:
        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -1092,15 +1110,7 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                skb1 = skb_clone(skb, GFP_ATOMIC);
                        if (skb1) {
-                                int ret = 0;
+                                int ret = udp_queue_rcv_skb(sk, skb1);
-                                bh_lock_sock(sk);
-                                if (!sock_owned_by_user(sk))
-                                        ret = udp_queue_rcv_skb(sk, skb1);
-                                else
-                                        sk_add_backlog(sk, skb1);
-                                bh_unlock_sock(sk);
                                if (ret > 0)
                                        /* we should probably re-process instead
                                         * of dropping packets here. */
@@ -1195,13 +1205,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
                        uh->dest, inet_iif(skb), udptable);
        if (sk != NULL) {
-                int ret = 0;
+                int ret = udp_queue_rcv_skb(sk, skb);
-                bh_lock_sock(sk);
-                if (!sock_owned_by_user(sk))
-                        ret = udp_queue_rcv_skb(sk, skb);
-                else
-                        sk_add_backlog(sk, skb);
-                bh_unlock_sock(sk);
                sock_put(sk);
                /* a return value > 0 means to resubmit the input, but
@@ -1494,7 +1498,7 @@ struct proto udp_prot = {
        .sendmsg           = udp_sendmsg,
        .recvmsg           = udp_recvmsg,
        .sendpage          = udp_sendpage,
-        .backlog_rcv       = udp_queue_rcv_skb,
+        .backlog_rcv       = __udp_queue_rcv_skb,
        .hash              = udp_lib_hash,
        .unhash            = udp_lib_unhash,
        .get_port          = udp_v4_get_port,
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 62e39ace0588..26654b26d7fa 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -97,8 +97,6 @@ hbh_mt6(const struct sk_buff *skb, const struct net_device *in,
        hdrlen -= 2;
        if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
                return ret;
-        } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-                pr_debug("Not strict - not implemented");
        } else {
                pr_debug("Strict ");
                pr_debug("#%d ", optinfo->optsnr);
@@ -177,6 +175,12 @@ hbh_mt6_check(const char *tablename, const void *entry,
                pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
                return false;
        }
+        if (optsinfo->flags & IP6T_OPTS_NSTRICT) {
+                pr_debug("ip6t_opts: Not strict - not implemented");
+                return false;
+        }
        return true;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9af6115f0f50..63442a1e741c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2688,6 +2688,8 @@ int __init ip6_route_init(void)
        if (ret)
                goto out_kmem_cache;
+        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
        /* Registering of the loopback is done before this portion of code,
         * the loopback reference in rt6_info will not be taken, do it
         * manually for init_net */
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b585c850a89a..10e22fd48222 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1050,7 +1050,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
        struct tcphdr *th = tcp_hdr(skb), *t1;
        struct sk_buff *buff;
        struct flowi fl;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(skb->dst->dev);
        struct sock *ctl_sk = net->ipv6.tcp_sk;
        unsigned int tot_len = sizeof(struct tcphdr);
        __be32 *topt;
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 705959b31e24..d7b54b5bfa69 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -524,7 +524,6 @@ static int iucv_enable(void)
        get_online_cpus();
        for_each_online_cpu(cpu)
                smp_call_function_single(cpu, iucv_declare_cpu, NULL, 1);
-        preempt_enable();
        if (cpus_empty(iucv_buffer_cpumask))
                /* No cpu could declare an iucv buffer. */
                goto out_path;
@@ -547,7 +546,9 @@ out:
 */
 static void iucv_disable(void)
 {
+        get_online_cpus();
        on_each_cpu(iucv_retrieve_cpu, NULL, 1);
+        put_online_cpus();
        kfree(iucv_path_table);
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index d628df97e02e..b7f5a1c353ee 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -73,22 +73,18 @@ static int pfkey_can_dump(struct sock *sk)
        return 0;
 }
-static int pfkey_do_dump(struct pfkey_sock *pfk)
+static void pfkey_terminate_dump(struct pfkey_sock *pfk)
 {
-        int rc;
+        if (pfk->dump.dump) {
+                pfk->dump.done(pfk);
-        rc = pfk->dump.dump(pfk);
+                pfk->dump.dump = NULL;
-        if (rc == -ENOBUFS)
+                pfk->dump.done = NULL;
-                return 0;
+        }
-        pfk->dump.done(pfk);
-        pfk->dump.dump = NULL;
-        pfk->dump.done = NULL;
-        return rc;
 }
 static void pfkey_sock_destruct(struct sock *sk)
 {
+        pfkey_terminate_dump(pfkey_sk(sk));
        skb_queue_purge(&sk->sk_receive_queue);
        if (!sock_flag(sk, SOCK_DEAD)) {
@@ -310,6 +306,18 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
        return err;
 }
+static int pfkey_do_dump(struct pfkey_sock *pfk)
+{
+        int rc;
+        rc = pfk->dump.dump(pfk);
+        if (rc == -ENOBUFS)
+                return 0;
+        pfkey_terminate_dump(pfk);
+        return rc;
+}
 static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
 {
        *new = *orig;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 532e4faa29f7..9f1ea4a27b35 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -525,6 +525,7 @@ static int nr_release(struct socket *sock)
        if (sk == NULL) return 0;
        sock_hold(sk);
+        sock_orphan(sk);
        lock_sock(sk);
        nr = nr_sk(sk);
@@ -548,7 +549,6 @@ static int nr_release(struct socket *sock)
                sk->sk_state    = TCP_CLOSE;
                sk->sk_shutdown |= SEND_SHUTDOWN;
                sk->sk_state_change(sk);
-                sock_orphan(sk);
                sock_set_flag(sk, SOCK_DESTROY);
                break;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 9634091ee2f0..ec0a0839ce51 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -215,10 +215,9 @@ static void dev_watchdog(unsigned long arg)
                            time_after(jiffies, (dev->trans_start +
                                                 dev->watchdog_timeo))) {
                                char drivername[64];
-                                printk(KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit timed out\n",
+                                WARN_ONCE(1, KERN_INFO "NETDEV WATCHDOG: %s (%s): transmit timed out\n",
                                       dev->name, netdev_drivername(dev, drivername, 64));
                                dev->tx_timeout(dev);
-                                WARN_ON_ONCE(1);
                        }
                        if (!mod_timer(&dev->watchdog_timer,
                                       round_jiffies(jiffies +
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 8472b8b349c4..abd51cef2413 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -599,11 +599,12 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
        /* Check to see if this is a duplicate. */
        peer = sctp_assoc_lookup_paddr(asoc, addr);
        if (peer) {
+                /* An UNKNOWN state is only set on transports added by
+                 * user in sctp_connectx() call.  Such transports should be
+                 * considered CONFIRMED per RFC 4960, Section 5.4.
+                 */
                if (peer->state == SCTP_UNKNOWN) {
-                        if (peer_state == SCTP_ACTIVE)
+                        peer->state = SCTP_ACTIVE;
-                                peer->state = SCTP_ACTIVE;
-                        if (peer_state == SCTP_UNCONFIRMED)
-                                peer->state = SCTP_UNCONFIRMED;
                }
                return peer;
        }
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 0dc4a7dfb234..225c7123c41f 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -533,7 +533,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
        if (!(dst->dev->features & NETIF_F_NO_CSUM)) {
                crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
                crc32 = sctp_end_cksum(crc32);
-        }
+        } else
+                nskb->ip_summed = CHECKSUM_UNNECESSARY;
        /* 3) Put the resultant value into the checksum field in the
         *    common header, and leave the rest of the bits unchanged.
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index e8ca4e54981f..d68869f966c3 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1012,6 +1012,29 @@ end:
        return retval;
 }
+struct sctp_chunk *sctp_make_violation_paramlen(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk,
+        struct sctp_paramhdr *param)
+{
+        struct sctp_chunk *retval;
+        static const char error[] = "The following parameter had invalid length:";
+        size_t payload_len = sizeof(error) + sizeof(sctp_errhdr_t) +
+                                sizeof(sctp_paramhdr_t);
+        retval = sctp_make_abort(asoc, chunk, payload_len);
+        if (!retval)
+                goto nodata;
+        sctp_init_cause(retval, SCTP_ERROR_PROTO_VIOLATION,
+                        sizeof(error) + sizeof(sctp_paramhdr_t));
+        sctp_addto_chunk(retval, sizeof(error), error);
+        sctp_addto_param(retval, sizeof(sctp_paramhdr_t), param);
+nodata:
+        return retval;
+}
 /* Make a HEARTBEAT chunk.  */
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *asoc,
                                  const struct sctp_transport *transport,
@@ -1782,11 +1805,6 @@ static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
                                        const struct sctp_chunk *chunk,
                                        struct sctp_chunk **errp)
 {
-        static const char error[] = "The following parameter had invalid length:";
-        size_t          payload_len = WORD_ROUND(sizeof(error)) +
-                                                sizeof(sctp_paramhdr_t);
        /* This is a fatal error.  Any accumulated non-fatal errors are
         * not reported.
         */
@@ -1794,14 +1812,7 @@ static int sctp_process_inv_paramlength(const struct sctp_association *asoc,
                sctp_chunk_free(*errp);
        /* Create an error chunk and fill it in with our payload. */
-        *errp = sctp_make_op_error_space(asoc, chunk, payload_len);
+        *errp = sctp_make_violation_paramlen(asoc, chunk, param);
-        if (*errp) {
-                sctp_init_cause(*errp, SCTP_ERROR_PROTO_VIOLATION,
-                                sizeof(error) + sizeof(sctp_paramhdr_t));
-                sctp_addto_chunk(*errp, sizeof(error), error);
-                sctp_addto_param(*errp, sizeof(sctp_paramhdr_t), param);
-        }
        return 0;
 }
@@ -1886,11 +1897,13 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
                            /* if the peer reports AUTH, assume that he
                             * supports AUTH.
                             */
-                            asoc->peer.auth_capable = 1;
+                            if (sctp_auth_enable)
+                                    asoc->peer.auth_capable = 1;
                            break;
                    case SCTP_CID_ASCONF:
                    case SCTP_CID_ASCONF_ACK:
-                            asoc->peer.asconf_capable = 1;
+                            if (sctp_addip_enable)
+                                    asoc->peer.asconf_capable = 1;
                            break;
                    default:
                            break;
@@ -2319,12 +2332,10 @@ clean_up:
        /* Release the transport structures. */
        list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
                transport = list_entry(pos, struct sctp_transport, transports);
-                list_del_init(pos);
+                if (transport->state != SCTP_ACTIVE)
-                sctp_transport_free(transport);
+                        sctp_assoc_rm_peer(asoc, transport);
        }
-        asoc->peer.transport_count = 0;
 nomem:
        return 0;
 }
@@ -2460,6 +2471,9 @@ do_addr_param:
                break;
        case SCTP_PARAM_SET_PRIMARY:
+                if (!sctp_addip_enable)
+                        goto fall_through;
                addr_param = param.v + sizeof(sctp_addip_param_t);
                af = sctp_get_af_specific(param_type2af(param.p->type));
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8848d329aa2c..7c622af2ce55 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -119,7 +119,7 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                     const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
-                                     void *arg,
+                                     void *arg, void *ext,
                                     sctp_cmd_seq_t *commands);
 static sctp_disposition_t sctp_sf_violation_ctsn(
@@ -3425,7 +3425,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
        addr_param = (union sctp_addr_param *)hdr->params;
        length = ntohs(addr_param->p.length);
        if (length < sizeof(sctp_paramhdr_t))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
                           (void *)addr_param, commands);
        /* Verify the ASCONF chunk before processing it. */
@@ -3433,8 +3433,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
                            (sctp_paramhdr_t *)((void *)addr_param + length),
                            (void *)chunk->chunk_end,
                            &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
-                                                  (void *)&err_param, commands);
+                                                  (void *)err_param, commands);
        /* ADDIP 5.2 E1) Compare the value of the serial number to the value
         * the endpoint stored in a new association variable
@@ -3542,8 +3542,8 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
            (sctp_paramhdr_t *)addip_hdr->params,
            (void *)asconf_ack->chunk_end,
            &err_param))
-                return sctp_sf_violation_paramlen(ep, asoc, type,
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
-                           (void *)&err_param, commands);
+                           (void *)err_param, commands);
        if (last_asconf) {
                addip_hdr = (sctp_addiphdr_t *)last_asconf->subh.addip_hdr;
@@ -4240,12 +4240,38 @@ static sctp_disposition_t sctp_sf_violation_paramlen(
                                     const struct sctp_endpoint *ep,
                                     const struct sctp_association *asoc,
                                     const sctp_subtype_t type,
-                                     void *arg,
+                                     void *arg, void *ext,
-                                     sctp_cmd_seq_t *commands) {
+                                     sctp_cmd_seq_t *commands)
-        static const char err_str[] = "The following parameter had invalid length:";
+{
+        struct sctp_chunk *chunk =  arg;
+        struct sctp_paramhdr *param = ext;
+        struct sctp_chunk *abort = NULL;
-        return sctp_sf_abort_violation(ep, asoc, arg, commands, err_str,
+        if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
-                                        sizeof(err_str));
+                goto discard;
+        /* Make the abort chunk. */
+        abort = sctp_make_violation_paramlen(asoc, chunk, param);
+        if (!abort)
+                goto nomem;
+        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
+        SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                        SCTP_ERROR(ECONNABORTED));
+        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                        SCTP_PERR(SCTP_ERROR_PROTO_VIOLATION));
+        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+discard:
+        sctp_sf_pdiscard(ep, asoc, SCTP_ST_CHUNK(0), arg, commands);
+        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+        return SCTP_DISPOSITION_ABORT;
+nomem:
+        return SCTP_DISPOSITION_NOMEM;
 }
 /* Handle a protocol violation when the peer trying to advance the
diff --git a/net/socket.c b/net/socket.c
index 8ef8ba81b9e2..3e8d4e35c08f 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1511,6 +1511,7 @@ out_fd:
        goto out_put;
 }
+#if 0
 #ifdef HAVE_SET_RESTORE_SIGMASK
 asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
                            int __user *upeer_addrlen,
@@ -1564,6 +1565,7 @@ asmlinkage long sys_paccept(int fd, struct sockaddr __user *upeer_sockaddr,
        return do_accept(fd, upeer_sockaddr, upeer_addrlen, flags);
 }
 #endif
+#endif
 asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
                           int __user *upeer_addrlen)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index ac25b4c0e982..dc50f1e71f76 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -27,10 +27,14 @@ static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb)
                - skb_headroom(skb);
        int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
-        if (nhead > 0 || ntail > 0)
+        if (nhead <= 0) {
-                return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
+                if (ntail <= 0)
+                        return 0;
-        return 0;
+                nhead = 0;
+        } else if (ntail < 0)
+                ntail = 0;
+        return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
 }
 static int xfrm_output_one(struct sk_buff *skb, int err)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 36b5eedcdc75..3e1057f885c6 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -32,6 +32,7 @@ char *defconfig_file;
 static int indent = 1;
 static int valid_stdin = 1;
+static int sync_kconfig;
 static int conf_cnt;
 static char line[128];
 static struct menu *rootEntry;
@@ -65,7 +66,7 @@ static void strip(char *str)
 static void check_stdin(void)
 {
-        if (!valid_stdin && input_mode == ask_silent) {
+        if (!valid_stdin) {
                printf(_("aborted!\n\n"));
                printf(_("Console input/output is redirected. "));
                printf(_("Run 'make oldconfig' to update configuration.\n\n"));
@@ -427,43 +428,6 @@ static void check_conf(struct menu *menu)
                check_conf(child);
 }
-static void conf_do_update(void)
-{
-        /* Update until a loop caused no more changes */
-        do {
-                conf_cnt = 0;
-                check_conf(&rootmenu);
-        } while (conf_cnt);
-}
-static int conf_silent_update(void)
-{
-        const char *name;
-        if (conf_get_changed()) {
-                name = getenv("KCONFIG_NOSILENTUPDATE");
-                if (name && *name) {
-                        fprintf(stderr,
-                        _("\n*** Kernel configuration requires explicit update.\n\n"));
-                        return 1;
-                }
-                conf_do_update();
-        }
-        return 0;
-}
-static int conf_update(void)
-{
-        rootEntry = &rootmenu;
-        conf(&rootmenu);
-        if (input_mode == ask_all) {
-                input_mode = ask_silent;
-                valid_stdin = 1;
-        }
-        conf_do_update();
-        return 0;
-}
 int main(int ac, char **av)
 {
        int opt;
@@ -477,11 +441,11 @@ int main(int ac, char **av)
        while ((opt = getopt(ac, av, "osdD:nmyrh")) != -1) {
                switch (opt) {
                case 'o':
-                        input_mode = ask_new;
+                        input_mode = ask_silent;
                        break;
                case 's':
                        input_mode = ask_silent;
-                        valid_stdin = isatty(0) && isatty(1) && isatty(2);
+                        sync_kconfig = 1;
                        break;
                case 'd':
                        input_mode = set_default;
@@ -519,6 +483,19 @@ int main(int ac, char **av)
        name = av[optind];
        conf_parse(name);
        //zconfdump(stdout);
+        if (sync_kconfig) {
+                if (stat(".config", &tmpstat)) {
+                        fprintf(stderr, _("***\n"
+                                "*** You have not yet configured your kernel!\n"
+                                "*** (missing kernel .config file)\n"
+                                "***\n"
+                                "*** Please run some configurator (e.g. \"make oldconfig\" or\n"
+                                "*** \"make menuconfig\" or \"make xconfig\").\n"
+                                "***\n"));
+                        exit(1);
+                }
+        }
        switch (input_mode) {
        case set_default:
                if (!defconfig_file)
@@ -531,16 +508,6 @@ int main(int ac, char **av)
                }
                break;
        case ask_silent:
-                if (stat(".config", &tmpstat)) {
-                        printf(_("***\n"
-                                "*** You have not yet configured your kernel!\n"
-                                "*** (missing kernel .config file)\n"
-                                "***\n"
-                                "*** Please run some configurator (e.g. \"make oldconfig\" or\n"
-                                "*** \"make menuconfig\" or \"make xconfig\").\n"
-                                "***\n"));
-                        exit(1);
-                }
        case ask_all:
        case ask_new:
                conf_read(NULL);
@@ -569,6 +536,19 @@ int main(int ac, char **av)
        default:
                break;
        }
+        if (sync_kconfig) {
+                if (conf_get_changed()) {
+                        name = getenv("KCONFIG_NOSILENTUPDATE");
+                        if (name && *name) {
+                                fprintf(stderr,
+                                        _("\n*** Kernel configuration requires explicit update.\n\n"));
+                                return 1;
+                        }
+                }
+                valid_stdin = isatty(0) && isatty(1) && isatty(2);
+        }
        switch (input_mode) {
        case set_no:
                conf_set_all_new_symbols(def_no);
@@ -585,27 +565,38 @@ int main(int ac, char **av)
        case set_default:
                conf_set_all_new_symbols(def_default);
                break;
-        case ask_silent:
        case ask_new:
-                if (conf_silent_update())
-                        exit(1);
-                break;
        case ask_all:
-                if (conf_update())
+                rootEntry = &rootmenu;
-                        exit(1);
+                conf(&rootmenu);
+                input_mode = ask_silent;
+                /* fall through */
+        case ask_silent:
+                /* Update until a loop caused no more changes */
+                do {
+                        conf_cnt = 0;
+                        check_conf(&rootmenu);
+                } while (conf_cnt);
                break;
        }
-        if (conf_write(NULL)) {
+        if (sync_kconfig) {
-                fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
+                /* silentoldconfig is used during the build so we shall update autoconf.
-                exit(1);
+                 * All other commands are only used to generate a config.
-        }
+                 */
-        /* ask_silent is used during the build so we shall update autoconf.
+                if (conf_get_changed() && conf_write(NULL)) {
-         * All other commands are only used to generate a config.
+                        fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
-         */
+                        exit(1);
-        if (input_mode == ask_silent && conf_write_autoconf()) {
+                }
-                fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
+                if (conf_write_autoconf()) {
-                return 1;
+                        fprintf(stderr, _("\n*** Error during update of the kernel configuration.\n\n"));
+                        return 1;
+                }
+        } else {
+                if (conf_write(NULL)) {
+                        fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
+                        exit(1);
+                }
        }
        return 0;
 }
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index df6a188b9930..b91cf241a539 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -222,8 +222,10 @@ load:
                                continue;
                        if (def == S_DEF_USER) {
                                sym = sym_find(line + 9);
-                                if (!sym)
+                                if (!sym) {
+                                        sym_add_change_count(1);
                                        break;
+                                }
                        } else {
                                sym = sym_lookup(line + 9, 0);
                                if (sym->type == S_UNKNOWN)
@@ -259,8 +261,10 @@ load:
                        }
                        if (def == S_DEF_USER) {
                                sym = sym_find(line + 7);
-                                if (!sym)
+                                if (!sym) {
+                                        sym_add_change_count(1);
                                        break;
+                                }
                        } else {
                                sym = sym_lookup(line + 7, 0);
                                if (sym->type == S_UNKNOWN)
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index ff787e6ff8ed..44ee94d2ab76 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -781,6 +781,7 @@ sub output_struct_xml(%) {
    print " <refsect1>\n";
    print "  <title>Members</title>\n";
+    if ($#{$args{'parameterlist'}} >= 0) {
    print "  <variablelist>\n";
    foreach $parameter (@{$args{'parameterlist'}}) {
      ($parameter =~ /^#/) && next;
@@ -798,6 +799,9 @@ sub output_struct_xml(%) {
      print "    </varlistentry>\n";
    }
    print "  </variablelist>\n";
+    } else {
+        print " <para>\n  None\n </para>\n";
+    }
    print " </refsect1>\n";
    output_section_xml(@_);
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 418cd7dbbc93..8e0de6a5e18a 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1986,11 +1986,13 @@ static void read_markers(const char *fname)
                mod = find_module(modname);
                if (!mod) {
-                        if (is_vmlinux(modname))
-                                have_vmlinux = 1;
                        mod = new_module(NOFAIL(strdup(modname)));
                        mod->skip = 1;
                }
+                if (is_vmlinux(modname)) {
+                        have_vmlinux = 1;
+                        mod->skip = 0;
+                }
                if (!mod->skip)
                        add_marker(mod, marker, fmt);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index d11a8154500f..8551952ef329 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2737,6 +2737,7 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
                if (ctx == NULL)
                        goto netlbl_secattr_to_sid_return;
+                context_init(&ctx_new);
                ctx_new.user = ctx->user;
                ctx_new.role = ctx->role;
                ctx_new.type = ctx->type;
@@ -2745,13 +2746,9 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
                        if (ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
                                                  secattr->attr.mls.cat) != 0)
                                goto netlbl_secattr_to_sid_return;
-                        ctx_new.range.level[1].cat.highbit =
+                        memcpy(&ctx_new.range.level[1].cat,
-                                ctx_new.range.level[0].cat.highbit;
+                               &ctx_new.range.level[0].cat,
-                        ctx_new.range.level[1].cat.node =
+                               sizeof(ctx_new.range.level[0].cat));
-                                ctx_new.range.level[0].cat.node;
-                } else {
-                        ebitmap_init(&ctx_new.range.level[0].cat);
-                        ebitmap_init(&ctx_new.range.level[1].cat);
                }
                if (mls_context_isvalid(&policydb, &ctx_new) != 1)
                        goto netlbl_secattr_to_sid_return_cleanup;
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 9dd9bc73fe1d..ece25c718e95 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -781,7 +781,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
                return -ENODEV;
        card = pcm->card;
-        down_read(&card->controls_rwsem);
+        read_lock(&card->ctl_files_rwlock);
        list_for_each_entry(kctl, &card->ctl_files, list) {
                if (kctl->pid == current->pid) {
                        prefer_subdevice = kctl->prefer_pcm_subdevice;
@@ -789,7 +789,7 @@ int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
                                break;
                }
        }
-        up_read(&card->controls_rwsem);
+        read_unlock(&card->ctl_files_rwlock);
        switch (stream) {
        case SNDRV_PCM_STREAM_PLAYBACK:
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index c49b9d9e303c..c487025d3457 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1546,16 +1546,10 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
        card = substream->pcm->card;
        if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
-            runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
+            runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED ||
+            runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
                return -EBADFD;
-        snd_power_lock(card);
-        if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
-                result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
-                if (result < 0)
-                        goto _unlock;
-        }
        snd_pcm_stream_lock_irq(substream);
        /* resume pause */
        if (runtime->status->state == SNDRV_PCM_STATE_PAUSED)
@@ -1564,8 +1558,7 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
        snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
        /* runtime->control->appl_ptr = runtime->status->hw_ptr; */
        snd_pcm_stream_unlock_irq(substream);
- _unlock:
-        snd_power_unlock(card);
        return result;
 }
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index f7ea7287c59c..b917a9f981c7 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -418,7 +418,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
        mutex_lock(&rmidi->open_mutex);
        while (1) {
                subdevice = -1;
-                down_read(&card->controls_rwsem);
+                read_lock(&card->ctl_files_rwlock);
                list_for_each_entry(kctl, &card->ctl_files, list) {
                        if (kctl->pid == current->pid) {
                                subdevice = kctl->prefer_rawmidi_subdevice;
@@ -426,7 +426,7 @@ static int snd_rawmidi_open(struct inode *inode, struct file *file)
                                        break;
                        }
                }
-                up_read(&card->controls_rwsem);
+                read_unlock(&card->ctl_files_rwlock);
                err = snd_rawmidi_kernel_open(rmidi->card, rmidi->device,
                                              subdevice, fflags, rawmidi_file);
                if (err >= 0)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index ad994fcab725..f3da621f25c5 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1683,8 +1683,8 @@ static struct snd_pci_quirk stac927x_cfg_tbl[] = {
        /* Dell 3 stack systems with verb table in BIOS */
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0227, "Dell Vostro 1400  ", STAC_DELL_BIOS),
-        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell     ", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022e, "Dell     ", STAC_DELL_BIOS),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x022f, "Dell Inspiron 1525", STAC_DELL_3ST),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0242, "Dell     ", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x0243, "Dell     ", STAC_DELL_BIOS),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL,  0x02ff, "Dell     ", STAC_DELL_BIOS),
diff --git a/sound/ppc/awacs.c b/sound/ppc/awacs.c
index 566a6d0daf4a..106c48225bba 100644
--- a/sound/ppc/awacs.c
+++ b/sound/ppc/awacs.c
@@ -621,6 +621,13 @@ static struct snd_kcontrol_new snd_pmac_screamer_mixers_imac[] __initdata = {
        AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
 };
+static struct snd_kcontrol_new snd_pmac_screamer_mixers_g4agp[] __initdata = {
+        AWACS_VOLUME("Line out Playback Volume", 2, 6, 1),
+        AWACS_VOLUME("Master Playback Volume", 5, 6, 1),
+        AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
+        AWACS_SWITCH("Line Capture Switch", 0, SHIFT_MUX_MIC, 0),
+};
 static struct snd_kcontrol_new snd_pmac_awacs_mixers_pmac7500[] __initdata = {
        AWACS_VOLUME("Line out Playback Volume", 2, 6, 1),
        AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
@@ -688,7 +695,10 @@ static struct snd_kcontrol_new snd_pmac_awacs_speaker_vol[] __initdata = {
 static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw __initdata =
 AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_SPKMUTE, 1);
-static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac __initdata =
+static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac1 __initdata =
+AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_PAROUT1, 1);
+static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac2 __initdata =
 AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_PAROUT1, 0);
@@ -765,11 +775,12 @@ static void snd_pmac_awacs_resume(struct snd_pmac *chip)
 #define IS_PM7500 (machine_is_compatible("AAPL,7500"))
 #define IS_BEIGE (machine_is_compatible("AAPL,Gossamer"))
-#define IS_IMAC (machine_is_compatible("PowerMac2,1") \
+#define IS_IMAC1 (machine_is_compatible("PowerMac2,1"))
-                || machine_is_compatible("PowerMac2,2") \
+#define IS_IMAC2 (machine_is_compatible("PowerMac2,2") \
                || machine_is_compatible("PowerMac4,1"))
+#define IS_G4AGP (machine_is_compatible("PowerMac3,1"))
-static int imac;
+static int imac1, imac2;
 #ifdef PMAC_SUPPORT_AUTOMUTE
 /*
@@ -815,13 +826,18 @@ static void snd_pmac_awacs_update_automute(struct snd_pmac *chip, int do_notify)
                {
                        int reg = chip->awacs_reg[1]
                                | (MASK_HDMUTE | MASK_SPKMUTE);
-                        if (imac) {
+                        if (imac1) {
+                                reg &= ~MASK_SPKMUTE;
+                                reg |= MASK_PAROUT1;
+                        } else if (imac2) {
                                reg &= ~MASK_SPKMUTE;
                                reg &= ~MASK_PAROUT1;
                        }
                        if (snd_pmac_awacs_detect_headphone(chip))
                                reg &= ~MASK_HDMUTE;
-                        else if (imac)
+                        else if (imac1)
+                                reg &= ~MASK_PAROUT1;
+                        else if (imac2)
                                reg |= MASK_PAROUT1;
                        else
                                reg &= ~MASK_SPKMUTE;
@@ -850,9 +866,13 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
 {
        int pm7500 = IS_PM7500;
        int beige = IS_BEIGE;
+        int g4agp = IS_G4AGP;
+        int imac;
        int err, vol;
-        imac = IS_IMAC;
+        imac1 = IS_IMAC1;
+        imac2 = IS_IMAC2;
+        imac = imac1 || imac2;
        /* looks like MASK_GAINLINE triggers something, so we set here
         * as start-up
         */
@@ -939,7 +959,7 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
                                snd_pmac_awacs_mixers);
        if (err < 0)
                return err;
-        if (beige)
+        if (beige || g4agp)
                ;
        else if (chip->model == PMAC_SCREAMER)
                err = build_mixers(chip, ARRAY_SIZE(snd_pmac_screamer_mixers2),
@@ -961,13 +981,17 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
                err = build_mixers(chip,
                                   ARRAY_SIZE(snd_pmac_screamer_mixers_imac),
                                   snd_pmac_screamer_mixers_imac);
+        else if (g4agp)
+                err = build_mixers(chip,
+                                   ARRAY_SIZE(snd_pmac_screamer_mixers_g4agp),
+                                   snd_pmac_screamer_mixers_g4agp);
        else
                err = build_mixers(chip,
                                   ARRAY_SIZE(snd_pmac_awacs_mixers_pmac),
                                   snd_pmac_awacs_mixers_pmac);
        if (err < 0)
                return err;
-        chip->master_sw_ctl = snd_ctl_new1((pm7500 || imac)
+        chip->master_sw_ctl = snd_ctl_new1((pm7500 || imac || g4agp)
                        ? &snd_pmac_awacs_master_sw_imac
                        : &snd_pmac_awacs_master_sw, chip);
        err = snd_ctl_add(chip->card, chip->master_sw_ctl);
@@ -1004,15 +1028,17 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
                                        snd_pmac_awacs_speaker_vol);
                if (err < 0)
                        return err;
-                chip->speaker_sw_ctl = snd_ctl_new1(imac
+                chip->speaker_sw_ctl = snd_ctl_new1(imac1
-                                ? &snd_pmac_awacs_speaker_sw_imac
+                                ? &snd_pmac_awacs_speaker_sw_imac1
+                                : imac2
+                                ? &snd_pmac_awacs_speaker_sw_imac2
                                : &snd_pmac_awacs_speaker_sw, chip);
                err = snd_ctl_add(chip->card, chip->speaker_sw_ctl);
                if (err < 0)
                        return err;
        }
-        if (beige)
+        if (beige || g4agp)
                err = build_mixers(chip,
                                ARRAY_SIZE(snd_pmac_screamer_mic_boost_beige),
                                snd_pmac_screamer_mic_boost_beige);
diff --git a/sound/soc/at32/at32-pcm.c b/sound/soc/at32/at32-pcm.c
index 435f1daf177c..c83584f989a9 100644
--- a/sound/soc/at32/at32-pcm.c
+++ b/sound/soc/at32/at32-pcm.c
@@ -434,7 +434,8 @@ static int at32_pcm_suspend(struct platform_device *pdev,
        params = prtd->params;
        /* Disable the PDC and save the PDC registers */
-        ssc_writex(params->ssc->regs, PDC_PTCR, params->mask->pdc_disable);
+        ssc_writex(params->ssc->regs, ATMEL_PDC_PTCR,
+                   params->mask->pdc_disable);
        prtd->pdc_xpr_save = ssc_readx(params->ssc->regs, params->pdc->xpr);
        prtd->pdc_xcr_save = ssc_readx(params->ssc->regs, params->pdc->xcr);
@@ -464,7 +465,7 @@ static int at32_pcm_resume(struct platform_device *pdev,
        ssc_writex(params->ssc->regs, params->pdc->xnpr, prtd->pdc_xnpr_save);
        ssc_writex(params->ssc->regs, params->pdc->xncr, prtd->pdc_xncr_save);
-        ssc_writex(params->ssc->regs, PDC_PTCR, params->mask->pdc_enable);
+        ssc_writex(params->ssc->regs, ATMEL_PDC_PTCR, params->mask->pdc_enable);
        return 0;
 }
 #else /* CONFIG_PM */
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index 9deb8c74fdfd..0bbd94501d7e 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -490,34 +490,7 @@ static int cs4270_mute(struct snd_soc_dai *dai, int mute)
 #endif
-static int cs4270_i2c_probe(struct i2c_adapter *adap, int addr, int kind);
+static int cs4270_i2c_probe(struct i2c_client *, const struct i2c_device_id *);
-/*
- * Notify the driver that a new I2C bus has been found.
- *
- * This function is called for each I2C bus in the system.  The function
- * then asks the I2C subsystem to probe that bus at the addresses on which
- * our device (the CS4270) could exist.  If a device is found at one of
- * those addresses, then our probe function (cs4270_i2c_probe) is called.
- */
-static int cs4270_i2c_attach(struct i2c_adapter *adapter)
-{
-        return i2c_probe(adapter, &addr_data, cs4270_i2c_probe);
-}
-static int cs4270_i2c_detach(struct i2c_client *client)
-{
-        struct snd_soc_codec *codec = i2c_get_clientdata(client);
-        i2c_detach_client(client);
-        codec->control_data = NULL;
-        kfree(codec->reg_cache);
-        codec->reg_cache = NULL;
-        kfree(client);
-        return 0;
-}
 /* A list of non-DAPM controls that the CS4270 supports */
 static const struct snd_kcontrol_new cs4270_snd_controls[] = {
@@ -525,14 +498,19 @@ static const struct snd_kcontrol_new cs4270_snd_controls[] = {
                CS4270_VOLA, CS4270_VOLB, 0, 0xFF, 1)
 };
+static const struct i2c_device_id cs4270_id[] = {
+        {"cs4270", 0},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, cs4270_id);
 static struct i2c_driver cs4270_i2c_driver = {
        .driver = {
                .name = "CS4270 I2C",
                .owner = THIS_MODULE,
        },
-        .id =             I2C_DRIVERID_CS4270,
+        .id_table = cs4270_id,
-        .attach_adapter = cs4270_i2c_attach,
+        .probe = cs4270_i2c_probe,
-        .detach_client =  cs4270_i2c_detach,
 };
 /*
@@ -561,11 +539,11 @@ static struct snd_soc_device *cs4270_socdev;
 * Note: snd_soc_new_pcms() must be called before this function can be called,
 * because of snd_ctl_add().
 */
-static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
+static int cs4270_i2c_probe(struct i2c_client *i2c_client,
+        const struct i2c_device_id *id)
 {
        struct snd_soc_device *socdev = cs4270_socdev;
        struct snd_soc_codec *codec = socdev->codec;
-        struct i2c_client *i2c_client = NULL;
        int i;
        int ret = 0;
@@ -578,12 +556,6 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
        /* Note: codec_dai->codec is NULL here */
-        i2c_client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
-        if (!i2c_client) {
-                printk(KERN_ERR "cs4270: could not allocate I2C client\n");
-                return -ENOMEM;
-        }
        codec->reg_cache = kzalloc(CS4270_NUMREGS, GFP_KERNEL);
        if (!codec->reg_cache) {
                printk(KERN_ERR "cs4270: could not allocate register cache\n");
@@ -591,13 +563,6 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
                goto error;
        }
-        i2c_set_clientdata(i2c_client, codec);
-        strcpy(i2c_client->name, "CS4270");
-        i2c_client->driver = &cs4270_i2c_driver;
-        i2c_client->adapter = adapter;
-        i2c_client->addr = addr;
        /* Verify that we have a CS4270 */
        ret = i2c_smbus_read_byte_data(i2c_client, CS4270_CHIPID);
@@ -612,18 +577,10 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
                goto error;
        }
-        printk(KERN_INFO "cs4270: found device at I2C address %X\n", addr);
+        printk(KERN_INFO "cs4270: found device at I2C address %X\n",
+                i2c_client->addr);
        printk(KERN_INFO "cs4270: hardware revision %X\n", ret & 0xF);
-        /* Tell the I2C layer a new client has arrived */
-        ret = i2c_attach_client(i2c_client);
-        if (ret) {
-                printk(KERN_ERR "cs4270: could not attach codec, "
-                        "I2C address %x, error code %i\n", addr, ret);
-                goto error;
-        }
        codec->control_data = i2c_client;
        codec->read = cs4270_read_reg_cache;
        codec->write = cs4270_i2c_write;
@@ -648,20 +605,17 @@ static int cs4270_i2c_probe(struct i2c_adapter *adapter, int addr, int kind)
                        goto error;
        }
+        i2c_set_clientdata(i2c_client, codec);
        return 0;
 error:
-        if (codec->control_data) {
+        codec->control_data = NULL;
-                i2c_detach_client(i2c_client);
-                codec->control_data = NULL;
-        }
        kfree(codec->reg_cache);
        codec->reg_cache = NULL;
        codec->reg_cache_size = 0;
-        kfree(i2c_client);
        return ret;
 }
@@ -727,7 +681,7 @@ static int cs4270_probe(struct platform_device *pdev)
        ret = snd_soc_new_pcms(socdev, SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1);
        if (ret < 0) {
                printk(KERN_ERR "cs4270: failed to create PCMs\n");
-                return ret;
+                goto error_free_codec;
        }
 #ifdef USE_I2C
@@ -736,8 +690,7 @@ static int cs4270_probe(struct platform_device *pdev)
        ret = i2c_add_driver(&cs4270_i2c_driver);
        if (ret) {
                printk(KERN_ERR "cs4270: failed to attach driver");
-                snd_soc_free_pcms(socdev);
+                goto error_free_pcms;
-                return ret;
        }
        /* Did we find a CS4270 on the I2C bus? */
@@ -759,10 +712,23 @@ static int cs4270_probe(struct platform_device *pdev)
        ret = snd_soc_register_card(socdev);
        if (ret < 0) {
                printk(KERN_ERR "cs4270: failed to register card\n");
-                snd_soc_free_pcms(socdev);
+                goto error_del_driver;
-                return ret;
        }
+        return 0;
+error_del_driver:
+#ifdef USE_I2C
+        i2c_del_driver(&cs4270_i2c_driver);
+error_free_pcms:
+#endif
+        snd_soc_free_pcms(socdev);
+error_free_codec:
+        kfree(socdev->codec);
+        socdev->codec = NULL;
        return ret;
 }
@@ -773,8 +739,7 @@ static int cs4270_remove(struct platform_device *pdev)
        snd_soc_free_pcms(socdev);
 #ifdef USE_I2C
-        if (socdev->codec->control_data)
+        i2c_del_driver(&cs4270_i2c_driver);
-                i2c_del_driver(&cs4270_i2c_driver);
 #endif
        kfree(socdev->codec);
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index 5761164fe16d..e873414840c8 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -583,7 +583,7 @@ static const struct snd_soc_dapm_route audio_map[] = {
        /* out 4 */
        {"Out4 Mux", "VREF", "VREF"},
-        {"Out4 Mux", "Capture ST", "Capture ST Mixer"},
+        {"Out4 Mux", "Capture ST", "Playback Mixer"},
        {"Out4 Mux", "LOUT2", "LOUT2"},
        {"Out 4", NULL, "Out4 Mux"},
        {"OUT4", NULL, "Out 4"},
@@ -607,7 +607,7 @@ static const struct snd_soc_dapm_route audio_map[] = {
        /* Capture Right Mux */
        {"Capture Right Mux", "PGA", "Right Capture Volume"},
        {"Capture Right Mux", "Line or RXP-RXN", "Line Right Mux"},
-        {"Capture Right Mux", "Sidetone", "Capture ST Mixer"},
+        {"Capture Right Mux", "Sidetone", "Playback Mixer"},
        /* Mono Capture mixer-mux */
        {"Capture Right Mixer", "Stereo", "Capture Right Mux"},