330 files changed, 3712 insertions, 1685 deletions

diff --git a/Documentation/fb/pvr2fb.txt b/Documentation/fb/pvr2fb.txt
index 2bf6c2321c2d..36bdeff585e2 100644
--- a/Documentation/fb/pvr2fb.txt
+++ b/Documentation/fb/pvr2fb.txt
@@ -9,14 +9,13 @@ one found in the Dreamcast.
 Advantages:
 
  * It provides a nice large console (128 cols + 48 lines with 1024x768)
-   without using tiny, unreadable fonts.
+   without using tiny, unreadable fonts (NOT on the Dreamcast)
  * You can run XF86_FBDev on top of /dev/fb0
  * Most important: boot logo :-)
 
 Disadvantages:
 
- * Driver is currently limited to the Dreamcast PowerVR 2 implementation
-   at the time of this writing.
+ * Driver is largely untested on non-Dreamcast systems.
 
 Configuration
 =============
@@ -29,11 +28,16 @@ Accepted options:
 font:X    - default font to use. All fonts are supported, including the
             SUN12x22 font which is very nice at high resolutions.
 
-mode:X    - default video mode. The following video modes are supported:
-            640x240-60, 640x480-60.
             
+mode:X    - default video mode with format [xres]x[yres]-<bpp>@<refresh rate>
+            The following video modes are supported:
+            640x640-16@60, 640x480-24@60, 640x480-32@60. The Dreamcast
+            defaults to 640x480-16@60. At the time of writing the
+            24bpp and 32bpp modes function poorly. Work to fix that is
+            ongoing
+
             Note: the 640x240 mode is currently broken, and should not be
-            used for any reason. It is only mentioned as a reference.
+            used for any reason. It is only mentioned here as a reference.
 
 inverse   - invert colors on screen (for LCD displays)
 
@@ -52,10 +56,10 @@ output:X  - output type. This can be any of the following: pal, ntsc, and
 X11
 ===
 
-XF86_FBDev should work, in theory. At the time of this writing it is
-totally untested and may or may not even portray the beginnings of
-working. If you end up testing this, please let me know!
+XF86_FBDev has been shown to work on the Dreamcast in the past - though not yet
+on any 2.6 series kernel.
 
 --
 Paul Mundt <lethal@linuxdc.org>
+Updated by Adrian McMenamin <adrian@mcmen.demon.co.uk>
 
diff --git a/Documentation/i386/zero-page.txt b/Documentation/i386/zero-page.txt
index 75b3680c41eb..6c0817c45683 100644
--- a/Documentation/i386/zero-page.txt
+++ b/Documentation/i386/zero-page.txt
@@ -1,3 +1,13 @@
+---------------------------------------------------------------------------
+!!!!!!!!!!!!!!!WARNING!!!!!!!!
+The zero page is a kernel internal data structure, not a stable ABI.  It might change
+without warning and the kernel has no way to detect old version of it.
+If you're writing some external code like a boot loader you should only use
+the stable versioned real mode boot protocol described in boot.txt. Otherwise the kernel
+might break you at any time.
+!!!!!!!!!!!!!WARNING!!!!!!!!!!!
+----------------------------------------------------------------------------
+
 Summary of boot_params layout (kernel point of view)
      ( collected by Hans Lermen and Martin Mares )
  
diff --git a/Documentation/kbuild/kconfig-language.txt b/Documentation/kbuild/kconfig-language.txt
index 536d5bfbdb8d..fe8b0c4892cf 100644
--- a/Documentation/kbuild/kconfig-language.txt
+++ b/Documentation/kbuild/kconfig-language.txt
@@ -98,6 +98,15 @@ applicable everywhere (see syntax).
   times, the limit is set to the largest selection.
   Reverse dependencies can only be used with boolean or tristate
   symbols.
+  Note:
+        select is evil.... select will by brute force set a symbol
+        equal to 'y' without visiting the dependencies. So abusing
+        select you are able to select a symbol FOO even if FOO depends
+        on BAR that is not set. In general use select only for
+        non-visible symbols (no promts anywhere) and for symbols with
+        no dependencies. That will limit the usefulness but on the
+        other hand avoid the illegal configurations all over. kconfig
+        should one day warn about such things.
 
 - numerical ranges: "range" <symbol> <symbol> ["if" <expr>]
   This allows to limit the range of possible input values for int
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index efdb42fd3fb8..975f029be25c 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -163,6 +163,8 @@ and is between 256 and 4096 characters. It is defined in the file
         acpi_irq_isa=   [HW,ACPI] If irq_balance, mark listed IRQs used by ISA
                         Format: <irq>,<irq>...
 
+        acpi_no_auto_ssdt       [HW,ACPI] Disable automatic loading of SSDT
+
         acpi_os_name=   [HW,ACPI] Tell ACPI BIOS the name of the OS
                         Format: To spoof as Windows 98: ="Microsoft Windows"
 
@@ -1820,6 +1822,26 @@ and is between 256 and 4096 characters. It is defined in the file
         thash_entries=  [KNL,NET]
                         Set number of hash buckets for TCP connection
 
+        thermal.act=    [HW,ACPI]
+                        -1: disable all active trip points in all thermal zones
+                        <degrees C>: override all lowest active trip points
+
+        thermal.nocrt=  [HW,ACPI]
+                        Set to disable actions on ACPI thermal zone
+                        critical and hot trip points.
+
+        thermal.off=    [HW,ACPI]
+                        1: disable ACPI thermal control
+
+        thermal.psv=    [HW,ACPI]
+                        -1: disable all passive trip points
+                        <degrees C>: override all passive trip points to this value
+
+        thermal.tzp=    [HW,ACPI]
+                        Specify global default ACPI thermal zone polling rate
+                        <deci-seconds>: poll all this frequency
+                        0: no polling (default)
+
         time            Show timing data prefixed to each printk message line
                         [deprecated, see 'printk.time']
 
@@ -1922,7 +1944,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         See header of drivers/scsi/wd7000.c.
 
         wdt=            [WDT] Watchdog
-                        See Documentation/watchdog/watchdog.txt.
+                        See Documentation/watchdog/wdt.txt.
 
         xd=             [HW,XT] Original XT pre-IDE (RLL encoded) disks.
         xd_geo=         See header of drivers/block/xd.c.
diff --git a/Documentation/memory-hotplug.txt b/Documentation/memory-hotplug.txt
new file mode 100644
index 000000000000..5fbcc22c98e9
--- /dev/null
+++ b/Documentation/memory-hotplug.txt
@@ -0,0 +1,322 @@
+==============
+Memory Hotplug
+==============
+
+Last Updated: Jul 28 2007
+
+This document is about memory hotplug including how-to-use and current status.
+Because Memory Hotplug is still under development, contents of this text will
+be changed often.
+
+1. Introduction
+  1.1 purpose of memory hotplug
+  1.2. Phases of memory hotplug
+  1.3. Unit of Memory online/offline operation
+2. Kernel Configuration
+3. sysfs files for memory hotplug
+4. Physical memory hot-add phase
+  4.1 Hardware(Firmware) Support
+  4.2 Notify memory hot-add event by hand
+5. Logical Memory hot-add phase
+  5.1. State of memory
+  5.2. How to online memory
+6. Logical memory remove
+  6.1 Memory offline and ZONE_MOVABLE
+  6.2. How to offline memory
+7. Physical memory remove
+8. Future Work List
+
+Note(1): x86_64's has special implementation for memory hotplug.
+         This text does not describe it.
+Note(2): This text assumes that sysfs is mounted at /sys.
+
+
+---------------
+1. Introduction
+---------------
+
+1.1 purpose of memory hotplug
+------------
+Memory Hotplug allows users to increase/decrease the amount of memory.
+Generally, there are two purposes.
+
+(A) For changing the amount of memory.
+    This is to allow a feature like capacity on demand.
+(B) For installing/removing DIMMs or NUMA-nodes physically.
+    This is to exchange DIMMs/NUMA-nodes, reduce power consumption, etc.
+
+(A) is required by highly virtualized environments and (B) is required by
+hardware which supports memory power management.
+
+Linux memory hotplug is designed for both purpose.
+
+
+1.2. Phases of memory hotplug
+---------------
+There are 2 phases in Memory Hotplug.
+  1) Physical Memory Hotplug phase
+  2) Logical Memory Hotplug phase.
+
+The First phase is to communicate hardware/firmware and make/erase
+environment for hotplugged memory. Basically, this phase is necessary
+for the purpose (B), but this is good phase for communication between
+highly virtualized environments too.
+
+When memory is hotplugged, the kernel recognizes new memory, makes new memory
+management tables, and makes sysfs files for new memory's operation.
+
+If firmware supports notification of connection of new memory to OS,
+this phase is triggered automatically. ACPI can notify this event. If not,
+"probe" operation by system administration is used instead.
+(see Section 4.).
+
+Logical Memory Hotplug phase is to change memory state into
+avaiable/unavailable for users. Amount of memory from user's view is
+changed by this phase. The kernel makes all memory in it as free pages
+when a memory range is available.
+
+In this document, this phase is described as online/offline.
+
+Logical Memory Hotplug phase is triggred by write of sysfs file by system
+administrator. For the hot-add case, it must be executed after Physical Hotplug
+phase by hand.
+(However, if you writes udev's hotplug scripts for memory hotplug, these
+ phases can be execute in seamless way.)
+
+
+1.3. Unit of Memory online/offline operation
+------------
+Memory hotplug uses SPARSEMEM memory model. SPARSEMEM divides the whole memory
+into chunks of the same size. The chunk is called a "section". The size of
+a section is architecture dependent. For example, power uses 16MiB, ia64 uses
+1GiB. The unit of online/offline operation is "one section". (see Section 3.)
+
+To determine the size of sections, please read this file:
+
+/sys/devices/system/memory/block_size_bytes
+
+This file shows the size of sections in byte.
+
+-----------------------
+2. Kernel Configuration
+-----------------------
+To use memory hotplug feature, kernel must be compiled with following
+config options.
+
+- For all memory hotplug
+    Memory model -> Sparse Memory  (CONFIG_SPARSEMEM)
+    Allow for memory hot-add       (CONFIG_MEMORY_HOTPLUG)
+
+- To enable memory removal, the followings are also necessary
+    Allow for memory hot remove    (CONFIG_MEMORY_HOTREMOVE)
+    Page Migration                 (CONFIG_MIGRATION)
+
+- For ACPI memory hotplug, the followings are also necessary
+    Memory hotplug (under ACPI Support menu) (CONFIG_ACPI_HOTPLUG_MEMORY)
+    This option can be kernel module.
+
+- As a related configuration, if your box has a feature of NUMA-node hotplug
+  via ACPI, then this option is necessary too.
+    ACPI0004,PNP0A05 and PNP0A06 Container Driver (under ACPI Support menu)
+    (CONFIG_ACPI_CONTAINER).
+    This option can be kernel module too.
+
+--------------------------------
+3 sysfs files for memory hotplug
+--------------------------------
+All sections have their device information under /sys/devices/system/memory as
+
+/sys/devices/system/memory/memoryXXX
+(XXX is section id.)
+
+Now, XXX is defined as start_address_of_section / section_size.
+
+For example, assume 1GiB section size. A device for a memory starting at
+0x100000000 is /sys/device/system/memory/memory4
+(0x100000000 / 1Gib = 4)
+This device covers address range [0x100000000 ... 0x140000000)
+
+Under each section, you can see 3 files.
+
+/sys/devices/system/memory/memoryXXX/phys_index
+/sys/devices/system/memory/memoryXXX/phys_device
+/sys/devices/system/memory/memoryXXX/state
+
+'phys_index' : read-only and contains section id, same as XXX.
+'state'      : read-write
+               at read:  contains online/offline state of memory.
+               at write: user can specify "online", "offline" command
+'phys_device': read-only: designed to show the name of physical memory device.
+               This is not well implemented now.
+
+NOTE:
+  These directories/files appear after physical memory hotplug phase.
+
+
+--------------------------------
+4. Physical memory hot-add phase
+--------------------------------
+
+4.1 Hardware(Firmware) Support
+------------
+On x86_64/ia64 platform, memory hotplug by ACPI is supported.
+
+In general, the firmware (ACPI) which supports memory hotplug defines
+memory class object of _HID "PNP0C80". When a notify is asserted to PNP0C80,
+Linux's ACPI handler does hot-add memory to the system and calls a hotplug udev
+script. This will be done automatically.
+
+But scripts for memory hotplug are not contained in generic udev package(now).
+You may have to write it by yourself or online/offline memory by hand.
+Please see "How to online memory", "How to offline memory" in this text.
+
+If firmware supports NUMA-node hotplug, and defines an object _HID "ACPI0004",
+"PNP0A05", or "PNP0A06", notification is asserted to it, and ACPI handler
+calls hotplug code for all of objects which are defined in it.
+If memory device is found, memory hotplug code will be called.
+
+
+4.2 Notify memory hot-add event by hand
+------------
+In some environments, especially virtualized environment, firmware will not
+notify memory hotplug event to the kernel. For such environment, "probe"
+interface is supported. This interface depends on CONFIG_ARCH_MEMORY_PROBE.
+
+Now, CONFIG_ARCH_MEMORY_PROBE is supported only by powerpc but it does not
+contain highly architecture codes. Please add config if you need "probe"
+interface.
+
+Probe interface is located at
+/sys/devices/system/memory/probe
+
+You can tell the physical address of new memory to the kernel by
+
+% echo start_address_of_new_memory > /sys/devices/system/memory/probe
+
+Then, [start_address_of_new_memory, start_address_of_new_memory + section_size)
+memory range is hot-added. In this case, hotplug script is not called (in
+current implementation). You'll have to online memory by yourself.
+Please see "How to online memory" in this text.
+
+
+
+------------------------------
+5. Logical Memory hot-add phase
+------------------------------
+
+5.1. State of memory
+------------
+To see (online/offline) state of memory section, read 'state' file.
+
+% cat /sys/device/system/memory/memoryXXX/state
+
+
+If the memory section is online, you'll read "online".
+If the memory section is offline, you'll read "offline".
+
+
+5.2. How to online memory
+------------
+Even if the memory is hot-added, it is not at ready-to-use state.
+For using newly added memory, you have to "online" the memory section.
+
+For onlining, you have to write "online" to the section's state file as:
+
+% echo online > /sys/devices/system/memory/memoryXXX/state
+
+After this, section memoryXXX's state will be 'online' and the amount of
+available memory will be increased.
+
+Currently, newly added memory is added as ZONE_NORMAL (for powerpc, ZONE_DMA).
+This may be changed in future.
+
+
+
+------------------------
+6. Logical memory remove
+------------------------
+
+6.1 Memory offline and ZONE_MOVABLE
+------------
+Memory offlining is more complicated than memory online. Because memory offline
+has to make the whole memory section be unused, memory offline can fail if
+the section includes memory which cannot be freed.
+
+In general, memory offline can use 2 techniques.
+
+(1) reclaim and free all memory in the section.
+(2) migrate all pages in the section.
+
+In the current implementation, Linux's memory offline uses method (2), freeing
+all  pages in the section by page migration. But not all pages are
+migratable. Under current Linux, migratable pages are anonymous pages and
+page caches. For offlining a section by migration, the kernel has to guarantee
+that the section contains only migratable pages.
+
+Now, a boot option for making a section which consists of migratable pages is
+supported. By specifying "kernelcore=" or "movablecore=" boot option, you can
+create ZONE_MOVABLE...a zone which is just used for movable pages.
+(See also Documentation/kernel-parameters.txt)
+
+Assume the system has "TOTAL" amount of memory at boot time, this boot option
+creates ZONE_MOVABLE as following.
+
+1) When kernelcore=YYYY boot option is used,
+  Size of memory not for movable pages (not for offline) is YYYY.
+  Size of memory for movable pages (for offline) is TOTAL-YYYY.
+
+2) When movablecore=ZZZZ boot option is used,
+  Size of memory not for movable pages (not for offline) is TOTAL - ZZZZ.
+  Size of memory for movable pages (for offline) is ZZZZ.
+
+
+Note) Unfortunately, there is no information to show which section belongs
+to ZONE_MOVABLE. This is TBD.
+
+
+6.2. How to offline memory
+------------
+You can offline a section by using the same sysfs interface that was used in
+memory onlining.
+
+% echo offline > /sys/devices/system/memory/memoryXXX/state
+
+If offline succeeds, the state of the memory section is changed to be "offline".
+If it fails, some error core (like -EBUSY) will be returned by the kernel.
+Even if a section does not belong to ZONE_MOVABLE, you can try to offline it.
+If it doesn't contain 'unmovable' memory, you'll get success.
+
+A section under ZONE_MOVABLE is considered to be able to be offlined easily.
+But under some busy state, it may return -EBUSY. Even if a memory section
+cannot be offlined due to -EBUSY, you can retry offlining it and may be able to
+offline it (or not).
+(For example, a page is referred to by some kernel internal call and released
+ soon.)
+
+Consideration:
+Memory hotplug's design direction is to make the possibility of memory offlining
+higher and to guarantee unplugging memory under any situation. But it needs
+more work. Returning -EBUSY under some situation may be good because the user
+can decide to retry more or not by himself. Currently, memory offlining code
+does some amount of retry with 120 seconds timeout.
+
+-------------------------
+7. Physical memory remove
+-------------------------
+Need more implementation yet....
+ - Notification completion of remove works by OS to firmware.
+ - Guard from remove if not yet.
+
+--------------
+8. Future Work
+--------------
+  - allowing memory hot-add to ZONE_MOVABLE. maybe we need some switch like
+    sysctl or new control file.
+  - showing memory section and physical device relationship.
+  - showing memory section and node relationship (maybe good for NUMA)
+  - showing memory section is under ZONE_MOVABLE or not
+  - test and make it better memory offlining.
+  - support HugeTLB page migration and offlining.
+  - memmap removing at memory offline.
+  - physical remove memory.
+
diff --git a/Documentation/sysrq.txt b/Documentation/sysrq.txt
index ba328f255417..ef19142896ca 100644
--- a/Documentation/sysrq.txt
+++ b/Documentation/sysrq.txt
@@ -1,6 +1,6 @@
 Linux Magic System Request Key Hacks
 Documentation for sysrq.c
-Last update: 2007-MAR-14
+Last update: 2007-AUG-04
 
 *  What is the magic SysRq key?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -78,7 +78,7 @@ On all -  write a character to /proc/sysrq-trigger.  e.g.:
 'g'     - Used by kgdb on ppc and sh platforms.
 
 'h'     - Will display help (actually any other key than those listed
-          above will display help. but 'h' is easy to remember :-)
+          here will display help. but 'h' is easy to remember :-)
 
 'i'     - Send a SIGKILL to all processes, except for init.
 
diff --git a/Documentation/thinkpad-acpi.txt b/Documentation/thinkpad-acpi.txt
index 6711fbcf4080..eb2f5986e1eb 100644
--- a/Documentation/thinkpad-acpi.txt
+++ b/Documentation/thinkpad-acpi.txt
@@ -105,10 +105,10 @@ The version of thinkpad-acpi's sysfs interface is exported by the driver
 as a driver attribute (see below).
 
 Sysfs driver attributes are on the driver's sysfs attribute space,
-for 2.6.20 this is /sys/bus/platform/drivers/thinkpad-acpi/.
+for 2.6.20 this is /sys/bus/platform/drivers/thinkpad_acpi/.
 
 Sysfs device attributes are on the driver's sysfs attribute space,
-for 2.6.20 this is /sys/devices/platform/thinkpad-acpi/.
+for 2.6.20 this is /sys/devices/platform/thinkpad_acpi/.
 
 Driver version
 --------------
diff --git a/MAINTAINERS b/MAINTAINERS
index e65e96a14bec..371fe67a4eef 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -97,6 +97,12 @@ M:	philb@gnu.org
 L:      netdev@vger.kernel.org
 S:      Maintained
 
+3C59X NETWORK DRIVER
+P:      Steffen Klassert
+M:      klassert@mathematik.tu-chemnitz.de
+L:      netdev@vger.kernel.org
+S:      Maintained
+
 3CR990 NETWORK DRIVER
 P:      David Dillow
 M:      dave@thedillows.org
@@ -612,6 +618,15 @@ W:	http://sourceforge.net/projects/acpi4asus
 W:      http://xf.iksaif.net/acpi4asus
 S:      Maintained
 
+ASYNCHRONOUS TRANSFERS/TRANSFORMS API
+P:      Dan Williams
+M:      dan.j.williams@intel.com
+P:      Shannon Nelson
+M:      shannon.nelson@intel.com
+L:      linux-kernel@vger.kernel.org
+W:      http://sourceforge.net/projects/xscaleiop
+S:      Supported
+
 ATA OVER ETHERNET DRIVER
 P:      Ed L. Cashin
 M:      ecashin@coraid.com
@@ -664,7 +679,7 @@ S:	Maintained
 AUDIT SUBSYSTEM
 P:      David Woodhouse
 M:      dwmw2@infradead.org
-L:      linux-audit@redhat.com
+L:      linux-audit@redhat.com (subscribers-only)
 W:      http://people.redhat.com/sgrubb/audit/
 T:      git kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6.git
 S:      Maintained
@@ -994,7 +1009,7 @@ P:	Steve French
 M:      sfrench@samba.org
 L:      linux-cifs-client@lists.samba.org
 L:      samba-technical@lists.samba.org
-W:      http://us1.samba.org/samba/Linux_CIFS_client.html
+W:      http://linux-cifs.samba.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/sfrench/cifs-2.6.git
 S:      Supported
 
@@ -1277,11 +1292,13 @@ M:	tori@unhappy.mine.nu
 L:      netdev@vger.kernel.org
 S:      Maintained
 
-DMA GENERIC MEMCPY SUBSYSTEM
+DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 P:      Shannon Nelson
 M:      shannon.nelson@intel.com
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-kernel@vger.kernel.org
-S:      Maintained
+S:      Supported
 
 DME1737 HARDWARE MONITOR DRIVER
 P:      Juerg Haefliger
@@ -1958,6 +1975,12 @@ M:	shannon.nelson@intel.com
 L:      linux-kernel@vger.kernel.org
 S:      Supported
 
+INTEL IOP-ADMA DMA DRIVER
+P:      Dan Williams
+M:      dan.j.williams@intel.com
+L:      linux-kernel@vger.kernel.org
+S:      Supported
+
 INTEL IXP4XX RANDOM NUMBER GENERATOR SUPPORT
 P:      Deepak Saxena
 M:      dsaxena@plexity.net
diff --git a/Makefile b/Makefile
index 91759a60d2a3..f3229a4945bf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 23
-EXTRAVERSION =-rc2
+EXTRAVERSION =-rc3
 NAME = Holy Dancing Manatees, Batman!
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index 1d3c1398c428..52c91ccc1648 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -271,6 +271,19 @@ titan_dispatch_irqs(u64 mask)
  * Titan Family
  */
 static void __init
+titan_request_irq(unsigned int irq, irq_handler_t handler,
+                  unsigned long irqflags, const char *devname,
+                  void *dev_id)
+{
+        int err;
+        err = request_irq(irq, handler, irqflags, devname, dev_id);
+        if (err) {
+                printk("titan_request_irq for IRQ %d returned %d; ignoring\n",
+                       irq, err);
+        }
+}
+
+static void __init
 titan_late_init(void)
 {
         /*
@@ -278,15 +291,15 @@ titan_late_init(void)
          * all reported to the kernel as machine checks, so the handler
          * is a nop so it can be called to count the individual events.
          */
-        request_irq(63+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(63+16, titan_intr_nop, IRQF_DISABLED,
                     "CChip Error", NULL);
-        request_irq(62+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(62+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 0 H_Error", NULL);
-        request_irq(61+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(61+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 1 H_Error", NULL);
-        request_irq(60+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(60+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 0 C_Error", NULL);
-        request_irq(59+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(59+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 1 C_Error", NULL);
 
         /* 
@@ -345,9 +358,9 @@ privateer_init_pci(void)
          * Hook a couple of extra err interrupts that the
          * common titan code won't.
          */
-        request_irq(53+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(53+16, titan_intr_nop, IRQF_DISABLED,
                     "NMI", NULL);
-        request_irq(50+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(50+16, titan_intr_nop, IRQF_DISABLED,
                     "Temperature Warning", NULL);
 
         /*
diff --git a/arch/avr32/boards/atngw100/setup.c b/arch/avr32/boards/atngw100/setup.c
index 2edcecdea8bd..ef801563bbf5 100644
--- a/arch/avr32/boards/atngw100/setup.c
+++ b/arch/avr32/boards/atngw100/setup.c
@@ -9,6 +9,7 @@
  */
 #include <linux/clk.h>
 #include <linux/etherdevice.h>
+#include <linux/i2c-gpio.h>
 #include <linux/init.h>
 #include <linux/linkage.h>
 #include <linux/platform_device.h>
@@ -123,6 +124,19 @@ static struct platform_device ngw_gpio_leds = {
         }
 };
 
+static struct i2c_gpio_platform_data i2c_gpio_data = {
+        .sda_pin        = GPIO_PIN_PA(6),
+        .scl_pin        = GPIO_PIN_PA(7),
+};
+
+static struct platform_device i2c_gpio_device = {
+        .name           = "i2c-gpio",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &i2c_gpio_data,
+        },
+};
+
 static int __init atngw100_init(void)
 {
         unsigned        i;
@@ -147,6 +161,10 @@ static int __init atngw100_init(void)
         }
         platform_device_register(&ngw_gpio_leds);
 
+        at32_select_gpio(i2c_gpio_data.sda_pin, 0);
+        at32_select_gpio(i2c_gpio_data.scl_pin, 0);
+        platform_device_register(&i2c_gpio_device);
+
         return 0;
 }
 postcore_initcall(atngw100_init);
diff --git a/arch/avr32/boards/atstk1000/Kconfig b/arch/avr32/boards/atstk1000/Kconfig
index 71bc7d364fb7..718578f64069 100644
--- a/arch/avr32/boards/atstk1000/Kconfig
+++ b/arch/avr32/boards/atstk1000/Kconfig
@@ -50,4 +50,30 @@ config BOARD_ATSTK1002_SPI1
           GPIO lines and accessed through the J1 jumper block.  Say "y"
           here to configure that SPI controller.
 
+config BOARD_ATSTK1002_J2_LED
+        bool
+        default BOARD_ATSTK1002_J2_LED8 || BOARD_ATSTK1002_J2_RGB
+
+choice
+        prompt "LEDs connected to J2:"
+        depends on LEDS_GPIO && !BOARD_ATSTK1002_SW4_CUSTOM
+        optional
+        help
+          Select this if you have jumpered the J2 jumper block to the
+          LED0..LED7 amber leds, or to the RGB leds, using a ten-pin
+          IDC cable.  A default "heartbeat" trigger is provided, but
+          you can of course override this.
+
+config BOARD_ATSTK1002_J2_LED8
+        bool "LED0..LED7"
+        help
+          Select this if J2 is jumpered to LED0..LED7 amber leds.
+
+config BOARD_ATSTK1002_J2_RGB
+        bool "RGB leds"
+        help
+          Select this if J2 is jumpered to the RGB leds.
+
+endchoice
+
 endif   # stk 1002
diff --git a/arch/avr32/boards/atstk1000/atstk1002.c b/arch/avr32/boards/atstk1000/atstk1002.c
index cb93eabb9c6c..c9981b731efa 100644
--- a/arch/avr32/boards/atstk1000/atstk1002.c
+++ b/arch/avr32/boards/atstk1000/atstk1002.c
@@ -11,6 +11,7 @@
 #include <linux/etherdevice.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/leds.h>
 #include <linux/platform_device.h>
 #include <linux/string.h>
 #include <linux/types.h>
@@ -120,6 +121,65 @@ static void __init set_hw_addr(struct platform_device *pdev)
         clk_put(pclk);
 }
 
+#ifdef CONFIG_BOARD_ATSTK1002_J2_LED
+
+static struct gpio_led stk_j2_led[] = {
+#ifdef CONFIG_BOARD_ATSTK1002_J2_LED8
+#define LEDSTRING "J2 jumpered to LED8"
+        { .name = "led0:amber", .gpio = GPIO_PIN_PB( 8), },
+        { .name = "led1:amber", .gpio = GPIO_PIN_PB( 9), },
+        { .name = "led2:amber", .gpio = GPIO_PIN_PB(10), },
+        { .name = "led3:amber", .gpio = GPIO_PIN_PB(13), },
+        { .name = "led4:amber", .gpio = GPIO_PIN_PB(14), },
+        { .name = "led5:amber", .gpio = GPIO_PIN_PB(15), },
+        { .name = "led6:amber", .gpio = GPIO_PIN_PB(16), },
+        { .name = "led7:amber", .gpio = GPIO_PIN_PB(30),
+                        .default_trigger = "heartbeat", },
+#else   /* RGB */
+#define LEDSTRING "J2 jumpered to RGB LEDs"
+        { .name = "r1:red",     .gpio = GPIO_PIN_PB( 8), },
+        { .name = "g1:green",   .gpio = GPIO_PIN_PB(10), },
+        { .name = "b1:blue",    .gpio = GPIO_PIN_PB(14), },
+
+        { .name = "r2:red",     .gpio = GPIO_PIN_PB( 9),
+                        .default_trigger = "heartbeat", },
+        { .name = "g2:green",   .gpio = GPIO_PIN_PB(13), },
+        { .name = "b2:blue",    .gpio = GPIO_PIN_PB(15),
+                        .default_trigger = "heartbeat", },
+        /* PB16, PB30 unused */
+#endif
+};
+
+static struct gpio_led_platform_data stk_j2_led_data = {
+        .num_leds       = ARRAY_SIZE(stk_j2_led),
+        .leds           = stk_j2_led,
+};
+
+static struct platform_device stk_j2_led_dev = {
+        .name           = "leds-gpio",
+        .id             = 2,    /* gpio block J2 */
+        .dev            = {
+                .platform_data  = &stk_j2_led_data,
+        },
+};
+
+static void setup_j2_leds(void)
+{
+        unsigned        i;
+
+        for (i = 0; i < ARRAY_SIZE(stk_j2_led); i++)
+                at32_select_gpio(stk_j2_led[i].gpio, AT32_GPIOF_OUTPUT);
+
+        printk("STK1002: " LEDSTRING "\n");
+        platform_device_register(&stk_j2_led_dev);
+}
+
+#else
+static void setup_j2_leds(void)
+{
+}
+#endif
+
 void __init setup_board(void)
 {
 #ifdef  CONFIG_BOARD_ATSTK1002_SW2_CUSTOM
@@ -185,6 +245,8 @@ static int __init atstk1002_init(void)
         at32_add_device_ssc(0, ATMEL_SSC_TX);
 #endif
 
+        setup_j2_leds();
+
         return 0;
 }
 postcore_initcall(atstk1002_init);
diff --git a/arch/blackfin/kernel/init_task.c b/arch/blackfin/kernel/init_task.c
index b45188f8512e..673c860ffc23 100644
--- a/arch/blackfin/kernel/init_task.c
+++ b/arch/blackfin/kernel/init_task.c
@@ -31,6 +31,7 @@
 #include <linux/module.h>
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/fs.h>
 
 static struct fs_struct init_fs = INIT_FS;
 static struct files_struct init_files = INIT_FILES;
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 5a51dd6ab280..6a7aefe48346 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -33,6 +33,8 @@
 #include <linux/user.h>
 #include <linux/a.out.h>
 #include <linux/uaccess.h>
+#include <linux/fs.h>
+#include <linux/err.h>
 
 #include <asm/blackfin.h>
 #include <asm/fixed_code.h>
diff --git a/arch/blackfin/kernel/sys_bfin.c b/arch/blackfin/kernel/sys_bfin.c
index f5e1ae3d1705..abcd14817d0e 100644
--- a/arch/blackfin/kernel/sys_bfin.c
+++ b/arch/blackfin/kernel/sys_bfin.c
@@ -37,6 +37,7 @@
 #include <linux/syscalls.h>
 #include <linux/mman.h>
 #include <linux/file.h>
+#include <linux/fs.h>
 #include <linux/uaccess.h>
 #include <linux/ipc.h>
 #include <linux/unistd.h>
diff --git a/arch/blackfin/kernel/traps.c b/arch/blackfin/kernel/traps.c
index 8766bd612b47..792a8416fe10 100644
--- a/arch/blackfin/kernel/traps.c
+++ b/arch/blackfin/kernel/traps.c
@@ -31,6 +31,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/kallsyms.h>
+#include <linux/fs.h>
 #include <asm/traps.h>
 #include <asm/cacheflush.h>
 #include <asm/blackfin.h>
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index 4b41248b61ad..6b4d026a00a1 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -180,8 +180,6 @@ source "drivers/isdn/Kconfig"
 
 source "drivers/telephony/Kconfig"
 
-source "drivers/cdrom/Kconfig"
-
 #
 # input before char - char/joystick depends on it. As does USB.
 #
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index 275673c192aa..1e74f3c5cee2 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -1496,6 +1496,7 @@ sys_call_table:
         .long sys_signalfd
         .long sys_timerfd
         .long sys_eventfd
+        .long sys_fallocate
 
 
 syscall_table_size = (. - sys_call_table)
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index f9524933258a..f16a46e8849c 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -1228,6 +1228,11 @@ menuconfig INSTRUMENTATION
         bool "Instrumentation Support"
         depends on EXPERIMENTAL
         default y
+        ---help---
+          Say Y here to get to see options related to performance measurement,
+          debugging, and testing. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if INSTRUMENTATION
 
diff --git a/arch/i386/Makefile b/arch/i386/Makefile
index 01f0ff0daaf4..52b932478c6d 100644
--- a/arch/i386/Makefile
+++ b/arch/i386/Makefile
@@ -51,8 +51,8 @@ cflags-y += -maccumulate-outgoing-args
 CFLAGS                          += $(shell if [ $(call cc-version) -lt 0400 ] ; then echo $(call cc-option,-fno-unit-at-a-time); fi ;)
 
 # do binutils support CFI?
-cflags-y += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
-AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
+cflags-y += $(call as-instr,.cfi_startproc\n.cfi_rel_offset esp${comma}0\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
+AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_rel_offset esp${comma}0\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
 
 # is .cfi_signal_frame supported too?
 cflags-y += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
diff --git a/arch/i386/boot/edd.c b/arch/i386/boot/edd.c
index 658834d9f92a..82b5c846a194 100644
--- a/arch/i386/boot/edd.c
+++ b/arch/i386/boot/edd.c
@@ -19,40 +19,12 @@
 
 #if defined(CONFIG_EDD) || defined(CONFIG_EDD_MODULE)
 
-struct edd_dapa {
-        u8      pkt_size;
-        u8      rsvd;
-        u16     sector_cnt;
-        u16     buf_off, buf_seg;
-        u64     lba;
-        u64     buf_lin_addr;
-};
-
 /*
  * Read the MBR (first sector) from a specific device.
  */
 static int read_mbr(u8 devno, void *buf)
 {
-        struct edd_dapa dapa;
-        u16 ax, bx, cx, dx, si;
-
-        memset(&dapa, 0, sizeof dapa);
-        dapa.pkt_size = sizeof(dapa);
-        dapa.sector_cnt = 1;
-        dapa.buf_off = (size_t)buf;
-        dapa.buf_seg = ds();
-        /* dapa.lba = 0; */
-
-        ax = 0x4200;            /* Extended Read */
-        si = (size_t)&dapa;
-        dx = devno;
-        asm("pushfl; stc; int $0x13; setc %%al; popfl"
-            : "+a" (ax), "+S" (si), "+d" (dx)
-            : "m" (dapa)
-            : "ebx", "ecx", "edi", "memory");
-
-        if (!(u8)ax)
-                return 0;       /* OK */
+        u16 ax, bx, cx, dx;
 
         ax = 0x0201;            /* Legacy Read, one sector */
         cx = 0x0001;            /* Sector 0-0-1 */
@@ -65,11 +37,10 @@ static int read_mbr(u8 devno, void *buf)
         return -(u8)ax;         /* 0 or -1 */
 }
 
-static u32 read_mbr_sig(u8 devno, struct edd_info *ei)
+static u32 read_mbr_sig(u8 devno, struct edd_info *ei, u32 *mbrsig)
 {
         int sector_size;
         char *mbrbuf_ptr, *mbrbuf_end;
-        u32 mbrsig;
         u32 buf_base, mbr_base;
         extern char _end[];
 
@@ -85,15 +56,15 @@ static u32 read_mbr_sig(u8 devno, struct edd_info *ei)
 
         /* Make sure we actually have space on the heap... */
         if (!(boot_params.hdr.loadflags & CAN_USE_HEAP))
-                return 0;
+                return -1;
         if (mbrbuf_end > (char *)(size_t)boot_params.hdr.heap_end_ptr)
-                return 0;
+                return -1;
 
         if (read_mbr(devno, mbrbuf_ptr))
-                return 0;
+                return -1;
 
-        mbrsig = *(u32 *)&mbrbuf_ptr[EDD_MBR_SIG_OFFSET];
-        return mbrsig;
+        *mbrsig = *(u32 *)&mbrbuf_ptr[EDD_MBR_SIG_OFFSET];
+        return 0;
 }
 
 static int get_edd_info(u8 devno, struct edd_info *ei)
@@ -160,6 +131,7 @@ void query_edd(void)
         int do_edd = 1;
         int devno;
         struct edd_info ei, *edp;
+        u32 *mbrptr;
 
         if (cmdline_find_option("edd", eddarg, sizeof eddarg) > 0) {
                 if (!strcmp(eddarg, "skipmbr") || !strcmp(eddarg, "skip"))
@@ -168,7 +140,8 @@ void query_edd(void)
                         do_edd = 0;
         }
 
-        edp = (struct edd_info *)boot_params.eddbuf;
+        edp    = boot_params.eddbuf;
+        mbrptr = boot_params.edd_mbr_sig_buffer;
 
         if (!do_edd)
                 return;
@@ -186,11 +159,8 @@ void query_edd(void)
                         boot_params.eddbuf_entries++;
                 }
 
-                if (do_mbr) {
-                        u32 mbr_sig;
-                        mbr_sig = read_mbr_sig(devno, &ei);
-                        boot_params.edd_mbr_sig_buffer[devno-0x80] = mbr_sig;
-                }
+                if (do_mbr && !read_mbr_sig(devno, &ei, mbrptr++))
+                        boot_params.edd_mbr_sig_buf_entries = devno-0x80+1;
         }
 }
 
diff --git a/arch/i386/boot/video.c b/arch/i386/boot/video.c
index 958130ef0042..693f20d3102e 100644
--- a/arch/i386/boot/video.c
+++ b/arch/i386/boot/video.c
@@ -61,7 +61,7 @@ static void store_video_mode(void)
 
         /* Not all BIOSes are clean with respect to the top bit */
         boot_params.screen_info.orig_video_mode = ax & 0x7f;
-        boot_params.screen_info.orig_video_page = page;
+        boot_params.screen_info.orig_video_page = page >> 8;
 }
 
 /*
diff --git a/arch/i386/kernel/alternative.c b/arch/i386/kernel/alternative.c
index c85598acb8fd..1b66d5c70eaf 100644
--- a/arch/i386/kernel/alternative.c
+++ b/arch/i386/kernel/alternative.c
@@ -11,6 +11,8 @@
 #include <asm/mce.h>
 #include <asm/nmi.h>
 
+#define MAX_PATCH_LEN (255-1)
+
 #ifdef CONFIG_HOTPLUG_CPU
 static int smp_alt_once;
 
@@ -148,7 +150,8 @@ static unsigned char** find_nop_table(void)
 
 #endif /* CONFIG_X86_64 */
 
-static void nop_out(void *insns, unsigned int len)
+/* Use this to add nops to a buffer, then text_poke the whole buffer. */
+static void add_nops(void *insns, unsigned int len)
 {
         unsigned char **noptable = find_nop_table();
 
@@ -156,7 +159,7 @@ static void nop_out(void *insns, unsigned int len)
                 unsigned int noplen = len;
                 if (noplen > ASM_NOP_MAX)
                         noplen = ASM_NOP_MAX;
-                text_poke(insns, noptable[noplen], noplen);
+                memcpy(insns, noptable[noplen], noplen);
                 insns += noplen;
                 len -= noplen;
         }
@@ -174,15 +177,15 @@ extern u8 *__smp_locks[], *__smp_locks_end[];
 void apply_alternatives(struct alt_instr *start, struct alt_instr *end)
 {
         struct alt_instr *a;
-        u8 *instr;
-        int diff;
+        char insnbuf[MAX_PATCH_LEN];
 
         DPRINTK("%s: alt table %p -> %p\n", __FUNCTION__, start, end);
         for (a = start; a < end; a++) {
+                u8 *instr = a->instr;
                 BUG_ON(a->replacementlen > a->instrlen);
+                BUG_ON(a->instrlen > sizeof(insnbuf));
                 if (!boot_cpu_has(a->cpuid))
                         continue;
-                instr = a->instr;
 #ifdef CONFIG_X86_64
                 /* vsyscall code is not mapped yet. resolve it manually. */
                 if (instr >= (u8 *)VSYSCALL_START && instr < (u8*)VSYSCALL_END) {
@@ -191,9 +194,10 @@ void apply_alternatives(struct alt_instr *start, struct alt_instr *end)
                                 __FUNCTION__, a->instr, instr);
                 }
 #endif
-                memcpy(instr, a->replacement, a->replacementlen);
-                diff = a->instrlen - a->replacementlen;
-                nop_out(instr + a->replacementlen, diff);
+                memcpy(insnbuf, a->replacement, a->replacementlen);
+                add_nops(insnbuf + a->replacementlen,
+                         a->instrlen - a->replacementlen);
+                text_poke(instr, insnbuf, a->instrlen);
         }
 }
 
@@ -215,16 +219,18 @@ static void alternatives_smp_lock(u8 **start, u8 **end, u8 *text, u8 *text_end)
 static void alternatives_smp_unlock(u8 **start, u8 **end, u8 *text, u8 *text_end)
 {
         u8 **ptr;
+        char insn[1];
 
         if (noreplace_smp)
                 return;
 
+        add_nops(insn, 1);
         for (ptr = start; ptr < end; ptr++) {
                 if (*ptr < text)
                         continue;
                 if (*ptr > text_end)
                         continue;
-                nop_out(*ptr, 1);
+                text_poke(*ptr, insn, 1);
         };
 }
 
@@ -351,6 +357,7 @@ void apply_paravirt(struct paravirt_patch_site *start,
                     struct paravirt_patch_site *end)
 {
         struct paravirt_patch_site *p;
+        char insnbuf[MAX_PATCH_LEN];
 
         if (noreplace_paravirt)
                 return;
@@ -358,13 +365,15 @@ void apply_paravirt(struct paravirt_patch_site *start,
         for (p = start; p < end; p++) {
                 unsigned int used;
 
-                used = paravirt_ops.patch(p->instrtype, p->clobbers, p->instr,
-                                          p->len);
+                BUG_ON(p->len > MAX_PATCH_LEN);
+                used = paravirt_ops.patch(p->instrtype, p->clobbers, insnbuf,
+                                          (unsigned long)p->instr, p->len);
 
                 BUG_ON(used > p->len);
 
                 /* Pad the rest with nops */
-                nop_out(p->instr + used, p->len - used);
+                add_nops(insnbuf + used, p->len - used);
+                text_poke(p->instr, insnbuf, p->len);
         }
 }
 extern struct paravirt_patch_site __start_parainstructions[],
@@ -379,7 +388,7 @@ void __init alternative_instructions(void)
            that might execute the to be patched code.
            Other CPUs are not running. */
         stop_nmi();
-#ifdef CONFIG_MCE
+#ifdef CONFIG_X86_MCE
         stop_mce();
 #endif
 
@@ -417,7 +426,7 @@ void __init alternative_instructions(void)
         local_irq_restore(flags);
 
         restart_nmi();
-#ifdef CONFIG_MCE
+#ifdef CONFIG_X86_MCE
         restart_mce();
 #endif
 }
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index bfc6cb7df7e7..3d67ae18d762 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -61,8 +61,9 @@ static int enable_local_apic __initdata = 0;
 
 /* Local APIC timer verification ok */
 static int local_apic_timer_verify_ok;
-/* Disable local APIC timer from the kernel commandline or via dmi quirk */
-static int local_apic_timer_disabled;
+/* Disable local APIC timer from the kernel commandline or via dmi quirk
+   or using CPU MSR check */
+int local_apic_timer_disabled;
 /* Local APIC timer works in C2 */
 int local_apic_timer_c2_ok;
 EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
@@ -370,12 +371,9 @@ void __init setup_boot_APIC_clock(void)
         long delta, deltapm;
         int pm_referenced = 0;
 
-        if (boot_cpu_has(X86_FEATURE_LAPIC_TIMER_BROKEN))
-                local_apic_timer_disabled = 1;
-
         /*
          * The local apic timer can be disabled via the kernel
-         * commandline or from the test above. Register the lapic
+         * commandline or from the CPU detection code. Register the lapic
          * timer as a dummy clock event source on SMP systems, so the
          * broadcast mechanism is used. On UP systems simply ignore it.
          */
@@ -1087,7 +1085,7 @@ static int __init detect_init_APIC (void)
         if (l & MSR_IA32_APICBASE_ENABLE)
                 mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
 
-        if (nmi_watchdog != NMI_NONE)
+        if (nmi_watchdog != NMI_NONE && nmi_watchdog != NMI_DISABLED)
                 nmi_watchdog = NMI_LOCAL_APIC;
 
         printk(KERN_INFO "Found and enabled local APIC!\n");
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index c7ba455d5ac7..dcf6bbb1c7c0 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -3,6 +3,7 @@
 #include <linux/mm.h>
 #include <asm/io.h>
 #include <asm/processor.h>
+#include <asm/apic.h>
 
 #include "cpu.h"
 
@@ -22,6 +23,7 @@
 extern void vide(void);
 __asm__(".align 4\nvide: ret");
 
+#ifdef CONFIG_X86_LOCAL_APIC
 #define ENABLE_C1E_MASK         0x18000000
 #define CPUID_PROCESSOR_SIGNATURE       1
 #define CPUID_XFAM              0x0ff00000
@@ -52,6 +54,7 @@ static __cpuinit int amd_apic_timer_broken(void)
         }
         return 0;
 }
+#endif
 
 int force_mwait __cpuinitdata;
 
@@ -282,8 +285,10 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                         num_cache_leaves = 3;
         }
 
+#ifdef CONFIG_X86_LOCAL_APIC
         if (amd_apic_timer_broken())
-                set_bit(X86_FEATURE_LAPIC_TIMER_BROKEN, c->x86_capability);
+                local_apic_timer_disabled = 1;
+#endif
 
         if (c->x86 == 0x10 && !force_mwait)
                 clear_bit(X86_FEATURE_MWAIT, c->x86_capability);
diff --git a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
index 32d04b083e38..705e13a30781 100644
--- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -68,7 +68,8 @@ struct acpi_cpufreq_data {
 };
 
 static struct acpi_cpufreq_data *drv_data[NR_CPUS];
-static struct acpi_processor_performance *acpi_perf_data[NR_CPUS];
+/* acpi_perf_data is a pointer to percpu data. */
+static struct acpi_processor_performance *acpi_perf_data;
 
 static struct cpufreq_driver acpi_cpufreq_driver;
 
@@ -508,24 +509,14 @@ acpi_cpufreq_guess_freq(struct acpi_cpufreq_data *data, unsigned int cpu)
  * do _PDC and _PSD and find out the processor dependency for the
  * actual init that will happen later...
  */
-static int acpi_cpufreq_early_init(void)
+static int __init acpi_cpufreq_early_init(void)
 {
-        struct acpi_processor_performance *data;
-        unsigned int i, j;
-
         dprintk("acpi_cpufreq_early_init\n");
 
-        for_each_possible_cpu(i) {
-                data = kzalloc(sizeof(struct acpi_processor_performance),
-                               GFP_KERNEL);
-                if (!data) {
-                        for_each_possible_cpu(j) {
-                                kfree(acpi_perf_data[j]);
-                                acpi_perf_data[j] = NULL;
-                        }
-                        return -ENOMEM;
-                }
-                acpi_perf_data[i] = data;
+        acpi_perf_data = alloc_percpu(struct acpi_processor_performance);
+        if (!acpi_perf_data) {
+                dprintk("Memory allocation error for acpi_perf_data.\n");
+                return -ENOMEM;
         }
 
         /* Do initialization in ACPI core */
@@ -574,14 +565,11 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
 
         dprintk("acpi_cpufreq_cpu_init\n");
 
-        if (!acpi_perf_data[cpu])
-                return -ENODEV;
-
         data = kzalloc(sizeof(struct acpi_cpufreq_data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
-        data->acpi_data = acpi_perf_data[cpu];
+        data->acpi_data = percpu_ptr(acpi_perf_data, cpu);
         drv_data[cpu] = data;
 
         if (cpu_has(c, X86_FEATURE_CONSTANT_TSC))
@@ -778,24 +766,25 @@ static struct cpufreq_driver acpi_cpufreq_driver = {
 
 static int __init acpi_cpufreq_init(void)
 {
+        int ret;
+
         dprintk("acpi_cpufreq_init\n");
 
-        acpi_cpufreq_early_init();
+        ret = acpi_cpufreq_early_init();
+        if (ret)
+                return ret;
 
         return cpufreq_register_driver(&acpi_cpufreq_driver);
 }
 
 static void __exit acpi_cpufreq_exit(void)
 {
-        unsigned int i;
         dprintk("acpi_cpufreq_exit\n");
 
         cpufreq_unregister_driver(&acpi_cpufreq_driver);
 
-        for_each_possible_cpu(i) {
-                kfree(acpi_perf_data[i]);
-                acpi_perf_data[i] = NULL;
-        }
+        free_percpu(acpi_perf_data);
+
         return;
 }
 
diff --git a/arch/i386/kernel/doublefault.c b/arch/i386/kernel/doublefault.c
index 265c5597efb0..40978af630e7 100644
--- a/arch/i386/kernel/doublefault.c
+++ b/arch/i386/kernel/doublefault.c
@@ -13,7 +13,7 @@
 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
 #define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
 
-#define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + 0x1000000)
+#define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
 
 static void doublefault_fn(void)
 {
@@ -23,23 +23,23 @@ static void doublefault_fn(void)
         store_gdt(&gdt_desc);
         gdt = gdt_desc.address;
 
-        printk("double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
+        printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
 
         if (ptr_ok(gdt)) {
                 gdt += GDT_ENTRY_TSS << 3;
                 tss = *(u16 *)(gdt+2);
                 tss += *(u8 *)(gdt+4) << 16;
                 tss += *(u8 *)(gdt+7) << 24;
-                printk("double fault, tss at %08lx\n", tss);
+                printk(KERN_EMERG "double fault, tss at %08lx\n", tss);
 
                 if (ptr_ok(tss)) {
                         struct i386_hw_tss *t = (struct i386_hw_tss *)tss;
 
-                        printk("eip = %08lx, esp = %08lx\n", t->eip, t->esp);
+                        printk(KERN_EMERG "eip = %08lx, esp = %08lx\n", t->eip, t->esp);
 
-                        printk("eax = %08lx, ebx = %08lx, ecx = %08lx, edx = %08lx\n",
+                        printk(KERN_EMERG "eax = %08lx, ebx = %08lx, ecx = %08lx, edx = %08lx\n",
                                 t->eax, t->ebx, t->ecx, t->edx);
-                        printk("esi = %08lx, edi = %08lx\n",
+                        printk(KERN_EMERG "esi = %08lx, edi = %08lx\n",
                                 t->esi, t->edi);
                 }
         }
@@ -63,6 +63,7 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
                 .cs             = __KERNEL_CS,
                 .ss             = __KERNEL_DS,
                 .ds             = __USER_DS,
+                .fs             = __KERNEL_PERCPU,
 
                 .__cr3          = __pa(swapper_pg_dir)
         }
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index 7c52b222207e..8f0382161c91 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -162,9 +162,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
  * which will be freed later
  */
 
-#ifdef CONFIG_HOTPLUG_CPU
-.section .text,"ax",@progbits
-#else
+#ifndef CONFIG_HOTPLUG_CPU
 .section .init.text,"ax",@progbits
 #endif
 
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index 893df8280756..4b8a8da4b2e0 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -1256,12 +1256,15 @@ static struct irq_chip ioapic_chip;
 static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
 {
         if ((trigger == IOAPIC_AUTO && IO_APIC_irq_trigger(irq)) ||
-                        trigger == IOAPIC_LEVEL)
+            trigger == IOAPIC_LEVEL) {
+                irq_desc[irq].status |= IRQ_LEVEL;
                 set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                          handle_fasteoi_irq, "fasteoi");
-        else
+        } else {
+                irq_desc[irq].status &= ~IRQ_LEVEL;
                 set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                          handle_edge_irq, "edge");
+        }
         set_intr_gate(vector, interrupt[irq]);
 }
 
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 99beac7f96ce..8c1c965eb2a8 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -77,7 +77,7 @@ static int __init check_nmi_watchdog(void)
         unsigned int *prev_nmi_count;
         int cpu;
 
-        if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DEFAULT))
+        if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DISABLED))
                 return 0;
 
         if (!atomic_read(&nmi_active))
@@ -424,7 +424,7 @@ int proc_nmi_enabled(struct ctl_table *table, int write, struct file *file,
         if (!!old_state == !!nmi_watchdog_enabled)
                 return 0;
 
-        if (atomic_read(&nmi_active) < 0) {
+        if (atomic_read(&nmi_active) < 0 || nmi_watchdog == NMI_DISABLED) {
                 printk( KERN_WARNING "NMI watchdog is permanently disabled\n");
                 return -EIO;
         }
diff --git a/arch/i386/kernel/paravirt.c b/arch/i386/kernel/paravirt.c
index ea962c0667d5..739cfb207dd7 100644
--- a/arch/i386/kernel/paravirt.c
+++ b/arch/i386/kernel/paravirt.c
@@ -69,7 +69,8 @@ DEF_NATIVE(read_tsc, "rdtsc");
 
 DEF_NATIVE(ud2a, "ud2a");
 
-static unsigned native_patch(u8 type, u16 clobbers, void *insns, unsigned len)
+static unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+                             unsigned long addr, unsigned len)
 {
         const unsigned char *start, *end;
         unsigned ret;
@@ -90,7 +91,7 @@ static unsigned native_patch(u8 type, u16 clobbers, void *insns, unsigned len)
 #undef SITE
 
         patch_site:
-                ret = paravirt_patch_insns(insns, len, start, end);
+                ret = paravirt_patch_insns(ibuf, len, start, end);
                 break;
 
         case PARAVIRT_PATCH(make_pgd):
@@ -107,7 +108,7 @@ static unsigned native_patch(u8 type, u16 clobbers, void *insns, unsigned len)
                 break;
 
         default:
-                ret = paravirt_patch_default(type, clobbers, insns, len);
+                ret = paravirt_patch_default(type, clobbers, ibuf, addr, len);
                 break;
         }
 
@@ -129,68 +130,67 @@ struct branch {
         u32 delta;
 } __attribute__((packed));
 
-unsigned paravirt_patch_call(void *target, u16 tgt_clobbers,
-                             void *site, u16 site_clobbers,
+unsigned paravirt_patch_call(void *insnbuf,
+                             const void *target, u16 tgt_clobbers,
+                             unsigned long addr, u16 site_clobbers,
                              unsigned len)
 {
-        unsigned char *call = site;
-        unsigned long delta = (unsigned long)target - (unsigned long)(call+5);
-        struct branch b;
+        struct branch *b = insnbuf;
+        unsigned long delta = (unsigned long)target - (addr+5);
 
         if (tgt_clobbers & ~site_clobbers)
                 return len;     /* target would clobber too much for this site */
         if (len < 5)
                 return len;     /* call too long for patch site */
 
-        b.opcode = 0xe8; /* call */
-        b.delta = delta;
-        BUILD_BUG_ON(sizeof(b) != 5);
-        text_poke(call, (unsigned char *)&b, 5);
+        b->opcode = 0xe8; /* call */
+        b->delta = delta;
+        BUILD_BUG_ON(sizeof(*b) != 5);
 
         return 5;
 }
 
-unsigned paravirt_patch_jmp(void *target, void *site, unsigned len)
+unsigned paravirt_patch_jmp(const void *target, void *insnbuf,
+                            unsigned long addr, unsigned len)
 {
-        unsigned char *jmp = site;
-        unsigned long delta = (unsigned long)target - (unsigned long)(jmp+5);
-        struct branch b;
+        struct branch *b = insnbuf;
+        unsigned long delta = (unsigned long)target - (addr+5);
 
         if (len < 5)
                 return len;     /* call too long for patch site */
 
-        b.opcode = 0xe9;        /* jmp */
-        b.delta = delta;
-        text_poke(jmp, (unsigned char *)&b, 5);
+        b->opcode = 0xe9;       /* jmp */
+        b->delta = delta;
 
         return 5;
 }
 
-unsigned paravirt_patch_default(u8 type, u16 clobbers, void *site, unsigned len)
+unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
+                                unsigned long addr, unsigned len)
 {
         void *opfunc = *((void **)&paravirt_ops + type);
         unsigned ret;
 
         if (opfunc == NULL)
                 /* If there's no function, patch it with a ud2a (BUG) */
-                ret = paravirt_patch_insns(site, len, start_ud2a, end_ud2a);
+                ret = paravirt_patch_insns(insnbuf, len, start_ud2a, end_ud2a);
         else if (opfunc == paravirt_nop)
                 /* If the operation is a nop, then nop the callsite */
                 ret = paravirt_patch_nop();
         else if (type == PARAVIRT_PATCH(iret) ||
                  type == PARAVIRT_PATCH(irq_enable_sysexit))
                 /* If operation requires a jmp, then jmp */
-                ret = paravirt_patch_jmp(opfunc, site, len);
+                ret = paravirt_patch_jmp(opfunc, insnbuf, addr, len);
         else
                 /* Otherwise call the function; assume target could
                    clobber any caller-save reg */
-                ret = paravirt_patch_call(opfunc, CLBR_ANY,
-                                          site, clobbers, len);
+                ret = paravirt_patch_call(insnbuf, opfunc, CLBR_ANY,
+                                          addr, clobbers, len);
 
         return ret;
 }
 
-unsigned paravirt_patch_insns(void *site, unsigned len,
+unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
                               const char *start, const char *end)
 {
         unsigned insn_len = end - start;
@@ -198,7 +198,7 @@ unsigned paravirt_patch_insns(void *site, unsigned len,
         if (insn_len > len || start == NULL)
                 insn_len = len;
         else
-                memcpy(site, start, insn_len);
+                memcpy(insnbuf, start, insn_len);
 
         return insn_len;
 }
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index 72042bb7ec94..18673e0f193b 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -87,12 +87,14 @@ struct vmi_timer_ops vmi_timer_ops;
 #define IRQ_PATCH_INT_MASK 0
 #define IRQ_PATCH_DISABLE  5
 
-static inline void patch_offset(unsigned char *eip, unsigned char *dest)
+static inline void patch_offset(void *insnbuf,
+                                unsigned long eip, unsigned long dest)
 {
-        *(unsigned long *)(eip+1) = dest-eip-5;
+        *(unsigned long *)(insnbuf+1) = dest-eip-5;
 }
 
-static unsigned patch_internal(int call, unsigned len, void *insns)
+static unsigned patch_internal(int call, unsigned len, void *insnbuf,
+                               unsigned long eip)
 {
         u64 reloc;
         struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
@@ -100,14 +102,14 @@ static unsigned patch_internal(int call, unsigned len, void *insns)
         switch(rel->type) {
                 case VMI_RELOCATION_CALL_REL:
                         BUG_ON(len < 5);
-                        *(char *)insns = MNEM_CALL;
-                        patch_offset(insns, rel->eip);
+                        *(char *)insnbuf = MNEM_CALL;
+                        patch_offset(insnbuf, eip, (unsigned long)rel->eip);
                         return 5;
 
                 case VMI_RELOCATION_JUMP_REL:
                         BUG_ON(len < 5);
-                        *(char *)insns = MNEM_JMP;
-                        patch_offset(insns, rel->eip);
+                        *(char *)insnbuf = MNEM_JMP;
+                        patch_offset(insnbuf, eip, (unsigned long)rel->eip);
                         return 5;
 
                 case VMI_RELOCATION_NOP:
@@ -128,21 +130,26 @@ static unsigned patch_internal(int call, unsigned len, void *insns)
  * Apply patch if appropriate, return length of new instruction
  * sequence.  The callee does nop padding for us.
  */
-static unsigned vmi_patch(u8 type, u16 clobbers, void *insns, unsigned len)
+static unsigned vmi_patch(u8 type, u16 clobbers, void *insns,
+                          unsigned long eip, unsigned len)
 {
         switch (type) {
                 case PARAVIRT_PATCH(irq_disable):
-                        return patch_internal(VMI_CALL_DisableInterrupts, len, insns);
+                        return patch_internal(VMI_CALL_DisableInterrupts, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(irq_enable):
-                        return patch_internal(VMI_CALL_EnableInterrupts, len, insns);
+                        return patch_internal(VMI_CALL_EnableInterrupts, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(restore_fl):
-                        return patch_internal(VMI_CALL_SetInterruptMask, len, insns);
+                        return patch_internal(VMI_CALL_SetInterruptMask, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(save_fl):
-                        return patch_internal(VMI_CALL_GetInterruptMask, len, insns);
+                        return patch_internal(VMI_CALL_GetInterruptMask, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(iret):
-                        return patch_internal(VMI_CALL_IRET, len, insns);
+                        return patch_internal(VMI_CALL_IRET, len, insns, eip);
                 case PARAVIRT_PATCH(irq_enable_sysexit):
-                        return patch_internal(VMI_CALL_SYSEXIT, len, insns);
+                        return patch_internal(VMI_CALL_SYSEXIT, len, insns, eip);
                 default:
                         break;
         }
diff --git a/arch/i386/mm/pageattr.c b/arch/i386/mm/pageattr.c
index 8927222b3ab2..4241a74d16c8 100644
--- a/arch/i386/mm/pageattr.c
+++ b/arch/i386/mm/pageattr.c
@@ -82,7 +82,7 @@ static void flush_kernel_map(void *arg)
         struct page *p;
 
         /* High level code is not ready for clflush yet */
-        if (cpu_has_clflush) {
+        if (0 && cpu_has_clflush) {
                 list_for_each_entry (p, lh, lru)
                         cache_flush_page(p);
         } else if (boot_cpu_data.x86_model >= 4)
diff --git a/arch/i386/pci/common.c b/arch/i386/pci/common.c
index 85503deeda46..ebc6f3c66340 100644
--- a/arch/i386/pci/common.c
+++ b/arch/i386/pci/common.c
@@ -455,3 +455,26 @@ void pcibios_disable_device (struct pci_dev *dev)
         if (!dev->msi_enabled && pcibios_disable_irq)
                 pcibios_disable_irq(dev);
 }
+
+struct pci_bus *pci_scan_bus_with_sysdata(int busno)
+{
+        struct pci_bus *bus = NULL;
+        struct pci_sysdata *sd;
+
+        /*
+         * Allocate per-root-bus (not per bus) arch-specific data.
+         * TODO: leak; this memory is never freed.
+         * It's arguable whether it's worth the trouble to care.
+         */
+        sd = kzalloc(sizeof(*sd), GFP_KERNEL);
+        if (!sd) {
+                printk(KERN_ERR "PCI: OOM, skipping PCI bus %02x\n", busno);
+                return NULL;
+        }
+        sd->node = -1;
+        bus = pci_scan_bus(busno, &pci_root_ops, sd);
+        if (!bus)
+                kfree(sd);
+
+        return bus;
+}
diff --git a/arch/i386/pci/fixup.c b/arch/i386/pci/fixup.c
index e7306dbf6c42..c82cbf4c7226 100644
--- a/arch/i386/pci/fixup.c
+++ b/arch/i386/pci/fixup.c
@@ -25,9 +25,9 @@ static void __devinit pci_fixup_i450nx(struct pci_dev *d)
                 pci_read_config_byte(d, reg++, &subb);
                 DBG("i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno, suba, subb);
                 if (busno)
-                        pci_scan_bus(busno, &pci_root_ops, NULL);       /* Bus A */
+                        pci_scan_bus_with_sysdata(busno);       /* Bus A */
                 if (suba < subb)
-                        pci_scan_bus(suba+1, &pci_root_ops, NULL);      /* Bus B */
+                        pci_scan_bus_with_sysdata(suba+1);      /* Bus B */
         }
         pcibios_last_bus = -1;
 }
@@ -42,7 +42,7 @@ static void __devinit pci_fixup_i450gx(struct pci_dev *d)
         u8 busno;
         pci_read_config_byte(d, 0x4a, &busno);
         printk(KERN_INFO "PCI: i440KX/GX host bridge %s: secondary bus %02x\n", pci_name(d), busno);
-        pci_scan_bus(busno, &pci_root_ops, NULL);
+        pci_scan_bus_with_sysdata(busno);
         pcibios_last_bus = -1;
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82454GX, pci_fixup_i450gx);
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index f2cb942f8281..665db063a40a 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -138,8 +138,9 @@ static void __init pirq_peer_trick(void)
         for(i = 1; i < 256; i++) {
                 if (!busmap[i] || pci_find_bus(0, i))
                         continue;
-                if (pci_scan_bus(i, &pci_root_ops, NULL))
-                        printk(KERN_INFO "PCI: Discovered primary peer bus %02x [IRQ]\n", i);
+                if (pci_scan_bus_with_sysdata(i))
+                        printk(KERN_INFO "PCI: Discovered primary peer "
+                               "bus %02x [IRQ]\n", i);
         }
         pcibios_last_bus = -1;
 }
diff --git a/arch/i386/pci/legacy.c b/arch/i386/pci/legacy.c
index 149a9588c256..5565d7016b75 100644
--- a/arch/i386/pci/legacy.c
+++ b/arch/i386/pci/legacy.c
@@ -26,7 +26,7 @@ static void __devinit pcibios_fixup_peer_bridges(void)
                             l != 0x0000 && l != 0xffff) {
                                 DBG("Found device at %02x:%02x [%04x]\n", n, devfn, l);
                                 printk(KERN_INFO "PCI: Discovered peer bus %02x\n", n);
-                                pci_scan_bus(n, &pci_root_ops, NULL);
+                                pci_scan_bus_with_sysdata(n);
                                 break;
                         }
                 }
diff --git a/arch/i386/pci/mmconfig.c b/arch/i386/pci/mmconfig.c
index bb1afd9e589d..1bf5816d34c8 100644
--- a/arch/i386/pci/mmconfig.c
+++ b/arch/i386/pci/mmconfig.c
@@ -82,16 +82,15 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                *value = readb(mmcfg_virt_addr + reg);
+                *value = mmio_config_readb(mmcfg_virt_addr + reg);
                 break;
         case 2:
-                *value = readw(mmcfg_virt_addr + reg);
+                *value = mmio_config_readw(mmcfg_virt_addr + reg);
                 break;
         case 4:
-                *value = readl(mmcfg_virt_addr + reg);
+                *value = mmio_config_readl(mmcfg_virt_addr + reg);
                 break;
         }
-
         spin_unlock_irqrestore(&pci_config_lock, flags);
 
         return 0;
@@ -116,16 +115,15 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                writeb(value, mmcfg_virt_addr + reg);
+                mmio_config_writeb(mmcfg_virt_addr + reg, value);
                 break;
         case 2:
-                writew(value, mmcfg_virt_addr + reg);
+                mmio_config_writew(mmcfg_virt_addr + reg, value);
                 break;
         case 4:
-                writel(value, mmcfg_virt_addr + reg);
+                mmio_config_writel(mmcfg_virt_addr + reg, value);
                 break;
         }
-
         spin_unlock_irqrestore(&pci_config_lock, flags);
 
         return 0;
diff --git a/arch/i386/pci/numa.c b/arch/i386/pci/numa.c
index adbe17a38f6f..f5f165f69e0c 100644
--- a/arch/i386/pci/numa.c
+++ b/arch/i386/pci/numa.c
@@ -96,10 +96,14 @@ static void __devinit pci_fixup_i450nx(struct pci_dev *d)
                 pci_read_config_byte(d, reg++, &suba);
                 pci_read_config_byte(d, reg++, &subb);
                 DBG("i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno, suba, subb);
-                if (busno)
-                        pci_scan_bus(QUADLOCAL2BUS(quad,busno), &pci_root_ops, NULL);   /* Bus A */
-                if (suba < subb)
-                        pci_scan_bus(QUADLOCAL2BUS(quad,suba+1), &pci_root_ops, NULL);  /* Bus B */
+                if (busno) {
+                        /* Bus A */
+                        pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, busno));
+                }
+                if (suba < subb) {
+                        /* Bus B */
+                        pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, suba+1));
+                }
         }
         pcibios_last_bus = -1;
 }
@@ -123,8 +127,7 @@ static int __init pci_numa_init(void)
                                 continue;
                         printk("Scanning PCI bus %d for quad %d\n", 
                                 QUADLOCAL2BUS(quad,0), quad);
-                        pci_scan_bus(QUADLOCAL2BUS(quad,0), 
-                                &pci_root_ops, NULL);
+                        pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, 0));
                 }
         return 0;
 }
diff --git a/arch/i386/pci/pci.h b/arch/i386/pci/pci.h
index e58bae2076ad..8c66f275756f 100644
--- a/arch/i386/pci/pci.h
+++ b/arch/i386/pci/pci.h
@@ -104,3 +104,46 @@ extern DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
 extern int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
                                            unsigned int devfn);
 extern int __init pci_mmcfg_arch_init(void);
+
+/*
+ * AMD Fam10h CPUs are buggy, and cannot access MMIO config space
+ * on their northbrige except through the * %eax register. As such, you MUST
+ * NOT use normal IOMEM accesses, you need to only use the magic mmio-config
+ * accessor functions.
+ * In fact just use pci_config_*, nothing else please.
+ */
+static inline unsigned char mmio_config_readb(void __iomem *pos)
+{
+        u8 val;
+        asm volatile("movb (%1),%%al" : "=a" (val) : "r" (pos));
+        return val;
+}
+
+static inline unsigned short mmio_config_readw(void __iomem *pos)
+{
+        u16 val;
+        asm volatile("movw (%1),%%ax" : "=a" (val) : "r" (pos));
+        return val;
+}
+
+static inline unsigned int mmio_config_readl(void __iomem *pos)
+{
+        u32 val;
+        asm volatile("movl (%1),%%eax" : "=a" (val) : "r" (pos));
+        return val;
+}
+
+static inline void mmio_config_writeb(void __iomem *pos, u8 val)
+{
+        asm volatile("movb %%al,(%1)" :: "a" (val), "r" (pos) : "memory");
+}
+
+static inline void mmio_config_writew(void __iomem *pos, u16 val)
+{
+        asm volatile("movw %%ax,(%1)" :: "a" (val), "r" (pos) : "memory");
+}
+
+static inline void mmio_config_writel(void __iomem *pos, u32 val)
+{
+        asm volatile("movl %%eax,(%1)" :: "a" (val), "r" (pos) : "memory");
+}
diff --git a/arch/i386/pci/visws.c b/arch/i386/pci/visws.c
index f1b486d4190b..8ecb1c722594 100644
--- a/arch/i386/pci/visws.c
+++ b/arch/i386/pci/visws.c
@@ -101,8 +101,8 @@ static int __init pcibios_init(void)
                 "bridge B (PIIX4) bus: %u\n", pci_bus1, pci_bus0);
 
         raw_pci_ops = &pci_direct_conf1;
-        pci_scan_bus(pci_bus0, &pci_root_ops, NULL);
-        pci_scan_bus(pci_bus1, &pci_root_ops, NULL);
+        pci_scan_bus_with_sysdata(pci_bus0);
+        pci_scan_bus_with_sysdata(pci_bus1);
         pci_fixup_irqs(visws_swizzle, visws_map_irq);
         pcibios_resource_survey();
         return 0;
diff --git a/arch/i386/xen/enlighten.c b/arch/i386/xen/enlighten.c
index 9a8c1181c001..f0c37511d8da 100644
--- a/arch/i386/xen/enlighten.c
+++ b/arch/i386/xen/enlighten.c
@@ -842,7 +842,8 @@ void __init xen_setup_vcpu_info_placement(void)
         }
 }
 
-static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
+static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
+                          unsigned long addr, unsigned len)
 {
         char *start, *end, *reloc;
         unsigned ret;
@@ -869,7 +870,7 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
                 if (start == NULL || (end-start) > len)
                         goto default_patch;
 
-                ret = paravirt_patch_insns(insns, len, start, end);
+                ret = paravirt_patch_insns(insnbuf, len, start, end);
 
                 /* Note: because reloc is assigned from something that
                    appears to be an array, gcc assumes it's non-null,
@@ -877,8 +878,8 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
                    end. */
                 if (reloc > start && reloc < end) {
                         int reloc_off = reloc - start;
-                        long *relocp = (long *)(insns + reloc_off);
-                        long delta = start - (char *)insns;
+                        long *relocp = (long *)(insnbuf + reloc_off);
+                        long delta = start - (char *)addr;
 
                         *relocp += delta;
                 }
@@ -886,7 +887,8 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
 
         default_patch:
         default:
-                ret = paravirt_patch_default(type, clobbers, insns, len);
+                ret = paravirt_patch_default(type, clobbers, insnbuf,
+                                             addr, len);
                 break;
         }
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 21aa4fc5f8ef..8c39913d1729 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -327,17 +327,7 @@ config FORCE_CPEI_RETARGET
         This option it useful to enable this feature on older BIOS's as well.
         You can also enable this by using boot command line option force_cpei=1.
 
-config PREEMPT
-        bool "Preemptible Kernel"
-        help
-          This option reduces the latency of the kernel when reacting to
-          real-time or interactive events by allowing a low priority process to
-          be preempted even if it is in kernel mode executing a system call.
-          This allows applications to run more reliably even when the system is
-          under load.
-
-          Say Y here if you are building a kernel for a desktop, embedded
-          or real-time system.  Say N if you are unsure.
+source "kernel/Kconfig.preempt"
 
 source "mm/Kconfig"
 
diff --git a/arch/ia64/configs/bigsur_defconfig b/arch/ia64/configs/bigsur_defconfig
index 9eb48c0927b0..6dd8655664f3 100644
--- a/arch/ia64/configs/bigsur_defconfig
+++ b/arch/ia64/configs/bigsur_defconfig
@@ -42,7 +42,7 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
-CONFIG_SLAB=y
+CONFIG_SLUB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
diff --git a/arch/ia64/configs/gensparse_defconfig b/arch/ia64/configs/gensparse_defconfig
index 3a9ed951db08..e86fbd39c795 100644
--- a/arch/ia64/configs/gensparse_defconfig
+++ b/arch/ia64/configs/gensparse_defconfig
@@ -43,7 +43,7 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
-CONFIG_SLAB=y
+CONFIG_SLUB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
diff --git a/arch/ia64/configs/sim_defconfig b/arch/ia64/configs/sim_defconfig
index c420d9f3df98..546a772f438e 100644
--- a/arch/ia64/configs/sim_defconfig
+++ b/arch/ia64/configs/sim_defconfig
@@ -43,7 +43,7 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
-CONFIG_SLAB=y
+CONFIG_SLUB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
diff --git a/arch/ia64/configs/sn2_defconfig b/arch/ia64/configs/sn2_defconfig
index 4c9ffc47bc7a..9aecfceeb38c 100644
--- a/arch/ia64/configs/sn2_defconfig
+++ b/arch/ia64/configs/sn2_defconfig
@@ -46,7 +46,7 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_SLAB=y
+CONFIG_SLUB=y
 CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
diff --git a/arch/ia64/configs/tiger_defconfig b/arch/ia64/configs/tiger_defconfig
index 3dbb3987df27..797acf9066c1 100644
--- a/arch/ia64/configs/tiger_defconfig
+++ b/arch/ia64/configs/tiger_defconfig
@@ -53,7 +53,7 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
-CONFIG_SLAB=y
+CONFIG_SLUB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 CONFIG_RT_MUTEXES=y
diff --git a/arch/ia64/configs/zx1_defconfig b/arch/ia64/configs/zx1_defconfig
index 4a060fc39934..0a06b1333c95 100644
--- a/arch/ia64/configs/zx1_defconfig
+++ b/arch/ia64/configs/zx1_defconfig
@@ -48,7 +48,7 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_SLAB=y
+CONFIG_SLUB=y
 CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
diff --git a/arch/ia64/defconfig b/arch/ia64/defconfig
index 03172dc8c403..0210545e7f61 100644
--- a/arch/ia64/defconfig
+++ b/arch/ia64/defconfig
@@ -53,8 +53,7 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_VM_EVENT_COUNTERS=y
-CONFIG_SLAB=y
-# CONFIG_SLUB is not set
+CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
diff --git a/arch/ia64/hp/sim/boot/boot_head.S b/arch/ia64/hp/sim/boot/boot_head.S
index a9bd71ac78e2..8808565491fb 100644
--- a/arch/ia64/hp/sim/boot/boot_head.S
+++ b/arch/ia64/hp/sim/boot/boot_head.S
@@ -26,6 +26,7 @@ GLOBAL_ENTRY(_start)
         movl sp = stack_mem+16384-16
         bsw.1
         br.call.sptk.many rp=start_bootloader
+0:      nop 0             /* dummy nop to make unwinding work */
 END(_start)
 
 /*
diff --git a/arch/ia64/kernel/cpufreq/acpi-cpufreq.c b/arch/ia64/kernel/cpufreq/acpi-cpufreq.c
index 15c08d52f09f..8c6ec7070844 100644
--- a/arch/ia64/kernel/cpufreq/acpi-cpufreq.c
+++ b/arch/ia64/kernel/cpufreq/acpi-cpufreq.c
@@ -113,10 +113,8 @@ processor_get_freq (
 
         saved_mask = current->cpus_allowed;
         set_cpus_allowed(current, cpumask_of_cpu(cpu));
-        if (smp_processor_id() != cpu) {
-                ret = -EAGAIN;
+        if (smp_processor_id() != cpu)
                 goto migrate_end;
-        }
 
         /* processor_get_pstate gets the instantaneous frequency */
         ret = processor_get_pstate(&value);
@@ -125,7 +123,7 @@ processor_get_freq (
                 set_cpus_allowed(current, saved_mask);
                 printk(KERN_WARNING "get performance failed with error %d\n",
                        ret);
-                ret = -EAGAIN;
+                ret = 0;
                 goto migrate_end;
         }
         clock_freq = extract_clock(data, value, cpu);
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index cc3ee4ef37af..44be1c952b7c 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -33,6 +33,11 @@ void ack_bad_irq(unsigned int irq)
 }
 
 #ifdef CONFIG_IA64_GENERIC
+ia64_vector __ia64_irq_to_vector(int irq)
+{
+        return irq_cfg[irq].vector;
+}
+
 unsigned int __ia64_local_vector_to_irq (ia64_vector vec)
 {
         return __get_cpu_var(vector_irq)[vec];
diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
index ff28620cb992..63b73f3d4c9f 100644
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -2018,22 +2018,26 @@ ia64_mca_late_init(void)
 
                 if (cpe_vector >= 0) {
                         /* If platform supports CPEI, enable the irq. */
-                        cpe_poll_enabled = 0;
-                        for (irq = 0; irq < NR_IRQS; ++irq)
-                                if (irq_to_vector(irq) == cpe_vector) {
-                                        desc = irq_desc + irq;
-                                        desc->status |= IRQ_PER_CPU;
-                                        setup_irq(irq, &mca_cpe_irqaction);
-                                        ia64_cpe_irq = irq;
-                                }
-                        ia64_mca_register_cpev(cpe_vector);
-                        IA64_MCA_DEBUG("%s: CPEI/P setup and enabled.\n", __FUNCTION__);
-                } else {
-                        /* If platform doesn't support CPEI, get the timer going. */
-                        if (cpe_poll_enabled) {
-                                ia64_mca_cpe_poll(0UL);
-                                IA64_MCA_DEBUG("%s: CPEP setup and enabled.\n", __FUNCTION__);
+                        irq = local_vector_to_irq(cpe_vector);
+                        if (irq > 0) {
+                                cpe_poll_enabled = 0;
+                                desc = irq_desc + irq;
+                                desc->status |= IRQ_PER_CPU;
+                                setup_irq(irq, &mca_cpe_irqaction);
+                                ia64_cpe_irq = irq;
+                                ia64_mca_register_cpev(cpe_vector);
+                                IA64_MCA_DEBUG("%s: CPEI/P setup and enabled.\n",
+                                        __FUNCTION__);
+                                return 0;
                         }
+                        printk(KERN_ERR "%s: Failed to find irq for CPE "
+                                        "interrupt handler, vector %d\n",
+                                        __FUNCTION__, cpe_vector);
+                }
+                /* If platform doesn't support CPEI, get the timer going. */
+                if (cpe_poll_enabled) {
+                        ia64_mca_cpe_poll(0UL);
+                        IA64_MCA_DEBUG("%s: CPEP setup and enabled.\n", __FUNCTION__);
                 }
         }
 #endif
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index 4158906c45aa..c613fc0e91cc 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -198,9 +198,13 @@ default_idle (void)
 {
         local_irq_enable();
         while (!need_resched()) {
-                if (can_do_pal_halt)
-                        safe_halt();
-                else
+                if (can_do_pal_halt) {
+                        local_irq_disable();
+                        if (!need_resched()) {
+                                safe_halt();
+                        }
+                        local_irq_enable();
+                } else
                         cpu_relax();
         }
 }
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 00f803246948..122444a97897 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -951,10 +951,14 @@ access_uarea (struct task_struct *child, unsigned long addr,
                         return 0;
 
                       case PT_CR_IPSR:
-                        if (write_access)
-                                pt->cr_ipsr = ((*data & IPSR_MASK)
+                        if (write_access) {
+                                unsigned long tmp = *data;
+                                /* psr.ri==3 is a reserved value: SDM 2:25 */
+                                if ((tmp & IA64_PSR_RI) == IA64_PSR_RI)
+                                        tmp &= ~IA64_PSR_RI;
+                                pt->cr_ipsr = ((tmp & IPSR_MASK)
                                                | (pt->cr_ipsr & ~IPSR_MASK));
-                        else
+                        } else
                                 *data = (pt->cr_ipsr & IPSR_MASK);
                         return 0;
 
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index cd9a37a552c3..407efea04bf5 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -389,6 +389,13 @@ early_console_setup (char *cmdline)
         if (!efi_setup_pcdp_console(cmdline))
                 earlycons++;
 #endif
+#ifdef CONFIG_HP_SIMSERIAL_CONSOLE
+        {
+                extern struct console hpsim_cons;
+                register_console(&hpsim_cons);
+                earlycons++;
+        }
+#endif
 
         return (earlycons) ? 0 : -1;
 }
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index 83e80677de70..00232b4357ba 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -20,6 +20,8 @@ PHDRS {
   code   PT_LOAD;
   percpu PT_LOAD;
   data   PT_LOAD;
+  note   PT_NOTE;
+  unwind 0x70000001; /* PT_IA_64_UNWIND, but ld doesn't match the name */
 }
 SECTIONS
 {
@@ -62,6 +64,9 @@ SECTIONS
 
   /* Read-only data */
 
+  NOTES :code :note             /* put .notes in text and mark in PT_NOTE  */
+  code_continues : {} :code     /* switch back to regular program...  */
+
   /* Exception table */
   . = ALIGN(16);
   __ex_table : AT(ADDR(__ex_table) - LOAD_OFFSET)
@@ -99,7 +104,8 @@ SECTIONS
           __start_unwind = .;
           *(.IA_64.unwind*)
           __end_unwind = .;
-        }
+        } :code :unwind
+  code_continues2 : {} : code
 
   RODATA
 
@@ -276,10 +282,6 @@ SECTIONS
   .debug_typenames 0 : { *(.debug_typenames) }
   .debug_varnames  0 : { *(.debug_varnames) }
   /* These must appear regardless of  .  */
-  /* Discard them for now since Intel SoftSDV cannot handle them.
-  .comment 0 : { *(.comment) }
-  .note 0 : { *(.note) }
-  */
   /DISCARD/ : { *(.comment) }
   /DISCARD/ : { *(.note) }
 }
diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
index 73ccb6010c05..9150ffaff9e8 100644
--- a/arch/ia64/mm/fault.c
+++ b/arch/ia64/mm/fault.c
@@ -112,11 +112,17 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
         down_read(&mm->mmap_sem);
 
         vma = find_vma_prev(mm, address, &prev_vma);
-        if (!vma)
+        if (!vma && !prev_vma )
                 goto bad_area;
 
-        /* find_vma_prev() returns vma such that address < vma->vm_end or NULL */
-        if (address < vma->vm_start)
+        /*
+         * find_vma_prev() returns vma such that address < vma->vm_end or NULL
+         *
+         * May find no vma, but could be that the last vm area is the
+         * register backing store that needs to expand upwards, in
+         * this case vma will be null, but prev_vma will ne non-null
+         */
+        if (( !vma && prev_vma ) || (address < vma->vm_start) )
                 goto check_expansion;
 
   good_area:
@@ -172,6 +178,8 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
 
   check_expansion:
         if (!(prev_vma && (prev_vma->vm_flags & VM_GROWSUP) && (address == prev_vma->vm_end))) {
+                if (!vma)
+                        goto bad_area;
                 if (!(vma->vm_flags & VM_GROWSDOWN))
                         goto bad_area;
                 if (REGION_NUMBER(address) != REGION_NUMBER(vma->vm_start)
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 7f6d2360a262..360047389449 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -256,6 +256,13 @@ struct irq_chip irq_type_sn = {
         .set_affinity   = sn_set_affinity_irq
 };
 
+ia64_vector sn_irq_to_vector(int irq)
+{
+        if (irq >= IA64_NUM_VECTORS)
+                return 0;
+        return (ia64_vector)irq;
+}
+
 unsigned int sn_local_vector_to_irq(u8 vector)
 {
         return (CPU_VECTOR_TO_IRQ(smp_processor_id(), vector));
@@ -398,7 +405,10 @@ sn_call_force_intr_provider(struct sn_irq_info *sn_irq_info)
         struct sn_pcibus_provider *pci_provider;
 
         pci_provider = sn_pci_provider[sn_irq_info->irq_bridge_type];
-        if (pci_provider && pci_provider->force_interrupt)
+
+        /* Don't force an interrupt if the irq has been disabled */
+        if (!(irq_desc[sn_irq_info->irq_irq].status & IRQ_DISABLED) &&
+            pci_provider && pci_provider->force_interrupt)
                 (*pci_provider->force_interrupt)(sn_irq_info);
 }
 
diff --git a/arch/powerpc/boot/flatdevtree.c b/arch/powerpc/boot/flatdevtree.c
index b732644788db..13761bf160c4 100644
--- a/arch/powerpc/boot/flatdevtree.c
+++ b/arch/powerpc/boot/flatdevtree.c
@@ -134,20 +134,6 @@ static char *ft_next(struct ft_cxt *cxt, char *p, struct ft_atom *ret)
 #define HDR_SIZE        _ALIGN(sizeof(struct boot_param_header), 8)
 #define EXPAND_INCR     1024    /* alloc this much extra when expanding */
 
-/* See if the regions are in the standard order and non-overlapping */
-static int ft_ordered(struct ft_cxt *cxt)
-{
-        char *p = (char *)cxt->bph + HDR_SIZE;
-        enum ft_rgn_id r;
-
-        for (r = FT_RSVMAP; r <= FT_STRINGS; ++r) {
-                if (p > cxt->rgn[r].start)
-                        return 0;
-                p = cxt->rgn[r].start + cxt->rgn[r].size;
-        }
-        return p <= (char *)cxt->bph + cxt->max_size;
-}
-
 /* Copy the tree to a newly-allocated region and put things in order */
 static int ft_reorder(struct ft_cxt *cxt, int nextra)
 {
@@ -573,10 +559,6 @@ int ft_open(struct ft_cxt *cxt, void *blob, unsigned int max_size,
         cxt->rgn[FT_STRUCT].size = struct_size(cxt);
         cxt->rgn[FT_STRINGS].start = blob + be32_to_cpu(bph->off_dt_strings);
         cxt->rgn[FT_STRINGS].size = be32_to_cpu(bph->dt_strings_size);
-        /* Leave as '0' to force first ft_make_space call to do a ft_reorder
-         * and move dt to an area allocated by realloc.
-        cxt->isordered = ft_ordered(cxt);
-        */
 
         cxt->p = cxt->rgn[FT_STRUCT].start;
         cxt->str_anchor = cxt->rgn[FT_STRINGS].start;
diff --git a/arch/powerpc/configs/ps3_defconfig b/arch/powerpc/configs/ps3_defconfig
index d0b43df44426..ca7a197998ee 100644
--- a/arch/powerpc/configs/ps3_defconfig
+++ b/arch/powerpc/configs/ps3_defconfig
@@ -1,9 +1,23 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.22-rc6
-# Tue Jun 26 14:15:19 2007
+# Linux kernel version: 2.6.23-rc2
+# Tue Aug  7 19:17:26 2007
 #
 CONFIG_PPC64=y
+
+#
+# Processor support
+#
+# CONFIG_POWER4_ONLY is not set
+CONFIG_POWER3=y
+CONFIG_POWER4=y
+CONFIG_PPC_FPU=y
+CONFIG_ALTIVEC=y
+CONFIG_PPC_STD_MMU=y
+# CONFIG_PPC_MM_SLICES is not set
+CONFIG_VIRT_CPU_ACCOUNTING=y
+CONFIG_SMP=y
+CONFIG_NR_CPUS=2
 CONFIG_64BIT=y
 CONFIG_PPC_MERGE=y
 CONFIG_MMU=y
@@ -15,6 +29,7 @@ CONFIG_ARCH_HAS_ILOG2_U64=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_ARCH_NO_VIRT_TO_BUS=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_COMPAT=y
@@ -22,50 +37,32 @@ CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
+CONFIG_OF=y
 # CONFIG_PPC_UDBG_16550 is not set
 # CONFIG_GENERIC_TBSYNC is not set
 CONFIG_AUDIT_ARCH=y
 CONFIG_GENERIC_BUG=y
 # CONFIG_DEFAULT_UIMAGE is not set
-
-#
-# Processor support
-#
-# CONFIG_POWER4_ONLY is not set
-CONFIG_POWER3=y
-CONFIG_POWER4=y
-CONFIG_PPC_FPU=y
 # CONFIG_PPC_DCR_NATIVE is not set
 # CONFIG_PPC_DCR_MMIO is not set
 # CONFIG_PPC_OF_PLATFORM_PCI is not set
-CONFIG_ALTIVEC=y
-CONFIG_PPC_STD_MMU=y
-# CONFIG_PPC_MM_SLICES is not set
-CONFIG_VIRT_CPU_ACCOUNTING=y
-CONFIG_SMP=y
-CONFIG_NR_CPUS=2
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
-# Code maturity level options
+# General setup
 #
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
-
-#
-# General setup
-#
 CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
-# CONFIG_IPC_NS is not set
 CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
-# CONFIG_UTS_NS is not set
+# CONFIG_USER_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=17
@@ -100,10 +97,6 @@ CONFIG_SLAB=y
 CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
-
-#
-# Loadable module support
-#
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
@@ -111,12 +104,9 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
-
-#
-# Block layer
-#
 CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
+CONFIG_BLK_DEV_BSG=y
 
 #
 # IO Schedulers
@@ -136,7 +126,9 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 CONFIG_PPC_MULTIPLATFORM=y
 # CONFIG_EMBEDDED6xx is not set
-# CONFIG_APUS is not set
+# CONFIG_PPC_82xx is not set
+# CONFIG_PPC_83xx is not set
+# CONFIG_PPC_86xx is not set
 # CONFIG_PPC_PSERIES is not set
 # CONFIG_PPC_ISERIES is not set
 # CONFIG_PPC_MPC52xx is not set
@@ -223,6 +215,7 @@ CONFIG_MEMORY_HOTPLUG_SPARSE=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_RESOURCES_64BIT=y
 CONFIG_ZONE_DMA_FLAG=1
+CONFIG_BOUNCE=y
 CONFIG_ARCH_MEMORY_PROBE=y
 # CONFIG_PPC_HAS_HASH_64K is not set
 # CONFIG_PPC_64K_PAGES is not set
@@ -241,6 +234,7 @@ CONFIG_ZONE_DMA=y
 CONFIG_GENERIC_ISA_DMA=y
 # CONFIG_PCI is not set
 # CONFIG_PCI_DOMAINS is not set
+# CONFIG_PCI_SYSCALL is not set
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 
 #
@@ -365,6 +359,7 @@ CONFIG_WIRELESS_EXT=y
 # CONFIG_MAC80211 is not set
 # CONFIG_IEEE80211 is not set
 # CONFIG_RFKILL is not set
+# CONFIG_NET_9P is not set
 
 #
 # Device Drivers
@@ -379,26 +374,11 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_DEBUG_DRIVER is not set
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
-
-#
-# Connector - unified userspace <-> kernelspace linker
-#
 # CONFIG_CONNECTOR is not set
 # CONFIG_MTD is not set
-
-#
-# Parallel port support
-#
+CONFIG_OF_DEVICE=y
 # CONFIG_PARPORT is not set
-
-#
-# Plug and Play support
-#
-# CONFIG_PNPACPI is not set
-
-#
-# Block devices
-#
+CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_FD is not set
 # CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
@@ -411,11 +391,8 @@ CONFIG_BLK_DEV_RAM_SIZE=65535
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
-
-#
-# Misc devices
-#
-# CONFIG_BLINK is not set
+CONFIG_MISC_DEVICES=y
+# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_IDE is not set
 
 #
@@ -423,6 +400,7 @@ CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+CONFIG_SCSI_DMA=y
 # CONFIG_SCSI_TGT is not set
 # CONFIG_SCSI_NETLINK is not set
 CONFIG_SCSI_PROC_FS=y
@@ -455,37 +433,22 @@ CONFIG_SCSI_WAIT_SCAN=m
 # CONFIG_SCSI_ISCSI_ATTRS is not set
 # CONFIG_SCSI_SAS_ATTRS is not set
 # CONFIG_SCSI_SAS_LIBSAS is not set
-
-#
-# SCSI low-level drivers
-#
-# CONFIG_ISCSI_TCP is not set
-# CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_LOWLEVEL is not set
 # CONFIG_ATA is not set
-
-#
-# Multi-device support (RAID and LVM)
-#
 # CONFIG_MD is not set
 # CONFIG_MACINTOSH_DRIVERS is not set
-
-#
-# Network device support
-#
 CONFIG_NETDEVICES=y
+# CONFIG_NETDEVICES_MULTIQUEUE is not set
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
+# CONFIG_MACVLAN is not set
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
-
-#
-# Ethernet (10 or 100Mbit)
-#
 # CONFIG_NET_ETHERNET is not set
 CONFIG_MII=m
 CONFIG_NETDEV_1000=y
-CONFIG_NETDEV_10000=y
 CONFIG_GELIC_NET=y
+# CONFIG_NETDEV_10000 is not set
 
 #
 # Wireless LAN
@@ -518,15 +481,7 @@ CONFIG_USB_NET_MCS7830=m
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
-
-#
-# ISDN subsystem
-#
 # CONFIG_ISDN is not set
-
-#
-# Telephony Support
-#
 # CONFIG_PHONE is not set
 
 #
@@ -604,10 +559,6 @@ CONFIG_VT_HW_CONSOLE_BINDING=y
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=16
-
-#
-# IPMI
-#
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_WATCHDOG is not set
 # CONFIG_HW_RANDOM is not set
@@ -616,10 +567,6 @@ CONFIG_GEN_RTC=y
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_HANGCHECK_TIMER is not set
-
-#
-# TPM devices
-#
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
 
@@ -628,11 +575,8 @@ CONFIG_GEN_RTC=y
 #
 # CONFIG_SPI is not set
 # CONFIG_SPI_MASTER is not set
-
-#
-# Dallas's 1-wire bus
-#
 # CONFIG_W1 is not set
+# CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 
 #
@@ -657,6 +601,7 @@ CONFIG_GEN_RTC=y
 #
 # CONFIG_DISPLAY_SUPPORT is not set
 # CONFIG_VGASTATE is not set
+CONFIG_VIDEO_OUTPUT_CONTROL=m
 CONFIG_FB=y
 # CONFIG_FIRMWARE_EDID is not set
 # CONFIG_FB_DDC is not set
@@ -691,11 +636,13 @@ CONFIG_FB_PS3_DEFAULT_SIZE_M=18
 # CONFIG_VGA_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
 CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y
 CONFIG_FONT_8x16=y
 CONFIG_LOGO=y
+CONFIG_FB_LOGO_EXTRA=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_VGA16 is not set
 CONFIG_LOGO_LINUX_CLUT224=y
@@ -709,6 +656,8 @@ CONFIG_SOUND=y
 # Advanced Linux Sound Architecture
 #
 CONFIG_SND=y
+CONFIG_SND_TIMER=y
+CONFIG_SND_PCM=y
 # CONFIG_SND_SEQUENCER is not set
 # CONFIG_SND_MIXER_OSS is not set
 # CONFIG_SND_PCM_OSS is not set
@@ -735,6 +684,12 @@ CONFIG_SND_VERBOSE_PROCFS=y
 #
 
 #
+# ALSA PowerPC devices
+#
+CONFIG_SND_PS3=y
+CONFIG_SND_PS3_DEFAULT_START_DELAY=2000
+
+#
 # USB devices
 #
 # CONFIG_SND_USB_AUDIO is not set
@@ -747,13 +702,14 @@ CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_SOC is not set
 
 #
-# Open Sound System
+# SoC Audio support for SuperH
 #
-# CONFIG_SOUND_PRIME is not set
 
 #
-# HID Devices
+# Open Sound System
 #
+# CONFIG_SOUND_PRIME is not set
+CONFIG_HID_SUPPORT=y
 CONFIG_HID=y
 # CONFIG_HID_DEBUG is not set
 
@@ -770,10 +726,7 @@ CONFIG_USB_HID=m
 #
 # CONFIG_USB_KBD is not set
 # CONFIG_USB_MOUSE is not set
-
-#
-# USB support
-#
+CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
 CONFIG_USB_ARCH_HAS_EHCI=y
@@ -803,6 +756,7 @@ CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
 CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_SL811_HCD is not set
+# CONFIG_USB_R8A66597_HCD is not set
 
 #
 # USB Device Class drivers
@@ -879,31 +833,8 @@ CONFIG_USB_MON=y
 #
 # CONFIG_USB_GADGET is not set
 # CONFIG_MMC is not set
-
-#
-# LED devices
-#
 # CONFIG_NEW_LEDS is not set
-
-#
-# LED drivers
-#
-
-#
-# LED Triggers
-#
-
-#
-# InfiniBand support
-#
-
-#
-# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
-#
-
-#
-# Real Time Clock
-#
+# CONFIG_EDAC is not set
 # CONFIG_RTC_CLASS is not set
 
 #
@@ -920,6 +851,11 @@ CONFIG_USB_MON=y
 #
 
 #
+# Userspace I/O
+#
+# CONFIG_UIO is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=m
@@ -948,8 +884,8 @@ CONFIG_QUOTA=y
 CONFIG_QFMT_V2=y
 CONFIG_QUOTACTL=y
 CONFIG_DNOTIFY=y
-# CONFIG_AUTOFS_FS is not set
-CONFIG_AUTOFS4_FS=y
+CONFIG_AUTOFS_FS=m
+CONFIG_AUTOFS4_FS=m
 # CONFIG_FUSE_FS is not set
 
 #
@@ -1030,7 +966,6 @@ CONFIG_CIFS=m
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
-# CONFIG_9P_FS is not set
 
 #
 # Partition Types
@@ -1096,6 +1031,7 @@ CONFIG_BITREVERSE=y
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_ITU_T is not set
 CONFIG_CRC32=y
+# CONFIG_CRC7 is not set
 # CONFIG_LIBCRC32C is not set
 CONFIG_PLIST=y
 CONFIG_HAS_IOMEM=y
@@ -1120,6 +1056,7 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
 # CONFIG_DEBUG_SHIRQ is not set
 CONFIG_DETECT_SOFTLOCKUP=y
+CONFIG_SCHED_DEBUG=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_SLAB is not set
@@ -1150,10 +1087,6 @@ CONFIG_IRQSTACKS=y
 #
 # CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
-
-#
-# Cryptographic options
-#
 CONFIG_CRYPTO=y
 CONFIG_CRYPTO_ALGAPI=y
 CONFIG_CRYPTO_BLKCIPHER=y
@@ -1191,7 +1124,4 @@ CONFIG_CRYPTO_DES=y
 # CONFIG_CRYPTO_CRC32C is not set
 # CONFIG_CRYPTO_CAMELLIA is not set
 # CONFIG_CRYPTO_TEST is not set
-
-#
-# Hardware crypto devices
-#
+CONFIG_CRYPTO_HW=y
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index f39a72f30aad..b0cb2e662c25 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -81,6 +81,7 @@ obj-y				+= iomap.o
 endif
 
 ifeq ($(CONFIG_PPC_ISERIES),y)
+CFLAGS_lparmap.s                += -g0
 extra-y += lparmap.s
 $(obj)/head_64.o:       $(obj)/lparmap.s
 AFLAGS_head_64.o += -I$(obj)
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 1448af92c6a9..171800002ede 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -1672,8 +1672,9 @@ _GLOBAL(__start_initialization_multiplatform)
          * Are we booted from a PROM Of-type client-interface ?
          */
         cmpldi  cr0,r5,0
-        bne     .__boot_from_prom               /* yes -> prom */
-
+        beq     1f
+        b       .__boot_from_prom               /* yes -> prom */
+1:
         /* Save parameters */
         mr      r31,r3
         mr      r30,r4
@@ -1701,7 +1702,7 @@ _GLOBAL(__start_initialization_multiplatform)
         bl      .__mmu_off
         b       .__after_prom_start
 
-_STATIC(__boot_from_prom)
+_INIT_STATIC(__boot_from_prom)
         /* Save parameters */
         mr      r31,r3
         mr      r30,r4
@@ -1768,9 +1769,10 @@ _STATIC(__after_prom_start)
                                         /*      the source addr          */
 
         cmpdi   r4,0                    /* In some cases the loader may  */
-        beq     .start_here_multiplatform /* have already put us at zero */
+        bne     1f
+        b       .start_here_multiplatform /* have already put us at zero */
                                         /* so we can skip the copy.      */
-        LOAD_REG_IMMEDIATE(r5,copy_to_here) /* # bytes of memory to copy */
+1:      LOAD_REG_IMMEDIATE(r5,copy_to_here) /* # bytes of memory to copy */
         sub     r5,r5,r27
 
         li      r6,0x100                /* Start offset, the first 0x100 */
@@ -1957,7 +1959,7 @@ _GLOBAL(enable_64b_mode)
 /*
  * This is where the main kernel code starts.
  */
-_STATIC(start_here_multiplatform)
+_INIT_STATIC(start_here_multiplatform)
         /* get a new offset, now that the kernel has moved. */
         bl      .reloc_offset
         mr      r26,r3
@@ -2019,7 +2021,7 @@ _STATIC(start_here_multiplatform)
         b       .       /* prevent speculative execution */
         
         /* This is where all platforms converge execution */
-_STATIC(start_here_common)
+_INIT_STATIC(start_here_common)
         /* relocation is on at this point */
 
         /* The following code sets up the SP and TOC now that we are */
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index e708ab7ca9e8..8533de50347d 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -301,9 +301,19 @@ _GLOBAL(_tlbie)
         mfspr   r4,SPRN_MMUCR
         mfspr   r5,SPRN_PID                     /* Get PID */
         rlwimi  r4,r5,0,24,31                   /* Set TID */
-        mtspr   SPRN_MMUCR,r4
 
+        /* We have to run the search with interrupts disabled, even critical
+         * and debug interrupts (in fact the only critical exceptions we have
+         * are debug and machine check).  Otherwise  an interrupt which causes
+         * a TLB miss can clobber the MMUCR between the mtspr and the tlbsx. */
+        mfmsr   r5
+        lis     r6,(MSR_EE|MSR_CE|MSR_ME|MSR_DE)@ha
+        addi    r6,r6,(MSR_EE|MSR_CE|MSR_ME|MSR_DE)@l
+        andc    r6,r5,r6
+        mtmsr   r6
+        mtspr   SPRN_MMUCR,r4
         tlbsx.  r3, 0, r3
+        mtmsr   r5
         bne     10f
         sync
         /* There are only 64 TLB entries, so r3 < 64,
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index a97e23ac1976..291ffbc360c9 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -313,6 +313,7 @@ struct pci_dev *of_create_pci_dev(struct device_node *node,
 
         dev->current_state = 4;         /* unknown power state */
         dev->error_state = pci_channel_io_normal;
+        dev->dma_mask = 0xffffffff;
 
         if (!strcmp(type, "pci") || !strcmp(type, "pciex")) {
                 /* a PCI-PCI bridge */
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index f1789578747a..a47151e806ca 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -795,7 +795,7 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
 
 #ifdef CONFIG_PPC_MM_SLICES
         /* We only prefault standard pages for now */
-        if (unlikely(get_slice_psize(mm, ea) != mm->context.user_psize));
+        if (unlikely(get_slice_psize(mm, ea) != mm->context.user_psize))
                 return;
 #endif
 
diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
index b0697017d0e8..a73d2d700973 100644
--- a/arch/powerpc/mm/slb.c
+++ b/arch/powerpc/mm/slb.c
@@ -69,20 +69,9 @@ static inline void slb_shadow_update(unsigned long ea,
         smp_wmb();
 }
 
-static inline void create_shadowed_slbe(unsigned long ea, unsigned long flags,
-                                        unsigned long entry)
+static inline void slb_shadow_clear(unsigned long entry)
 {
-        /*
-         * Updating the shadow buffer before writing the SLB ensures
-         * we don't get a stale entry here if we get preempted by PHYP
-         * between these two statements.
-         */
-        slb_shadow_update(ea, flags, entry);
-
-        asm volatile("slbmte  %0,%1" :
-                     : "r" (mk_vsid_data(ea, flags)),
-                       "r" (mk_esid_data(ea, entry))
-                     : "memory" );
+        get_slb_shadow()->save_area[entry].esid = 0;
 }
 
 void slb_flush_and_rebolt(void)
@@ -100,11 +89,13 @@ void slb_flush_and_rebolt(void)
         vflags = SLB_VSID_KERNEL | vmalloc_llp;
 
         ksp_esid_data = mk_esid_data(get_paca()->kstack, 2);
-        if ((ksp_esid_data & ESID_MASK) == PAGE_OFFSET)
+        if ((ksp_esid_data & ESID_MASK) == PAGE_OFFSET) {
                 ksp_esid_data &= ~SLB_ESID_V;
-
-        /* Only third entry (stack) may change here so only resave that */
-        slb_shadow_update(get_paca()->kstack, lflags, 2);
+                slb_shadow_clear(2);
+        } else {
+                /* Update stack entry; others don't change */
+                slb_shadow_update(get_paca()->kstack, lflags, 2);
+        }
 
         /* We need to do this all in asm, so we're sure we don't touch
          * the stack between the slbia and rebolting it. */
@@ -235,16 +226,12 @@ void slb_initialize(void)
         vflags = SLB_VSID_KERNEL | vmalloc_llp;
 
         /* Invalidate the entire SLB (even slot 0) & all the ERATS */
-        asm volatile("isync":::"memory");
-        asm volatile("slbmte  %0,%0"::"r" (0) : "memory");
-        asm volatile("isync; slbia; isync":::"memory");
-        create_shadowed_slbe(PAGE_OFFSET, lflags, 0);
-
-        create_shadowed_slbe(VMALLOC_START, vflags, 1);
-
-        /* We don't bolt the stack for the time being - we're in boot,
-         * so the stack is in the bolted segment.  By the time it goes
-         * elsewhere, we'll call _switch() which will bolt in the new
-         * one. */
-        asm volatile("isync":::"memory");
+        slb_shadow_update(PAGE_OFFSET, lflags, 0);
+        asm volatile("isync; slbia; sync; slbmte  %0,%1; isync" ::
+                     "r" (get_slb_shadow()->save_area[0].vsid),
+                     "r" (get_slb_shadow()->save_area[0].esid) : "memory");
+
+        slb_shadow_update(VMALLOC_START, vflags, 1);
+
+        slb_flush_and_rebolt();
 }
diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
index f833dba2a028..d5fd3909d13a 100644
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -405,6 +405,8 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
 
         if (len > mm->task_size)
                 return -ENOMEM;
+        if (len & ((1ul << pshift) - 1))
+                return -EINVAL;
         if (fixed && (addr & ((1ul << pshift) - 1)))
                 return -EINVAL;
         if (fixed && addr > (mm->task_size - len))
diff --git a/arch/powerpc/platforms/83xx/mpc832x_mds.c b/arch/powerpc/platforms/83xx/mpc832x_mds.c
index b39cb52c6fb9..2c8e641a739b 100644
--- a/arch/powerpc/platforms/83xx/mpc832x_mds.c
+++ b/arch/powerpc/platforms/83xx/mpc832x_mds.c
@@ -106,7 +106,6 @@ static struct of_device_id mpc832x_ids[] = {
         { .type = "soc", },
         { .compatible = "soc", },
         { .type = "qe", },
-        { .type = "mdio", },
         {},
 };
 
diff --git a/arch/powerpc/platforms/83xx/mpc832x_rdb.c b/arch/powerpc/platforms/83xx/mpc832x_rdb.c
index b2b28a44738c..090906170a41 100644
--- a/arch/powerpc/platforms/83xx/mpc832x_rdb.c
+++ b/arch/powerpc/platforms/83xx/mpc832x_rdb.c
@@ -70,7 +70,6 @@ static struct of_device_id mpc832x_ids[] = {
         { .type = "soc", },
         { .compatible = "soc", },
         { .type = "qe", },
-        { .type = "mdio", },
         {},
 };
 
diff --git a/arch/powerpc/platforms/83xx/mpc836x_mds.c b/arch/powerpc/platforms/83xx/mpc836x_mds.c
index 0e615fd65c1f..84b58934aafd 100644
--- a/arch/powerpc/platforms/83xx/mpc836x_mds.c
+++ b/arch/powerpc/platforms/83xx/mpc836x_mds.c
@@ -113,7 +113,6 @@ static struct of_device_id mpc836x_ids[] = {
         { .type = "soc", },
         { .compatible = "soc", },
         { .type = "qe", },
-        { .type = "mdio", },
         {},
 };
 
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_mds.c b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
index e8003bf00c9a..be25ecd911ba 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_mds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
@@ -142,7 +142,6 @@ static struct of_device_id mpc85xx_ids[] = {
         { .type = "soc", },
         { .compatible = "soc", },
         { .type = "qe", },
-        { .type = "mdio", },
         {},
 };
 
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index 90124228b8f4..095a30304c56 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -36,7 +36,6 @@
 #include <asm/spu_priv1.h>
 #include <asm/xmon.h>
 #include <asm/prom.h>
-#include "spu_priv1_mmio.h"
 
 const struct spu_management_ops *spu_management_ops;
 EXPORT_SYMBOL_GPL(spu_management_ops);
@@ -636,138 +635,6 @@ static ssize_t spu_stat_show(struct sys_device *sysdev, char *buf)
 
 static SYSDEV_ATTR(stat, 0644, spu_stat_show, NULL);
 
-/* Hardcoded affinity idxs for QS20 */
-#define SPES_PER_BE 8
-static int QS20_reg_idxs[SPES_PER_BE] =   { 0, 2, 4, 6, 7, 5, 3, 1 };
-static int QS20_reg_memory[SPES_PER_BE] = { 1, 1, 0, 0, 0, 0, 0, 0 };
-
-static struct spu *spu_lookup_reg(int node, u32 reg)
-{
-        struct spu *spu;
-
-        list_for_each_entry(spu, &cbe_spu_info[node].spus, cbe_list) {
-                if (*(u32 *)get_property(spu_devnode(spu), "reg", NULL) == reg)
-                        return spu;
-        }
-        return NULL;
-}
-
-static void init_aff_QS20_harcoded(void)
-{
-        int node, i;
-        struct spu *last_spu, *spu;
-        u32 reg;
-
-        for (node = 0; node < MAX_NUMNODES; node++) {
-                last_spu = NULL;
-                for (i = 0; i < SPES_PER_BE; i++) {
-                        reg = QS20_reg_idxs[i];
-                        spu = spu_lookup_reg(node, reg);
-                        if (!spu)
-                                continue;
-                        spu->has_mem_affinity = QS20_reg_memory[reg];
-                        if (last_spu)
-                                list_add_tail(&spu->aff_list,
-                                                &last_spu->aff_list);
-                        last_spu = spu;
-                }
-        }
-}
-
-static int of_has_vicinity(void)
-{
-        struct spu* spu;
-
-        spu = list_entry(cbe_spu_info[0].spus.next, struct spu, cbe_list);
-        return of_find_property(spu_devnode(spu), "vicinity", NULL) != NULL;
-}
-
-static struct spu *aff_devnode_spu(int cbe, struct device_node *dn)
-{
-        struct spu *spu;
-
-        list_for_each_entry(spu, &cbe_spu_info[cbe].spus, cbe_list)
-                if (spu_devnode(spu) == dn)
-                        return spu;
-        return NULL;
-}
-
-static struct spu *
-aff_node_next_to(int cbe, struct device_node *target, struct device_node *avoid)
-{
-        struct spu *spu;
-        const phandle *vic_handles;
-        int lenp, i;
-
-        list_for_each_entry(spu, &cbe_spu_info[cbe].spus, cbe_list) {
-                if (spu_devnode(spu) == avoid)
-                        continue;
-                vic_handles = get_property(spu_devnode(spu), "vicinity", &lenp);
-                for (i=0; i < (lenp / sizeof(phandle)); i++) {
-                        if (vic_handles[i] == target->linux_phandle)
-                                return spu;
-                }
-        }
-        return NULL;
-}
-
-static void init_aff_fw_vicinity_node(int cbe)
-{
-        struct spu *spu, *last_spu;
-        struct device_node *vic_dn, *last_spu_dn;
-        phandle avoid_ph;
-        const phandle *vic_handles;
-        const char *name;
-        int lenp, i, added, mem_aff;
-
-        last_spu = list_entry(cbe_spu_info[cbe].spus.next, struct spu, cbe_list);
-        avoid_ph = 0;
-        for (added = 1; added < cbe_spu_info[cbe].n_spus; added++) {
-                last_spu_dn = spu_devnode(last_spu);
-                vic_handles = get_property(last_spu_dn, "vicinity", &lenp);
-
-                for (i = 0; i < (lenp / sizeof(phandle)); i++) {
-                        if (vic_handles[i] == avoid_ph)
-                                continue;
-
-                        vic_dn = of_find_node_by_phandle(vic_handles[i]);
-                        if (!vic_dn)
-                                continue;
-
-                        name = get_property(vic_dn, "name", NULL);
-                        if (strcmp(name, "spe") == 0) {
-                                spu = aff_devnode_spu(cbe, vic_dn);
-                                avoid_ph = last_spu_dn->linux_phandle;
-                        }
-                        else {
-                                mem_aff = strcmp(name, "mic-tm") == 0;
-                                spu = aff_node_next_to(cbe, vic_dn, last_spu_dn);
-                                if (!spu)
-                                        continue;
-                                if (mem_aff) {
-                                        last_spu->has_mem_affinity = 1;
-                                        spu->has_mem_affinity = 1;
-                                }
-                                avoid_ph = vic_dn->linux_phandle;
-                        }
-                        list_add_tail(&spu->aff_list, &last_spu->aff_list);
-                        last_spu = spu;
-                        break;
-                }
-        }
-}
-
-static void init_aff_fw_vicinity(void)
-{
-        int cbe;
-
-        /* sets has_mem_affinity for each spu, as long as the
-         * spu->aff_list list, linking each spu to its neighbors
-         */
-        for (cbe = 0; cbe < MAX_NUMNODES; cbe++)
-                init_aff_fw_vicinity_node(cbe);
-}
-
 static int __init init_spu_base(void)
 {
         int i, ret = 0;
@@ -811,13 +678,7 @@ static int __init init_spu_base(void)
         mutex_unlock(&spu_full_list_mutex);
         spu_add_sysdev_attr(&attr_stat);
 
-        if (of_has_vicinity()) {
-                init_aff_fw_vicinity();
-        } else {
-                long root = of_get_flat_dt_root();
-                if (of_flat_dt_is_compatible(root, "IBM,CPBW-1.0"))
-                        init_aff_QS20_harcoded();
-        }
+        spu_init_affinity();
 
         return 0;
 
diff --git a/arch/powerpc/platforms/cell/spu_manage.c b/arch/powerpc/platforms/cell/spu_manage.c
index 75ed50fcc3db..5eb88346181a 100644
--- a/arch/powerpc/platforms/cell/spu_manage.c
+++ b/arch/powerpc/platforms/cell/spu_manage.c
@@ -361,8 +361,171 @@ static int of_destroy_spu(struct spu *spu)
         return 0;
 }
 
+/* Hardcoded affinity idxs for qs20 */
+#define QS20_SPES_PER_BE 8
+static int qs20_reg_idxs[QS20_SPES_PER_BE] =   { 0, 2, 4, 6, 7, 5, 3, 1 };
+static int qs20_reg_memory[QS20_SPES_PER_BE] = { 1, 1, 0, 0, 0, 0, 0, 0 };
+
+static struct spu *spu_lookup_reg(int node, u32 reg)
+{
+        struct spu *spu;
+        u32 *spu_reg;
+
+        list_for_each_entry(spu, &cbe_spu_info[node].spus, cbe_list) {
+                spu_reg = (u32*)of_get_property(spu_devnode(spu), "reg", NULL);
+                if (*spu_reg == reg)
+                        return spu;
+        }
+        return NULL;
+}
+
+static void init_affinity_qs20_harcoded(void)
+{
+        int node, i;
+        struct spu *last_spu, *spu;
+        u32 reg;
+
+        for (node = 0; node < MAX_NUMNODES; node++) {
+                last_spu = NULL;
+                for (i = 0; i < QS20_SPES_PER_BE; i++) {
+                        reg = qs20_reg_idxs[i];
+                        spu = spu_lookup_reg(node, reg);
+                        if (!spu)
+                                continue;
+                        spu->has_mem_affinity = qs20_reg_memory[reg];
+                        if (last_spu)
+                                list_add_tail(&spu->aff_list,
+                                                &last_spu->aff_list);
+                        last_spu = spu;
+                }
+        }
+}
+
+static int of_has_vicinity(void)
+{
+        struct spu* spu;
+
+        spu = list_first_entry(&cbe_spu_info[0].spus, struct spu, cbe_list);
+        return of_find_property(spu_devnode(spu), "vicinity", NULL) != NULL;
+}
+
+static struct spu *devnode_spu(int cbe, struct device_node *dn)
+{
+        struct spu *spu;
+
+        list_for_each_entry(spu, &cbe_spu_info[cbe].spus, cbe_list)
+                if (spu_devnode(spu) == dn)
+                        return spu;
+        return NULL;
+}
+
+static struct spu *
+neighbour_spu(int cbe, struct device_node *target, struct device_node *avoid)
+{
+        struct spu *spu;
+        struct device_node *spu_dn;
+        const phandle *vic_handles;
+        int lenp, i;
+
+        list_for_each_entry(spu, &cbe_spu_info[cbe].spus, cbe_list) {
+                spu_dn = spu_devnode(spu);
+                if (spu_dn == avoid)
+                        continue;
+                vic_handles = of_get_property(spu_dn, "vicinity", &lenp);
+                for (i=0; i < (lenp / sizeof(phandle)); i++) {
+                        if (vic_handles[i] == target->linux_phandle)
+                                return spu;
+                }
+        }
+        return NULL;
+}
+
+static void init_affinity_node(int cbe)
+{
+        struct spu *spu, *last_spu;
+        struct device_node *vic_dn, *last_spu_dn;
+        phandle avoid_ph;
+        const phandle *vic_handles;
+        const char *name;
+        int lenp, i, added;
+
+        last_spu = list_first_entry(&cbe_spu_info[cbe].spus, struct spu,
+                                                                cbe_list);
+        avoid_ph = 0;
+        for (added = 1; added < cbe_spu_info[cbe].n_spus; added++) {
+                last_spu_dn = spu_devnode(last_spu);
+                vic_handles = of_get_property(last_spu_dn, "vicinity", &lenp);
+
+                /*
+                 * Walk through each phandle in vicinity property of the spu
+                 * (tipically two vicinity phandles per spe node)
+                 */
+                for (i = 0; i < (lenp / sizeof(phandle)); i++) {
+                        if (vic_handles[i] == avoid_ph)
+                                continue;
+
+                        vic_dn = of_find_node_by_phandle(vic_handles[i]);
+                        if (!vic_dn)
+                                continue;
+
+                        /* a neighbour might be spe, mic-tm, or bif0 */
+                        name = of_get_property(vic_dn, "name", NULL);
+                        if (!name)
+                                continue;
+
+                        if (strcmp(name, "spe") == 0) {
+                                spu = devnode_spu(cbe, vic_dn);
+                                avoid_ph = last_spu_dn->linux_phandle;
+                        } else {
+                                /*
+                                 * "mic-tm" and "bif0" nodes do not have
+                                 * vicinity property. So we need to find the
+                                 * spe which has vic_dn as neighbour, but
+                                 * skipping the one we came from (last_spu_dn)
+                                 */
+                                spu = neighbour_spu(cbe, vic_dn, last_spu_dn);
+                                if (!spu)
+                                        continue;
+                                if (!strcmp(name, "mic-tm")) {
+                                        last_spu->has_mem_affinity = 1;
+                                        spu->has_mem_affinity = 1;
+                                }
+                                avoid_ph = vic_dn->linux_phandle;
+                        }
+
+                        list_add_tail(&spu->aff_list, &last_spu->aff_list);
+                        last_spu = spu;
+                        break;
+                }
+        }
+}
+
+static void init_affinity_fw(void)
+{
+        int cbe;
+
+        for (cbe = 0; cbe < MAX_NUMNODES; cbe++)
+                init_affinity_node(cbe);
+}
+
+static int __init init_affinity(void)
+{
+        if (of_has_vicinity()) {
+                init_affinity_fw();
+        } else {
+                long root = of_get_flat_dt_root();
+                if (of_flat_dt_is_compatible(root, "IBM,CPBW-1.0"))
+                        init_affinity_qs20_harcoded();
+                else
+                        printk("No affinity configuration found");
+        }
+
+        return 0;
+}
+
 const struct spu_management_ops spu_management_of_ops = {
         .enumerate_spus = of_enumerate_spus,
         .create_spu = of_create_spu,
         .destroy_spu = of_destroy_spu,
+        .init_affinity = init_affinity,
 };
diff --git a/arch/powerpc/platforms/cell/spu_syscalls.c b/arch/powerpc/platforms/cell/spu_syscalls.c
index dd2c6688c8aa..027ac32cc636 100644
--- a/arch/powerpc/platforms/cell/spu_syscalls.c
+++ b/arch/powerpc/platforms/cell/spu_syscalls.c
@@ -45,6 +45,7 @@ asmlinkage long sys_spu_create(const char __user *name,
         if (owner && try_module_get(owner)) {
                 if (flags & SPU_CREATE_AFFINITY_SPU) {
                         neighbor = fget_light(neighbor_fd, &fput_needed);
+                        ret = -EBADF;
                         if (neighbor) {
                                 ret = spufs_calls.create_thread(name, flags,
                                                                 mode, neighbor);
diff --git a/arch/powerpc/platforms/ps3/Kconfig b/arch/powerpc/platforms/ps3/Kconfig
index d4fc74f7bb15..67144d1d1405 100644
--- a/arch/powerpc/platforms/ps3/Kconfig
+++ b/arch/powerpc/platforms/ps3/Kconfig
@@ -1,5 +1,5 @@
 config PPC_PS3
-        bool "Sony PS3 (incomplete)"
+        bool "Sony PS3"
         depends on PPC_MULTIPLATFORM && PPC64
         select PPC_CELL
         select USB_ARCH_HAS_OHCI
@@ -10,10 +10,10 @@ config PPC_PS3
         select MEMORY_HOTPLUG
         help
           This option enables support for the Sony PS3 game console
-          and other platforms using the PS3 hypervisor.
-          Support for this platform is not yet complete, so
-          enabling this will not result in a bootable kernel on a
-          PS3 system.
+          and other platforms using the PS3 hypervisor.  Enabling this
+          option will allow building otheros.bld, a kernel image suitable
+          for programming into flash memory, and vmlinux, a kernel image
+          suitable for loading via kexec.
 
 menu "PS3 Platform Options"
         depends on PPC_PS3
diff --git a/arch/powerpc/platforms/ps3/device-init.c b/arch/powerpc/platforms/ps3/device-init.c
index 825ebb2cbc2a..ce15cada88d4 100644
--- a/arch/powerpc/platforms/ps3/device-init.c
+++ b/arch/powerpc/platforms/ps3/device-init.c
@@ -273,55 +273,58 @@ static int ps3stor_wait_for_completion(u64 dev_id, u64 tag,
 
 static int ps3_storage_wait_for_device(const struct ps3_repository_device *repo)
 {
+        int error = -ENODEV;
         int result;
         const u64 notification_dev_id = (u64)-1LL;
         const unsigned int timeout = HZ;
         u64 lpar;
         u64 tag;
+        void *buf;
+        enum ps3_notify_type {
+                notify_device_ready = 0,
+                notify_region_probe = 1,
+                notify_region_update = 2,
+        };
         struct {
                 u64 operation_code;     /* must be zero */
-                u64 event_mask;         /* 1 = device ready */
+                u64 event_mask;         /* OR of 1UL << enum ps3_notify_type */
         } *notify_cmd;
         struct {
-                u64 event_type;         /* notify_device_ready */
+                u64 event_type;         /* enum ps3_notify_type */
                 u64 bus_id;
                 u64 dev_id;
                 u64 dev_type;
                 u64 dev_port;
         } *notify_event;
-        enum {
-                notify_device_ready = 1
-        };
 
         pr_debug(" -> %s:%u: bus_id %u, dev_id %u, dev_type %u\n", __func__,
                  __LINE__, repo->bus_id, repo->dev_id, repo->dev_type);
 
-        notify_cmd = kzalloc(512, GFP_KERNEL);
-        notify_event = (void *)notify_cmd;
-        if (!notify_cmd)
+        buf = kzalloc(512, GFP_KERNEL);
+        if (!buf)
                 return -ENOMEM;
 
-        lpar = ps3_mm_phys_to_lpar(__pa(notify_cmd));
+        lpar = ps3_mm_phys_to_lpar(__pa(buf));
+        notify_cmd = buf;
+        notify_event = buf;
 
         result = lv1_open_device(repo->bus_id, notification_dev_id, 0);
         if (result) {
                 printk(KERN_ERR "%s:%u: lv1_open_device %s\n", __func__,
                        __LINE__, ps3_result(result));
-                result = -ENODEV;
                 goto fail_free;
         }
 
         /* Setup and write the request for device notification. */
 
-        notify_cmd->operation_code = 0; /* must be zero */
-        notify_cmd->event_mask = 0x01;  /* device ready */
+        notify_cmd->operation_code = 0; /* must be zero */
+        notify_cmd->event_mask = 1UL << notify_region_probe;
 
         result = lv1_storage_write(notification_dev_id, 0, 0, 1, 0, lpar,
                                    &tag);
         if (result) {
                 printk(KERN_ERR "%s:%u: write failed %s\n", __func__, __LINE__,
                        ps3_result(result));
-                result = -ENODEV;
                 goto fail_close;
         }
 
@@ -332,13 +335,11 @@ static int ps3_storage_wait_for_device(const struct ps3_repository_device *repo)
         if (result) {
                 printk(KERN_ERR "%s:%u: write not completed %s\n", __func__,
                        __LINE__, ps3_result(result));
-                result = -ENODEV;
                 goto fail_close;
         }
 
         /* Loop here processing the requested notification events. */
 
-        result = -ENODEV;
         while (1) {
                 memset(notify_event, 0, sizeof(*notify_event));
 
@@ -358,7 +359,7 @@ static int ps3_storage_wait_for_device(const struct ps3_repository_device *repo)
                         break;
                 }
 
-                if (notify_event->event_type != notify_device_ready ||
+                if (notify_event->event_type != notify_region_probe ||
                     notify_event->bus_id != repo->bus_id) {
                         pr_debug("%s:%u: bad notify_event: event %lu, "
                                  "dev_id %lu, dev_type %lu\n",
@@ -371,7 +372,7 @@ static int ps3_storage_wait_for_device(const struct ps3_repository_device *repo)
                     notify_event->dev_type == repo->dev_type) {
                         pr_debug("%s:%u: device ready: dev_id %u\n", __func__,
                                  __LINE__, repo->dev_id);
-                        result = 0;
+                        error = 0;
                         break;
                 }
 
@@ -386,9 +387,9 @@ static int ps3_storage_wait_for_device(const struct ps3_repository_device *repo)
 fail_close:
         lv1_close_device(repo->bus_id, notification_dev_id);
 fail_free:
-        kfree(notify_cmd);
+        kfree(buf);
         pr_debug(" <- %s:%u\n", __func__, __LINE__);
-        return result;
+        return error;
 }
 
 static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
diff --git a/arch/powerpc/platforms/ps3/spu.c b/arch/powerpc/platforms/ps3/spu.c
index 502d80ed982b..ac2a4b8a4c14 100644
--- a/arch/powerpc/platforms/ps3/spu.c
+++ b/arch/powerpc/platforms/ps3/spu.c
@@ -414,10 +414,16 @@ static int __init ps3_enumerate_spus(int (*fn)(void *data))
         return num_resource_id;
 }
 
+static int ps3_init_affinity(void)
+{
+        return 0;
+}
+
 const struct spu_management_ops spu_management_ps3_ops = {
         .enumerate_spus = ps3_enumerate_spus,
         .create_spu = ps3_create_spu,
         .destroy_spu = ps3_destroy_spu,
+        .init_affinity = ps3_init_affinity,
 };
 
 /* spu_priv1_ops */
diff --git a/arch/ppc/kernel/misc.S b/arch/ppc/kernel/misc.S
index 0da55368655c..a22e1f4d94c8 100644
--- a/arch/ppc/kernel/misc.S
+++ b/arch/ppc/kernel/misc.S
@@ -237,9 +237,19 @@ _GLOBAL(_tlbie)
         mfspr   r4,SPRN_MMUCR
         mfspr   r5,SPRN_PID                     /* Get PID */
         rlwimi  r4,r5,0,24,31                   /* Set TID */
-        mtspr   SPRN_MMUCR,r4
 
+        /* We have to run the search with interrupts disabled, even critical
+         * and debug interrupts (in fact the only critical exceptions we have
+         * are debug and machine check).  Otherwise  an interrupt which causes
+         * a TLB miss can clobber the MMUCR between the mtspr and the tlbsx. */
+        mfmsr   r5
+        lis     r6,(MSR_EE|MSR_CE|MSR_ME|MSR_DE)@ha
+        addi    r6,r6,(MSR_EE|MSR_CE|MSR_ME|MSR_DE)@l
+        andc    r6,r5,r6
+        mtmsr   r6
+        mtspr   SPRN_MMUCR,r4
         tlbsx.  r3, 0, r3
+        mtmsr   r5
         bne     10f
         sync
         /* There are only 64 TLB entries, so r3 < 64,
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 098c62c29f9c..b71132166f60 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -109,10 +109,6 @@ config HOTPLUG_CPU
           can be controlled through /sys/devices/system/cpu/cpu#.
           Say N if you want to disable CPU hotplug.
 
-config DEFAULT_MIGRATION_COST
-        int
-        default "1000000"
-
 config MATHEMU
         bool "IEEE FPU emulation"
         depends on MARCH_G5
diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
index 8e1ea1c40128..ad4ca75c0f04 100644
--- a/arch/s390/hypfs/inode.c
+++ b/arch/s390/hypfs/inode.c
@@ -17,6 +17,8 @@
 #include <linux/parser.h>
 #include <linux/sysfs.h>
 #include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/mount.h>
 #include <asm/ebcdic.h>
 #include "hypfs.h"
 
@@ -256,6 +258,15 @@ static int hypfs_parse_options(char *options, struct super_block *sb)
         return 0;
 }
 
+static int hypfs_show_options(struct seq_file *s, struct vfsmount *mnt)
+{
+        struct hypfs_sb_info *hypfs_info = mnt->mnt_sb->s_fs_info;
+
+        seq_printf(s, ",uid=%u", hypfs_info->uid);
+        seq_printf(s, ",gid=%u", hypfs_info->gid);
+        return 0;
+}
+
 static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct inode *root_inode;
@@ -459,6 +470,7 @@ static struct file_system_type hypfs_type = {
 static struct super_operations hypfs_s_ops = {
         .statfs         = simple_statfs,
         .drop_inode     = hypfs_drop_inode,
+        .show_options   = hypfs_show_options,
 };
 
 static decl_subsys(s390, NULL, NULL);
diff --git a/arch/sh/kernel/early_printk.c b/arch/sh/kernel/early_printk.c
index 9833493d8867..80b637c30203 100644
--- a/arch/sh/kernel/early_printk.c
+++ b/arch/sh/kernel/early_printk.c
@@ -76,7 +76,7 @@ static void scif_sercon_putc(int c)
         sci_in(&scif_port, SCxSR);
         sci_out(&scif_port, SCxSR, 0xf3 & ~(0x20 | 0x40));
 
-        while ((sci_in(&scif_port, SCxSR) & 0x40) == 0);
+        while ((sci_in(&scif_port, SCxSR) & 0x40) == 0)
                 ;
 
         if (c == '\n')
diff --git a/arch/sh/kernel/machvec.c b/arch/sh/kernel/machvec.c
index 23c5948f0124..129b2cfd18a8 100644
--- a/arch/sh/kernel/machvec.c
+++ b/arch/sh/kernel/machvec.c
@@ -91,6 +91,13 @@ void __init sh_mv_setup(void)
                                 (unsigned long)&__machvec_start);
 
                 /*
+                 * Sanity check for machvec section alignment. Ensure
+                 * __initmv hasn't been misused.
+                 */
+                if (machvec_size % sizeof(struct sh_machine_vector))
+                        panic("machvec misaligned, invalid __initmv use?");
+
+                /*
                  * If the machvec hasn't been preselected, use the first
                  * vector (usually the only one) from .machvec.init.
                  */
diff --git a/arch/sh/kernel/ptrace.c b/arch/sh/kernel/ptrace.c
index 891d1d46c902..f64a2d2416d4 100644
--- a/arch/sh/kernel/ptrace.c
+++ b/arch/sh/kernel/ptrace.c
@@ -93,6 +93,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
         case PTRACE_PEEKTEXT: /* read word at location addr. */
         case PTRACE_PEEKDATA:
                 ret = generic_ptrace_peekdata(child, addr, data);
+                break;
 
         /* read the word at location addr in the USER area. */
         case PTRACE_PEEKUSR: {
diff --git a/arch/sh64/kernel/setup.c b/arch/sh64/kernel/setup.c
index 53e9d20a874a..2b7264c0c6f7 100644
--- a/arch/sh64/kernel/setup.c
+++ b/arch/sh64/kernel/setup.c
@@ -59,10 +59,6 @@
 #include <asm/setup.h>
 #include <asm/smp.h>
 
-#ifdef CONFIG_VT
-#include <linux/console.h>
-#endif
-
 struct screen_info screen_info;
 
 #ifdef CONFIG_BLK_DEV_RAM
diff --git a/arch/sh64/kernel/signal.c b/arch/sh64/kernel/signal.c
index 0bb4a8f94276..79fc48cf54c6 100644
--- a/arch/sh64/kernel/signal.c
+++ b/arch/sh64/kernel/signal.c
@@ -25,7 +25,6 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/stddef.h>
-#include <linux/personality.h>
 #include <asm/ucontext.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
diff --git a/arch/sparc/kernel/ebus.c b/arch/sparc/kernel/ebus.c
index ac352eb6dff3..e2d02fd13f35 100644
--- a/arch/sparc/kernel/ebus.c
+++ b/arch/sparc/kernel/ebus.c
@@ -238,6 +238,7 @@ void __init fill_ebus_device(struct device_node *dp, struct linux_ebus_device *d
         sd = &dev->ofdev.dev.archdata;
         sd->prom_node = dp;
         sd->op = &dev->ofdev;
+        sd->iommu = dev->bus->ofdev.dev.parent->archdata.iommu;
 
         dev->ofdev.node = dp;
         dev->ofdev.dev.parent = &dev->bus->ofdev.dev;
diff --git a/arch/sparc/mm/init.c b/arch/sparc/mm/init.c
index a1bef07755a9..c13e6cd279ac 100644
--- a/arch/sparc/mm/init.c
+++ b/arch/sparc/mm/init.c
@@ -206,8 +206,7 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
 #ifdef CONFIG_BLK_DEV_INITRD
         /* Now have to check initial ramdisk, so that bootmap does not overwrite it */
         if (sparc_ramdisk_image) {
-                if (sparc_ramdisk_image >= (unsigned long)&_end - 2 * PAGE_SIZE)
-                        sparc_ramdisk_image -= KERNBASE;
+                sparc_ramdisk_image -= KERNBASE;
                 initrd_start = sparc_ramdisk_image + phys_base;
                 initrd_end = initrd_start + sparc_ramdisk_size;
                 if (initrd_end > end_of_phys_memory) {
diff --git a/arch/sparc/mm/io-unit.c b/arch/sparc/mm/io-unit.c
index 4ccda77d08d6..7c89893b1fe8 100644
--- a/arch/sparc/mm/io-unit.c
+++ b/arch/sparc/mm/io-unit.c
@@ -66,7 +66,7 @@ iounit_init(int sbi_node, int io_node, struct sbus_bus *sbus)
         }
         if(!xpt) panic("Cannot map External Page Table.");
         
-        sbus->iommu = (struct iommu_struct *)iounit;
+        sbus->ofdev.dev.archdata.iommu = iounit;
         iounit->page_table = xpt;
         spin_lock_init(&iounit->lock);
         
@@ -127,7 +127,7 @@ nexti:	scan = find_next_zero_bit(iounit->bmap, limit, scan);
 static __u32 iounit_get_scsi_one(char *vaddr, unsigned long len, struct sbus_bus *sbus)
 {
         unsigned long ret, flags;
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
         
         spin_lock_irqsave(&iounit->lock, flags);
         ret = iounit_get_area(iounit, (unsigned long)vaddr, len);
@@ -138,7 +138,7 @@ static __u32 iounit_get_scsi_one(char *vaddr, unsigned long len, struct sbus_bus
 static void iounit_get_scsi_sgl(struct scatterlist *sg, int sz, struct sbus_bus *sbus)
 {
         unsigned long flags;
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
 
         /* FIXME: Cache some resolved pages - often several sg entries are to the same page */
         spin_lock_irqsave(&iounit->lock, flags);
@@ -153,7 +153,7 @@ static void iounit_get_scsi_sgl(struct scatterlist *sg, int sz, struct sbus_bus
 static void iounit_release_scsi_one(__u32 vaddr, unsigned long len, struct sbus_bus *sbus)
 {
         unsigned long flags;
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
         
         spin_lock_irqsave(&iounit->lock, flags);
         len = ((vaddr & ~PAGE_MASK) + len + (PAGE_SIZE-1)) >> PAGE_SHIFT;
@@ -168,7 +168,7 @@ static void iounit_release_scsi_sgl(struct scatterlist *sg, int sz, struct sbus_
 {
         unsigned long flags;
         unsigned long vaddr, len;
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
 
         spin_lock_irqsave(&iounit->lock, flags);
         while (sz != 0) {
@@ -211,7 +211,7 @@ static int iounit_map_dma_area(dma_addr_t *pba, unsigned long va, __u32 addr, in
                         i = ((addr - IOUNIT_DMA_BASE) >> PAGE_SHIFT);
 
                         for_each_sbus(sbus) {
-                                struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+                                struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
 
                                 iopte = (iopte_t *)(iounit->page_table + i);
                                 *iopte = MKIOPTE(__pa(page));
@@ -235,7 +235,7 @@ static void iounit_unmap_dma_area(unsigned long addr, int len)
 static struct page *iounit_translate_dvma(unsigned long addr)
 {
         struct sbus_bus *sbus = sbus_root;      /* They are all the same */
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
         int i;
         iopte_t *iopte;
 
@@ -279,7 +279,7 @@ __u32 iounit_map_dma_init(struct sbus_bus *sbus, int size)
         unsigned long rotor, scan, limit;
         unsigned long flags;
         __u32 ret;
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
 
         npages = (size + (PAGE_SIZE-1)) >> PAGE_SHIFT;
         i = 0x0213;
@@ -315,7 +315,7 @@ nexti:	scan = find_next_zero_bit(iounit->bmap, limit, scan);
 __u32 iounit_map_dma_page(__u32 vaddr, void *addr, struct sbus_bus *sbus)
 {
         int scan = (vaddr - IOUNIT_DMA_BASE) >> PAGE_SHIFT;
-        struct iounit_struct *iounit = (struct iounit_struct *)sbus->iommu;
+        struct iounit_struct *iounit = sbus->ofdev.dev.archdata.iommu;
         
         iounit->page_table[scan] = MKIOPTE(__pa(((unsigned long)addr) & PAGE_MASK));
         return vaddr + (((unsigned long)addr) & ~PAGE_MASK);
diff --git a/arch/sparc/mm/iommu.c b/arch/sparc/mm/iommu.c
index be042efd1ba4..52e907af9d29 100644
--- a/arch/sparc/mm/iommu.c
+++ b/arch/sparc/mm/iommu.c
@@ -132,7 +132,7 @@ iommu_init(int iommund, struct sbus_bus *sbus)
             impl, vers, iommu->page_table,
             (int)(IOMMU_NPTES*sizeof(iopte_t)), (int)IOMMU_NPTES);
 
-        sbus->iommu = iommu;
+        sbus->ofdev.dev.archdata.iommu = iommu;
 }
 
 /* This begs to be btfixup-ed by srmmu. */
@@ -166,7 +166,7 @@ static void iommu_flush_iotlb(iopte_t *iopte, unsigned int niopte)
 
 static u32 iommu_get_one(struct page *page, int npages, struct sbus_bus *sbus)
 {
-        struct iommu_struct *iommu = sbus->iommu;
+        struct iommu_struct *iommu = sbus->ofdev.dev.archdata.iommu;
         int ioptex;
         iopte_t *iopte, *iopte0;
         unsigned int busa, busa0;
@@ -291,7 +291,7 @@ static void iommu_get_scsi_sgl_pflush(struct scatterlist *sg, int sz, struct sbu
 
 static void iommu_release_one(u32 busa, int npages, struct sbus_bus *sbus)
 {
-        struct iommu_struct *iommu = sbus->iommu;
+        struct iommu_struct *iommu = sbus->ofdev.dev.archdata.iommu;
         int ioptex;
         int i;
 
@@ -334,7 +334,7 @@ static int iommu_map_dma_area(dma_addr_t *pba, unsigned long va,
     unsigned long addr, int len)
 {
         unsigned long page, end;
-        struct iommu_struct *iommu = sbus_root->iommu;
+        struct iommu_struct *iommu = sbus_root->ofdev.dev.archdata.iommu;
         iopte_t *iopte = iommu->page_table;
         iopte_t *first;
         int ioptex;
@@ -399,7 +399,7 @@ static int iommu_map_dma_area(dma_addr_t *pba, unsigned long va,
 
 static void iommu_unmap_dma_area(unsigned long busa, int len)
 {
-        struct iommu_struct *iommu = sbus_root->iommu;
+        struct iommu_struct *iommu = sbus_root->ofdev.dev.archdata.iommu;
         iopte_t *iopte = iommu->page_table;
         unsigned long end;
         int ioptex = (busa - iommu->start) >> PAGE_SHIFT;
@@ -420,7 +420,7 @@ static void iommu_unmap_dma_area(unsigned long busa, int len)
 
 static struct page *iommu_translate_dvma(unsigned long busa)
 {
-        struct iommu_struct *iommu = sbus_root->iommu;
+        struct iommu_struct *iommu = sbus_root->ofdev.dev.archdata.iommu;
         iopte_t *iopte = iommu->page_table;
 
         iopte += ((busa - iommu->start) >> PAGE_SHIFT);
diff --git a/arch/sparc/mm/sun4c.c b/arch/sparc/mm/sun4c.c
index 79d60d86f6f8..005a3e72d4f2 100644
--- a/arch/sparc/mm/sun4c.c
+++ b/arch/sparc/mm/sun4c.c
@@ -268,7 +268,6 @@ static inline void sun4c_init_clean_mmu(unsigned long kernel_end)
         unsigned char savectx, ctx;
 
         savectx = sun4c_get_context();
-        kernel_end = SUN4C_REAL_PGDIR_ALIGN(kernel_end);
         for (ctx = 0; ctx < num_contexts; ctx++) {
                 sun4c_set_context(ctx);
                 for (vaddr = 0; vaddr < 0x20000000; vaddr += SUN4C_REAL_PGDIR_SIZE)
@@ -2064,7 +2063,6 @@ void __init sun4c_paging_init(void)
         unsigned long end_pfn, pages_avail;
 
         kernel_end = (unsigned long) &end;
-        kernel_end += (SUN4C_REAL_PGDIR_SIZE * 4);
         kernel_end = SUN4C_REAL_PGDIR_ALIGN(kernel_end);
 
         pages_avail = 0;
diff --git a/arch/sparc64/kernel/head.S b/arch/sparc64/kernel/head.S
index ac18bd8e273f..63144ad476f6 100644
--- a/arch/sparc64/kernel/head.S
+++ b/arch/sparc64/kernel/head.S
@@ -501,7 +501,7 @@ niagara_tlb_fixup:
         cmp     %g1, SUN4V_CHIP_NIAGARA1
         be,pt   %xcc, niagara_patch
          cmp    %g1, SUN4V_CHIP_NIAGARA2
-        be,pt   %xcc, niagara_patch
+        be,pt   %xcc, niagara2_patch
          nop
 
         call    generic_patch_copyops
@@ -512,6 +512,15 @@ niagara_tlb_fixup:
          nop
 
         ba,a,pt %xcc, 80f
+niagara2_patch:
+        call    niagara2_patch_copyops
+         nop
+        call    niagara_patch_bzero
+         nop
+        call    niagara2_patch_pageops
+         nop
+
+        ba,a,pt %xcc, 80f
 
 niagara_patch:
         call    niagara_patch_copyops
@@ -706,12 +715,13 @@ setup_trap_table:
 
         membar  #Sync
 
+        BRANCH_IF_SUN4V(o2, 1f)
+
         /* Kill PROM timer */
         sethi   %hi(0x80000000), %o2
         sllx    %o2, 32, %o2
         wr      %o2, 0, %tick_cmpr
 
-        BRANCH_IF_SUN4V(o2, 1f)
         BRANCH_IF_ANY_CHEETAH(o2, o3, 1f)
 
         ba,pt   %xcc, 2f
diff --git a/arch/sparc64/kernel/mdesc.c b/arch/sparc64/kernel/mdesc.c
index 95059c2ec414..9f22e4ff6015 100644
--- a/arch/sparc64/kernel/mdesc.c
+++ b/arch/sparc64/kernel/mdesc.c
@@ -9,6 +9,7 @@
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
+#include <linux/miscdevice.h>
 
 #include <asm/hypervisor.h>
 #include <asm/mdesc.h>
@@ -836,6 +837,43 @@ void __devinit mdesc_fill_in_cpu_data(cpumask_t mask)
         mdesc_release(hp);
 }
 
+static ssize_t mdesc_read(struct file *file, char __user *buf,
+                          size_t len, loff_t *offp)
+{
+        struct mdesc_handle *hp = mdesc_grab();
+        int err;
+
+        if (!hp)
+                return -ENODEV;
+
+        err = hp->handle_size;
+        if (len < hp->handle_size)
+                err = -EMSGSIZE;
+        else if (copy_to_user(buf, &hp->mdesc, hp->handle_size))
+                err = -EFAULT;
+        mdesc_release(hp);
+
+        return err;
+}
+
+static const struct file_operations mdesc_fops = {
+        .read   = mdesc_read,
+        .owner  = THIS_MODULE,
+};
+
+static struct miscdevice mdesc_misc = {
+        .minor  = MISC_DYNAMIC_MINOR,
+        .name   = "mdesc",
+        .fops   = &mdesc_fops,
+};
+
+static int __init mdesc_misc_init(void)
+{
+        return misc_register(&mdesc_misc);
+}
+
+__initcall(mdesc_misc_init);
+
 void __init sun4v_mdesc_init(void)
 {
         struct mdesc_handle *hp;
diff --git a/arch/sparc64/kernel/trampoline.S b/arch/sparc64/kernel/trampoline.S
index 9448595f9063..9533a25ce5d2 100644
--- a/arch/sparc64/kernel/trampoline.S
+++ b/arch/sparc64/kernel/trampoline.S
@@ -95,14 +95,13 @@ spitfire_startup:
         membar          #Sync
 
 startup_continue:
+        mov             %o0, %l0
+        BRANCH_IF_SUN4V(g1, niagara_lock_tlb)
+
         sethi           %hi(0x80000000), %g2
         sllx            %g2, 32, %g2
         wr              %g2, 0, %tick_cmpr
 
-        mov             %o0, %l0
-
-        BRANCH_IF_SUN4V(g1, niagara_lock_tlb)
-
         /* Call OBP by hand to lock KERNBASE into i/d tlbs.
          * We lock 2 consequetive entries if we are 'bigkernel'.
          */
diff --git a/arch/sparc64/lib/Makefile b/arch/sparc64/lib/Makefile
index f95fbfa3eeb8..f095e13910bc 100644
--- a/arch/sparc64/lib/Makefile
+++ b/arch/sparc64/lib/Makefile
@@ -13,6 +13,8 @@ lib-y := PeeCeeI.o copy_page.o clear_page.o strlen.o strncmp.o \
          U3memcpy.o U3copy_from_user.o U3copy_to_user.o U3patch.o \
          NGmemcpy.o NGcopy_from_user.o NGcopy_to_user.o NGpatch.o \
          NGpage.o NGbzero.o \
+         NG2memcpy.o NG2copy_from_user.o NG2copy_to_user.o NG2patch.o \
+         NG2page.o \
          GENmemcpy.o GENcopy_from_user.o GENcopy_to_user.o GENpatch.o \
          GENpage.o GENbzero.o \
          copy_in_user.o user_fixup.o memmove.o \
diff --git a/arch/sparc64/lib/NG2copy_from_user.S b/arch/sparc64/lib/NG2copy_from_user.S
new file mode 100644
index 000000000000..c77ef5f22102
--- /dev/null
+++ b/arch/sparc64/lib/NG2copy_from_user.S
@@ -0,0 +1,40 @@
+/* NG2copy_from_user.S: Niagara-2 optimized copy from userspace.
+ *
+ * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ */
+
+#define EX_LD(x)                \
+98:     x;                      \
+        .section .fixup;        \
+        .align 4;               \
+99:     wr      %g0, ASI_AIUS, %asi;\
+        retl;                   \
+         mov    1, %o0;         \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, 99b;         \
+        .text;                  \
+        .align 4;
+
+#ifndef ASI_AIUS
+#define ASI_AIUS        0x11
+#endif
+
+#ifndef ASI_BLK_AIUS_4V
+#define ASI_BLK_AIUS_4V 0x17
+#endif
+
+#define FUNC_NAME               NG2copy_from_user
+#define LOAD(type,addr,dest)    type##a [addr] %asi, dest
+#define LOAD_BLK(addr,dest)     ldda [addr] ASI_BLK_AIUS_4V, dest
+#define EX_RETVAL(x)            0
+
+#ifdef __KERNEL__
+#define PREAMBLE                                        \
+        rd              %asi, %g1;                      \
+        cmp             %g1, ASI_AIUS;                  \
+        bne,pn          %icc, memcpy_user_stub;         \
+         nop
+#endif
+
+#include "NG2memcpy.S"
diff --git a/arch/sparc64/lib/NG2copy_to_user.S b/arch/sparc64/lib/NG2copy_to_user.S
new file mode 100644
index 000000000000..4bd4093acbbd
--- /dev/null
+++ b/arch/sparc64/lib/NG2copy_to_user.S
@@ -0,0 +1,49 @@
+/* NG2copy_to_user.S: Niagara-2 optimized copy to userspace.
+ *
+ * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ */
+
+#define EX_ST(x)                \
+98:     x;                      \
+        .section .fixup;        \
+        .align 4;               \
+99:     wr      %g0, ASI_AIUS, %asi;\
+        retl;                   \
+         mov    1, %o0;         \
+        .section __ex_table,"a";\
+        .align 4;               \
+        .word 98b, 99b;         \
+        .text;                  \
+        .align 4;
+
+#ifndef ASI_AIUS
+#define ASI_AIUS        0x11
+#endif
+
+#ifndef ASI_BLK_AIUS_4V
+#define ASI_BLK_AIUS_4V 0x17
+#endif
+
+#ifndef ASI_BLK_INIT_QUAD_LDD_AIUS
+#define ASI_BLK_INIT_QUAD_LDD_AIUS 0x23
+#endif
+
+#define FUNC_NAME               NG2copy_to_user
+#define STORE(type,src,addr)    type##a src, [addr] ASI_AIUS
+#define STORE_ASI               ASI_BLK_INIT_QUAD_LDD_AIUS
+#define STORE_BLK(src,addr)     stda src, [addr] ASI_BLK_AIUS_4V
+#define EX_RETVAL(x)            0
+
+#ifdef __KERNEL__
+        /* Writing to %asi is _expensive_ so we hardcode it.
+         * Reading %asi to check for KERNEL_DS is comparatively
+         * cheap.
+         */
+#define PREAMBLE                                        \
+        rd              %asi, %g1;                      \
+        cmp             %g1, ASI_AIUS;                  \
+        bne,pn          %icc, memcpy_user_stub;         \
+         nop
+#endif
+
+#include "NG2memcpy.S"
diff --git a/arch/sparc64/lib/NG2memcpy.S b/arch/sparc64/lib/NG2memcpy.S
new file mode 100644
index 000000000000..0aed75653b50
--- /dev/null
+++ b/arch/sparc64/lib/NG2memcpy.S
@@ -0,0 +1,520 @@
+/* NG2memcpy.S: Niagara-2 optimized memcpy.
+ *
+ * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ */
+
+#ifdef __KERNEL__
+#include <asm/visasm.h>
+#include <asm/asi.h>
+#define GLOBAL_SPARE    %g7
+#else
+#define ASI_PNF 0x82
+#define ASI_BLK_P 0xf0
+#define ASI_BLK_INIT_QUAD_LDD_P 0xe2
+#define FPRS_FEF  0x04
+#ifdef MEMCPY_DEBUG
+#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs; \
+                     clr %g1; clr %g2; clr %g3; subcc %g0, %g0, %g0;
+#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
+#else
+#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs
+#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
+#endif
+#define GLOBAL_SPARE    %g5
+#endif
+
+#ifndef STORE_ASI
+#ifndef SIMULATE_NIAGARA_ON_NON_NIAGARA
+#define STORE_ASI       ASI_BLK_INIT_QUAD_LDD_P
+#else
+#define STORE_ASI       0x80            /* ASI_P */
+#endif
+#endif
+
+#ifndef EX_LD
+#define EX_LD(x)        x
+#endif
+
+#ifndef EX_ST
+#define EX_ST(x)        x
+#endif
+
+#ifndef EX_RETVAL
+#define EX_RETVAL(x)    x
+#endif
+
+#ifndef LOAD
+#define LOAD(type,addr,dest)    type [addr], dest
+#endif
+
+#ifndef LOAD_BLK
+#define LOAD_BLK(addr,dest)     ldda [addr] ASI_BLK_P, dest
+#endif
+
+#ifndef STORE
+#ifndef MEMCPY_DEBUG
+#define STORE(type,src,addr)    type src, [addr]
+#else
+#define STORE(type,src,addr)    type##a src, [addr] 0x80
+#endif
+#endif
+
+#ifndef STORE_BLK
+#define STORE_BLK(src,addr)     stda src, [addr] ASI_BLK_P
+#endif
+
+#ifndef STORE_INIT
+#define STORE_INIT(src,addr)    stxa src, [addr] STORE_ASI
+#endif
+
+#ifndef FUNC_NAME
+#define FUNC_NAME       NG2memcpy
+#endif
+
+#ifndef PREAMBLE
+#define PREAMBLE
+#endif
+
+#ifndef XCC
+#define XCC xcc
+#endif
+
+#define FREG_FROB(x0, x1, x2, x3, x4, x5, x6, x7, x8) \
+        faligndata      %x0, %x1, %f0; \
+        faligndata      %x1, %x2, %f2; \
+        faligndata      %x2, %x3, %f4; \
+        faligndata      %x3, %x4, %f6; \
+        faligndata      %x4, %x5, %f8; \
+        faligndata      %x5, %x6, %f10; \
+        faligndata      %x6, %x7, %f12; \
+        faligndata      %x7, %x8, %f14;
+
+#define FREG_MOVE_1(x0) \
+        fmovd           %x0, %f0;
+#define FREG_MOVE_2(x0, x1) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2;
+#define FREG_MOVE_3(x0, x1, x2) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2; \
+        fmovd           %x2, %f4;
+#define FREG_MOVE_4(x0, x1, x2, x3) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2; \
+        fmovd           %x2, %f4; \
+        fmovd           %x3, %f6;
+#define FREG_MOVE_5(x0, x1, x2, x3, x4) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2; \
+        fmovd           %x2, %f4; \
+        fmovd           %x3, %f6; \
+        fmovd           %x4, %f8;
+#define FREG_MOVE_6(x0, x1, x2, x3, x4, x5) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2; \
+        fmovd           %x2, %f4; \
+        fmovd           %x3, %f6; \
+        fmovd           %x4, %f8; \
+        fmovd           %x5, %f10;
+#define FREG_MOVE_7(x0, x1, x2, x3, x4, x5, x6) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2; \
+        fmovd           %x2, %f4; \
+        fmovd           %x3, %f6; \
+        fmovd           %x4, %f8; \
+        fmovd           %x5, %f10; \
+        fmovd           %x6, %f12;
+#define FREG_MOVE_8(x0, x1, x2, x3, x4, x5, x6, x7) \
+        fmovd           %x0, %f0; \
+        fmovd           %x1, %f2; \
+        fmovd           %x2, %f4; \
+        fmovd           %x3, %f6; \
+        fmovd           %x4, %f8; \
+        fmovd           %x5, %f10; \
+        fmovd           %x6, %f12; \
+        fmovd           %x7, %f14;
+#define FREG_LOAD_1(base, x0) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0))
+#define FREG_LOAD_2(base, x0, x1) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD(LOAD(ldd, base + 0x08, %x1));
+#define FREG_LOAD_3(base, x0, x1, x2) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD(LOAD(ldd, base + 0x10, %x2));
+#define FREG_LOAD_4(base, x0, x1, x2, x3) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD(LOAD(ldd, base + 0x18, %x3));
+#define FREG_LOAD_5(base, x0, x1, x2, x3, x4) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD(LOAD(ldd, base + 0x18, %x3)); \
+        EX_LD(LOAD(ldd, base + 0x20, %x4));
+#define FREG_LOAD_6(base, x0, x1, x2, x3, x4, x5) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD(LOAD(ldd, base + 0x18, %x3)); \
+        EX_LD(LOAD(ldd, base + 0x20, %x4)); \
+        EX_LD(LOAD(ldd, base + 0x28, %x5));
+#define FREG_LOAD_7(base, x0, x1, x2, x3, x4, x5, x6) \
+        EX_LD(LOAD(ldd, base + 0x00, %x0)); \
+        EX_LD(LOAD(ldd, base + 0x08, %x1)); \
+        EX_LD(LOAD(ldd, base + 0x10, %x2)); \
+        EX_LD(LOAD(ldd, base + 0x18, %x3)); \
+        EX_LD(LOAD(ldd, base + 0x20, %x4)); \
+        EX_LD(LOAD(ldd, base + 0x28, %x5)); \
+        EX_LD(LOAD(ldd, base + 0x30, %x6));
+
+        .register       %g2,#scratch
+        .register       %g3,#scratch
+
+        .text
+        .align          64
+
+        .globl  FUNC_NAME
+        .type   FUNC_NAME,#function
+FUNC_NAME:      /* %o0=dst, %o1=src, %o2=len */
+        srlx            %o2, 31, %g2
+        cmp             %g2, 0
+        tne             %xcc, 5
+        PREAMBLE
+        mov             %o0, GLOBAL_SPARE
+        cmp             %o2, 0
+        be,pn           %XCC, 85f
+         or             %o0, %o1, %o3
+        cmp             %o2, 16
+        blu,a,pn        %XCC, 80f
+         or             %o3, %o2, %o3
+
+        /* 2 blocks (128 bytes) is the minimum we can do the block
+         * copy with.  We need to ensure that we'll iterate at least
+         * once in the block copy loop.  At worst we'll need to align
+         * the destination to a 64-byte boundary which can chew up
+         * to (64 - 1) bytes from the length before we perform the
+         * block copy loop.
+         *
+         * However, the cut-off point, performance wise, is around
+         * 4 64-byte blocks.
+         */
+        cmp             %o2, (4 * 64)
+        blu,pt          %XCC, 75f
+         andcc          %o3, 0x7, %g0
+
+        /* %o0: dst
+         * %o1: src
+         * %o2: len  (known to be >= 128)
+         *
+         * The block copy loops can use %o4, %g2, %g3 as
+         * temporaries while copying the data.  %o5 must
+         * be preserved between VISEntryHalf and VISExitHalf
+         */
+
+        LOAD(prefetch, %o1 + 0x000, #one_read)
+        LOAD(prefetch, %o1 + 0x040, #one_read)
+        LOAD(prefetch, %o1 + 0x080, #one_read)
+
+        /* Align destination on 64-byte boundary.  */
+        andcc           %o0, (64 - 1), %o4
+        be,pt           %XCC, 2f
+         sub            %o4, 64, %o4
+        sub             %g0, %o4, %o4   ! bytes to align dst
+        sub             %o2, %o4, %o2
+1:      subcc           %o4, 1, %o4
+        EX_LD(LOAD(ldub, %o1, %g1))
+        EX_ST(STORE(stb, %g1, %o0))
+        add             %o1, 1, %o1
+        bne,pt          %XCC, 1b
+        add             %o0, 1, %o0
+
+2:
+        /* Clobbers o5/g1/g2/g3/g7/icc/xcc.  We must preserve
+         * o5 from here until we hit VISExitHalf.
+         */
+        VISEntryHalf
+
+        alignaddr       %o1, %g0, %g0
+
+        add             %o1, (64 - 1), %o4
+        andn            %o4, (64 - 1), %o4
+        andn            %o2, (64 - 1), %g1
+        sub             %o2, %g1, %o2
+
+        and             %o1, (64 - 1), %g2
+        add             %o1, %g1, %o1
+        sub             %o0, %o4, %g3
+        brz,pt          %g2, 190f
+         cmp            %g2, 32
+        blu,a           5f
+         cmp            %g2, 16
+        cmp             %g2, 48
+        blu,a           4f
+         cmp            %g2, 40
+        cmp             %g2, 56
+        blu             170f
+         nop
+        ba,a,pt         %xcc, 180f
+
+4:      /* 32 <= low bits < 48 */
+        blu             150f
+         nop
+        ba,a,pt         %xcc, 160f
+5:      /* 0 < low bits < 32 */
+        blu,a           6f
+         cmp            %g2, 8
+        cmp             %g2, 24
+        blu             130f
+         nop
+        ba,a,pt         %xcc, 140f
+6:      /* 0 < low bits < 16 */
+        bgeu            120f
+         nop
+        /* fall through for 0 < low bits < 8 */
+110:    sub             %o4, 64, %g2
+        EX_LD(LOAD_BLK(%g2, %f0))
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f14, f16)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_8(f16, f18, f20, f22, f24, f26, f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+120:    sub             %o4, 56, %g2
+        FREG_LOAD_7(%g2, f0, f2, f4, f6, f8, f10, f12)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f4, f6, f8, f10, f12, f16, f18)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_7(f18, f20, f22, f24, f26, f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+130:    sub             %o4, 48, %g2
+        FREG_LOAD_6(%g2, f0, f2, f4, f6, f8, f10)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f4, f6, f8, f10, f16, f18, f20)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_6(f20, f22, f24, f26, f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+140:    sub             %o4, 40, %g2
+        FREG_LOAD_5(%g2, f0, f2, f4, f6, f8)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f4, f6, f8, f16, f18, f20, f22)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_5(f22, f24, f26, f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+150:    sub             %o4, 32, %g2
+        FREG_LOAD_4(%g2, f0, f2, f4, f6)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f4, f6, f16, f18, f20, f22, f24)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_4(f24, f26, f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+160:    sub             %o4, 24, %g2
+        FREG_LOAD_3(%g2, f0, f2, f4)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f4, f16, f18, f20, f22, f24, f26)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_3(f26, f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+170:    sub             %o4, 16, %g2
+        FREG_LOAD_2(%g2, f0, f2)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f2, f16, f18, f20, f22, f24, f26, f28)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_2(f28, f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+180:    sub             %o4, 8, %g2
+        FREG_LOAD_1(%g2, f0)
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        EX_LD(LOAD_BLK(%o4, %f16))
+        FREG_FROB(f0, f16, f18, f20, f22, f24, f26, f28, f30)
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        FREG_MOVE_1(f30)
+        subcc           %g1, 64, %g1
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+        ba,pt           %xcc, 195f
+         nop
+
+190:
+1:      EX_ST(STORE_INIT(%g0, %o4 + %g3))
+        subcc           %g1, 64, %g1
+        EX_LD(LOAD_BLK(%o4, %f0))
+        EX_ST(STORE_BLK(%f0, %o4 + %g3))
+        add             %o4, 64, %o4
+        bne,pt          %xcc, 1b
+         LOAD(prefetch, %o4 + 64, #one_read)
+
+195:
+        add             %o4, %g3, %o0
+        membar          #Sync
+
+        VISExitHalf
+
+        /* %o2 contains any final bytes still needed to be copied
+         * over. If anything is left, we copy it one byte at a time.
+         */
+        brz,pt          %o2, 85f
+         sub            %o0, %o1, %o3
+        ba,a,pt         %XCC, 90f
+
+        .align          64
+75: /* 16 < len <= 64 */
+        bne,pn          %XCC, 75f
+         sub            %o0, %o1, %o3
+
+72:
+        andn            %o2, 0xf, %o4
+        and             %o2, 0xf, %o2
+1:      subcc           %o4, 0x10, %o4
+        EX_LD(LOAD(ldx, %o1, %o5))
+        add             %o1, 0x08, %o1
+        EX_LD(LOAD(ldx, %o1, %g1))
+        sub             %o1, 0x08, %o1
+        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        add             %o1, 0x8, %o1
+        EX_ST(STORE(stx, %g1, %o1 + %o3))
+        bgu,pt          %XCC, 1b
+         add            %o1, 0x8, %o1
+73:     andcc           %o2, 0x8, %g0
+        be,pt           %XCC, 1f
+         nop
+        sub             %o2, 0x8, %o2
+        EX_LD(LOAD(ldx, %o1, %o5))
+        EX_ST(STORE(stx, %o5, %o1 + %o3))
+        add             %o1, 0x8, %o1
+1:      andcc           %o2, 0x4, %g0
+        be,pt           %XCC, 1f
+         nop
+        sub             %o2, 0x4, %o2
+        EX_LD(LOAD(lduw, %o1, %o5))
+        EX_ST(STORE(stw, %o5, %o1 + %o3))
+        add             %o1, 0x4, %o1
+1:      cmp             %o2, 0
+        be,pt           %XCC, 85f
+         nop
+        ba,pt           %xcc, 90f
+         nop
+
+75:
+        andcc           %o0, 0x7, %g1
+        sub             %g1, 0x8, %g1
+        be,pn           %icc, 2f
+         sub            %g0, %g1, %g1
+        sub             %o2, %g1, %o2
+
+1:      subcc           %g1, 1, %g1
+        EX_LD(LOAD(ldub, %o1, %o5))
+        EX_ST(STORE(stb, %o5, %o1 + %o3))
+        bgu,pt          %icc, 1b
+         add            %o1, 1, %o1
+
+2:      add             %o1, %o3, %o0
+        andcc           %o1, 0x7, %g1
+        bne,pt          %icc, 8f
+         sll            %g1, 3, %g1
+
+        cmp             %o2, 16
+        bgeu,pt         %icc, 72b
+         nop
+        ba,a,pt         %xcc, 73b
+
+8:      mov             64, %o3
+        andn            %o1, 0x7, %o1
+        EX_LD(LOAD(ldx, %o1, %g2))
+        sub             %o3, %g1, %o3
+        andn            %o2, 0x7, %o4
+        sllx            %g2, %g1, %g2
+1:      add             %o1, 0x8, %o1
+        EX_LD(LOAD(ldx, %o1, %g3))
+        subcc           %o4, 0x8, %o4
+        srlx            %g3, %o3, %o5
+        or              %o5, %g2, %o5
+        EX_ST(STORE(stx, %o5, %o0))
+        add             %o0, 0x8, %o0
+        bgu,pt          %icc, 1b
+         sllx           %g3, %g1, %g2
+
+        srl             %g1, 3, %g1
+        andcc           %o2, 0x7, %o2
+        be,pn           %icc, 85f
+         add            %o1, %g1, %o1
+        ba,pt           %xcc, 90f
+         sub            %o0, %o1, %o3
+
+        .align          64
+80: /* 0 < len <= 16 */
+        andcc           %o3, 0x3, %g0
+        bne,pn          %XCC, 90f
+         sub            %o0, %o1, %o3
+
+1:
+        subcc           %o2, 4, %o2
+        EX_LD(LOAD(lduw, %o1, %g1))
+        EX_ST(STORE(stw, %g1, %o1 + %o3))
+        bgu,pt          %XCC, 1b
+         add            %o1, 4, %o1
+
+85:     retl
+         mov            EX_RETVAL(GLOBAL_SPARE), %o0
+
+        .align          32
+90:
+        subcc           %o2, 1, %o2
+        EX_LD(LOAD(ldub, %o1, %g1))
+        EX_ST(STORE(stb, %g1, %o1 + %o3))
+        bgu,pt          %XCC, 90b
+         add            %o1, 1, %o1
+        retl
+         mov            EX_RETVAL(GLOBAL_SPARE), %o0
+
+        .size           FUNC_NAME, .-FUNC_NAME
diff --git a/arch/sparc64/lib/NG2page.S b/arch/sparc64/lib/NG2page.S
new file mode 100644
index 000000000000..73b6b7c72cbf
--- /dev/null
+++ b/arch/sparc64/lib/NG2page.S
@@ -0,0 +1,61 @@
+/* NG2page.S: Niagara-2 optimized clear and copy page.
+ *
+ * Copyright (C) 2007 (davem@davemloft.net)
+ */
+
+#include <asm/asi.h>
+#include <asm/page.h>
+#include <asm/visasm.h>
+
+        .text
+        .align  32
+
+        /* This is heavily simplified from the sun4u variants
+         * because Niagara-2 does not have any D-cache aliasing issues.
+         */
+NG2copy_user_page:      /* %o0=dest, %o1=src, %o2=vaddr */
+        prefetch        [%o1 + 0x00], #one_read
+        prefetch        [%o1 + 0x40], #one_read
+        VISEntryHalf
+        set             PAGE_SIZE, %g7
+        sub             %o0, %o1, %g3
+1:      stxa            %g0, [%o1 + %g3] ASI_BLK_INIT_QUAD_LDD_P
+        subcc           %g7, 64, %g7
+        ldda            [%o1] ASI_BLK_P, %f0
+        stda            %f0, [%o1 + %g3] ASI_BLK_P
+        add             %o1, 64, %o1
+        bne,pt          %xcc, 1b
+         prefetch       [%o1 + 0x40], #one_read
+        membar          #Sync
+        VISExitHalf
+        retl
+         nop
+
+#define BRANCH_ALWAYS   0x10680000
+#define NOP             0x01000000
+#define NG_DO_PATCH(OLD, NEW)   \
+        sethi   %hi(NEW), %g1; \
+        or      %g1, %lo(NEW), %g1; \
+        sethi   %hi(OLD), %g2; \
+        or      %g2, %lo(OLD), %g2; \
+        sub     %g1, %g2, %g1; \
+        sethi   %hi(BRANCH_ALWAYS), %g3; \
+        sll     %g1, 11, %g1; \
+        srl     %g1, 11 + 2, %g1; \
+        or      %g3, %lo(BRANCH_ALWAYS), %g3; \
+        or      %g3, %g1, %g3; \
+        stw     %g3, [%g2]; \
+        sethi   %hi(NOP), %g3; \
+        or      %g3, %lo(NOP), %g3; \
+        stw     %g3, [%g2 + 0x4]; \
+        flush   %g2;
+
+        .globl  niagara2_patch_pageops
+        .type   niagara2_patch_pageops,#function
+niagara2_patch_pageops:
+        NG_DO_PATCH(copy_user_page, NG2copy_user_page)
+        NG_DO_PATCH(_clear_page, NGclear_page)
+        NG_DO_PATCH(clear_user_page, NGclear_user_page)
+        retl
+         nop
+        .size   niagara2_patch_pageops,.-niagara2_patch_pageops
diff --git a/arch/sparc64/lib/NG2patch.S b/arch/sparc64/lib/NG2patch.S
new file mode 100644
index 000000000000..28c36f06a6d1
--- /dev/null
+++ b/arch/sparc64/lib/NG2patch.S
@@ -0,0 +1,33 @@
+/* NG2patch.S: Patch Ultra-I routines with Niagara-2 variant.
+ *
+ * Copyright (C) 2007 David S. Miller <davem@davemloft.net>
+ */
+
+#define BRANCH_ALWAYS   0x10680000
+#define NOP             0x01000000
+#define NG_DO_PATCH(OLD, NEW)   \
+        sethi   %hi(NEW), %g1; \
+        or      %g1, %lo(NEW), %g1; \
+        sethi   %hi(OLD), %g2; \
+        or      %g2, %lo(OLD), %g2; \
+        sub     %g1, %g2, %g1; \
+        sethi   %hi(BRANCH_ALWAYS), %g3; \
+        sll     %g1, 11, %g1; \
+        srl     %g1, 11 + 2, %g1; \
+        or      %g3, %lo(BRANCH_ALWAYS), %g3; \
+        or      %g3, %g1, %g3; \
+        stw     %g3, [%g2]; \
+        sethi   %hi(NOP), %g3; \
+        or      %g3, %lo(NOP), %g3; \
+        stw     %g3, [%g2 + 0x4]; \
+        flush   %g2;
+
+        .globl  niagara2_patch_copyops
+        .type   niagara2_patch_copyops,#function
+niagara2_patch_copyops:
+        NG_DO_PATCH(memcpy, NG2memcpy)
+        NG_DO_PATCH(___copy_from_user, NG2copy_from_user)
+        NG_DO_PATCH(___copy_to_user, NG2copy_to_user)
+        retl
+         nop
+        .size   niagara2_patch_copyops,.-niagara2_patch_copyops
diff --git a/arch/sparc64/lib/NGpage.S b/arch/sparc64/lib/NGpage.S
index 8ce3a0c9c537..428920de05ba 100644
--- a/arch/sparc64/lib/NGpage.S
+++ b/arch/sparc64/lib/NGpage.S
@@ -45,6 +45,7 @@ NGcopy_user_page:	/* %o0=dest, %o1=src, %o2=vaddr */
         retl
          nop
 
+        .globl          NGclear_page, NGclear_user_page
 NGclear_page:           /* %o0=dest */
 NGclear_user_page:      /* %o0=dest, %o1=vaddr */
         mov             8, %g1
diff --git a/arch/x86_64/Makefile b/arch/x86_64/Makefile
index 128561d3e876..b024e4a86895 100644
--- a/arch/x86_64/Makefile
+++ b/arch/x86_64/Makefile
@@ -57,8 +57,8 @@ cflags-y += $(call cc-option,-mno-sse -mno-mmx -mno-sse2 -mno-3dnow,)
 cflags-y += -maccumulate-outgoing-args
 
 # do binutils support CFI?
-cflags-y += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
-AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
+cflags-y += $(call as-instr,.cfi_startproc\n.cfi_rel_offset rsp${comma}0\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
+AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_rel_offset rsp${comma}0\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
 
 # is .cfi_signal_frame supported too?
 cflags-y += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
diff --git a/arch/x86_64/boot/compressed/head.S b/arch/x86_64/boot/compressed/head.S
index 1312bfaff306..9fd8030cc54f 100644
--- a/arch/x86_64/boot/compressed/head.S
+++ b/arch/x86_64/boot/compressed/head.S
@@ -195,6 +195,11 @@ ENTRY(startup_64)
         movl    %eax, %ds
         movl    %eax, %es
         movl    %eax, %ss
+        movl    %eax, %fs
+        movl    %eax, %gs
+        lldt    %ax
+        movl    $0x20, %eax
+        ltr     %ax
 
         /* Compute the decompressed kernel start address.  It is where
          * we were loaded at aligned to a 2M boundary. %rbp contains the
@@ -295,6 +300,8 @@ gdt:
         .quad   0x0000000000000000      /* NULL descriptor */
         .quad   0x00af9a000000ffff      /* __KERNEL_CS */
         .quad   0x00cf92000000ffff      /* __KERNEL_DS */
+        .quad   0x0080890000000000      /* TS descriptor */
+        .quad   0x0000000000000000      /* TS continued */
 gdt_end:
         .bss
 /* Stack for uncompression */
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index 900ff38d68de..925758dbca0c 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -791,10 +791,8 @@ static void setup_APIC_timer(unsigned int clocks)
 
         /* wait for irq slice */
         if (hpet_address && hpet_use_timer) {
-                int trigger = hpet_readl(HPET_T0_CMP);
-                while (hpet_readl(HPET_COUNTER) >= trigger)
-                        /* do nothing */ ;
-                while (hpet_readl(HPET_COUNTER) <  trigger)
+                u32 trigger = hpet_readl(HPET_T0_CMP);
+                while (hpet_readl(HPET_T0_CMP) == trigger)
                         /* do nothing */ ;
         } else {
                 int c1, c2;
diff --git a/arch/x86_64/kernel/head.S b/arch/x86_64/kernel/head.S
index e89abcdbdde8..b6167fe3330e 100644
--- a/arch/x86_64/kernel/head.S
+++ b/arch/x86_64/kernel/head.S
@@ -345,8 +345,7 @@ NEXT_PAGE(level2_kernel_pgt)
         /* 40MB kernel mapping. The kernel code cannot be bigger than that.
            When you change this change KERNEL_TEXT_SIZE in page.h too. */
         /* (2^48-(2*1024*1024*1024)-((2^39)*511)-((2^30)*510)) = 0 */
-        PMDS(0x0000000000000000, __PAGE_KERNEL_LARGE_EXEC|_PAGE_GLOBAL,
-                KERNEL_TEXT_SIZE/PMD_SIZE)
+        PMDS(0x0000000000000000, __PAGE_KERNEL_LARGE_EXEC|_PAGE_GLOBAL, KERNEL_TEXT_SIZE/PMD_SIZE)
         /* Module mapping starts here */
         .fill   (PTRS_PER_PMD - (KERNEL_TEXT_SIZE/PMD_SIZE)),8,0
 
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 050141c0602b..f57f8b901912 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -800,12 +800,15 @@ static struct irq_chip ioapic_chip;
 
 static void ioapic_register_intr(int irq, unsigned long trigger)
 {
-        if (trigger)
+        if (trigger) {
+                irq_desc[irq].status |= IRQ_LEVEL;
                 set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                               handle_fasteoi_irq, "fasteoi");
-        else
+        } else {
+                irq_desc[irq].status &= ~IRQ_LEVEL;
                 set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                               handle_edge_irq, "edge");
+        }
 }
 
 static void setup_IO_APIC_irq(int apic, int pin, unsigned int irq,
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index cb8ee9d02f86..0ec6d2ddb931 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -85,7 +85,7 @@ int __init check_nmi_watchdog (void)
         int *counts;
         int cpu;
 
-        if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DEFAULT))
+        if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DISABLED)) 
                 return 0;
 
         if (!atomic_read(&nmi_active))
@@ -442,7 +442,7 @@ int proc_nmi_enabled(struct ctl_table *table, int write, struct file *file,
         if (!!old_state == !!nmi_watchdog_enabled)
                 return 0;
 
-        if (atomic_read(&nmi_active) < 0) {
+        if (atomic_read(&nmi_active) < 0 || nmi_watchdog == NMI_DISABLED) {
                 printk( KERN_WARNING "NMI watchdog is permanently disabled\n");
                 return -EIO;
         }
diff --git a/arch/x86_64/kernel/pci-calgary.c b/arch/x86_64/kernel/pci-calgary.c
index ba16c968ca3f..71da01e73f03 100644
--- a/arch/x86_64/kernel/pci-calgary.c
+++ b/arch/x86_64/kernel/pci-calgary.c
@@ -367,16 +367,15 @@ static inline struct iommu_table *find_iommu_table(struct device *dev)
 
         pdev = to_pci_dev(dev);
 
-        /* is the device behind a bridge? */
-        if (unlikely(pdev->bus->parent))
-                pbus = pdev->bus->parent;
-        else
-                pbus = pdev->bus;
+        pbus = pdev->bus;
+
+        /* is the device behind a bridge? Look for the root bus */
+        while (pbus->parent)
+                pbus = pbus->parent;
 
         tbl = pci_iommu(pbus);
 
-        BUG_ON(pdev->bus->parent &&
-               (tbl->it_busno != pdev->bus->parent->number));
+        BUG_ON(tbl && (tbl->it_busno != pbus->number));
 
         return tbl;
 }
diff --git a/arch/x86_64/kernel/pci-dma.c b/arch/x86_64/kernel/pci-dma.c
index 05d745ede561..29711445c818 100644
--- a/arch/x86_64/kernel/pci-dma.c
+++ b/arch/x86_64/kernel/pci-dma.c
@@ -82,6 +82,10 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
         if (dma_mask == 0)
                 dma_mask = DMA_32BIT_MASK;
 
+        /* Device not DMA able */
+        if (dev->dma_mask == NULL)
+                return NULL;
+
         /* Don't invoke OOM killer */
         gfp |= __GFP_NORETRY;
 
diff --git a/arch/x86_64/lib/memcpy.S b/arch/x86_64/lib/memcpy.S
index 0ea0ddc875a7..c22981fa2f3a 100644
--- a/arch/x86_64/lib/memcpy.S
+++ b/arch/x86_64/lib/memcpy.S
@@ -124,6 +124,8 @@ ENDPROC(__memcpy)
         .quad memcpy
         .quad 1b
         .byte X86_FEATURE_REP_GOOD
-        .byte .Lfinal - memcpy
+        /* Replace only beginning, memcpy is used to apply alternatives, so it
+         * is silly to overwrite itself with nops - reboot is only outcome... */
+        .byte 2b - 1b
         .byte 2b - 1b
         .previous
diff --git a/arch/x86_64/mm/pageattr.c b/arch/x86_64/mm/pageattr.c
index 7e161c698af4..10b9809ce821 100644
--- a/arch/x86_64/mm/pageattr.c
+++ b/arch/x86_64/mm/pageattr.c
@@ -75,7 +75,8 @@ static void flush_kernel_map(void *arg)
 
         /* When clflush is available always use it because it is
            much cheaper than WBINVD. */
-        if (!cpu_has_clflush)
+        /* clflush is still broken. Disable for now. */
+        if (1 || !cpu_has_clflush)
                 asm volatile("wbinvd" ::: "memory");
         else list_for_each_entry(pg, l, lru) {
                 void *adr = page_address(pg);
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index 65d82736987e..4095e4d66a1d 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -66,13 +66,13 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                *value = readb(addr + reg);
+                *value = mmio_config_readb(addr + reg);
                 break;
         case 2:
-                *value = readw(addr + reg);
+                *value = mmio_config_readw(addr + reg);
                 break;
         case 4:
-                *value = readl(addr + reg);
+                *value = mmio_config_readl(addr + reg);
                 break;
         }
 
@@ -94,13 +94,13 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                writeb(value, addr + reg);
+                mmio_config_writeb(addr + reg, value);
                 break;
         case 2:
-                writew(value, addr + reg);
+                mmio_config_writew(addr + reg, value);
                 break;
         case 4:
-                writel(value, addr + reg);
+                mmio_config_writel(addr + reg, value);
                 break;
         }
 
diff --git a/arch/x86_64/vdso/.gitignore b/arch/x86_64/vdso/.gitignore
new file mode 100644
index 000000000000..f8b69d84238e
--- /dev/null
+++ b/arch/x86_64/vdso/.gitignore
@@ -0,0 +1 @@
+vdso.lds
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 8c2caff87cc3..a15845c164f2 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -3047,6 +3047,10 @@ static inline void blk_partition_remap(struct bio *bio)
 
                 bio->bi_sector += p->start_sect;
                 bio->bi_bdev = bdev->bd_contains;
+
+                blk_add_trace_remap(bdev_get_queue(bio->bi_bdev), bio,
+                                    bdev->bd_dev, bio->bi_sector,
+                                    bio->bi_sector - p->start_sect);
         }
 }
 
diff --git a/drivers/acpi/asus_acpi.c b/drivers/acpi/asus_acpi.c
index 9c4bd220c44f..86fd142f4bf3 100644
--- a/drivers/acpi/asus_acpi.c
+++ b/drivers/acpi/asus_acpi.c
@@ -1192,6 +1192,7 @@ static int asus_hotk_get_info(void)
                         break;
                 default:
                         kfree(model);
+                        model = NULL;
                         break;
                 }
         }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 81651032791b..d7b499fe0cd9 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -113,7 +113,7 @@ struct acpi_battery_info {
         acpi_string oem_info;
 };
 
-enum acpi_battery_files{
+enum acpi_battery_files {
         ACPI_BATTERY_INFO = 0,
         ACPI_BATTERY_STATE,
         ACPI_BATTERY_ALARM,
@@ -129,13 +129,14 @@ struct acpi_battery_flags {
 };
 
 struct acpi_battery {
-        struct mutex mutex;
         struct acpi_device *device;
         struct acpi_battery_flags flags;
         struct acpi_buffer bif_data;
         struct acpi_buffer bst_data;
+        struct mutex lock;
         unsigned long alarm;
         unsigned long update_time[ACPI_BATTERY_NUMFILES];
+
 };
 
 inline int acpi_battery_present(struct acpi_battery *battery)
@@ -235,10 +236,10 @@ static int acpi_battery_get_info(struct acpi_battery *battery)
                 return 0;
 
         /* Evaluate _BIF */
-
-        status =
-            acpi_evaluate_object(acpi_battery_handle(battery), "_BIF", NULL,
-                                 &buffer);
+        mutex_lock(&battery->lock);
+        status = acpi_evaluate_object(acpi_battery_handle(battery), "_BIF",
+                                      NULL, &buffer);
+        mutex_unlock(&battery->lock);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _BIF"));
                 return -ENODEV;
@@ -285,10 +286,10 @@ static int acpi_battery_get_state(struct acpi_battery *battery)
                 return 0;
 
         /* Evaluate _BST */
-
-        status =
-            acpi_evaluate_object(acpi_battery_handle(battery), "_BST", NULL,
-                                 &buffer);
+        mutex_lock(&battery->lock);
+        status = acpi_evaluate_object(acpi_battery_handle(battery), "_BST",
+                                      NULL, &buffer);
+        mutex_unlock(&battery->lock);
         if (ACPI_FAILURE(status)) {
                 ACPI_EXCEPTION((AE_INFO, status, "Evaluating _BST"));
                 return -ENODEV;
@@ -336,9 +337,10 @@ static int acpi_battery_set_alarm(struct acpi_battery *battery,
 
         arg0.integer.value = alarm;
 
-        status =
-            acpi_evaluate_object(acpi_battery_handle(battery), "_BTP",
+        mutex_lock(&battery->lock);
+        status = acpi_evaluate_object(acpi_battery_handle(battery), "_BTP",
                                  &arg_list, NULL);
+        mutex_unlock(&battery->lock);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
@@ -658,8 +660,6 @@ acpi_battery_write_alarm(struct file *file,
         if (!battery || (count > sizeof(alarm_string) - 1))
                 return -EINVAL;
 
-        mutex_lock(&battery->mutex);
-
         result = acpi_battery_update(battery, 1, &update_result);
         if (result) {
                 result = -ENODEV;
@@ -688,9 +688,7 @@ acpi_battery_write_alarm(struct file *file,
         acpi_battery_check_result(battery, result);
 
         if (!result)
-                result = count;
-
-        mutex_unlock(&battery->mutex);
+                return count;
 
         return result;
 }
@@ -714,8 +712,6 @@ static int acpi_battery_read(int fid, struct seq_file *seq)
         int update_result = ACPI_BATTERY_NONE_UPDATE;
         int update = 0;
 
-        mutex_lock(&battery->mutex);
-
         update = (get_seconds() - battery->update_time[fid] >= update_time);
         update = (update | battery->flags.update[fid]);
 
@@ -733,7 +729,6 @@ static int acpi_battery_read(int fid, struct seq_file *seq)
         result = acpi_read_funcs[fid].print(seq, result);
         acpi_battery_check_result(battery, result);
         battery->flags.update[fid] = result;
-        mutex_unlock(&battery->mutex);
         return result;
 }
 
@@ -897,10 +892,7 @@ static int acpi_battery_add(struct acpi_device *device)
         if (!battery)
                 return -ENOMEM;
 
-        mutex_init(&battery->mutex);
-
-        mutex_lock(&battery->mutex);
-
+        mutex_init(&battery->lock);
         battery->device = device;
         strcpy(acpi_device_name(device), ACPI_BATTERY_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_BATTERY_CLASS);
@@ -936,7 +928,6 @@ static int acpi_battery_add(struct acpi_device *device)
                 kfree(battery);
         }
 
-        mutex_unlock(&battery->mutex);
 
         return result;
 }
@@ -951,8 +942,6 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
 
         battery = acpi_driver_data(device);
 
-        mutex_lock(&battery->mutex);
-
         status = acpi_remove_notify_handler(device->handle,
                                             ACPI_ALL_NOTIFY,
                                             acpi_battery_notify);
@@ -963,9 +952,7 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
 
         kfree(battery->bst_data.pointer);
 
-        mutex_unlock(&battery->mutex);
-
-        mutex_destroy(&battery->mutex);
+        mutex_destroy(&battery->lock);
 
         kfree(battery);
 
diff --git a/drivers/acpi/bay.c b/drivers/acpi/bay.c
index 56a5b3fffeb3..6daf6088ac88 100644
--- a/drivers/acpi/bay.c
+++ b/drivers/acpi/bay.c
@@ -337,7 +337,7 @@ static void bay_notify(acpi_handle handle, u32 event, void *data)
         char *envp[] = { event_string, NULL };
 
         bay_dprintk(handle, "Bay event");
-        sprintf(event_string, "BAY_EVENT=%d\n", event);
+        sprintf(event_string, "BAY_EVENT=%d", event);
         kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
 }
 
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 6192c8be66df..1dabdf4c07b3 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -336,13 +336,13 @@ static void hotplug_dock_devices(struct dock_station *ds, u32 event)
 static void dock_event(struct dock_station *ds, u32 event, int num)
 {
         struct device *dev = &dock_device->dev;
-        char event_string[7];
+        char event_string[13];
         char *envp[] = { event_string, NULL };
 
         if (num == UNDOCK_EVENT)
-                sprintf(event_string, "UNDOCK");
+                sprintf(event_string, "EVENT=undock");
         else
-                sprintf(event_string, "DOCK");
+                sprintf(event_string, "EVENT=dock");
 
         /*
          * Indicate that the status of the dock station has
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 469f3f57f881..56bee9e065cf 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -471,7 +471,6 @@ static void acpi_ec_gpe_query(void *ec_cxt)
                 }
         }
         mutex_unlock(&ec->lock);
-        printk(KERN_ERR PREFIX "Handler for query 0x%x is not found!\n", value);
 }
 
 static u32 acpi_ec_gpe_handler(void *data)
@@ -665,30 +664,44 @@ acpi_ec_register_query_methods(acpi_handle handle, u32 level,
         return AE_OK;
 }
 
-static int ec_parse_device(struct acpi_ec *ec, acpi_handle handle)
+static acpi_status
+ec_parse_device(acpi_handle handle, u32 Level, void *context, void **retval)
 {
-        if (ACPI_FAILURE(acpi_walk_resources(handle, METHOD_NAME__CRS,
-                                     ec_parse_io_ports, ec)))
-                return -EINVAL;
+        acpi_status status;
+
+        struct acpi_ec *ec = context;
+        status = acpi_walk_resources(handle, METHOD_NAME__CRS,
+                                     ec_parse_io_ports, ec);
+        if (ACPI_FAILURE(status))
+                return status;
 
         /* Get GPE bit assignment (EC events). */
         /* TODO: Add support for _GPE returning a package */
-        if (ACPI_FAILURE(acpi_evaluate_integer(handle, "_GPE", NULL, &ec->gpe)))
-                return -EINVAL;
-
-        /* Use the global lock for all EC transactions? */
-        acpi_evaluate_integer(handle, "_GLK", NULL, &ec->global_lock);
+        status = acpi_evaluate_integer(handle, "_GPE", NULL, &ec->gpe);
+        if (ACPI_FAILURE(status))
+                return status;
 
         /* Find and register all query methods */
         acpi_walk_namespace(ACPI_TYPE_METHOD, handle, 1,
                             acpi_ec_register_query_methods, ec, NULL);
 
+        /* Use the global lock for all EC transactions? */
+        acpi_evaluate_integer(handle, "_GLK", NULL, &ec->global_lock);
+
         ec->handle = handle;
 
-        printk(KERN_INFO PREFIX "GPE = 0x%lx, I/O: command/status = 0x%lx, data = 0x%lx",
+        printk(KERN_INFO PREFIX "GPE = 0x%lx, I/O: command/status = 0x%lx, data = 0x%lx\n",
                           ec->gpe, ec->command_addr, ec->data_addr);
 
-        return 0;
+        return AE_CTRL_TERMINATE;
+}
+
+static void ec_remove_handlers(struct acpi_ec *ec)
+{
+        acpi_remove_address_space_handler(ec->handle,
+                                          ACPI_ADR_SPACE_EC,
+                                          &acpi_ec_space_handler);
+        acpi_remove_gpe_handler(NULL, ec->gpe, &acpi_ec_gpe_handler);
 }
 
 static int acpi_ec_add(struct acpi_device *device)
@@ -705,7 +718,8 @@ static int acpi_ec_add(struct acpi_device *device)
         if (!ec)
                 return -ENOMEM;
 
-        if (ec_parse_device(ec, device->handle)) {
+        if (ec_parse_device(device->handle, 0, ec, NULL) !=
+            AE_CTRL_TERMINATE) {
                 kfree(ec);
                 return -EINVAL;
         }
@@ -713,16 +727,13 @@ static int acpi_ec_add(struct acpi_device *device)
         /* Check if we found the boot EC */
         if (boot_ec) {
                 if (boot_ec->gpe == ec->gpe) {
-                        /* We might have incorrect info for GL at boot time */
-                        mutex_lock(&boot_ec->lock);
-                        boot_ec->global_lock = ec->global_lock;
-                        /* Copy handlers from new ec into boot ec */
-                        list_splice(&ec->list, &boot_ec->list);
-                        mutex_unlock(&boot_ec->lock);
-                        kfree(ec);
-                        ec = boot_ec;
+                        ec_remove_handlers(boot_ec);
+                        mutex_destroy(&boot_ec->lock);
+                        kfree(boot_ec);
+                        first_ec = boot_ec = NULL;
                 }
-        } else
+        }
+        if (!first_ec)
                 first_ec = ec;
         ec->handle = device->handle;
         acpi_driver_data(device) = ec;
@@ -734,14 +745,14 @@ static int acpi_ec_add(struct acpi_device *device)
 static int acpi_ec_remove(struct acpi_device *device, int type)
 {
         struct acpi_ec *ec;
-        struct acpi_ec_query_handler *handler;
+        struct acpi_ec_query_handler *handler, *tmp;
 
         if (!device)
                 return -EINVAL;
 
         ec = acpi_driver_data(device);
         mutex_lock(&ec->lock);
-        list_for_each_entry(handler, &ec->list, node) {
+        list_for_each_entry_safe(handler, tmp, &ec->list, node) {
                 list_del(&handler->node);
                 kfree(handler);
         }
@@ -751,9 +762,6 @@ static int acpi_ec_remove(struct acpi_device *device, int type)
         if (ec == first_ec)
                 first_ec = NULL;
 
-        /* Don't touch boot EC */
-        if (boot_ec != ec)
-                kfree(ec);
         return 0;
 }
 
@@ -817,9 +825,7 @@ static int acpi_ec_start(struct acpi_device *device)
         if (!ec)
                 return -EINVAL;
 
-        /* Boot EC is already working */
-        if (ec != boot_ec)
-                ret = ec_install_handlers(ec);
+        ret = ec_install_handlers(ec);
 
         /* EC is fully operational, allow queries */
         atomic_set(&ec->query_pending, 0);
@@ -829,7 +835,6 @@ static int acpi_ec_start(struct acpi_device *device)
 
 static int acpi_ec_stop(struct acpi_device *device, int type)
 {
-        acpi_status status;
         struct acpi_ec *ec;
 
         if (!device)
@@ -838,21 +843,7 @@ static int acpi_ec_stop(struct acpi_device *device, int type)
         ec = acpi_driver_data(device);
         if (!ec)
                 return -EINVAL;
-
-        /* Don't touch boot EC */
-        if (ec == boot_ec)
-                return 0;
-
-        status = acpi_remove_address_space_handler(ec->handle,
-                                                   ACPI_ADR_SPACE_EC,
-                                                   &acpi_ec_space_handler);
-        if (ACPI_FAILURE(status))
-                return -ENODEV;
-
-        status = acpi_remove_gpe_handler(NULL, ec->gpe, &acpi_ec_gpe_handler);
-        if (ACPI_FAILURE(status))
-                return -ENODEV;
-
+        ec_remove_handlers(ec);
         return 0;
 }
 
@@ -868,18 +859,21 @@ int __init acpi_ec_ecdt_probe(void)
         /*
          * Generate a boot ec context
          */
-
         status = acpi_get_table(ACPI_SIG_ECDT, 1,
                                 (struct acpi_table_header **)&ecdt_ptr);
-        if (ACPI_FAILURE(status))
-                goto error;
-
-        printk(KERN_INFO PREFIX "EC description table is found, configuring boot EC\n");
-
-        boot_ec->command_addr = ecdt_ptr->control.address;
-        boot_ec->data_addr = ecdt_ptr->data.address;
-        boot_ec->gpe = ecdt_ptr->gpe;
-        boot_ec->handle = ACPI_ROOT_OBJECT;
+        if (ACPI_SUCCESS(status)) {
+                printk(KERN_INFO PREFIX "EC description table is found, configuring boot EC\n\n");
+                boot_ec->command_addr = ecdt_ptr->control.address;
+                boot_ec->data_addr = ecdt_ptr->data.address;
+                boot_ec->gpe = ecdt_ptr->gpe;
+                boot_ec->handle = ACPI_ROOT_OBJECT;
+        } else {
+                printk(KERN_DEBUG PREFIX "Look up EC in DSDT\n");
+                status = acpi_get_devices(ec_device_ids[0].id, ec_parse_device,
+                                                boot_ec, NULL);
+                if (ACPI_FAILURE(status))
+                        goto error;
+        }
 
         ret = ec_install_handlers(boot_ec);
         if (!ret) {
diff --git a/drivers/acpi/event.c b/drivers/acpi/event.c
index dfa5853b17f0..95637a4ff782 100644
--- a/drivers/acpi/event.c
+++ b/drivers/acpi/event.c
@@ -108,7 +108,7 @@ static const struct file_operations acpi_system_event_ops = {
 };
 
 #ifdef CONFIG_NET
-unsigned int acpi_event_seqnum;
+static unsigned int acpi_event_seqnum;
 struct acpi_genl_event {
         acpi_device_class device_class;
         char bus_id[15];
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index a898991f77cb..a8634a0655fc 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -969,11 +969,17 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
         }
 
         if (pr->flags.bm_check) {
-                /* bus mastering control is necessary */
                 if (!pr->flags.bm_control) {
-                        /* In this case we enter C3 without bus mastering */
-                        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                "C3 support without bus mastering control\n"));
+                        if (pr->flags.has_cst != 1) {
+                                /* bus mastering control is necessary */
+                                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+                                        "C3 support requires BM control\n"));
+                                return;
+                        } else {
+                                /* Here we enter C3 without bus mastering */
+                                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+                                        "C3 support without BM control\n"));
+                        }
                 }
         } else {
                 /*
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index c4efc0c17f8f..463b0247cbc5 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -539,7 +539,7 @@ end:
 }
 
 int acpi_processor_preregister_performance(
-                struct acpi_processor_performance **performance)
+                struct acpi_processor_performance *performance)
 {
         int count, count_target;
         int retval = 0;
@@ -567,12 +567,12 @@ int acpi_processor_preregister_performance(
                         continue;
                 }
 
-                if (!performance || !performance[i]) {
+                if (!performance || !percpu_ptr(performance, i)) {
                         retval = -EINVAL;
                         continue;
                 }
 
-                pr->performance = performance[i];
+                pr->performance = percpu_ptr(performance, i);
                 cpu_set(i, pr->performance->shared_cpu_map);
                 if (acpi_processor_get_psd(pr)) {
                         retval = -EINVAL;
diff --git a/drivers/acpi/resources/rsxface.c b/drivers/acpi/resources/rsxface.c
index f63813a358c5..4c3fd4cdaf73 100644
--- a/drivers/acpi/resources/rsxface.c
+++ b/drivers/acpi/resources/rsxface.c
@@ -474,8 +474,6 @@ acpi_rs_match_vendor_resource(struct acpi_resource *resource, void *context)
         return (AE_CTRL_TERMINATE);
 }
 
-ACPI_EXPORT_SYMBOL(acpi_rs_match_vendor_resource)
-
 /*******************************************************************************
  *
  * FUNCTION:    acpi_walk_resources
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index 7d8e78ea13a5..82c3a550016d 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -1415,7 +1415,7 @@ static int acpi_sbs_update_run(struct acpi_sbs *sbs, int id, int data_type)
         char dir_name[32];
         int do_battery_init = 0, do_ac_init = 0;
         int old_remaining_capacity = 0;
-        int update_ac = 1, update_battery = 1;
+        int update_battery = 1;
         int up_tm = update_time;
 
         if (sbs_zombie(sbs)) {
@@ -1435,10 +1435,6 @@ static int acpi_sbs_update_run(struct acpi_sbs *sbs, int id, int data_type)
 
         sbs->run_cnt++;
 
-        if (!update_ac && !update_battery) {
-                goto end;
-        }
-
         old_ac_present = sbs->ac.ac_present;
 
         result = acpi_ac_get_present(sbs);
diff --git a/drivers/acpi/tables/tbxface.c b/drivers/acpi/tables/tbxface.c
index 5b302c4e293f..a9e3331fee5d 100644
--- a/drivers/acpi/tables/tbxface.c
+++ b/drivers/acpi/tables/tbxface.c
@@ -52,6 +52,8 @@ ACPI_MODULE_NAME("tbxface")
 /* Local prototypes */
 static acpi_status acpi_tb_load_namespace(void);
 
+static int no_auto_ssdt;
+
 /*******************************************************************************
  *
  * FUNCTION:    acpi_allocate_root_table
@@ -536,6 +538,10 @@ static acpi_status acpi_tb_load_namespace(void)
 
                 ACPI_INFO((AE_INFO, "Table DSDT replaced by host OS"));
                 acpi_tb_print_table_header(0, table);
+
+                if (no_auto_ssdt == 0) {
+                        printk(KERN_WARNING "ACPI: DSDT override uses original SSDTs unless \"acpi_no_auto_ssdt\"");
+                }
         }
 
         status =
@@ -577,6 +583,11 @@ static acpi_status acpi_tb_load_namespace(void)
                         continue;
                 }
 
+                if (no_auto_ssdt) {
+                        printk(KERN_WARNING "ACPI: SSDT ignored due to \"acpi_no_auto_ssdt\"\n");
+                        continue;
+                }
+
                 /* Ignore errors while loading tables, get as many as possible */
 
                 (void)acpi_ut_release_mutex(ACPI_MTX_TABLES);
@@ -622,3 +633,15 @@ acpi_status acpi_load_tables(void)
 }
 
 ACPI_EXPORT_SYMBOL(acpi_load_tables)
+
+
+static int __init acpi_no_auto_ssdt_setup(char *s) {
+
+        printk(KERN_NOTICE "ACPI: SSDT auto-load disabled\n");
+
+        no_auto_ssdt = 1;
+
+        return 1;
+}
+
+__setup("acpi_no_auto_ssdt", acpi_no_auto_ssdt_setup);
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 5a62de1b7f2a..1e06159fd9c4 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -33,6 +33,7 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/proc_fs.h>
@@ -74,10 +75,26 @@ MODULE_AUTHOR("Paul Diefenbaugh");
 MODULE_DESCRIPTION("ACPI Thermal Zone Driver");
 MODULE_LICENSE("GPL");
 
+static int act;
+module_param(act, int, 0644);
+MODULE_PARM_DESC(act, "Disable or override all lowest active trip points.\n");
+
 static int tzp;
-module_param(tzp, int, 0);
+module_param(tzp, int, 0444);
 MODULE_PARM_DESC(tzp, "Thermal zone polling frequency, in 1/10 seconds.\n");
 
+static int nocrt;
+module_param(nocrt, int, 0);
+MODULE_PARM_DESC(nocrt, "Set to disable action on ACPI thermal zone critical and hot trips.\n");
+
+static int off;
+module_param(off, int, 0);
+MODULE_PARM_DESC(off, "Set to disable ACPI thermal support.\n");
+
+static int psv;
+module_param(psv, int, 0644);
+MODULE_PARM_DESC(psv, "Disable or override all passive trip points.\n");
+
 static int acpi_thermal_add(struct acpi_device *device);
 static int acpi_thermal_remove(struct acpi_device *device, int type);
 static int acpi_thermal_resume(struct acpi_device *device);
@@ -339,9 +356,16 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
 
         /* Passive: Processors (optional) */
 
-        status =
-            acpi_evaluate_integer(tz->device->handle, "_PSV", NULL,
-                                  &tz->trips.passive.temperature);
+        if (psv == -1) {
+                status = AE_SUPPORT;
+        } else if (psv > 0) {
+                tz->trips.passive.temperature = CELSIUS_TO_KELVIN(psv);
+                status = AE_OK;
+        } else {
+                status = acpi_evaluate_integer(tz->device->handle,
+                        "_PSV", NULL, &tz->trips.passive.temperature);
+        }
+
         if (ACPI_FAILURE(status)) {
                 tz->trips.passive.flags.valid = 0;
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "No passive threshold\n"));
@@ -386,11 +410,33 @@ static int acpi_thermal_get_trip_points(struct acpi_thermal *tz)
 
                 char name[5] = { '_', 'A', 'C', ('0' + i), '\0' };
 
-                status =
-                    acpi_evaluate_integer(tz->device->handle, name, NULL,
-                                          &tz->trips.active[i].temperature);
-                if (ACPI_FAILURE(status))
+                if (act == -1)
+                        break;  /* disable all active trip points */
+
+                status = acpi_evaluate_integer(tz->device->handle,
+                        name, NULL, &tz->trips.active[i].temperature);
+
+                if (ACPI_FAILURE(status)) {
+                        if (i == 0)     /* no active trip points */
+                                break;
+                        if (act <= 0)   /* no override requested */
+                                break;
+                        if (i == 1) {   /* 1 trip point */
+                                tz->trips.active[0].temperature =
+                                        CELSIUS_TO_KELVIN(act);
+                        } else {        /* multiple trips */
+                                /*
+                                 * Don't allow override higher than
+                                 * the next higher trip point
+                                 */
+                                tz->trips.active[i - 1].temperature =
+                                    (tz->trips.active[i - 2].temperature <
+                                        CELSIUS_TO_KELVIN(act) ?
+                                        tz->trips.active[i - 2].temperature :
+                                        CELSIUS_TO_KELVIN(act));
+                        }
                         break;
+                }
 
                 name[2] = 'L';
                 status =
@@ -427,7 +473,7 @@ static int acpi_thermal_get_devices(struct acpi_thermal *tz)
 
 static int acpi_thermal_critical(struct acpi_thermal *tz)
 {
-        if (!tz || !tz->trips.critical.flags.valid)
+        if (!tz || !tz->trips.critical.flags.valid || nocrt)
                 return -EINVAL;
 
         if (tz->temperature >= tz->trips.critical.temperature) {
@@ -449,7 +495,7 @@ static int acpi_thermal_critical(struct acpi_thermal *tz)
 
 static int acpi_thermal_hot(struct acpi_thermal *tz)
 {
-        if (!tz || !tz->trips.hot.flags.valid)
+        if (!tz || !tz->trips.hot.flags.valid || nocrt)
                 return -EINVAL;
 
         if (tz->temperature >= tz->trips.hot.temperature) {
@@ -824,12 +870,14 @@ static int acpi_thermal_trip_seq_show(struct seq_file *seq, void *offset)
                 goto end;
 
         if (tz->trips.critical.flags.valid)
-                seq_printf(seq, "critical (S5):           %ld C\n",
-                           KELVIN_TO_CELSIUS(tz->trips.critical.temperature));
+                seq_printf(seq, "critical (S5):           %ld C%s",
+                           KELVIN_TO_CELSIUS(tz->trips.critical.temperature),
+                           nocrt ? " <disabled>\n" : "\n");
 
         if (tz->trips.hot.flags.valid)
-                seq_printf(seq, "hot (S4):                %ld C\n",
-                           KELVIN_TO_CELSIUS(tz->trips.hot.temperature));
+                seq_printf(seq, "hot (S4):                %ld C%s",
+                           KELVIN_TO_CELSIUS(tz->trips.hot.temperature),
+                           nocrt ? " <disabled>\n" : "\n");
 
         if (tz->trips.passive.flags.valid) {
                 seq_printf(seq,
@@ -1281,11 +1329,78 @@ static int acpi_thermal_resume(struct acpi_device *device)
         return AE_OK;
 }
 
+#ifdef CONFIG_DMI
+static int thermal_act(struct dmi_system_id *d) {
+
+        if (act == 0) {
+                printk(KERN_NOTICE "ACPI: %s detected: "
+                        "disabling all active thermal trip points\n", d->ident);
+                act = -1;
+        }
+        return 0;
+}
+static int thermal_tzp(struct dmi_system_id *d) {
+
+        if (tzp == 0) {
+                printk(KERN_NOTICE "ACPI: %s detected: "
+                        "enabling thermal zone polling\n", d->ident);
+                tzp = 300;      /* 300 dS = 30 Seconds */
+        }
+        return 0;
+}
+static int thermal_psv(struct dmi_system_id *d) {
+
+        if (psv == 0) {
+                printk(KERN_NOTICE "ACPI: %s detected: "
+                        "disabling all passive thermal trip points\n", d->ident);
+                psv = -1;
+        }
+        return 0;
+}
+
+static struct dmi_system_id thermal_dmi_table[] __initdata = {
+        /*
+         * Award BIOS on this AOpen makes thermal control almost worthless.
+         * http://bugzilla.kernel.org/show_bug.cgi?id=8842
+         */
+        {
+         .callback = thermal_act,
+         .ident = "AOpen i915GMm-HFS",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
+                DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
+                },
+        },
+        {
+         .callback = thermal_psv,
+         .ident = "AOpen i915GMm-HFS",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
+                DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
+                },
+        },
+        {
+         .callback = thermal_tzp,
+         .ident = "AOpen i915GMm-HFS",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
+                DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
+                },
+        },
+        {}
+};
+#endif /* CONFIG_DMI */
+
 static int __init acpi_thermal_init(void)
 {
         int result = 0;
 
+        dmi_check_system(thermal_dmi_table);
 
+        if (off) {
+                printk(KERN_NOTICE "ACPI: thermal control disabled\n");
+                return -ENODEV;
+        }
         acpi_thermal_dir = proc_mkdir(ACPI_THERMAL_CLASS, acpi_root_dir);
         if (!acpi_thermal_dir)
                 return -ENODEV;
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index a78832ea81fa..071d274afaab 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -436,7 +436,7 @@ static const struct piix_map_db ich8_map_db = {
                 /* PM   PS   SM   SS       MAP */
                 {  P0,  P2,  P1,  P3 }, /* 00b (hardwired when in AHCI) */
                 {  RV,  RV,  RV,  RV },
-                {  IDE,  IDE,  NA,  NA }, /* 10b (IDE mode) */
+                {  P0,  P2, IDE, IDE }, /* 10b (IDE mode) */
                 {  RV,  RV,  RV,  RV },
         },
 };
@@ -901,6 +901,13 @@ static int piix_broken_suspend(void)
                         },
                 },
                 {
+                        .ident = "TECRA M7",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "TECRA M7"),
+                        },
+                },
+                {
                         .ident = "Satellite U205",
                         .matches = {
                                 DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 60e78bef469f..99d4fbffb0df 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1723,7 +1723,7 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
                 tf.protocol = ATA_PROT_NODATA;
                 tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
                 err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0);
-                if (err_mask) {
+                if (err_mask && id[2] != 0x738c) {
                         rc = -EIO;
                         reason = "SPINUP failed";
                         goto err_out;
diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
index ce589d96ca42..b5352ebecef9 100644
--- a/drivers/ata/pata_artop.c
+++ b/drivers/ata/pata_artop.c
@@ -2,6 +2,7 @@
  *    pata_artop.c - ARTOP ATA controller driver
  *
  *      (C) 2006 Red Hat <alan@redhat.com>
+ *      (C) 2007 Bartlomiej Zolnierkiewicz
  *
  *    Based in part on drivers/ide/pci/aec62xx.c
  *      Copyright (C) 1999-2002 Andre Hedrick <andre@linux-ide.org>
@@ -28,7 +29,7 @@
 #include <linux/ata.h>
 
 #define DRV_NAME        "pata_artop"
-#define DRV_VERSION     "0.4.3"
+#define DRV_VERSION     "0.4.4"
 
 /*
  *      The ARTOP has 33 Mhz and "over clocked" timing tables. Until we
@@ -430,7 +431,7 @@ static int artop_init_one (struct pci_dev *pdev, const struct pci_device_id *id)
                 .udma_mask      = ATA_UDMA4,
                 .port_ops       = &artop6260_ops,
         };
-        static const struct ata_port_info info_626x_fast = {
+        static const struct ata_port_info info_628x = {
                 .sht            = &artop_sht,
                 .flags          = ATA_FLAG_SLAVE_POSS,
                 .pio_mask       = 0x1f, /* pio0-4 */
@@ -438,6 +439,14 @@ static int artop_init_one (struct pci_dev *pdev, const struct pci_device_id *id)
                 .udma_mask      = ATA_UDMA5,
                 .port_ops       = &artop6260_ops,
         };
+        static const struct ata_port_info info_628x_fast = {
+                .sht            = &artop_sht,
+                .flags          = ATA_FLAG_SLAVE_POSS,
+                .pio_mask       = 0x1f, /* pio0-4 */
+                .mwdma_mask     = 0x07, /* mwdma0-2 */
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &artop6260_ops,
+        };
         const struct ata_port_info *ppi[] = { NULL, NULL };
 
         if (!printed_version++)
@@ -455,13 +464,13 @@ static int artop_init_one (struct pci_dev *pdev, const struct pci_device_id *id)
         }
         else if (id->driver_data == 1)  /* 6260 */
                 ppi[0] = &info_626x;
-        else if (id->driver_data == 2)  { /* 6260 or 6260 + fast */
+        else if (id->driver_data == 2)  { /* 6280 or 6280 + fast */
                 unsigned long io = pci_resource_start(pdev, 4);
                 u8 reg;
 
-                ppi[0] = &info_626x;
+                ppi[0] = &info_628x;
                 if (inb(io) & 0x10)
-                        ppi[0] = &info_626x_fast;
+                        ppi[0] = &info_628x_fast;
                 /* Mac systems come up with some registers not set as we
                    will need them */
 
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index 84d9c5568567..c5ddd937dbf2 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -8,12 +8,10 @@
  * Copyright (C) 1999-2003              Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001          Sun Microsystems, Inc.
  * Portions Copyright (C) 2003          Red Hat Inc
- * Portions Copyright (C) 2005-2006     MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2007     MontaVista Software, Inc.
  *
  * TODO
- *      PLL mode
- *      Look into engine reset on timeout errors. Should not be
- *              required.
+ *      Look into engine reset on timeout errors. Should not be required.
  */
 
 #include <linux/kernel.h>
@@ -26,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt37x"
-#define DRV_VERSION     "0.6.7"
+#define DRV_VERSION     "0.6.9"
 
 struct hpt_clock {
         u8      xfer_speed;
@@ -1092,9 +1090,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 int dpll, adjust;
 
                 /* Compute DPLL */
-                dpll = 2;
-                if (port->udma_mask & 0xE0)
-                        dpll = 3;
+                dpll = (port->udma_mask & 0xC0) ? 3 : 2;
 
                 f_low = (MHz[clock_slot] * 48) / MHz[dpll];
                 f_high = f_low + 2;
@@ -1116,7 +1112,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                         pci_write_config_dword(dev, 0x5C, (f_high << 16) | f_low | 0x100);
                 }
                 if (adjust == 8) {
-                        printk(KERN_WARNING "hpt37x: DPLL did not stabilize.\n");
+                        printk(KERN_ERR "pata_hpt37x: DPLL did not stabilize!\n");
                         return -ENODEV;
                 }
                 if (dpll == 3)
@@ -1124,7 +1120,8 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 else
                         private_data = (void *)hpt37x_timings_50;
 
-                printk(KERN_INFO "hpt37x: Bus clock %dMHz, using DPLL.\n", MHz[dpll]);
+                printk(KERN_INFO "pata_hpt37x: bus clock %dMHz, using %dMHz DPLL.\n",
+                       MHz[clock_slot], MHz[dpll]);
         } else {
                 private_data = (void *)chip_table->clocks[clock_slot];
                 /*
@@ -1137,7 +1134,8 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                         port = &info_hpt370_33;
                 if (clock_slot < 2 && port == &info_hpt370a)
                         port = &info_hpt370a_33;
-                printk(KERN_INFO "hpt37x: %s: Bus clock %dMHz.\n", chip_table->name, MHz[clock_slot]);
+                printk(KERN_INFO "pata_hpt37x: %s using %dMHz bus clock.\n",
+                       chip_table->name, MHz[clock_slot]);
         }
 
         /* Now kick off ATA set up */
diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
index aa29cde09f8b..f8f234bfc8ce 100644
--- a/drivers/ata/pata_hpt3x2n.c
+++ b/drivers/ata/pata_hpt3x2n.c
@@ -8,7 +8,7 @@
  * Copyright (C) 1999-2003              Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001          Sun Microsystems, Inc.
  * Portions Copyright (C) 2003          Red Hat Inc
- * Portions Copyright (C) 2005-2006     MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2007     MontaVista Software, Inc.
  *
  *
  * TODO
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt3x2n"
-#define DRV_VERSION     "0.3.3"
+#define DRV_VERSION     "0.3.4"
 
 enum {
         HPT_PCI_FAST    =       (1 << 31),
@@ -579,10 +579,12 @@ static int hpt3x2n_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 pci_write_config_dword(dev, 0x5C, (f_high << 16) | f_low);
         }
         if (adjust == 8) {
-                printk(KERN_WARNING "hpt3x2n: DPLL did not stabilize.\n");
+                printk(KERN_ERR "pata_hpt3x2n: DPLL did not stabilize!\n");
                 return -ENODEV;
         }
 
+        printk(KERN_INFO "pata_hpt37x: bus clock %dMHz, using 66MHz DPLL.\n",
+               pci_mhz);
         /* Set our private data up. We only need a few flags so we use
            it directly */
         port.private_data = NULL;
diff --git a/drivers/ata/pata_isapnp.c b/drivers/ata/pata_isapnp.c
index 5525518204e6..91a396fa5b20 100644
--- a/drivers/ata/pata_isapnp.c
+++ b/drivers/ata/pata_isapnp.c
@@ -139,6 +139,8 @@ static struct pnp_device_id isapnp_devices[] = {
         {.id = ""}
 };
 
+MODULE_DEVICE_TABLE(pnp, isapnp_devices);
+
 static struct pnp_driver isapnp_driver = {
         .name           = DRV_NAME,
         .id_table       = isapnp_devices,
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 8ec520885b95..3acf65e75eb2 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -621,6 +621,9 @@ static const struct pci_device_id mv_pci_tbl[] = {
         { PCI_VDEVICE(MARVELL, 0x5041), chip_504x },
         { PCI_VDEVICE(MARVELL, 0x5080), chip_5080 },
         { PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
+        /* RocketRAID 1740/174x have different identifiers */
+        { PCI_VDEVICE(TTI, 0x1740), chip_508x },
+        { PCI_VDEVICE(TTI, 0x1742), chip_508x },
 
         { PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
         { PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig
index bed9f58c2d5a..b554edac1ced 100644
--- a/drivers/atm/Kconfig
+++ b/drivers/atm/Kconfig
@@ -6,6 +6,11 @@ menuconfig ATM_DRIVERS
         bool "ATM drivers"
         depends on NETDEVICES && ATM
         default y
+        ---help---
+          Say Y here to get to see options for Asynchronous Transfer Mode
+          device drivers. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if ATM_DRIVERS && NETDEVICES && ATM
 
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index 405ee5e09221..8b12925fe7a4 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -2435,7 +2435,7 @@ fore200e_init_cmd_queue(struct fore200e* fore200e)
 }
 
 
-static void __init
+static void __devinit
 fore200e_param_bs_queue(struct fore200e* fore200e,
                         enum buffer_scheme scheme, enum buffer_magn magn,
                         int queue_length, int pool_size, int supply_blksize)
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index a3b605a0ca17..ef52452640e0 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -1601,14 +1601,14 @@ static int rx_init(struct atm_dev *dev)
   
         skb_queue_head_init(&iadev->rx_dma_q);  
         iadev->rx_free_desc_qhead = NULL;   
-        iadev->rx_open = kmalloc(4*iadev->num_vc,GFP_KERNEL);
-        if (!iadev->rx_open)  
-        {  
+
+        iadev->rx_open = kzalloc(4 * iadev->num_vc, GFP_KERNEL);
+        if (!iadev->rx_open) {
                 printk(KERN_ERR DEV_LABEL "itf %d couldn't get free page\n",
                 dev->number);  
                 goto err_free_dle;
         }  
-        memset(iadev->rx_open, 0, 4*iadev->num_vc);  
+
         iadev->rxing = 1;
         iadev->rx_pkt_cnt = 0;
         /* Mode Register */  
@@ -3171,12 +3171,12 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
         unsigned long flags;
         int ret;
 
-        iadev = kmalloc(sizeof(*iadev), GFP_KERNEL); 
+        iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
         if (!iadev) {
                 ret = -ENOMEM;
                 goto err_out;
         }
-        memset(iadev, 0, sizeof(*iadev));
+
         iadev->pci = pdev;
 
         IF_INIT(printk("ia detected at bus:%d dev: %d function:%d\n",
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index 55fd1b4543fd..144a49f15220 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -65,7 +65,6 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/dma-mapping.h>
 
 /* -------------------- TUNABLE PARAMATERS: */
 
diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig
index de2fcce10ba5..043353bd0600 100644
--- a/drivers/auxdisplay/Kconfig
+++ b/drivers/auxdisplay/Kconfig
@@ -8,6 +8,11 @@
 menuconfig AUXDISPLAY
         depends on PARPORT
         bool "Auxiliary Display support"
+        ---help---
+          Say Y here to get to see options for auxiliary display drivers.
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if AUXDISPLAY && PARPORT
 
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index a4a311992408..ef32e977d307 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -6,6 +6,12 @@ menuconfig BLK_DEV
         bool "Block devices"
         depends on BLOCK
         default y
+        ---help---
+          Say Y here to get to see options for various different block device
+          drivers. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled;
+          only do this if you know what you are doing.
 
 if BLK_DEV
 
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index a11b2bd54bbe..084358a828e9 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1977,12 +1977,13 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
 {
         ReadCapdata_struct *buf;
         int return_code;
-        buf = kmalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
-        if (buf == NULL) {
+
+        buf = kzalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
+        if (!buf) {
                 printk(KERN_WARNING "cciss: out of memory\n");
                 return;
         }
-        memset(buf, 0, sizeof(ReadCapdata_struct));
+
         if (withirq)
                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
                                 ctlr, buf, sizeof(ReadCapdata_struct),
@@ -2003,7 +2004,6 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
                 printk(KERN_INFO "      blocks= %llu block_size= %d\n",
                 (unsigned long long)*total_size+1, *block_size);
         kfree(buf);
-        return;
 }
 
 static void
@@ -2011,12 +2011,13 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
 {
         ReadCapdata_struct_16 *buf;
         int return_code;
-        buf = kmalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
-        if (buf == NULL) {
+
+        buf = kzalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
+        if (!buf) {
                 printk(KERN_WARNING "cciss: out of memory\n");
                 return;
         }
-        memset(buf, 0, sizeof(ReadCapdata_struct_16));
+
         if (withirq) {
                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
                         ctlr, buf, sizeof(ReadCapdata_struct_16),
@@ -2038,7 +2039,6 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
         printk(KERN_INFO "      blocks= %llu block_size= %d\n",
                (unsigned long long)*total_size+1, *block_size);
         kfree(buf);
-        return;
 }
 
 static int cciss_revalidate(struct gendisk *disk)
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index be4e3477d83b..eb9799acf65b 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -420,18 +420,17 @@ static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
                         goto Enomem2;
         }
 
-        hba[i]->cmd_pool = (cmdlist_t *)pci_alloc_consistent(
+        hba[i]->cmd_pool = pci_alloc_consistent(
                 hba[i]->pci_dev, NR_CMDS * sizeof(cmdlist_t),
                 &(hba[i]->cmd_pool_dhandle));
-        hba[i]->cmd_pool_bits = kmalloc(
-                ((NR_CMDS+BITS_PER_LONG-1)/BITS_PER_LONG)*sizeof(unsigned long),
+        hba[i]->cmd_pool_bits = kcalloc(
+                (NR_CMDS+BITS_PER_LONG-1)/BITS_PER_LONG, sizeof(unsigned long),
                 GFP_KERNEL);
 
         if (!hba[i]->cmd_pool_bits || !hba[i]->cmd_pool)
                         goto Enomem1;
 
         memset(hba[i]->cmd_pool, 0, NR_CMDS * sizeof(cmdlist_t));
-        memset(hba[i]->cmd_pool_bits, 0, ((NR_CMDS+BITS_PER_LONG-1)/BITS_PER_LONG)*sizeof(unsigned long));
         printk(KERN_INFO "cpqarray: Finding drives on %s",
                 hba[i]->devname);
 
@@ -1660,45 +1659,30 @@ static void getgeometry(int ctlr)
 
         info_p->log_drv_map = 0;        
         
-        id_ldrive = kmalloc(sizeof(id_log_drv_t), GFP_KERNEL);
-        if(id_ldrive == NULL)
-        {
+        id_ldrive = kzalloc(sizeof(id_log_drv_t), GFP_KERNEL);
+        if (!id_ldrive) {
                 printk( KERN_ERR "cpqarray:  out of memory.\n");
-                return;
+                goto err_0;
         }
 
-        id_ctlr_buf = kmalloc(sizeof(id_ctlr_t), GFP_KERNEL);
-        if(id_ctlr_buf == NULL)
-        {
-                kfree(id_ldrive);
+        id_ctlr_buf = kzalloc(sizeof(id_ctlr_t), GFP_KERNEL);
+        if (!id_ctlr_buf) {
                 printk( KERN_ERR "cpqarray:  out of memory.\n");
-                return;
+                goto err_1;
         }
 
-        id_lstatus_buf = kmalloc(sizeof(sense_log_drv_stat_t), GFP_KERNEL);
-        if(id_lstatus_buf == NULL)
-        {
-                kfree(id_ctlr_buf);
-                kfree(id_ldrive);
+        id_lstatus_buf = kzalloc(sizeof(sense_log_drv_stat_t), GFP_KERNEL);
+        if (!id_lstatus_buf) {
                 printk( KERN_ERR "cpqarray:  out of memory.\n");
-                return;
+                goto err_2;
         }
 
-        sense_config_buf = kmalloc(sizeof(config_t), GFP_KERNEL);
-        if(sense_config_buf == NULL)
-        {
-                kfree(id_lstatus_buf);
-                kfree(id_ctlr_buf);
-                kfree(id_ldrive);
+        sense_config_buf = kzalloc(sizeof(config_t), GFP_KERNEL);
+        if (!sense_config_buf) {
                 printk( KERN_ERR "cpqarray:  out of memory.\n");
-                return;
+                goto err_3;
         }
 
-        memset(id_ldrive, 0, sizeof(id_log_drv_t));
-        memset(id_ctlr_buf, 0, sizeof(id_ctlr_t));
-        memset(id_lstatus_buf, 0, sizeof(sense_log_drv_stat_t));
-        memset(sense_config_buf, 0, sizeof(config_t));
-
         info_p->phys_drives = 0;
         info_p->log_drv_map = 0;
         info_p->drv_assign_map = 0;
@@ -1712,13 +1696,8 @@ static void getgeometry(int ctlr)
                  * so the idastubopen will fail on all logical drives
                  * on the controller.
                  */
-                 /* Free all the buffers and return */ 
                 printk(KERN_ERR "cpqarray: error sending ID controller\n");
-                kfree(sense_config_buf);
-                kfree(id_lstatus_buf);
-                kfree(id_ctlr_buf);
-                kfree(id_ldrive);
-                return;
+                goto err_4;
         }
 
         info_p->log_drives = id_ctlr_buf->nr_drvs;
@@ -1764,12 +1743,7 @@ static void getgeometry(int ctlr)
                                 " failed to report status of logical drive %d\n"
                          "Access to this controller has been disabled\n",
                                 ctlr, log_unit);
-                        /* Free all the buffers and return */
-                        kfree(sense_config_buf);
-                        kfree(id_lstatus_buf);
-                        kfree(id_ctlr_buf);
-                        kfree(id_ldrive);
-                        return;
+                        goto err_4;
                 }
                 /*
                    Make sure the logical drive is configured
@@ -1798,14 +1772,8 @@ static void getgeometry(int ctlr)
                                  sizeof(config_t), 0, 0, log_unit);
                                 if (ret_code == IO_ERROR) {
                                         info_p->log_drv_map = 0;
-                                        /* Free all the buffers and return */
                                         printk(KERN_ERR "cpqarray: error sending sense config\n");
-                                        kfree(sense_config_buf);
-                                        kfree(id_lstatus_buf);
-                                        kfree(id_ctlr_buf);
-                                        kfree(id_ldrive);
-                                        return;
-
+                                        goto err_4;
                                 }
 
                                 info_p->phys_drives =
@@ -1820,12 +1788,18 @@ static void getgeometry(int ctlr)
                         log_index = log_index + 1;
                 }               /* end of if logical drive configured */
         }                       /* end of for log_unit */
+
+        /* Free all the buffers and return */
+err_4:
         kfree(sense_config_buf);
-        kfree(id_ldrive);
+err_3:
         kfree(id_lstatus_buf);
+err_2:
         kfree(id_ctlr_buf);
+err_1:
+        kfree(id_ldrive);
+err_0:
         return;
-
 }
 
 static void __exit cpqarray_exit(void)
diff --git a/drivers/block/lguest_blk.c b/drivers/block/lguest_blk.c
index 93e3c4001bf5..160cf14431ac 100644
--- a/drivers/block/lguest_blk.c
+++ b/drivers/block/lguest_blk.c
@@ -308,9 +308,12 @@ static int lguestblk_probe(struct lguest_device *lgdev)
         }
 
         /* This allocates a "struct gendisk" where we pack all the information
-         * about the disk which the rest of Linux sees.  We ask for one minor
-         * number; I do wonder if we should be asking for more. */
-        bd->disk = alloc_disk(1);
+         * about the disk which the rest of Linux sees.  The argument is the
+         * number of minor devices desired: we need one minor for the main
+         * disk, and one for each partition.  Of course, we can't possibly know
+         * how many partitions are on the disk (add_disk does that).
+         */
+        bd->disk = alloc_disk(16);
         if (!bd->disk) {
                 err = -ENOMEM;
                 goto out_unregister_blkdev;
diff --git a/drivers/block/viodasd.c b/drivers/block/viodasd.c
index 85916e2665d4..af3969a9c963 100644
--- a/drivers/block/viodasd.c
+++ b/drivers/block/viodasd.c
@@ -41,7 +41,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/completion.h>
 #include <linux/device.h>
-#include <linux/kernel.h>
 
 #include <asm/uaccess.h>
 #include <asm/vio.h>
diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
index cb27e8863d7c..3ede0b63da13 100644
--- a/drivers/block/xsysace.c
+++ b/drivers/block/xsysace.c
@@ -902,26 +902,17 @@ static int ace_release(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static int ace_ioctl(struct inode *inode, struct file *filp,
-                     unsigned int cmd, unsigned long arg)
+static int ace_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct ace_device *ace = inode->i_bdev->bd_disk->private_data;
-        struct hd_geometry __user *geo = (struct hd_geometry __user *)arg;
-        struct hd_geometry g;
-        dev_dbg(ace->dev, "ace_ioctl()\n");
-
-        switch (cmd) {
-        case HDIO_GETGEO:
-                g.heads = ace->cf_id.heads;
-                g.sectors = ace->cf_id.sectors;
-                g.cylinders = ace->cf_id.cyls;
-                g.start = 0;
-                return copy_to_user(geo, &g, sizeof(g)) ? -EFAULT : 0;
+        struct ace_device *ace = bdev->bd_disk->private_data;
 
-        default:
-                return -ENOTTY;
-        }
-        return -ENOTTY;
+        dev_dbg(ace->dev, "ace_getgeo()\n");
+
+        geo->heads = ace->cf_id.heads;
+        geo->sectors = ace->cf_id.sectors;
+        geo->cylinders = ace->cf_id.cyls;
+
+        return 0;
 }
 
 static struct block_device_operations ace_fops = {
@@ -930,7 +921,7 @@ static struct block_device_operations ace_fops = {
         .release = ace_release,
         .media_changed = ace_media_changed,
         .revalidate_disk = ace_revalidate_disk,
-        .ioctl = ace_ioctl,
+        .getgeo = ace_getgeo,
 };
 
 /* --------------------------------------------------------------------
diff --git a/drivers/char/hvc_lguest.c b/drivers/char/hvc_lguest.c
index feeccbaec438..3d6bd0baa56d 100644
--- a/drivers/char/hvc_lguest.c
+++ b/drivers/char/hvc_lguest.c
@@ -35,6 +35,7 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/lguest_bus.h>
+#include <asm/paravirt.h>
 #include "hvc_console.h"
 
 /*D:340 This is our single console input buffer, with associated "struct
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index fee58e03dbe2..4177f6db83e9 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1629,7 +1629,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
         struct pcmcia_device *link;
-        int rc, minor = iminor(inode);
+        int minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
                 return -ENODEV;
@@ -1668,7 +1668,6 @@ static int cmm_open(struct inode *inode, struct file *filp)
         start_monitor(dev);
 
         link->open = 1;         /* only one open per device */
-        rc = 0;
 
         DEBUGP(2, dev, "<- cmm_open\n");
         return nonseekable_open(inode, filp);
@@ -1824,7 +1823,7 @@ static int cm4000_resume(struct pcmcia_device *link)
 
 static void cm4000_release(struct pcmcia_device *link)
 {
-        cmm_cm4000_release(link->priv); /* delay release until device closed */
+        cmm_cm4000_release(link);       /* delay release until device closed */
         pcmcia_disable_device(link);
 }
 
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index af88181a17f4..b24a3e7bbb9f 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -599,7 +599,7 @@ cs_release:
 
 static void reader_release(struct pcmcia_device *link)
 {
-        cm4040_reader_release(link->priv);
+        cm4040_reader_release(link);
         pcmcia_disable_device(link);
 }
 
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 73037a4d3c50..aeec67e27264 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1147,10 +1147,15 @@ static int sonypi_acpi_remove(struct acpi_device *device, int type)
         return 0;
 }
 
+const static struct acpi_device_id sonypi_device_ids[] = {
+        {"SNY6001", 0},
+        {"", 0},
+};
+
 static struct acpi_driver sonypi_acpi_driver = {
         .name           = "sonypi",
         .class          = "hkey",
-        .ids            = "SNY6001",
+        .ids            = sonypi_device_ids,
         .ops            = {
                            .add = sonypi_acpi_add,
                            .remove = sonypi_acpi_remove,
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index de37ebc3a4cf..51ea93cab6c4 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -369,25 +369,54 @@ static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
 }
 
 /**
- *      tty_buffer_flush                -       flush full tty buffers
+ *      __tty_buffer_flush              -       flush full tty buffers
  *      @tty: tty to flush
  *
- *      flush all the buffers containing receive data
+ *      flush all the buffers containing receive data. Caller must
+ *      hold the buffer lock and must have ensured no parallel flush to
+ *      ldisc is running.
  *
- *      Locking: none
+ *      Locking: Caller must hold tty->buf.lock
  */
 
-static void tty_buffer_flush(struct tty_struct *tty)
+static void __tty_buffer_flush(struct tty_struct *tty)
 {
         struct tty_buffer *thead;
-        unsigned long flags;
 
-        spin_lock_irqsave(&tty->buf.lock, flags);
         while((thead = tty->buf.head) != NULL) {
                 tty->buf.head = thead->next;
                 tty_buffer_free(tty, thead);
         }
         tty->buf.tail = NULL;
+}
+
+/**
+ *      tty_buffer_flush                -       flush full tty buffers
+ *      @tty: tty to flush
+ *
+ *      flush all the buffers containing receive data. If the buffer is
+ *      being processed by flush_to_ldisc then we defer the processing
+ *      to that function
+ *
+ *      Locking: none
+ */
+
+static void tty_buffer_flush(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+
+        /* If the data is being pushed to the tty layer then we can't
+           process it here. Instead set a flag and the flush_to_ldisc
+           path will process the flush request before it exits */
+        if (test_bit(TTY_FLUSHING, &tty->flags)) {
+                set_bit(TTY_FLUSHPENDING, &tty->flags);
+                spin_unlock_irqrestore(&tty->buf.lock, flags);
+                wait_event(tty->read_wait,
+                                test_bit(TTY_FLUSHPENDING, &tty->flags) == 0);
+                return;
+        } else
+                __tty_buffer_flush(tty);
         spin_unlock_irqrestore(&tty->buf.lock, flags);
 }
 
@@ -3594,6 +3623,7 @@ static void flush_to_ldisc(struct work_struct *work)
                 return;
 
         spin_lock_irqsave(&tty->buf.lock, flags);
+        set_bit(TTY_FLUSHING, &tty->flags);     /* So we know a flush is running */
         head = tty->buf.head;
         if (head != NULL) {
                 tty->buf.head = NULL;
@@ -3607,6 +3637,11 @@ static void flush_to_ldisc(struct work_struct *work)
                                 tty_buffer_free(tty, tbuf);
                                 continue;
                         }
+                        /* Ldisc or user is trying to flush the buffers
+                           we are feeding to the ldisc, stop feeding the
+                           line discipline as we want to empty the queue */
+                        if (test_bit(TTY_FLUSHPENDING, &tty->flags))
+                                break;
                         if (!tty->receive_room) {
                                 schedule_delayed_work(&tty->buf.work, 1);
                                 break;
@@ -3620,8 +3655,17 @@ static void flush_to_ldisc(struct work_struct *work)
                         disc->receive_buf(tty, char_buf, flag_buf, count);
                         spin_lock_irqsave(&tty->buf.lock, flags);
                 }
+                /* Restore the queue head */
                 tty->buf.head = head;
         }
+        /* We may have a deferred request to flush the input buffer,
+           if so pull the chain under the lock and empty the queue */
+        if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
+                __tty_buffer_flush(tty);
+                clear_bit(TTY_FLUSHPENDING, &tty->flags);
+                wake_up(&tty->read_wait);
+        }
+        clear_bit(TTY_FLUSHING, &tty->flags);
         spin_unlock_irqrestore(&tty->buf.lock, flags);
 
         tty_ldisc_deref(disc);
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 84ebfcc1ffb4..c0fc4aeb8596 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -2,6 +2,11 @@
 menuconfig CRYPTO_HW
         bool "Hardware crypto devices"
         default y
+        ---help---
+          Say Y here to get to see options for hardware crypto devices and
+          processors. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if CRYPTO_HW
 
diff --git a/drivers/dma/ioatdma.c b/drivers/dma/ioatdma.c
index 5fbe56b5cea0..2d1f17865b64 100644
--- a/drivers/dma/ioatdma.c
+++ b/drivers/dma/ioatdma.c
@@ -347,8 +347,7 @@ ioat_dma_prep_memcpy(struct dma_chan *chan, size_t len, int int_en)
         new->async_tx.ack = 0; /* client is in control of this ack */
         new->async_tx.cookie = -EBUSY;
 
-        pci_unmap_len_set(new, src_len, orig_len);
-        pci_unmap_len_set(new, dst_len, orig_len);
+        pci_unmap_len_set(new, len, orig_len);
         spin_unlock_bh(&ioat_chan->desc_lock);
 
         return new ? &new->async_tx : NULL;
@@ -423,11 +422,11 @@ static void ioat_dma_memcpy_cleanup(struct ioat_dma_chan *chan)
                         */
                         pci_unmap_page(chan->device->pdev,
                                         pci_unmap_addr(desc, dst),
-                                        pci_unmap_len(desc, dst_len),
+                                        pci_unmap_len(desc, len),
                                         PCI_DMA_FROMDEVICE);
                         pci_unmap_page(chan->device->pdev,
                                         pci_unmap_addr(desc, src),
-                                        pci_unmap_len(desc, src_len),
+                                        pci_unmap_len(desc, len),
                                         PCI_DMA_TODEVICE);
                 }
 
diff --git a/drivers/dma/ioatdma.h b/drivers/dma/ioatdma.h
index d3726478031a..bf4dad70e0f5 100644
--- a/drivers/dma/ioatdma.h
+++ b/drivers/dma/ioatdma.h
@@ -111,10 +111,9 @@ struct ioat_desc_sw {
         struct ioat_dma_descriptor *hw;
         struct list_head node;
         int tx_cnt;
+        DECLARE_PCI_UNMAP_LEN(len)
         DECLARE_PCI_UNMAP_ADDR(src)
-        DECLARE_PCI_UNMAP_LEN(src_len)
         DECLARE_PCI_UNMAP_ADDR(dst)
-        DECLARE_PCI_UNMAP_LEN(dst_len)
         struct dma_async_tx_descriptor async_tx;
 };
 
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 3b63b0b78122..19667fcc722a 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -5,6 +5,11 @@ menuconfig HID_SUPPORT
         bool "HID Devices"
         depends on INPUT
         default y
+        ---help---
+          Say Y here to get to see options for various computer-human interface
+          device drivers. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if HID_SUPPORT
 
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index 338ee4f54614..d3181967f167 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -585,6 +585,8 @@ static int __devinit smsc47m1_probe(struct platform_device *pdev)
 
         if ((err = device_create_file(dev, &dev_attr_alarms)))
                 goto error_remove_files;
+        if ((err = device_create_file(dev, &dev_attr_name)))
+                goto error_remove_files;
 
         data->class_dev = hwmon_device_register(dev);
         if (IS_ERR(data->class_dev)) {
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index c51ae2e17758..d9a9ec7dd84a 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -309,18 +309,16 @@ static inline int is_word_sized(u16 reg)
               || (reg & 0x00ff) == 0x55));
 }
 
-/* We assume that the default bank is 0, thus the following two functions do
-   nothing for registers which live in bank 0. For others, they respectively
-   set the bank register to the correct value (before the register is
-   accessed), and back to 0 (afterwards). */
+/* Registers 0x50-0x5f are banked */
 static inline void w83627ehf_set_bank(struct w83627ehf_data *data, u16 reg)
 {
-        if (reg & 0xff00) {
+        if ((reg & 0x00f0) == 0x50) {
                 outb_p(W83627EHF_REG_BANK, data->addr + ADDR_REG_OFFSET);
                 outb_p(reg >> 8, data->addr + DATA_REG_OFFSET);
         }
 }
 
+/* Not strictly necessary, but play it safe for now */
 static inline void w83627ehf_reset_bank(struct w83627ehf_data *data, u16 reg)
 {
         if (reg & 0xff00) {
@@ -421,6 +419,31 @@ static void w83627ehf_write_fan_div(struct w83627ehf_data *data, int nr)
         }
 }
 
+static void w83627ehf_update_fan_div(struct w83627ehf_data *data)
+{
+        int i;
+
+        i = w83627ehf_read_value(data, W83627EHF_REG_FANDIV1);
+        data->fan_div[0] = (i >> 4) & 0x03;
+        data->fan_div[1] = (i >> 6) & 0x03;
+        i = w83627ehf_read_value(data, W83627EHF_REG_FANDIV2);
+        data->fan_div[2] = (i >> 6) & 0x03;
+        i = w83627ehf_read_value(data, W83627EHF_REG_VBAT);
+        data->fan_div[0] |= (i >> 3) & 0x04;
+        data->fan_div[1] |= (i >> 4) & 0x04;
+        data->fan_div[2] |= (i >> 5) & 0x04;
+        if (data->has_fan & ((1 << 3) | (1 << 4))) {
+                i = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
+                data->fan_div[3] = i & 0x03;
+                data->fan_div[4] = ((i >> 2) & 0x03)
+                                 | ((i >> 5) & 0x04);
+        }
+        if (data->has_fan & (1 << 3)) {
+                i = w83627ehf_read_value(data, W83627EHF_REG_SMI_OVT);
+                data->fan_div[3] |= (i >> 5) & 0x04;
+        }
+}
+
 static struct w83627ehf_data *w83627ehf_update_device(struct device *dev)
 {
         struct w83627ehf_data *data = dev_get_drvdata(dev);
@@ -432,25 +455,7 @@ static struct w83627ehf_data *w83627ehf_update_device(struct device *dev)
         if (time_after(jiffies, data->last_updated + HZ + HZ/2)
          || !data->valid) {
                 /* Fan clock dividers */
-                i = w83627ehf_read_value(data, W83627EHF_REG_FANDIV1);
-                data->fan_div[0] = (i >> 4) & 0x03;
-                data->fan_div[1] = (i >> 6) & 0x03;
-                i = w83627ehf_read_value(data, W83627EHF_REG_FANDIV2);
-                data->fan_div[2] = (i >> 6) & 0x03;
-                i = w83627ehf_read_value(data, W83627EHF_REG_VBAT);
-                data->fan_div[0] |= (i >> 3) & 0x04;
-                data->fan_div[1] |= (i >> 4) & 0x04;
-                data->fan_div[2] |= (i >> 5) & 0x04;
-                if (data->has_fan & ((1 << 3) | (1 << 4))) {
-                        i = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
-                        data->fan_div[3] = i & 0x03;
-                        data->fan_div[4] = ((i >> 2) & 0x03)
-                                         | ((i >> 5) & 0x04);
-                }
-                if (data->has_fan & (1 << 3)) {
-                        i = w83627ehf_read_value(data, W83627EHF_REG_SMI_OVT);
-                        data->fan_div[3] |= (i >> 5) & 0x04;
-                }
+                w83627ehf_update_fan_div(data);
 
                 /* Measured voltages and limits */
                 for (i = 0; i < data->in_num; i++) {
@@ -1312,6 +1317,9 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
         if (!(i & (1 << 1)) && (!fan5pin))
                 data->has_fan |= (1 << 4);
 
+        /* Read fan clock dividers immediately */
+        w83627ehf_update_fan_div(data);
+
         /* Register sysfs hooks */
         for (i = 0; i < ARRAY_SIZE(sda_sf3_arrays); i++)
                 if ((err = device_create_file(dev,
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index f85b48fea1c4..c95909cc1d21 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -740,9 +740,9 @@ store_sensor(struct device *dev, struct device_attribute *da,
 static SENSOR_DEVICE_ATTR(temp1_type, S_IRUGO | S_IWUSR,
         show_sensor, store_sensor, 0);
 static SENSOR_DEVICE_ATTR(temp2_type, S_IRUGO | S_IWUSR,
-        show_sensor, store_sensor, 0);
+        show_sensor, store_sensor, 1);
 static SENSOR_DEVICE_ATTR(temp3_type, S_IRUGO | S_IWUSR,
-        show_sensor, store_sensor, 0);
+        show_sensor, store_sensor, 2);
 
 /* I2C devices get this name attribute automatically, but for ISA devices
    we must create it by ourselves. */
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 8f5c686123b8..289816db52ae 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -272,11 +272,11 @@ static int i801_block_transaction_byte_by_byte(union i2c_smbus_data *data,
                 /* Make sure the SMBus host is ready to start transmitting */
                 temp = inb_p(SMBHSTSTS);
                 if (i == 1) {
-                        /* Erronenous conditions before transaction:
+                        /* Erroneous conditions before transaction:
                          * Byte_Done, Failed, Bus_Err, Dev_Err, Intr, Host_Busy */
                         errmask = 0x9f;
                 } else {
-                        /* Erronenous conditions during transaction:
+                        /* Erroneous conditions during transaction:
                          * Failed, Bus_Err, Dev_Err, Intr */
                         errmask = 0x1e;
                 }
diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
index 440342bc62e1..ace644e21b14 100644
--- a/drivers/i2c/busses/i2c-iop3xx.c
+++ b/drivers/i2c/busses/i2c-iop3xx.c
@@ -490,6 +490,7 @@ iop3xx_i2c_probe(struct platform_device *pdev)
         memcpy(new_adapter->name, pdev->name, strlen(pdev->name));
         new_adapter->id = I2C_HW_IOP3XX;
         new_adapter->owner = THIS_MODULE;
+        new_adapter->class = I2C_CLASS_HWMON;
         new_adapter->dev.parent = &pdev->dev;
         new_adapter->nr = pdev->id;
 
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 851c3ed513d0..d8de4ac88b7d 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -105,6 +105,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
                         schedule();
                         if (time_after(jiffies, orig_jiffies + timeout)) {
                                 pr_debug("I2C: timeout\n");
+                                writeccr(i2c, 0);
                                 result = -EIO;
                                 break;
                         }
@@ -116,10 +117,12 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
                 result = wait_event_interruptible_timeout(i2c->queue,
                         (i2c->interrupt & CSR_MIF), timeout * HZ);
 
-                if (unlikely(result < 0))
+                if (unlikely(result < 0)) {
                         pr_debug("I2C: wait interrupted\n");
-                else if (unlikely(!(i2c->interrupt & CSR_MIF))) {
+                        writeccr(i2c, 0);
+                } else if (unlikely(!(i2c->interrupt & CSR_MIF))) {
                         pr_debug("I2C: wait timeout\n");
+                        writeccr(i2c, 0);
                         result = -ETIMEDOUT;
                 }
 
@@ -172,7 +175,6 @@ static void mpc_i2c_start(struct mpc_i2c *i2c)
 static void mpc_i2c_stop(struct mpc_i2c *i2c)
 {
         writeccr(i2c, CCR_MEN);
-        writeccr(i2c, 0);
 }
 
 static int mpc_write(struct mpc_i2c *i2c, int target,
@@ -261,6 +263,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
         while (readb(i2c->base + MPC_I2C_SR) & CSR_MBB) {
                 if (signal_pending(current)) {
                         pr_debug("I2C: Interrupted\n");
+                        writeccr(i2c, 0);
                         return -EINTR;
                 }
                 if (time_after(jiffies, orig_jiffies + HZ)) {
@@ -362,7 +365,7 @@ static int fsl_i2c_probe(struct platform_device *pdev)
 
       fail_add:
         if (i2c->irq != 0)
-                free_irq(i2c->irq, NULL);
+                free_irq(i2c->irq, i2c);
       fail_irq:
         iounmap(i2c->base);
       fail_map:
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 251154ae5d97..bb7bf68a7fb6 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -107,6 +107,21 @@ struct mv64xxx_i2c_data {
  *
  *****************************************************************************
  */
+
+/* Reset hardware and initialize FSM */
+static void
+mv64xxx_i2c_hw_init(struct mv64xxx_i2c_data *drv_data)
+{
+        writel(0, drv_data->reg_base + MV64XXX_I2C_REG_SOFT_RESET);
+        writel((((drv_data->freq_m & 0xf) << 3) | (drv_data->freq_n & 0x7)),
+                drv_data->reg_base + MV64XXX_I2C_REG_BAUD);
+        writel(0, drv_data->reg_base + MV64XXX_I2C_REG_SLAVE_ADDR);
+        writel(0, drv_data->reg_base + MV64XXX_I2C_REG_EXT_SLAVE_ADDR);
+        writel(MV64XXX_I2C_REG_CONTROL_TWSIEN | MV64XXX_I2C_REG_CONTROL_STOP,
+                drv_data->reg_base + MV64XXX_I2C_REG_CONTROL);
+        drv_data->state = MV64XXX_I2C_STATE_IDLE;
+}
+
 static void
 mv64xxx_i2c_fsm(struct mv64xxx_i2c_data *drv_data, u32 status)
 {
@@ -203,7 +218,7 @@ mv64xxx_i2c_fsm(struct mv64xxx_i2c_data *drv_data, u32 status)
                          drv_data->state, status, drv_data->msg->addr,
                          drv_data->msg->flags);
                 drv_data->action = MV64XXX_I2C_ACTION_SEND_STOP;
-                drv_data->state = MV64XXX_I2C_STATE_IDLE;
+                mv64xxx_i2c_hw_init(drv_data);
                 drv_data->rc = -EIO;
         }
 }
@@ -367,6 +382,7 @@ mv64xxx_i2c_wait_for_completion(struct mv64xxx_i2c_data *drv_data)
                                 "mv64xxx: I2C bus locked, block: %d, "
                                 "time_left: %d\n", drv_data->block,
                                 (int)time_left);
+                        mv64xxx_i2c_hw_init(drv_data);
                 }
         } else
                 spin_unlock_irqrestore(&drv_data->lock, flags);
@@ -443,19 +459,6 @@ static const struct i2c_algorithm mv64xxx_i2c_algo = {
  *
  *****************************************************************************
  */
-static void __devinit
-mv64xxx_i2c_hw_init(struct mv64xxx_i2c_data *drv_data)
-{
-        writel(0, drv_data->reg_base + MV64XXX_I2C_REG_SOFT_RESET);
-        writel((((drv_data->freq_m & 0xf) << 3) | (drv_data->freq_n & 0x7)),
-                drv_data->reg_base + MV64XXX_I2C_REG_BAUD);
-        writel(0, drv_data->reg_base + MV64XXX_I2C_REG_SLAVE_ADDR);
-        writel(0, drv_data->reg_base + MV64XXX_I2C_REG_EXT_SLAVE_ADDR);
-        writel(MV64XXX_I2C_REG_CONTROL_TWSIEN | MV64XXX_I2C_REG_CONTROL_STOP,
-                drv_data->reg_base + MV64XXX_I2C_REG_CONTROL);
-        drv_data->state = MV64XXX_I2C_STATE_IDLE;
-}
-
 static int __devinit
 mv64xxx_i2c_map_regs(struct platform_device *pd,
         struct mv64xxx_i2c_data *drv_data)
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index e4540fcf6476..c44ada5f4292 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -39,8 +39,8 @@
 #include <asm/io.h>
 
 #include <asm/arch/regs-gpio.h>
-#include <asm/arch/regs-iic.h>
-#include <asm/arch/iic.h>
+#include <asm/plat-s3c/regs-iic.h>
+#include <asm/plat-s3c/iic.h>
 
 /* i2c controller state */
 
diff --git a/drivers/i2c/chips/isp1301_omap.c b/drivers/i2c/chips/isp1301_omap.c
index 9fafadb92510..fe04e46991aa 100644
--- a/drivers/i2c/chips/isp1301_omap.c
+++ b/drivers/i2c/chips/isp1301_omap.c
@@ -18,8 +18,6 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-#undef  DEBUG
-#undef  VERBOSE
 
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -44,7 +42,7 @@
 
 
 #define DRIVER_VERSION  "24 August 2004"
-#define DRIVER_NAME     (isp1301_driver.name)
+#define DRIVER_NAME     (isp1301_driver.driver.name)
 
 MODULE_DESCRIPTION("ISP1301 USB OTG Transceiver Driver");
 MODULE_LICENSE("GPL");
@@ -55,6 +53,7 @@ struct isp1301 {
         void                    (*i2c_release)(struct device *dev);
 
         int                     irq;
+        int                     irq_type;
 
         u32                     last_otg_ctrl;
         unsigned                working:1;
@@ -63,7 +62,7 @@ struct isp1301 {
 
         /* use keventd context to change the state for us */
         struct work_struct      work;
-        
+
         unsigned long           todo;
 #               define WORK_UPDATE_ISP  0       /* update ISP from OTG */
 #               define WORK_UPDATE_OTG  1       /* update OTG from ISP */
@@ -94,7 +93,7 @@ struct isp1301 {
 
 /* board-specific PM hooks */
 
-#include <asm/arch/gpio.h>
+#include <asm/gpio.h>
 #include <asm/arch/mux.h>
 #include <asm/mach-types.h>
 
@@ -291,7 +290,7 @@ static void power_up(struct isp1301 *isp)
 {
         // isp1301_clear_bits(isp, ISP1301_MODE_CONTROL_2, MC2_GLOBAL_PWR_DN);
         isp1301_clear_bits(isp, ISP1301_MODE_CONTROL_1, MC1_SUSPEND_REG);
-        
+
         /* do this only when cpu is driving transceiver,
          * so host won't see a low speed device...
          */
@@ -799,7 +798,7 @@ static irqreturn_t omap_otg_irq(int irq, void *_isp)
                 /* role is host */
                 } else {
                         if (!(otg_ctrl & OTG_ID)) {
-                                otg_ctrl &= OTG_CTRL_MASK & ~OTG_XCEIV_INPUTS;
+                                otg_ctrl &= OTG_CTRL_MASK & ~OTG_XCEIV_INPUTS;
                                 OTG_CTRL_REG = otg_ctrl | OTG_A_BUSREQ;
                         }
 
@@ -1100,9 +1099,9 @@ static u8 isp1301_clear_latch(struct isp1301 *isp)
 }
 
 static void
-isp1301_work(void *data)
+isp1301_work(struct work_struct *work)
 {
-        struct isp1301  *isp = data;
+        struct isp1301  *isp = container_of(work, struct isp1301, work);
         int             stop;
 
         /* implicit lock:  we're the only task using this device */
@@ -1244,7 +1243,7 @@ static int isp1301_detach_client(struct i2c_client *i2c)
  *  - DEVICE mode, for when there's a B/Mini-B (device) connector
  *
  * As a rule, you won't have an isp1301 chip unless it's there to
- * support the OTG mode.  Other modes help testing USB controllers 
+ * support the OTG mode.  Other modes help testing USB controllers
  * in isolation from (full) OTG support, or maybe so later board
  * revisions can help to support those feature.
  */
@@ -1260,9 +1259,9 @@ static int isp1301_otg_enable(struct isp1301 *isp)
          * a few more interrupts than are strictly needed.
          */
         isp1301_set_bits(isp, ISP1301_INTERRUPT_RISING,
-                INTR_VBUS_VLD | INTR_SESS_VLD | INTR_ID_GND);
+                INTR_VBUS_VLD | INTR_SESS_VLD | INTR_ID_GND);
         isp1301_set_bits(isp, ISP1301_INTERRUPT_FALLING,
-                INTR_VBUS_VLD | INTR_SESS_VLD | INTR_ID_GND);
+                INTR_VBUS_VLD | INTR_SESS_VLD | INTR_ID_GND);
 
         dev_info(&isp->client.dev, "ready for dual-role USB ...\n");
 
@@ -1306,9 +1305,9 @@ isp1301_set_host(struct otg_transceiver *otg, struct usb_bus *host)
 
         dev_info(&isp->client.dev, "A-Host sessions ok\n");
         isp1301_set_bits(isp, ISP1301_INTERRUPT_RISING,
-                INTR_ID_GND);
+                INTR_ID_GND);
         isp1301_set_bits(isp, ISP1301_INTERRUPT_FALLING,
-                INTR_ID_GND);
+                INTR_ID_GND);
 
         /* If this has a Mini-AB connector, this mode is highly
          * nonstandard ... but can be handy for testing, especially with
@@ -1368,9 +1367,9 @@ isp1301_set_peripheral(struct otg_transceiver *otg, struct usb_gadget *gadget)
                 isp1301_set_bits(isp, ISP1301_MODE_CONTROL_1, MC1_DAT_SE0);
 
         isp1301_set_bits(isp, ISP1301_INTERRUPT_RISING,
-                INTR_SESS_VLD);
+                INTR_SESS_VLD);
         isp1301_set_bits(isp, ISP1301_INTERRUPT_FALLING,
-                INTR_VBUS_VLD);
+                INTR_VBUS_VLD);
         dev_info(&isp->client.dev, "B-Peripheral sessions ok\n");
         dump_regs(isp, __FUNCTION__);
 
@@ -1494,7 +1493,7 @@ static int isp1301_probe(struct i2c_adapter *bus, int address, int kind)
         if (!isp)
                 return 0;
 
-        INIT_WORK(&isp->work, isp1301_work, isp);
+        INIT_WORK(&isp->work, isp1301_work);
         init_timer(&isp->timer);
         isp->timer.function = isp1301_timer;
         isp->timer.data = (unsigned long) isp;
@@ -1572,13 +1571,14 @@ fail1:
                 /* IRQ wired at M14 */
                 omap_cfg_reg(M14_1510_GPIO2);
                 isp->irq = OMAP_GPIO_IRQ(2);
-                omap_request_gpio(2);
-                omap_set_gpio_direction(2, 1);
-                omap_set_gpio_edge_ctrl(2, OMAP_GPIO_FALLING_EDGE);
+                if (gpio_request(2, "isp1301") == 0)
+                        gpio_direction_input(2);
+                isp->irq_type = IRQF_TRIGGER_FALLING;
         }
 
+        isp->irq_type |= IRQF_SAMPLE_RANDOM;
         status = request_irq(isp->irq, isp1301_irq,
-                        IRQF_SAMPLE_RANDOM, DRIVER_NAME, isp);
+                        isp->irq_type, DRIVER_NAME, isp);
         if (status < 0) {
                 dev_dbg(&i2c->dev, "can't get IRQ %d, err %d\n",
                                 isp->irq, status);
diff --git a/drivers/i2c/chips/menelaus.c b/drivers/i2c/chips/menelaus.c
index 48a7e2f0bdd3..d9c92c5e0077 100644
--- a/drivers/i2c/chips/menelaus.c
+++ b/drivers/i2c/chips/menelaus.c
@@ -1,4 +1,3 @@
-#define DEBUG
 /*
  * Copyright (C) 2004 Texas Instruments, Inc.
  *
@@ -933,7 +932,7 @@ static int menelaus_set_time(struct device *dev, struct rtc_time *t)
                 return status;
         status = menelaus_write_reg(MENELAUS_RTC_WKDAY, BIN2BCD(t->tm_wday));
         if (status < 0) {
-                dev_err(&the_menelaus->client->dev, "rtc write reg %02x",
+                dev_err(&the_menelaus->client->dev, "rtc write reg %02x "
                                 "err %d\n", MENELAUS_RTC_WKDAY, status);
                 return status;
         }
diff --git a/drivers/infiniband/core/agent.c b/drivers/infiniband/core/agent.c
index db2633e4aae6..ae7c2880e624 100644
--- a/drivers/infiniband/core/agent.c
+++ b/drivers/infiniband/core/agent.c
@@ -78,15 +78,14 @@ ib_get_agent_port(struct ib_device *device, int port_num)
         return entry;
 }
 
-int agent_send_response(struct ib_mad *mad, struct ib_grh *grh,
-                        struct ib_wc *wc, struct ib_device *device,
-                        int port_num, int qpn)
+void agent_send_response(struct ib_mad *mad, struct ib_grh *grh,
+                         struct ib_wc *wc, struct ib_device *device,
+                         int port_num, int qpn)
 {
         struct ib_agent_port_private *port_priv;
         struct ib_mad_agent *agent;
         struct ib_mad_send_buf *send_buf;
         struct ib_ah *ah;
-        int ret;
         struct ib_mad_send_wr_private *mad_send_wr;
 
         if (device->node_type == RDMA_NODE_IB_SWITCH)
@@ -96,23 +95,21 @@ int agent_send_response(struct ib_mad *mad, struct ib_grh *grh,
 
         if (!port_priv) {
                 printk(KERN_ERR SPFX "Unable to find port agent\n");
-                return -ENODEV;
+                return;
         }
 
         agent = port_priv->agent[qpn];
         ah = ib_create_ah_from_wc(agent->qp->pd, wc, grh, port_num);
         if (IS_ERR(ah)) {
-                ret = PTR_ERR(ah);
-                printk(KERN_ERR SPFX "ib_create_ah_from_wc error:%d\n", ret);
-                return ret;
+                printk(KERN_ERR SPFX "ib_create_ah_from_wc error\n");
+                return;
         }
 
         send_buf = ib_create_send_mad(agent, wc->src_qp, wc->pkey_index, 0,
                                       IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
                                       GFP_KERNEL);
         if (IS_ERR(send_buf)) {
-                ret = PTR_ERR(send_buf);
-                printk(KERN_ERR SPFX "ib_create_send_mad error:%d\n", ret);
+                printk(KERN_ERR SPFX "ib_create_send_mad error\n");
                 goto err1;
         }
 
@@ -126,16 +123,15 @@ int agent_send_response(struct ib_mad *mad, struct ib_grh *grh,
                 mad_send_wr->send_wr.wr.ud.port_num = port_num;
         }
 
-        if ((ret = ib_post_send_mad(send_buf, NULL))) {
-                printk(KERN_ERR SPFX "ib_post_send_mad error:%d\n", ret);
+        if (ib_post_send_mad(send_buf, NULL)) {
+                printk(KERN_ERR SPFX "ib_post_send_mad error\n");
                 goto err2;
         }
-        return 0;
+        return;
 err2:
         ib_free_send_mad(send_buf);
 err1:
         ib_destroy_ah(ah);
-        return ret;
 }
 
 static void agent_send_handler(struct ib_mad_agent *mad_agent,
diff --git a/drivers/infiniband/core/agent.h b/drivers/infiniband/core/agent.h
index 86d72fab37b0..fb9ed1489f95 100644
--- a/drivers/infiniband/core/agent.h
+++ b/drivers/infiniband/core/agent.h
@@ -46,8 +46,8 @@ extern int ib_agent_port_open(struct ib_device *device, int port_num);
 
 extern int ib_agent_port_close(struct ib_device *device, int port_num);
 
-extern int agent_send_response(struct ib_mad *mad, struct ib_grh *grh,
-                               struct ib_wc *wc, struct ib_device *device,
-                               int port_num, int qpn);
+extern void agent_send_response(struct ib_mad *mad, struct ib_grh *grh,
+                                struct ib_wc *wc, struct ib_device *device,
+                                int port_num, int qpn);
 
 #endif  /* __AGENT_H_ */
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 3ada17c0f239..2506c43ba041 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -702,7 +702,7 @@ int ib_find_pkey(struct ib_device *device,
                 if (ret)
                         return ret;
 
-                if (pkey == tmp_pkey) {
+                if ((pkey & 0x7fff) == (tmp_pkey & 0x7fff)) {
                         *index = i;
                         return 0;
                 }
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index bc547f1d34ba..6f4287716ab1 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1842,16 +1842,11 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
 {
         struct ib_mad_qp_info *qp_info;
         struct ib_mad_private_header *mad_priv_hdr;
-        struct ib_mad_private *recv, *response;
+        struct ib_mad_private *recv, *response = NULL;
         struct ib_mad_list_head *mad_list;
         struct ib_mad_agent_private *mad_agent;
         int port_num;
 
-        response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
-        if (!response)
-                printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "
-                       "for response buffer\n");
-
         mad_list = (struct ib_mad_list_head *)(unsigned long)wc->wr_id;
         qp_info = mad_list->mad_queue->qp_info;
         dequeue_mad(mad_list);
@@ -1879,6 +1874,13 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
         if (!validate_mad(&recv->mad.mad, qp_info->qp->qp_num))
                 goto out;
 
+        response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
+        if (!response) {
+                printk(KERN_ERR PFX "ib_mad_recv_done_handler no memory "
+                       "for response buffer\n");
+                goto out;
+        }
+
         if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)
                 port_num = wc->port_num;
         else
@@ -1914,12 +1916,11 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
                         response->header.recv_wc.recv_buf.mad = &response->mad.mad;
                         response->header.recv_wc.recv_buf.grh = &response->grh;
 
-                        if (!agent_send_response(&response->mad.mad,
-                                                 &response->grh, wc,
-                                                 port_priv->device,
-                                                 smi_get_fwd_port(&recv->mad.smp),
-                                                 qp_info->qp->qp_num))
-                                response = NULL;
+                        agent_send_response(&response->mad.mad,
+                                            &response->grh, wc,
+                                            port_priv->device,
+                                            smi_get_fwd_port(&recv->mad.smp),
+                                            qp_info->qp->qp_num);
 
                         goto out;
                 }
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 3663fd7022be..d43bc62005b3 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -163,8 +163,10 @@ static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent,
                                  hdr_len, 0, GFP_KERNEL);
         if (IS_ERR(msg))
                 ib_destroy_ah(ah);
-        else
+        else {
                 msg->ah = ah;
+                msg->context[0] = ah;
+        }
 
         return msg;
 }
@@ -197,9 +199,7 @@ static void ack_ds_ack(struct ib_mad_agent_private *agent,
 
 void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc)
 {
-        struct ib_rmpp_mad *rmpp_mad = mad_send_wc->send_buf->mad;
-
-        if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_ACK)
+        if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah)
                 ib_destroy_ah(mad_send_wc->send_buf->ah);
         ib_free_send_mad(mad_send_wc->send_buf);
 }
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 20ab6b3e484d..d271bd715c12 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -385,9 +385,7 @@ static void update_sm_ah(struct work_struct *work)
 
         new_ah->pkey_index = 0;
         if (ib_find_pkey(port->agent->device, port->port_num,
-                         IB_DEFAULT_PKEY_FULL, &new_ah->pkey_index) &&
-            ib_find_pkey(port->agent->device, port->port_num,
-                         IB_DEFAULT_PKEY_PARTIAL, &new_ah->pkey_index))
+                         IB_DEFAULT_PKEY_FULL, &new_ah->pkey_index))
                 printk(KERN_ERR "Couldn't find index for default PKey\n");
 
         memset(&ah_attr, 0, sizeof ah_attr);
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 26d0470eef6e..664d2faa9e74 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -40,6 +40,11 @@
 
 #include "uverbs.h"
 
+#define IB_UMEM_MAX_PAGE_CHUNK                                          \
+        ((PAGE_SIZE - offsetof(struct ib_umem_chunk, page_list)) /      \
+         ((void *) &((struct ib_umem_chunk *) 0)->page_list[1] -        \
+          (void *) &((struct ib_umem_chunk *) 0)->page_list[0]))
+
 static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int dirty)
 {
         struct ib_umem_chunk *chunk, *tmp;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 9574088f0d4e..1cdfcd43b0bc 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -139,7 +139,7 @@ static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb)
         req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
         OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_TID_RELEASE, hwtid));
         skb->priority = CPL_PRIORITY_SETUP;
-        tdev->send(tdev, skb);
+        cxgb3_ofld_send(tdev, skb);
         return;
 }
 
@@ -161,7 +161,7 @@ int iwch_quiesce_tid(struct iwch_ep *ep)
         req->val = cpu_to_be64(1 << S_TCB_RX_QUIESCE);
 
         skb->priority = CPL_PRIORITY_DATA;
-        ep->com.tdev->send(ep->com.tdev, skb);
+        cxgb3_ofld_send(ep->com.tdev, skb);
         return 0;
 }
 
@@ -183,7 +183,7 @@ int iwch_resume_tid(struct iwch_ep *ep)
         req->val = 0;
 
         skb->priority = CPL_PRIORITY_DATA;
-        ep->com.tdev->send(ep->com.tdev, skb);
+        cxgb3_ofld_send(ep->com.tdev, skb);
         return 0;
 }
 
@@ -784,7 +784,7 @@ static int update_rx_credits(struct iwch_ep *ep, u32 credits)
         OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_RX_DATA_ACK, ep->hwtid));
         req->credit_dack = htonl(V_RX_CREDITS(credits) | V_RX_FORCE_ACK(1));
         skb->priority = CPL_PRIORITY_ACK;
-        ep->com.tdev->send(ep->com.tdev, skb);
+        cxgb3_ofld_send(ep->com.tdev, skb);
         return credits;
 }
 
@@ -1152,7 +1152,7 @@ static int listen_start(struct iwch_listen_ep *ep)
         req->opt1 = htonl(V_CONN_POLICY(CPL_CONN_POLICY_ASK));
 
         skb->priority = 1;
-        ep->com.tdev->send(ep->com.tdev, skb);
+        cxgb3_ofld_send(ep->com.tdev, skb);
         return 0;
 }
 
@@ -1186,7 +1186,7 @@ static int listen_stop(struct iwch_listen_ep *ep)
         req->cpu_idx = 0;
         OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_CLOSE_LISTSRV_REQ, ep->stid));
         skb->priority = 1;
-        ep->com.tdev->send(ep->com.tdev, skb);
+        cxgb3_ofld_send(ep->com.tdev, skb);
         return 0;
 }
 
@@ -1264,7 +1264,7 @@ static void reject_cr(struct t3cdev *tdev, u32 hwtid, __be32 peer_ip,
                 rpl->opt0l_status = htonl(CPL_PASS_OPEN_REJECT);
                 rpl->opt2 = 0;
                 rpl->rsvd = rpl->opt2;
-                tdev->send(tdev, skb);
+                cxgb3_ofld_send(tdev, skb);
         }
 }
 
@@ -1557,7 +1557,7 @@ static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         rpl->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
         OPCODE_TID(rpl) = htonl(MK_OPCODE_TID(CPL_ABORT_RPL, ep->hwtid));
         rpl->cmd = CPL_ABORT_NO_RST;
-        ep->com.tdev->send(ep->com.tdev, rpl_skb);
+        cxgb3_ofld_send(ep->com.tdev, rpl_skb);
         if (state != ABORTING) {
                 state_set(&ep->com, DEAD);
                 release_ep_resources(ep);
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 660b27aecae5..8bf44daf45ec 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -389,7 +389,7 @@ static int mlx4_ib_poll_one(struct mlx4_ib_cq *cq,
                         wc->opcode    = IB_WC_SEND;
                         break;
                 case MLX4_OPCODE_RDMA_READ:
-                        wc->opcode    = IB_WC_SEND;
+                        wc->opcode    = IB_WC_RDMA_READ;
                         wc->byte_len  = be32_to_cpu(cqe->byte_cnt);
                         break;
                 case MLX4_OPCODE_ATOMIC_CS:
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 333091787c5f..0ed02b7834da 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -109,7 +109,7 @@ int mlx4_MAD_IFC(struct mlx4_ib_dev *dev, int ignore_mkey, int ignore_bkey,
                            in_modifier, op_modifier,
                            MLX4_CMD_MAD_IFC, MLX4_CMD_TIME_CLASS_C);
 
-        if (!err);
+        if (!err)
                 memcpy(response_mad, outmailbox->buf, 256);
 
         mlx4_free_cmd_mailbox(dev->dev, inmailbox);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 982eb88e27ec..563aeacf9e14 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -211,6 +211,7 @@ out_free_cq:
 
 out_free_mr:
         ib_dereg_mr(priv->mr);
+        ipoib_cm_dev_cleanup(dev);
 
 out_free_pd:
         ib_dealloc_pd(priv->pd);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index f01ca182f226..f6a051428144 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -75,16 +75,12 @@ module_param(topspin_workarounds, int, 0444);
 MODULE_PARM_DESC(topspin_workarounds,
                  "Enable workarounds for Topspin/Cisco SRP target bugs if != 0");
 
-static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
-
 static int mellanox_workarounds = 1;
 
 module_param(mellanox_workarounds, int, 0444);
 MODULE_PARM_DESC(mellanox_workarounds,
                  "Enable workarounds for Mellanox SRP target bugs if != 0");
 
-static const u8 mellanox_oui[3] = { 0x00, 0x02, 0xc9 };
-
 static void srp_add_one(struct ib_device *device);
 static void srp_remove_one(struct ib_device *device);
 static void srp_completion(struct ib_cq *cq, void *target_ptr);
@@ -108,6 +104,24 @@ static const char *srp_target_info(struct Scsi_Host *host)
         return host_to_target(host)->target_name;
 }
 
+static int srp_target_is_topspin(struct srp_target_port *target)
+{
+        static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
+        static const u8 cisco_oui[3]   = { 0x00, 0x1b, 0x0d };
+
+        return topspin_workarounds &&
+                (!memcmp(&target->ioc_guid, topspin_oui, sizeof topspin_oui) ||
+                 !memcmp(&target->ioc_guid, cisco_oui, sizeof cisco_oui));
+}
+
+static int srp_target_is_mellanox(struct srp_target_port *target)
+{
+        static const u8 mellanox_oui[3] = { 0x00, 0x02, 0xc9 };
+
+        return mellanox_workarounds &&
+                !memcmp(&target->ioc_guid, mellanox_oui, sizeof mellanox_oui);
+}
+
 static struct srp_iu *srp_alloc_iu(struct srp_host *host, size_t size,
                                    gfp_t gfp_mask,
                                    enum dma_data_direction direction)
@@ -360,7 +374,7 @@ static int srp_send_req(struct srp_target_port *target)
          * zero out the first 8 bytes of our initiator port ID and set
          * the second 8 bytes to the local node GUID.
          */
-        if (topspin_workarounds && !memcmp(&target->ioc_guid, topspin_oui, 3)) {
+        if (srp_target_is_topspin(target)) {
                 printk(KERN_DEBUG PFX "Topspin/Cisco initiator port ID workaround "
                        "activated for target GUID %016llx\n",
                        (unsigned long long) be64_to_cpu(target->ioc_guid));
@@ -585,8 +599,8 @@ static int srp_map_fmr(struct srp_target_port *target, struct scatterlist *scat,
         if (!dev->fmr_pool)
                 return -ENODEV;
 
-        if ((ib_sg_dma_address(ibdev, &scat[0]) & ~dev->fmr_page_mask) &&
-            mellanox_workarounds && !memcmp(&target->ioc_guid, mellanox_oui, 3))
+        if (srp_target_is_mellanox(target) &&
+            (ib_sg_dma_address(ibdev, &scat[0]) & ~dev->fmr_page_mask))
                 return -EINVAL;
 
         len = page_cnt = 0;
@@ -1087,8 +1101,7 @@ static void srp_cm_rej_handler(struct ib_cm_id *cm_id,
                 break;
 
         case IB_CM_REJ_PORT_REDIRECT:
-                if (topspin_workarounds &&
-                    !memcmp(&target->ioc_guid, topspin_oui, 3)) {
+                if (srp_target_is_topspin(target)) {
                         /*
                          * Topspin/Cisco SRP gateways incorrectly send
                          * reject reason code 25 when they mean 24
diff --git a/drivers/kvm/Kconfig b/drivers/kvm/Kconfig
index 6cecc396e040..7b64fd4aa2f3 100644
--- a/drivers/kvm/Kconfig
+++ b/drivers/kvm/Kconfig
@@ -5,6 +5,11 @@ menuconfig VIRTUALIZATION
         bool "Virtualization"
         depends on X86
         default y
+        ---help---
+          Say Y here to get to see options for virtualization guest drivers.
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if VIRTUALIZATION
 
diff --git a/drivers/lguest/lguest.c b/drivers/lguest/lguest.c
index 524beea7fb19..6e135ac0834f 100644
--- a/drivers/lguest/lguest.c
+++ b/drivers/lguest/lguest.c
@@ -936,23 +936,24 @@ static const struct lguest_insns
 /* Now our patch routine is fairly simple (based on the native one in
  * paravirt.c).  If we have a replacement, we copy it in and return how much of
  * the available space we used. */
-static unsigned lguest_patch(u8 type, u16 clobber, void *insns, unsigned len)
+static unsigned lguest_patch(u8 type, u16 clobber, void *ibuf,
+                             unsigned long addr, unsigned len)
 {
         unsigned int insn_len;
 
         /* Don't do anything special if we don't have a replacement */
         if (type >= ARRAY_SIZE(lguest_insns) || !lguest_insns[type].start)
-                return paravirt_patch_default(type, clobber, insns, len);
+                return paravirt_patch_default(type, clobber, ibuf, addr, len);
 
         insn_len = lguest_insns[type].end - lguest_insns[type].start;
 
         /* Similarly if we can't fit replacement (shouldn't happen, but let's
          * be thorough). */
         if (len < insn_len)
-                return paravirt_patch_default(type, clobber, insns, len);
+                return paravirt_patch_default(type, clobber, ibuf, addr, len);
 
         /* Copy in our instructions. */
-        memcpy(insns, lguest_insns[type].start, insn_len);
+        memcpy(ibuf, lguest_insns[type].start, insn_len);
         return insn_len;
 }
 
diff --git a/drivers/lguest/lguest_bus.c b/drivers/lguest/lguest_bus.c
index 55a7940ca732..9e7752cc8002 100644
--- a/drivers/lguest/lguest_bus.c
+++ b/drivers/lguest/lguest_bus.c
@@ -5,6 +5,7 @@
 #include <linux/bootmem.h>
 #include <linux/lguest_bus.h>
 #include <asm/io.h>
+#include <asm/paravirt.h>
 
 static ssize_t type_show(struct device *_dev,
                          struct device_attribute *attr, char *buf)
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index dbe96268866e..56cd8998fe4b 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -3,6 +3,11 @@ menuconfig MACINTOSH_DRIVERS
         bool "Macintosh device drivers"
         depends on PPC || MAC || X86
         default y if (PPC_PMAC || MAC)
+        ---help---
+          Say Y here to get to see options for devices used with Macintosh
+          computers. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if MACINTOSH_DRIVERS
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 141ff9fa296e..2120155929a6 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -580,8 +580,8 @@ static void __map_bio(struct dm_target *ti, struct bio *clone,
                 /* the bio has been remapped so dispatch it */
 
                 blk_add_trace_remap(bdev_get_queue(clone->bi_bdev), clone,
-                                    tio->io->bio->bi_bdev->bd_dev, sector,
-                                    clone->bi_sector);
+                                    tio->io->bio->bi_bdev->bd_dev,
+                                    clone->bi_sector, sector);
 
                 generic_make_request(clone);
         } else if (r < 0 || r == DM_MAPIO_REQUEUE) {
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index aaaa61ea4217..a26655881e6a 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -5,6 +5,11 @@
 menuconfig MISC_DEVICES
         bool "Misc devices"
         default y
+        ---help---
+          Say Y here to get to see options for device drivers from various
+          different categories. This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if MISC_DEVICES
 
@@ -200,14 +205,22 @@ config THINKPAD_ACPI_BAY
 config THINKPAD_ACPI_INPUT_ENABLED
         bool "Enable input layer support by default"
         depends on THINKPAD_ACPI
-        default y
+        default n
         ---help---
-          Enables hot key handling over the input layer by default.  If unset,
-          the driver does not enable any hot key handling by default, and also
-          starts up with a mostly empty keymap.
-
-          If you are not sure, say Y here.  Say N to retain the deprecated
-          behavior of ibm-acpi, and thinkpad-acpi for kernels up to 2.6.21.
+          This option enables thinkpad-acpi hot key handling over the input
+          layer at driver load time.  When it is unset, the driver does not
+          enable hot key handling by default, and also starts up with a mostly
+          empty keymap.
+
+          This option should be enabled if you have a new enough HAL or other
+          userspace support that properly handles the thinkpad-acpi event
+          device.  It auto-tunes the hot key support to those reported by the
+          firmware and enables it automatically.
+
+          If unsure, say N here to retain the old behaviour of ibm-acpi, and
+          thinkpad-acpi up to kernel 2.6.21: userspace will have to enable and
+          set up the thinkpad-acpi hot key handling using the sysfs interace
+          after loading the driver.
 
 
 endif # MISC_DEVICES
diff --git a/drivers/misc/sony-laptop.c b/drivers/misc/sony-laptop.c
index 14ee06c8f127..91da6880ae93 100644
--- a/drivers/misc/sony-laptop.c
+++ b/drivers/misc/sony-laptop.c
@@ -845,7 +845,7 @@ static struct sony_nc_event sony_C_events[] = {
 };
 
 /* SNC-only model map */
-struct dmi_system_id sony_nc_ids[] = {
+static struct dmi_system_id sony_nc_ids[] = {
                 {
                         .ident = "Sony Vaio FE Series",
                         .callback = sony_nc_C_enable,
@@ -942,6 +942,11 @@ static int sony_nc_resume(struct acpi_device *device)
                 }
         }
 
+        /* set the last requested brightness level */
+        if (sony_backlight_device &&
+                        !sony_backlight_update_status(sony_backlight_device))
+                printk(KERN_WARNING DRV_PFX "unable to restore brightness level");
+
         /* re-initialize models with specific requirements */
         dmi_check_system(sony_nc_ids);
 
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index fa80f355e522..f6cd34a3dbac 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -4668,12 +4668,15 @@ static int __init thinkpad_acpi_module_init(void)
                 thinkpad_acpi_module_exit();
                 return ret;
         }
+        tp_features.platform_drv_registered = 1;
+
         ret = tpacpi_create_driver_attributes(&tpacpi_pdriver.driver);
         if (ret) {
                 printk(IBM_ERR "unable to create sysfs driver attributes\n");
                 thinkpad_acpi_module_exit();
                 return ret;
         }
+        tp_features.platform_drv_attrs_registered = 1;
 
 
         /* Device initialization */
@@ -4756,8 +4759,11 @@ static void thinkpad_acpi_module_exit(void)
         if (tpacpi_pdev)
                 platform_device_unregister(tpacpi_pdev);
 
-        tpacpi_remove_driver_attributes(&tpacpi_pdriver.driver);
-        platform_driver_unregister(&tpacpi_pdriver);
+        if (tp_features.platform_drv_attrs_registered)
+                tpacpi_remove_driver_attributes(&tpacpi_pdriver.driver);
+
+        if (tp_features.platform_drv_registered)
+                platform_driver_unregister(&tpacpi_pdriver);
 
         if (proc_dir)
                 remove_proc_entry(IBM_PROC_DIR, acpi_root_dir);
diff --git a/drivers/misc/thinkpad_acpi.h b/drivers/misc/thinkpad_acpi.h
index 88af089d6494..eee8809a50d9 100644
--- a/drivers/misc/thinkpad_acpi.h
+++ b/drivers/misc/thinkpad_acpi.h
@@ -246,6 +246,8 @@ static struct {
         u16 wan:1;
         u16 fan_ctrl_status_undef:1;
         u16 input_device_registered:1;
+        u16 platform_drv_registered:1;
+        u16 platform_drv_attrs_registered:1;
 } tp_features;
 
 struct thinkpad_id_data {
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 8c86b802f212..d091b2430b48 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -7,6 +7,7 @@
 
 #include <linux/device.h>
 #include <linux/fs.h>
+#include <linux/mm.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 001c66dd3a94..a8c0f436cdd2 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1555,6 +1555,7 @@ vortex_up(struct net_device *dev)
                 mii_reg1 = mdio_read(dev, vp->phys[0], MII_BMSR);
                 mii_reg5 = mdio_read(dev, vp->phys[0], MII_LPA);
                 vp->partner_flow_ctrl = ((mii_reg5 & 0x0400) != 0);
+                vp->mii.full_duplex = vp->full_duplex;
 
                 vortex_check_media(dev, 1);
         }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 81ef81c9a584..5b9e17bf1749 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1968,6 +1968,16 @@ menuconfig NETDEV_1000
         bool "Ethernet (1000 Mbit)"
         depends on !UML
         default y
+        ---help---
+          Ethernet (also called IEEE 802.3 or ISO 8802-2) is the most common
+          type of Local Area Network (LAN) in universities and companies.
+
+          Say Y here to get to see options for Gigabit Ethernet drivers.
+          This option alone does not add any kernel code.
+          Note that drivers supporting both 100 and 1000 MBit may be listed
+          under "Ethernet (10 or 100MBit)" instead.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if NETDEV_1000
 
@@ -2339,6 +2349,11 @@ menuconfig NETDEV_10000
         bool "Ethernet (10000 Mbit)"
         depends on !UML
         default y
+        ---help---
+          Say Y here to get to see options for 10 Gigabit Ethernet drivers.
+          This option alone does not add any kernel code.
+
+          If you say N, all options in this submenu will be skipped and disabled.
 
 if NETDEV_10000
 
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 83da1770bafb..90e0734e6037 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -821,8 +821,9 @@ static int ax_probe(struct platform_device *pdev)
         dev->base_addr = (unsigned long)ei_status.mem;
 
         if (ei_status.mem == NULL) {
-                dev_err(&pdev->dev, "Cannot ioremap area (%08zx,%08zx)\n",
-                        res->start, res->end);
+                dev_err(&pdev->dev, "Cannot ioremap area (%08llx,%08llx)\n",
+                        (unsigned long long)res->start,
+                        (unsigned long long)res->end);
 
                 ret = -ENXIO;
                 goto exit_req;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 070b78d959cc..1afda3230def 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1202,43 +1202,35 @@ static int bond_sethwaddr(struct net_device *bond_dev,
         return 0;
 }
 
-#define BOND_INTERSECT_FEATURES \
-        (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_TSO | NETIF_F_UFO)
+#define BOND_VLAN_FEATURES \
+        (NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX | \
+         NETIF_F_HW_VLAN_FILTER)
 
 /* 
  * Compute the common dev->feature set available to all slaves.  Some
- * feature bits are managed elsewhere, so preserve feature bits set on
- * master device that are not part of the examined set.
+ * feature bits are managed elsewhere, so preserve those feature bits
+ * on the master device.
  */
 static int bond_compute_features(struct bonding *bond)
 {
-        unsigned long features = BOND_INTERSECT_FEATURES;
         struct slave *slave;
         struct net_device *bond_dev = bond->dev;
+        unsigned long features = bond_dev->features;
         unsigned short max_hard_header_len = ETH_HLEN;
         int i;
 
+        features &= ~(NETIF_F_ALL_CSUM | BOND_VLAN_FEATURES);
+        features |= NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
+                    NETIF_F_GSO_MASK | NETIF_F_NO_CSUM;
+
         bond_for_each_slave(bond, slave, i) {
-                features &= (slave->dev->features & BOND_INTERSECT_FEATURES);
+                features = netdev_compute_features(features,
+                                                   slave->dev->features);
                 if (slave->dev->hard_header_len > max_hard_header_len)
                         max_hard_header_len = slave->dev->hard_header_len;
         }
 
-        if ((features & NETIF_F_SG) && 
-            !(features & NETIF_F_ALL_CSUM))
-                features &= ~NETIF_F_SG;
-
-        /* 
-         * features will include NETIF_F_TSO (NETIF_F_UFO) iff all 
-         * slave devices support NETIF_F_TSO (NETIF_F_UFO), which 
-         * implies that all slaves also support scatter-gather 
-         * (NETIF_F_SG), which implies that features also includes 
-         * NETIF_F_SG. So no need to check whether we have an  
-         * illegal combination of NETIF_F_{TSO,UFO} and 
-         * !NETIF_F_SG 
-         */
-
-        features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES);
+        features |= (bond_dev->features & BOND_VLAN_FEATURES);
         bond_dev->features = features;
         bond_dev->hard_header_len = max_hard_header_len;
 
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index c90c92e72d2a..4c3785c9d4b8 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1706,6 +1706,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
         case E1000_DEV_ID_82545EM_COPPER:
         case E1000_DEV_ID_82546GB_QUAD_COPPER:
         case E1000_DEV_ID_82546GB_PCIE:
+        case E1000_DEV_ID_82571EB_SERDES_QUAD:
                 /* these don't support WoL at all */
                 wol->supported = 0;
                 break;
@@ -1723,6 +1724,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
                 retval = 0;
                 break;
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
                 /* quad port adapters only support WoL on port A */
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index 9be44699300b..ba120f7fb0be 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -384,7 +384,10 @@ e1000_set_mac_type(struct e1000_hw *hw)
         case E1000_DEV_ID_82571EB_COPPER:
         case E1000_DEV_ID_82571EB_FIBER:
         case E1000_DEV_ID_82571EB_SERDES:
+        case E1000_DEV_ID_82571EB_SERDES_DUAL:
+        case E1000_DEV_ID_82571EB_SERDES_QUAD:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 hw->mac_type = e1000_82571;
                 break;
@@ -485,6 +488,8 @@ e1000_set_media_type(struct e1000_hw *hw)
     case E1000_DEV_ID_82545GM_SERDES:
     case E1000_DEV_ID_82546GB_SERDES:
     case E1000_DEV_ID_82571EB_SERDES:
+    case E1000_DEV_ID_82571EB_SERDES_DUAL:
+    case E1000_DEV_ID_82571EB_SERDES_QUAD:
     case E1000_DEV_ID_82572EI_SERDES:
     case E1000_DEV_ID_80003ES2LAN_SERDES_DPT:
         hw->media_type = e1000_media_type_internal_serdes;
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index bd000b802ee7..fe8714655c90 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -475,7 +475,10 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82571EB_FIBER       0x105F
 #define E1000_DEV_ID_82571EB_SERDES      0x1060
 #define E1000_DEV_ID_82571EB_QUAD_COPPER 0x10A4
+#define E1000_DEV_ID_82571EB_QUAD_FIBER  0x10A5
 #define E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE  0x10BC
+#define E1000_DEV_ID_82571EB_SERDES_DUAL 0x10D9
+#define E1000_DEV_ID_82571EB_SERDES_QUAD 0x10DA
 #define E1000_DEV_ID_82572EI_COPPER      0x107D
 #define E1000_DEV_ID_82572EI_FIBER       0x107E
 #define E1000_DEV_ID_82572EI_SERDES      0x107F
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index f48b659e0c2b..4a225950fb43 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -100,6 +100,7 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x1099),
         INTEL_E1000_ETHERNET_DEVICE(0x109A),
         INTEL_E1000_ETHERNET_DEVICE(0x10A4),
+        INTEL_E1000_ETHERNET_DEVICE(0x10A5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B5),
         INTEL_E1000_ETHERNET_DEVICE(0x10B9),
         INTEL_E1000_ETHERNET_DEVICE(0x10BA),
@@ -107,6 +108,8 @@ static struct pci_device_id e1000_pci_tbl[] = {
         INTEL_E1000_ETHERNET_DEVICE(0x10BC),
         INTEL_E1000_ETHERNET_DEVICE(0x10C4),
         INTEL_E1000_ETHERNET_DEVICE(0x10C5),
+        INTEL_E1000_ETHERNET_DEVICE(0x10D9),
+        INTEL_E1000_ETHERNET_DEVICE(0x10DA),
         /* required last entry */
         {0,}
 };
@@ -1096,6 +1099,7 @@ e1000_probe(struct pci_dev *pdev,
                 break;
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
         case E1000_DEV_ID_82571EB_QUAD_COPPER:
+        case E1000_DEV_ID_82571EB_QUAD_FIBER:
         case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                 /* if quad port adapter, disable WoL on all but port A */
                 if (global_quad_port_a != 0)
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 69f5f365239a..10f4e3b55168 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3068,8 +3068,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                                 np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         break;
                 }
 
@@ -3186,8 +3186,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                                 np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         break;
                 }
 
@@ -3233,8 +3233,8 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_TX_ALL;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
                         break;
                 }
 
@@ -3348,8 +3348,8 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_RX_ALL;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
                         break;
                 }
         }
@@ -3421,8 +3421,8 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                 np->nic_poll_irq |= NVREG_IRQ_OTHER;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
-                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
                         spin_unlock_irqrestore(&np->lock, flags);
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
                         break;
                 }
 
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 0ac240ca905b..3b0fd83fa266 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1561,10 +1561,9 @@ static inline struct irda_class_desc *irda_usb_find_class_desc(struct usb_interf
         struct irda_class_desc *desc;
         int ret;
 
-        desc = kmalloc(sizeof (*desc), GFP_KERNEL);
-        if (desc == NULL) 
+        desc = kzalloc(sizeof(*desc), GFP_KERNEL);
+        if (!desc)
                 return NULL;
-        memset(desc, 0, sizeof(*desc));
 
         /* USB-IrDA class spec 1.0:
          *      6.1.3: Standard "Get Descriptor" Device Request is not
@@ -1617,7 +1616,7 @@ static int irda_usb_probe(struct usb_interface *intf,
 {
         struct net_device *net;
         struct usb_device *dev = interface_to_usbdev(intf);
-        struct irda_usb_cb *self = NULL;
+        struct irda_usb_cb *self;
         struct usb_host_interface *interface;
         struct irda_class_desc *irda_desc;
         int ret = -ENOMEM;
@@ -1655,7 +1654,7 @@ static int irda_usb_probe(struct usb_interface *intf,
                 self->header_length = USB_IRDA_HEADER;
         }
 
-        self->rx_urb = kzalloc(self->max_rx_urb * sizeof(struct urb *),
+        self->rx_urb = kcalloc(self->max_rx_urb, sizeof(struct urb *),
                                 GFP_KERNEL);
 
         for (i = 0; i < self->max_rx_urb; i++) {
@@ -1715,7 +1714,7 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Find IrDA class descriptor */
         irda_desc = irda_usb_find_class_desc(intf);
         ret = -ENODEV;
-        if (irda_desc == NULL)
+        if (!irda_desc)
                 goto err_out_3;
 
         if (self->needspatch) {
@@ -1738,15 +1737,13 @@ static int irda_usb_probe(struct usb_interface *intf,
         /* Don't change this buffer size and allocation without doing
          * some heavy and complete testing. Don't ask why :-(
          * Jean II */
-        self->speed_buff = kmalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
-        if (self->speed_buff == NULL) 
+        self->speed_buff = kzalloc(IRDA_USB_SPEED_MTU, GFP_KERNEL);
+        if (!self->speed_buff)
                 goto err_out_3;
 
-        memset(self->speed_buff, 0, IRDA_USB_SPEED_MTU);
-
         self->tx_buff = kzalloc(IRDA_SKB_MAX_MTU + self->header_length,
                                 GFP_KERNEL);
-        if (self->tx_buff == NULL)
+        if (!self->tx_buff)
                 goto err_out_4;
 
         ret = irda_usb_open(self);
@@ -1767,12 +1764,11 @@ static int irda_usb_probe(struct usb_interface *intf,
 
                 /* replace IrDA class descriptor with what patched device is now reporting */
                 irda_desc = irda_usb_find_class_desc (self->usbintf);
-                if (irda_desc == NULL) {
+                if (!irda_desc) {
                         ret = -ENODEV;
                         goto err_out_6;
                 }
-                if (self->irda_desc)
-                        kfree (self->irda_desc);
+                kfree(self->irda_desc);
                 self->irda_desc = irda_desc;
                 irda_usb_init_qos(self);
         }
diff --git a/drivers/net/mlx4/reset.c b/drivers/net/mlx4/reset.c
index e4dfd4b11a4a..e199715fabd0 100644
--- a/drivers/net/mlx4/reset.c
+++ b/drivers/net/mlx4/reset.c
@@ -119,6 +119,9 @@ int mlx4_reset(struct mlx4_dev *dev)
         writel(MLX4_RESET_VALUE, reset + MLX4_RESET_OFFSET);
         iounmap(reset);
 
+        /* Docs say to wait one second before accessing device */
+        msleep(1000);
+
         end = jiffies + MLX4_RESET_TIMEOUT_JIFFIES;
         do {
                 if (!pci_read_config_word(dev->pdev, PCI_VENDOR_ID, &vendor) &&
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index deca65330b0f..ae9bb7b7fd67 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -191,6 +191,7 @@ struct myri10ge_priv {
         struct timer_list watchdog_timer;
         int watchdog_tx_done;
         int watchdog_tx_req;
+        int watchdog_pause;
         int watchdog_resets;
         int tx_linearized;
         int pause;
@@ -2800,6 +2801,7 @@ static void myri10ge_watchdog(struct work_struct *work)
 static void myri10ge_watchdog_timer(unsigned long arg)
 {
         struct myri10ge_priv *mgp;
+        u32 rx_pause_cnt;
 
         mgp = (struct myri10ge_priv *)arg;
 
@@ -2816,19 +2818,28 @@ static void myri10ge_watchdog_timer(unsigned long arg)
                     myri10ge_fill_thresh)
                         mgp->rx_big.watchdog_needed = 0;
         }
+        rx_pause_cnt = ntohl(mgp->fw_stats->dropped_pause);
 
         if (mgp->tx.req != mgp->tx.done &&
             mgp->tx.done == mgp->watchdog_tx_done &&
-            mgp->watchdog_tx_req != mgp->watchdog_tx_done)
+            mgp->watchdog_tx_req != mgp->watchdog_tx_done) {
                 /* nic seems like it might be stuck.. */
-                schedule_work(&mgp->watchdog_work);
-        else
-                /* rearm timer */
-                mod_timer(&mgp->watchdog_timer,
-                          jiffies + myri10ge_watchdog_timeout * HZ);
-
+                if (rx_pause_cnt != mgp->watchdog_pause) {
+                        if (net_ratelimit())
+                                printk(KERN_WARNING "myri10ge %s:"
+                                       "TX paused, check link partner\n",
+                                       mgp->dev->name);
+                } else {
+                        schedule_work(&mgp->watchdog_work);
+                        return;
+                }
+        }
+        /* rearm timer */
+        mod_timer(&mgp->watchdog_timer,
+                  jiffies + myri10ge_watchdog_timeout * HZ);
         mgp->watchdog_tx_done = mgp->tx.done;
         mgp->watchdog_tx_req = mgp->tx.req;
+        mgp->watchdog_pause = rx_pause_cnt;
 }
 
 static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 6bb48ba80964..b47a12d684f9 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2438,13 +2438,16 @@ static void netdev_error(struct net_device *dev, int intr_status)
                                 dev->name);
                 }
                 np->stats.rx_fifo_errors++;
+                np->stats.rx_errors++;
         }
         /* Hmmmmm, it's not clear how to recover from PCI faults. */
         if (intr_status & IntrPCIErr) {
                 printk(KERN_NOTICE "%s: PCI error %#08x\n", dev->name,
                         intr_status & IntrPCIErr);
                 np->stats.tx_fifo_errors++;
+                np->stats.tx_errors++;
                 np->stats.rx_fifo_errors++;
+                np->stats.rx_errors++;
         }
         spin_unlock(&np->lock);
 }
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index c3fe230695a0..b56dff26772d 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -42,7 +42,13 @@ static int max_interrupt_work = 20;
 
 /* Set the copy breakpoint for the copy-only-tiny-frames scheme.
    Setting to > 1518 effectively disables this feature. */
+#if defined(__alpha__) || defined(__arm__) || defined(__hppa__) \
+       || defined(CONFIG_SPARC) || defined(__ia64__) \
+       || defined(__sh__) || defined(__mips__)
+static int rx_copybreak = 1518;
+#else
 static int rx_copybreak;
+#endif
 
 /* Work-around for broken BIOSes: they are unable to get the chip back out of
    power state D3 so PXE booting fails. bootparam(7): via-rhine.avoid_D3=1 */
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index 15b6e07a4382..071a64cacd5c 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -212,14 +212,13 @@ static pvc_device* add_pvc(struct net_device *dev, u16 dlci)
                 pvc_p = &(*pvc_p)->next;
         }
 
-        pvc = kmalloc(sizeof(pvc_device), GFP_ATOMIC);
+        pvc = kzalloc(sizeof(pvc_device), GFP_ATOMIC);
 #ifdef DEBUG_PVC
         printk(KERN_DEBUG "add_pvc: allocated pvc %p, frad %p\n", pvc, dev);
 #endif
         if (!pvc)
                 return NULL;
 
-        memset(pvc, 0, sizeof(pvc_device));
         pvc->dlci = dlci;
         pvc->frad = dev;
         pvc->next = *pvc_p;     /* Put it in the chain */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 489f69c5d6ca..4445810335a8 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -566,6 +566,10 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (notify)
                 notify_remote_via_irq(np->netdev->irq);
 
+        np->stats.tx_bytes += skb->len;
+        np->stats.tx_packets++;
+
+        /* Note: It is not safe to access skb after xennet_tx_buf_gc()! */
         xennet_tx_buf_gc(dev);
 
         if (!netfront_tx_slot_available(np))
@@ -573,9 +577,6 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         spin_unlock_irq(&np->tx_lock);
 
-        np->stats.tx_bytes += skb->len;
-        np->stats.tx_packets++;
-
         return 0;
 
  drop:
diff --git a/drivers/s390/char/monwriter.c b/drivers/s390/char/monwriter.c
index 268598ef3efe..20442fbf9346 100644
--- a/drivers/s390/char/monwriter.c
+++ b/drivers/s390/char/monwriter.c
@@ -17,6 +17,7 @@
 #include <linux/miscdevice.h>
 #include <linux/ctype.h>
 #include <linux/poll.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <asm/ebcdic.h>
 #include <asm/io.h>
@@ -41,6 +42,7 @@ struct mon_private {
         size_t hdr_to_read;
         size_t data_to_read;
         struct mon_buf *current_buf;
+        struct mutex thread_mutex;
 };
 
 /*
@@ -179,6 +181,7 @@ static int monwrite_open(struct inode *inode, struct file *filp)
                 return -ENOMEM;
         INIT_LIST_HEAD(&monpriv->list);
         monpriv->hdr_to_read = sizeof(monpriv->hdr);
+        mutex_init(&monpriv->thread_mutex);
         filp->private_data = monpriv;
         return nonseekable_open(inode, filp);
 }
@@ -209,6 +212,7 @@ static ssize_t monwrite_write(struct file *filp, const char __user *data,
         void *to;
         int rc;
 
+        mutex_lock(&monpriv->thread_mutex);
         for (written = 0; written < count; ) {
                 if (monpriv->hdr_to_read) {
                         len = min(count - written, monpriv->hdr_to_read);
@@ -247,11 +251,13 @@ static ssize_t monwrite_write(struct file *filp, const char __user *data,
                 }
                 monpriv->hdr_to_read = sizeof(monpriv->hdr);
         }
+        mutex_unlock(&monpriv->thread_mutex);
         return written;
 
 out_error:
         monpriv->data_to_read = 0;
         monpriv->hdr_to_read = sizeof(struct monwrite_hdr);
+        mutex_unlock(&monpriv->thread_mutex);
         return rc;
 }
 
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 161867cebd8c..04b19bdc09da 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -119,10 +119,12 @@ static void urdev_put(struct urdev *urd)
 /*
  * Low-level functions to do I/O to a ur device.
  *     alloc_chan_prog
+ *     free_chan_prog
  *     do_ur_io
  *     ur_int_handler
  *
  * alloc_chan_prog allocates and builds the channel program
+ * free_chan_prog frees memory of the channel program
  *
  * do_ur_io issues the channel program to the device and blocks waiting
  * on a completion event it publishes at urd->io_done. The function
@@ -137,6 +139,16 @@ static void urdev_put(struct urdev *urd)
  * address pointer that alloc_chan_prog returned.
  */
 
+static void free_chan_prog(struct ccw1 *cpa)
+{
+        struct ccw1 *ptr = cpa;
+
+        while (ptr->cda) {
+                kfree((void *)(addr_t) ptr->cda);
+                ptr++;
+        }
+        kfree(cpa);
+}
 
 /*
  * alloc_chan_prog
@@ -144,44 +156,45 @@ static void urdev_put(struct urdev *urd)
  * with a final NOP CCW command-chained on (which ensures that CE and DE
  * are presented together in a single interrupt instead of as separate
  * interrupts unless an incorrect length indication kicks in first). The
- * data length in each CCW is reclen. The caller must ensure that count
- * is an integral multiple of reclen.
- * The channel program pointer returned by this function must be freed
- * with kfree. The caller is responsible for checking that
- * count/reclen is not ridiculously large.
+ * data length in each CCW is reclen.
  */
-static struct ccw1 *alloc_chan_prog(char *buf, size_t count, size_t reclen)
+static struct ccw1 *alloc_chan_prog(const char __user *ubuf, int rec_count,
+                                    int reclen)
 {
-        size_t num_ccws;
         struct ccw1 *cpa;
+        void *kbuf;
         int i;
 
-        TRACE("alloc_chan_prog(%p, %zu, %zu)\n", buf, count, reclen);
+        TRACE("alloc_chan_prog(%p, %i, %i)\n", ubuf, rec_count, reclen);
 
         /*
          * We chain a NOP onto the writes to force CE+DE together.
          * That means we allocate room for CCWs to cover count/reclen
          * records plus a NOP.
          */
-        num_ccws = count / reclen + 1;
-        cpa = kmalloc(num_ccws * sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
+        cpa = kzalloc((rec_count + 1) * sizeof(struct ccw1),
+                      GFP_KERNEL | GFP_DMA);
         if (!cpa)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
-        for (i = 0; count; i++) {
+        for (i = 0; i < rec_count; i++) {
                 cpa[i].cmd_code = WRITE_CCW_CMD;
                 cpa[i].flags = CCW_FLAG_CC | CCW_FLAG_SLI;
                 cpa[i].count = reclen;
-                cpa[i].cda = __pa(buf);
-                buf += reclen;
-                count -= reclen;
+                kbuf = kmalloc(reclen, GFP_KERNEL | GFP_DMA);
+                if (!kbuf) {
+                        free_chan_prog(cpa);
+                        return ERR_PTR(-ENOMEM);
+                }
+                cpa[i].cda = (u32)(addr_t) kbuf;
+                if (copy_from_user(kbuf, ubuf, reclen)) {
+                        free_chan_prog(cpa);
+                        return ERR_PTR(-EFAULT);
+                }
+                ubuf += reclen;
         }
         /* The following NOP CCW forces CE+DE to be presented together */
         cpa[i].cmd_code = CCW_CMD_NOOP;
-        cpa[i].flags = 0;
-        cpa[i].count = 0;
-        cpa[i].cda = 0;
-
         return cpa;
 }
 
@@ -189,7 +202,7 @@ static int do_ur_io(struct urdev *urd, struct ccw1 *cpa)
 {
         int rc;
         struct ccw_device *cdev = urd->cdev;
-        DECLARE_COMPLETION(event);
+        DECLARE_COMPLETION_ONSTACK(event);
 
         TRACE("do_ur_io: cpa=%p\n", cpa);
 
@@ -325,24 +338,11 @@ static ssize_t do_write(struct urdev *urd, const char __user *udata,
                         size_t count, size_t reclen, loff_t *ppos)
 {
         struct ccw1 *cpa;
-        char *buf;
         int rc;
 
-        /* Data buffer must be under 2GB line for fmt1 CCWs: hence GFP_DMA */
-        buf = kmalloc(count, GFP_KERNEL | GFP_DMA);
-        if (!buf)
-                return -ENOMEM;
-
-        if (copy_from_user(buf, udata, count)) {
-                rc = -EFAULT;
-                goto fail_kfree_buf;
-        }
-
-        cpa = alloc_chan_prog(buf, count, reclen);
-        if (!cpa) {
-                rc = -ENOMEM;
-                goto fail_kfree_buf;
-        }
+        cpa = alloc_chan_prog(udata, count / reclen, reclen);
+        if (IS_ERR(cpa))
+                return PTR_ERR(cpa);
 
         rc = do_ur_io(urd, cpa);
         if (rc)
@@ -354,10 +354,9 @@ static ssize_t do_write(struct urdev *urd, const char __user *udata,
         }
         *ppos += count;
         rc = count;
+
 fail_kfree_cpa:
-        kfree(cpa);
-fail_kfree_buf:
-        kfree(buf);
+        free_chan_prog(cpa);
         return rc;
 }
 
@@ -473,7 +472,7 @@ static ssize_t diag14_read(struct file *file, char __user *ubuf, size_t count,
                 return rc;
 
         len = min((size_t) PAGE_SIZE, count);
-        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        buf = (char *) __get_free_page(GFP_KERNEL | GFP_DMA);
         if (!buf)
                 return -ENOMEM;
 
@@ -500,7 +499,7 @@ static ssize_t diag14_read(struct file *file, char __user *ubuf, size_t count,
         *offs += copied;
         rc = copied;
 fail:
-        kfree(buf);
+        free_page((unsigned long) buf);
         return rc;
 }
 
@@ -543,56 +542,97 @@ static int diag_read_next_file_info(struct file_control_block *buf, int spid)
         }
 }
 
-static int verify_device(struct urdev *urd)
+static int verify_uri_device(struct urdev *urd)
 {
-        struct file_control_block fcb;
+        struct file_control_block *fcb;
         char *buf;
         int rc;
 
+        fcb = kmalloc(sizeof(*fcb), GFP_KERNEL | GFP_DMA);
+        if (!fcb)
+                return -ENOMEM;
+
+        /* check for empty reader device (beginning of chain) */
+        rc = diag_read_next_file_info(fcb, 0);
+        if (rc)
+                goto fail_free_fcb;
+
+        /* if file is in hold status, we do not read it */
+        if (fcb->file_stat & (FLG_SYSTEM_HOLD | FLG_USER_HOLD)) {
+                rc = -EPERM;
+                goto fail_free_fcb;
+        }
+
+        /* open file on virtual reader  */
+        buf = (char *) __get_free_page(GFP_KERNEL | GFP_DMA);
+        if (!buf) {
+                rc = -ENOMEM;
+                goto fail_free_fcb;
+        }
+        rc = diag_read_file(urd->dev_id.devno, buf);
+        if ((rc != 0) && (rc != -ENODATA)) /* EOF does not hurt */
+                goto fail_free_buf;
+
+        /* check if the file on top of the queue is open now */
+        rc = diag_read_next_file_info(fcb, 0);
+        if (rc)
+                goto fail_free_buf;
+        if (!(fcb->file_stat & FLG_IN_USE)) {
+                rc = -EMFILE;
+                goto fail_free_buf;
+        }
+        rc = 0;
+
+fail_free_buf:
+        free_page((unsigned long) buf);
+fail_free_fcb:
+        kfree(fcb);
+        return rc;
+}
+
+static int verify_device(struct urdev *urd)
+{
         switch (urd->class) {
         case DEV_CLASS_UR_O:
                 return 0; /* no check needed here */
         case DEV_CLASS_UR_I:
-                /* check for empty reader device (beginning of chain) */
-                rc = diag_read_next_file_info(&fcb, 0);
-                if (rc)
-                        return rc;
-
-                /* open file on virtual reader  */
-                buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
-                if (!buf)
-                        return -ENOMEM;
-                rc = diag_read_file(urd->dev_id.devno, buf);
-                kfree(buf);
-
-                if ((rc != 0) && (rc != -ENODATA)) /* EOF does not hurt */
-                        return rc;
-                return 0;
+                return verify_uri_device(urd);
         default:
                 return -ENOTSUPP;
         }
 }
 
-static int get_file_reclen(struct urdev *urd)
+static int get_uri_file_reclen(struct urdev *urd)
 {
-        struct file_control_block fcb;
+        struct file_control_block *fcb;
         int rc;
 
+        fcb = kmalloc(sizeof(*fcb), GFP_KERNEL | GFP_DMA);
+        if (!fcb)
+                return -ENOMEM;
+        rc = diag_read_next_file_info(fcb, 0);
+        if (rc)
+                goto fail_free;
+        if (fcb->file_stat & FLG_CP_DUMP)
+                rc = 0;
+        else
+                rc = fcb->rec_len;
+
+fail_free:
+        kfree(fcb);
+        return rc;
+}
+
+static int get_file_reclen(struct urdev *urd)
+{
         switch (urd->class) {
         case DEV_CLASS_UR_O:
                 return 0;
         case DEV_CLASS_UR_I:
-                rc = diag_read_next_file_info(&fcb, 0);
-                if (rc)
-                        return rc;
-                break;
+                return get_uri_file_reclen(urd);
         default:
                 return -ENOTSUPP;
         }
-        if (fcb.file_stat & FLG_CP_DUMP)
-                return 0;
-
-        return fcb.rec_len;
 }
 
 static int ur_open(struct inode *inode, struct file *file)
diff --git a/drivers/s390/char/vmur.h b/drivers/s390/char/vmur.h
index 16d0a4e38e40..2b3c564e0472 100644
--- a/drivers/s390/char/vmur.h
+++ b/drivers/s390/char/vmur.h
@@ -50,7 +50,10 @@ struct file_control_block {
         char  rest[200];
 } __attribute__ ((packed));
 
-#define FLG_CP_DUMP 0x10
+#define FLG_SYSTEM_HOLD 0x04
+#define FLG_CP_DUMP     0x10
+#define FLG_USER_HOLD   0x20
+#define FLG_IN_USE      0x80
 
 /*
  * A struct urdev is created for each ur device that is made available
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 1c27a5a06b49..5635e656c1a3 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -79,6 +79,7 @@ css_alloc_subchannel(struct subchannel_id schid)
         sch->schib.pmcw.intparm = (__u32)(unsigned long)sch;
         ret = cio_modify(sch);
         if (ret) {
+                kfree(sch->lock);
                 kfree(sch);
                 return ERR_PTR(ret);
         }
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index ed026a1dc324..03347aed2b3e 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -81,6 +81,7 @@ static __u32 volatile spare_indicator;
 static atomic_t spare_indicator_usecount;
 #define QDIO_MEMPOOL_SCSSC_ELEMENTS 2
 static mempool_t *qdio_mempool_scssc;
+static struct kmem_cache *qdio_q_cache;
 
 static debug_info_t *qdio_dbf_setup;
 static debug_info_t *qdio_dbf_sbal;
@@ -1617,23 +1618,21 @@ static void
 qdio_release_irq_memory(struct qdio_irq *irq_ptr)
 {
         int i;
+        struct qdio_q *q;
 
-        for (i=0;i<QDIO_MAX_QUEUES_PER_IRQ;i++) {
-                if (!irq_ptr->input_qs[i])
-                        goto next;
-
-                kfree(irq_ptr->input_qs[i]->slib);
-                kfree(irq_ptr->input_qs[i]);
-
-next:
-                if (!irq_ptr->output_qs[i])
-                        continue;
-
-                kfree(irq_ptr->output_qs[i]->slib);
-                kfree(irq_ptr->output_qs[i]);
-
+        for (i = 0; i < QDIO_MAX_QUEUES_PER_IRQ; i++) {
+                q = irq_ptr->input_qs[i];
+                if (q) {
+                        free_page((unsigned long) q->slib);
+                        kmem_cache_free(qdio_q_cache, q);
+                }
+                q = irq_ptr->output_qs[i];
+                if (q) {
+                        free_page((unsigned long) q->slib);
+                        kmem_cache_free(qdio_q_cache, q);
+                }
         }
-        kfree(irq_ptr->qdr);
+        free_page((unsigned long) irq_ptr->qdr);
         free_page((unsigned long) irq_ptr);
 }
 
@@ -1680,44 +1679,35 @@ qdio_alloc_qs(struct qdio_irq *irq_ptr,
 {
         int i;
         struct qdio_q *q;
-        int result=-ENOMEM;
-
-        for (i=0;i<no_input_qs;i++) {
-                q = kzalloc(sizeof(struct qdio_q), GFP_KERNEL);
 
-                if (!q) {
-                        QDIO_PRINT_ERR("kmalloc of q failed!\n");
-                        goto out;
-                }
+        for (i = 0; i < no_input_qs; i++) {
+                q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL);
+                if (!q)
+                        return -ENOMEM;
+                memset(q, 0, sizeof(*q));
 
-                q->slib = kmalloc(PAGE_SIZE, GFP_KERNEL);
+                q->slib = (struct slib *) __get_free_page(GFP_KERNEL);
                 if (!q->slib) {
-                        QDIO_PRINT_ERR("kmalloc of slib failed!\n");
-                        goto out;
+                        kmem_cache_free(qdio_q_cache, q);
+                        return -ENOMEM;
                 }
-
                 irq_ptr->input_qs[i]=q;
         }
 
-        for (i=0;i<no_output_qs;i++) {
-                q = kzalloc(sizeof(struct qdio_q), GFP_KERNEL);
-
-                if (!q) {
-                        goto out;
-                }
+        for (i = 0; i < no_output_qs; i++) {
+                q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL);
+                if (!q)
+                        return -ENOMEM;
+                memset(q, 0, sizeof(*q));
 
-                q->slib=kmalloc(PAGE_SIZE,GFP_KERNEL);
+                q->slib = (struct slib *) __get_free_page(GFP_KERNEL);
                 if (!q->slib) {
-                        QDIO_PRINT_ERR("kmalloc of slib failed!\n");
-                        goto out;
+                        kmem_cache_free(qdio_q_cache, q);
+                        return -ENOMEM;
                 }
-
                 irq_ptr->output_qs[i]=q;
         }
-
-        result=0;
-out:
-        return result;
+        return 0;
 }
 
 static void
@@ -2985,17 +2975,17 @@ qdio_allocate(struct qdio_initialize *init_data)
         QDIO_DBF_HEX0(0,setup,&irq_ptr,sizeof(void*));
 
         if (!irq_ptr) {
-                QDIO_PRINT_ERR("kmalloc of irq_ptr failed!\n");
+                QDIO_PRINT_ERR("allocation of irq_ptr failed!\n");
                 return -ENOMEM;
         }
 
         init_MUTEX(&irq_ptr->setting_up_sema);
 
         /* QDR must be in DMA area since CCW data address is only 32 bit */
-        irq_ptr->qdr=kmalloc(sizeof(struct qdr), GFP_KERNEL | GFP_DMA);
+        irq_ptr->qdr = (struct qdr *) __get_free_page(GFP_KERNEL | GFP_DMA);
         if (!(irq_ptr->qdr)) {
                 free_page((unsigned long) irq_ptr);
-                QDIO_PRINT_ERR("kmalloc of irq_ptr->qdr failed!\n");
+                QDIO_PRINT_ERR("allocation of irq_ptr->qdr failed!\n");
                 return -ENOMEM;
         }
         QDIO_DBF_TEXT0(0,setup,"qdr:");
@@ -3004,6 +2994,7 @@ qdio_allocate(struct qdio_initialize *init_data)
         if (qdio_alloc_qs(irq_ptr,
                           init_data->no_input_qs,
                           init_data->no_output_qs)) {
+                QDIO_PRINT_ERR("queue allocation failed!\n");
                 qdio_release_irq_memory(irq_ptr);
                 return -ENOMEM;
         }
@@ -3895,9 +3886,19 @@ init_QDIO(void)
         if (res)
                 return res;
 
+        qdio_q_cache = kmem_cache_create("qdio_q", sizeof(struct qdio_q),
+                                         256, 0, NULL);
+        if (!qdio_q_cache) {
+                qdio_release_qdio_memory();
+                return -ENOMEM;
+        }
+
         res = qdio_register_dbf_views();
-        if (res)
+        if (res) {
+                kmem_cache_destroy(qdio_q_cache);
+                qdio_release_qdio_memory();
                 return res;
+        }
 
         QDIO_DBF_TEXT0(0,setup,"initQDIO");
         res = bus_create_file(&ccw_bus_type, &bus_attr_qdio_performance_stats);
@@ -3929,6 +3930,7 @@ cleanup_QDIO(void)
         qdio_release_qdio_memory();
         qdio_unregister_dbf_views();
         mempool_destroy(qdio_mempool_scssc);
+        kmem_cache_destroy(qdio_q_cache);
         bus_remove_file(&ccw_bus_type, &bus_attr_qdio_performance_stats);
         printk("qdio: %s: module removed\n",version);
 }
diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index 0c16a2b39b41..2adf856e44c2 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -86,7 +86,7 @@ struct mpc83xx_spi {
 
         unsigned nsecs;         /* (clock cycle time)/2 */
 
-        u32 sysclk;
+        u32 spibrg;             /* SPIBRG input clock */
         u32 rx_shift;           /* RX data reg shift when in qe mode */
         u32 tx_shift;           /* TX data reg shift when in qe mode */
 
@@ -148,6 +148,8 @@ static void mpc83xx_spi_chipselect(struct spi_device *spi, int value)
         if (value == BITBANG_CS_ACTIVE) {
                 u32 regval = mpc83xx_spi_read_reg(&mpc83xx_spi->base->mode);
                 u32 len = spi->bits_per_word;
+                u8 pm;
+
                 if (len == 32)
                         len = 0;
                 else
@@ -169,17 +171,20 @@ static void mpc83xx_spi_chipselect(struct spi_device *spi, int value)
 
                 regval |= SPMODE_LEN(len);
 
-                if ((mpc83xx_spi->sysclk / spi->max_speed_hz) >= 64) {
-                        u8 pm = mpc83xx_spi->sysclk / (spi->max_speed_hz * 64);
+                if ((mpc83xx_spi->spibrg / spi->max_speed_hz) >= 64) {
+                        pm = mpc83xx_spi->spibrg / (spi->max_speed_hz * 64) - 1;
                         if (pm > 0x0f) {
-                                printk(KERN_WARNING "MPC83xx SPI: SPICLK can't be less then a SYSCLK/1024!\n"
-                                                "Requested SPICLK is %d Hz. Will use %d Hz instead.\n",
-                                                spi->max_speed_hz, mpc83xx_spi->sysclk / 1024);
+                                dev_err(&spi->dev, "Requested speed is too "
+                                        "low: %d Hz. Will use %d Hz instead.\n",
+                                        spi->max_speed_hz,
+                                        mpc83xx_spi->spibrg / 1024);
                                 pm = 0x0f;
                         }
                         regval |= SPMODE_PM(pm) | SPMODE_DIV16;
                 } else {
-                        u8 pm = mpc83xx_spi->sysclk / (spi->max_speed_hz * 4);
+                        pm = mpc83xx_spi->spibrg / (spi->max_speed_hz * 4);
+                        if (pm)
+                                pm--;
                         regval |= SPMODE_PM(pm);
                 }
 
@@ -429,13 +434,17 @@ static int __init mpc83xx_spi_probe(struct platform_device *dev)
         mpc83xx_spi->bitbang.chipselect = mpc83xx_spi_chipselect;
         mpc83xx_spi->bitbang.setup_transfer = mpc83xx_spi_setup_transfer;
         mpc83xx_spi->bitbang.txrx_bufs = mpc83xx_spi_bufs;
-        mpc83xx_spi->sysclk = pdata->sysclk;
         mpc83xx_spi->activate_cs = pdata->activate_cs;
         mpc83xx_spi->deactivate_cs = pdata->deactivate_cs;
         mpc83xx_spi->qe_mode = pdata->qe_mode;
         mpc83xx_spi->get_rx = mpc83xx_spi_rx_buf_u8;
         mpc83xx_spi->get_tx = mpc83xx_spi_tx_buf_u8;
 
+        if (mpc83xx_spi->qe_mode)
+                mpc83xx_spi->spibrg = pdata->sysclk / 2;
+        else
+                mpc83xx_spi->spibrg = pdata->sysclk;
+
         mpc83xx_spi->rx_shift = 0;
         mpc83xx_spi->tx_shift = 0;
         if (mpc83xx_spi->qe_mode) {
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 630f781aeb19..c55459c592b8 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -183,7 +183,9 @@ static int spidev_message(struct spidev_data *spidev,
 
                 if (u_tmp->rx_buf) {
                         k_tmp->rx_buf = buf;
-                        if (!access_ok(VERIFY_WRITE, u_tmp->rx_buf, u_tmp->len))
+                        if (!access_ok(VERIFY_WRITE, (u8 __user *)
+                                                (ptrdiff_t) u_tmp->rx_buf,
+                                                u_tmp->len))
                                 goto done;
                 }
                 if (u_tmp->tx_buf) {
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 7dd73546bf43..63436892688c 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -6,6 +6,9 @@ menuconfig USB_SUPPORT
         bool "USB support"
         depends on HAS_IOMEM
         default y
+        ---help---
+          This option adds core support for Universal Serial Bus (USB).
+          You will also need drivers from the following menu to make use of it.
 
 if USB_SUPPORT
 
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index decfdc8eb9cc..e58c87b3e3a0 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -127,8 +127,20 @@ static int last_fb_vc = MAX_NR_CONSOLES - 1;
 static int fbcon_is_default = 1; 
 static int fbcon_has_exited;
 static int primary_device = -1;
+
+#ifdef CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY
 static int map_override;
 
+static inline void fbcon_map_override(void)
+{
+        map_override = 1;
+}
+#else
+static inline void fbcon_map_override(void)
+{
+}
+#endif /* CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY */
+
 /* font data */
 static char fontname[40];
 
@@ -506,7 +518,7 @@ static int __init fb_console_setup(char *this_opt)
                                                 (options[j++]-'0') % FB_MAX;
                                 }
 
-                                map_override = 1;
+                                fbcon_map_override();
                         }
 
                         return 1;
diff --git a/drivers/video/matrox/g450_pll.c b/drivers/video/matrox/g450_pll.c
index 7c76e079ca7d..d42346e7fdda 100644
--- a/drivers/video/matrox/g450_pll.c
+++ b/drivers/video/matrox/g450_pll.c
@@ -331,16 +331,19 @@ static int __g450_setclk(WPMINFO unsigned int fout, unsigned int pll,
                                         tmp |= M1064_XPIXCLKCTRL_PLL_UP;
                                 }
                                 matroxfb_DAC_out(PMINFO M1064_XPIXCLKCTRL, tmp);
-#ifdef __powerpc__
-                                /* This is necessary to avoid jitter on PowerPC
-                                 * (OpenFirmware) systems, but apparently
-                                 * introduces jitter, at least on a x86-64
-                                 * using DVI.
-                                 * A simple workaround is disable for non-PPC.
-                                 */
-                                matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL, 0);
-#endif /* __powerpc__ */
-                                matroxfb_DAC_out(PMINFO M1064_XPWRCTRL, xpwrctrl);
+                                /* DVI PLL preferred for frequencies up to
+                                   panel link max, standard PLL otherwise */
+                                if (fout >= MINFO->max_pixel_clock_panellink)
+                                        tmp = 0;
+                                else tmp =
+                                        M1064_XDVICLKCTRL_DVIDATAPATHSEL |
+                                        M1064_XDVICLKCTRL_C1DVICLKSEL |
+                                        M1064_XDVICLKCTRL_C1DVICLKEN |
+                                        M1064_XDVICLKCTRL_DVILOOPCTL |
+                                        M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
+                                matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp);
+                                matroxfb_DAC_out(PMINFO M1064_XPWRCTRL,
+                                                 xpwrctrl);
 
                                 matroxfb_DAC_unlock_irqrestore(flags);
                         }
diff --git a/drivers/video/matrox/matroxfb_DAC1064.h b/drivers/video/matrox/matroxfb_DAC1064.h
index df39c3193735..7a98ce8043d7 100644
--- a/drivers/video/matrox/matroxfb_DAC1064.h
+++ b/drivers/video/matrox/matroxfb_DAC1064.h
@@ -33,6 +33,21 @@ void DAC1064_global_restore(WPMINFO2);
 #define     M1064_XCURCTRL_3COLOR       0x01    /* transparent, 0, 1, 2 */
 #define     M1064_XCURCTRL_XGA          0x02    /* 0, 1, transparent, complement */
 #define     M1064_XCURCTRL_XWIN         0x03    /* transparent, transparent, 0, 1 */
+        /* drive DVI by standard(0)/DVI(1) PLL */
+        /* if set(1), C?DVICLKEN and C?DVICLKSEL must be set(1) */
+#define      M1064_XDVICLKCTRL_DVIDATAPATHSEL   0x01
+        /* drive CRTC1 by standard(0)/DVI(1) PLL */
+#define      M1064_XDVICLKCTRL_C1DVICLKSEL      0x02
+        /* drive CRTC2 by standard(0)/DVI(1) PLL */
+#define      M1064_XDVICLKCTRL_C2DVICLKSEL      0x04
+        /* pixel clock allowed to(0)/blocked from(1) driving CRTC1 */
+#define      M1064_XDVICLKCTRL_C1DVICLKEN       0x08
+        /* DVI PLL loop filter bandwidth selection bits */
+#define      M1064_XDVICLKCTRL_DVILOOPCTL       0x30
+        /* CRTC2 pixel clock allowed to(0)/blocked from(1) driving CRTC2 */
+#define      M1064_XDVICLKCTRL_C2DVICLKEN       0x40
+        /* P1PLL loop filter bandwith selection */
+#define      M1064_XDVICLKCTRL_P1LOOPBWDTCTL    0x80
 #define M1064_XCURCOL0RED       0x08
 #define M1064_XCURCOL0GREEN     0x09
 #define M1064_XCURCOL0BLUE      0x0A
diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
index d59577c8de86..f3107ad7e545 100644
--- a/drivers/video/matrox/matroxfb_base.h
+++ b/drivers/video/matrox/matroxfb_base.h
@@ -424,6 +424,7 @@ struct matrox_fb_info {
                       } mmio;
 
         unsigned int    max_pixel_clock;
+        unsigned int    max_pixel_clock_panellink;
 
         struct matrox_switch*   hw_switch;
 
diff --git a/drivers/video/matrox/matroxfb_misc.c b/drivers/video/matrox/matroxfb_misc.c
index 5948e54b9ef9..ab7fb50bc1de 100644
--- a/drivers/video/matrox/matroxfb_misc.c
+++ b/drivers/video/matrox/matroxfb_misc.c
@@ -658,6 +658,7 @@ static int parse_pins5(WPMINFO const struct matrox_bios* bd) {
                 MINFO->values.reg.mctlwtst_core = (MINFO->values.reg.mctlwtst & ~7) |
                                                   wtst_xlat[MINFO->values.reg.mctlwtst & 7];
         }
+        MINFO->max_pixel_clock_panellink = bd->pins[47] * 4000;
         return 0;
 }
 
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index f9300266044d..7d6c29800d14 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -94,6 +94,7 @@
 #define DISP_DIWCONF (DISP_BASE + 0xe8)
 #define DISP_DIWHSTRT (DISP_BASE + 0xec)
 #define DISP_DIWVSTRT (DISP_BASE + 0xf0)
+#define DISP_PIXDEPTH (DISP_BASE + 0x108)
 
 /* Pixel clocks, one for TV output, doubled for VGA output */
 #define TV_CLK 74239
@@ -143,6 +144,7 @@ static struct pvr2fb_par {
         unsigned char is_lowres;        /* Is horizontal pixel-doubling enabled? */
 
         unsigned long mmio_base;        /* MMIO base */
+        u32 palette[16];
 } *currentpar;
 
 static struct fb_info *fb_info;
@@ -599,6 +601,7 @@ static void pvr2_init_display(struct fb_info *info)
 
         /* bits per pixel */
         fb_writel(fb_readl(DISP_DIWMODE) | (--bytesperpixel << 2), DISP_DIWMODE);
+        fb_writel(bytesperpixel << 2, DISP_PIXDEPTH);
 
         /* video enable, color sync, interlace,
          * hsync and vsync polarity (currently unused) */
@@ -790,7 +793,7 @@ static int __devinit pvr2fb_common_init(void)
         fb_info->fbops          = &pvr2fb_ops;
         fb_info->fix            = pvr2_fix;
         fb_info->par            = currentpar;
-        fb_info->pseudo_palette = (void *)(fb_info->par + 1);
+        fb_info->pseudo_palette = currentpar->palette;
         fb_info->flags          = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN;
 
         if (video_output == VO_VGA)
@@ -807,6 +810,8 @@ static int __devinit pvr2fb_common_init(void)
 
         if (register_framebuffer(fb_info) < 0)
                 goto out_err;
+        /*Must write PIXDEPTH to register before anything is displayed - so force init */
+        pvr2_init_display(fb_info);
 
         modememused = get_line_length(fb_info->var.xres_virtual,
                                       fb_info->var.bits_per_pixel);
@@ -1082,14 +1087,15 @@ static int __init pvr2fb_init(void)
 #endif
         size = sizeof(struct fb_info) + sizeof(struct pvr2fb_par) + 16 * sizeof(u32);
 
-        fb_info = kzalloc(size, GFP_KERNEL);
+        fb_info = framebuffer_alloc(sizeof(struct pvr2fb_par), NULL);
+
         if (!fb_info) {
                 printk(KERN_ERR "Failed to allocate memory for fb_info\n");
                 return -ENOMEM;
         }
 
 
-        currentpar = (struct pvr2fb_par *)(fb_info + 1);
+        currentpar = fb_info->par;
 
         for (i = 0; i < ARRAY_SIZE(board_driver); i++) {
                 struct pvr2_board *pvr_board = board_driver + i;
@@ -1102,7 +1108,7 @@ static int __init pvr2fb_init(void)
                 if (ret != 0) {
                         printk(KERN_ERR "pvr2fb: Failed init of %s device\n",
                                 pvr_board->name);
-                        kfree(fb_info);
+                        framebuffer_release(fb_info);
                         break;
                 }
         }
@@ -1126,7 +1132,7 @@ static void __exit pvr2fb_exit(void)
 #endif
 
         unregister_framebuffer(fb_info);
-        kfree(fb_info);
+        framebuffer_release(fb_info);
 }
 
 module_init(pvr2fb_init);
diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
index c97709ecbad0..e7c8db2eb49b 100644
--- a/drivers/video/stifb.c
+++ b/drivers/video/stifb.c
@@ -1100,13 +1100,18 @@ stifb_init_fb(struct sti_struct *sti, int bpp_pref)
         /* only supported cards are allowed */
         switch (fb->id) {
         case CRT_ID_VISUALIZE_EG:
-                /* look for a double buffering device like e.g. the 
-                   "INTERNAL_EG_DX1024" in the RDI precisionbook laptop
-                   which won't work. The same device in non-double 
-                   buffering mode returns "INTERNAL_EG_X1024". */
-                if (strstr(sti->outptr.dev_name, "EG_DX")) {
-                   printk(KERN_WARNING 
-                        "stifb: ignoring '%s'. Disable double buffering in IPL menu.\n",
+                /* Visualize cards can run either in "double buffer" or
+                  "standard" mode. Depending on the mode, the card reports
+                  a different device name, e.g. "INTERNAL_EG_DX1024" in double
+                  buffer mode and "INTERNAL_EG_X1024" in standard mode.
+                  Since this driver only supports standard mode, we check
+                  if the device name contains the string "DX" and tell the
+                  user how to reconfigure the card. */
+                if (strstr(sti->outptr.dev_name, "DX")) {
+                   printk(KERN_WARNING "WARNING: stifb framebuffer driver does not "
+                        "support '%s' in double-buffer mode.\n"
+                        KERN_WARNING "WARNING: Please disable the double-buffer mode "
+                        "in IPL menu (the PARISC-BIOS).\n",
                         sti->outptr.dev_name);
                    goto out_err0;
                 }
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 6d84ca2beead..bed6215c0794 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -3,7 +3,10 @@ Version 1.50
 Fix NTLMv2 signing. NFS server mounted over cifs works (if cifs mount is
 done with "serverino" mount option).  Add support for POSIX Unlink
 (helps with certain sharing violation cases when server such as
-Samba supports newer POSIX CIFS Protocol Extensions).
+Samba supports newer POSIX CIFS Protocol Extensions). Add "nounix"
+mount option to allow disabling the CIFS Unix Extensions for just
+that mount. Fix hang on spinlock in find_writable_file (race when
+reopening file after session crash).
 
 Version 1.49
 ------------
diff --git a/fs/cifs/README b/fs/cifs/README
index 85f1eb14083e..b806b11b5560 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -444,6 +444,13 @@ A partial list of the supported mount options follows:
  noposixpaths   If CIFS Unix extensions are supported, do not request
                 posix path name support (this may cause servers to
                 reject creatingfile with certain reserved characters).
+ nounix         Disable the CIFS Unix Extensions for this mount (tree
+                connection). This is rarely needed, but it may be useful
+                in order to turn off multiple settings all at once (ie
+                posix acls, posix locks, posix paths, symlink support
+                and retrieving uids/gids/mode from the server) or to
+                work around a bug in server which implement the Unix
+                Extensions.
  nobrl          Do not send byte range lock requests to the server.
                 This is necessary for certain applications that break
                 with cifs style mandatory byte range locks (and most
@@ -451,6 +458,12 @@ A partial list of the supported mount options follows:
                 byte range locks).
  remount        remount the share (often used to change from ro to rw mounts
                 or vice versa)
+ servern        Specify the server 's netbios name (RFC1001 name) to use
+                when attempting to setup a session to the server.  This is
+                This is needed for mounting to some older servers (such
+                as OS/2 or Windows 98 and Windows ME) since they do not
+                support a default server name.  A server name can be up
+                to 15 characters long and is usually uppercased.
  sfu            When the CIFS Unix Extensions are not negotiated, attempt to
                 create device files and fifos in a format compatible with
                 Services for Unix (SFU).  In addition retrieve bits 10-12
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index d7bd51575fd6..29d4b2715254 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -82,8 +82,7 @@ u) DOS attrs - returned as pseudo-xattr in Samba format (check VFAT and NTFS for
 
 v) mount check for unmatched uids
 
-w) Add mount option for Linux extension disable per mount, and partial
-disable per mount (uid off, symlink/fifo/mknod on but what about posix acls?)
+w) Add support for new vfs entry points for setlease and fallocate 
 
 x) Fix Samba 3 server to handle Linux kernel aio so dbench with lots of 
 processes can proceed better in parallel (on the server)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index e13592afca9c..894b1f7b299d 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1904,6 +1904,25 @@ static int cifs_readpage(struct file *file, struct page *page)
         return rc;
 }
 
+static int is_inode_writable(struct cifsInodeInfo *cifs_inode)
+{
+        struct cifsFileInfo *open_file;
+
+        read_lock(&GlobalSMBSeslock);
+        list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
+                if (open_file->closePend)
+                        continue;
+                if (open_file->pfile &&
+                    ((open_file->pfile->f_flags & O_RDWR) ||
+                     (open_file->pfile->f_flags & O_WRONLY))) {
+                        read_unlock(&GlobalSMBSeslock);
+                        return 1;
+                }
+        }
+        read_unlock(&GlobalSMBSeslock);
+        return 0;
+}
+
 /* We do not want to update the file size from server for inodes
    open for write - to avoid races with writepage extending
    the file - in the future we could consider allowing
@@ -1912,19 +1931,13 @@ static int cifs_readpage(struct file *file, struct page *page)
    page caching in the current Linux kernel design */
 int is_size_safe_to_change(struct cifsInodeInfo *cifsInode, __u64 end_of_file)
 {
-        struct cifsFileInfo *open_file = NULL;
-
-        if (cifsInode)
-                open_file =  find_writable_file(cifsInode);
+        if (!cifsInode)
+                return 1;
 
-        if (open_file) {
+        if (is_inode_writable(cifsInode)) {
+                /* This inode is open for write at least once */
                 struct cifs_sb_info *cifs_sb;
 
-                /* there is not actually a write pending so let
-                this handle go free and allow it to
-                be closable if needed */
-                atomic_dec(&open_file->wrtPending);
-
                 cifs_sb = CIFS_SB(cifsInode->vfs_inode.i_sb);
                 if ( cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO ) {
                         /* since no page cache to corrupt on directio
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 2ea027dda215..892be9b4d1f3 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -372,6 +372,10 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
 
         /* 2000 big enough to fit max user, domain, NOS name etc. */
         str_area = kmalloc(2000, GFP_KERNEL);
+        if (str_area == NULL) {
+                cifs_small_buf_release(smb_buf);
+                return -ENOMEM;
+        }
         bcc_ptr = str_area;
 
         ses->flags &= ~CIFS_SES_LANMAN;
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 52bb2638f7ab..6874785bb65a 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -974,6 +974,7 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode,
         dio->get_block = get_block;
         dio->end_io = end_io;
         dio->map_bh.b_private = NULL;
+        dio->map_bh.b_state = 0;
         dio->final_block_in_bio = -1;
         dio->next_block_for_io = -1;
 
diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c
index b455919c1998..2082daf083d8 100644
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@ -1670,9 +1670,10 @@ static int can_be_granted(struct dlm_rsb *r, struct dlm_lkb *lkb, int now,
    with a deadlk here, we'd have to generate something like grant_lock with
    the deadlk error.) */
 
-/* returns the highest requested mode of all blocked conversions */
+/* Returns the highest requested mode of all blocked conversions; sets
+   cw if there's a blocked conversion to DLM_LOCK_CW. */
 
-static int grant_pending_convert(struct dlm_rsb *r, int high)
+static int grant_pending_convert(struct dlm_rsb *r, int high, int *cw)
 {
         struct dlm_lkb *lkb, *s;
         int hi, demoted, quit, grant_restart, demote_restart;
@@ -1709,6 +1710,9 @@ static int grant_pending_convert(struct dlm_rsb *r, int high)
                 }
 
                 hi = max_t(int, lkb->lkb_rqmode, hi);
+
+                if (cw && lkb->lkb_rqmode == DLM_LOCK_CW)
+                        *cw = 1;
         }
 
         if (grant_restart)
@@ -1721,29 +1725,52 @@ static int grant_pending_convert(struct dlm_rsb *r, int high)
         return max_t(int, high, hi);
 }
 
-static int grant_pending_wait(struct dlm_rsb *r, int high)
+static int grant_pending_wait(struct dlm_rsb *r, int high, int *cw)
 {
         struct dlm_lkb *lkb, *s;
 
         list_for_each_entry_safe(lkb, s, &r->res_waitqueue, lkb_statequeue) {
                 if (can_be_granted(r, lkb, 0, NULL))
                         grant_lock_pending(r, lkb);
-                else
+                else {
                         high = max_t(int, lkb->lkb_rqmode, high);
+                        if (lkb->lkb_rqmode == DLM_LOCK_CW)
+                                *cw = 1;
+                }
         }
 
         return high;
 }
 
+/* cw of 1 means there's a lock with a rqmode of DLM_LOCK_CW that's blocked
+   on either the convert or waiting queue.
+   high is the largest rqmode of all locks blocked on the convert or
+   waiting queue. */
+
+static int lock_requires_bast(struct dlm_lkb *gr, int high, int cw)
+{
+        if (gr->lkb_grmode == DLM_LOCK_PR && cw) {
+                if (gr->lkb_highbast < DLM_LOCK_EX)
+                        return 1;
+                return 0;
+        }
+
+        if (gr->lkb_highbast < high &&
+            !__dlm_compat_matrix[gr->lkb_grmode+1][high+1])
+                return 1;
+        return 0;
+}
+
 static void grant_pending_locks(struct dlm_rsb *r)
 {
         struct dlm_lkb *lkb, *s;
         int high = DLM_LOCK_IV;
+        int cw = 0;
 
         DLM_ASSERT(is_master(r), dlm_dump_rsb(r););
 
-        high = grant_pending_convert(r, high);
-        high = grant_pending_wait(r, high);
+        high = grant_pending_convert(r, high, &cw);
+        high = grant_pending_wait(r, high, &cw);
 
         if (high == DLM_LOCK_IV)
                 return;
@@ -1751,27 +1778,41 @@ static void grant_pending_locks(struct dlm_rsb *r)
         /*
          * If there are locks left on the wait/convert queue then send blocking
          * ASTs to granted locks based on the largest requested mode (high)
-         * found above. FIXME: highbast < high comparison not valid for PR/CW.
+         * found above.
          */
 
         list_for_each_entry_safe(lkb, s, &r->res_grantqueue, lkb_statequeue) {
-                if (lkb->lkb_bastaddr && (lkb->lkb_highbast < high) &&
-                    !__dlm_compat_matrix[lkb->lkb_grmode+1][high+1]) {
-                        queue_bast(r, lkb, high);
+                if (lkb->lkb_bastaddr && lock_requires_bast(lkb, high, cw)) {
+                        if (cw && high == DLM_LOCK_PR)
+                                queue_bast(r, lkb, DLM_LOCK_CW);
+                        else
+                                queue_bast(r, lkb, high);
                         lkb->lkb_highbast = high;
                 }
         }
 }
 
+static int modes_require_bast(struct dlm_lkb *gr, struct dlm_lkb *rq)
+{
+        if ((gr->lkb_grmode == DLM_LOCK_PR && rq->lkb_rqmode == DLM_LOCK_CW) ||
+            (gr->lkb_grmode == DLM_LOCK_CW && rq->lkb_rqmode == DLM_LOCK_PR)) {
+                if (gr->lkb_highbast < DLM_LOCK_EX)
+                        return 1;
+                return 0;
+        }
+
+        if (gr->lkb_highbast < rq->lkb_rqmode && !modes_compat(gr, rq))
+                return 1;
+        return 0;
+}
+
 static void send_bast_queue(struct dlm_rsb *r, struct list_head *head,
                             struct dlm_lkb *lkb)
 {
         struct dlm_lkb *gr;
 
         list_for_each_entry(gr, head, lkb_statequeue) {
-                if (gr->lkb_bastaddr &&
-                    gr->lkb_highbast < lkb->lkb_rqmode &&
-                    !modes_compat(gr, lkb)) {
+                if (gr->lkb_bastaddr && modes_require_bast(gr, lkb)) {
                         queue_bast(r, gr, lkb->lkb_rqmode);
                         gr->lkb_highbast = lkb->lkb_rqmode;
                 }
@@ -2235,7 +2276,7 @@ static int do_convert(struct dlm_rsb *r, struct dlm_lkb *lkb)
            before we try again to grant this one. */
 
         if (is_demoted(lkb)) {
-                grant_pending_convert(r, DLM_LOCK_IV);
+                grant_pending_convert(r, DLM_LOCK_IV, NULL);
                 if (_can_be_granted(r, lkb, 1)) {
                         grant_lock(r, lkb);
                         queue_cast(r, lkb, 0);
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index dd362739d291..9e9d2e82f40f 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -313,6 +313,7 @@ static void make_sockaddr(struct sockaddr_storage *saddr, uint16_t port,
                 in6_addr->sin6_port = cpu_to_be16(port);
                 *addr_len = sizeof(struct sockaddr_in6);
         }
+        memset((char *)saddr + *addr_len, 0, sizeof(struct sockaddr_storage) - *addr_len);
 }
 
 /* Close a remote connection and tidy up */
@@ -332,8 +333,19 @@ static void close_connection(struct connection *con, bool and_other)
                 __free_page(con->rx_page);
                 con->rx_page = NULL;
         }
-        con->retries = 0;
-        mutex_unlock(&con->sock_mutex);
+
+        /* If we are an 'othercon' then NULL the pointer to us
+           from the parent and tidy ourself up */
+        if (test_bit(CF_IS_OTHERCON, &con->flags)) {
+                struct connection *parent = __nodeid2con(con->nodeid, 0);
+                parent->othercon = NULL;
+                kmem_cache_free(con_cache, con);
+        }
+        else {
+                /* Parent connections get reused */
+                con->retries = 0;
+                mutex_unlock(&con->sock_mutex);
+        }
 }
 
 /* We only send shutdown messages to nodes that are not part of the cluster */
@@ -631,7 +643,7 @@ out_resched:
 
 out_close:
         mutex_unlock(&con->sock_mutex);
-        if (ret != -EAGAIN && !test_bit(CF_IS_OTHERCON, &con->flags)) {
+        if (ret != -EAGAIN) {
                 close_connection(con, false);
                 /* Reconnect when there is something to send */
         }
@@ -1122,8 +1134,6 @@ static int tcp_listen_for_all(void)
 
         log_print("Using TCP for communications");
 
-        set_bit(CF_IS_OTHERCON, &con->flags);
-
         sock = tcp_create_listen_sock(con, dlm_local_addr[0]);
         if (sock) {
                 add_sock(sock, con);
@@ -1407,7 +1417,7 @@ void dlm_lowcomms_stop(void)
         for (i = 0; i <= max_nodeid; i++) {
                 con = __nodeid2con(i, 0);
                 if (con) {
-                        con->flags |= 0xFF;
+                        con->flags |= 0x0F;
                         if (con->sock)
                                 con->sock->sk->sk_user_data = NULL;
                 }
@@ -1423,8 +1433,6 @@ void dlm_lowcomms_stop(void)
                 con = __nodeid2con(i, 0);
                 if (con) {
                         close_connection(con, true);
-                        if (con->othercon)
-                                kmem_cache_free(con_cache, con->othercon);
                         kmem_cache_free(con_cache, con);
                 }
         }
diff --git a/fs/dlm/member.c b/fs/dlm/member.c
index 073599dced2a..d09977528f69 100644
--- a/fs/dlm/member.c
+++ b/fs/dlm/member.c
@@ -56,8 +56,10 @@ static int dlm_add_member(struct dlm_ls *ls, int nodeid)
                 return -ENOMEM;
 
         w = dlm_node_weight(ls->ls_name, nodeid);
-        if (w < 0)
+        if (w < 0) {
+                kfree(memb);
                 return w;
+        }
 
         memb->nodeid = nodeid;
         memb->weight = w;
diff --git a/fs/dlm/rcom.c b/fs/dlm/rcom.c
index e3a1527cbdbe..188b91c027e4 100644
--- a/fs/dlm/rcom.c
+++ b/fs/dlm/rcom.c
@@ -386,8 +386,7 @@ static void receive_rcom_lock_reply(struct dlm_ls *ls, struct dlm_rcom *rc_in)
         dlm_recover_process_copy(ls, rc_in);
 }
 
-static int send_ls_not_ready(struct dlm_ls *ls, int nodeid,
-                             struct dlm_rcom *rc_in)
+static int send_ls_not_ready(int nodeid, struct dlm_rcom *rc_in)
 {
         struct dlm_rcom *rc;
         struct rcom_config *rf;
@@ -395,7 +394,7 @@ static int send_ls_not_ready(struct dlm_ls *ls, int nodeid,
         char *mb;
         int mb_len = sizeof(struct dlm_rcom) + sizeof(struct rcom_config);
 
-        mh = dlm_lowcomms_get_buffer(nodeid, mb_len, ls->ls_allocation, &mb);
+        mh = dlm_lowcomms_get_buffer(nodeid, mb_len, GFP_NOFS, &mb);
         if (!mh)
                 return -ENOBUFS;
         memset(mb, 0, mb_len);
@@ -465,7 +464,7 @@ void dlm_receive_rcom(struct dlm_header *hd, int nodeid)
                 log_print("lockspace %x from %d type %x not found",
                           hd->h_lockspace, nodeid, rc->rc_type);
                 if (rc->rc_type == DLM_RCOM_STATUS)
-                        send_ls_not_ready(ls, nodeid, rc);
+                        send_ls_not_ready(nodeid, rc);
                 return;
         }
 
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 0a50942b4378..131954b3fb98 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -353,6 +353,10 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
                 ecryptfs_printk(KERN_DEBUG, "Is a symlink; returning\n");
                 goto out;
         }
+        if (special_file(lower_inode->i_mode)) {
+                ecryptfs_printk(KERN_DEBUG, "Is a special file; returning\n");
+                goto out;
+        }
         if (!nd) {
                 ecryptfs_printk(KERN_DEBUG, "We have a NULL nd, just leave"
                                 "as we *think* we are about to unlink\n");
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index e557a6766927..a98497264fe8 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -813,6 +813,15 @@ out:
         return rc;
 }
 
+static void do_sysfs_unregistration(void)
+{
+        sysfs_remove_file(&ecryptfs_subsys.kobj,
+                          &sysfs_attr_version.attr);
+        sysfs_remove_file(&ecryptfs_subsys.kobj,
+                          &sysfs_attr_version_str.attr);
+        subsystem_unregister(&ecryptfs_subsys);
+}
+
 static int __init ecryptfs_init(void)
 {
         int rc;
@@ -851,6 +860,9 @@ static int __init ecryptfs_init(void)
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Failure occured while attempting to "
                                 "initialize the eCryptfs netlink socket\n");
+                do_sysfs_unregistration();
+                unregister_filesystem(&ecryptfs_fs_type);
+                ecryptfs_free_kmem_caches();
         }
 out:
         return rc;
@@ -858,11 +870,7 @@ out:
 
 static void __exit ecryptfs_exit(void)
 {
-        sysfs_remove_file(&ecryptfs_subsys.kobj,
-                          &sysfs_attr_version.attr);
-        sysfs_remove_file(&ecryptfs_subsys.kobj,
-                          &sysfs_attr_version_str.attr);
-        subsystem_unregister(&ecryptfs_subsys);
+        do_sysfs_unregistration();
         ecryptfs_release_messaging(ecryptfs_transport);
         unregister_filesystem(&ecryptfs_fs_type);
         ecryptfs_free_kmem_caches();
diff --git a/fs/exec.c b/fs/exec.c
index 7bdea7937ee8..ce62f7b65f17 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1084,9 +1084,12 @@ int flush_old_exec(struct linux_binprm * bprm)
          */
         current->mm->task_size = TASK_SIZE;
 
-        if (bprm->e_uid != current->euid || bprm->e_gid != current->egid || 
-            file_permission(bprm->file, MAY_READ) ||
-            (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
+        if (bprm->e_uid != current->euid || bprm->e_gid != current->egid) {
+                suid_keys(current);
+                set_dumpable(current->mm, suid_dumpable);
+                current->pdeath_signal = 0;
+        } else if (file_permission(bprm->file, MAY_READ) ||
+                        (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
                 suid_keys(current);
                 set_dumpable(current->mm, suid_dumpable);
         }
@@ -1177,8 +1180,10 @@ void compute_creds(struct linux_binprm *bprm)
 {
         int unsafe;
 
-        if (bprm->e_uid != current->uid)
+        if (bprm->e_uid != current->uid) {
                 suid_keys(current);
+                current->pdeath_signal = 0;
+        }
         exec_keys(current);
 
         task_lock(current);
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index aff70f0698fd..3b395c41b2f3 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -486,8 +486,8 @@ static void databuf_lo_add(struct gfs2_sbd *sdp, struct gfs2_log_element *le)
                 gfs2_pin(sdp, bd->bd_bh);
                 tr->tr_num_databuf_new++;
         }
-        sdp->sd_log_num_databuf++;
         gfs2_log_lock(sdp);
+        sdp->sd_log_num_databuf++;
         list_add(&le->le_list, &sdp->sd_log_le_databuf);
         gfs2_log_unlock(sdp);
 }
@@ -523,7 +523,7 @@ static void databuf_lo_before_commit(struct gfs2_sbd *sdp)
         struct buffer_head *bh = NULL,*bh1 = NULL;
         struct gfs2_log_descriptor *ld;
         unsigned int limit;
-        unsigned int total_dbuf = sdp->sd_log_num_databuf;
+        unsigned int total_dbuf;
         unsigned int total_jdata = sdp->sd_log_num_jdata;
         unsigned int num, n;
         __be64 *ptr = NULL;
@@ -535,6 +535,7 @@ static void databuf_lo_before_commit(struct gfs2_sbd *sdp)
          * into the log along with a header
          */
         gfs2_log_lock(sdp);
+        total_dbuf = sdp->sd_log_num_databuf;
         bd2 = bd1 = list_prepare_entry(bd1, &sdp->sd_log_le_databuf,
                                        bd_le.le_list);
         while(total_dbuf) {
@@ -653,6 +654,7 @@ static void databuf_lo_before_commit(struct gfs2_sbd *sdp)
                                 break;
                 }
                 bh = NULL;
+                BUG_ON(total_dbuf < num);
                 total_dbuf -= num;
                 total_jdata -= num;
         }
diff --git a/fs/gfs2/mount.c b/fs/gfs2/mount.c
index 6f006a804db3..4864659555d4 100644
--- a/fs/gfs2/mount.c
+++ b/fs/gfs2/mount.c
@@ -82,19 +82,20 @@ int gfs2_mount_args(struct gfs2_sbd *sdp, char *data_arg, int remount)
         char *options, *o, *v;
         int error = 0;
 
-        /*  If someone preloaded options, use those instead  */
-        spin_lock(&gfs2_sys_margs_lock);
-        if (!remount && gfs2_sys_margs) {
-                data = gfs2_sys_margs;
-                gfs2_sys_margs = NULL;
-        }
-        spin_unlock(&gfs2_sys_margs_lock);
+        if (!remount) {
+                /*  If someone preloaded options, use those instead  */
+                spin_lock(&gfs2_sys_margs_lock);
+                if (gfs2_sys_margs) {
+                        data = gfs2_sys_margs;
+                        gfs2_sys_margs = NULL;
+                }
+                spin_unlock(&gfs2_sys_margs_lock);
 
-        /*  Set some defaults  */
-        memset(args, 0, sizeof(struct gfs2_args));
-        args->ar_num_glockd = GFS2_GLOCKD_DEFAULT;
-        args->ar_quota = GFS2_QUOTA_DEFAULT;
-        args->ar_data = GFS2_DATA_DEFAULT;
+                /*  Set some defaults  */
+                args->ar_num_glockd = GFS2_GLOCKD_DEFAULT;
+                args->ar_quota = GFS2_QUOTA_DEFAULT;
+                args->ar_data = GFS2_DATA_DEFAULT;
+        }
 
         /* Split the options into tokens with the "," character and
            process them */
diff --git a/fs/gfs2/ops_address.c b/fs/gfs2/ops_address.c
index ce90032c010e..42a5f58f6fca 100644
--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -416,7 +416,7 @@ static int gfs2_prepare_write(struct file *file, struct page *page,
 
         error = gfs2_trans_begin(sdp, rblocks, 0);
         if (error)
-                goto out;
+                goto out_trans_fail;
 
         if (gfs2_is_stuffed(ip)) {
                 if (end > sdp->sd_sb.sb_bsize - sizeof(struct gfs2_dinode)) {
@@ -434,6 +434,7 @@ prepare_write:
 out:
         if (error) {
                 gfs2_trans_end(sdp);
+out_trans_fail:
                 if (alloc_required) {
                         gfs2_inplace_release(ip);
 out_qunlock:
diff --git a/fs/gfs2/ops_file.c b/fs/gfs2/ops_file.c
index 773421130116..94d76ace0b95 100644
--- a/fs/gfs2/ops_file.c
+++ b/fs/gfs2/ops_file.c
@@ -177,8 +177,8 @@ static const u32 fsflags_to_gfs2[32] = {
         [5] = GFS2_DIF_APPENDONLY,
         [7] = GFS2_DIF_NOATIME,
         [12] = GFS2_DIF_EXHASH,
-        [14] = GFS2_DIF_JDATA,
-        [20] = GFS2_DIF_DIRECTIO,
+        [14] = GFS2_DIF_INHERIT_JDATA,
+        [20] = GFS2_DIF_INHERIT_DIRECTIO,
 };
 
 static const u32 gfs2_to_fsflags[32] = {
@@ -187,8 +187,6 @@ static const u32 gfs2_to_fsflags[32] = {
         [gfs2fl_AppendOnly] = FS_APPEND_FL,
         [gfs2fl_NoAtime] = FS_NOATIME_FL,
         [gfs2fl_ExHash] = FS_INDEX_FL,
-        [gfs2fl_Jdata] = FS_JOURNAL_DATA_FL,
-        [gfs2fl_Directio] = FS_DIRECTIO_FL,
         [gfs2fl_InheritDirectio] = FS_DIRECTIO_FL,
         [gfs2fl_InheritJdata] = FS_JOURNAL_DATA_FL,
 };
@@ -207,6 +205,12 @@ static int gfs2_get_flags(struct file *filp, u32 __user *ptr)
                 return error;
 
         fsflags = fsflags_cvt(gfs2_to_fsflags, ip->i_di.di_flags);
+        if (!S_ISDIR(inode->i_mode)) {
+                if (ip->i_di.di_flags & GFS2_DIF_JDATA)
+                        fsflags |= FS_JOURNAL_DATA_FL;
+                if (ip->i_di.di_flags & GFS2_DIF_DIRECTIO)
+                        fsflags |= FS_DIRECTIO_FL;
+        }
         if (put_user(fsflags, ptr))
                 error = -EFAULT;
 
@@ -270,13 +274,6 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask)
         if ((new_flags ^ flags) == 0)
                 goto out;
 
-        if (S_ISDIR(inode->i_mode)) {
-                if ((new_flags ^ flags) & GFS2_DIF_JDATA)
-                        new_flags ^= (GFS2_DIF_JDATA|GFS2_DIF_INHERIT_JDATA);
-                if ((new_flags ^ flags) & GFS2_DIF_DIRECTIO)
-                        new_flags ^= (GFS2_DIF_DIRECTIO|GFS2_DIF_INHERIT_DIRECTIO);
-        }
-
         error = -EINVAL;
         if ((new_flags ^ flags) & ~GFS2_FLAGS_USER_SET)
                 goto out;
@@ -315,11 +312,19 @@ out:
 
 static int gfs2_set_flags(struct file *filp, u32 __user *ptr)
 {
+        struct inode *inode = filp->f_path.dentry->d_inode;
         u32 fsflags, gfsflags;
         if (get_user(fsflags, ptr))
                 return -EFAULT;
         gfsflags = fsflags_cvt(fsflags_to_gfs2, fsflags);
-        return do_gfs2_set_flags(filp, gfsflags, ~0);
+        if (!S_ISDIR(inode->i_mode)) {
+                if (gfsflags & GFS2_DIF_INHERIT_JDATA)
+                        gfsflags ^= (GFS2_DIF_JDATA | GFS2_DIF_INHERIT_JDATA);
+                if (gfsflags & GFS2_DIF_INHERIT_DIRECTIO)
+                        gfsflags ^= (GFS2_DIF_DIRECTIO | GFS2_DIF_INHERIT_DIRECTIO);
+                return do_gfs2_set_flags(filp, gfsflags, ~0);
+        }
+        return do_gfs2_set_flags(filp, gfsflags, ~GFS2_DIF_JDATA);
 }
 
 static long gfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index e4e040625153..ce48c4594ec8 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -863,16 +863,19 @@ static struct inode *try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked)
         u64 no_addr;
 
         for(;;) {
+                if (goal >= rgd->rd_data)
+                        break;
                 goal = rgblk_search(rgd, goal, GFS2_BLKST_UNLINKED,
                                     GFS2_BLKST_UNLINKED);
-                if (goal == 0)
-                        return 0;
+                if (goal == BFITNOENT)
+                        break;
                 no_addr = goal + rgd->rd_data0;
-                if (no_addr <= *last_unlinked)
+                goal++;
+                if (no_addr < *last_unlinked)
                         continue;
                 *last_unlinked = no_addr;
                 inode = gfs2_inode_lookup(rgd->rd_sbd->sd_vfs, DT_UNKNOWN,
-                                        no_addr, -1);
+                                          no_addr, -1);
                 if (!IS_ERR(inode))
                         return inode;
         }
@@ -1313,7 +1316,7 @@ static u32 rgblk_search(struct gfs2_rgrpd *rgd, u32 goal,
                                     bi->bi_len, blk, new_state);
         }
 
-        return (blk == BFITNOENT) ? 0 : (bi->bi_start * GFS2_NBBY) + blk;
+        return (blk == BFITNOENT) ? blk : (bi->bi_start * GFS2_NBBY) + blk;
 }
 
 /**
@@ -1393,6 +1396,7 @@ u64 gfs2_alloc_data(struct gfs2_inode *ip)
                 goal = rgd->rd_last_alloc_data;
 
         blk = rgblk_search(rgd, goal, GFS2_BLKST_FREE, GFS2_BLKST_USED);
+        BUG_ON(blk == BFITNOENT);
         rgd->rd_last_alloc_data = blk;
 
         block = rgd->rd_data0 + blk;
@@ -1437,6 +1441,7 @@ u64 gfs2_alloc_meta(struct gfs2_inode *ip)
                 goal = rgd->rd_last_alloc_meta;
 
         blk = rgblk_search(rgd, goal, GFS2_BLKST_FREE, GFS2_BLKST_USED);
+        BUG_ON(blk == BFITNOENT);
         rgd->rd_last_alloc_meta = blk;
 
         block = rgd->rd_data0 + blk;
@@ -1478,6 +1483,7 @@ u64 gfs2_alloc_di(struct gfs2_inode *dip, u64 *generation)
 
         blk = rgblk_search(rgd, rgd->rd_last_alloc_meta,
                            GFS2_BLKST_FREE, GFS2_BLKST_DINODE);
+        BUG_ON(blk == BFITNOENT);
 
         rgd->rd_last_alloc_meta = blk;
 
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index f5e11f4fa952..4f517665c9a0 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -3731,7 +3731,6 @@ int ocfs2_insert_extent(struct ocfs2_super *osb,
 {
         int status;
         struct buffer_head *last_eb_bh = NULL;
-        struct buffer_head *bh = NULL;
         struct ocfs2_insert_type insert = {0, };
         struct ocfs2_extent_rec rec;
 
@@ -3783,9 +3782,6 @@ int ocfs2_insert_extent(struct ocfs2_super *osb,
                 ocfs2_extent_map_insert_rec(inode, &rec);
 
 bail:
-        if (bh)
-                brelse(bh);
-
         if (last_eb_bh)
                 brelse(last_eb_bh);
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index f0bdfd944c44..685c18065c82 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -854,17 +854,25 @@ static void o2net_sendpage(struct o2net_sock_container *sc,
         struct o2net_node *nn = o2net_nn_from_num(sc->sc_node->nd_num);
         ssize_t ret;
 
-
-        mutex_lock(&sc->sc_send_lock);
-        ret = sc->sc_sock->ops->sendpage(sc->sc_sock,
-                                         virt_to_page(kmalloced_virt),
-                                         (long)kmalloced_virt & ~PAGE_MASK,
-                                         size, MSG_DONTWAIT);
-        mutex_unlock(&sc->sc_send_lock);
-        if (ret != size) {
+        while (1) {
+                mutex_lock(&sc->sc_send_lock);
+                ret = sc->sc_sock->ops->sendpage(sc->sc_sock,
+                                                 virt_to_page(kmalloced_virt),
+                                                 (long)kmalloced_virt & ~PAGE_MASK,
+                                                 size, MSG_DONTWAIT);
+                mutex_unlock(&sc->sc_send_lock);
+                if (ret == size)
+                        break;
+                if (ret == (ssize_t)-EAGAIN) {
+                        mlog(0, "sendpage of size %zu to " SC_NODEF_FMT
+                             " returned EAGAIN\n", size, SC_NODEF_ARGS(sc));
+                        cond_resched();
+                        continue;
+                }
                 mlog(ML_ERROR, "sendpage of size %zu to " SC_NODEF_FMT 
                      " failed with %zd\n", size, SC_NODEF_ARGS(sc), ret);
                 o2net_ensure_shutdown(nn, sc, 0);
+                break;
         }
 }
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index c4034f693e7b..4ffa715be09c 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -187,6 +187,7 @@ int ocfs2_update_inode_atime(struct inode *inode,
         int ret;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         handle_t *handle;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *) bh->b_data;
 
         mlog_entry_void();
 
@@ -197,11 +198,27 @@ int ocfs2_update_inode_atime(struct inode *inode,
                 goto out;
         }
 
+        ret = ocfs2_journal_access(handle, inode, bh,
+                                   OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        /*
+         * Don't use ocfs2_mark_inode_dirty() here as we don't always
+         * have i_mutex to guard against concurrent changes to other
+         * inode fields.
+         */
         inode->i_atime = CURRENT_TIME;
-        ret = ocfs2_mark_inode_dirty(handle, inode, bh);
+        di->i_atime = cpu_to_le64(inode->i_atime.tv_sec);
+        di->i_atime_nsec = cpu_to_le32(inode->i_atime.tv_nsec);
+
+        ret = ocfs2_journal_dirty(handle, bh);
         if (ret < 0)
                 mlog_errno(ret);
 
+out_commit:
         ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
 out:
         mlog_exit(ret);
@@ -1011,6 +1028,11 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         if (size_change && attr->ia_size != i_size_read(inode)) {
+                if (attr->ia_size > sb->s_maxbytes) {
+                        status = -EFBIG;
+                        goto bail_unlock;
+                }
+
                 if (i_size_read(inode) > attr->ia_size)
                         status = ocfs2_truncate_file(inode, bh, attr->ia_size);
                 else
@@ -1516,7 +1538,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct buffer_head *di_bh = NULL;
         handle_t *handle;
-        unsigned long long max_off = ocfs2_max_file_offset(inode->i_sb->s_blocksize_bits);
+        unsigned long long max_off = inode->i_sb->s_maxbytes;
 
         if (ocfs2_is_hard_readonly(osb) || ocfs2_is_soft_readonly(osb))
                 return -EROFS;
@@ -1942,7 +1964,7 @@ static ssize_t ocfs2_file_buffered_write(struct file *file, loff_t *ppos,
                 }
 
                 dst = kmap_atomic(page, KM_USER0);
-                memcpy(dst + (pos & (PAGE_CACHE_SIZE - 1)), buf, bytes);
+                memcpy(dst + (pos & (loff_t)(PAGE_CACHE_SIZE - 1)), buf, bytes);
                 kunmap_atomic(dst, KM_USER0);
                 flush_dcache_page(page);
                 ocfs2_put_write_source(user_page);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index d430fdab16e9..701e6d04ed5d 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1080,6 +1080,7 @@ static int ocfs2_rename(struct inode *old_dir,
         struct buffer_head *old_inode_de_bh = NULL; // if old_dentry is a dir,
                                                     // this is the 1st dirent bh
         nlink_t old_dir_nlink = old_dir->i_nlink;
+        struct ocfs2_dinode *old_di;
 
         /* At some point it might be nice to break this function up a
          * bit. */
@@ -1354,7 +1355,20 @@ static int ocfs2_rename(struct inode *old_dir,
 
         old_inode->i_ctime = CURRENT_TIME;
         mark_inode_dirty(old_inode);
-        ocfs2_mark_inode_dirty(handle, old_inode, old_inode_bh);
+
+        status = ocfs2_journal_access(handle, old_inode, old_inode_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (status >= 0) {
+                old_di = (struct ocfs2_dinode *) old_inode_bh->b_data;
+
+                old_di->i_ctime = cpu_to_le64(old_inode->i_ctime.tv_sec);
+                old_di->i_ctime_nsec = cpu_to_le32(old_inode->i_ctime.tv_nsec);
+
+                status = ocfs2_journal_dirty(handle, old_inode_bh);
+                if (status < 0)
+                        mlog_errno(status);
+        } else
+                mlog_errno(status);
 
         /* now that the name has been added to new_dir, remove the old name */
         status = ocfs2_delete_entry(handle, old_dir, old_de, old_de_bh);
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 5cc90a40b3c5..58307853fb4a 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -494,16 +494,16 @@ static inline unsigned int ocfs2_page_index_to_clusters(struct super_block *sb,
 /*
  * Find the 1st page index which covers the given clusters.
  */
-static inline unsigned long ocfs2_align_clusters_to_page_index(struct super_block *sb,
+static inline pgoff_t ocfs2_align_clusters_to_page_index(struct super_block *sb,
                                                         u32 clusters)
 {
         unsigned int cbits = OCFS2_SB(sb)->s_clustersize_bits;
-        unsigned long index = clusters;
+        pgoff_t index = clusters;
 
         if (PAGE_CACHE_SHIFT > cbits) {
-                index = clusters >> (PAGE_CACHE_SHIFT - cbits);
+                index = (pgoff_t)clusters >> (PAGE_CACHE_SHIFT - cbits);
         } else if (PAGE_CACHE_SHIFT < cbits) {
-                index = clusters << (cbits - PAGE_CACHE_SHIFT);
+                index = (pgoff_t)clusters << (cbits - PAGE_CACHE_SHIFT);
         }
 
         return index;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 200c7d4790dc..f2fc9a795deb 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -316,39 +316,51 @@ static void ocfs2_destroy_inode(struct inode *inode)
         kmem_cache_free(ocfs2_inode_cachep, OCFS2_I(inode));
 }
 
-/* From xfs_super.c:xfs_max_file_offset
- * Copyright (c) 2000-2004 Silicon Graphics, Inc.
- */
-unsigned long long ocfs2_max_file_offset(unsigned int blockshift)
+static unsigned long long ocfs2_max_file_offset(unsigned int bbits,
+                                                unsigned int cbits)
 {
-        unsigned int pagefactor = 1;
-        unsigned int bitshift = BITS_PER_LONG - 1;
-
-        /* Figure out maximum filesize, on Linux this can depend on
-         * the filesystem blocksize (on 32 bit platforms).
-         * __block_prepare_write does this in an [unsigned] long...
-         *      page->index << (PAGE_CACHE_SHIFT - bbits)
-         * So, for page sized blocks (4K on 32 bit platforms),
-         * this wraps at around 8Tb (hence MAX_LFS_FILESIZE which is
-         *      (((u64)PAGE_CACHE_SIZE << (BITS_PER_LONG-1))-1)
-         * but for smaller blocksizes it is less (bbits = log2 bsize).
-         * Note1: get_block_t takes a long (implicit cast from above)
-         * Note2: The Large Block Device (LBD and HAVE_SECTOR_T) patch
-         * can optionally convert the [unsigned] long from above into
-         * an [unsigned] long long.
+        unsigned int bytes = 1 << cbits;
+        unsigned int trim = bytes;
+        unsigned int bitshift = 32;
+
+        /*
+         * i_size and all block offsets in ocfs2 are always 64 bits
+         * wide. i_clusters is 32 bits, in cluster-sized units. So on
+         * 64 bit platforms, cluster size will be the limiting factor.
          */
 
 #if BITS_PER_LONG == 32
 # if defined(CONFIG_LBD)
         BUILD_BUG_ON(sizeof(sector_t) != 8);
-        pagefactor = PAGE_CACHE_SIZE;
-        bitshift = BITS_PER_LONG;
+        /*
+         * We might be limited by page cache size.
+         */
+        if (bytes > PAGE_CACHE_SIZE) {
+                bytes = PAGE_CACHE_SIZE;
+                trim = 1;
+                /*
+                 * Shift by 31 here so that we don't get larger than
+                 * MAX_LFS_FILESIZE
+                 */
+                bitshift = 31;
+        }
 # else
-        pagefactor = PAGE_CACHE_SIZE >> (PAGE_CACHE_SHIFT - blockshift);
+        /*
+         * We are limited by the size of sector_t. Use block size, as
+         * that's what we expose to the VFS.
+         */
+        bytes = 1 << bbits;
+        trim = 1;
+        bitshift = 31;
 # endif
 #endif
 
-        return (((unsigned long long)pagefactor) << bitshift) - 1;
+        /*
+         * Trim by a whole cluster when we can actually approach the
+         * on-disk limits. Otherwise we can overflow i_clusters when
+         * an extent start is at the max offset.
+         */
+        return (((unsigned long long)bytes) << bitshift) - trim;
 }
 
 static int ocfs2_remount(struct super_block *sb, int *flags, char *data)
@@ -1259,8 +1271,8 @@ static int ocfs2_initialize_super(struct super_block *sb,
                                   int sector_size)
 {
         int status = 0;
-        int i;
-        struct ocfs2_dinode *di = NULL;
+        int i, cbits, bbits;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
         struct inode *inode = NULL;
         struct buffer_head *bitmap_bh = NULL;
         struct ocfs2_journal *journal;
@@ -1279,9 +1291,12 @@ static int ocfs2_initialize_super(struct super_block *sb,
         sb->s_fs_info = osb;
         sb->s_op = &ocfs2_sops;
         sb->s_export_op = &ocfs2_export_ops;
+        sb->s_time_gran = 1;
         sb->s_flags |= MS_NOATIME;
         /* this is needed to support O_LARGEFILE */
-        sb->s_maxbytes = ocfs2_max_file_offset(sb->s_blocksize_bits);
+        cbits = le32_to_cpu(di->id2.i_super.s_clustersize_bits);
+        bbits = le32_to_cpu(di->id2.i_super.s_blocksize_bits);
+        sb->s_maxbytes = ocfs2_max_file_offset(bbits, cbits);
 
         osb->sb = sb;
         /* Save off for ocfs2_rw_direct */
@@ -1341,8 +1356,6 @@ static int ocfs2_initialize_super(struct super_block *sb,
                 goto bail;
         }
 
-        di = (struct ocfs2_dinode *)bh->b_data;
-
         osb->max_slots = le16_to_cpu(di->id2.i_super.s_max_slots);
         if (osb->max_slots > OCFS2_MAX_SLOTS || osb->max_slots == 0) {
                 mlog(ML_ERROR, "Invalid number of node slots (%u)\n",
diff --git a/fs/ocfs2/super.h b/fs/ocfs2/super.h
index 3b9cb3d0b008..783f5270f2a1 100644
--- a/fs/ocfs2/super.h
+++ b/fs/ocfs2/super.h
@@ -45,6 +45,4 @@ void __ocfs2_abort(struct super_block *sb,
 
 #define ocfs2_abort(sb, fmt, args...) __ocfs2_abort(sb, __PRETTY_FUNCTION__, fmt, ##args)
 
-unsigned long long ocfs2_max_file_offset(unsigned int blockshift);
-
 #endif /* OCFS2_SUPER_H */
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index f9f987f8e661..ec3ffdadb4d2 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -232,7 +232,7 @@ struct acpi_processor_errata {
 
 extern int acpi_processor_preregister_performance(struct
                                                   acpi_processor_performance
-                                                  **performance);
+                                                  *performance);
 
 extern int acpi_processor_register_performance(struct acpi_processor_performance
                                                *performance, unsigned int cpu);
diff --git a/include/asm-avr32/io.h b/include/asm-avr32/io.h
index e30d4b3bd836..64bb92bb6773 100644
--- a/include/asm-avr32/io.h
+++ b/include/asm-avr32/io.h
@@ -255,6 +255,8 @@ static inline void memset_io(volatile void __iomem *addr, unsigned char val,
         memset((void __force *)addr, val, count);
 }
 
+#define mmiowb()
+
 #define IO_SPACE_LIMIT  0xffffffff
 
 extern void __iomem *__ioremap(unsigned long offset, size_t size,
diff --git a/include/asm-avr32/pgalloc.h b/include/asm-avr32/pgalloc.h
index bb82e70cde8d..0e680f47209f 100644
--- a/include/asm-avr32/pgalloc.h
+++ b/include/asm-avr32/pgalloc.h
@@ -27,13 +27,7 @@ static __inline__ void pmd_populate(struct mm_struct *mm, pmd_t *pmd,
  */
 static __inline__ pgd_t *pgd_alloc(struct mm_struct *mm)
 {
-        unsigned int pgd_size = (USER_PTRS_PER_PGD * sizeof(pgd_t));
-        pgd_t *pgd = kmalloc(pgd_size, GFP_KERNEL);
-
-        if (pgd)
-                memset(pgd, 0, pgd_size);
-
-        return pgd;
+        return kcalloc(USER_PTRS_PER_PGD, sizeof(pgd_t), GFP_KERNEL);
 }
 
 static inline void pgd_free(pgd_t *pgd)
@@ -44,18 +38,9 @@ static inline void pgd_free(pgd_t *pgd)
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        int count = 0;
         pte_t *pte;
 
-        do {
-                pte = (pte_t *) __get_free_page(GFP_KERNEL | __GFP_REPEAT);
-                if (pte)
-                        clear_page(pte);
-                else {
-                        current->state = TASK_UNINTERRUPTIBLE;
-                        schedule_timeout(HZ);
-                }
-        } while (!pte && (count++ < 10));
+        pte = (pte_t *)get_zeroed_page(GFP_KERNEL | __GFP_REPEAT);
 
         return pte;
 }
@@ -63,18 +48,9 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 static inline struct page *pte_alloc_one(struct mm_struct *mm,
                                          unsigned long address)
 {
-        int count = 0;
         struct page *pte;
 
-        do {
-                pte = alloc_pages(GFP_KERNEL, 0);
-                if (pte)
-                        clear_page(page_address(pte));
-                else {
-                        current->state = TASK_UNINTERRUPTIBLE;
-                        schedule_timeout(HZ);
-                }
-        } while (!pte && (count++ < 10));
+        pte = alloc_page(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO);
 
         return pte;
 }
diff --git a/include/asm-avr32/pgtable.h b/include/asm-avr32/pgtable.h
index c07bdd10b891..018f6e2a0242 100644
--- a/include/asm-avr32/pgtable.h
+++ b/include/asm-avr32/pgtable.h
@@ -32,8 +32,6 @@
 #define USER_PTRS_PER_PGD       (TASK_SIZE / PGDIR_SIZE)
 #define FIRST_USER_ADDRESS      0
 
-#define PTE_PHYS_MASK   0x1ffff000
-
 #ifndef __ASSEMBLY__
 extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 extern void paging_init(void);
@@ -265,7 +263,7 @@ static inline pte_t pte_mkyoung(pte_t pte)
  * trivial.
  */
 #define pages_to_mb(x)  ((x) >> (20-PAGE_SHIFT))
-#define pte_page(x)     phys_to_page(pte_val(x) & PTE_PHYS_MASK)
+#define pte_page(x)     (pfn_to_page(pte_pfn(x)))
 
 /*
  * Mark the prot value as uncacheable and unbufferable
diff --git a/include/asm-frv/unistd.h b/include/asm-frv/unistd.h
index 7306c71a8926..cd84f1771e34 100644
--- a/include/asm-frv/unistd.h
+++ b/include/asm-frv/unistd.h
@@ -330,10 +330,11 @@
 #define __NR_signalfd           321
 #define __NR_timerfd            322
 #define __NR_eventfd            323
+#define __NR_fallocate          324
 
 #ifdef __KERNEL__
 
-#define NR_syscalls 324
+#define NR_syscalls 325
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 /* #define __ARCH_WANT_OLD_READDIR */
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f605e8d0eed3..5f0d797d33fd 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -2,6 +2,7 @@
 #define _ASM_GENERIC_PGTABLE_H
 
 #ifndef __ASSEMBLY__
+#ifdef CONFIG_MMU
 
 #ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
 /*
@@ -133,41 +134,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #endif
 
 /*
- * A facility to provide lazy MMU batching.  This allows PTE updates and
- * page invalidations to be delayed until a call to leave lazy MMU mode
- * is issued.  Some architectures may benefit from doing this, and it is
- * beneficial for both shadow and direct mode hypervisors, which may batch
- * the PTE updates which happen during this window.  Note that using this
- * interface requires that read hazards be removed from the code.  A read
- * hazard could result in the direct mode hypervisor case, since the actual
- * write to the page tables may not yet have taken place, so reads though
- * a raw PTE pointer after it has been modified are not guaranteed to be
- * up to date.  This mode can only be entered and left under the protection of
- * the page table locks for all page tables which may be modified.  In the UP
- * case, this is required so that preemption is disabled, and in the SMP case,
- * it must synchronize the delayed page table writes properly on other CPUs.
- */
-#ifndef __HAVE_ARCH_ENTER_LAZY_MMU_MODE
-#define arch_enter_lazy_mmu_mode()      do {} while (0)
-#define arch_leave_lazy_mmu_mode()      do {} while (0)
-#define arch_flush_lazy_mmu_mode()      do {} while (0)
-#endif
-
-/*
- * A facility to provide batching of the reload of page tables with the
- * actual context switch code for paravirtualized guests.  By convention,
- * only one of the lazy modes (CPU, MMU) should be active at any given
- * time, entry should never be nested, and entry and exits should always
- * be paired.  This is for sanity of maintaining and reasoning about the
- * kernel code.
- */
-#ifndef __HAVE_ARCH_ENTER_LAZY_CPU_MODE
-#define arch_enter_lazy_cpu_mode()      do {} while (0)
-#define arch_leave_lazy_cpu_mode()      do {} while (0)
-#define arch_flush_lazy_cpu_mode()      do {} while (0)
-#endif
-
-/*
  * When walking page tables, get the address of the next boundary,
  * or the end address of the range if that comes earlier.  Although no
  * vma end wraps to 0, rounded up __boundary may wrap to 0 throughout.
@@ -233,6 +199,43 @@ static inline int pmd_none_or_clear_bad(pmd_t *pmd)
         }
         return 0;
 }
+#endif /* CONFIG_MMU */
+
+/*
+ * A facility to provide lazy MMU batching.  This allows PTE updates and
+ * page invalidations to be delayed until a call to leave lazy MMU mode
+ * is issued.  Some architectures may benefit from doing this, and it is
+ * beneficial for both shadow and direct mode hypervisors, which may batch
+ * the PTE updates which happen during this window.  Note that using this
+ * interface requires that read hazards be removed from the code.  A read
+ * hazard could result in the direct mode hypervisor case, since the actual
+ * write to the page tables may not yet have taken place, so reads though
+ * a raw PTE pointer after it has been modified are not guaranteed to be
+ * up to date.  This mode can only be entered and left under the protection of
+ * the page table locks for all page tables which may be modified.  In the UP
+ * case, this is required so that preemption is disabled, and in the SMP case,
+ * it must synchronize the delayed page table writes properly on other CPUs.
+ */
+#ifndef __HAVE_ARCH_ENTER_LAZY_MMU_MODE
+#define arch_enter_lazy_mmu_mode()      do {} while (0)
+#define arch_leave_lazy_mmu_mode()      do {} while (0)
+#define arch_flush_lazy_mmu_mode()      do {} while (0)
+#endif
+
+/*
+ * A facility to provide batching of the reload of page tables with the
+ * actual context switch code for paravirtualized guests.  By convention,
+ * only one of the lazy modes (CPU, MMU) should be active at any given
+ * time, entry should never be nested, and entry and exits should always
+ * be paired.  This is for sanity of maintaining and reasoning about the
+ * kernel code.
+ */
+#ifndef __HAVE_ARCH_ENTER_LAZY_CPU_MODE
+#define arch_enter_lazy_cpu_mode()      do {} while (0)
+#define arch_leave_lazy_cpu_mode()      do {} while (0)
+#define arch_flush_lazy_cpu_mode()      do {} while (0)
+#endif
+
 #endif /* !__ASSEMBLY__ */
 
 #endif /* _ASM_GENERIC_PGTABLE_H */
diff --git a/include/asm-i386/apic.h b/include/asm-i386/apic.h
index 1e8f6f252dd3..4091b33dcb10 100644
--- a/include/asm-i386/apic.h
+++ b/include/asm-i386/apic.h
@@ -116,6 +116,8 @@ extern void enable_NMI_through_LVT0 (void * dummy);
 extern int timer_over_8254;
 extern int local_apic_timer_c2_ok;
 
+extern int local_apic_timer_disabled;
+
 #else /* !CONFIG_X86_LOCAL_APIC */
 static inline void lapic_shutdown(void) { }
 
diff --git a/include/asm-i386/cpufeature.h b/include/asm-i386/cpufeature.h
index c961c03cf1e2..7b3aa28ebc6e 100644
--- a/include/asm-i386/cpufeature.h
+++ b/include/asm-i386/cpufeature.h
@@ -79,7 +79,7 @@
 #define X86_FEATURE_ARCH_PERFMON (3*32+11) /* Intel Architectural PerfMon */
 #define X86_FEATURE_PEBS        (3*32+12)  /* Precise-Event Based Sampling */
 #define X86_FEATURE_BTS         (3*32+13)  /* Branch Trace Store */
-#define X86_FEATURE_LAPIC_TIMER_BROKEN (3*32+ 14) /* lapic timer broken in C1 */
+/* 14 free */
 #define X86_FEATURE_SYNC_RDTSC  (3*32+15)  /* RDTSC synchronizes the CPU */
 #define X86_FEATURE_REP_GOOD   (3*32+16) /* rep microcode works well on this CPU */
 
diff --git a/include/asm-i386/mach-default/mach_wakecpu.h b/include/asm-i386/mach-default/mach_wakecpu.h
index 673b85c9b273..3ebb17893aa5 100644
--- a/include/asm-i386/mach-default/mach_wakecpu.h
+++ b/include/asm-i386/mach-default/mach_wakecpu.h
@@ -15,7 +15,8 @@
 
 static inline void wait_for_init_deassert(atomic_t *deassert)
 {
-        while (!atomic_read(deassert));
+        while (!atomic_read(deassert))
+                cpu_relax();
         return;
 }
 
diff --git a/include/asm-i386/mach-es7000/mach_wakecpu.h b/include/asm-i386/mach-es7000/mach_wakecpu.h
index efc903b73486..84ff58314501 100644
--- a/include/asm-i386/mach-es7000/mach_wakecpu.h
+++ b/include/asm-i386/mach-es7000/mach_wakecpu.h
@@ -31,7 +31,8 @@ wakeup_secondary_cpu(int phys_apicid, unsigned long start_eip)
 static inline void wait_for_init_deassert(atomic_t *deassert)
 {
 #ifdef WAKE_SECONDARY_VIA_INIT
-        while (!atomic_read(deassert));
+        while (!atomic_read(deassert))
+                cpu_relax();
 #endif
         return;
 }
diff --git a/include/asm-i386/nmi.h b/include/asm-i386/nmi.h
index ff30c98f87b0..70a958a8e381 100644
--- a/include/asm-i386/nmi.h
+++ b/include/asm-i386/nmi.h
@@ -33,11 +33,12 @@ extern int nmi_watchdog_tick (struct pt_regs * regs, unsigned reason);
 
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
-#define NMI_DEFAULT     -1
+#define NMI_DISABLED    -1
 #define NMI_NONE        0
 #define NMI_IO_APIC     1
 #define NMI_LOCAL_APIC  2
 #define NMI_INVALID     3
+#define NMI_DEFAULT     NMI_DISABLED
 
 struct ctl_table;
 struct file;
diff --git a/include/asm-i386/paravirt.h b/include/asm-i386/paravirt.h
index 7df88be2dd9e..9fa3fa9e62d1 100644
--- a/include/asm-i386/paravirt.h
+++ b/include/asm-i386/paravirt.h
@@ -47,7 +47,8 @@ struct paravirt_ops
          * The patch function should return the number of bytes of code
          * generated, as we nop pad the rest in generic code.
          */
-        unsigned (*patch)(u8 type, u16 clobber, void *firstinsn, unsigned len);
+        unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
+                          unsigned long addr, unsigned len);
 
         /* Basic arch-specific setup */
         void (*arch_setup)(void);
@@ -253,13 +254,16 @@ extern struct paravirt_ops paravirt_ops;
 
 unsigned paravirt_patch_nop(void);
 unsigned paravirt_patch_ignore(unsigned len);
-unsigned paravirt_patch_call(void *target, u16 tgt_clobbers,
-                             void *site, u16 site_clobbers,
+unsigned paravirt_patch_call(void *insnbuf,
+                             const void *target, u16 tgt_clobbers,
+                             unsigned long addr, u16 site_clobbers,
                              unsigned len);
-unsigned paravirt_patch_jmp(void *target, void *site, unsigned len);
-unsigned paravirt_patch_default(u8 type, u16 clobbers, void *site, unsigned len);
+unsigned paravirt_patch_jmp(const void *target, void *insnbuf,
+                            unsigned long addr, unsigned len);
+unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
+                                unsigned long addr, unsigned len);
 
-unsigned paravirt_patch_insns(void *site, unsigned len,
+unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
                               const char *start, const char *end);
 
 int paravirt_disable_iospace(void);
diff --git a/include/asm-i386/pci.h b/include/asm-i386/pci.h
index d790343e9982..4fcacc711385 100644
--- a/include/asm-i386/pci.h
+++ b/include/asm-i386/pci.h
@@ -8,6 +8,9 @@ struct pci_sysdata {
         int             node;           /* NUMA node */
 };
 
+/* scan a bus after allocating a pci_sysdata for it */
+extern struct pci_bus *pci_scan_bus_with_sysdata(int busno);
+
 #include <linux/mm.h>           /* for struct page */
 
 /* Can be used to override the logic in pci_scan_bus for skipping
diff --git a/include/asm-ia64/atomic.h b/include/asm-ia64/atomic.h
index 1fc3b83325da..50c2b83fd5a0 100644
--- a/include/asm-ia64/atomic.h
+++ b/include/asm-ia64/atomic.h
@@ -55,7 +55,7 @@ ia64_atomic64_add (__s64 i, atomic64_t *v)
 
         do {
                 CMPXCHG_BUGCHECK(v);
-                old = atomic_read(v);
+                old = atomic64_read(v);
                 new = old + i;
         } while (ia64_cmpxchg(acq, v, old, new, sizeof(atomic64_t)) != old);
         return new;
@@ -83,7 +83,7 @@ ia64_atomic64_sub (__s64 i, atomic64_t *v)
 
         do {
                 CMPXCHG_BUGCHECK(v);
-                old = atomic_read(v);
+                old = atomic64_read(v);
                 new = old - i;
         } while (ia64_cmpxchg(acq, v, old, new, sizeof(atomic64_t)) != old);
         return new;
diff --git a/include/asm-ia64/hw_irq.h b/include/asm-ia64/hw_irq.h
index efa1b8f7251d..bba5baa3c7fc 100644
--- a/include/asm-ia64/hw_irq.h
+++ b/include/asm-ia64/hw_irq.h
@@ -124,6 +124,11 @@ static inline void ia64_resend_irq(unsigned int vector)
 extern irq_desc_t irq_desc[NR_IRQS];
 
 #ifndef CONFIG_IA64_GENERIC
+static inline ia64_vector __ia64_irq_to_vector(int irq)
+{
+        return irq_cfg[irq].vector;
+}
+
 static inline unsigned int
 __ia64_local_vector_to_irq (ia64_vector vec)
 {
@@ -145,7 +150,7 @@ __ia64_local_vector_to_irq (ia64_vector vec)
 static inline ia64_vector
 irq_to_vector (int irq)
 {
-        return irq_cfg[irq].vector;
+        return platform_irq_to_vector(irq);
 }
 
 /*
diff --git a/include/asm-ia64/machvec.h b/include/asm-ia64/machvec.h
index 5cf8bf1e805e..c201a2020aa4 100644
--- a/include/asm-ia64/machvec.h
+++ b/include/asm-ia64/machvec.h
@@ -30,6 +30,7 @@ typedef void ia64_mv_send_ipi_t (int, int, int, int);
 typedef void ia64_mv_timer_interrupt_t (int, void *);
 typedef void ia64_mv_global_tlb_purge_t (struct mm_struct *, unsigned long, unsigned long, unsigned long);
 typedef void ia64_mv_tlb_migrate_finish_t (struct mm_struct *);
+typedef u8 ia64_mv_irq_to_vector (int);
 typedef unsigned int ia64_mv_local_vector_to_irq (u8);
 typedef char *ia64_mv_pci_get_legacy_mem_t (struct pci_bus *);
 typedef int ia64_mv_pci_legacy_read_t (struct pci_bus *, u16 port, u32 *val,
@@ -145,6 +146,7 @@ extern void machvec_tlb_migrate_finish (struct mm_struct *);
 #  define platform_dma_sync_sg_for_device ia64_mv.dma_sync_sg_for_device
 #  define platform_dma_mapping_error            ia64_mv.dma_mapping_error
 #  define platform_dma_supported        ia64_mv.dma_supported
+#  define platform_irq_to_vector        ia64_mv.irq_to_vector
 #  define platform_local_vector_to_irq  ia64_mv.local_vector_to_irq
 #  define platform_pci_get_legacy_mem   ia64_mv.pci_get_legacy_mem
 #  define platform_pci_legacy_read      ia64_mv.pci_legacy_read
@@ -198,6 +200,7 @@ struct ia64_machine_vector {
         ia64_mv_dma_sync_sg_for_device *dma_sync_sg_for_device;
         ia64_mv_dma_mapping_error *dma_mapping_error;
         ia64_mv_dma_supported *dma_supported;
+        ia64_mv_irq_to_vector *irq_to_vector;
         ia64_mv_local_vector_to_irq *local_vector_to_irq;
         ia64_mv_pci_get_legacy_mem_t *pci_get_legacy_mem;
         ia64_mv_pci_legacy_read_t *pci_legacy_read;
@@ -247,6 +250,7 @@ struct ia64_machine_vector {
         platform_dma_sync_sg_for_device,        \
         platform_dma_mapping_error,                     \
         platform_dma_supported,                 \
+        platform_irq_to_vector,                 \
         platform_local_vector_to_irq,           \
         platform_pci_get_legacy_mem,            \
         platform_pci_legacy_read,               \
@@ -366,6 +370,9 @@ extern ia64_mv_dma_supported		swiotlb_dma_supported;
 #ifndef platform_dma_supported
 # define  platform_dma_supported        swiotlb_dma_supported
 #endif
+#ifndef platform_irq_to_vector
+# define platform_irq_to_vector         __ia64_irq_to_vector
+#endif
 #ifndef platform_local_vector_to_irq
 # define platform_local_vector_to_irq   __ia64_local_vector_to_irq
 #endif
diff --git a/include/asm-ia64/machvec_init.h b/include/asm-ia64/machvec_init.h
index 2d36f6840f0b..7f21249fba3f 100644
--- a/include/asm-ia64/machvec_init.h
+++ b/include/asm-ia64/machvec_init.h
@@ -2,6 +2,7 @@
 
 extern ia64_mv_send_ipi_t ia64_send_ipi;
 extern ia64_mv_global_tlb_purge_t ia64_global_tlb_purge;
+extern ia64_mv_irq_to_vector __ia64_irq_to_vector;
 extern ia64_mv_local_vector_to_irq __ia64_local_vector_to_irq;
 extern ia64_mv_pci_get_legacy_mem_t ia64_pci_get_legacy_mem;
 extern ia64_mv_pci_legacy_read_t ia64_pci_legacy_read;
diff --git a/include/asm-ia64/machvec_sn2.h b/include/asm-ia64/machvec_sn2.h
index eaa2fce0fecd..61439a7f5b08 100644
--- a/include/asm-ia64/machvec_sn2.h
+++ b/include/asm-ia64/machvec_sn2.h
@@ -35,6 +35,7 @@ extern ia64_mv_send_ipi_t sn2_send_IPI;
 extern ia64_mv_timer_interrupt_t sn_timer_interrupt;
 extern ia64_mv_global_tlb_purge_t sn2_global_tlb_purge;
 extern ia64_mv_tlb_migrate_finish_t     sn_tlb_migrate_finish;
+extern ia64_mv_irq_to_vector sn_irq_to_vector;
 extern ia64_mv_local_vector_to_irq sn_local_vector_to_irq;
 extern ia64_mv_pci_get_legacy_mem_t sn_pci_get_legacy_mem;
 extern ia64_mv_pci_legacy_read_t sn_pci_legacy_read;
@@ -104,6 +105,7 @@ extern ia64_mv_pci_fixup_bus_t		sn_pci_fixup_bus;
 #define platform_readw_relaxed          __sn_readw_relaxed
 #define platform_readl_relaxed          __sn_readl_relaxed
 #define platform_readq_relaxed          __sn_readq_relaxed
+#define platform_irq_to_vector          sn_irq_to_vector
 #define platform_local_vector_to_irq    sn_local_vector_to_irq
 #define platform_pci_get_legacy_mem     sn_pci_get_legacy_mem
 #define platform_pci_legacy_read        sn_pci_legacy_read
diff --git a/include/asm-powerpc/dma-mapping.h b/include/asm-powerpc/dma-mapping.h
index f6bd804d9090..744d6bb24116 100644
--- a/include/asm-powerpc/dma-mapping.h
+++ b/include/asm-powerpc/dma-mapping.h
@@ -95,7 +95,7 @@ static inline int dma_set_mask(struct device *dev, u64 dma_mask)
                 return -EIO;
         if (dma_ops->set_dma_mask != NULL)
                 return dma_ops->set_dma_mask(dev, dma_mask);
-        if (!dev->dma_mask || !dma_supported(dev, *dev->dma_mask))
+        if (!dev->dma_mask || !dma_supported(dev, dma_mask))
                 return -EIO;
         *dev->dma_mask = dma_mask;
         return 0;
diff --git a/include/asm-powerpc/spu_priv1.h b/include/asm-powerpc/spu_priv1.h
index 7e78f6a1ab8b..0f37c7c90820 100644
--- a/include/asm-powerpc/spu_priv1.h
+++ b/include/asm-powerpc/spu_priv1.h
@@ -178,6 +178,7 @@ struct spu_management_ops {
         int (*enumerate_spus)(int (*fn)(void *data));
         int (*create_spu)(struct spu *spu, void *data);
         int (*destroy_spu)(struct spu *spu);
+        int (*init_affinity)(void);
 };
 
 extern const struct spu_management_ops* spu_management_ops;
@@ -200,6 +201,12 @@ spu_destroy_spu (struct spu *spu)
         return spu_management_ops->destroy_spu(spu);
 }
 
+static inline int
+spu_init_affinity (void)
+{
+        return spu_management_ops->init_affinity();
+}
+
 /*
  * The declarations folowing are put here for convenience
  * and only intended to be used by the platform setup code.
diff --git a/include/asm-sh/dma-mapping.h b/include/asm-sh/dma-mapping.h
index 6f492ac3fa13..84fefdaa01a5 100644
--- a/include/asm-sh/dma-mapping.h
+++ b/include/asm-sh/dma-mapping.h
@@ -160,6 +160,25 @@ static inline void dma_sync_single_for_device(struct device *dev,
         dma_sync_single(dev, dma_handle, size, dir);
 }
 
+static inline void dma_sync_single_range_for_cpu(struct device *dev,
+                                                 dma_addr_t dma_handle,
+                                                 unsigned long offset,
+                                                 size_t size,
+                                                 enum dma_data_direction direction)
+{
+        dma_sync_single_for_cpu(dev, dma_handle+offset, size, direction);
+}
+
+static inline void dma_sync_single_range_for_device(struct device *dev,
+                                                    dma_addr_t dma_handle,
+                                                    unsigned long offset,
+                                                    size_t size,
+                                                    enum dma_data_direction direction)
+{
+        dma_sync_single_for_device(dev, dma_handle+offset, size, direction);
+}
+
+
 static inline void dma_sync_sg_for_cpu(struct device *dev,
                                        struct scatterlist *sg, int nelems,
                                        enum dma_data_direction dir)
diff --git a/include/asm-sh64/dma-mapping.h b/include/asm-sh64/dma-mapping.h
index d505f357f819..de4309960207 100644
--- a/include/asm-sh64/dma-mapping.h
+++ b/include/asm-sh64/dma-mapping.h
@@ -141,6 +141,24 @@ static inline void dma_sync_single_for_device(struct device *dev,
         dma_sync_single(dev, dma_handle, size, dir);
 }
 
+static inline void dma_sync_single_range_for_cpu(struct device *dev,
+                                                 dma_addr_t dma_handle,
+                                                 unsigned long offset,
+                                                 size_t size,
+                                                 enum dma_data_direction direction)
+{
+        dma_sync_single_for_cpu(dev, dma_handle+offset, size, direction);
+}
+
+static inline void dma_sync_single_range_for_device(struct device *dev,
+                                                    dma_addr_t dma_handle,
+                                                    unsigned long offset,
+                                                    size_t size,
+                                                    enum dma_data_direction direction)
+{
+        dma_sync_single_for_device(dev, dma_handle+offset, size, direction);
+}
+
 static inline void dma_sync_sg_for_cpu(struct device *dev,
                                        struct scatterlist *sg, int nelems,
                                        enum dma_data_direction dir)
diff --git a/include/asm-sparc/sbus.h b/include/asm-sparc/sbus.h
index d036e4419d79..27d076c46964 100644
--- a/include/asm-sparc/sbus.h
+++ b/include/asm-sparc/sbus.h
@@ -68,7 +68,6 @@ struct sbus_dev {
 /* This struct describes the SBus(s) found on this machine. */
 struct sbus_bus {
         struct of_device        ofdev;
-        void                    *iommu;         /* Opaque IOMMU cookie */
         struct sbus_dev         *devices;       /* Link to devices on this SBus */
         struct sbus_bus         *next;          /* next SBus, if more than one SBus */
         int                     prom_node;      /* PROM device tree node for this SBus */
diff --git a/include/asm-sparc/sfp-machine.h b/include/asm-sparc/sfp-machine.h
index ecfc86a4a725..266a42b8f99f 100644
--- a/include/asm-sparc/sfp-machine.h
+++ b/include/asm-sparc/sfp-machine.h
@@ -203,4 +203,10 @@ extern struct task_struct *last_task_used_math;
 #define FP_INHIBIT_RESULTS ((last_task_used_math->thread.fsr >> 23) & _fex)
 #endif
 
+#ifdef CONFIG_SMP
+#define FP_TRAPPING_EXCEPTIONS ((current->thread.fsr >> 23) & 0x1f)
+#else
+#define FP_TRAPPING_EXCEPTIONS ((last_task_used_math->thread.fsr >> 23) & 0x1f)
+#endif
+
 #endif
diff --git a/include/asm-sparc64/elf.h b/include/asm-sparc64/elf.h
index 303d85e2f82e..8653e8665009 100644
--- a/include/asm-sparc64/elf.h
+++ b/include/asm-sparc64/elf.h
@@ -70,6 +70,7 @@
 #define HWCAP_SPARC_V9          16
 #define HWCAP_SPARC_ULTRA3      32
 #define HWCAP_SPARC_BLKINIT     64
+#define HWCAP_SPARC_N2          128
 
 /*
  * These are used to set parameters in the core dumps.
@@ -155,8 +156,13 @@ static inline unsigned int sparc64_elf_hwcap(void)
 
         if (tlb_type == cheetah || tlb_type == cheetah_plus)
                 cap |= HWCAP_SPARC_ULTRA3;
-        else if (tlb_type == hypervisor)
-                cap |= HWCAP_SPARC_BLKINIT;
+        else if (tlb_type == hypervisor) {
+                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA2)
+                        cap |= HWCAP_SPARC_BLKINIT;
+                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2)
+                        cap |= HWCAP_SPARC_N2;
+        }
 
         return cap;
 }
diff --git a/include/asm-sparc64/sfp-machine.h b/include/asm-sparc64/sfp-machine.h
index 89d42431efb5..c9331b02d9c8 100644
--- a/include/asm-sparc64/sfp-machine.h
+++ b/include/asm-sparc64/sfp-machine.h
@@ -88,4 +88,6 @@
 
 #define FP_INHIBIT_RESULTS ((current_thread_info()->xfsr[0] >> 23) & _fex)
 
+#define FP_TRAPPING_EXCEPTIONS ((current_thread_info()->xfsr[0] >> 23) & 0x1f)
+
 #endif
diff --git a/include/asm-x86_64/nmi.h b/include/asm-x86_64/nmi.h
index 5fb3c0de5ccc..65b6acf3bb59 100644
--- a/include/asm-x86_64/nmi.h
+++ b/include/asm-x86_64/nmi.h
@@ -64,11 +64,12 @@ extern int setup_nmi_watchdog(char *);
 
 extern atomic_t nmi_active;
 extern unsigned int nmi_watchdog;
-#define NMI_DEFAULT     -1
+#define NMI_DISABLED    -1
 #define NMI_NONE        0
 #define NMI_IO_APIC     1
 #define NMI_LOCAL_APIC  2
 #define NMI_INVALID     3
+#define NMI_DEFAULT     NMI_DISABLED
 
 struct ctl_table;
 struct file;
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index 88926eb44f5c..5da8cb0c0599 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -10,6 +10,8 @@ struct pci_sysdata {
         void*           iommu;          /* IOMMU private data */
 };
 
+extern struct pci_bus *pci_scan_bus_with_sysdata(int busno);
+
 #ifdef CONFIG_CALGARY_IOMMU
 static inline void* pci_iommu(struct pci_bus *bus)
 {
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 4d85262b4fa4..1ddef34f43c3 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -24,6 +24,8 @@
 #include <linux/mempool.h>
 #include <linux/ioprio.h>
 
+#ifdef CONFIG_BLOCK
+
 /* Platforms may set this to teach the BIO layer about IOMMU hardware. */
 #include <asm/io.h>
 
@@ -361,4 +363,5 @@ static inline char *__bio_kmap_irq(struct bio *bio, unsigned short idx,
         __bio_kmap_irq((bio), (bio)->bi_idx, (flags))
 #define bio_kunmap_irq(buf,flags)       __bio_kunmap_irq(buf, flags)
 
+#endif /* CONFIG_BLOCK */
 #endif /* __LINUX_BIO_H */
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 90874a5d7d78..7b5d56b82b59 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -105,7 +105,7 @@ struct blk_io_trace {
  */
 struct blk_io_trace_remap {
         __be32 device;
-        u32 __pad;
+        __be32 device_from;
         __be64 sector;
 };
 
@@ -272,6 +272,7 @@ static inline void blk_add_trace_remap(struct request_queue *q, struct bio *bio,
                 return;
 
         r.device = cpu_to_be32(dev);
+        r.device_from = cpu_to_be32(bio->bi_bdev->bd_dev);
         r.sector = cpu_to_be64(to);
 
         __blk_add_trace(bt, from, bio->bi_size, bio->bi_rw, BLK_TA_REMAP, !bio_flagged(bio, BIO_UPTODATE), sizeof(r), &r);
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index e0bd46eb2414..def5a659b8a5 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -123,7 +123,6 @@ extern void clockevents_exchange_device(struct clock_event_device *old,
 extern void clockevents_set_mode(struct clock_event_device *dev,
                                  enum clock_event_mode mode);
 extern int clockevents_register_notifier(struct notifier_block *nb);
-extern void clockevents_unregister_notifier(struct notifier_block *nb);
 extern int clockevents_program_event(struct clock_event_device *dev,
                                      ktime_t expires, ktime_t now);
 
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index c2236bbff412..1d5ded0836ee 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -41,8 +41,6 @@ extern void cpu_remove_sysdev_attr(struct sysdev_attribute *attr);
 extern int cpu_add_sysdev_attr_group(struct attribute_group *attrs);
 extern void cpu_remove_sysdev_attr_group(struct attribute_group *attrs);
 
-extern struct sysdev_attribute attr_sched_mc_power_savings;
-extern struct sysdev_attribute attr_sched_smt_power_savings;
 extern int sched_create_sysfs_power_savings_entries(struct sysdev_class *cls);
 
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 6bf139562947..16421f662a7a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1659,7 +1659,6 @@ extern int sb_min_blocksize(struct super_block *, int);
 extern int generic_file_mmap(struct file *, struct vm_area_struct *);
 extern int generic_file_readonly_mmap(struct file *, struct vm_area_struct *);
 extern int file_read_actor(read_descriptor_t * desc, struct page *page, unsigned long offset, unsigned long size);
-extern int file_send_actor(read_descriptor_t * desc, struct page *page, unsigned long offset, unsigned long size);
 int generic_write_checks(struct file *file, loff_t *pos, size_t *count, int isblk);
 extern ssize_t generic_file_aio_read(struct kiocb *, const struct iovec *, unsigned long, loff_t);
 extern ssize_t generic_file_aio_write(struct kiocb *, const struct iovec *, unsigned long, loff_t);
diff --git a/include/linux/init.h b/include/linux/init.h
index 1a4a283d19a9..74b1f43bf982 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -43,7 +43,7 @@
 #define __init          __attribute__ ((__section__ (".init.text"))) __cold
 #define __initdata      __attribute__ ((__section__ (".init.data")))
 #define __exitdata      __attribute__ ((__section__(".exit.data")))
-#define __exit_call     __attribute_used__ __attribute__ ((__section__ (".exitcall.exit"))) __cold
+#define __exit_call     __attribute_used__ __attribute__ ((__section__ (".exitcall.exit")))
 
 /* modpost check for section mismatches during the kernel build.
  * A section mismatch happens when there are references from a
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index b4f5b81b4257..f592df74b3cf 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -226,7 +226,7 @@ extern void print_hex_dump(const char *level, const char *prefix_str,
                                 int prefix_type, int rowsize, int groupsize,
                                 const void *buf, size_t len, bool ascii);
 extern void print_hex_dump_bytes(const char *prefix_str, int prefix_type,
-                        void *buf, size_t len);
+                        const void *buf, size_t len);
 #define hex_asc(x)      "0123456789abcdef"[x]
 
 #ifdef DEBUG
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 2ada8ee316b3..4dc5fa8be781 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -159,7 +159,8 @@ struct ap_device_id {
 
 #define AP_DEVICE_ID_MATCH_DEVICE_TYPE          0x01
 
-#define ACPI_ID_LEN     9
+#define ACPI_ID_LEN     16 /* only 9 bytes needed here, 16 bytes are used */
+                           /* to workaround crosscompile issues */
 
 struct acpi_device_id {
         __u8 id[ACPI_ID_LEN];
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 4a616d73cc25..e679b2751665 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1131,6 +1131,8 @@ extern void dev_seq_stop(struct seq_file *seq, void *v);
 
 extern void linkwatch_run_queue(void);
 
+extern int netdev_compute_features(unsigned long all, unsigned long one);
+
 static inline int net_gso_ok(int features, int gso_type)
 {
         int feature = gso_type << NETIF_F_GSO_SHIFT;
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 28e3664fdf1b..cd13a78c5db8 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -75,7 +75,6 @@ struct proc_dir_entry {
         write_proc_t *write_proc;
         atomic_t count;         /* use count */
         int deleted;            /* delete flag */
-        void *set;
         int pde_users;  /* number of callers into module in progress */
         spinlock_t pde_unload_lock; /* proc_fops checks and pde_users bumps */
         struct completion *pde_unload_completion;
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index c6b7485eac7c..fe17d7d750c2 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -281,7 +281,6 @@ extern void FASTCALL(call_rcu(struct rcu_head *head,
 extern void FASTCALL(call_rcu_bh(struct rcu_head *head,
                                 void (*func)(struct rcu_head *head)));
 extern void synchronize_rcu(void);
-void synchronize_idle(void);
 extern void rcu_barrier(void);
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 691a1748d9d2..6570719eafdf 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -274,6 +274,8 @@ struct tty_struct {
 #define TTY_PTY_LOCK            16      /* pty private */
 #define TTY_NO_WRITE_SPLIT      17      /* Preserve write boundaries to driver */
 #define TTY_HUPPED              18      /* Post driver->hangup() */
+#define TTY_FLUSHING            19      /* Flushing to ldisc in progress */
+#define TTY_FLUSHPENDING        20      /* Queued buffer flush pending */
 
 #define TTY_WRITE_FLUSH(tty) tty_write_flush((tty))
 
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index 93780abd01bc..bb46e7645d53 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -145,13 +145,16 @@ do {								\
               {                                                 \
                 X##_e = 1;                                      \
                 _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc);        \
+                FP_SET_EXCEPTION(FP_EX_INEXACT);                \
               }                                                 \
             else                                                \
               {                                                 \
                 X##_e = 0;                                      \
                 _FP_FRAC_SRL_##wc(X, _FP_WORKBITS);             \
-                FP_SET_EXCEPTION(FP_EX_UNDERFLOW);              \
               }                                                 \
+            if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) ||          \
+                (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW))     \
+                FP_SET_EXCEPTION(FP_EX_UNDERFLOW);              \
           }                                                     \
         else                                                    \
           {                                                     \
diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
index d02eb64a865b..a0721ef5c2f9 100644
--- a/include/math-emu/soft-fp.h
+++ b/include/math-emu/soft-fp.h
@@ -97,12 +97,19 @@
 #define FP_INHIBIT_RESULTS 0
 #endif
 
+#ifndef FP_TRAPPING_EXCEPTIONS
+#define FP_TRAPPING_EXCPETIONS 0
+#endif
+
 #define FP_SET_EXCEPTION(ex)                            \
   _fex |= (ex)
   
 #define FP_UNSET_EXCEPTION(ex)                          \
   _fex &= ~(ex)
 
+#define FP_CUR_EXCEPTIONS                               \
+  (_fex)
+
 #define FP_CLEAR_EXCEPTIONS                             \
   _fex = 0
 
diff --git a/include/rdma/ib_mad.h b/include/rdma/ib_mad.h
index 30712ddd8a5e..8ec3799e42e1 100644
--- a/include/rdma/ib_mad.h
+++ b/include/rdma/ib_mad.h
@@ -39,6 +39,8 @@
 #if !defined( IB_MAD_H )
 #define IB_MAD_H
 
+#include <linux/list.h>
+
 #include <rdma/ib_verbs.h>
 
 /* Management base version */
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 0627a6aa282a..4bea182d7116 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -46,6 +46,8 @@
 #include <linux/mm.h>
 #include <linux/dma-mapping.h>
 #include <linux/kref.h>
+#include <linux/list.h>
+#include <linux/rwsem.h>
 
 #include <asm/atomic.h>
 #include <asm/scatterlist.h>
@@ -731,11 +733,6 @@ struct ib_udata {
         size_t       outlen;
 };
 
-#define IB_UMEM_MAX_PAGE_CHUNK                                          \
-        ((PAGE_SIZE - offsetof(struct ib_umem_chunk, page_list)) /      \
-         ((void *) &((struct ib_umem_chunk *) 0)->page_list[1] -        \
-          (void *) &((struct ib_umem_chunk *) 0)->page_list[0]))
-
 struct ib_pd {
         struct ib_device       *device;
         struct ib_uobject      *uobject;
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 615ce97c6cfd..f1a73f0b54e7 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -352,13 +352,10 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
          * keep it masked and get out of here
          */
         action = desc->action;
-        if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
-                desc->status |= IRQ_PENDING;
+        if (unlikely(!action || (desc->status & IRQ_DISABLED)))
                 goto out_unlock;
-        }
 
         desc->status |= IRQ_INPROGRESS;
-        desc->status &= ~IRQ_PENDING;
         spin_unlock(&desc->lock);
 
         action_ret = handle_IRQ_event(irq, action);
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index 5bfeaed7e487..a8046791ba2d 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -62,7 +62,12 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
          */
         desc->chip->enable(irq);
 
-        if ((status & (IRQ_PENDING | IRQ_REPLAY)) == IRQ_PENDING) {
+        /*
+         * We do not resend level type interrupts. Level type
+         * interrupts are resent by hardware when they are still
+         * active.
+         */
+        if ((status & (IRQ_LEVEL | IRQ_PENDING | IRQ_REPLAY)) == IRQ_PENDING) {
                 desc->status = (status & ~IRQ_PENDING) | IRQ_REPLAY;
 
                 if (!desc->chip || !desc->chip->retrigger ||
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 3e9f513a728d..4b8a4493c541 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1063,6 +1063,11 @@ EXPORT_SYMBOL_GPL(register_kprobe);
 EXPORT_SYMBOL_GPL(unregister_kprobe);
 EXPORT_SYMBOL_GPL(register_jprobe);
 EXPORT_SYMBOL_GPL(unregister_jprobe);
+#ifdef CONFIG_KPROBES
 EXPORT_SYMBOL_GPL(jprobe_return);
+#endif
+
+#ifdef CONFIG_KPROBES
 EXPORT_SYMBOL_GPL(register_kretprobe);
 EXPORT_SYMBOL_GPL(unregister_kretprobe);
+#endif
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index a3b7854b8f7c..a686590d88c1 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -709,7 +709,8 @@ static void mark_nosave_pages(struct memory_bitmap *bm)
                                 region->end_pfn << PAGE_SHIFT);
 
                 for (pfn = region->start_pfn; pfn < region->end_pfn; pfn++)
-                        memory_bm_set_bit(bm, pfn);
+                        if (pfn_valid(pfn))
+                                memory_bm_set_bit(bm, pfn);
         }
 }
 
diff --git a/kernel/profile.c b/kernel/profile.c
index 5b20fe977bed..cb1e37d2dac3 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -199,11 +199,11 @@ EXPORT_SYMBOL_GPL(register_timer_hook);
 EXPORT_SYMBOL_GPL(unregister_timer_hook);
 EXPORT_SYMBOL_GPL(task_handoff_register);
 EXPORT_SYMBOL_GPL(task_handoff_unregister);
+EXPORT_SYMBOL_GPL(profile_event_register);
+EXPORT_SYMBOL_GPL(profile_event_unregister);
 
 #endif /* CONFIG_PROFILING */
 
-EXPORT_SYMBOL_GPL(profile_event_register);
-EXPORT_SYMBOL_GPL(profile_event_unregister);
 
 #ifdef CONFIG_SMP
 /*
diff --git a/kernel/sched.c b/kernel/sched.c
index b0afd8db1396..45e17b83b7f1 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -263,6 +263,7 @@ struct rq {
 
         unsigned int clock_warps, clock_overflows;
         unsigned int clock_unstable_events;
+        u64 tick_timestamp;
 
         atomic_t nr_iowait;
 
@@ -341,8 +342,11 @@ static void __update_rq_clock(struct rq *rq)
                 /*
                  * Catch too large forward jumps too:
                  */
-                if (unlikely(delta > 2*TICK_NSEC)) {
-                        clock++;
+                if (unlikely(clock + delta > rq->tick_timestamp + TICK_NSEC)) {
+                        if (clock < rq->tick_timestamp + TICK_NSEC)
+                                clock = rq->tick_timestamp + TICK_NSEC;
+                        else
+                                clock++;
                         rq->clock_overflows++;
                 } else {
                         if (unlikely(delta > rq->clock_max_delta))
@@ -3102,7 +3106,7 @@ static void run_rebalance_domains(struct softirq_action *h)
                         if (need_resched())
                                 break;
 
-                        rebalance_domains(balance_cpu, SCHED_IDLE);
+                        rebalance_domains(balance_cpu, CPU_IDLE);
 
                         rq = cpu_rq(balance_cpu);
                         if (time_after(this_rq->next_balance, rq->next_balance))
@@ -3308,9 +3312,16 @@ void scheduler_tick(void)
         int cpu = smp_processor_id();
         struct rq *rq = cpu_rq(cpu);
         struct task_struct *curr = rq->curr;
+        u64 next_tick = rq->tick_timestamp + TICK_NSEC;
 
         spin_lock(&rq->lock);
         __update_rq_clock(rq);
+        /*
+         * Let rq->clock advance by at least TICK_NSEC:
+         */
+        if (unlikely(rq->clock < next_tick))
+                rq->clock = next_tick;
+        rq->tick_timestamp = rq->clock;
         update_cpu_load(rq);
         if (curr != rq->idle) /* FIXME: needed? */
                 curr->sched_class->task_tick(rq, curr);
@@ -6317,7 +6328,7 @@ int partition_sched_domains(cpumask_t *partition1, cpumask_t *partition2)
 }
 
 #if defined(CONFIG_SCHED_MC) || defined(CONFIG_SCHED_SMT)
-int arch_reinit_sched_domains(void)
+static int arch_reinit_sched_domains(void)
 {
         int err;
 
@@ -6346,24 +6357,6 @@ static ssize_t sched_power_savings_store(const char *buf, size_t count, int smt)
         return ret ? ret : count;
 }
 
-int sched_create_sysfs_power_savings_entries(struct sysdev_class *cls)
-{
-        int err = 0;
-
-#ifdef CONFIG_SCHED_SMT
-        if (smt_capable())
-                err = sysfs_create_file(&cls->kset.kobj,
-                                        &attr_sched_smt_power_savings.attr);
-#endif
-#ifdef CONFIG_SCHED_MC
-        if (!err && mc_capable())
-                err = sysfs_create_file(&cls->kset.kobj,
-                                        &attr_sched_mc_power_savings.attr);
-#endif
-        return err;
-}
-#endif
-
 #ifdef CONFIG_SCHED_MC
 static ssize_t sched_mc_power_savings_show(struct sys_device *dev, char *page)
 {
@@ -6374,8 +6367,8 @@ static ssize_t sched_mc_power_savings_store(struct sys_device *dev,
 {
         return sched_power_savings_store(buf, count, 0);
 }
-SYSDEV_ATTR(sched_mc_power_savings, 0644, sched_mc_power_savings_show,
-            sched_mc_power_savings_store);
+static SYSDEV_ATTR(sched_mc_power_savings, 0644, sched_mc_power_savings_show,
+                   sched_mc_power_savings_store);
 #endif
 
 #ifdef CONFIG_SCHED_SMT
@@ -6388,8 +6381,26 @@ static ssize_t sched_smt_power_savings_store(struct sys_device *dev,
 {
         return sched_power_savings_store(buf, count, 1);
 }
-SYSDEV_ATTR(sched_smt_power_savings, 0644, sched_smt_power_savings_show,
-            sched_smt_power_savings_store);
+static SYSDEV_ATTR(sched_smt_power_savings, 0644, sched_smt_power_savings_show,
+                   sched_smt_power_savings_store);
+#endif
+
+int sched_create_sysfs_power_savings_entries(struct sysdev_class *cls)
+{
+        int err = 0;
+
+#ifdef CONFIG_SCHED_SMT
+        if (smt_capable())
+                err = sysfs_create_file(&cls->kset.kobj,
+                                        &attr_sched_smt_power_savings.attr);
+#endif
+#ifdef CONFIG_SCHED_MC
+        if (!err && mc_capable())
+                err = sysfs_create_file(&cls->kset.kobj,
+                                        &attr_sched_mc_power_savings.attr);
+#endif
+        return err;
+}
 #endif
 
 /*
diff --git a/kernel/sched_debug.c b/kernel/sched_debug.c
index 3da32156394e..87e524762b85 100644
--- a/kernel/sched_debug.c
+++ b/kernel/sched_debug.c
@@ -108,7 +108,7 @@ print_cfs_rq_runtime_sum(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 
 void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
 {
-        SEQ_printf(m, "\ncfs_rq %p\n", cfs_rq);
+        SEQ_printf(m, "\ncfs_rq\n");
 
 #define P(x) \
         SEQ_printf(m, "  .%-30s: %Ld\n", #x, (long long)(cfs_rq->x))
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index e91db32cadfd..fedbb51bba96 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -75,7 +75,7 @@ enum {
 
 unsigned int sysctl_sched_features __read_mostly =
                 SCHED_FEAT_FAIR_SLEEPERS        *1 |
-                SCHED_FEAT_SLEEPER_AVG          *1 |
+                SCHED_FEAT_SLEEPER_AVG          *0 |
                 SCHED_FEAT_SLEEPER_LOAD_AVG     *1 |
                 SCHED_FEAT_PRECISE_CPU_LOAD     *1 |
                 SCHED_FEAT_START_DEBIT          *1 |
@@ -304,11 +304,9 @@ __update_curr(struct cfs_rq *cfs_rq, struct sched_entity *curr)
         delta_mine = calc_delta_mine(delta_exec, curr->load.weight, lw);
 
         if (cfs_rq->sleeper_bonus > sysctl_sched_granularity) {
-                delta = calc_delta_mine(cfs_rq->sleeper_bonus,
-                                        curr->load.weight, lw);
-                if (unlikely(delta > cfs_rq->sleeper_bonus))
-                        delta = cfs_rq->sleeper_bonus;
-
+                delta = min(cfs_rq->sleeper_bonus, (u64)delta_exec);
+                delta = calc_delta_mine(delta, curr->load.weight, lw);
+                delta = min((u64)delta, cfs_rq->sleeper_bonus);
                 cfs_rq->sleeper_bonus -= delta;
                 delta_mine -= delta;
         }
@@ -521,6 +519,8 @@ static void __enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
          * Track the amount of bonus we've given to sleepers:
          */
         cfs_rq->sleeper_bonus += delta_fair;
+        if (unlikely(cfs_rq->sleeper_bonus > sysctl_sched_runtime_limit))
+                cfs_rq->sleeper_bonus = sysctl_sched_runtime_limit;
 
         schedstat_add(cfs_rq, wait_runtime, se->wait_runtime);
 }
@@ -959,13 +959,12 @@ load_balance_fair(struct rq *this_rq, int this_cpu, struct rq *busiest,
         for_each_leaf_cfs_rq(busiest, busy_cfs_rq) {
 #ifdef CONFIG_FAIR_GROUP_SCHED
                 struct cfs_rq *this_cfs_rq;
-                long imbalances;
+                long imbalance;
                 unsigned long maxload;
 
                 this_cfs_rq = cpu_cfs_rq(busy_cfs_rq, this_cpu);
 
-                imbalance = busy_cfs_rq->load.weight -
-                                                 this_cfs_rq->load.weight;
+                imbalance = busy_cfs_rq->load.weight - this_cfs_rq->load.weight;
                 /* Don't pull if this_cfs_rq has more load than busy_cfs_rq */
                 if (imbalance <= 0)
                         continue;
@@ -976,7 +975,7 @@ load_balance_fair(struct rq *this_rq, int this_cpu, struct rq *busiest,
 
                 *this_best_prio = cfs_rq_best_prio(this_cfs_rq);
 #else
-#define maxload rem_load_move
+# define maxload rem_load_move
 #endif
                 /* pass busy_cfs_rq argument into
                  * load_balance_[start|next]_fair iterators
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 79c891e6266c..8bdb8c07e04f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1023,6 +1023,7 @@ static ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_doulongvec_minmax,
         },
+#endif
 #ifdef CONFIG_NUMA
         {
                 .ctl_name       = CTL_UNNUMBERED,
@@ -1034,7 +1035,6 @@ static ctl_table vm_table[] = {
                 .strategy       = &sysctl_string,
         },
 #endif
-#endif
 #if defined(CONFIG_X86_32) || \
    (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL))
         {
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 2ad1c37b8dfe..41dd3105ce7f 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -113,16 +113,6 @@ int clockevents_register_notifier(struct notifier_block *nb)
         return ret;
 }
 
-/**
- * clockevents_unregister_notifier - unregister a clock events change listener
- */
-void clockevents_unregister_notifier(struct notifier_block *nb)
-{
-        spin_lock(&clockevents_lock);
-        raw_notifier_chain_unregister(&clockevents_chain, nb);
-        spin_unlock(&clockevents_lock);
-}
-
 /*
  * Notify about a clock event change. Called with clockevents_lock
  * held.
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 16f2e2935e87..bd5edaeaa80b 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -189,7 +189,7 @@ EXPORT_SYMBOL(print_hex_dump);
  * rowsize of 16, groupsize of 1, and ASCII output included.
  */
 void print_hex_dump_bytes(const char *prefix_str, int prefix_type,
-                        void *buf, size_t len)
+                        const void *buf, size_t len)
 {
         print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, 16, 1,
                         buf, len, 1);
diff --git a/mm/filemap.c b/mm/filemap.c
index 6cf700d41844..90b657b50f81 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -843,7 +843,7 @@ static void shrink_readahead_size_eio(struct file *filp,
 /**
  * do_generic_mapping_read - generic file read routine
  * @mapping:    address_space to be read
- * @ra:         file's readahead state
+ * @_ra:        file's readahead state
  * @filp:       the file to read
  * @ppos:       current file position
  * @desc:       read_descriptor
@@ -1218,26 +1218,6 @@ out:
 }
 EXPORT_SYMBOL(generic_file_aio_read);
 
-int file_send_actor(read_descriptor_t * desc, struct page *page, unsigned long offset, unsigned long size)
-{
-        ssize_t written;
-        unsigned long count = desc->count;
-        struct file *file = desc->arg.data;
-
-        if (size > count)
-                size = count;
-
-        written = file->f_op->sendpage(file, page, offset,
-                                       size, &file->f_pos, size<count);
-        if (written < 0) {
-                desc->error = written;
-                written = 0;
-        }
-        desc->count = count - written;
-        desc->written += written;
-        return written;
-}
-
 static ssize_t
 do_readahead(struct address_space *mapping, struct file *filp,
              unsigned long index, unsigned long nr)
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index c0040c9064a1..bd08aa090763 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -319,7 +319,7 @@ static int vlandev_seq_show(struct seq_file *seq, void *offset)
         static const char fmt[] = "%30s %12lu\n";
         int i;
 
-        if ((vlandev == NULL) || (!(vlandev->priv_flags & IFF_802_1Q_VLAN)))
+        if (!(vlandev->priv_flags & IFF_802_1Q_VLAN))
                 return 0;
 
         seq_printf(seq, "%s  VID: %d     REORDER_HDR: %i  dev->priv_flags: %hx\n",
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 2770fb451ae8..59d5aa3366f2 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -21,7 +21,6 @@
 #include <net/dst.h>
 #include <linux/proc_fs.h>
 #include <linux/spinlock.h>
-#include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
 /* TokenRing if needed */
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 16be0c14780a..8443af57a374 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -69,7 +69,6 @@ void ax25_protocol_release(unsigned int pid)
         if (protocol->pid == pid) {
                 protocol_list = protocol->next;
                 write_unlock_bh(&protocol_list_lock);
-                kfree(protocol);
                 return;
         }
 
@@ -78,7 +77,6 @@ void ax25_protocol_release(unsigned int pid)
                         s = protocol->next;
                         protocol->next = protocol->next->next;
                         write_unlock_bh(&protocol_list_lock);
-                        kfree(s);
                         return;
                 }
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 5e1892d8d874..0eded176ce99 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -179,5 +179,5 @@ void br_dev_setup(struct net_device *dev)
         dev->priv_flags = IFF_EBRIDGE;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
-                        NETIF_F_TSO | NETIF_F_NO_CSUM | NETIF_F_GSO_ROBUST;
+                        NETIF_F_GSO_MASK | NETIF_F_NO_CSUM | NETIF_F_LLTX;
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b40dada002bf..749f0e8f541d 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -349,43 +349,15 @@ int br_min_mtu(const struct net_bridge *br)
 void br_features_recompute(struct net_bridge *br)
 {
         struct net_bridge_port *p;
-        unsigned long features, checksum;
+        unsigned long features;
 
-        checksum = br->feature_mask & NETIF_F_ALL_CSUM ? NETIF_F_NO_CSUM : 0;
-        features = br->feature_mask & ~NETIF_F_ALL_CSUM;
+        features = br->feature_mask;
 
         list_for_each_entry(p, &br->port_list, list) {
-                unsigned long feature = p->dev->features;
-
-                /* if device needs checksumming, downgrade to hw checksumming */
-                if (checksum & NETIF_F_NO_CSUM && !(feature & NETIF_F_NO_CSUM))
-                        checksum ^= NETIF_F_NO_CSUM | NETIF_F_HW_CSUM;
-
-                /* if device can't do all checksum, downgrade to ipv4/ipv6 */
-                if (checksum & NETIF_F_HW_CSUM && !(feature & NETIF_F_HW_CSUM))
-                        checksum ^= NETIF_F_HW_CSUM
-                                | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-
-                if (checksum & NETIF_F_IPV6_CSUM && !(feature & NETIF_F_IPV6_CSUM))
-                        checksum &= ~NETIF_F_IPV6_CSUM;
-
-                if (!(feature & NETIF_F_IP_CSUM))
-                        checksum = 0;
-
-                if (feature & NETIF_F_GSO)
-                        feature |= NETIF_F_GSO_SOFTWARE;
-                feature |= NETIF_F_GSO;
-
-                features &= feature;
+                features = netdev_compute_features(features, p->dev->features);
         }
 
-        if (!(checksum & NETIF_F_ALL_CSUM))
-                features &= ~NETIF_F_SG;
-        if (!(features & NETIF_F_SG))
-                features &= ~NETIF_F_GSO_MASK;
-
-        br->dev->features = features | checksum | NETIF_F_LLTX |
-                            NETIF_F_GSO_ROBUST;
+        br->dev->features = features;
 }
 
 /* called with RTNL */
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 1ea2f86f7683..1a430eccec9b 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -132,7 +132,7 @@ static void br_stp_start(struct net_bridge *br)
         } else {
                 br->stp_enabled = BR_KERNEL_STP;
                 printk(KERN_INFO "%s: starting userspace STP failed, "
-                                "staring kernel STP\n", br->dev->name);
+                                "starting kernel STP\n", br->dev->name);
 
                 /* To start timers on any ports left in blocking */
                 spin_lock_bh(&br->lock);
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 4f42263e0a8a..88f43003b193 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -147,20 +147,26 @@ static ssize_t show_stp_state(struct device *d,
         return sprintf(buf, "%d\n", br->stp_enabled);
 }
 
-static void set_stp_state(struct net_bridge *br, unsigned long val)
-{
-        rtnl_lock();
-        spin_unlock_bh(&br->lock);
-        br_stp_set_enabled(br, val);
-        spin_lock_bh(&br->lock);
-        rtnl_unlock();
-}
 
 static ssize_t store_stp_state(struct device *d,
                                struct device_attribute *attr, const char *buf,
                                size_t len)
 {
-        return store_bridge_parm(d, buf, len, set_stp_state);
+        struct net_bridge *br = to_bridge(d);
+        char *endp;
+        unsigned long val;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        val = simple_strtoul(buf, &endp, 0);
+        if (endp == buf)
+                return -EINVAL;
+
+        rtnl_lock();
+        br_stp_set_enabled(br, val);
+        rtnl_unlock();
+
 }
 static DEVICE_ATTR(stp_state, S_IRUGO | S_IWUSR, show_stp_state,
                    store_stp_state);
diff --git a/net/core/dev.c b/net/core/dev.c
index 6cc8a70350ac..a76021c71207 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3993,6 +3993,45 @@ static int __init netdev_dma_register(void)
 static int __init netdev_dma_register(void) { return -ENODEV; }
 #endif /* CONFIG_NET_DMA */
 
+/**
+ *      netdev_compute_feature - compute conjunction of two feature sets
+ *      @all: first feature set
+ *      @one: second feature set
+ *
+ *      Computes a new feature set after adding a device with feature set
+ *      @one to the master device with current feature set @all.  Returns
+ *      the new feature set.
+ */
+int netdev_compute_features(unsigned long all, unsigned long one)
+{
+        /* if device needs checksumming, downgrade to hw checksumming */
+        if (all & NETIF_F_NO_CSUM && !(one & NETIF_F_NO_CSUM))
+                all ^= NETIF_F_NO_CSUM | NETIF_F_HW_CSUM;
+
+        /* if device can't do all checksum, downgrade to ipv4/ipv6 */
+        if (all & NETIF_F_HW_CSUM && !(one & NETIF_F_HW_CSUM))
+                all ^= NETIF_F_HW_CSUM
+                        | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+
+        if (one & NETIF_F_GSO)
+                one |= NETIF_F_GSO_SOFTWARE;
+        one |= NETIF_F_GSO;
+
+        /* If even one device supports robust GSO, enable it for all. */
+        if (one & NETIF_F_GSO_ROBUST)
+                all |= NETIF_F_GSO_ROBUST;
+
+        all &= one | NETIF_F_LLTX;
+
+        if (!(all & NETIF_F_ALL_CSUM))
+                all &= ~NETIF_F_SG;
+        if (!(all & NETIF_F_SG))
+                all &= ~NETIF_F_GSO_MASK;
+
+        return all;
+}
+EXPORT_SYMBOL(netdev_compute_features);
+
 /*
  *      Initialize the DEV module. At boot time this walks the device list and
  *      unhooks any devices that fail to initialise (normally hardware not
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 2ab0a60046a5..c5e059352d43 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -948,7 +948,6 @@ int dev_ethtool(struct ifreq *ifr)
         return rc;
 }
 
-EXPORT_SYMBOL(dev_ethtool);
 EXPORT_SYMBOL(ethtool_op_get_link);
 EXPORT_SYMBOL(ethtool_op_get_sg);
 EXPORT_SYMBOL(ethtool_op_get_tso);
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index ccbf72c793b6..c45088b5e6fb 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -40,6 +40,7 @@ static inline void ccids_write_unlock(void)
 static inline void ccids_read_lock(void)
 {
         atomic_inc(&ccids_lockct);
+        smp_mb__after_atomic_inc();
         spin_unlock_wait(&ccids_lock);
 }
 
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index cd845df5320d..5ebdd86c1b99 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -327,10 +327,16 @@ static void dccp_feat_empty_confirm(struct dccp_minisock *dmsk,
         }
 
         switch (type) {
-        case DCCPO_CHANGE_L: opt->dccpop_type = DCCPO_CONFIRM_R; break;
-        case DCCPO_CHANGE_R: opt->dccpop_type = DCCPO_CONFIRM_L; break;
-        default:             DCCP_WARN("invalid type %d\n", type); return;
-
+        case DCCPO_CHANGE_L:
+                opt->dccpop_type = DCCPO_CONFIRM_R;
+                break;
+        case DCCPO_CHANGE_R:
+                opt->dccpop_type = DCCPO_CONFIRM_L;
+                break;
+        default:
+                DCCP_WARN("invalid type %d\n", type);
+                kfree(opt);
+                return;
         }
         opt->dccpop_feat = feature;
         opt->dccpop_val  = NULL;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index b5524f32ac2d..35c96bcc0f32 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -1146,6 +1146,9 @@ static void __exit econet_proto_exit(void)
                 sock_release(udpsock);
 #endif
         unregister_netdevice_notifier(&econet_netdev_notifier);
+#ifdef CONFIG_ECONET_NATIVE
+        dev_remove_pack(&econet_packet_type);
+#endif
         sock_unregister(econet_family_ops.family);
         proto_unregister(&econet_proto);
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index c9e2b5e6305e..0f1d7beacf78 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -75,7 +75,6 @@
 #include <net/icmp.h>
 #include <net/checksum.h>
 #include <net/inetpeer.h>
-#include <net/checksum.h>
 #include <linux/igmp.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_bridge.h>
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 342ca8d89458..c5b247077539 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1281,9 +1281,9 @@ static int __init ip_auto_config(void)
          */
         if (ic_myaddr == NONE ||
 #ifdef CONFIG_ROOT_NFS
-            (MAJOR(ROOT_DEV) == UNNAMED_MAJOR
-             && root_server_addr == NONE
-             && ic_servaddr == NONE) ||
+            (root_server_addr == NONE
+             && ic_servaddr == NONE
+             && ROOT_DEV == Root_NFS) ||
 #endif
             ic_first_dev->next) {
 #ifdef IPCONFIG_DYNAMIC
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index e1052bcf4ed1..902fd578aa3c 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -29,7 +29,6 @@
 #include <linux/proc_fs.h>
 #include <linux/workqueue.h>
 #include <linux/swap.h>
-#include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
 #include <linux/netfilter.h>
@@ -909,7 +908,7 @@ ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
         write_lock_bh(&__ip_vs_svc_lock);
 
         /* Wait until all other svc users go away */
-        while (atomic_read(&svc->usecnt) > 1) {};
+        IP_VS_WAIT_WHILE(atomic_read(&svc->usecnt) > 1);
 
         /* call the update_service, because server weight may be changed */
         svc->scheduler->update_service(svc);
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index dcc12b183474..69bd362b5fa2 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -19,7 +19,6 @@
 #include <linux/udp.h>
 #include <linux/icmp.h>
 #include <linux/if_arp.h>
-#include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/netfilter_arp.h>
 #include <linux/netfilter/x_tables.h>
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index a889ec3ec83a..e14d41976c27 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -104,7 +104,7 @@ static unsigned int ip_nat_sip(struct sk_buff **pskb,
         dataoff = ip_hdrlen(*pskb) + sizeof(struct udphdr);
         datalen = (*pskb)->len - dataoff;
         if (datalen < sizeof("SIP/2.0") - 1)
-                return NF_DROP;
+                return NF_ACCEPT;
 
         addr_map_init(ct, &map);
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index d6846393182d..761a910f4f97 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -820,7 +820,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
                 return 0;
 
         len = min_t(unsigned int, len, ipv6_optlen(hdr));
-        if (copy_to_user(optval, hdr, len));
+        if (copy_to_user(optval, hdr, len))
                 return -EFAULT;
         return ipv6_optlen(hdr);
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cbdb78487915..0f7defb482e9 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -56,7 +56,6 @@
 #include <net/inet_ecn.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
-#include <net/addrconf.h>
 #include <net/snmp.h>
 #include <net/dsfield.h>
 #include <net/timewait_sock.h>
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 8ec5ed192b5d..7286c389a4d0 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -4678,7 +4678,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
                         memset(skb->cb, 0, sizeof(skb->cb));
                         netif_rx(skb);
                         skb = skb2;
-                        break;
                 }
         }
  out:
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 7ba352e3ffe0..0d99b685df5f 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -2154,7 +2154,11 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
                 return 0;
         } else {
                 if (ifsta->state != IEEE80211_AUTHENTICATE) {
-                        ieee80211_sta_start_scan(dev, NULL, 0);
+                        if (ifsta->auto_ssid_sel)
+                                ieee80211_sta_start_scan(dev, NULL, 0);
+                        else
+                                ieee80211_sta_start_scan(dev, ifsta->ssid,
+                                                         ifsta->ssid_len);
                         ifsta->state = IEEE80211_AUTHENTICATE;
                         set_bit(IEEE80211_STA_REQ_AUTH, &ifsta->request);
                 } else
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 1276a442f10c..d449fa47491c 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -295,6 +295,7 @@ static int epaddr_len(struct nf_conn *ct, const char *dptr,
 static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
                           const char *limit, int *shift)
 {
+        const char *start = dptr;
         int s = *shift;
 
         /* Search for @, but stop at the end of the line.
@@ -309,8 +310,10 @@ static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
         if (dptr <= limit && *dptr == '@') {
                 dptr++;
                 (*shift)++;
-        } else
+        } else {
+                dptr = start;
                 *shift = s;
+        }
 
         return epaddr_len(ct, dptr, limit, shift);
 }
@@ -330,7 +333,8 @@ int ct_sip_get_info(struct nf_conn *ct,
 
         while (dptr <= limit) {
                 if ((strncmp(dptr, hnfo->lname, hnfo->lnlen) != 0) &&
-                    (strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
+                    (hnfo->sname == NULL ||
+                     strncmp(dptr, hnfo->sname, hnfo->snlen) != 0)) {
                         dptr++;
                         continue;
                 }
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 74f9b14c012f..bec427915b30 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -36,7 +36,7 @@ static bool u32_match_it(const struct xt_u32 *data,
                 at  = 0;
                 pos = ct->location[0].number;
 
-                if (skb->len < 4 || pos > skb->len - 4);
+                if (skb->len < 4 || pos > skb->len - 4)
                         return false;
 
                 ret   = skb_copy_bits(skb, pos, &n, sizeof(n));
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index bf90e60f8411..6085be578459 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -16,7 +16,6 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/skbuff.h>
-#include <linux/module.h>
 #include <linux/rtnetlink.h>
 #include <linux/init.h>
 #include <net/act_api.h>
diff --git a/net/socket.c b/net/socket.c
index ec077037f534..7d44453dfae1 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1168,7 +1168,7 @@ static int __sock_create(int family, int type, int protocol,
         module_put(pf->owner);
         err = security_socket_post_create(sock, family, type, protocol, kern);
         if (err)
-                goto out_release;
+                goto out_sock_release;
         *res = sock;
 
         return 0;
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index dc2f41e9f577..7da7050f06c3 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -42,7 +42,6 @@
 #include <linux/pagemap.h>
 
 #include <linux/sunrpc/auth_gss.h>
-#include <linux/sunrpc/svcauth.h>
 #include <linux/sunrpc/gss_err.h>
 #include <linux/sunrpc/svcauth.h>
 #include <linux/sunrpc/svcauth_gss.h>
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 5d2b9ce84d0a..76088153524c 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -41,7 +41,6 @@
 #include "addr.h"
 #include "link.h"
 #include "node.h"
-#include "port.h"
 #include "name_table.h"
 #include "user_reg.h"
 #include "msg.h"
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index e5a3be03aa0d..7012891d39f2 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -23,10 +23,9 @@
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/cache.h>
+#include <linux/audit.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
-#include <linux/audit.h>
-#include <linux/cache.h>
 
 #include "xfrm_hash.h"
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 31be405efb55..d4356e6f7f9b 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -19,9 +19,8 @@
 #include <linux/ipsec.h>
 #include <linux/module.h>
 #include <linux/cache.h>
-#include <asm/uaccess.h>
 #include <linux/audit.h>
-#include <linux/cache.h>
+#include <asm/uaccess.h>
 
 #include "xfrm_hash.h"
 
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 73751ab6ec0c..dae7d30dca0f 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -9,7 +9,7 @@ use strict;
 my $P = $0;
 $P =~ s@.*/@@g;
 
-my $V = '0.08';
+my $V = '0.09';
 
 use Getopt::Long qw(:config no_auto_abbrev);
 
@@ -311,7 +311,7 @@ sub process {
 
         my $Ident       = qr{[A-Za-z\d_]+};
         my $Storage     = qr{extern|static};
-        my $Sparse      = qr{__user|__kernel|__force|__iomem};
+        my $Sparse      = qr{__user|__kernel|__force|__iomem|__must_check|__init_refok};
         my $NonptrType  = qr{
                                 \b
                                 (?:const\s+)?
@@ -325,6 +325,7 @@ sub process {
                                         unsigned|
                                         float|
                                         double|
+                                        bool|
                                         long\s+int|
                                         long\s+long|
                                         long\s+long\s+int|
@@ -340,7 +341,8 @@ sub process {
                           }x;
         my $Type        = qr{
                                 \b$NonptrType\b
-                                (?:\s*\*+\s*const|\s*\*+)?
+                                (?:\s*\*+\s*const|\s*\*+|(?:\s*\[\s*\])+)?
+                                (?:\s+$Sparse)*
                           }x;
         my $Declare     = qr{(?:$Storage\s+)?$Type};
         my $Attribute   = qr{const|__read_mostly|__init|__initdata|__meminit};
@@ -494,16 +496,15 @@ sub process {
                         ERROR("use tabs not spaces\n" . $herevet);
                 }
 
-                #
-                # The rest of our checks refer specifically to C style
-                # only apply those _outside_ comments.
-                #
-                next if ($in_comment);
-
 # Remove comments from the line before processing.
-                $line =~ s@/\*.*\*/@@g;
-                $line =~ s@/\*.*@@;
-                $line =~ s@.*\*/@@;
+                my $comment_edge = ($line =~ s@/\*.*\*/@@g) +
+                                   ($line =~ s@/\*.*@@) +
+                                   ($line =~ s@^(.).*\*/@$1@);
+
+# The rest of our checks refer specifically to C style
+# only apply those _outside_ comments.  Only skip
+# lines in the middle of comments.
+                next if (!$comment_edge && $in_comment);
 
 # Standardise the strings and chars within the input to simplify matching.
                 $line = sanitise_line($line);
@@ -599,7 +600,7 @@ sub process {
                         if (($prevline !~ /^}/) &&
                            ($prevline !~ /^\+}/) &&
                            ($prevline !~ /^ }/) &&
-                           ($prevline !~ /\s$name(?:\s+$Attribute)?\s*(?:;|=)/)) {
+                           ($prevline !~ /\b\Q$name\E(?:\s+$Attribute)?\s*(?:;|=)/)) {
                                 WARN("EXPORT_SYMBOL(foo); should immediately follow its function/variable\n" . $herecurr);
                         }
                 }
@@ -680,9 +681,9 @@ sub process {
 
 # check for spaces between functions and their parentheses.
                 if ($line =~ /($Ident)\s+\(/ &&
-                    $1 !~ /^(?:if|for|while|switch|return|volatile)$/ &&
+                    $1 !~ /^(?:if|for|while|switch|return|volatile|__volatile__|__attribute__|format|__extension__|Copyright)$/ &&
                     $line !~ /$Type\s+\(/ && $line !~ /^.\#\s*define\b/) {
-                        ERROR("no space between function name and open parenthesis '('\n" . $herecurr);
+                        WARN("no space between function name and open parenthesis '('\n" . $herecurr);
                 }
 # Check operator spacing.
                 # Note we expand the line with the leading + as the real
@@ -712,6 +713,7 @@ sub process {
                                         $c = 'W' if ($elements[$n + 2] =~ /^\s/);
                                         $c = 'B' if ($elements[$n + 2] =~ /^(\)|\]|;)/);
                                         $c = 'O' if ($elements[$n + 2] eq '');
+                                        $c = 'E' if ($elements[$n + 2] =~ /\s*\\$/);
                                 } else {
                                         $c = 'E';
                                 }
@@ -812,7 +814,11 @@ sub process {
 
                                 # All the others need spaces both sides.
                                 } elsif ($ctx !~ /[EW]x[WE]/) {
-                                        ERROR("need spaces around that '$op' $at\n" . $hereptr);
+                                        # Ignore email addresses <foo@bar>
+                                        if (!($op eq '<' && $cb =~ /$;\S+\@\S+>/) &&
+                                            !($op eq '>' && $cb =~ /<\S+\@\S+$;/)) {
+                                                ERROR("need spaces around that '$op' $at\n" . $hereptr);
+                                        }
                                 }
                                 $off += length($elements[$n + 1]);
                         }
@@ -823,15 +829,24 @@ sub process {
                         WARN("multiple assignments should be avoided\n" . $herecurr);
                 }
 
-# check for multiple declarations, allowing for a function declaration
-# continuation.
-                if ($line =~ /^.\s*$Type\s+$Ident(?:\s*=[^,{]*)?\s*,\s*$Ident.*/ &&
-                    $line !~ /^.\s*$Type\s+$Ident(?:\s*=[^,{]*)?\s*,\s*$Type\s*$Ident.*/) {
-                        WARN("declaring multiple variables together should be avoided\n" . $herecurr);
-                }
+## # check for multiple declarations, allowing for a function declaration
+## # continuation.
+##              if ($line =~ /^.\s*$Type\s+$Ident(?:\s*=[^,{]*)?\s*,\s*$Ident.*/ &&
+##                  $line !~ /^.\s*$Type\s+$Ident(?:\s*=[^,{]*)?\s*,\s*$Type\s*$Ident.*/) {
+##
+##                      # Remove any bracketed sections to ensure we do not
+##                      # falsly report the parameters of functions.
+##                      my $ln = $line;
+##                      while ($ln =~ s/\([^\(\)]*\)//g) {
+##                      }
+##                      if ($ln =~ /,/) {
+##                              WARN("declaring multiple variables together should be avoided\n" . $herecurr);
+##                      }
+##              }
 
 #need space before brace following if, while, etc
-                if ($line =~ /\(.*\){/ || $line =~ /do{/) {
+                if (($line =~ /\(.*\){/ && $line !~ /\($Type\){/) ||
+                    $line =~ /do{/) {
                         ERROR("need a space before the open brace '{'\n" . $herecurr);
                 }
 
@@ -841,6 +856,22 @@ sub process {
                         ERROR("need a space after that close brace '}'\n" . $herecurr);
                 }
 
+# check spacing on square brackets
+                if ($line =~ /\[\s/ && $line !~ /\[\s*$/) {
+                        ERROR("no space after that open square bracket '['\n" . $herecurr);
+                }
+                if ($line =~ /\s\]/) {
+                        ERROR("no space before that close square bracket ']'\n" . $herecurr);
+                }
+
+# check spacing on paretheses
+                if ($line =~ /\(\s/ && $line !~ /\(\s*$/) {
+                        ERROR("no space after that open parenthesis '('\n" . $herecurr);
+                }
+                if ($line =~ /\s\)/) {
+                        ERROR("no space before that close parenthesis ')'\n" . $herecurr);
+                }
+
 #goto labels aren't indented, allow a single space however
                 if ($line=~/^.\s+[A-Za-z\d_]+:(?![0-9]+)/ and
                    !($line=~/^. [A-Za-z\d_]+:/) and !($line=~/^.\s+default:/)) {
@@ -910,7 +941,7 @@ sub process {
                         # grabbing the statement after the identifier
                         $prevline =~ m{^(.#\s*define\s*$Ident(?:\([^\)]*\))?\s*)(.*)\\\s*$};
                         ##print "1<$1> 2<$2>\n";
-                        if ($2 ne '') {
+                        if (defined $2 && $2 ne '') {
                                 $off = length($1);
                                 $ln--;
                                 $cnt++;
@@ -950,8 +981,10 @@ sub process {
                                 my ($lvl, @block) = ctx_block_level($nr, $cnt);
 
                                 my $stmt = join(' ', @block);
-                                $stmt =~ s/^[^{]*{//;
-                                $stmt =~ s/}[^}]*$//;
+                                $stmt =~ s/(^[^{]*){//;
+                                my $before = $1;
+                                $stmt =~ s/}([^}]*$)//;
+                                my $after = $1;
 
                                 #print "block<" . join(' ', @block) . "><" . scalar(@block) . ">\n";
                                 #print "stmt<$stmt>\n\n";
@@ -963,12 +996,14 @@ sub process {
                                 # Also nested if's often require braces to
                                 # disambiguate the else binding so shhh there.
                                 my @semi = ($stmt =~ /;/g);
+                                push(@semi, "/**/") if ($stmt =~ m@/\*@);
                                 ##print "semi<" . scalar(@semi) . ">\n";
                                 if ($lvl == 0 && scalar(@semi) < 2 &&
-                                    $stmt !~ /{/ && $stmt !~ /\bif\b/) {
+                                    $stmt !~ /{/ && $stmt !~ /\bif\b/ &&
+                                    $before !~ /}/ && $after !~ /{/) {
                                         my $herectx = "$here\n" . join("\n", @control, @block[1 .. $#block]) . "\n";
                                         shift(@block);
-                                        ERROR("braces {} are not necessary for single statement blocks\n" . $herectx);
+                                        WARN("braces {} are not necessary for single statement blocks\n" . $herectx);
                                 }
                         }
                 }
@@ -1013,6 +1048,11 @@ sub process {
 #                       $clean = 0;
 #               }
 
+# warn about spacing in #ifdefs
+                if ($line =~ /^.#\s*(ifdef|ifndef|elif)\s\s+/) {
+                        ERROR("exactly one space required after that #$1\n" . $herecurr);
+                }
+
 # check for spinlock_t definitions without a comment.
                 if ($line =~ /^.\s*(struct\s+mutex|spinlock_t)\s+\S+;/) {
                         my $which = $1;
@@ -1027,14 +1067,14 @@ sub process {
                         }
                 }
 # check of hardware specific defines
-                if ($line =~ m@^.#\s*if.*\b(__i386__|__powerpc64__|__sun__|__s390x__)\b@) {
+                if ($line =~ m@^.#\s*if.*\b(__i386__|__powerpc64__|__sun__|__s390x__)\b@ && $realfile !~ m@include/asm-@) {
                         CHK("architecture specific defines should be avoided\n" .  $herecurr);
                 }
 
 # check the location of the inline attribute, that it is between
 # storage class and type.
-                if ($line =~ /$Type\s+(?:inline|__always_inline)\b/ ||
-                    $line =~ /\b(?:inline|always_inline)\s+$Storage/) {
+                if ($line =~ /$Type\s+(?:inline|__always_inline|noinline)\b/ ||
+                    $line =~ /\b(?:inline|__always_inline|noinline)\s+$Storage/) {
                         ERROR("inline keyword should sit between storage class and type\n" . $herecurr);
                 }
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index f00161ef99ed..6100fc023055 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2127,7 +2127,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
         *rule = NULL;
 
         if (!ss_initialized)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         switch (field) {
         case AUDIT_SUBJ_USER: