133 files changed, 1697 insertions, 713 deletions

diff --git a/Documentation/cachetlb.txt b/Documentation/cachetlb.txt
index 73e794f0ff09..debf6813934a 100644
--- a/Documentation/cachetlb.txt
+++ b/Documentation/cachetlb.txt
@@ -373,14 +373,15 @@ maps this page at its virtual address.
         likely that you will need to flush the instruction cache
         for copy_to_user_page().
 
-  void flush_anon_page(struct page *page, unsigned long vmaddr)
+  void flush_anon_page(struct vm_area_struct *vma, struct page *page,
+                       unsigned long vmaddr)
         When the kernel needs to access the contents of an anonymous
         page, it calls this function (currently only
         get_user_pages()).  Note: flush_dcache_page() deliberately
         doesn't work for an anonymous page.  The default
         implementation is a nop (and should remain so for all coherent
         architectures).  For incoherent architectures, it should flush
-        the cache of the page at vmaddr in the current user process.
+        the cache of the page at vmaddr.
 
   void flush_kernel_dcache_page(struct page *page)
         When the kernel needs to modify a user page is has obtained
diff --git a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
index d077d764f82b..7fb3b8a44eb6 100644
--- a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
+++ b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
@@ -157,8 +157,8 @@ rtc@<addr>	rtc		*-rtc		Real time clock
 mscan@<addr>    mscan           *-mscan         CAN bus controller
 pci@<addr>      pci             *-pci           PCI bridge
 serial@<addr>   serial          *-psc-uart      PSC in serial mode
-i2s@<addr>      i2s             *-psc-i2s       PSC in i2s mode
-ac97@<addr>     ac97            *-psc-ac97      PSC in ac97 mode
+i2s@<addr>      sound           *-psc-i2s       PSC in i2s mode
+ac97@<addr>     sound           *-psc-ac97      PSC in ac97 mode
 spi@<addr>      spi             *-psc-spi       PSC in spi mode
 irda@<addr>     irda            *-psc-irda      PSC in IrDA mode
 spi@<addr>      spi             *-spi           MPC52xx spi device
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index dbdcaf68e3ea..5c86ed6f0448 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -52,6 +52,10 @@ APICs
                  apicmaintimer. Useful when your PIT timer is totally
                  broken.
 
+   disable_8254_timer / enable_8254_timer
+                 Enable interrupt 0 timer routing over the 8254 in addition to over
+                 the IO-APIC. The kernel tries to set a sensible default.
+
 Early Console
 
    syntax: earlyprintk=vga
diff --git a/MAINTAINERS b/MAINTAINERS
index 2bd34ef58ffa..49e4f554d211 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -412,20 +412,32 @@ S:      Maintained
 ARM/INTEL IOP32X ARM ARCHITECTURE
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
+
+ARM/INTEL IOP33X ARM ARCHITECTURE
+P:      Dan Williams
+M:      dan.j.williams@intel.com
+L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
+S:      Supported
 
 ARM/INTEL IOP13XX ARM ARCHITECTURE
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
 
 ARM/INTEL IQ81342EX MACHINE SUPPORT
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
 
 ARM/INTEL IXP2000 ARM ARCHITECTURE
 P:      Lennert Buytenhek
@@ -448,8 +460,10 @@ S:	Maintained
 ARM/INTEL XSC3 (MANZANO) ARM CORE
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
 
 ARM/IP FABRICS DOUBLE ESPRESSO MACHINE SUPPORT
 P:      Lennert Buytenhek
@@ -2622,6 +2636,12 @@ M:	promise@pnd-pc.demon.co.uk
 W:      http://www.pnd-pc.demon.co.uk/promise/
 S:      Maintained
 
+PROMISE SATA TX2/TX4 CONTROLLER LIBATA DRIVER
+P:      Mikael Pettersson
+M:      mikpe@it.uu.se
+L:      linux-ide@vger.kernel.org
+S:      Maintained
+
 PS3 PLATFORM SUPPORT
 P:      Geoff Levand
 M:      geoffrey.levand@am.sony.com
diff --git a/Makefile b/Makefile
index fb5b3ef9ab11..47669cb6c8fb 100644
--- a/Makefile
+++ b/Makefile
@@ -368,14 +368,10 @@ endif
 # Detect when mixed targets is specified, and make a second invocation
 # of make so .config is not included in this case either (for *config).
 
-PHONY += generated_headers
-
-generated_headers: include/linux/version.h include/linux/compile.h \
-                include/linux/utsrelease.h
-
-no-dot-config-targets := generated_headers clean mrproper distclean \
+no-dot-config-targets := clean mrproper distclean \
                          cscope TAGS tags help %docs check% \
-                         headers_% kernelrelease kernelversion
+                         include/linux/version.h headers_% \
+                         kernelrelease kernelversion
 
 config-targets := 0
 mixed-targets  := 0
@@ -738,16 +734,6 @@ debug_kallsyms: .tmp_map$(last_kallsyms)
 
 endif # ifdef CONFIG_KALLSYMS
 
-# compile.h changes depending on hostname, generation number, etc,
-# so we regenerate it always.
-# mkcompile_h will make sure to only update the
-# actual file if its content has changed.
-
-include/linux/compile.h: FORCE
-        @echo '  CHK     $@'
-        $(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkcompile_h $@ \
-        "$(UTS_MACHINE)" "$(CONFIG_SMP)" "$(CONFIG_PREEMPT)" "$(CC) $(CFLAGS)"
-
 # vmlinux image - including updated kernel symbols
 vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) $(kallsyms.o) FORCE
 ifdef CONFIG_HEADERS_CHECK
@@ -866,8 +852,8 @@ endif
 # prepare2 creates a makefile if using a separate output directory
 prepare2: prepare3 outputmakefile
 
-prepare1: prepare2 generated_headers include/asm include/config/auto.conf
-
+prepare1: prepare2 include/linux/version.h include/linux/utsrelease.h \
+                   include/asm include/config/auto.conf
 ifneq ($(KBUILD_MODULES),)
         $(Q)mkdir -p $(MODVERDIR)
         $(Q)rm -f $(MODVERDIR)/*
@@ -936,14 +922,14 @@ export INSTALL_HDR_PATH
 HDRARCHES=$(filter-out generic,$(patsubst $(srctree)/include/asm-%/Kbuild,%,$(wildcard $(srctree)/include/asm-*/Kbuild)))
 
 PHONY += headers_install_all
-headers_install_all: generated_headers scripts_basic FORCE
+headers_install_all: include/linux/version.h scripts_basic FORCE
         $(Q)$(MAKE) $(build)=scripts scripts/unifdef
         $(Q)for arch in $(HDRARCHES); do \
          $(MAKE) ARCH=$$arch -f $(srctree)/scripts/Makefile.headersinst obj=include BIASMDIR=-bi-$$arch ;\
          done
 
 PHONY += headers_install
-headers_install: generated_headers scripts_basic FORCE
+headers_install: include/linux/version.h scripts_basic FORCE
         @if [ ! -r $(srctree)/include/asm-$(ARCH)/Kbuild ]; then \
           echo '*** Error: Headers not exportable for this architecture ($(ARCH))'; \
           exit 1 ; fi
@@ -1040,7 +1026,8 @@ CLEAN_FILES +=	vmlinux System.map \
 # Directories & files removed with 'make mrproper'
 MRPROPER_DIRS  += include/config include2 usr/include
 MRPROPER_FILES += .config .config.old include/asm .version .old_version \
-                  include/linux/autoconf.h include/linux/utsrelease.h include/linux/version.h \
+                  include/linux/autoconf.h include/linux/version.h      \
+                  include/linux/utsrelease.h                            \
                   Module.symvers tags TAGS cscope*
 
 # clean - Delete most, but leave enough to build external modules
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 2db42b18f53f..8517c3c3eb33 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -436,7 +436,7 @@ __und_usr:
         usr_entry
 
         tst     r3, #PSR_T_BIT                  @ Thumb mode?
-        bne     fpundefinstr                    @ ignore FP
+        bne     __und_usr_unknown               @ ignore FP
         sub     r4, r2, #4
 
         @
@@ -448,7 +448,7 @@ __und_usr:
         @
 1:      ldrt    r0, [r4]
         adr     r9, ret_from_exception
-        adr     lr, fpundefinstr
+        adr     lr, __und_usr_unknown
         @
         @ fallthrough to call_fpe
         @
@@ -476,7 +476,9 @@ __und_usr:
  * Emulators may wish to make use of the following registers:
  *  r0  = instruction opcode.
  *  r2  = PC+4
+ *  r9  = normal "successful" return address
  *  r10 = this threads thread_info structure.
+ *  lr  = unrecognised instruction return address
  */
 call_fpe:
         tst     r0, #0x08000000                 @ only CDP/CPRT/LDC/STC have bit 27
@@ -545,10 +547,12 @@ do_fpe:
 
         .data
 ENTRY(fp_enter)
-        .word   fpundefinstr
+        .word   no_fp
         .text
 
-fpundefinstr:
+no_fp:  mov     pc, lr
+
+__und_usr_unknown:
         mov     r0, sp
         adr     lr, ret_from_exception
         b       do_undefinstr
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index 6ff5e3ff6cb5..3c8cdcfe8d4a 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -29,6 +29,8 @@
 #include <linux/timer.h>
 #include <linux/irq.h>
 
+#include <linux/mc146818rtc.h>
+
 #include <asm/leds.h>
 #include <asm/thread_info.h>
 #include <asm/mach/time.h>
@@ -85,6 +87,17 @@ unsigned long long __attribute__((weak)) sched_clock(void)
         return (unsigned long long)jiffies * (1000000000 / HZ);
 }
 
+/*
+ * An implementation of printk_clock() independent from
+ * sched_clock().  This avoids non-bootable kernels when
+ * printk_clock is enabled.
+ */
+unsigned long long printk_clock(void)
+{
+        return (unsigned long long)(jiffies - INITIAL_JIFFIES) *
+                        (1000000000 / HZ);
+}
+
 static unsigned long next_rtc_update;
 
 /*
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 042a12982e98..908915675edc 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -27,6 +27,7 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include <asm/traps.h>
+#include <asm/io.h>
 
 #include "ptrace.h"
 #include "signal.h"
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 628348c9f6c5..9df507d36e0b 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -202,3 +202,42 @@ void flush_dcache_page(struct page *page)
         }
 }
 EXPORT_SYMBOL(flush_dcache_page);
+
+/*
+ * Flush an anonymous page so that users of get_user_pages()
+ * can safely access the data.  The expected sequence is:
+ *
+ *  get_user_pages()
+ *    -> flush_anon_page
+ *  memcpy() to/from page
+ *  if written to page, flush_dcache_page()
+ */
+void __flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
+{
+        unsigned long pfn;
+
+        /* VIPT non-aliasing caches need do nothing */
+        if (cache_is_vipt_nonaliasing())
+                return;
+
+        /*
+         * Write back and invalidate userspace mapping.
+         */
+        pfn = page_to_pfn(page);
+        if (cache_is_vivt()) {
+                flush_cache_page(vma, vmaddr, pfn);
+        } else {
+                /*
+                 * For aliasing VIPT, we can flush an alias of the
+                 * userspace address only.
+                 */
+                flush_pfn_alias(pfn, vmaddr);
+        }
+
+        /*
+         * Invalidate kernel mapping.  No data should be contained
+         * in this mapping of the page.  FIXME: this is overkill
+         * since we actually ask for a write-back and invalidate.
+         */
+        __cpuc_flush_dcache_page(page_address(page));
+}
diff --git a/arch/mips/au1000/common/pci.c b/arch/mips/au1000/common/pci.c
index da591f674893..9f8ce08e173b 100644
--- a/arch/mips/au1000/common/pci.c
+++ b/arch/mips/au1000/common/pci.c
@@ -39,15 +39,15 @@
 
 /* TBD */
 static struct resource pci_io_resource = {
-        .start  = PCI_IO_START,
-        .end    = PCI_IO_END,
+        .start  = (resource_size_t)PCI_IO_START,
+        .end    = (resource_size_t)PCI_IO_END,
         .name   = "PCI IO space",
         .flags  = IORESOURCE_IO
 };
 
 static struct resource pci_mem_resource = {
-        .start  = PCI_MEM_START,
-        .end    = PCI_MEM_END,
+        .start  = (resource_size_t)PCI_MEM_START,
+        .end    = (resource_size_t)PCI_MEM_END,
         .name   = "PCI memory space",
         .flags  = IORESOURCE_MEM
 };
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index b061c9aa6302..de3fae260ff8 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -440,14 +440,26 @@ sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 }
 
 #ifdef CONFIG_MIPS32_N32
-asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, union semun arg)
+asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
 {
         /* compat_sys_semctl expects a pointer to union semun */
         u32 __user *uptr = compat_alloc_user_space(sizeof(u32));
-        if (put_user(ptr_to_compat(arg.__pad), uptr))
+        if (put_user(arg, uptr))
                 return -EFAULT;
         return compat_sys_semctl(semid, semnum, cmd, uptr);
 }
+
+asmlinkage long sysn32_msgsnd(int msqid, u32 msgp, unsigned msgsz, int msgflg)
+{
+        return compat_sys_msgsnd(msqid, msgsz, msgflg, compat_ptr(msgp));
+}
+
+asmlinkage long sysn32_msgrcv(int msqid, u32 msgp, size_t msgsz, int msgtyp,
+                              int msgflg)
+{
+        return compat_sys_msgrcv(msqid, msgsz, msgtyp, msgflg, IPC_64,
+                                 compat_ptr(msgp));
+}
 #endif
 
 struct sysctl_args32
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index f44a01357ada..2ef857c3ee53 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -46,5 +46,7 @@ EXPORT_SYMBOL(__strnlen_user_nocheck_asm);
 EXPORT_SYMBOL(__strnlen_user_asm);
 
 EXPORT_SYMBOL(csum_partial);
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
+EXPORT_SYMBOL(__csum_partial_copy_user);
 
 EXPORT_SYMBOL(invalid_pte_table);
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 34567d81f940..a7bff2a54723 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -187,8 +187,8 @@ EXPORT(sysn32_call_table)
         PTR     sysn32_semctl
         PTR     sys_shmdt                       /* 6065 */
         PTR     sys_msgget
-        PTR     compat_sys_msgsnd
-        PTR     compat_sys_msgrcv
+        PTR     sysn32_msgsnd
+        PTR     sysn32_msgrcv
         PTR     compat_sys_msgctl
         PTR     compat_sys_fcntl                /* 6070 */
         PTR     sys_flock
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index 11aab6d6bfe5..8aa544f73a5e 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -94,10 +94,8 @@ static void c0_timer_ack(void)
 {
         unsigned int count;
 
-#ifndef CONFIG_SOC_PNX8550      /* pnx8550 resets to zero */
         /* Ack this timer interrupt and set the next one.  */
         expirelo += cycles_per_jiffy;
-#endif
         write_c0_compare(expirelo);
 
         /* Check to see if we have missed any timer interrupts.  */
diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile
index 888b61ea12fe..989c900b8b14 100644
--- a/arch/mips/lib/Makefile
+++ b/arch/mips/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for MIPS-specific library files..
 #
 
-lib-y   += csum_partial.o csum_partial_copy.o memcpy.o promlib.o \
+lib-y   += csum_partial.o memcpy.o promlib.o \
            strlen_user.o strncpy_user.o strnlen_user.o uncached.o
 
 obj-y   += iomap.o
diff --git a/arch/mips/lib/csum_partial.S b/arch/mips/lib/csum_partial.S
index 9db357294be1..c0a77fe038be 100644
--- a/arch/mips/lib/csum_partial.S
+++ b/arch/mips/lib/csum_partial.S
@@ -8,7 +8,9 @@
  * Copyright (C) 1998, 1999 Ralf Baechle
  * Copyright (C) 1999 Silicon Graphics, Inc.
  */
+#include <linux/errno.h>
 #include <asm/asm.h>
+#include <asm/asm-offsets.h>
 #include <asm/regdef.h>
 
 #ifdef CONFIG_64BIT
@@ -271,3 +273,443 @@ small_csumcpy:
         jr      ra
         .set    noreorder
         END(csum_partial)
+
+
+/*
+ * checksum and copy routines based on memcpy.S
+ *
+ *      csum_partial_copy_nocheck(src, dst, len, sum)
+ *      __csum_partial_copy_user(src, dst, len, sum, errp)
+ *
+ * See "Spec" in memcpy.S for details.  Unlike __copy_user, all
+ * function in this file use the standard calling convention.
+ */
+
+#define src a0
+#define dst a1
+#define len a2
+#define psum a3
+#define sum v0
+#define odd t8
+#define errptr t9
+
+/*
+ * The exception handler for loads requires that:
+ *  1- AT contain the address of the byte just past the end of the source
+ *     of the copy,
+ *  2- src_entry <= src < AT, and
+ *  3- (dst - src) == (dst_entry - src_entry),
+ * The _entry suffix denotes values when __copy_user was called.
+ *
+ * (1) is set up up by __csum_partial_copy_from_user and maintained by
+ *      not writing AT in __csum_partial_copy
+ * (2) is met by incrementing src by the number of bytes copied
+ * (3) is met by not doing loads between a pair of increments of dst and src
+ *
+ * The exception handlers for stores stores -EFAULT to errptr and return.
+ * These handlers do not need to overwrite any data.
+ */
+
+#define EXC(inst_reg,addr,handler)              \
+9:      inst_reg, addr;                         \
+        .section __ex_table,"a";                \
+        PTR     9b, handler;                    \
+        .previous
+
+#ifdef USE_DOUBLE
+
+#define LOAD   ld
+#define LOADL  ldl
+#define LOADR  ldr
+#define STOREL sdl
+#define STORER sdr
+#define STORE  sd
+#define ADD    daddu
+#define SUB    dsubu
+#define SRL    dsrl
+#define SLL    dsll
+#define SLLV   dsllv
+#define SRLV   dsrlv
+#define NBYTES 8
+#define LOG_NBYTES 3
+
+#else
+
+#define LOAD   lw
+#define LOADL  lwl
+#define LOADR  lwr
+#define STOREL swl
+#define STORER swr
+#define STORE  sw
+#define ADD    addu
+#define SUB    subu
+#define SRL    srl
+#define SLL    sll
+#define SLLV   sllv
+#define SRLV   srlv
+#define NBYTES 4
+#define LOG_NBYTES 2
+
+#endif /* USE_DOUBLE */
+
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+#define LDFIRST LOADR
+#define LDREST  LOADL
+#define STFIRST STORER
+#define STREST  STOREL
+#define SHIFT_DISCARD SLLV
+#define SHIFT_DISCARD_REVERT SRLV
+#else
+#define LDFIRST LOADL
+#define LDREST  LOADR
+#define STFIRST STOREL
+#define STREST  STORER
+#define SHIFT_DISCARD SRLV
+#define SHIFT_DISCARD_REVERT SLLV
+#endif
+
+#define FIRST(unit) ((unit)*NBYTES)
+#define REST(unit)  (FIRST(unit)+NBYTES-1)
+
+#define ADDRMASK (NBYTES-1)
+
+        .set    noat
+
+LEAF(__csum_partial_copy_user)
+        PTR_ADDU        AT, src, len    /* See (1) above. */
+#ifdef CONFIG_64BIT
+        move    errptr, a4
+#else
+        lw      errptr, 16(sp)
+#endif
+FEXPORT(csum_partial_copy_nocheck)
+        move    sum, zero
+        move    odd, zero
+        /*
+         * Note: dst & src may be unaligned, len may be 0
+         * Temps
+         */
+        /*
+         * The "issue break"s below are very approximate.
+         * Issue delays for dcache fills will perturb the schedule, as will
+         * load queue full replay traps, etc.
+         *
+         * If len < NBYTES use byte operations.
+         */
+        sltu    t2, len, NBYTES
+        and     t1, dst, ADDRMASK
+        bnez    t2, copy_bytes_checklen
+         and    t0, src, ADDRMASK
+        andi    odd, dst, 0x1                   /* odd buffer? */
+        bnez    t1, dst_unaligned
+         nop
+        bnez    t0, src_unaligned_dst_aligned
+        /*
+         * use delay slot for fall-through
+         * src and dst are aligned; need to compute rem
+         */
+both_aligned:
+         SRL    t0, len, LOG_NBYTES+3    # +3 for 8 units/iter
+        beqz    t0, cleanup_both_aligned # len < 8*NBYTES
+         nop
+        SUB     len, 8*NBYTES           # subtract here for bgez loop
+        .align  4
+1:
+EXC(    LOAD    t0, UNIT(0)(src),       l_exc)
+EXC(    LOAD    t1, UNIT(1)(src),       l_exc_copy)
+EXC(    LOAD    t2, UNIT(2)(src),       l_exc_copy)
+EXC(    LOAD    t3, UNIT(3)(src),       l_exc_copy)
+EXC(    LOAD    t4, UNIT(4)(src),       l_exc_copy)
+EXC(    LOAD    t5, UNIT(5)(src),       l_exc_copy)
+EXC(    LOAD    t6, UNIT(6)(src),       l_exc_copy)
+EXC(    LOAD    t7, UNIT(7)(src),       l_exc_copy)
+        SUB     len, len, 8*NBYTES
+        ADD     src, src, 8*NBYTES
+EXC(    STORE   t0, UNIT(0)(dst),       s_exc)
+        ADDC(sum, t0)
+EXC(    STORE   t1, UNIT(1)(dst),       s_exc)
+        ADDC(sum, t1)
+EXC(    STORE   t2, UNIT(2)(dst),       s_exc)
+        ADDC(sum, t2)
+EXC(    STORE   t3, UNIT(3)(dst),       s_exc)
+        ADDC(sum, t3)
+EXC(    STORE   t4, UNIT(4)(dst),       s_exc)
+        ADDC(sum, t4)
+EXC(    STORE   t5, UNIT(5)(dst),       s_exc)
+        ADDC(sum, t5)
+EXC(    STORE   t6, UNIT(6)(dst),       s_exc)
+        ADDC(sum, t6)
+EXC(    STORE   t7, UNIT(7)(dst),       s_exc)
+        ADDC(sum, t7)
+        bgez    len, 1b
+         ADD    dst, dst, 8*NBYTES
+        ADD     len, 8*NBYTES           # revert len (see above)
+
+        /*
+         * len == the number of bytes left to copy < 8*NBYTES
+         */
+cleanup_both_aligned:
+#define rem t7
+        beqz    len, done
+         sltu   t0, len, 4*NBYTES
+        bnez    t0, less_than_4units
+         and    rem, len, (NBYTES-1)    # rem = len % NBYTES
+        /*
+         * len >= 4*NBYTES
+         */
+EXC(    LOAD    t0, UNIT(0)(src),       l_exc)
+EXC(    LOAD    t1, UNIT(1)(src),       l_exc_copy)
+EXC(    LOAD    t2, UNIT(2)(src),       l_exc_copy)
+EXC(    LOAD    t3, UNIT(3)(src),       l_exc_copy)
+        SUB     len, len, 4*NBYTES
+        ADD     src, src, 4*NBYTES
+EXC(    STORE   t0, UNIT(0)(dst),       s_exc)
+        ADDC(sum, t0)
+EXC(    STORE   t1, UNIT(1)(dst),       s_exc)
+        ADDC(sum, t1)
+EXC(    STORE   t2, UNIT(2)(dst),       s_exc)
+        ADDC(sum, t2)
+EXC(    STORE   t3, UNIT(3)(dst),       s_exc)
+        ADDC(sum, t3)
+        beqz    len, done
+         ADD    dst, dst, 4*NBYTES
+less_than_4units:
+        /*
+         * rem = len % NBYTES
+         */
+        beq     rem, len, copy_bytes
+         nop
+1:
+EXC(    LOAD    t0, 0(src),             l_exc)
+        ADD     src, src, NBYTES
+        SUB     len, len, NBYTES
+EXC(    STORE   t0, 0(dst),             s_exc)
+        ADDC(sum, t0)
+        bne     rem, len, 1b
+         ADD    dst, dst, NBYTES
+
+        /*
+         * src and dst are aligned, need to copy rem bytes (rem < NBYTES)
+         * A loop would do only a byte at a time with possible branch
+         * mispredicts.  Can't do an explicit LOAD dst,mask,or,STORE
+         * because can't assume read-access to dst.  Instead, use
+         * STREST dst, which doesn't require read access to dst.
+         *
+         * This code should perform better than a simple loop on modern,
+         * wide-issue mips processors because the code has fewer branches and
+         * more instruction-level parallelism.
+         */
+#define bits t2
+        beqz    len, done
+         ADD    t1, dst, len    # t1 is just past last byte of dst
+        li      bits, 8*NBYTES
+        SLL     rem, len, 3     # rem = number of bits to keep
+EXC(    LOAD    t0, 0(src),             l_exc)
+        SUB     bits, bits, rem # bits = number of bits to discard
+        SHIFT_DISCARD t0, t0, bits
+EXC(    STREST  t0, -1(t1),             s_exc)
+        SHIFT_DISCARD_REVERT t0, t0, bits
+        .set reorder
+        ADDC(sum, t0)
+        b       done
+        .set noreorder
+dst_unaligned:
+        /*
+         * dst is unaligned
+         * t0 = src & ADDRMASK
+         * t1 = dst & ADDRMASK; T1 > 0
+         * len >= NBYTES
+         *
+         * Copy enough bytes to align dst
+         * Set match = (src and dst have same alignment)
+         */
+#define match rem
+EXC(    LDFIRST t3, FIRST(0)(src),      l_exc)
+        ADD     t2, zero, NBYTES
+EXC(    LDREST  t3, REST(0)(src),       l_exc_copy)
+        SUB     t2, t2, t1      # t2 = number of bytes copied
+        xor     match, t0, t1
+EXC(    STFIRST t3, FIRST(0)(dst),      s_exc)
+        SLL     t4, t1, 3               # t4 = number of bits to discard
+        SHIFT_DISCARD t3, t3, t4
+        /* no SHIFT_DISCARD_REVERT to handle odd buffer properly */
+        ADDC(sum, t3)
+        beq     len, t2, done
+         SUB    len, len, t2
+        ADD     dst, dst, t2
+        beqz    match, both_aligned
+         ADD    src, src, t2
+
+src_unaligned_dst_aligned:
+        SRL     t0, len, LOG_NBYTES+2    # +2 for 4 units/iter
+        beqz    t0, cleanup_src_unaligned
+         and    rem, len, (4*NBYTES-1)   # rem = len % 4*NBYTES
+1:
+/*
+ * Avoid consecutive LD*'s to the same register since some mips
+ * implementations can't issue them in the same cycle.
+ * It's OK to load FIRST(N+1) before REST(N) because the two addresses
+ * are to the same unit (unless src is aligned, but it's not).
+ */
+EXC(    LDFIRST t0, FIRST(0)(src),      l_exc)
+EXC(    LDFIRST t1, FIRST(1)(src),      l_exc_copy)
+        SUB     len, len, 4*NBYTES
+EXC(    LDREST  t0, REST(0)(src),       l_exc_copy)
+EXC(    LDREST  t1, REST(1)(src),       l_exc_copy)
+EXC(    LDFIRST t2, FIRST(2)(src),      l_exc_copy)
+EXC(    LDFIRST t3, FIRST(3)(src),      l_exc_copy)
+EXC(    LDREST  t2, REST(2)(src),       l_exc_copy)
+EXC(    LDREST  t3, REST(3)(src),       l_exc_copy)
+        ADD     src, src, 4*NBYTES
+#ifdef CONFIG_CPU_SB1
+        nop                             # improves slotting
+#endif
+EXC(    STORE   t0, UNIT(0)(dst),       s_exc)
+        ADDC(sum, t0)
+EXC(    STORE   t1, UNIT(1)(dst),       s_exc)
+        ADDC(sum, t1)
+EXC(    STORE   t2, UNIT(2)(dst),       s_exc)
+        ADDC(sum, t2)
+EXC(    STORE   t3, UNIT(3)(dst),       s_exc)
+        ADDC(sum, t3)
+        bne     len, rem, 1b
+         ADD    dst, dst, 4*NBYTES
+
+cleanup_src_unaligned:
+        beqz    len, done
+         and    rem, len, NBYTES-1  # rem = len % NBYTES
+        beq     rem, len, copy_bytes
+         nop
+1:
+EXC(    LDFIRST t0, FIRST(0)(src),      l_exc)
+EXC(    LDREST  t0, REST(0)(src),       l_exc_copy)
+        ADD     src, src, NBYTES
+        SUB     len, len, NBYTES
+EXC(    STORE   t0, 0(dst),             s_exc)
+        ADDC(sum, t0)
+        bne     len, rem, 1b
+         ADD    dst, dst, NBYTES
+
+copy_bytes_checklen:
+        beqz    len, done
+         nop
+copy_bytes:
+        /* 0 < len < NBYTES  */
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+#define SHIFT_START 0
+#define SHIFT_INC 8
+#else
+#define SHIFT_START 8*(NBYTES-1)
+#define SHIFT_INC -8
+#endif
+        move    t2, zero        # partial word
+        li      t3, SHIFT_START # shift
+/* use l_exc_copy here to return correct sum on fault */
+#define COPY_BYTE(N)                    \
+EXC(    lbu     t0, N(src), l_exc_copy);        \
+        SUB     len, len, 1;            \
+EXC(    sb      t0, N(dst), s_exc);     \
+        SLLV    t0, t0, t3;             \
+        addu    t3, SHIFT_INC;          \
+        beqz    len, copy_bytes_done;   \
+         or     t2, t0
+
+        COPY_BYTE(0)
+        COPY_BYTE(1)
+#ifdef USE_DOUBLE
+        COPY_BYTE(2)
+        COPY_BYTE(3)
+        COPY_BYTE(4)
+        COPY_BYTE(5)
+#endif
+EXC(    lbu     t0, NBYTES-2(src), l_exc_copy)
+        SUB     len, len, 1
+EXC(    sb      t0, NBYTES-2(dst), s_exc)
+        SLLV    t0, t0, t3
+        or      t2, t0
+copy_bytes_done:
+        ADDC(sum, t2)
+done:
+        /* fold checksum */
+#ifdef USE_DOUBLE
+        dsll32  v1, sum, 0
+        daddu   sum, v1
+        sltu    v1, sum, v1
+        dsra32  sum, sum, 0
+        addu    sum, v1
+#endif
+        sll     v1, sum, 16
+        addu    sum, v1
+        sltu    v1, sum, v1
+        srl     sum, sum, 16
+        addu    sum, v1
+
+        /* odd buffer alignment? */
+        beqz    odd, 1f
+         nop
+        sll     v1, sum, 8
+        srl     sum, sum, 8
+        or      sum, v1
+        andi    sum, 0xffff
+1:
+        .set reorder
+        ADDC(sum, psum)
+        jr      ra
+        .set noreorder
+
+l_exc_copy:
+        /*
+         * Copy bytes from src until faulting load address (or until a
+         * lb faults)
+         *
+         * When reached by a faulting LDFIRST/LDREST, THREAD_BUADDR($28)
+         * may be more than a byte beyond the last address.
+         * Hence, the lb below may get an exception.
+         *
+         * Assumes src < THREAD_BUADDR($28)
+         */
+        LOAD    t0, TI_TASK($28)
+         li     t2, SHIFT_START
+        LOAD    t0, THREAD_BUADDR(t0)
+1:
+EXC(    lbu     t1, 0(src),     l_exc)
+        ADD     src, src, 1
+        sb      t1, 0(dst)      # can't fault -- we're copy_from_user
+        SLLV    t1, t1, t2
+        addu    t2, SHIFT_INC
+        ADDC(sum, t1)
+        bne     src, t0, 1b
+         ADD    dst, dst, 1
+l_exc:
+        LOAD    t0, TI_TASK($28)
+         nop
+        LOAD    t0, THREAD_BUADDR(t0)   # t0 is just past last good address
+         nop
+        SUB     len, AT, t0             # len number of uncopied bytes
+        /*
+         * Here's where we rely on src and dst being incremented in tandem,
+         *   See (3) above.
+         * dst += (fault addr - src) to put dst at first byte to clear
+         */
+        ADD     dst, t0                 # compute start address in a1
+        SUB     dst, src
+        /*
+         * Clear len bytes starting at dst.  Can't call __bzero because it
+         * might modify len.  An inefficient loop for these rare times...
+         */
+        beqz    len, done
+         SUB    src, len, 1
+1:      sb      zero, 0(dst)
+        ADD     dst, dst, 1
+        bnez    src, 1b
+         SUB    src, src, 1
+        li      v1, -EFAULT
+        b       done
+         sw     v1, (errptr)
+
+s_exc:
+        li      v0, -1 /* invalid checksum */
+        li      v1, -EFAULT
+        jr      ra
+         sw     v1, (errptr)
+        END(__csum_partial_copy_user)
diff --git a/arch/mips/lib/csum_partial_copy.c b/arch/mips/lib/csum_partial_copy.c
deleted file mode 100644
index 06771040a267..000000000000
--- a/arch/mips/lib/csum_partial_copy.c
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 1994, 1995 Waldorf Electronics GmbH
- * Copyright (C) 1998, 1999 Ralf Baechle
- */
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <asm/byteorder.h>
-#include <asm/string.h>
-#include <asm/uaccess.h>
-#include <net/checksum.h>
-
-/*
- * copy while checksumming, otherwise like csum_partial
- */
-__wsum csum_partial_copy_nocheck(const void *src,
-        void *dst, int len, __wsum sum)
-{
-        /*
-         * It's 2:30 am and I don't feel like doing it real ...
-         * This is lots slower than the real thing (tm)
-         */
-        sum = csum_partial(src, len, sum);
-        memcpy(dst, src, len);
-
-        return sum;
-}
-
-EXPORT_SYMBOL(csum_partial_copy_nocheck);
-
-/*
- * Copy from userspace and compute checksum.  If we catch an exception
- * then zero the rest of the buffer.
- */
-__wsum csum_partial_copy_from_user (const void __user *src,
-        void *dst, int len, __wsum sum, int *err_ptr)
-{
-        int missing;
-
-        might_sleep();
-        missing = copy_from_user(dst, src, len);
-        if (missing) {
-                memset(dst + len - missing, 0, missing);
-                *err_ptr = -EFAULT;
-        }
-
-        return csum_partial(dst, len, sum);
-}
diff --git a/arch/mips/mips-boards/generic/time.c b/arch/mips/mips-boards/generic/time.c
index e4604c73f02e..a3c3a1d462b2 100644
--- a/arch/mips/mips-boards/generic/time.c
+++ b/arch/mips/mips-boards/generic/time.c
@@ -47,6 +47,9 @@
 #ifdef CONFIG_MIPS_MALTA
 #include <asm/mips-boards/maltaint.h>
 #endif
+#ifdef CONFIG_MIPS_SEAD
+#include <asm/mips-boards/seadint.h>
+#endif
 
 unsigned long cpu_khz;
 
@@ -263,11 +266,13 @@ void __init mips_time_init(void)
 
 void __init plat_timer_setup(struct irqaction *irq)
 {
+#ifdef MSC01E_INT_BASE
         if (cpu_has_veic) {
                 set_vi_handler (MSC01E_INT_CPUCTR, mips_timer_dispatch);
                 mips_cpu_timer_irq = MSC01E_INT_BASE + MSC01E_INT_CPUCTR;
-        }
-        else {
+        } else
+#endif
+        {
                 if (cpu_has_vint)
                         set_vi_handler (MIPSCPU_INT_CPUCTR, mips_timer_dispatch);
                 mips_cpu_timer_irq = MIPSCPU_INT_BASE + MIPSCPU_INT_CPUCTR;
diff --git a/arch/mips/mips-boards/malta/malta_mtd.c b/arch/mips/mips-boards/malta/malta_mtd.c
new file mode 100644
index 000000000000..8ad9bdf25dce
--- /dev/null
+++ b/arch/mips/mips-boards/malta/malta_mtd.c
@@ -0,0 +1,63 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2006 MIPS Technologies, Inc.
+ *     written by Ralf Baechle <ralf@linux-mips.org>
+ */
+
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/physmap.h>
+#include <mtd/mtd-abi.h>
+
+static struct mtd_partition malta_mtd_partitions[] = {
+        {
+                .name =         "YAMON",
+                .offset =       0x0,
+                .size =         0x100000,
+                .mask_flags =   MTD_WRITEABLE
+        }, {
+                .name =         "User FS",
+                .offset =       0x100000,
+                .size =         0x2e0000
+        }, {
+                .name =         "Board Config",
+                .offset =       0x3e0000,
+                .size =         0x020000,
+                .mask_flags =   MTD_WRITEABLE
+        }
+};
+
+static struct physmap_flash_data malta_flash_data = {
+        .width          = 4,
+        .nr_parts       = ARRAY_SIZE(malta_mtd_partitions),
+        .parts          = malta_mtd_partitions
+};
+
+static struct resource malta_flash_resource = {
+        .start          = 0x1e000000,
+        .end            = 0x1e3fffff,
+        .flags          = IORESOURCE_MEM
+};
+
+static struct platform_device malta_flash = {
+        .name           = "physmap-flash",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &malta_flash_data,
+        },
+        .num_resources  = 1,
+        .resource       = &malta_flash_resource,
+};
+
+static int __init malta_mtd_init(void)
+{
+        platform_device_register(&malta_flash);
+
+        return 0;
+}
+
+module_init(malta_mtd_init)
diff --git a/arch/mips/mips-boards/sead/sead_int.c b/arch/mips/mips-boards/sead/sead_int.c
index f445fcddfdfd..874ccb0066b8 100644
--- a/arch/mips/mips-boards/sead/sead_int.c
+++ b/arch/mips/mips-boards/sead/sead_int.c
@@ -21,7 +21,7 @@
  * Sead board.
  */
 #include <linux/init.h>
-#include <linux/irq.h>
+#include <linux/interrupt.h>
 
 #include <asm/irq_cpu.h>
 #include <asm/mipsregs.h>
@@ -108,7 +108,7 @@ asmlinkage void plat_irq_dispatch(void)
         if (irq >= 0)
                 do_IRQ(MIPSCPU_INT_BASE + irq);
         else
-                spurious_interrupt(regs);
+                spurious_interrupt();
 }
 
 void __init arch_init_irq(void)
diff --git a/arch/mips/mm/pg-r4k.c b/arch/mips/mm/pg-r4k.c
index d41fc5885e87..dc795be62807 100644
--- a/arch/mips/mm/pg-r4k.c
+++ b/arch/mips/mm/pg-r4k.c
@@ -243,11 +243,10 @@ static void __init __build_store_reg(int reg)
 
 static inline void build_store_reg(int reg)
 {
-        if (cpu_has_prefetch)
-                if (reg)
-                        build_dst_pref(pref_offset_copy);
-                else
-                        build_dst_pref(pref_offset_clear);
+        int pref_off = cpu_has_prefetch ?
+                (reg ? pref_offset_copy : pref_offset_clear) : 0;
+        if (pref_off)
+                build_dst_pref(pref_off);
         else if (cpu_has_cache_cdex_s)
                 build_cdex_s();
         else if (cpu_has_cache_cdex_p)
diff --git a/arch/mips/pci/ops-pnx8550.c b/arch/mips/pci/ops-pnx8550.c
index 454b65cc3354..f556b7a8dccd 100644
--- a/arch/mips/pci/ops-pnx8550.c
+++ b/arch/mips/pci/ops-pnx8550.c
@@ -202,7 +202,7 @@ write_config_byte(struct pci_bus *bus, unsigned int devfn, int where, u8 val)
                 break;
         }
 
-        err = config_access(PCI_CMD_CONFIG_READ, bus, devfn, where, ~(1 << (where & 3)), &data);
+        err = config_access(PCI_CMD_CONFIG_WRITE, bus, devfn, where, ~(1 << (where & 3)), &data);
 
         return err;
 }
diff --git a/arch/mips/philips/pnx8550/common/time.c b/arch/mips/philips/pnx8550/common/time.c
index 65c440e8480b..68def3880a1c 100644
--- a/arch/mips/philips/pnx8550/common/time.c
+++ b/arch/mips/philips/pnx8550/common/time.c
@@ -33,7 +33,17 @@
 #include <int.h>
 #include <cm.h>
 
-extern unsigned int mips_hpt_frequency;
+static unsigned long cpj;
+
+static cycle_t hpt_read(void)
+{
+        return read_c0_count2();
+}
+
+static void timer_ack(void)
+{
+        write_c0_compare(cpj);
+}
 
 /*
  * pnx8550_time_init() - it does the following things:
@@ -68,27 +78,48 @@ void pnx8550_time_init(void)
          * HZ timer interrupts per second.
          */
         mips_hpt_frequency = 27UL * ((1000000UL * n)/(m * pow2p));
+        cpj = (mips_hpt_frequency + HZ / 2) / HZ;
+        write_c0_count(0);
+        timer_ack();
+
+        /* Setup Timer 2 */
+        write_c0_count2(0);
+        write_c0_compare2(0xffffffff);
+
+        clocksource_mips.read = hpt_read;
+        mips_timer_ack = timer_ack;
+}
+
+static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
+{
+        /* Timer 2 clear interrupt */
+        write_c0_compare2(-1);
+        return IRQ_HANDLED;
 }
 
+static struct irqaction monotonic_irqaction = {
+        .handler = monotonic_interrupt,
+        .flags = IRQF_DISABLED,
+        .name = "Monotonic timer",
+};
+
 void __init plat_timer_setup(struct irqaction *irq)
 {
         int configPR;
 
         setup_irq(PNX8550_INT_TIMER1, irq);
+        setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
 
-        /* Start timer1 */
+        /* Timer 1 start */
         configPR = read_c0_config7();
         configPR &= ~0x00000008;
         write_c0_config7(configPR);
 
-        /* Timer 2 stop */
+        /* Timer 2 start */
         configPR = read_c0_config7();
-        configPR |= 0x00000010;
+        configPR &= ~0x00000010;
         write_c0_config7(configPR);
 
-        write_c0_count2(0);
-        write_c0_compare2(0xffffffff);
-
         /* Timer 3 stop */
         configPR = read_c0_config7();
         configPR |= 0x00000020;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 8699dadcd096..0855d55c194d 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -436,7 +436,7 @@ config PPC_EFIKA
         select RTAS_PROC
         select PPC_MPC52xx
         select PPC_NATIVE
-        default y
+        default n
 
 config PPC_LITE5200
         bool "Freescale Lite5200 Eval Board"
@@ -471,7 +471,7 @@ config PPC_PREP
         select PPC_INDIRECT_PCI
         select PPC_UDBG_16550
         select PPC_NATIVE
-        default y
+        default n
 
 config PPC_MAPLE
         depends on PPC_MULTIPLATFORM && PPC64
diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts
index 8bc0d259796d..a8efb59f5dd7 100644
--- a/arch/powerpc/boot/dts/lite5200.dts
+++ b/arch/powerpc/boot/dts/lite5200.dts
@@ -238,7 +238,7 @@
 
                 // PSC3 in CODEC mode example
                 i2s@2400 {              // PSC3
-                        device_type = "i2s";
+                        device_type = "sound";
                         compatible = "mpc5200-psc-i2s\0mpc52xx-psc-i2s";
                         reg = <2400 100>;
                         interrupts = <2 3 0>;
@@ -265,7 +265,7 @@
 
                 // PSC6 in AC97 mode example
                 ac97@2c00 {             // PSC6
-                        device_type = "ac97";
+                        device_type = "sound";
                         compatible = "mpc5200-psc-ac97\0mpc52xx-psc-ac97";
                         reg = <2c00 100>;
                         interrupts = <2 4 0>;
diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts
index 81cb76418a78..1aabee432d86 100644
--- a/arch/powerpc/boot/dts/lite5200b.dts
+++ b/arch/powerpc/boot/dts/lite5200b.dts
@@ -243,7 +243,7 @@
 
                 // PSC3 in CODEC mode example
                 i2s@2400 {              // PSC3
-                        device_type = "i2s";
+                        device_type = "sound";
                         compatible = "mpc5200b-psc-i2s\0mpc52xx-psc-i2s";
                         reg = <2400 100>;
                         interrupts = <2 3 0>;
@@ -270,7 +270,7 @@
 
                 // PSC6 in AC97 mode example
                 ac97@2c00 {             // PSC6
-                        device_type = "ac97";
+                        device_type = "sound";
                         compatible = "mpc5200b-psc-ac97\0mpc52xx-psc-ac97";
                         reg = <2c00 100>;
                         interrupts = <2 4 0>;
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 1c009651f925..340376a47001 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc6
-# Sun Sep 10 10:45:11 2006
+# Linux kernel version: 2.6.20-rc3
+# Tue Jan  2 15:32:44 2007
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -10,6 +10,8 @@ CONFIG_MMU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_IRQ_PER_CPU=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_ARCH_HAS_ILOG2_U32=y
+CONFIG_ARCH_HAS_ILOG2_U64=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
@@ -22,6 +24,8 @@ CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_PPC_UDBG_16550=y
 CONFIG_GENERIC_TBSYNC=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_GENERIC_BUG=y
 # CONFIG_DEFAULT_UIMAGE is not set
 
 #
@@ -31,6 +35,10 @@ CONFIG_GENERIC_TBSYNC=y
 CONFIG_POWER3=y
 CONFIG_POWER4=y
 CONFIG_PPC_FPU=y
+# CONFIG_PPC_DCR_NATIVE is not set
+CONFIG_PPC_DCR_MMIO=y
+CONFIG_PPC_DCR=y
+CONFIG_PPC_OF_PLATFORM_PCI=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
 CONFIG_VIRT_CPU_ACCOUNTING=y
@@ -52,19 +60,24 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
-CONFIG_SYSCTL=y
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
+CONFIG_SYSFS_DEPRECATED=y
 CONFIG_RELAY=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+# CONFIG_TASK_XACCT is not set
+CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
+CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -73,12 +86,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
-CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -97,6 +110,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 CONFIG_BLK_DEV_IO_TRACE=y
 
 #
@@ -116,16 +130,20 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # Platform support
 #
 CONFIG_PPC_MULTIPLATFORM=y
-# CONFIG_PPC_ISERIES is not set
 # CONFIG_EMBEDDED6xx is not set
 # CONFIG_APUS is not set
 CONFIG_PPC_PSERIES=y
+CONFIG_PPC_ISERIES=y
+# CONFIG_PPC_MPC52xx is not set
 CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 CONFIG_PPC_MAPLE=y
+# CONFIG_PPC_PASEMI is not set
 CONFIG_PPC_CELL=y
 CONFIG_PPC_CELL_NATIVE=y
 CONFIG_PPC_IBM_CELL_BLADE=y
+# CONFIG_PPC_PS3 is not set
+CONFIG_PPC_NATIVE=y
 CONFIG_UDBG_RTAS_CONSOLE=y
 CONFIG_XICS=y
 CONFIG_U3_DART=y
@@ -139,6 +157,8 @@ CONFIG_IBMVIO=y
 # CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
 CONFIG_PPC_970_NAP=y
+CONFIG_PPC_INDIRECT_IO=y
+CONFIG_GENERIC_IOMAP=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -160,14 +180,16 @@ CONFIG_MPIC=y
 #
 CONFIG_SPU_FS=m
 CONFIG_SPU_BASE=y
-CONFIG_SPUFS_MMAP=y
 CONFIG_CBE_RAS=y
+CONFIG_CBE_THERM=m
+CONFIG_CBE_CPUFREQ=m
 
 #
 # Kernel options
 #
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_PREEMPT_NONE=y
@@ -192,6 +214,7 @@ CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
 # CONFIG_FLATMEM_MANUAL is not set
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -201,6 +224,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_EXTREME=y
 CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTPLUG_SPARSE=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_RESOURCES_64BIT=y
 CONFIG_ARCH_MEMORY_PROBE=y
@@ -222,6 +246,7 @@ CONFIG_PPC_I8259=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 # CONFIG_PCIEPORTBUS is not set
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -254,6 +279,7 @@ CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 CONFIG_XFRM_USER=m
+# CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_NET_KEY=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -272,10 +298,13 @@ CONFIG_INET_XFRM_TUNNEL=m
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
 
 #
 # IP: Virtual Server Configuration
@@ -294,25 +323,31 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+CONFIG_NF_CONNTRACK_ENABLED=m
+CONFIG_NF_CONNTRACK_SUPPORT=y
+# CONFIG_IP_NF_CONNTRACK_SUPPORT is not set
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CT_ACCT=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CT_PROTO_GRE=m
+CONFIG_NF_CT_PROTO_SCTP=m
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
 # CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
 #
-CONFIG_IP_NF_CONNTRACK=m
-CONFIG_IP_NF_CT_ACCT=y
-CONFIG_IP_NF_CONNTRACK_MARK=y
-CONFIG_IP_NF_CONNTRACK_EVENTS=y
-CONFIG_IP_NF_CONNTRACK_NETLINK=m
-CONFIG_IP_NF_CT_PROTO_SCTP=m
-CONFIG_IP_NF_FTP=m
-CONFIG_IP_NF_IRC=m
-# CONFIG_IP_NF_NETBIOS_NS is not set
-CONFIG_IP_NF_TFTP=m
-CONFIG_IP_NF_AMANDA=m
-# CONFIG_IP_NF_PPTP is not set
-# CONFIG_IP_NF_H323 is not set
-CONFIG_IP_NF_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
 CONFIG_IP_NF_QUEUE=m
 
 #
@@ -339,7 +374,6 @@ CONFIG_LLC=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -412,6 +446,12 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
@@ -438,7 +478,6 @@ CONFIG_IDEPCI_SHARE_IRQ=y
 # CONFIG_BLK_DEV_OFFBOARD is not set
 CONFIG_BLK_DEV_GENERIC=y
 # CONFIG_BLK_DEV_OPTI621 is not set
-CONFIG_BLK_DEV_SL82C105=y
 CONFIG_BLK_DEV_IDEDMA_PCI=y
 # CONFIG_BLK_DEV_IDEDMA_FORCED is not set
 CONFIG_IDEDMA_PCI_AUTO=y
@@ -453,6 +492,7 @@ CONFIG_BLK_DEV_AMD74XX=y
 # CONFIG_BLK_DEV_CS5530 is not set
 # CONFIG_BLK_DEV_HPT34X is not set
 # CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
 # CONFIG_BLK_DEV_IT821X is not set
@@ -461,6 +501,7 @@ CONFIG_BLK_DEV_AMD74XX=y
 # CONFIG_BLK_DEV_PDC202XX_NEW is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
+CONFIG_BLK_DEV_SL82C105=y
 # CONFIG_BLK_DEV_SLC90E66 is not set
 # CONFIG_BLK_DEV_TRM290 is not set
 # CONFIG_BLK_DEV_VIA82CXXX is not set
@@ -478,6 +519,8 @@ CONFIG_IDEDMA_AUTO=y
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+# CONFIG_SCSI_TGT is not set
+CONFIG_SCSI_NETLINK=y
 CONFIG_SCSI_PROC_FS=y
 
 #
@@ -497,14 +540,16 @@ CONFIG_CHR_DEV_SG=y
 CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 # CONFIG_SCSI_LOGGING is not set
+# CONFIG_SCSI_SCAN_ASYNC is not set
 
 #
-# SCSI Transport Attributes
+# SCSI Transports
 #
 CONFIG_SCSI_SPI_ATTRS=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
 
 #
 # SCSI low-level drivers
@@ -517,26 +562,12 @@ CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_ARCMSR is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
-CONFIG_ATA=y
-# CONFIG_SATA_AHCI is not set
-CONFIG_SATA_SVW=y
-# CONFIG_SCSI_ATA_PIIX is not set
-# CONFIG_SATA_MV is not set
-# CONFIG_SATA_NV is not set
-# CONFIG_SCSI_PDC_ADMA is not set
 # CONFIG_SCSI_HPTIOP is not set
-# CONFIG_SATA_QSTOR is not set
-# CONFIG_SATA_PROMISE is not set
-# CONFIG_SATA_SX4 is not set
-# CONFIG_SATA_SIL is not set
-# CONFIG_SATA_SIL24 is not set
-# CONFIG_SATA_SIS is not set
-# CONFIG_SATA_ULI is not set
-# CONFIG_SATA_VIA is not set
-# CONFIG_SATA_VITESSE is not set
 # CONFIG_SCSI_BUSLOGIC is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_EATA is not set
@@ -546,6 +577,7 @@ CONFIG_SATA_SVW=y
 CONFIG_SCSI_IBMVSCSI=y
 # CONFIG_SCSI_INITIO is not set
 # CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_STEX is not set
 CONFIG_SCSI_SYM53C8XX_2=y
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=0
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
@@ -556,10 +588,66 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
 CONFIG_SCSI_DEBUG=m
+# CONFIG_SCSI_SRP is not set
+
+#
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+CONFIG_ATA=y
+# CONFIG_SATA_AHCI is not set
+CONFIG_SATA_SVW=y
+# CONFIG_ATA_PIIX is not set
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_MARVELL is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_PDC2027X is not set
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -575,6 +663,7 @@ CONFIG_MD_RAID5_RESHAPE=y
 CONFIG_MD_MULTIPATH=m
 CONFIG_MD_FAULTY=m
 CONFIG_BLK_DEV_DM=y
+# CONFIG_DM_DEBUG is not set
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
@@ -630,11 +719,13 @@ CONFIG_IEEE1394_RAWIO=y
 CONFIG_ADB_PMU=y
 # CONFIG_ADB_PMU_LED is not set
 CONFIG_PMAC_SMU=y
+# CONFIG_MAC_EMUMOUSEBTN is not set
 CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
 CONFIG_WINDFARM_PM112=y
+# CONFIG_PMAC_RACKMETER is not set
 
 #
 # Network device support
@@ -675,6 +766,7 @@ CONFIG_VORTEX=y
 CONFIG_IBMVETH=m
 CONFIG_NET_PCI=y
 CONFIG_PCNET32=y
+# CONFIG_PCNET32_NAPI is not set
 # CONFIG_AMD8111_ETH is not set
 # CONFIG_ADAPTEC_STARFIRE is not set
 # CONFIG_B44 is not set
@@ -713,7 +805,7 @@ CONFIG_E1000=y
 CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
 CONFIG_SPIDER_NET=m
-# CONFIG_MV643XX_ETH is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
@@ -723,6 +815,7 @@ CONFIG_IXGB=m
 # CONFIG_IXGB_NAPI is not set
 # CONFIG_S2IO is not set
 # CONFIG_MYRI10GE is not set
+# CONFIG_NETXEN_NIC is not set
 
 #
 # Token Ring devices
@@ -741,6 +834,7 @@ CONFIG_IBMOL=y
 # Wan interfaces
 #
 # CONFIG_WAN is not set
+CONFIG_ISERIES_VETH=m
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
 CONFIG_PPP=m
@@ -753,6 +847,7 @@ CONFIG_PPP_BSDCOMP=m
 # CONFIG_PPP_MPPE is not set
 CONFIG_PPPOE=m
 # CONFIG_SLIP is not set
+CONFIG_SLHC=m
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 CONFIG_NETCONSOLE=y
@@ -775,6 +870,7 @@ CONFIG_NET_POLL_CONTROLLER=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -797,6 +893,7 @@ CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_SERIAL is not set
@@ -850,6 +947,7 @@ CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_HVC_DRIVER=y
 CONFIG_HVC_CONSOLE=y
+CONFIG_HVC_ISERIES=y
 CONFIG_HVC_RTAS=y
 CONFIG_HVCS=m
 
@@ -868,10 +966,6 @@ CONFIG_GEN_RTC=y
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
-
-#
-# Ftape, the floppy tape device driver
-#
 # CONFIG_AGP is not set
 # CONFIG_DRM is not set
 CONFIG_RAW_DRIVER=y
@@ -882,7 +976,6 @@ CONFIG_MAX_RAW_DEVS=256
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -947,6 +1040,7 @@ CONFIG_I2C_POWERMAC=y
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -955,14 +1049,9 @@ CONFIG_I2C_POWERMAC=y
 # CONFIG_HWMON_VID is not set
 
 #
-# Misc devices
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -975,6 +1064,7 @@ CONFIG_VIDEO_V4L2=y
 #
 CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
+CONFIG_FB_DDC=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
@@ -1011,6 +1101,7 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
 # CONFIG_FB_TRIDENT is not set
+CONFIG_FB_IBM_GXT4500=y
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -1159,6 +1250,11 @@ CONFIG_SND_AOA_SOUNDBUS_I2S=m
 # CONFIG_SOUND_PRIME is not set
 
 #
+# HID Devices
+#
+CONFIG_HID=y
+
+#
 # USB support
 #
 CONFIG_USB_ARCH_HAS_HCD=y
@@ -1173,6 +1269,7 @@ CONFIG_USB=y
 CONFIG_USB_DEVICEFS=y
 # CONFIG_USB_BANDWIDTH is not set
 # CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_MULTITHREAD_PROBE is not set
 # CONFIG_USB_OTG is not set
 
 #
@@ -1214,13 +1311,13 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
 # CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
 # CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
-CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
@@ -1250,6 +1347,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_KAWETH is not set
 # CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_USBNET_MII is not set
 # CONFIG_USB_USBNET is not set
 # CONFIG_USB_MON is not set
 
@@ -1267,6 +1365,7 @@ CONFIG_USB_HIDDEV=y
 #
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
 # CONFIG_USB_AUERSWALD is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
@@ -1274,12 +1373,13 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
-# CONFIG_USB_PHIDGETKIT is not set
-# CONFIG_USB_PHIDGETSERVO is not set
+# CONFIG_USB_PHIDGET is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
 CONFIG_USB_APPLEDISPLAY=m
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1318,6 +1418,7 @@ CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_ADDR_TRANS=y
 CONFIG_INFINIBAND_MTHCA=m
 CONFIG_INFINIBAND_MTHCA_DEBUG=y
+# CONFIG_INFINIBAND_AMSO1100 is not set
 CONFIG_INFINIBAND_IPOIB=m
 CONFIG_INFINIBAND_IPOIB_DEBUG=y
 # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set
@@ -1347,6 +1448,10 @@ CONFIG_INFINIBAND_ISER=m
 #
 
 #
+# Virtualization
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1359,6 +1464,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 CONFIG_EXT3_FS_SECURITY=y
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1379,6 +1485,7 @@ CONFIG_XFS_FS=m
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -1414,8 +1521,10 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
@@ -1540,8 +1649,23 @@ CONFIG_NLS_KOI8_U=m
 CONFIG_NLS_UTF8=m
 
 #
+# Distributed Lock Manager
+#
+# CONFIG_DLM is not set
+
+#
+# iSeries device drivers
+#
+# CONFIG_VIOCONS is not set
+CONFIG_VIODASD=y
+CONFIG_VIOCD=m
+CONFIG_VIOTAPE=m
+CONFIG_VIOPATH=y
+
+#
 # Library routines
 #
+CONFIG_BITREVERSE=y
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
@@ -1551,6 +1675,7 @@ CONFIG_ZLIB_DEFLATE=m
 CONFIG_TEXTSEARCH=y
 CONFIG_TEXTSEARCH_KMP=m
 CONFIG_PLIST=y
+CONFIG_IOMAP_COPY=y
 
 #
 # Instrumentation Support
@@ -1563,8 +1688,11 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
@@ -1578,16 +1706,19 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
-CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
+# CONFIG_HCALL_STATS is not set
 CONFIG_DEBUGGER=y
 CONFIG_XMON=y
 # CONFIG_XMON_DEFAULT is not set
+CONFIG_XMON_DISASSEMBLY=y
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
 # CONFIG_PPC_EARLY_DEBUG is not set
@@ -1602,7 +1733,12 @@ CONFIG_BOOTX_TEXT=y
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_XCBC is not set
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
@@ -1611,9 +1747,14 @@ CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_TGR192=m
+# CONFIG_CRYPTO_GF128MUL is not set
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=y
+# CONFIG_CRYPTO_LRW is not set
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_TWOFISH_COMMON=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_AES=m
 CONFIG_CRYPTO_CAST5=m
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index e96521530d21..030d300cd71c 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -303,5 +303,8 @@ int main(void)
         DEFINE(NSEC_PER_SEC, NSEC_PER_SEC);
         DEFINE(CLOCK_REALTIME_RES, TICK_NSEC);
 
+#ifdef CONFIG_BUG
+        DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry));
+#endif
         return 0;
 }
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 1a3d4de197d2..2551c0884afc 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -28,6 +28,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/cputable.h>
 #include <asm/firmware.h>
+#include <asm/bug.h>
 
 /*
  * System calls.
@@ -634,19 +635,15 @@ _GLOBAL(enter_rtas)
         li      r0,0
         mtcr    r0
 
+#ifdef CONFIG_BUG       
         /* There is no way it is acceptable to get here with interrupts enabled,
          * check it with the asm equivalent of WARN_ON
          */
         lbz     r0,PACASOFTIRQEN(r13)
 1:      tdnei   r0,0
-.section __bug_table,"a"
-        .llong  1b,__LINE__ + 0x1000000, 1f, 2f
-.previous
-.section .rodata,"a"
-1:      .asciz  __FILE__
-2:      .asciz "enter_rtas"
-.previous
-
+        EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING
+#endif
+        
         /* Hard-disable interrupts */
         mfmsr   r6
         rldicl  r7,r6,48,1
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 89c836d54809..1bb20d841080 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -744,7 +744,8 @@ static int htlb_check_hinted_area(unsigned long addr, unsigned long len)
         struct vm_area_struct *vma;
 
         vma = find_vma(current->mm, addr);
-        if (!vma || ((addr + len) <= vma->vm_start))
+        if (TASK_SIZE - len >= addr &&
+            (!vma || ((addr + len) <= vma->vm_start)))
                 return 0;
 
         return -ENOMEM;
@@ -815,6 +816,8 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 return -EINVAL;
         if (len & ~HPAGE_MASK)
                 return -EINVAL;
+        if (len > TASK_SIZE)
+                return -ENOMEM;
 
         if (!cpu_has_feature(CPU_FTR_16M_PAGE))
                 return -EINVAL;
@@ -823,9 +826,6 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
         BUG_ON((addr + len)  < addr);
 
         if (test_thread_flag(TIF_32BIT)) {
-                /* Paranoia, caller should have dealt with this */
-                BUG_ON((addr + len) > 0x100000000UL);
-
                 curareas = current->mm->context.low_htlb_areas;
 
                 /* First see if we can use the hint address */
diff --git a/arch/powerpc/platforms/52xx/lite5200.c b/arch/powerpc/platforms/52xx/lite5200.c
index eaff71e74fb0..0f21bab33f6c 100644
--- a/arch/powerpc/platforms/52xx/lite5200.c
+++ b/arch/powerpc/platforms/52xx/lite5200.c
@@ -153,6 +153,7 @@ define_machine(lite52xx) {
         .name           = "lite52xx",
         .probe          = lite52xx_probe,
         .setup_arch     = lite52xx_setup_arch,
+        .init           = mpc52xx_declare_of_platform_devices,
         .init_IRQ       = mpc52xx_init_irq,
         .get_irq        = mpc52xx_get_irq,
         .show_cpuinfo   = lite52xx_show_cpuinfo,
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_common.c b/arch/powerpc/platforms/52xx/mpc52xx_common.c
index 8331ff457770..cc40889074bd 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_common.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_common.c
@@ -116,11 +116,12 @@ unmap_regs:
         if (xlb) iounmap(xlb);
 }
 
-static int __init
+void __init
 mpc52xx_declare_of_platform_devices(void)
 {
         /* Find every child of the SOC node and add it to of_platform */
-        return of_platform_bus_probe(NULL, NULL, NULL);
+        if (of_platform_bus_probe(NULL, NULL, NULL))
+                printk(KERN_ERR __FILE__ ": "
+                        "Error while probing of_platform bus\n");
 }
 
-device_initcall(mpc52xx_declare_of_platform_devices);
diff --git a/arch/powerpc/platforms/iseries/lpevents.c b/arch/powerpc/platforms/iseries/lpevents.c
index e3e929e1b460..c1f4502a3c6a 100644
--- a/arch/powerpc/platforms/iseries/lpevents.c
+++ b/arch/powerpc/platforms/iseries/lpevents.c
@@ -17,6 +17,7 @@
 
 #include <asm/system.h>
 #include <asm/paca.h>
+#include <asm/firmware.h>
 #include <asm/iseries/it_lp_queue.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/hv_call_event.h>
@@ -318,6 +319,9 @@ static int __init proc_lpevents_init(void)
 {
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         e = create_proc_entry("iSeries/lpevents", S_IFREG|S_IRUGO, NULL);
         if (e)
                 e->proc_fops = &proc_lpevents_operations;
diff --git a/arch/powerpc/platforms/iseries/mf.c b/arch/powerpc/platforms/iseries/mf.c
index cff15ae24f6b..1ad0e4aaad1a 100644
--- a/arch/powerpc/platforms/iseries/mf.c
+++ b/arch/powerpc/platforms/iseries/mf.c
@@ -38,6 +38,7 @@
 #include <asm/uaccess.h>
 #include <asm/paca.h>
 #include <asm/abs_addr.h>
+#include <asm/firmware.h>
 #include <asm/iseries/vio.h>
 #include <asm/iseries/mf.h>
 #include <asm/iseries/hv_lp_config.h>
@@ -1235,6 +1236,9 @@ static int __init mf_proc_init(void)
         char name[2];
         int i;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         mf_proc_root = proc_mkdir("iSeries/mf", NULL);
         if (!mf_proc_root)
                 return 1;
diff --git a/arch/powerpc/platforms/iseries/proc.c b/arch/powerpc/platforms/iseries/proc.c
index c241413629ac..b54e37101e69 100644
--- a/arch/powerpc/platforms/iseries/proc.c
+++ b/arch/powerpc/platforms/iseries/proc.c
@@ -24,6 +24,7 @@
 #include <asm/processor.h>
 #include <asm/time.h>
 #include <asm/lppaca.h>
+#include <asm/firmware.h>
 #include <asm/iseries/hv_call_xm.h>
 
 #include "processor_vpd.h"
@@ -31,7 +32,12 @@
 
 static int __init iseries_proc_create(void)
 {
-        struct proc_dir_entry *e = proc_mkdir("iSeries", 0);
+        struct proc_dir_entry *e;
+
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
+        e = proc_mkdir("iSeries", 0);
         if (!e)
                 return 1;
 
@@ -106,6 +112,9 @@ static int __init iseries_proc_init(void)
 {
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         e = create_proc_entry("iSeries/titanTod", S_IFREG|S_IRUGO, NULL);
         if (e)
                 e->proc_fops = &proc_titantod_operations;
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index bdf2afbb60c1..cce7e309340c 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -527,7 +527,8 @@ static void __init iSeries_fixup_klimit(void)
 static int __init iSeries_src_init(void)
 {
         /* clear the progress line */
-        ppc_md.progress(" ", 0xffff);
+        if (firmware_has_feature(FW_FEATURE_ISERIES))
+                ppc_md.progress(" ", 0xffff);
         return 0;
 }
 
diff --git a/arch/powerpc/platforms/iseries/viopath.c b/arch/powerpc/platforms/iseries/viopath.c
index 84e7ee2c086f..a6799ed34a66 100644
--- a/arch/powerpc/platforms/iseries/viopath.c
+++ b/arch/powerpc/platforms/iseries/viopath.c
@@ -42,6 +42,7 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/prom.h>
+#include <asm/firmware.h>
 #include <asm/iseries/hv_types.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/hv_lp_config.h>
@@ -183,6 +184,9 @@ static int __init vio_proc_init(void)
 {
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         e = create_proc_entry("iSeries/config", 0, NULL);
         if (e)
                 e->proc_fops = &proc_viopath_operations;
diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
index f12d5c69e74d..50855d4fd5a0 100644
--- a/arch/powerpc/platforms/maple/setup.c
+++ b/arch/powerpc/platforms/maple/setup.c
@@ -254,7 +254,6 @@ static void __init maple_init_IRQ(void)
                 printk(KERN_DEBUG "OpenPIC addr: %lx, has ISUs: %d\n",
                        openpic_addr, has_isus);
         }
-        of_node_put(root);
 
         BUG_ON(openpic_addr == 0);
 
diff --git a/arch/powerpc/platforms/pasemi/setup.c b/arch/powerpc/platforms/pasemi/setup.c
index 89d6e295dbf7..bea7d1bb1a3b 100644
--- a/arch/powerpc/platforms/pasemi/setup.c
+++ b/arch/powerpc/platforms/pasemi/setup.c
@@ -129,7 +129,6 @@ static __init void pas_init_IRQ(void)
         }
         openpic_addr = of_read_number(opprop, naddr);
         printk(KERN_DEBUG "OpenPIC addr: %lx\n", openpic_addr);
-        of_node_put(root);
 
         mpic = mpic_alloc(mpic_node, openpic_addr, MPIC_PRIMARY, 0, 0,
                           " PAS-OPIC  ");
diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
index c00cfed7af2c..5c7e38789897 100644
--- a/arch/powerpc/platforms/pseries/hvCall.S
+++ b/arch/powerpc/platforms/pseries/hvCall.S
@@ -26,7 +26,7 @@
 BEGIN_FTR_SECTION;                                              \
         mfspr   r0,SPRN_PURR;           /* get PURR and */      \
         std     r0,STK_PARM(r6)(r1);    /* save for later */    \
-END_FTR_SECTION_IFCLR(CPU_FTR_PURR);
+END_FTR_SECTION_IFSET(CPU_FTR_PURR);
         
 /*
  * postcall is performed immediately before function return which
@@ -43,7 +43,7 @@ BEGIN_FTR_SECTION;						\
         mfspr   r8,SPRN_PURR;           /* PURR after */        \
         ld      r6,STK_PARM(r6)(r1);    /* PURR before */       \
         subf    r6,r6,r8;               /* delta */             \
-END_FTR_SECTION_IFCLR(CPU_FTR_PURR);                            \
+END_FTR_SECTION_IFSET(CPU_FTR_PURR);                            \
         ld      r5,STK_PARM(r5)(r1);    /* timebase before */   \
         subf    r5,r5,r7;               /* time delta */        \
                                                                 \
@@ -66,7 +66,7 @@ BEGIN_FTR_SECTION;						\
         ld      r7,HCALL_STAT_PURR(r4); /* PURR */              \
         add     r7,r7,r6;                                       \
         std     r7,HCALL_STAT_PURR(r4);                         \
-END_FTR_SECTION_IFCLR(CPU_FTR_PURR);                            \
+END_FTR_SECTION_IFSET(CPU_FTR_PURR);                            \
 1:
 #else
 #define HCALL_INST_PRECALL
@@ -145,6 +145,7 @@ _GLOBAL(plpar_hcall9)
 
         HVSC                            /* invoke the hypervisor */
 
+        mr      r0,r12
         ld      r12,STK_PARM(r4)(r1)
         std     r4,  0(r12)
         std     r5,  8(r12)
@@ -154,7 +155,7 @@ _GLOBAL(plpar_hcall9)
         std     r9, 40(r12)
         std     r10,48(r12)
         std     r11,56(r12)
-        std     r12,64(r12)
+        std     r0, 64(r12)
 
         HCALL_INST_POSTCALL
 
diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
index 80181c4c49eb..3ddc04925d50 100644
--- a/arch/powerpc/platforms/pseries/hvCall_inst.c
+++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
@@ -34,7 +34,7 @@ DEFINE_PER_CPU(struct hcall_stats[HCALL_STAT_ARRAY_SIZE], hcall_stats);
  */
 static void *hc_start(struct seq_file *m, loff_t *pos)
 {
-        if ((int)*pos < HCALL_STAT_ARRAY_SIZE)
+        if ((int)*pos < (HCALL_STAT_ARRAY_SIZE-1))
                 return (void *)(unsigned long)(*pos + 1);
 
         return NULL;
@@ -57,7 +57,7 @@ static int hc_show(struct seq_file *m, void *p)
         struct hcall_stats *hs = (struct hcall_stats *)m->private;
 
         if (hs[h_num].num_calls) {
-                if (!cpu_has_feature(CPU_FTR_PURR))
+                if (cpu_has_feature(CPU_FTR_PURR))
                         seq_printf(m, "%lu %lu %lu %lu\n", h_num<<2,
                                    hs[h_num].num_calls,
                                    hs[h_num].tb_total,
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index b5b2b1103de8..81d172d65038 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -224,7 +224,6 @@ static void xics_unmask_irq(unsigned int virq)
 static void xics_mask_real_irq(unsigned int irq)
 {
         int call_status;
-        unsigned int server;
 
         if (irq == XICS_IPI)
                 return;
@@ -236,9 +235,9 @@ static void xics_mask_real_irq(unsigned int irq)
                 return;
         }
 
-        server = get_irq_server(irq);
         /* Have to set XIVE to 0xff to be able to remove a slot */
-        call_status = rtas_call(ibm_set_xive, 3, 1, NULL, irq, server, 0xff);
+        call_status = rtas_call(ibm_set_xive, 3, 1, NULL, irq,
+                                default_server, 0xff);
         if (call_status != 0) {
                 printk(KERN_ERR "xics_disable_irq: irq=%u: ibm_set_xive(0xff)"
                        " returned %d\n", irq, call_status);
diff --git a/arch/powerpc/sysdev/Makefile b/arch/powerpc/sysdev/Makefile
index 04d4917eb303..2621a7e72d2d 100644
--- a/arch/powerpc/sysdev/Makefile
+++ b/arch/powerpc/sysdev/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_MMIO_NVRAM)	+= mmio_nvram.o
 obj-$(CONFIG_FSL_SOC)           += fsl_soc.o
 obj-$(CONFIG_TSI108_BRIDGE)     += tsi108_pci.o tsi108_dev.o
 obj-$(CONFIG_QUICC_ENGINE)      += qe_lib/
-obj-$(CONFIG_MTD)               += rom.o
 
 ifeq ($(CONFIG_PPC_MERGE),y)
 obj-$(CONFIG_PPC_I8259)         += i8259.o
@@ -21,5 +20,6 @@ endif
 
 # Temporary hack until we have migrated to asm-powerpc
 ifeq ($(ARCH),powerpc)
+obj-$(CONFIG_MTD)               += rom.o
 obj-$(CONFIG_CPM2)              += cpm2_common.o cpm2_pic.o
 endif
diff --git a/arch/s390/kernel/head31.S b/arch/s390/kernel/head31.S
index 4388b3309e0c..eca507050e47 100644
--- a/arch/s390/kernel/head31.S
+++ b/arch/s390/kernel/head31.S
@@ -164,11 +164,14 @@ startup_continue:
         srl     %r7,28
         clr     %r6,%r7                 # compare cc with last access code
         be      .Lsame-.LPG1(%r13)
-        b       .Lchkmem-.LPG1(%r13)
+        lhi     %r8,0                   # no program checks
+        b       .Lsavchk-.LPG1(%r13)
 .Lsame:
         ar      %r5,%r1                 # add 128KB to end of chunk
         bno     .Lloop-.LPG1(%r13)      # r1 < 0x80000000 -> loop
 .Lchkmem:                               # > 2GB or tprot got a program check
+        lhi     %r8,1                   # set program check flag
+.Lsavchk:
         clr     %r4,%r5                 # chunk size > 0?
         be      .Lchkloop-.LPG1(%r13)
         st      %r4,0(%r3)              # store start address of chunk
@@ -190,8 +193,15 @@ startup_continue:
         je      .Ldonemem               # if not, leave
         chi     %r10,0                  # do we have chunks left?
         je      .Ldonemem
+        chi     %r8,1                   # program check ?
+        je      .Lpgmchk
+        lr      %r4,%r5                 # potential new chunk
+        alr     %r5,%r1                 # add 128KB to end of chunk
+        j       .Llpcnt
+.Lpgmchk:
         alr     %r5,%r1                 # add 128KB to end of chunk
         lr      %r4,%r5                 # potential new chunk
+.Llpcnt:
         clr     %r5,%r9                 # should we go on?
         jl      .Lloop
 .Ldonemem:
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index c526279e1123..6ba3f4512dd1 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -172,12 +172,15 @@ startup_continue:
         srl     %r7,28
         clr     %r6,%r7                 # compare cc with last access code
         je      .Lsame
-        j       .Lchkmem
+        lghi    %r8,0                   # no program checks
+        j       .Lsavchk
 .Lsame:
         algr    %r5,%r1                 # add 128KB to end of chunk
                                         # no need to check here,
         brc     12,.Lloop               # this is the same chunk
 .Lchkmem:                               # > 16EB or tprot got a program check
+        lghi    %r8,1                   # set program check flag
+.Lsavchk:
         clgr    %r4,%r5                 # chunk size > 0?
         je      .Lchkloop
         stg     %r4,0(%r3)              # store start address of chunk
@@ -204,8 +207,15 @@ startup_continue:
         chi     %r10, 0                 # do we have chunks left?
         je      .Ldonemem
 .Lhsaskip:
+        chi     %r8,1                   # program check ?
+        je      .Lpgmchk
+        lgr     %r4,%r5                 # potential new chunk
+        algr    %r5,%r1                 # add 128KB to end of chunk
+        j       .Llpcnt
+.Lpgmchk:
         algr    %r5,%r1                 # add 128KB to end of chunk
         lgr     %r4,%r5                 # potential new chunk
+.Llpcnt:
         clgr    %r5,%r9                 # should we go on?
         jl      .Lloop
 .Ldonemem:
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 49ef206ec880..5d8ee3baac14 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -476,7 +476,7 @@ static void __init setup_memory_end(void)
         int i;
 
         memory_size = real_size = 0;
-        max_phys = VMALLOC_END - VMALLOC_MIN_SIZE;
+        max_phys = VMALLOC_END_INIT - VMALLOC_MIN_SIZE;
         memory_end &= PAGE_MASK;
 
         max_mem = memory_end ? min(max_phys, memory_end) : max_phys;
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 19090f7d4f51..c0cd255fddbd 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -794,7 +794,10 @@ static int __init topology_init(void)
         int ret;
 
         for_each_possible_cpu(cpu) {
-                ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu);
+                struct cpu *c = &per_cpu(cpu_devices, cpu);
+
+                c->hotpluggable = 1;
+                ret = register_cpu(c, cpu);
                 if (ret)
                         printk(KERN_WARNING "topology_init: register_cpu %d "
                                "failed (%d)\n", cpu, ret);
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 633249c3ba91..49c3e46b4065 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/errno.h>
+#include <linux/hardirq.h>
 #include <linux/mm.h>
 #include <asm/uaccess.h>
 #include <asm/futex.h>
@@ -18,6 +19,8 @@ static inline int __handle_fault(struct mm_struct *mm, unsigned long address,
         struct vm_area_struct *vma;
         int ret = -EFAULT;
 
+        if (in_atomic())
+                return ret;
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if (unlikely(!vma))
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c
index bbaca66fa293..56a0214e9928 100644
--- a/arch/s390/lib/uaccess_std.c
+++ b/arch/s390/lib/uaccess_std.c
@@ -258,8 +258,6 @@ int futex_atomic_op(int op, int __user *uaddr, int oparg, int *old)
 {
         int oldval = 0, newval, ret;
 
-        pagefault_disable();
-
         switch (op) {
         case FUTEX_OP_SET:
                 __futex_atomic_op("lr %2,%5\n",
@@ -284,7 +282,6 @@ int futex_atomic_op(int op, int __user *uaddr, int oparg, int *old)
         default:
                 ret = -ENOSYS;
         }
-        pagefault_enable();
         *old = oldval;
         return ret;
 }
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 829698f6d049..49802f1bee94 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -69,6 +69,11 @@ static void nvidia_bugs(void)
 
 static void ati_bugs(void)
 {
+        if (timer_over_8254 == 1) {
+                timer_over_8254 = 0;
+                printk(KERN_INFO
+                "ATI board detected. Disabling timer routing over 8254.\n");
+        }
 }
 
 static void intel_bugs(void)
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 2a1dcd5f69c2..d7bad90a5ad8 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -55,6 +55,10 @@ int sis_apic_bug; /* not actually supported, dummy for compile */
 
 static int no_timer_check;
 
+static int disable_timer_pin_1 __initdata;
+
+int timer_over_8254 __initdata = 1;
+
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
@@ -350,6 +354,29 @@ static int __init disable_ioapic_setup(char *str)
 }
 early_param("noapic", disable_ioapic_setup);
 
+/* Actually the next is obsolete, but keep it for paranoid reasons -AK */
+static int __init disable_timer_pin_setup(char *arg)
+{
+        disable_timer_pin_1 = 1;
+        return 1;
+}
+__setup("disable_timer_pin_1", disable_timer_pin_setup);
+
+static int __init setup_disable_8254_timer(char *s)
+{
+        timer_over_8254 = -1;
+        return 1;
+}
+static int __init setup_enable_8254_timer(char *s)
+{
+        timer_over_8254 = 2;
+        return 1;
+}
+
+__setup("disable_8254_timer", setup_disable_8254_timer);
+__setup("enable_8254_timer", setup_enable_8254_timer);
+
+
 /*
  * Find the IRQ entry number of a certain pin.
  */
@@ -1568,33 +1595,10 @@ static inline void unlock_ExtINT_logic(void)
  * a wide range of boards and BIOS bugs.  Fortunately only the timer IRQ
  * is so screwy.  Thanks to Brian Perkins for testing/hacking this beast
  * fanatically on his truly buggy board.
+ *
+ * FIXME: really need to revamp this for modern platforms only.
  */
-
-static int try_apic_pin(int apic, int pin, char *msg)
-{
-        apic_printk(APIC_VERBOSE, KERN_INFO
-                    "..TIMER: trying IO-APIC=%d PIN=%d %s",
-                    apic, pin, msg);
-
-        /*
-         * Ok, does IRQ0 through the IOAPIC work?
-         */
-        if (!no_timer_check && timer_irq_works()) {
-                nmi_watchdog_default();
-                if (nmi_watchdog == NMI_IO_APIC) {
-                        disable_8259A_irq(0);
-                        setup_nmi();
-                        enable_8259A_irq(0);
-                }
-                return 1;
-        }
-        clear_IO_APIC_pin(apic, pin);
-        apic_printk(APIC_QUIET, KERN_ERR " .. failed\n");
-        return 0;
-}
-
-/* The function from hell */
-static void check_timer(void)
+static inline void check_timer(void)
 {
         int apic1, pin1, apic2, pin2;
         int vector;
@@ -1615,43 +1619,61 @@ static void check_timer(void)
          */
         apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
         init_8259A(1);
+        if (timer_over_8254 > 0)
+                enable_8259A_irq(0);
 
         pin1  = find_isa_irq_pin(0, mp_INT);
         apic1 = find_isa_irq_apic(0, mp_INT);
         pin2  = ioapic_i8259.pin;
         apic2 = ioapic_i8259.apic;
 
-        /* Do this first, otherwise we get double interrupts on ATI boards */
-        if ((pin1 != -1) && try_apic_pin(apic1, pin1,"with 8259 IRQ0 disabled"))
-                return;
+        apic_printk(APIC_VERBOSE,KERN_INFO "..TIMER: vector=0x%02X apic1=%d pin1=%d apic2=%d pin2=%d\n",
+                vector, apic1, pin1, apic2, pin2);
 
-        /* Now try again with IRQ0 8259A enabled.
-           Assumes timer is on IO-APIC 0 ?!? */
-        enable_8259A_irq(0);
-        unmask_IO_APIC_irq(0);
-        if (try_apic_pin(apic1, pin1, "with 8259 IRQ0 enabled"))
-                return;
-        disable_8259A_irq(0);
-
-        /* Always try pin0 and pin2 on APIC 0 to handle buggy timer overrides
-           on Nvidia boards */
-        if (!(apic1 == 0 && pin1 == 0) &&
-            try_apic_pin(0, 0, "fallback with 8259 IRQ0 disabled"))
-                return;
-        if (!(apic1 == 0 && pin1 == 2) &&
-            try_apic_pin(0, 2, "fallback with 8259 IRQ0 disabled"))
-                return;
+        if (pin1 != -1) {
+                /*
+                 * Ok, does IRQ0 through the IOAPIC work?
+                 */
+                unmask_IO_APIC_irq(0);
+                if (!no_timer_check && timer_irq_works()) {
+                        nmi_watchdog_default();
+                        if (nmi_watchdog == NMI_IO_APIC) {
+                                disable_8259A_irq(0);
+                                setup_nmi();
+                                enable_8259A_irq(0);
+                        }
+                        if (disable_timer_pin_1 > 0)
+                                clear_IO_APIC_pin(0, pin1);
+                        return;
+                }
+                clear_IO_APIC_pin(apic1, pin1);
+                apic_printk(APIC_QUIET,KERN_ERR "..MP-BIOS bug: 8254 timer not "
+                                "connected to IO-APIC\n");
+        }
 
-        /* Then try pure 8259A routing on the 8259 as reported by BIOS*/
-        enable_8259A_irq(0);
+        apic_printk(APIC_VERBOSE,KERN_INFO "...trying to set up timer (IRQ0) "
+                                "through the 8259A ... ");
         if (pin2 != -1) {
+                apic_printk(APIC_VERBOSE,"\n..... (found apic %d pin %d) ...",
+                        apic2, pin2);
+                /*
+                 * legacy devices should be connected to IO APIC #0
+                 */
                 setup_ExtINT_IRQ0_pin(apic2, pin2, vector);
-                if (try_apic_pin(apic2,pin2,"8259A broadcast ExtINT from BIOS"))
+                if (timer_irq_works()) {
+                        apic_printk(APIC_VERBOSE," works.\n");
+                        nmi_watchdog_default();
+                        if (nmi_watchdog == NMI_IO_APIC) {
+                                setup_nmi();
+                        }
                         return;
+                }
+                /*
+                 * Cleanup, just in case ...
+                 */
+                clear_IO_APIC_pin(apic2, pin2);
         }
-
-        /* Tried all possibilities to go through the IO-APIC. Now come the
-           really cheesy fallbacks. */
+        apic_printk(APIC_VERBOSE," failed.\n");
 
         if (nmi_watchdog == NMI_IO_APIC) {
                 printk(KERN_WARNING "timer doesn't work through the IO-APIC - disabling NMI Watchdog!\n");
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index aeefec97fdee..6bdf593081d8 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -117,10 +117,17 @@ static struct usb_device_id blacklist_ids[] = {
 
         /* IBM/Lenovo ThinkPad with Broadcom chip */
         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = HCI_WRONG_SCO_MTU },
+        { USB_DEVICE(0x0a5c, 0x2110), .driver_info = HCI_WRONG_SCO_MTU },
 
         /* ANYCOM Bluetooth USB-200 and USB-250 */
         { USB_DEVICE(0x0a5c, 0x2111), .driver_info = HCI_RESET },
 
+        /* HP laptop with Broadcom chip */
+        { USB_DEVICE(0x03f0, 0x171d), .driver_info = HCI_WRONG_SCO_MTU },
+
+        /* Dell laptop with Broadcom chip */
+        { USB_DEVICE(0x413c, 0x8126), .driver_info = HCI_WRONG_SCO_MTU },
+
         /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
         { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 533193d4e5df..9e0ab048c878 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1088,10 +1088,21 @@ static int cma_iw_handler(struct iw_cm_id *iw_id, struct iw_cm_event *iw_event)
                 *sin = iw_event->local_addr;
                 sin = (struct sockaddr_in *) &id_priv->id.route.addr.dst_addr;
                 *sin = iw_event->remote_addr;
-                if (iw_event->status)
-                        event.event = RDMA_CM_EVENT_REJECTED;
-                else
+                switch (iw_event->status) {
+                case 0:
                         event.event = RDMA_CM_EVENT_ESTABLISHED;
+                        break;
+                case -ECONNRESET:
+                case -ECONNREFUSED:
+                        event.event = RDMA_CM_EVENT_REJECTED;
+                        break;
+                case -ETIMEDOUT:
+                        event.event = RDMA_CM_EVENT_UNREACHABLE;
+                        break;
+                default:
+                        event.event = RDMA_CM_EVENT_CONNECT_ERROR;
+                        break;
+                }
                 break;
         case IW_CM_EVENT_ESTABLISHED:
                 event.event = RDMA_CM_EVENT_ESTABLISHED;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 81a5cdc5733a..e2e8d329b443 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -209,10 +209,21 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
         if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
                 if (!ctx->backlog) {
                         ret = -EDQUOT;
+                        kfree(uevent);
                         goto out;
                 }
                 ctx->backlog--;
+        } else if (!ctx->uid) {
+                /*
+                 * We ignore events for new connections until userspace has set
+                 * their context.  This can only happen if an error occurs on a
+                 * new connection before the user accepts it.  This is okay,
+                 * since the accept will just fail later.
+                 */
+                kfree(uevent);
+                goto out;
         }
+
         list_add_tail(&uevent->list, &ctx->file->event_list);
         wake_up_interruptible(&ctx->file->poll_wait);
 out:
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index e1b618c5f685..b7be950ab47c 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -50,7 +50,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                                               ib_device);
         struct hipz_query_hca *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -110,7 +110,7 @@ int ehca_query_port(struct ib_device *ibdev,
                                               ib_device);
         struct hipz_query_port *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -179,7 +179,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
                 return -EINVAL;
         }
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device,  "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -212,7 +212,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
                 return -EINVAL;
         }
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index c3ea746e9045..e7209afb4250 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -138,7 +138,7 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
         u64 *rblock;
         unsigned long block_count;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_ATOMIC);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Cannot allocate rblock memory.");
                 ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 3720e3032cce..cd7789f0d08e 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -180,10 +180,10 @@ int ehca_mmap_register(u64 physical,void **mapped,
 int ehca_munmap(unsigned long addr, size_t len);
 
 #ifdef CONFIG_PPC_64K_PAGES
-void *ehca_alloc_fw_ctrlblock(void);
+void *ehca_alloc_fw_ctrlblock(gfp_t flags);
 void ehca_free_fw_ctrlblock(void *ptr);
 #else
-#define ehca_alloc_fw_ctrlblock() ((void *) get_zeroed_page(GFP_KERNEL))
+#define ehca_alloc_fw_ctrlblock(flags) ((void *) get_zeroed_page(flags))
 #define ehca_free_fw_ctrlblock(ptr) free_page((unsigned long)(ptr))
 #endif
 
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index cc47e4c13a18..6574fbbaead5 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -106,9 +106,9 @@ static struct timer_list poll_eqs_timer;
 #ifdef CONFIG_PPC_64K_PAGES
 static struct kmem_cache *ctblk_cache = NULL;
 
-void *ehca_alloc_fw_ctrlblock(void)
+void *ehca_alloc_fw_ctrlblock(gfp_t flags)
 {
-        void *ret = kmem_cache_zalloc(ctblk_cache, GFP_KERNEL);
+        void *ret = kmem_cache_zalloc(ctblk_cache, flags);
         if (!ret)
                 ehca_gen_err("Out of memory for ctblk");
         return ret;
@@ -206,7 +206,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
         u64 h_ret;
         struct hipz_query_hca *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_gen_err("Cannot allocate rblock memory.");
                 return -ENOMEM;
@@ -258,7 +258,7 @@ static int init_node_guid(struct ehca_shca *shca)
         int ret = 0;
         struct hipz_query_hca *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -469,7 +469,7 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                            \
         shca = dev->driver_data;                                           \
                                                                            \
-        rblock = ehca_alloc_fw_ctrlblock();                                \
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);                      \
         if (!rblock) {                                                     \
                 dev_err(dev, "Can't allocate rblock memory.");             \
                 return 0;                                                  \
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 0a5e2214cc5f..cfb362a1029c 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -1013,7 +1013,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
         u32 i;
         u64 *kpage;
 
-        kpage = ehca_alloc_fw_ctrlblock();
+        kpage = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
@@ -1124,7 +1124,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
         ehca_mrmw_map_acl(acl, &hipz_acl);
         ehca_mrmw_set_pgsize_hipz_acl(&hipz_acl);
 
-        kpage = ehca_alloc_fw_ctrlblock();
+        kpage = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index c6c9cef203e3..34b85556d01e 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -807,7 +807,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
         unsigned long spl_flags = 0;
 
         /* do query_qp to obtain current attr values */
-        mqpcb = ehca_alloc_fw_ctrlblock();
+        mqpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!mqpcb) {
                 ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                          "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
@@ -1273,7 +1273,7 @@ int ehca_query_qp(struct ib_qp *qp,
                 return -EINVAL;
         }
 
-        qpcb = ehca_alloc_fw_ctrlblock();
+        qpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!qpcb) {
                 ehca_err(qp->device,"Out of memory for qpcb "
                          "ehca_qp=%p qp_num=%x", my_qp, qp->qp_num);
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 283d50b76c3d..1159c8a0f2c5 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -54,6 +54,10 @@ enum {
         MTHCA_CQ_ENTRY_SIZE = 0x20
 };
 
+enum {
+        MTHCA_ATOMIC_BYTE_LEN = 8
+};
+
 /*
  * Must be packed because start is 64 bits but only aligned to 32 bits.
  */
@@ -599,11 +603,11 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
                         break;
                 case MTHCA_OPCODE_ATOMIC_CS:
                         entry->opcode    = IB_WC_COMP_SWAP;
-                        entry->byte_len  = be32_to_cpu(cqe->byte_cnt);
+                        entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
                         break;
                 case MTHCA_OPCODE_ATOMIC_FA:
                         entry->opcode    = IB_WC_FETCH_ADD;
-                        entry->byte_len  = be32_to_cpu(cqe->byte_cnt);
+                        entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
                         break;
                 case MTHCA_OPCODE_BIND_MW:
                         entry->opcode    = IB_WC_BIND_MW;
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 15cc2f6eb475..6b19645d946c 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -232,7 +232,7 @@ void *mthca_table_find(struct mthca_icm_table *table, int obj)
 
         list_for_each_entry(chunk, &icm->chunk_list, list) {
                 for (i = 0; i < chunk->npages; ++i) {
-                        if (chunk->mem[i].length >= offset) {
+                        if (chunk->mem[i].length > offset) {
                                 page = chunk->mem[i].page;
                                 goto out;
                         }
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index d844a2569b47..5f5214c0337d 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -429,13 +429,18 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
 {
         struct mthca_dev *dev = to_mdev(ibqp->device);
         struct mthca_qp *qp = to_mqp(ibqp);
-        int err;
-        struct mthca_mailbox *mailbox;
+        int err = 0;
+        struct mthca_mailbox *mailbox = NULL;
         struct mthca_qp_param *qp_param;
         struct mthca_qp_context *context;
         int mthca_state;
         u8 status;
 
+        if (qp->state == IB_QPS_RESET) {
+                qp_attr->qp_state = IB_QPS_RESET;
+                goto done;
+        }
+
         mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
@@ -454,7 +459,6 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
         mthca_state = be32_to_cpu(context->flags) >> 28;
 
         qp_attr->qp_state            = to_ib_qp_state(mthca_state);
-        qp_attr->cur_qp_state        = qp_attr->qp_state;
         qp_attr->path_mtu            = context->mtu_msgmax >> 5;
         qp_attr->path_mig_state      =
                 to_ib_mig_state((be32_to_cpu(context->flags) >> 11) & 0x3);
@@ -464,11 +468,6 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
         qp_attr->dest_qp_num         = be32_to_cpu(context->remote_qpn) & 0xffffff;
         qp_attr->qp_access_flags     =
                 to_ib_qp_access_flags(be32_to_cpu(context->params2));
-        qp_attr->cap.max_send_wr     = qp->sq.max;
-        qp_attr->cap.max_recv_wr     = qp->rq.max;
-        qp_attr->cap.max_send_sge    = qp->sq.max_gs;
-        qp_attr->cap.max_recv_sge    = qp->rq.max_gs;
-        qp_attr->cap.max_inline_data = qp->max_inline_data;
 
         if (qp->transport == RC || qp->transport == UC) {
                 to_ib_ah_attr(dev, &qp_attr->ah_attr, &context->pri_path);
@@ -495,7 +494,16 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
         qp_attr->retry_cnt          = (be32_to_cpu(context->params1) >> 16) & 0x7;
         qp_attr->rnr_retry          = context->pri_path.rnr_retry >> 5;
         qp_attr->alt_timeout        = context->alt_path.ackto >> 3;
-        qp_init_attr->cap           = qp_attr->cap;
+
+done:
+        qp_attr->cur_qp_state        = qp_attr->qp_state;
+        qp_attr->cap.max_send_wr     = qp->sq.max;
+        qp_attr->cap.max_recv_wr     = qp->rq.max;
+        qp_attr->cap.max_send_sge    = qp->sq.max_gs;
+        qp_attr->cap.max_recv_sge    = qp->rq.max_gs;
+        qp_attr->cap.max_inline_data = qp->max_inline_data;
+
+        qp_init_attr->cap            = qp_attr->cap;
 
 out:
         mthca_free_mailbox(dev, mailbox);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 9b2041e25d59..dd221eda3ea6 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -177,7 +177,7 @@ iscsi_iser_mtask_xmit(struct iscsi_conn *conn,
          * - if yes, the mtask is recycled at iscsi_complete_pdu
          * - if no,  the mtask is recycled at iser_snd_completion
          */
-        if (error && error != -EAGAIN)
+        if (error && error != -ENOBUFS)
                 iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
 
         return error;
@@ -241,7 +241,7 @@ iscsi_iser_ctask_xmit(struct iscsi_conn *conn,
                 error = iscsi_iser_ctask_xmit_unsol_data(conn, ctask);
 
  iscsi_iser_ctask_xmit_exit:
-        if (error && error != -EAGAIN)
+        if (error && error != -ENOBUFS)
                 iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
         return error;
 }
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index e73c87b9be43..0a7d1ab60e6d 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -304,18 +304,14 @@ int iser_conn_set_full_featured_mode(struct iscsi_conn *conn)
 static int
 iser_check_xmit(struct iscsi_conn *conn, void *task)
 {
-        int rc = 0;
         struct iscsi_iser_conn *iser_conn = conn->dd_data;
 
-        write_lock_bh(conn->recv_lock);
         if (atomic_read(&iser_conn->ib_conn->post_send_buf_count) ==
             ISER_QP_MAX_REQ_DTOS) {
-                iser_dbg("%ld can't xmit task %p, suspending tx\n",jiffies,task);
-                set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
-                rc = -EAGAIN;
+                iser_dbg("%ld can't xmit task %p\n",jiffies,task);
+                return -ENOBUFS;
         }
-        write_unlock_bh(conn->recv_lock);
-        return rc;
+        return 0;
 }
 
 
@@ -340,7 +336,7 @@ int iser_send_command(struct iscsi_conn     *conn,
                 return -EPERM;
         }
         if (iser_check_xmit(conn, ctask))
-                return -EAGAIN;
+                return -ENOBUFS;
 
         edtl = ntohl(hdr->data_length);
 
@@ -426,7 +422,7 @@ int iser_send_data_out(struct iscsi_conn     *conn,
         }
 
         if (iser_check_xmit(conn, ctask))
-                return -EAGAIN;
+                return -ENOBUFS;
 
         itt = ntohl(hdr->itt);
         data_seg_len = ntoh24(hdr->dlength);
@@ -498,7 +494,7 @@ int iser_send_control(struct iscsi_conn *conn,
         }
 
         if (iser_check_xmit(conn,mtask))
-                return -EAGAIN;
+                return -ENOBUFS;
 
         /* build the tx desc regd header and add it to the tx desc dto */
         mdesc->type = ISCSI_TX_CONTROL;
@@ -605,6 +601,7 @@ void iser_snd_completion(struct iser_desc *tx_desc)
         struct iscsi_iser_conn *iser_conn = ib_conn->iser_conn;
         struct iscsi_conn      *conn = iser_conn->iscsi_conn;
         struct iscsi_mgmt_task *mtask;
+        int resume_tx = 0;
 
         iser_dbg("Initiator, Data sent dto=0x%p\n", dto);
 
@@ -613,15 +610,16 @@ void iser_snd_completion(struct iser_desc *tx_desc)
         if (tx_desc->type == ISCSI_TX_DATAOUT)
                 kmem_cache_free(ig.desc_cache, tx_desc);
 
+        if (atomic_read(&iser_conn->ib_conn->post_send_buf_count) ==
+            ISER_QP_MAX_REQ_DTOS)
+                resume_tx = 1;
+
         atomic_dec(&ib_conn->post_send_buf_count);
 
-        write_lock(conn->recv_lock);
-        if (conn->suspend_tx) {
+        if (resume_tx) {
                 iser_dbg("%ld resuming tx\n",jiffies);
-                clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
                 scsi_queue_work(conn->session->host, &conn->xmitwork);
         }
-        write_unlock(conn->recv_lock);
 
         if (tx_desc->type == ISCSI_TX_CONTROL) {
                 /* this arithmetic is legal by libiscsi dd_data allocation */
diff --git a/drivers/mmc/at91_mci.c b/drivers/mmc/at91_mci.c
index 08a33c33f6ed..aa152f31851e 100644
--- a/drivers/mmc/at91_mci.c
+++ b/drivers/mmc/at91_mci.c
@@ -768,7 +768,7 @@ static irqreturn_t at91_mmc_det_irq(int irq, void *_host)
         return IRQ_HANDLED;
 }
 
-int at91_mci_get_ro(struct mmc_host *mmc)
+static int at91_mci_get_ro(struct mmc_host *mmc)
 {
         int read_only = 0;
         struct at91mci_host *host = mmc_priv(mmc);
@@ -794,7 +794,7 @@ static const struct mmc_host_ops at91_mci_ops = {
 /*
  * Probe for the device
  */
-static int at91_mci_probe(struct platform_device *pdev)
+static int __init at91_mci_probe(struct platform_device *pdev)
 {
         struct mmc_host *mmc;
         struct at91mci_host *host;
@@ -910,7 +910,7 @@ static int at91_mci_probe(struct platform_device *pdev)
 /*
  * Remove a device
  */
-static int at91_mci_remove(struct platform_device *pdev)
+static int __exit at91_mci_remove(struct platform_device *pdev)
 {
         struct mmc_host *mmc = platform_get_drvdata(pdev);
         struct at91mci_host *host;
@@ -972,8 +972,7 @@ static int at91_mci_resume(struct platform_device *pdev)
 #endif
 
 static struct platform_driver at91_mci_driver = {
-        .probe          = at91_mci_probe,
-        .remove         = at91_mci_remove,
+        .remove         = __exit_p(at91_mci_remove),
         .suspend        = at91_mci_suspend,
         .resume         = at91_mci_resume,
         .driver         = {
@@ -984,7 +983,7 @@ static struct platform_driver at91_mci_driver = {
 
 static int __init at91_mci_init(void)
 {
-        return platform_driver_register(&at91_mci_driver);
+        return platform_driver_probe(&at91_mci_driver, at91_mci_probe);
 }
 
 static void __exit at91_mci_exit(void)
diff --git a/drivers/mmc/mmci.c b/drivers/mmc/mmci.c
index e9b80e920266..ccfe6561be24 100644
--- a/drivers/mmc/mmci.c
+++ b/drivers/mmc/mmci.c
@@ -42,6 +42,8 @@ mmci_request_end(struct mmci_host *host, struct mmc_request *mrq)
 {
         writel(0, host->base + MMCICOMMAND);
 
+        BUG_ON(host->data);
+
         host->mrq = NULL;
         host->cmd = NULL;
 
@@ -198,6 +200,8 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
         }
 
         if (!cmd->data || cmd->error != MMC_ERR_NONE) {
+                if (host->data)
+                        mmci_stop_data(host);
                 mmci_request_end(host, cmd->mrq);
         } else if (!(cmd->data->flags & MMC_DATA_READ)) {
                 mmci_start_data(host, cmd->data);
diff --git a/drivers/mmc/omap.c b/drivers/mmc/omap.c
index 435d331e772a..9488408308fb 100644
--- a/drivers/mmc/omap.c
+++ b/drivers/mmc/omap.c
@@ -581,9 +581,9 @@ static void mmc_omap_switch_timer(unsigned long arg)
         schedule_work(&host->switch_work);
 }
 
-static void mmc_omap_switch_handler(void *data)
+static void mmc_omap_switch_handler(struct work_struct *work)
 {
-        struct mmc_omap_host *host = (struct mmc_omap_host *) data;
+        struct mmc_omap_host *host = container_of(work, struct mmc_omap_host, switch_work);
         struct mmc_card *card;
         static int complained = 0;
         int cards = 0, cover_open;
@@ -1116,7 +1116,7 @@ static int __init mmc_omap_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, host);
 
         if (host->switch_pin >= 0) {
-                INIT_WORK(&host->switch_work, mmc_omap_switch_handler, host);
+                INIT_WORK(&host->switch_work, mmc_omap_switch_handler);
                 init_timer(&host->switch_timer);
                 host->switch_timer.function = mmc_omap_switch_timer;
                 host->switch_timer.data = (unsigned long) host;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index ada5e9b9988c..ca5acc4736df 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -57,8 +57,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.2"
-#define DRV_MODULE_RELDATE      "December 13, 2006"
+#define DRV_MODULE_VERSION      "1.5.3"
+#define DRV_MODULE_RELDATE      "January 8, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -1345,8 +1345,6 @@ bnx2_init_copper_phy(struct bnx2 *bp)
 {
         u32 val;
 
-        bp->phy_flags |= PHY_CRC_FIX_FLAG;
-
         if (bp->phy_flags & PHY_CRC_FIX_FLAG) {
                 bnx2_write_phy(bp, 0x18, 0x0c00);
                 bnx2_write_phy(bp, 0x17, 0x000a);
@@ -3085,7 +3083,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 int buf_size)
 {
         u32 written, offset32, len32;
-        u8 *buf, start[4], end[4], *flash_buffer = NULL;
+        u8 *buf, start[4], end[4], *align_buf = NULL, *flash_buffer = NULL;
         int rc = 0;
         int align_start, align_end;
 
@@ -3113,16 +3111,17 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
         }
 
         if (align_start || align_end) {
-                buf = kmalloc(len32, GFP_KERNEL);
-                if (buf == NULL)
+                align_buf = kmalloc(len32, GFP_KERNEL);
+                if (align_buf == NULL)
                         return -ENOMEM;
                 if (align_start) {
-                        memcpy(buf, start, 4);
+                        memcpy(align_buf, start, 4);
                 }
                 if (align_end) {
-                        memcpy(buf + len32 - 4, end, 4);
+                        memcpy(align_buf + len32 - 4, end, 4);
                 }
-                memcpy(buf + align_start, data_buf, buf_size);
+                memcpy(align_buf + align_start, data_buf, buf_size);
+                buf = align_buf;
         }
 
         if (bp->flash_info->buffered == 0) {
@@ -3256,11 +3255,8 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
         }
 
 nvram_write_end:
-        if (bp->flash_info->buffered == 0)
-                kfree(flash_buffer);
-
-        if (align_start || align_end)
-                kfree(buf);
+        kfree(flash_buffer);
+        kfree(align_buf);
         return rc;
 }
 
@@ -5645,6 +5641,44 @@ poll_bnx2(struct net_device *dev)
 }
 #endif
 
+static void __devinit
+bnx2_get_5709_media(struct bnx2 *bp)
+{
+        u32 val = REG_RD(bp, BNX2_MISC_DUAL_MEDIA_CTRL);
+        u32 bond_id = val & BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID;
+        u32 strap;
+
+        if (bond_id == BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID_C)
+                return;
+        else if (bond_id == BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID_S) {
+                bp->phy_flags |= PHY_SERDES_FLAG;
+                return;
+        }
+
+        if (val & BNX2_MISC_DUAL_MEDIA_CTRL_STRAP_OVERRIDE)
+                strap = (val & BNX2_MISC_DUAL_MEDIA_CTRL_PHY_CTRL) >> 21;
+        else
+                strap = (val & BNX2_MISC_DUAL_MEDIA_CTRL_PHY_CTRL_STRAP) >> 8;
+
+        if (PCI_FUNC(bp->pdev->devfn) == 0) {
+                switch (strap) {
+                case 0x4:
+                case 0x5:
+                case 0x6:
+                        bp->phy_flags |= PHY_SERDES_FLAG;
+                        return;
+                }
+        } else {
+                switch (strap) {
+                case 0x1:
+                case 0x2:
+                case 0x4:
+                        bp->phy_flags |= PHY_SERDES_FLAG;
+                        return;
+                }
+        }
+}
+
 static int __devinit
 bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 {
@@ -5865,10 +5899,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->phy_addr = 1;
 
         /* Disable WOL support if we are running on a SERDES chip. */
-        if (CHIP_NUM(bp) == CHIP_NUM_5709) {
-                if (CHIP_BOND_ID(bp) != BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID_C)
-                        bp->phy_flags |= PHY_SERDES_FLAG;
-        } else if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT)
+        if (CHIP_NUM(bp) == CHIP_NUM_5709)
+                bnx2_get_5709_media(bp);
+        else if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT)
                 bp->phy_flags |= PHY_SERDES_FLAG;
 
         if (bp->phy_flags & PHY_SERDES_FLAG) {
@@ -5880,7 +5913,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                         if (reg & BNX2_SHARED_HW_CFG_PHY_2_5G)
                                 bp->phy_flags |= PHY_2_5G_CAPABLE_FLAG;
                 }
-        }
+        } else if (CHIP_NUM(bp) == CHIP_NUM_5706 ||
+                   CHIP_NUM(bp) == CHIP_NUM_5708)
+                bp->phy_flags |= PHY_CRC_FIX_FLAG;
 
         if ((CHIP_ID(bp) == CHIP_ID_5708_A0) ||
             (CHIP_ID(bp) == CHIP_ID_5708_B0) ||
diff --git a/drivers/net/chelsio/my3126.c b/drivers/net/chelsio/my3126.c
index c7731b6f9de3..82fed1dd5005 100644
--- a/drivers/net/chelsio/my3126.c
+++ b/drivers/net/chelsio/my3126.c
@@ -170,9 +170,10 @@ static struct cphy *my3126_phy_create(adapter_t *adapter,
 {
         struct cphy *cphy = kzalloc(sizeof (*cphy), GFP_KERNEL);
 
-        if (cphy)
-                cphy_init(cphy, adapter, phy_addr, &my3126_ops, mdio_ops);
+        if (!cphy)
+                return NULL;
 
+        cphy_init(cphy, adapter, phy_addr, &my3126_ops, mdio_ops);
         INIT_DELAYED_WORK(&cphy->phy_update, my3216_poll);
         cphy->bmsr = 0;
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4c1ff752048c..c6259c7127f6 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -995,12 +995,6 @@ e1000_probe(struct pci_dev *pdev,
            (adapter->hw.mac_type != e1000_82547))
                 netdev->features |= NETIF_F_TSO;
 
-#ifdef CONFIG_DEBUG_SLAB
-        /* 82544's work arounds do not play nicely with DEBUG SLAB */
-        if (adapter->hw.mac_type == e1000_82544)
-                netdev->features &= ~NETIF_F_TSO;
-#endif
-
 #ifdef NETIF_F_TSO6
         if (adapter->hw.mac_type > e1000_82547_rev_2)
                 netdev->features |= NETIF_F_TSO6;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 2f48fe9a29a7..93f2b7a22160 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -234,6 +234,7 @@ enum {
 #define NVREG_XMITCTL_HOST_SEMA_MASK    0x0000f000
 #define NVREG_XMITCTL_HOST_SEMA_ACQ     0x0000f000
 #define NVREG_XMITCTL_HOST_LOADED       0x00004000
+#define NVREG_XMITCTL_TX_PATH_EN        0x01000000
         NvRegTransmitterStatus = 0x088,
 #define NVREG_XMITSTAT_BUSY     0x01
 
@@ -249,6 +250,7 @@ enum {
 #define NVREG_OFFLOAD_NORMAL    RX_NIC_BUFSIZE
         NvRegReceiverControl = 0x094,
 #define NVREG_RCVCTL_START      0x01
+#define NVREG_RCVCTL_RX_PATH_EN 0x01000000
         NvRegReceiverStatus = 0x98,
 #define NVREG_RCVSTAT_BUSY      0x01
 
@@ -1169,16 +1171,21 @@ static void nv_start_rx(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 rx_ctrl = readl(base + NvRegReceiverControl);
 
         dprintk(KERN_DEBUG "%s: nv_start_rx\n", dev->name);
         /* Already running? Stop it. */
-        if (readl(base + NvRegReceiverControl) & NVREG_RCVCTL_START) {
-                writel(0, base + NvRegReceiverControl);
+        if ((readl(base + NvRegReceiverControl) & NVREG_RCVCTL_START) && !np->mac_in_use) {
+                rx_ctrl &= ~NVREG_RCVCTL_START;
+                writel(rx_ctrl, base + NvRegReceiverControl);
                 pci_push(base);
         }
         writel(np->linkspeed, base + NvRegLinkSpeed);
         pci_push(base);
-        writel(NVREG_RCVCTL_START, base + NvRegReceiverControl);
+        rx_ctrl |= NVREG_RCVCTL_START;
+        if (np->mac_in_use)
+                rx_ctrl &= ~NVREG_RCVCTL_RX_PATH_EN;
+        writel(rx_ctrl, base + NvRegReceiverControl);
         dprintk(KERN_DEBUG "%s: nv_start_rx to duplex %d, speed 0x%08x.\n",
                                 dev->name, np->duplex, np->linkspeed);
         pci_push(base);
@@ -1186,39 +1193,59 @@ static void nv_start_rx(struct net_device *dev)
 
 static void nv_stop_rx(struct net_device *dev)
 {
+        struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 rx_ctrl = readl(base + NvRegReceiverControl);
 
         dprintk(KERN_DEBUG "%s: nv_stop_rx\n", dev->name);
-        writel(0, base + NvRegReceiverControl);
+        if (!np->mac_in_use)
+                rx_ctrl &= ~NVREG_RCVCTL_START;
+        else
+                rx_ctrl |= NVREG_RCVCTL_RX_PATH_EN;
+        writel(rx_ctrl, base + NvRegReceiverControl);
         reg_delay(dev, NvRegReceiverStatus, NVREG_RCVSTAT_BUSY, 0,
                         NV_RXSTOP_DELAY1, NV_RXSTOP_DELAY1MAX,
                         KERN_INFO "nv_stop_rx: ReceiverStatus remained busy");
 
         udelay(NV_RXSTOP_DELAY2);
-        writel(0, base + NvRegLinkSpeed);
+        if (!np->mac_in_use)
+                writel(0, base + NvRegLinkSpeed);
 }
 
 static void nv_start_tx(struct net_device *dev)
 {
+        struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 tx_ctrl = readl(base + NvRegTransmitterControl);
 
         dprintk(KERN_DEBUG "%s: nv_start_tx\n", dev->name);
-        writel(NVREG_XMITCTL_START, base + NvRegTransmitterControl);
+        tx_ctrl |= NVREG_XMITCTL_START;
+        if (np->mac_in_use)
+                tx_ctrl &= ~NVREG_XMITCTL_TX_PATH_EN;
+        writel(tx_ctrl, base + NvRegTransmitterControl);
         pci_push(base);
 }
 
 static void nv_stop_tx(struct net_device *dev)
 {
+        struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 tx_ctrl = readl(base + NvRegTransmitterControl);
 
         dprintk(KERN_DEBUG "%s: nv_stop_tx\n", dev->name);
-        writel(0, base + NvRegTransmitterControl);
+        if (!np->mac_in_use)
+                tx_ctrl &= ~NVREG_XMITCTL_START;
+        else
+                tx_ctrl |= NVREG_XMITCTL_TX_PATH_EN;
+        writel(tx_ctrl, base + NvRegTransmitterControl);
         reg_delay(dev, NvRegTransmitterStatus, NVREG_XMITSTAT_BUSY, 0,
                         NV_TXSTOP_DELAY1, NV_TXSTOP_DELAY1MAX,
                         KERN_INFO "nv_stop_tx: TransmitterStatus remained busy");
 
         udelay(NV_TXSTOP_DELAY2);
-        writel(readl(base + NvRegTransmitPoll) & NVREG_TRANSMITPOLL_MAC_ADDR_REV, base + NvRegTransmitPoll);
+        if (!np->mac_in_use)
+                writel(readl(base + NvRegTransmitPoll) & NVREG_TRANSMITPOLL_MAC_ADDR_REV,
+                       base + NvRegTransmitPoll);
 }
 
 static void nv_txrx_reset(struct net_device *dev)
@@ -4148,20 +4175,6 @@ static int nv_mgmt_acquire_sema(struct net_device *dev)
         return 0;
 }
 
-/* Indicate to mgmt unit whether driver is loaded or not */
-static void nv_mgmt_driver_loaded(struct net_device *dev, int loaded)
-{
-        u8 __iomem *base = get_hwbase(dev);
-        u32 tx_ctrl;
-
-        tx_ctrl = readl(base + NvRegTransmitterControl);
-        if (loaded)
-                tx_ctrl |= NVREG_XMITCTL_HOST_LOADED;
-        else
-                tx_ctrl &= ~NVREG_XMITCTL_HOST_LOADED;
-        writel(tx_ctrl, base + NvRegTransmitterControl);
-}
-
 static int nv_open(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
@@ -4659,33 +4672,24 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         writel(NVREG_MIISTAT_MASK, base + NvRegMIIStatus);
 
         if (id->driver_data & DEV_HAS_MGMT_UNIT) {
-                writel(0x1, base + 0x204); pci_push(base);
-                msleep(500);
                 /* management unit running on the mac? */
-                np->mac_in_use = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_MGMT_ST;
-                if (np->mac_in_use) {
-                        u32 mgmt_sync;
-                        /* management unit setup the phy already? */
-                        mgmt_sync = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK;
-                        if (mgmt_sync == NVREG_XMITCTL_SYNC_NOT_READY) {
-                                if (!nv_mgmt_acquire_sema(dev)) {
-                                        for (i = 0; i < 5000; i++) {
-                                                msleep(1);
-                                                mgmt_sync = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK;
-                                                if (mgmt_sync == NVREG_XMITCTL_SYNC_NOT_READY)
-                                                        continue;
-                                                if (mgmt_sync == NVREG_XMITCTL_SYNC_PHY_INIT)
-                                                        phyinitialized = 1;
-                                                break;
+                if (readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_PHY_INIT) {
+                        np->mac_in_use = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_MGMT_ST;
+                        dprintk(KERN_INFO "%s: mgmt unit is running. mac in use %x.\n", pci_name(pci_dev), np->mac_in_use);
+                        for (i = 0; i < 5000; i++) {
+                                msleep(1);
+                                if (nv_mgmt_acquire_sema(dev)) {
+                                        /* management unit setup the phy already? */
+                                        if ((readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK) ==
+                                            NVREG_XMITCTL_SYNC_PHY_INIT) {
+                                                /* phy is inited by mgmt unit */
+                                                phyinitialized = 1;
+                                                dprintk(KERN_INFO "%s: Phy already initialized by mgmt unit.\n", pci_name(pci_dev));
+                                        } else {
+                                                /* we need to init the phy */
                                         }
-                                } else {
-                                        /* we need to init the phy */
+                                        break;
                                 }
-                        } else if (mgmt_sync == NVREG_XMITCTL_SYNC_PHY_INIT) {
-                                /* phy is inited by SMU */
-                                phyinitialized = 1;
-                        } else {
-                                /* we need to init the phy */
                         }
                 }
         }
@@ -4724,10 +4728,12 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         if (!phyinitialized) {
                 /* reset it */
                 phy_init(dev);
-        }
-
-        if (id->driver_data & DEV_HAS_MGMT_UNIT) {
-                nv_mgmt_driver_loaded(dev, 1);
+        } else {
+                /* see if it is a gigabit phy */
+                u32 mii_status = mii_rw(dev, np->phyaddr, MII_BMSR, MII_READ);
+                if (mii_status & PHY_GIGABIT) {
+                        np->gigabit = PHY_GIGABIT;
+                }
         }
 
         /* set default link speed settings */
@@ -4749,8 +4755,6 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 out_error:
         if (phystate_orig)
                 writel(phystate|NVREG_ADAPTCTL_RUNNING, base + NvRegAdapterControl);
-        if (np->mac_in_use)
-                nv_mgmt_driver_loaded(dev, 0);
         pci_set_drvdata(pci_dev, NULL);
 out_freering:
         free_rings(dev);
@@ -4780,9 +4784,6 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
         writel(np->orig_mac[0], base + NvRegMacAddrA);
         writel(np->orig_mac[1], base + NvRegMacAddrB);
 
-        if (np->mac_in_use)
-                nv_mgmt_driver_loaded(dev, 0);
-
         /* free all structures */
         free_rings(dev);
         iounmap(get_hwbase(dev));
diff --git a/drivers/net/ixgb/ixgb.h b/drivers/net/ixgb/ixgb.h
index 50ffe90488ff..f4aba4355b19 100644
--- a/drivers/net/ixgb/ixgb.h
+++ b/drivers/net/ixgb/ixgb.h
@@ -171,6 +171,7 @@ struct ixgb_adapter {
 
         /* TX */
         struct ixgb_desc_ring tx_ring ____cacheline_aligned_in_smp;
+        unsigned int restart_queue;
         unsigned long timeo_start;
         uint32_t tx_cmd_type;
         uint64_t hw_csum_tx_good;
diff --git a/drivers/net/ixgb/ixgb_ethtool.c b/drivers/net/ixgb/ixgb_ethtool.c
index cd22523fb035..82c044d6e08a 100644
--- a/drivers/net/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ixgb/ixgb_ethtool.c
@@ -79,6 +79,7 @@ static struct ixgb_stats ixgb_gstrings_stats[] = {
         {"tx_window_errors", IXGB_STAT(net_stats.tx_window_errors)},
         {"tx_deferred_ok", IXGB_STAT(stats.dc)},
         {"tx_timeout_count", IXGB_STAT(tx_timeout_count) },
+        {"tx_restart_queue", IXGB_STAT(restart_queue) },
         {"rx_long_length_errors", IXGB_STAT(stats.roc)},
         {"rx_short_length_errors", IXGB_STAT(stats.ruc)},
 #ifdef NETIF_F_TSO
diff --git a/drivers/net/ixgb/ixgb_hw.c b/drivers/net/ixgb/ixgb_hw.c
index 02089b64e42c..ecbf45861c68 100644
--- a/drivers/net/ixgb/ixgb_hw.c
+++ b/drivers/net/ixgb/ixgb_hw.c
@@ -399,8 +399,9 @@ ixgb_init_rx_addrs(struct ixgb_hw *hw)
         /* Zero out the other 15 receive addresses. */
         DEBUGOUT("Clearing RAR[1-15]\n");
         for(i = 1; i < IXGB_RAR_ENTRIES; i++) {
-                IXGB_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
+                /* Write high reg first to disable the AV bit first */
                 IXGB_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0);
+                IXGB_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
         }
 
         return;
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index e628126c9c49..a083a9189230 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -36,7 +36,7 @@ static char ixgb_driver_string[] = "Intel(R) PRO/10GbE Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION             "1.0.117-k2"DRIVERNAPI
+#define DRV_VERSION             "1.0.126-k2"DRIVERNAPI
 char ixgb_driver_version[] = DRV_VERSION;
 static char ixgb_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -1287,6 +1287,7 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
         struct ixgb_buffer *buffer_info;
         int len = skb->len;
         unsigned int offset = 0, size, count = 0, i;
+        unsigned int mss = skb_shinfo(skb)->gso_size;
 
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int f;
@@ -1298,6 +1299,11 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
         while(len) {
                 buffer_info = &tx_ring->buffer_info[i];
                 size = min(len, IXGB_MAX_DATA_PER_TXD);
+                /* Workaround for premature desc write-backs
+                 * in TSO mode.  Append 4-byte sentinel desc */
+                if (unlikely(mss && !nr_frags && size == len && size > 8))
+                        size -= 4;
+
                 buffer_info->length = size;
                 WARN_ON(buffer_info->dma != 0);
                 buffer_info->dma =
@@ -1324,6 +1330,13 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
                 while(len) {
                         buffer_info = &tx_ring->buffer_info[i];
                         size = min(len, IXGB_MAX_DATA_PER_TXD);
+
+                        /* Workaround for premature desc write-backs
+                         * in TSO mode.  Append 4-byte sentinel desc */
+                        if (unlikely(mss && !nr_frags && size == len
+                                     && size > 8))
+                                size -= 4;
+
                         buffer_info->length = size;
                         buffer_info->dma =
                                 pci_map_page(adapter->pdev,
@@ -1398,11 +1411,43 @@ ixgb_tx_queue(struct ixgb_adapter *adapter, int count, int vlan_id,int tx_flags)
         IXGB_WRITE_REG(&adapter->hw, TDT, i);
 }
 
+static int __ixgb_maybe_stop_tx(struct net_device *netdev, int size)
+{
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
+        struct ixgb_desc_ring *tx_ring = &adapter->tx_ring;
+
+        netif_stop_queue(netdev);
+        /* Herbert's original patch had:
+         *  smp_mb__after_netif_stop_queue();
+         * but since that doesn't exist yet, just open code it. */
+        smp_mb();
+
+        /* We need to check again in a case another CPU has just
+         * made room available. */
+        if (likely(IXGB_DESC_UNUSED(tx_ring) < size))
+                return -EBUSY;
+
+        /* A reprieve! */
+        netif_start_queue(netdev);
+        ++adapter->restart_queue;
+        return 0;
+}
+
+static int ixgb_maybe_stop_tx(struct net_device *netdev,
+                              struct ixgb_desc_ring *tx_ring, int size)
+{
+        if (likely(IXGB_DESC_UNUSED(tx_ring) >= size))
+                return 0;
+        return __ixgb_maybe_stop_tx(netdev, size);
+}
+
+
 /* Tx Descriptors needed, worst case */
 #define TXD_USE_COUNT(S) (((S) >> IXGB_MAX_TXD_PWR) + \
                          (((S) & (IXGB_MAX_DATA_PER_TXD - 1)) ? 1 : 0))
-#define DESC_NEEDED TXD_USE_COUNT(IXGB_MAX_DATA_PER_TXD) + \
-        MAX_SKB_FRAGS * TXD_USE_COUNT(PAGE_SIZE) + 1
+#define DESC_NEEDED TXD_USE_COUNT(IXGB_MAX_DATA_PER_TXD) /* skb->date */ + \
+        MAX_SKB_FRAGS * TXD_USE_COUNT(PAGE_SIZE) + 1 /* for context */ \
+        + 1 /* one more needed for sentinel TSO workaround */
 
 static int
 ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
@@ -1430,7 +1475,8 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         spin_lock_irqsave(&adapter->tx_lock, flags);
 #endif
 
-        if(unlikely(IXGB_DESC_UNUSED(&adapter->tx_ring) < DESC_NEEDED)) {
+        if (unlikely(ixgb_maybe_stop_tx(netdev, &adapter->tx_ring,
+                     DESC_NEEDED))) {
                 netif_stop_queue(netdev);
                 spin_unlock_irqrestore(&adapter->tx_lock, flags);
                 return NETDEV_TX_BUSY;
@@ -1468,8 +1514,7 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
 #ifdef NETIF_F_LLTX
         /* Make sure there is space in the ring for the next send. */
-        if(unlikely(IXGB_DESC_UNUSED(&adapter->tx_ring) < DESC_NEEDED))
-                netif_stop_queue(netdev);
+        ixgb_maybe_stop_tx(netdev, &adapter->tx_ring, DESC_NEEDED);
 
         spin_unlock_irqrestore(&adapter->tx_lock, flags);
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 2b1238e2dbdb..d88e9b2e93cf 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1617,6 +1617,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FastEther PCC-TX", 0x5261440f, 0x485e85d9),
         PCMCIA_DEVICE_PROD_ID12("Corega,K.K.", "Ethernet LAN Card", 0x110d26d9, 0x9fd2f0a2),
         PCMCIA_DEVICE_PROD_ID12("corega,K.K.", "Ethernet LAN Card", 0x9791a90e, 0x9fd2f0a2),
+        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "(CG-LAPCCTXD)", 0x5261440f, 0x73ec0d88),
         PCMCIA_DEVICE_PROD_ID12("CouplerlessPCMCIA", "100BASE", 0xee5af0ad, 0x7c2add04),
         PCMCIA_DEVICE_PROD_ID12("CyQ've", "ELA-010", 0x77008979, 0x9d8d445d),
         PCMCIA_DEVICE_PROD_ID12("CyQ've", "ELA-110E 10/100M LAN Card", 0x77008979, 0xfd184814),
@@ -1667,6 +1668,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN100TX", 0x88fcdeda, 0x6d772737),
         PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN100TE", 0x88fcdeda, 0x0e714bee),
         PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN20T", 0x88fcdeda, 0x81090922),
+        PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN10TE", 0x88fcdeda, 0xc1e2521c),
         PCMCIA_DEVICE_PROD_ID12("LONGSHINE", "PCMCIA Ethernet Card", 0xf866b0b0, 0x6f6652e0),
         PCMCIA_DEVICE_PROD_ID12("MACNICA", "ME1-JEIDA", 0x20841b68, 0xaf8a3578),
         PCMCIA_DEVICE_PROD_ID12("Macsense", "MPC-10", 0xd830297f, 0xd265c307),
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index d79d141a601d..8844c20eac2d 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -208,6 +208,15 @@ static void ql_write_common_reg(struct ql3_adapter *qdev,
         return;
 }
 
+static void ql_write_nvram_reg(struct ql3_adapter *qdev,
+                                u32 __iomem *reg, u32 value)
+{
+        writel(value, reg);
+        readl(reg);
+        udelay(1);
+        return;
+}
+
 static void ql_write_page0_reg(struct ql3_adapter *qdev,
                                u32 __iomem *reg, u32 value)
 {
@@ -336,9 +345,9 @@ static void fm93c56a_select(struct ql3_adapter *qdev)
                         qdev->mem_map_registers;
 
         qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1;
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
 }
 
@@ -355,14 +364,14 @@ static void fm93c56a_cmd(struct ql3_adapter *qdev, u32 cmd, u32 eepromAddr)
                         qdev->mem_map_registers;
 
         /* Clock in a zero, then do the start bit */
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->eeprom_cmd_data |
                             AUBURN_EEPROM_DO_1);
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->
                             eeprom_cmd_data | AUBURN_EEPROM_DO_1 |
                             AUBURN_EEPROM_CLK_RISE);
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->
                             eeprom_cmd_data | AUBURN_EEPROM_DO_1 |
                             AUBURN_EEPROM_CLK_FALL);
@@ -378,20 +387,20 @@ static void fm93c56a_cmd(struct ql3_adapter *qdev, u32 cmd, u32 eepromAddr)
                          * If the bit changed, then change the DO state to
                          * match
                          */
-                        ql_write_common_reg(qdev,
+                        ql_write_nvram_reg(qdev,
                                             &port_regs->CommonRegs.
                                             serialPortInterfaceReg,
                                             ISP_NVRAM_MASK | qdev->
                                             eeprom_cmd_data | dataBit);
                         previousBit = dataBit;
                 }
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
                                     eeprom_cmd_data | dataBit |
                                     AUBURN_EEPROM_CLK_RISE);
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
@@ -412,20 +421,20 @@ static void fm93c56a_cmd(struct ql3_adapter *qdev, u32 cmd, u32 eepromAddr)
                          * If the bit changed, then change the DO state to
                          * match
                          */
-                        ql_write_common_reg(qdev,
+                        ql_write_nvram_reg(qdev,
                                             &port_regs->CommonRegs.
                                             serialPortInterfaceReg,
                                             ISP_NVRAM_MASK | qdev->
                                             eeprom_cmd_data | dataBit);
                         previousBit = dataBit;
                 }
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
                                     eeprom_cmd_data | dataBit |
                                     AUBURN_EEPROM_CLK_RISE);
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
@@ -443,7 +452,7 @@ static void fm93c56a_deselect(struct ql3_adapter *qdev)
         struct ql3xxx_port_registers __iomem *port_regs =
                         qdev->mem_map_registers;
         qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_0;
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
 }
 
@@ -461,12 +470,12 @@ static void fm93c56a_datain(struct ql3_adapter *qdev, unsigned short *value)
         /* Read the data bits */
         /* The first bit is a dummy.  Clock right over it. */
         for (i = 0; i < dataBits; i++) {
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->eeprom_cmd_data |
                                     AUBURN_EEPROM_CLK_RISE);
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->eeprom_cmd_data |
@@ -3370,7 +3379,6 @@ static int __devinit ql3xxx_probe(struct pci_dev *pdev,
         SET_MODULE_OWNER(ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
 
-        ndev->features = NETIF_F_LLTX;
         if (pci_using_dac)
                 ndev->features |= NETIF_F_HIGHDMA;
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 4056ba1ff3c7..f4bf62c2a7a5 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.71"
-#define DRV_MODULE_RELDATE      "December 15, 2006"
+#define DRV_MODULE_VERSION      "3.72"
+#define DRV_MODULE_RELDATE      "January 8, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1015,7 +1015,12 @@ out:
         else if (tp->tg3_flags2 & TG3_FLG2_PHY_JITTER_BUG) {
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0c00);
                 tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
-                tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
+                if (tp->tg3_flags2 & TG3_FLG2_PHY_ADJUST_TRIM) {
+                        tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x110b);
+                        tg3_writephy(tp, MII_TG3_TEST1,
+                                     MII_TG3_TEST1_TRIM_EN | 0x4);
+                } else
+                        tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0400);
         }
         /* Set Extended packet length bit (bit 14) on all chips that */
@@ -10803,9 +10808,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 
         if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755 ||
-                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787)
+                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787) {
                         tp->tg3_flags2 |= TG3_FLG2_PHY_JITTER_BUG;
-                else if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
+                        if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5755M)
+                                tp->tg3_flags2 |= TG3_FLG2_PHY_ADJUST_TRIM;
+                } else if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
                         tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
         }
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index cf78a7e5997b..80f59ac7ec58 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1658,6 +1658,9 @@
 #define MII_TG3_EPHY_TEST               0x1f /* 5906 PHY register */
 #define MII_TG3_EPHY_SHADOW_EN          0x80
 
+#define MII_TG3_TEST1                   0x1e
+#define MII_TG3_TEST1_TRIM_EN           0x0010
+
 /* There are two ways to manage the TX descriptors on the tigon3.
  * Either the descriptors are in host DMA'able memory, or they
  * exist only in the cards on-chip SRAM.  All 16 send bds are under
@@ -2256,6 +2259,7 @@ struct tg3 {
 #define TG3_FLG2_1SHOT_MSI              0x10000000
 #define TG3_FLG2_PHY_JITTER_BUG         0x20000000
 #define TG3_FLG2_NO_FWARE_REPORTED      0x40000000
+#define TG3_FLG2_PHY_ADJUST_TRIM        0x80000000
 
         u32                             split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ         3
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index 0e94fbbf7a94..b85857a84870 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -2664,7 +2664,7 @@ static void __ipw2100_rx_process(struct ipw2100_priv *priv)
                                 break;
                         }
 #endif
-                        if (stats.len < sizeof(u->rx_data.header))
+                        if (stats.len < sizeof(struct ieee80211_hdr_3addr))
                                 break;
                         switch (WLAN_FC_GET_TYPE(u->rx_data.header.frame_ctl)) {
                         case IEEE80211_FTYPE_MGMT:
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8f0322d6f3bf..0535efc4f184 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1117,10 +1117,11 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_ICH6_1,	asus_h
 static void quirk_sis_96x_smbus(struct pci_dev *dev)
 {
         u8 val = 0;
-        printk(KERN_INFO "Enabling SiS 96x SMBus.\n");
-        pci_read_config_byte(dev, 0x77, &val);
-        pci_write_config_byte(dev, 0x77, val & ~0x10);
         pci_read_config_byte(dev, 0x77, &val);
+        if (val & 0x10) {
+                printk(KERN_INFO "Enabling SiS 96x SMBus.\n");
+                pci_write_config_byte(dev, 0x77, val & ~0x10);
+        }
 }
 
 /*
@@ -1152,11 +1153,12 @@ static void quirk_sis_503(struct pci_dev *dev)
         printk(KERN_WARNING "Uncovering SIS%x that hid as a SIS503 (compatible=%d)\n", devid, sis_96x_compatible);
 
         /*
-         * Ok, it now shows up as a 96x.. The 96x quirks are after
-         * the 503 quirk in the quirk table, so they'll automatically
-         * run and enable things like the SMBus device
+         * Ok, it now shows up as a 96x.. run the 96x quirk by
+         * hand in case it has already been processed.
+         * (depends on link order, which is apparently not guaranteed)
          */
         dev->device = devid;
+        quirk_sis_96x_smbus(dev);
 }
 
 static void __init quirk_sis_96x_compatible(struct pci_dev *dev)
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 1678b6c757ec..a420cd099041 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -117,7 +117,7 @@ vmcp_write(struct file *file, const char __user * buff, size_t count,
                 return -ENOMEM;
         }
         debug_text_event(vmcp_debug, 1, cmd);
-        session->resp_size = __cpcmd(cmd, session->response,
+        session->resp_size = cpcmd(cmd, session->response,
                                      session->bufsize,
                                      &session->resp_code);
         up(&session->mutex);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index b471ac4a1bf6..ae1bf231d089 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -880,19 +880,15 @@ static void cio_reset_pgm_check_handler(void)
 static int stsch_reset(struct subchannel_id schid, volatile struct schib *addr)
 {
         int rc;
-        register struct subchannel_id reg1 asm ("1") = schid;
 
         pgm_check_occured = 0;
         s390_reset_pgm_handler = cio_reset_pgm_check_handler;
+        rc = stsch(schid, addr);
+        s390_reset_pgm_handler = NULL;
 
-        asm volatile(
-                "       stsch   0(%2)\n"
-                "       ipm     %0\n"
-                "       srl     %0,28"
-                : "=d" (rc)
-                : "d" (reg1), "a" (addr), "m" (*addr) : "memory", "cc");
+        /* The program check handler could have changed pgm_check_occured */
+        barrier();
 
-        s390_reset_pgm_handler = NULL;
         if (pgm_check_occured)
                 return -EIO;
         else
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 1a93fa684e9f..52625153a4f0 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -27,10 +27,7 @@ config IUCV
         help
           Select this option if you want to use inter-user communication
           under VM or VIF. If unsure, say "Y" to enable a fast communication
-          link between VM guests. At boot time the user ID of the guest needs
-          to be passed to the kernel. Note that both kernels need to be
-          compiled with this option and both need to be booted with the user ID
-          of the other VM guest.
+          link between VM guests.
 
 config NETIUCV
         tristate "IUCV network device support (VM only)"
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 53c358c7d368..e95c281f1e36 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -710,7 +710,7 @@ struct qeth_reply {
         int (*callback)(struct qeth_card *,struct qeth_reply *,unsigned long);
         u32 seqno;
         unsigned long offset;
-        int received;
+        atomic_t received;
         int rc;
         void *param;
         struct qeth_card *card;
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 2bde4f1fb9c2..d2efa5ff125d 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -471,7 +471,7 @@ qeth_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
             channel->state == CH_STATE_UP)
                 qeth_issue_next_read(card);
 
-        tasklet_schedule(&channel->irq_tasklet);
+        qeth_irq_tasklet((unsigned long)channel);
         return;
 out:
         wake_up(&card->wait_q);
@@ -951,40 +951,6 @@ qeth_do_run_thread(struct qeth_card *card, unsigned long thread)
 }
 
 static int
-qeth_register_ip_addresses(void *ptr)
-{
-        struct qeth_card *card;
-
-        card = (struct qeth_card *) ptr;
-        daemonize("qeth_reg_ip");
-        QETH_DBF_TEXT(trace,4,"regipth1");
-        if (!qeth_do_run_thread(card, QETH_SET_IP_THREAD))
-                return 0;
-        QETH_DBF_TEXT(trace,4,"regipth2");
-        qeth_set_ip_addr_list(card);
-        qeth_clear_thread_running_bit(card, QETH_SET_IP_THREAD);
-        return 0;
-}
-
-/*
- * Drive the SET_PROMISC_MODE thread
- */
-static int
-qeth_set_promisc_mode(void *ptr)
-{
-        struct qeth_card *card = (struct qeth_card *) ptr;
-
-        daemonize("qeth_setprm");
-        QETH_DBF_TEXT(trace,4,"setprm1");
-        if (!qeth_do_run_thread(card, QETH_SET_PROMISC_MODE_THREAD))
-                return 0;
-        QETH_DBF_TEXT(trace,4,"setprm2");
-        qeth_setadp_promisc_mode(card);
-        qeth_clear_thread_running_bit(card, QETH_SET_PROMISC_MODE_THREAD);
-        return 0;
-}
-
-static int
 qeth_recover(void *ptr)
 {
         struct qeth_card *card;
@@ -1047,11 +1013,6 @@ qeth_start_kernel_thread(struct work_struct *work)
         if (card->read.state != CH_STATE_UP &&
             card->write.state != CH_STATE_UP)
                 return;
-
-        if (qeth_do_start_thread(card, QETH_SET_IP_THREAD))
-                kernel_thread(qeth_register_ip_addresses, (void *)card,SIGCHLD);
-        if (qeth_do_start_thread(card, QETH_SET_PROMISC_MODE_THREAD))
-                kernel_thread(qeth_set_promisc_mode, (void *)card, SIGCHLD);
         if (qeth_do_start_thread(card, QETH_RECOVER_THREAD))
                 kernel_thread(qeth_recover, (void *) card, SIGCHLD);
 }
@@ -1074,7 +1035,7 @@ qeth_set_intial_options(struct qeth_card *card)
                 card->options.layer2 = 1;
         else
                 card->options.layer2 = 0;
-        card->options.performance_stats = 1;
+        card->options.performance_stats = 0;
 }
 
 /**
@@ -1613,8 +1574,6 @@ qeth_issue_next_read(struct qeth_card *card)
                 return -ENOMEM;
         }
         qeth_setup_ccw(&card->read, iob->data, QETH_BUFSIZE);
-        wait_event(card->wait_q,
-                   atomic_cmpxchg(&card->read.irq_pending, 0, 1) == 0);
         QETH_DBF_TEXT(trace, 6, "noirqpnd");
         rc = ccw_device_start(card->read.ccwdev, &card->read.ccw,
                               (addr_t) iob, 0, 0);
@@ -1635,6 +1594,7 @@ qeth_alloc_reply(struct qeth_card *card)
         reply = kzalloc(sizeof(struct qeth_reply), GFP_ATOMIC);
         if (reply){
                 atomic_set(&reply->refcnt, 1);
+                atomic_set(&reply->received, 0);
                 reply->card = card;
         };
         return reply;
@@ -1655,31 +1615,6 @@ qeth_put_reply(struct qeth_reply *reply)
                 kfree(reply);
 }
 
-static void
-qeth_cmd_timeout(unsigned long data)
-{
-        struct qeth_reply *reply, *list_reply, *r;
-        unsigned long flags;
-
-        reply = (struct qeth_reply *) data;
-        spin_lock_irqsave(&reply->card->lock, flags);
-        list_for_each_entry_safe(list_reply, r,
-                                 &reply->card->cmd_waiter_list, list) {
-                if (reply == list_reply){
-                        qeth_get_reply(reply);
-                        list_del_init(&reply->list);
-                        spin_unlock_irqrestore(&reply->card->lock, flags);
-                        reply->rc = -ETIME;
-                        reply->received = 1;
-                        wake_up(&reply->wait_q);
-                        qeth_put_reply(reply);
-                        return;
-                }
-        }
-        spin_unlock_irqrestore(&reply->card->lock, flags);
-}
-
-
 static struct qeth_ipa_cmd *
 qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
 {
@@ -1745,7 +1680,7 @@ qeth_clear_ipacmd_list(struct qeth_card *card)
         list_for_each_entry_safe(reply, r, &card->cmd_waiter_list, list) {
                 qeth_get_reply(reply);
                 reply->rc = -EIO;
-                reply->received = 1;
+                atomic_inc(&reply->received);
                 list_del_init(&reply->list);
                 wake_up(&reply->wait_q);
                 qeth_put_reply(reply);
@@ -1814,7 +1749,7 @@ qeth_send_control_data_cb(struct qeth_channel *channel,
                                               &card->cmd_waiter_list);
                                 spin_unlock_irqrestore(&card->lock, flags);
                         } else {
-                                reply->received = 1;
+                                atomic_inc(&reply->received);
                                 wake_up(&reply->wait_q);
                         }
                         qeth_put_reply(reply);
@@ -1858,7 +1793,7 @@ qeth_send_control_data(struct qeth_card *card, int len,
         int rc;
         unsigned long flags;
         struct qeth_reply *reply = NULL;
-        struct timer_list timer;
+        unsigned long timeout;
 
         QETH_DBF_TEXT(trace, 2, "sendctl");
 
@@ -1873,21 +1808,20 @@ qeth_send_control_data(struct qeth_card *card, int len,
                 reply->seqno = QETH_IDX_COMMAND_SEQNO;
         else
                 reply->seqno = card->seqno.ipa++;
-        init_timer(&timer);
-        timer.function = qeth_cmd_timeout;
-        timer.data = (unsigned long) reply;
         init_waitqueue_head(&reply->wait_q);
         spin_lock_irqsave(&card->lock, flags);
         list_add_tail(&reply->list, &card->cmd_waiter_list);
         spin_unlock_irqrestore(&card->lock, flags);
         QETH_DBF_HEX(control, 2, iob->data, QETH_DBF_CONTROL_LEN);
-        wait_event(card->wait_q,
-                   atomic_cmpxchg(&card->write.irq_pending, 0, 1) == 0);
+
+        while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ;
         qeth_prepare_control_data(card, len, iob);
+
         if (IS_IPA(iob->data))
-                timer.expires = jiffies + QETH_IPA_TIMEOUT;
+                timeout = jiffies + QETH_IPA_TIMEOUT;
         else
-                timer.expires = jiffies + QETH_TIMEOUT;
+                timeout = jiffies + QETH_TIMEOUT;
+
         QETH_DBF_TEXT(trace, 6, "noirqpnd");
         spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags);
         rc = ccw_device_start(card->write.ccwdev, &card->write.ccw,
@@ -1906,9 +1840,16 @@ qeth_send_control_data(struct qeth_card *card, int len,
                 wake_up(&card->wait_q);
                 return rc;
         }
-        add_timer(&timer);
-        wait_event(reply->wait_q, reply->received);
-        del_timer_sync(&timer);
+        while (!atomic_read(&reply->received)) {
+                if (time_after(jiffies, timeout)) {
+                        spin_lock_irqsave(&reply->card->lock, flags);
+                        list_del_init(&reply->list);
+                        spin_unlock_irqrestore(&reply->card->lock, flags);
+                        reply->rc = -ETIME;
+                        atomic_inc(&reply->received);
+                        wake_up(&reply->wait_q);
+                }
+        };
         rc = reply->rc;
         qeth_put_reply(reply);
         return rc;
@@ -2466,32 +2407,17 @@ qeth_rebuild_skb_fake_ll(struct qeth_card *card, struct sk_buff *skb,
                 qeth_rebuild_skb_fake_ll_eth(card, skb, hdr);
 }
 
-static inline __u16
+static inline void
 qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                         struct qeth_hdr *hdr)
 {
-        unsigned short vlan_id = 0;
-#ifdef CONFIG_QETH_VLAN
-        struct vlan_hdr *vhdr;
-#endif
-
         skb->pkt_type = PACKET_HOST;
         skb->protocol = qeth_type_trans(skb, skb->dev);
         if (card->options.checksum_type == NO_CHECKSUMMING)
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
                 skb->ip_summed = CHECKSUM_NONE;
-#ifdef CONFIG_QETH_VLAN
-        if (hdr->hdr.l2.flags[2] & (QETH_LAYER2_FLAG_VLAN)) {
-                vhdr = (struct vlan_hdr *) skb->data;
-                skb->protocol =
-                        __constant_htons(vhdr->h_vlan_encapsulated_proto);
-                vlan_id = hdr->hdr.l2.vlan_id;
-                skb_pull(skb, VLAN_HLEN);
-        }
-#endif
         *((__u32 *)skb->cb) = ++card->seqno.pkt_seqno;
-        return vlan_id;
 }
 
 static inline __u16
@@ -2560,7 +2486,6 @@ qeth_process_inbound_buffer(struct qeth_card *card,
         int offset;
         int rxrc;
         __u16 vlan_tag = 0;
-        __u16 *vlan_addr;
 
         /* get first element of current buffer */
         element = (struct qdio_buffer_element *)&buf->buffer->element[0];
@@ -2571,7 +2496,7 @@ qeth_process_inbound_buffer(struct qeth_card *card,
                                        &offset, &hdr))) {
                 skb->dev = card->dev;
                 if (hdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2)
-                        vlan_tag = qeth_layer2_rebuild_skb(card, skb, hdr);
+                        qeth_layer2_rebuild_skb(card, skb, hdr);
                 else if (hdr->hdr.l3.id == QETH_HEADER_TYPE_LAYER3)
                         vlan_tag = qeth_rebuild_skb(card, skb, hdr);
                 else { /*in case of OSN*/
@@ -3968,13 +3893,22 @@ static inline struct sk_buff *
 qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb,
                  struct qeth_hdr **hdr, int ipv)
 {
-        struct sk_buff *new_skb;
+        struct sk_buff *new_skb, *new_skb2;
         
         QETH_DBF_TEXT(trace, 6, "prepskb");
-
-        new_skb = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
-        if (new_skb == NULL)
+        new_skb = skb;
+        new_skb = qeth_pskb_unshare(skb, GFP_ATOMIC);
+        if (!new_skb)
+                return NULL;
+        new_skb2 = qeth_realloc_headroom(card, new_skb,
+                                         sizeof(struct qeth_hdr));
+        if (!new_skb2) {
+                __qeth_free_new_skb(skb, new_skb);
                 return NULL;
+        }
+        if (new_skb != skb)
+                __qeth_free_new_skb(new_skb2, new_skb);
+        new_skb = new_skb2;
         *hdr = __qeth_prepare_skb(card, new_skb, ipv);
         if (*hdr == NULL) {
                 __qeth_free_new_skb(skb, new_skb);
@@ -4844,9 +4778,11 @@ qeth_arp_query(struct qeth_card *card, char __user *udata)
                            "(0x%x/%d)\n",
                            QETH_CARD_IFNAME(card), qeth_arp_get_error_cause(&rc),
                            tmp, tmp);
-                copy_to_user(udata, qinfo.udata, 4);
+                if (copy_to_user(udata, qinfo.udata, 4))
+                        rc = -EFAULT;
         } else {
-                copy_to_user(udata, qinfo.udata, qinfo.udata_len);
+                if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
+                        rc = -EFAULT;
         }
         kfree(qinfo.udata);
         return rc;
@@ -4992,8 +4928,10 @@ qeth_snmp_command(struct qeth_card *card, char __user *udata)
         if (rc)
                 PRINT_WARN("SNMP command failed on %s: (0x%x)\n",
                            QETH_CARD_IFNAME(card), rc);
-         else
-                copy_to_user(udata, qinfo.udata, qinfo.udata_len);
+        else {
+                if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
+                        rc = -EFAULT;
+        }
 
         kfree(ureq);
         kfree(qinfo.udata);
@@ -5544,12 +5482,10 @@ qeth_set_multicast_list(struct net_device *dev)
         qeth_add_multicast_ipv6(card);
 #endif
 out:
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
         if (!qeth_adp_supported(card, IPA_SETADP_SET_PROMISC_MODE))
                 return;
-        if (qeth_set_thread_start_bit(card, QETH_SET_PROMISC_MODE_THREAD)==0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_setadp_promisc_mode(card);
 }
 
 static int
@@ -6351,6 +6287,42 @@ static struct ethtool_ops qeth_ethtool_ops = {
 };
 
 static int
+qeth_hard_header_parse(struct sk_buff *skb, unsigned char *haddr)
+{
+        struct qeth_card *card;
+        struct ethhdr *eth;
+
+        card = qeth_get_card_from_dev(skb->dev);
+        if (card->options.layer2)
+                goto haveheader;
+#ifdef CONFIG_QETH_IPV6
+        /* cause of the manipulated arp constructor and the ARP
+           flag for OSAE devices we have some nasty exceptions */
+        if (card->info.type == QETH_CARD_TYPE_OSAE) {
+                if (!card->options.fake_ll) {
+                        if ((skb->pkt_type==PACKET_OUTGOING) &&
+                            (skb->protocol==ETH_P_IPV6))
+                                goto haveheader;
+                        else
+                                return 0;
+                } else {
+                        if ((skb->pkt_type==PACKET_OUTGOING) &&
+                            (skb->protocol==ETH_P_IP))
+                                return 0;
+                        else
+                                goto haveheader;
+                }
+        }
+#endif
+        if (!card->options.fake_ll)
+                return 0;
+haveheader:
+        eth = eth_hdr(skb);
+        memcpy(haddr, eth->h_source, ETH_ALEN);
+        return ETH_ALEN;
+}
+
+static int
 qeth_netdev_init(struct net_device *dev)
 {
         struct qeth_card *card;
@@ -6388,7 +6360,10 @@ qeth_netdev_init(struct net_device *dev)
         if (card->options.fake_ll &&
                 (qeth_get_netdev_flags(card) & IFF_NOARP))
                         dev->hard_header = qeth_fake_header;
-        dev->hard_header_parse = NULL;
+        if (dev->type == ARPHRD_IEEE802_TR)
+                dev->hard_header_parse = NULL;
+        else
+                dev->hard_header_parse = qeth_hard_header_parse;
         dev->set_mac_address = qeth_layer2_set_mac_address;
         dev->flags |= qeth_get_netdev_flags(card);
         if ((card->options.fake_broadcast) ||
@@ -8235,8 +8210,7 @@ qeth_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
         }
         if (!qeth_add_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
         return rc;
 }
 
@@ -8264,8 +8238,7 @@ qeth_del_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
                 return;
         if (!qeth_delete_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 }
 
 /*
@@ -8308,8 +8281,7 @@ qeth_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
         }
         if (!qeth_add_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
         return 0;
 }
 
@@ -8337,8 +8309,7 @@ qeth_del_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
                 return;
         if (!qeth_delete_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 }
 
 /**
@@ -8380,8 +8351,7 @@ qeth_ip_event(struct notifier_block *this,
         default:
                 break;
         }
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 out:
         return NOTIFY_DONE;
 }
@@ -8433,8 +8403,7 @@ qeth_ip6_event(struct notifier_block *this,
         default:
                 break;
         }
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 out:
         return NOTIFY_DONE;
 }
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 9d11a75663e6..3c4b6c243712 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -789,7 +789,9 @@ static struct console mpc52xx_console = {
 static int __init
 mpc52xx_console_init(void)
 {
+#if defined(CONFIG_PPC_MERGE)
         mpc52xx_uart_of_enumerate();
+#endif
         register_console(&mpc52xx_console);
         return 0;
 }
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 92ea7743fe8f..b37ce33f67ea 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -47,7 +47,6 @@
 #include <linux/vmalloc.h>
 #include <linux/crash_dump.h>
 #include <linux/pid_namespace.h>
-#include <linux/compile.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
@@ -254,12 +253,7 @@ static int version_read_proc(char *page, char **start, off_t off,
 {
         int len;
 
-        /* FIXED STRING! Don't touch! */
-        len = snprintf(page, PAGE_SIZE,
-                "%s version %s"
-                " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ")"
-                " (" LINUX_COMPILER ")"
-                " %s\n",
+        len = snprintf(page, PAGE_SIZE, linux_proc_banner,
                 utsname()->sysname,
                 utsname()->release,
                 utsname()->version);
diff --git a/include/asm-arm/arch-iop32x/iop32x.h b/include/asm-arm/arch-iop32x/iop32x.h
index 4bbd85f3ed2a..2e9469047eb1 100644
--- a/include/asm-arm/arch-iop32x/iop32x.h
+++ b/include/asm-arm/arch-iop32x/iop32x.h
@@ -19,7 +19,7 @@
  * Peripherals that are shared between the iop32x and iop33x but
  * located at different addresses.
  */
-#define IOP3XX_GPIO_REG(reg)    (IOP3XX_PERIPHERAL_VIRT_BASE + 0x07c0 + (reg))
+#define IOP3XX_GPIO_REG(reg)    (IOP3XX_PERIPHERAL_VIRT_BASE + 0x07c4 + (reg))
 #define IOP3XX_TIMER_REG(reg)   (IOP3XX_PERIPHERAL_VIRT_BASE + 0x07e0 + (reg))
 
 #include <asm/hardware/iop3xx.h>
diff --git a/include/asm-arm/cacheflush.h b/include/asm-arm/cacheflush.h
index d51049522cd0..5f531ea03059 100644
--- a/include/asm-arm/cacheflush.h
+++ b/include/asm-arm/cacheflush.h
@@ -357,6 +357,16 @@ extern void flush_dcache_page(struct page *);
 
 extern void __flush_dcache_page(struct address_space *mapping, struct page *page);
 
+#define ARCH_HAS_FLUSH_ANON_PAGE
+static inline void flush_anon_page(struct vm_area_struct *vma,
+                         struct page *page, unsigned long vmaddr)
+{
+        extern void __flush_anon_page(struct vm_area_struct *vma,
+                                struct page *, unsigned long);
+        if (PageAnon(page))
+                __flush_anon_page(vma, page, vmaddr);
+}
+
 #define flush_dcache_mmap_lock(mapping) \
         write_lock_irq(&(mapping)->tree_lock)
 #define flush_dcache_mmap_unlock(mapping) \
diff --git a/include/asm-arm/hardware/iop3xx.h b/include/asm-arm/hardware/iop3xx.h
index 1018a7486ab7..13ac8a4cd01f 100644
--- a/include/asm-arm/hardware/iop3xx.h
+++ b/include/asm-arm/hardware/iop3xx.h
@@ -168,9 +168,9 @@ extern void gpio_line_set(int line, int value);
 #define IOP3XX_PERCR0           (volatile u32 *)IOP3XX_REG_ADDR(0x0710)
 
 /* General Purpose I/O  */
-#define IOP3XX_GPOE             (volatile u32 *)IOP3XX_GPIO_REG(0x0004)
-#define IOP3XX_GPID             (volatile u32 *)IOP3XX_GPIO_REG(0x0008)
-#define IOP3XX_GPOD             (volatile u32 *)IOP3XX_GPIO_REG(0x000c)
+#define IOP3XX_GPOE             (volatile u32 *)IOP3XX_GPIO_REG(0x0000)
+#define IOP3XX_GPID             (volatile u32 *)IOP3XX_GPIO_REG(0x0004)
+#define IOP3XX_GPOD             (volatile u32 *)IOP3XX_GPIO_REG(0x0008)
 
 /* Timers  */
 #define IOP3XX_TU_TMR0          (volatile u32 *)IOP3XX_TIMER_REG(0x0000)
diff --git a/include/asm-mips/checksum.h b/include/asm-mips/checksum.h
index 9b768c3b96b3..24cdcc6eaab8 100644
--- a/include/asm-mips/checksum.h
+++ b/include/asm-mips/checksum.h
@@ -29,31 +29,38 @@
  */
 __wsum csum_partial(const void *buff, int len, __wsum sum);
 
+__wsum __csum_partial_copy_user(const void *src, void *dst,
+                                int len, __wsum sum, int *err_ptr);
+
 /*
  * this is a new version of the above that records errors it finds in *errp,
  * but continues and zeros the rest of the buffer.
  */
-__wsum csum_partial_copy_from_user(const void __user *src,
-                                         void *dst, int len,
-                                         __wsum sum, int *errp);
+static inline
+__wsum csum_partial_copy_from_user(const void __user *src, void *dst, int len,
+                                   __wsum sum, int *err_ptr)
+{
+        might_sleep();
+        return __csum_partial_copy_user((__force void *)src, dst,
+                                        len, sum, err_ptr);
+}
 
 /*
  * Copy and checksum to user
  */
 #define HAVE_CSUM_COPY_USER
-static inline __wsum csum_and_copy_to_user (const void *src, void __user *dst,
-                                                  int len, __wsum sum,
-                                                  int *err_ptr)
+static inline
+__wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
+                             __wsum sum, int *err_ptr)
 {
         might_sleep();
-        sum = csum_partial(src, len, sum);
-
-        if (copy_to_user(dst, src, len)) {
+        if (access_ok(VERIFY_WRITE, dst, len))
+                return __csum_partial_copy_user(src, (__force void *)dst,
+                                                len, sum, err_ptr);
+        if (len)
                 *err_ptr = -EFAULT;
-                return (__force __wsum)-1;
-        }
 
-        return sum;
+        return (__force __wsum)-1; /* invalid checksum */
 }
 
 /*
diff --git a/include/asm-mips/irq.h b/include/asm-mips/irq.h
index 67657089efa7..386da82e5774 100644
--- a/include/asm-mips/irq.h
+++ b/include/asm-mips/irq.h
@@ -31,14 +31,14 @@ static inline int irq_canonicalize(int irq)
  * functions will take over re-enabling the low-level mask.
  * Otherwise it will be done on return from exception.
  */
-#define __DO_IRQ_SMTC_HOOK()                                            \
+#define __DO_IRQ_SMTC_HOOK(irq)                                         \
 do {                                                                    \
         if (irq_hwmask[irq] & 0x0000ff00)                               \
                 write_c0_tccontext(read_c0_tccontext() &                \
                                    ~(irq_hwmask[irq] & 0x0000ff00));    \
 } while (0)
 #else
-#define __DO_IRQ_SMTC_HOOK() do { } while (0)
+#define __DO_IRQ_SMTC_HOOK(irq) do { } while (0)
 #endif
 
 /*
@@ -52,7 +52,7 @@ do {									\
 #define do_IRQ(irq)                                                     \
 do {                                                                    \
         irq_enter();                                                    \
-        __DO_IRQ_SMTC_HOOK();                                           \
+        __DO_IRQ_SMTC_HOOK(irq);                                        \
         generic_handle_irq(irq);                                        \
         irq_exit();                                                     \
 } while (0)
diff --git a/include/asm-parisc/cacheflush.h b/include/asm-parisc/cacheflush.h
index aedb0512cb04..a799dd8ef395 100644
--- a/include/asm-parisc/cacheflush.h
+++ b/include/asm-parisc/cacheflush.h
@@ -186,7 +186,7 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 }
 
 static inline void
-flush_anon_page(struct page *page, unsigned long vmaddr)
+flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
 {
         if (PageAnon(page))
                 flush_user_dcache_page(vmaddr);
diff --git a/include/asm-powerpc/bug.h b/include/asm-powerpc/bug.h
index 709568879f73..f6fa39474846 100644
--- a/include/asm-powerpc/bug.h
+++ b/include/asm-powerpc/bug.h
@@ -11,10 +11,31 @@
 #define BUG_OPCODE .long 0x00b00b00  /* For asm */
 #define BUG_ILLEGAL_INSTR "0x00b00b00" /* For BUG macro */
 
-#ifndef __ASSEMBLY__
-
 #ifdef CONFIG_BUG
 
+#ifdef __ASSEMBLY__
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+.macro EMIT_BUG_ENTRY addr,file,line,flags
+         .section __bug_table,"a"
+5001:    PPC_LONG \addr, 5002f
+         .short \line, \flags
+         .org 5001b+BUG_ENTRY_SIZE
+         .previous
+         .section .rodata,"a"
+5002:    .asciz "\file"
+         .previous
+.endm
+#else
+ .macro EMIT_BUG_ENTRY addr,file,line,flags
+         .section __bug_table,"a"
+5001:    PPC_LONG \addr
+         .short \flags
+         .org 5001b+BUG_ENTRY_SIZE
+         .previous
+.endm
+#endif /* verbose */
+
+#else /* !__ASSEMBLY__ */
 /* _EMIT_BUG_ENTRY expects args %0,%1,%2,%3 to be FILE, LINE, flags and
    sizeof(struct bug_entry), respectively */
 #ifdef CONFIG_DEBUG_BUGVERBOSE
@@ -91,8 +112,8 @@
 #define HAVE_ARCH_BUG
 #define HAVE_ARCH_BUG_ON
 #define HAVE_ARCH_WARN_ON
-#endif /* CONFIG_BUG */
 #endif /* __ASSEMBLY __ */
+#endif /* CONFIG_BUG */
 
 #include <asm-generic/bug.h>
 
diff --git a/include/asm-powerpc/hvcall.h b/include/asm-powerpc/hvcall.h
index 257d1cecb8c9..7a500732b671 100644
--- a/include/asm-powerpc/hvcall.h
+++ b/include/asm-powerpc/hvcall.h
@@ -252,8 +252,6 @@ struct hcall_stats {
         unsigned long   tb_total;       /* total wall time (mftb) of calls. */
         unsigned long   purr_total;     /* total cpu time (PURR) of calls. */
 };
-void update_hcall_stats(unsigned long opcode, unsigned long tb_delta,
-                        unsigned long purr_delta);
 #define HCALL_STAT_ARRAY_SIZE   ((MAX_HCALL_OPCODE >> 2) + 1)
 
 #endif /* __ASSEMBLY__ */
diff --git a/include/asm-powerpc/mpc52xx.h b/include/asm-powerpc/mpc52xx.h
index 4a28a850998c..4560d72fc758 100644
--- a/include/asm-powerpc/mpc52xx.h
+++ b/include/asm-powerpc/mpc52xx.h
@@ -244,6 +244,7 @@ struct mpc52xx_cdm {
 extern void __iomem * mpc52xx_find_and_map(const char *);
 extern unsigned int mpc52xx_find_ipb_freq(struct device_node *node);
 extern void mpc52xx_setup_cpu(void);
+extern void mpc52xx_declare_of_platform_devices(void);
 
 extern void mpc52xx_init_irq(void);
 extern unsigned int mpc52xx_get_irq(void);
diff --git a/include/asm-s390/futex.h b/include/asm-s390/futex.h
index 5e261e1de671..5c5d02de49e9 100644
--- a/include/asm-s390/futex.h
+++ b/include/asm-s390/futex.h
@@ -4,8 +4,8 @@
 #ifdef __KERNEL__
 
 #include <linux/futex.h>
+#include <linux/uaccess.h>
 #include <asm/errno.h>
-#include <asm/uaccess.h>
 
 static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
 {
@@ -21,7 +21,9 @@ static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         if (! access_ok (VERIFY_WRITE, uaddr, sizeof(int)))
                 return -EFAULT;
 
+        pagefault_disable();
         ret = uaccess.futex_atomic_op(op, uaddr, oparg, &oldval);
+        pagefault_enable();
 
         if (!ret) {
                 switch (cmp) {
diff --git a/include/linux/highmem.h b/include/linux/highmem.h
index ca9a602cffd7..645d440807c2 100644
--- a/include/linux/highmem.h
+++ b/include/linux/highmem.h
@@ -8,7 +8,7 @@
 #include <asm/cacheflush.h>
 
 #ifndef ARCH_HAS_FLUSH_ANON_PAGE
-static inline void flush_anon_page(struct page *page, unsigned long vmaddr)
+static inline void flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
 {
 }
 #endif
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index b0c4a05a4b0c..63fb18dcac30 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -17,6 +17,9 @@
 #include <asm/byteorder.h>
 #include <asm/bug.h>
 
+extern const char linux_banner[];
+extern const char linux_proc_banner[];
+
 #define INT_MAX         ((int)(~0U>>1))
 #define INT_MIN         (-INT_MAX - 1)
 #define UINT_MAX        (~0U)
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index 6b01ba297727..2f4e98b90cc0 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -25,7 +25,7 @@ enum tcp_conntrack {
 #define IP_CT_TCP_FLAG_SACK_PERM                0x02
 
 /* This sender sent FIN first */
-#define IP_CT_TCP_FLAG_CLOSE_INIT               0x03
+#define IP_CT_TCP_FLAG_CLOSE_INIT               0x04
 
 #ifdef __KERNEL__
 
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 0be235418a2f..24c8786d12e9 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -190,6 +190,7 @@ struct arpt_replace
 
 /* The argument to ARPT_SO_ADD_COUNTERS. */
 #define arpt_counters_info xt_counters_info
+#define arpt_counters xt_counters
 
 /* The argument to ARPT_SO_GET_ENTRIES. */
 struct arpt_get_entries
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index e6af381e206d..e02d85f56e60 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -218,7 +218,7 @@ struct ieee80211_snap_hdr {
 #define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
 
 #define WLAN_GET_SEQ_FRAG(seq) ((seq) & IEEE80211_SCTL_FRAG)
-#define WLAN_GET_SEQ_SEQ(seq)  ((seq) & IEEE80211_SCTL_SEQ)
+#define WLAN_GET_SEQ_SEQ(seq)  (((seq) & IEEE80211_SCTL_SEQ) >> 4)
 
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
diff --git a/include/sound/version.h b/include/sound/version.h
index 2949b9b991b5..20f7babad514 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
 #define CONFIG_SND_VERSION "1.0.14rc1"
-#define CONFIG_SND_DATE " (Wed Dec 20 08:11:48 2006 UTC)"
+#define CONFIG_SND_DATE " (Tue Jan 09 09:56:17 2007 UTC)"
diff --git a/init/Makefile b/init/Makefile
index 9cd871ce5784..633a268d270d 100644
--- a/init/Makefile
+++ b/init/Makefile
@@ -15,6 +15,14 @@ clean-files := ../include/linux/compile.h
 
 # dependencies on generated files need to be listed explicitly
 
-$(obj)/main.o: include/linux/compile.h
 $(obj)/version.o: include/linux/compile.h
 
+# compile.h changes depending on hostname, generation number, etc,
+# so we regenerate it always.
+# mkcompile_h will make sure to only update the
+# actual file if its content has changed.
+
+include/linux/compile.h: FORCE
+        @echo '  CHK     $@'
+        $(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkcompile_h $@ \
+        "$(UTS_MACHINE)" "$(CONFIG_SMP)" "$(CONFIG_PREEMPT)" "$(CC) $(CFLAGS)"
diff --git a/init/main.c b/init/main.c
index bc27d72bbb19..d908d3e03344 100644
--- a/init/main.c
+++ b/init/main.c
@@ -50,9 +50,7 @@
 #include <linux/buffer_head.h>
 #include <linux/debug_locks.h>
 #include <linux/lockdep.h>
-#include <linux/utsrelease.h>
 #include <linux/pid_namespace.h>
-#include <linux/compile.h>
 #include <linux/device.h>
 
 #include <asm/io.h>
@@ -482,12 +480,6 @@ void __init __attribute__((weak)) smp_setup_processor_id(void)
 {
 }
 
-static const char linux_banner[] =
-        "Linux version " UTS_RELEASE
-        " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ")"
-        " (" LINUX_COMPILER ")"
-        " " UTS_VERSION "\n";
-
 asmlinkage void __init start_kernel(void)
 {
         char * command_line;
diff --git a/init/version.c b/init/version.c
index 9d96d36501ca..55abe76f4ec9 100644
--- a/init/version.c
+++ b/init/version.c
@@ -33,3 +33,13 @@ struct uts_namespace init_uts_ns = {
         },
 };
 EXPORT_SYMBOL_GPL(init_uts_ns);
+
+/* FIXED STRING! Don't touch! */
+const char __init linux_banner[] =
+        "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
+        LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
+
+const char linux_proc_banner[] =
+        "%s version %s"
+        " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ")"
+        " (" LINUX_COMPILER ") %s\n";
diff --git a/mm/memory.c b/mm/memory.c
index 563792f4f687..af227d26e104 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1091,7 +1091,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         if (pages) {
                                 pages[i] = page;
 
-                                flush_anon_page(page, start);
+                                flush_anon_page(vma, page, start);
                                 flush_dcache_page(page);
                         }
                         if (vmas)
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index be04e9fb11f6..ab166b48ce8d 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -196,6 +196,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
 
         switch (CAPIMSG_SUBCOMMAND(skb->data)) {
         case CAPI_CONF:
+                if (skb->len < CAPI_MSG_BASELEN + 10)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 5);
                 info = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 8);
 
@@ -226,6 +229,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_PROFILE:
+                        if (skb->len < CAPI_MSG_BASELEN + 11 + sizeof(capi_profile))
+                                break;
+
                         controller = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 11);
                         msgnum = CAPIMSG_MSGID(skb->data);
 
@@ -246,17 +252,26 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_MANUFACTURER:
+                        if (skb->len < CAPI_MSG_BASELEN + 15)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 10);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_MANUFACTURER_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 14]);
+
+                                memset(ctrl->manu, 0, CAPI_MANUFACTURER_LEN);
                                 strncpy(ctrl->manu,
-                                        skb->data + CAPI_MSG_BASELEN + 15,
-                                        skb->data[CAPI_MSG_BASELEN + 14]);
+                                        skb->data + CAPI_MSG_BASELEN + 15, len);
                         }
 
                         break;
 
                 case CAPI_FUNCTION_GET_VERSION:
+                        if (skb->len < CAPI_MSG_BASELEN + 32)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
@@ -269,13 +284,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_SERIAL_NUMBER:
+                        if (skb->len < CAPI_MSG_BASELEN + 17)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_SERIAL_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 16]);
+
                                 memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
                                 strncpy(ctrl->serial,
-                                        skb->data + CAPI_MSG_BASELEN + 17,
-                                        skb->data[CAPI_MSG_BASELEN + 16]);
+                                        skb->data + CAPI_MSG_BASELEN + 17, len);
                         }
 
                         break;
@@ -284,14 +304,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                 break;
 
         case CAPI_IND:
+                if (skb->len < CAPI_MSG_BASELEN + 6)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 3);
 
                 if (func == CAPI_FUNCTION_LOOPBACK) {
+                        int len = min_t(uint, skb->len - CAPI_MSG_BASELEN - 6,
+                                                skb->data[CAPI_MSG_BASELEN + 5]);
                         appl = CAPIMSG_APPID(skb->data);
                         msgnum = CAPIMSG_MSGID(skb->data);
                         cmtp_send_interopmsg(session, CAPI_RESP, appl, msgnum, func,
-                                                skb->data + CAPI_MSG_BASELEN + 6,
-                                                skb->data[CAPI_MSG_BASELEN + 5]);
+                                                skb->data + CAPI_MSG_BASELEN + 6, len);
                 }
 
                 break;
@@ -309,6 +333,9 @@ void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 
         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 
+        if (skb->len < CAPI_MSG_BASELEN)
+                return;
+
         if (CAPIMSG_COMMAND(skb->data) == CAPI_INTEROPERABILITY) {
                 cmtp_recv_interopmsg(session, skb);
                 return;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index d4c935692ccf..801d687ea4ef 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -242,7 +242,7 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work);
         int i;
 
-        if (device_register(&conn->dev) < 0) {
+        if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
@@ -272,6 +272,8 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         dev_set_drvdata(&conn->dev, conn);
 
+        device_initialize(&conn->dev);
+
         INIT_WORK(&conn->work, add_conn);
 
         schedule_work(&conn->work);
@@ -287,6 +289,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
+        if (!device_is_registered(&conn->dev))
+                return;
+
         INIT_WORK(&conn->work, del_conn);
 
         schedule_work(&conn->work);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 544d65b7baa7..cb7e855f0828 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -557,7 +557,6 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
         struct sk_buff *skb;
-        int err;
         int sent = 0;
 
         if (msg->msg_flags & MSG_OOB)
@@ -572,6 +571,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         while (len) {
                 size_t size = min_t(size_t, len, d->mtu);
+                int err;
                 
                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
                                 msg->msg_flags & MSG_DONTWAIT, &err);
@@ -582,13 +582,16 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
                 if (err) {
                         kfree_skb(skb);
-                        sent = err;
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
                 err = rfcomm_dlc_send(d, skb);
                 if (err < 0) {
                         kfree_skb(skb);
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
@@ -598,7 +601,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         release_sock(sk);
 
-        return sent ? sent : err;
+        return sent;
 }
 
 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e0e0d09023b2..eb2b52484c70 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -697,9 +697,13 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        if (!dev || !dev->dlc)
+                return 0;
+
         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
         if (room < 0)
                 room = 0;
+
         return room;
 }
 
@@ -915,12 +919,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        struct rfcomm_dlc *dlc = dev->dlc;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!skb_queue_empty(&dlc->tx_queue))
-                return dlc->mtu;
+        if (!dev || !dev->dlc)
+                return 0;
+
+        if (!skb_queue_empty(&dev->dlc->tx_queue))
+                return dev->dlc->mtu;
 
         return 0;
 }
@@ -928,11 +934,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev || !dev->dlc)
+                return;
+
         skb_queue_purge(&dev->dlc->tx_queue);
 
         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +959,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev)
+                return;
+
         rfcomm_tty_flush_buffer(tty);
 
         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1144900d37f6..864009643675 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -305,7 +305,7 @@ lookup_protocol:
                 sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
-        inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
                 inet->num = protocol;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 25c8a42965df..480ace9819f6 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -174,9 +174,10 @@ struct in_device *inetdev_init(struct net_device *dev)
         ip_mc_init_dev(in_dev);
         if (dev->flags & IFF_UP)
                 ip_mc_up(in_dev);
-out:
+
         /* we can receive as soon as ip_ptr is set -- do this last */
         rcu_assign_pointer(dev->ip_ptr, in_dev);
+out:
         return in_dev;
 out_kfree:
         kfree(in_dev);
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 730a7a44c883..00d6dea9f7f3 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -123,7 +123,7 @@ nf_nat_fn(unsigned int hooknum,
 
         nat = nfct_nat(ct);
         if (!nat)
-                return NF_DROP;
+                return NF_ACCEPT;
 
         switch (ctinfo) {
         case IP_CT_RELATED:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index bf7a22412bcb..12de90a5047c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -648,7 +648,7 @@ static void tcp_v4_send_ack(struct tcp_timewait_sock *twsk,
                                    TCPOLEN_TIMESTAMP);
                 rep.opt[1] = htonl(tcp_time_stamp);
                 rep.opt[2] = htonl(ts);
-                arg.iov[0].iov_len = TCPOLEN_TSTAMP_ALIGNED;
+                arg.iov[0].iov_len += TCPOLEN_TSTAMP_ALIGNED;
         }
 
         /* Swap the send and the receive. */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e5cd83b2205d..0e0e4262f4dc 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -171,7 +171,7 @@ lookup_protocol:
                 sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
-        inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
                 inet->num = protocol;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 37e5fca923aa..d9c15402ba66 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -835,6 +835,8 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                 s->nfct_reasm = skb;
 
                 s2 = s->next;
+                s->next = NULL;
+
                 NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn,
                                NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
                 s = s2;
diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index a5b234e444dc..2a48efdf0d67 100644
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -89,6 +89,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
 
         exp->expectfn             = NULL;
         exp->flags                = NF_CT_EXPECT_PERMANENT;
+        exp->helper               = NULL;
 
         nf_conntrack_expect_related(exp);
         nf_conntrack_expect_put(exp);
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4afc75f9e377..73e0ff469bff 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
 
         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
                 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
-                        if (iter > CIPSO_V4_TAG_MAXCNT)
+                        if (iter >= CIPSO_V4_TAG_MAXCNT)
                                 return -EINVAL;
                         doi_def->tags[iter++] = nla_get_u8(nla);
                 }
-        if (iter < CIPSO_V4_TAG_MAXCNT)
-                doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
+        while (iter < CIPSO_V4_TAG_MAXCNT)
+                doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 
         return 0;
 }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f0bbe36799cf..167d888d1df2 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -124,8 +124,8 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         padlen = len % 4;
         err.length  = htons(len);
         len += padlen;
-        sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
-        chunk->subh.err_hdr = sctp_addto_chunk(chunk, paylen, payload);
+        chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
+        sctp_addto_chunk(chunk, paylen, payload);
 }
 
 /* 3.3.2 Initiation (INIT) (1)
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 9f42b9c9de37..27f5cc7966f6 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -254,7 +254,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
          *      They want reverse charging, we won't accept it.
          */
         if ((theirs.reverse & 0x01 ) && (ours->reverse & 0x01)) {
-                SOCK_DEBUG(sk, "X.25: rejecting reverse charging request");
+                SOCK_DEBUG(sk, "X.25: rejecting reverse charging request\n");
                 return -1;
         }
 
@@ -262,29 +262,29 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
 
         if (theirs.throughput) {
                 if (theirs.throughput < ours->throughput) {
-                        SOCK_DEBUG(sk, "X.25: throughput negotiated down");
+                        SOCK_DEBUG(sk, "X.25: throughput negotiated down\n");
                         new->throughput = theirs.throughput;
                 }
         }
 
         if (theirs.pacsize_in && theirs.pacsize_out) {
                 if (theirs.pacsize_in < ours->pacsize_in) {
-                        SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down\n");
                         new->pacsize_in = theirs.pacsize_in;
                 }
                 if (theirs.pacsize_out < ours->pacsize_out) {
-                        SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down\n");
                         new->pacsize_out = theirs.pacsize_out;
                 }
         }
 
         if (theirs.winsize_in && theirs.winsize_out) {
                 if (theirs.winsize_in < ours->winsize_in) {
-                        SOCK_DEBUG(sk, "X.25: window size inwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: window size inwards negotiated down\n");
                         new->winsize_in = theirs.winsize_in;
                 }
                 if (theirs.winsize_out < ours->winsize_out) {
-                        SOCK_DEBUG(sk, "X.25: window size outwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: window size outwards negotiated down\n");
                         new->winsize_out = theirs.winsize_out;
                 }
         }
diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
index 0562bacb7b99..2eee0dab524d 100644
--- a/security/selinux/ss/context.h
+++ b/security/selinux/ss/context.h
@@ -55,6 +55,29 @@ out:
         return rc;
 }
 
+/*
+ * Sets both levels in the MLS range of 'dst' to the low level of 'src'.
+ */
+static inline int mls_context_cpy_low(struct context *dst, struct context *src)
+{
+        int rc;
+
+        if (!selinux_mls_enabled)
+                return 0;
+
+        dst->range.level[0].sens = src->range.level[0].sens;
+        rc = ebitmap_cpy(&dst->range.level[0].cat, &src->range.level[0].cat);
+        if (rc)
+                goto out;
+
+        dst->range.level[1].sens = src->range.level[0].sens;
+        rc = ebitmap_cpy(&dst->range.level[1].cat, &src->range.level[0].cat);
+        if (rc)
+                ebitmap_destroy(&dst->range.level[0].cat);
+out:
+        return rc;
+}
+
 static inline int mls_context_cmp(struct context *c1, struct context *c2)
 {
         if (!selinux_mls_enabled)
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index b4f682dc13ff..4a8bab2f3c71 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -270,7 +270,7 @@ int mls_context_to_sid(char oldc,
                 if (!defcon)
                         goto out;
 
-                rc = mls_copy_context(context, defcon);
+                rc = mls_context_cpy(context, defcon);
                 goto out;
         }
 
@@ -401,26 +401,6 @@ int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
 }
 
 /*
- * Copies the effective MLS range from `src' into `dst'.
- */
-static inline int mls_scopy_context(struct context *dst,
-                                    struct context *src)
-{
-        int l, rc = 0;
-
-        /* Copy the MLS range from the source context */
-        for (l = 0; l < 2; l++) {
-                dst->range.level[l].sens = src->range.level[0].sens;
-                rc = ebitmap_cpy(&dst->range.level[l].cat,
-                                 &src->range.level[0].cat);
-                if (rc)
-                        break;
-        }
-
-        return rc;
-}
-
-/*
  * Copies the MLS range `range' into `context'.
  */
 static inline int mls_range_set(struct context *context,
@@ -552,19 +532,19 @@ int mls_compute_sid(struct context *scontext,
         case AVTAB_CHANGE:
                 if (tclass == SECCLASS_PROCESS)
                         /* Use the process MLS attributes. */
-                        return mls_copy_context(newcontext, scontext);
+                        return mls_context_cpy(newcontext, scontext);
                 else
                         /* Use the process effective MLS attributes. */
-                        return mls_scopy_context(newcontext, scontext);
+                        return mls_context_cpy_low(newcontext, scontext);
         case AVTAB_MEMBER:
                 /* Only polyinstantiate the MLS attributes if
                    the type is being polyinstantiated */
                 if (newcontext->type != tcontext->type) {
                         /* Use the process effective MLS attributes. */
-                        return mls_scopy_context(newcontext, scontext);
+                        return mls_context_cpy_low(newcontext, scontext);
                 } else {
                         /* Use the related object MLS attributes. */
-                        return mls_copy_context(newcontext, tcontext);
+                        return mls_context_cpy(newcontext, tcontext);
                 }
         default:
                 return -EINVAL;
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index 661d6fc76966..096d1b4ef7fb 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -24,26 +24,6 @@
 #include "context.h"
 #include "policydb.h"
 
-/*
- * Copies the MLS range from `src' into `dst'.
- */
-static inline int mls_copy_context(struct context *dst,
-                                   struct context *src)
-{
-        int l, rc = 0;
-
-        /* Copy the MLS range from the source context */
-        for (l = 0; l < 2; l++) {
-                dst->range.level[l].sens = src->range.level[l].sens;
-                rc = ebitmap_cpy(&dst->range.level[l].cat,
-                                 &src->range.level[l].cat);
-                if (rc)
-                        break;
-        }
-
-        return rc;
-}
-
 int mls_compute_context_len(struct context *context);
 void mls_sid_to_context(struct context *context, char **scontext);
 int mls_context_isvalid(struct policydb *p, struct context *c);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index ee0581557966..3eb1fa9f0de1 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1916,11 +1916,10 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
         newcon.user = context1->user;
         newcon.role = context1->role;
         newcon.type = context1->type;
-        rc = mls_copy_context(&newcon, context2);
+        rc = mls_context_cpy(&newcon, context2);
         if (rc)
                 goto out_unlock;
 
-
         /* Check the validity of the new context. */
         if (!policydb_context_isvalid(&policydb, &newcon)) {
                 rc = convert_context_handle_invalid_context(&newcon);
@@ -2492,9 +2491,9 @@ static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid)
 
         rc = netlbl_socket_setattr(sock, &secattr);
         if (rc == 0) {
-                spin_lock(&sksec->nlbl_lock);
+                spin_lock_bh(&sksec->nlbl_lock);
                 sksec->nlbl_state = NLBL_LABELED;
-                spin_unlock(&sksec->nlbl_lock);
+                spin_unlock_bh(&sksec->nlbl_lock);
         }
 
 netlbl_socket_setsid_return:
diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
index 71c58df4af28..70face7e1048 100644
--- a/sound/pci/cmipci.c
+++ b/sound/pci/cmipci.c
@@ -2198,7 +2198,8 @@ static int _snd_cmipci_uswitch_put(struct snd_kcontrol *kcontrol,
                 val = inb(cm->iobase + args->reg);
         else
                 val = snd_cmipci_read(cm, args->reg);
-        change = (val & args->mask) != (ucontrol->value.integer.value[0] ? args->mask : 0);
+        change = (val & args->mask) != (ucontrol->value.integer.value[0] ? 
+                        args->mask_on : (args->mask & ~args->mask_on));
         if (change) {
                 val &= ~args->mask;
                 if (ucontrol->value.integer.value[0])
diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f11e3a8..91f5bff66d3f 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,7 @@ static void snd_echo_midi_output_write(unsigned long data)
         sent = bytes = 0;
         spin_lock_irqsave(&chip->lock, flags);
         chip->midi_full = 0;
-        if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+        if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
                 bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
                                                   MIDI_OUT_BUFFER_SIZE - 1);
                 DE_MID(("Try to send %d bytes...\n", bytes));
@@ -264,9 +264,11 @@ static void snd_echo_midi_output_trigger(struct snd_rawmidi_substream *substream
                 }
         } else {
                 if (chip->tinuse) {
-                        del_timer(&chip->timer);
                         chip->tinuse = 0;
+                        spin_unlock_irq(&chip->lock);
+                        del_timer_sync(&chip->timer);
                         DE_MID(("Timer removed\n"));
+                        return;
                 }
         }
         spin_unlock_irq(&chip->lock);
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 97e9af130b71..1589d2f2917f 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -485,8 +485,9 @@ static const char *get_input_type(struct hda_gnode *node, unsigned int *pinctl)
                         return "Front Aux";
                 return "Aux";
         case AC_JACK_MIC_IN:
-                if (node->pin_caps &
-                    (AC_PINCAP_VREF_80 << AC_PINCAP_VREF_SHIFT))
+                if (pinctl &&
+                    (node->pin_caps &
+                     (AC_PINCAP_VREF_80 << AC_PINCAP_VREF_SHIFT)))
                         *pinctl |= AC_PINCTL_VREF_80;
                 if ((location & 0x0f) == AC_JACK_LOC_FRONT)
                         return "Front Mic";
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 9fd34f85cad5..1a7e82104bb9 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -83,6 +83,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{Intel, ICH7},"
                          "{Intel, ESB2},"
                          "{Intel, ICH8},"
+                         "{Intel, ICH9},"
                          "{ATI, SB450},"
                          "{ATI, SB600},"
                          "{ATI, RS600},"
@@ -1711,6 +1712,8 @@ static struct pci_device_id azx_ids[] = {
         { 0x8086, 0x27d8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH7 */
         { 0x8086, 0x269a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ESB2 */
         { 0x8086, 0x284b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH8 */
+        { 0x8086, 0x293e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH9 */
+        { 0x8086, 0x293f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH9 */
         { 0x1002, 0x437b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB450 */
         { 0x1002, 0x4383, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB600 */
         { 0x1002, 0x793b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATIHDMI }, /* ATI RS600 HDMI */
@@ -1718,9 +1721,14 @@ static struct pci_device_id azx_ids[] = {
         { 0x1106, 0x3288, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_VIA }, /* VIA VT8251/VT8237A */
         { 0x1039, 0x7502, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_SIS }, /* SIS966 */
         { 0x10b9, 0x5461, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ULI }, /* ULI M5461 */
-        { 0x10de, 0x026c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA 026c */
-        { 0x10de, 0x0371, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA 0371 */
-        { 0x10de, 0x03f0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA 03f0 */
+        { 0x10de, 0x026c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP51 */
+        { 0x10de, 0x0371, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP55 */
+        { 0x10de, 0x03e4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP61 */
+        { 0x10de, 0x03f0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP61 */
+        { 0x10de, 0x044a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP65 */
+        { 0x10de, 0x044b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP65 */
+        { 0x10de, 0x055c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP67 */
+        { 0x10de, 0x055d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP67 */
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index 3d7f36fb4cf0..19bdcc74c96c 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2471,7 +2471,13 @@ static int parse_audio_format_rates(struct snd_usb_audio *chip, struct audioform
                 fp->nr_rates = nr_rates;
                 fp->rate_min = fp->rate_max = combine_triple(&fmt[8]);
                 for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
-                        unsigned int rate = fp->rate_table[r] = combine_triple(&fmt[idx]);
+                        unsigned int rate = combine_triple(&fmt[idx]);
+                        /* C-Media CM6501 mislabels its 96 kHz altsetting */
+                        if (rate == 48000 && nr_rates == 1 &&
+                            chip->usb_id == USB_ID(0x0d8c, 0x0201) &&
+                            fp->altsetting == 5 && fp->maxpacksize == 392)
+                                rate = 96000;
+                        fp->rate_table[r] = rate;
                         if (rate < fp->rate_min)
                                 fp->rate_min = rate;
                         else if (rate > fp->rate_max)
@@ -3280,6 +3286,7 @@ static void snd_usb_audio_create_proc(struct snd_usb_audio *chip)
 
 static int snd_usb_audio_free(struct snd_usb_audio *chip)
 {
+        usb_chip[chip->index] = NULL;
         kfree(chip);
         return 0;
 }
@@ -3541,7 +3548,6 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, void *ptr)
                 list_for_each(p, &chip->mixer_list) {
                         snd_usb_mixer_disconnect(p);
                 }
-                usb_chip[chip->index] = NULL;
                 mutex_unlock(&register_mutex);
                 snd_card_free_when_closed(card);
         } else {
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index e74eb1bc8d87..7b3bf3545a3b 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -1526,7 +1526,7 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, unsi
                 namelist[i] = kmalloc(MAX_ITEM_NAME_LEN, GFP_KERNEL);
                 if (! namelist[i]) {
                         snd_printk(KERN_ERR "cannot malloc\n");
-                        while (--i > 0)
+                        while (i--)
                                 kfree(namelist[i]);
                         kfree(namelist);
                         kfree(cval);