476 files changed, 7409 insertions, 5057 deletions

diff --git a/.mailmap b/.mailmap
index bf62dbea88e6..ebf9bf84da0a 100644
--- a/.mailmap
+++ b/.mailmap
@@ -67,6 +67,8 @@ Koushik <raghavendra.koushik@neterion.com>
 Leonid I Ananiev <leonid.i.ananiev@intel.com>
 Linas Vepstas <linas@austin.ibm.com>
 Matthieu CASTET <castet.matthieu@free.fr>
+Michael Buesch <mb@bu3sch.de>
+Michael Buesch <mbuesch@freenet.de>
 Michel Dänzer <michel@tungstengraphics.com>
 Mitesh shah <mshah@teja.com>
 Morten Welinder <terra@gnome.org>
diff --git a/Documentation/ABI/obsolete/dv1394 b/Documentation/ABI/obsolete/dv1394
new file mode 100644
index 000000000000..2ee36864ca10
--- /dev/null
+++ b/Documentation/ABI/obsolete/dv1394
@@ -0,0 +1,9 @@
+What:           dv1394 (a.k.a. "OHCI-DV I/O support" for FireWire)
+Contact:        linux1394-devel@lists.sourceforge.net
+Description:
+        New application development should use raw1394 + userspace libraries
+        instead, notably libiec61883 which is functionally equivalent.
+
+Users:
+        ffmpeg/libavformat (used by a variety of media players)
+        dvgrab v1.x (replaced by dvgrab2 on top of raw1394 and resp. libraries)
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index 842f0d1ab216..f2c0a6842930 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -557,6 +557,9 @@ Set some flags:
 Add some cpus:
 # /bin/echo 0-7 > cpus
 
+Add some mems:
+# /bin/echo 0-7 > mems
+
 Now attach your shell to this cpuset:
 # /bin/echo $$ > tasks
 
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 0bc8b0b2e103..19b4c96b2a49 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -39,17 +39,6 @@ Who:	Dan Dennedy <dan@dennedy.org>, Stefan Richter <stefanr@s5r6.in-berlin.de>
 
 ---------------------------
 
-What:   dv1394 driver (CONFIG_IEEE1394_DV1394)
-When:   June 2007
-Why:    Replaced by raw1394 + userspace libraries, notably libiec61883.  This
-        shift of application support has been indicated on www.linux1394.org
-        and developers' mailinglists for quite some time.  Major applications
-        have been converted, with the exception of ffmpeg and hence xine.
-        Piped output of dvgrab2 is a partial equivalent to dv1394.
-Who:    Dan Dennedy <dan@dennedy.org>, Stefan Richter <stefanr@s5r6.in-berlin.de>
-
----------------------------
-
 What:   Video4Linux API 1 ioctls and video_decoder.h from Video devices.
 When:   December 2006
 Why:    V4L1 AP1 was replaced by V4L2 API. during migration from 2.4 to 2.6
diff --git a/Documentation/gpio.txt b/Documentation/gpio.txt
index 989f1130f4f3..f8528db967fa 100644
--- a/Documentation/gpio.txt
+++ b/Documentation/gpio.txt
@@ -27,7 +27,7 @@ The exact capabilities of GPIOs vary between systems.  Common options:
   - Output values are writable (high=1, low=0).  Some chips also have
     options about how that value is driven, so that for example only one
     value might be driven ... supporting "wire-OR" and similar schemes
-    for the other value.
+    for the other value (notably, "open drain" signaling).
 
   - Input values are likewise readable (1, 0).  Some chips support readback
     of pins configured as "output", which is very useful in such "wire-OR"
@@ -247,6 +247,35 @@ with gpio_get_value(), for example to initialize or update driver state
 when the IRQ is edge-triggered.
 
 
+Emulating Open Drain Signals
+----------------------------
+Sometimes shared signals need to use "open drain" signaling, where only the
+low signal level is actually driven.  (That term applies to CMOS transistors;
+"open collector" is used for TTL.)  A pullup resistor causes the high signal
+level.  This is sometimes called a "wire-AND"; or more practically, from the
+negative logic (low=true) perspective this is a "wire-OR".
+
+One common example of an open drain signal is a shared active-low IRQ line.
+Also, bidirectional data bus signals sometimes use open drain signals.
+
+Some GPIO controllers directly support open drain outputs; many don't.  When
+you need open drain signaling but your hardware doesn't directly support it,
+there's a common idiom you can use to emulate it with any GPIO pin that can
+be used as either an input or an output:
+
+ LOW:   gpio_direction_output(gpio, 0) ... this drives the signal
+        and overrides the pullup.
+
+ HIGH:  gpio_direction_input(gpio) ... this turns off the output,
+        so the pullup (or some other device) controls the signal.
+
+If you are "driving" the signal high but gpio_get_value(gpio) reports a low
+value (after the appropriate rise time passes), you know some other component
+is driving the shared signal low.  That's not necessarily an error.  As one
+common example, that's how I2C clocks are stretched:  a slave that needs a
+slower clock delays the rising edge of SCK, and the I2C master adjusts its
+signaling rate accordingly.
+
 
 What do these conventions omit?
 ===============================
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index ef2ffded1392..12533a958c51 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -142,7 +142,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         Format: <int>
                         2: use 2nd APIC table, if available
                         1,0: use 1st APIC table
-                        default: 2
+                        default: 0
 
         acpi_sleep=     [HW,ACPI] Sleep options
                         Format: { s3_bios, s3_mode }
diff --git a/Documentation/networking/ax25.txt b/Documentation/networking/ax25.txt
index 37c25b0925f0..8257dbf9be57 100644
--- a/Documentation/networking/ax25.txt
+++ b/Documentation/networking/ax25.txt
@@ -1,16 +1,10 @@
 To use the amateur radio protocols within Linux you will need to get a
-suitable copy of the AX.25 Utilities. More detailed information about these
-and associated programs can be found on http://zone.pspt.fi/~jsn/.
-
-For more information about the AX.25, NET/ROM and ROSE protocol stacks, see
-the AX25-HOWTO written by Terry Dawson <terry@perf.no.itg.telstra.com.au>
-who is also the AX.25 Utilities maintainer.
+suitable copy of the AX.25 Utilities. More detailed information about
+AX.25, NET/ROM and ROSE, associated programs and and utilities can be
+found on http://www.linux-ax25.org.
 
 There is an active mailing list for discussing Linux amateur radio matters
-called linux-hams. To subscribe to it, send a message to
+called linux-hams@vger.kernel.org. To subscribe to it, send a message to
 majordomo@vger.kernel.org with the words "subscribe linux-hams" in the body
-of the message, the subject field is ignored.
-
-Jonathan G4KLX
-
-g4klx@g4klx.demon.co.uk
+of the message, the subject field is ignored.  You don't need to be
+subscribed to post but of course that means you might miss an answer.
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d3aae1f9b4c1..702d1d8dd04a 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -851,6 +851,15 @@ accept_redirects - BOOLEAN
         Functional default: enabled if local forwarding is disabled.
                             disabled if local forwarding is enabled.
 
+accept_source_route - INTEGER
+        Accept source routing (routing extension header).
+
+        > 0: Accept routing header.
+        = 0: Accept only routing header type 2.
+        < 0: Do not accept routing header.
+
+        Default: 0
+
 autoconf - BOOLEAN
         Autoconfigure addresses using Prefix Information in Router 
         Advertisements.
diff --git a/Documentation/power/pci.txt b/Documentation/power/pci.txt
index c750f9f2e76e..b6a3cbf7e846 100644
--- a/Documentation/power/pci.txt
+++ b/Documentation/power/pci.txt
@@ -102,31 +102,28 @@ pci_save_state
 --------------
 
 Usage:
-        pci_save_state(dev, buffer);
+        pci_save_state(struct pci_dev *dev);
 
 Description:
-        Save first 64 bytes of PCI config space. Buffer must be allocated by
-        caller.
+        Save first 64 bytes of PCI config space, along with any additional
+        PCI-Express or PCI-X information.
 
 
 pci_restore_state
 -----------------
 
 Usage:
-        pci_restore_state(dev, buffer);
+        pci_restore_state(struct pci_dev *dev);
 
 Description:
-        Restore previously saved config space. (First 64 bytes only);
-
-        If buffer is NULL, then restore what information we know about the
-        device from bootup: BARs and interrupt line.
+        Restore previously saved config space.
 
 
 pci_set_power_state
 -------------------
 
 Usage:
-        pci_set_power_state(dev, state);
+        pci_set_power_state(struct pci_dev *dev, pci_power_t state);
 
 Description:
         Transition device to low power state using PCI PM Capabilities
@@ -142,7 +139,7 @@ pci_enable_wake
 ---------------
 
 Usage:
-        pci_enable_wake(dev, state, enable);
+        pci_enable_wake(struct pci_dev *dev, pci_power_t state, int enable);
 
 Description:
         Enable device to generate PME# during low power state using PCI PM 
diff --git a/Documentation/sony-laptop.txt b/Documentation/sony-laptop.txt
index dfd26df056f4..7a5c1a81905c 100644
--- a/Documentation/sony-laptop.txt
+++ b/Documentation/sony-laptop.txt
@@ -3,12 +3,18 @@ Sony Notebook Control Driver (SNC) Readme
         Copyright (C) 2004- 2005 Stelian Pop <stelian@popies.net>
         Copyright (C) 2007 Mattia Dongili <malattia@linux.it>
 
-This mini-driver drives the SNC device present in the ACPI BIOS of
-the Sony Vaio laptops.
+This mini-driver drives the SNC and SPIC device present in the ACPI BIOS of the
+Sony Vaio laptops. This driver mixes both devices functions under the same
+(hopefully consistent) interface. This also means that the sonypi driver is
+obsoleted by sony-laptop now.
 
-It gives access to some extra laptop functionalities. In its current
-form, this driver let the user set or query the screen brightness
-through the backlight subsystem and remove/apply power to some devices.
+Fn keys (hotkeys):
+------------------
+Some models report hotkeys through the SNC or SPIC devices, such events are
+reported both through the ACPI subsystem as acpi events and through the INPUT
+subsystem. See the logs of acpid or /proc/acpi/event and
+/proc/bus/input/devices to find out what those events are and which input
+devices are created by the driver.
 
 Backlight control:
 ------------------
@@ -39,6 +45,8 @@ The files are:
         audiopower              power on/off the internal sound card
         lanpower                power on/off the internal ethernet card
                                 (only in debug mode)
+        bluetoothpower          power on/off the internal bluetooth device
+        fanspeed                get/set the fan speed
 
 Note that some files may be missing if they are not supported
 by your particular laptop model.
@@ -76,9 +84,9 @@ The sony-laptop driver creates, for some of those methods (the most
 current ones found on several Vaio models), an entry under
 /sys/devices/platform/sony-laptop, just like the 'cdpower' one.
 You can create other entries corresponding to your own laptop methods by
-further editing the source (see the 'sony_acpi_values' table, and add a new
+further editing the source (see the 'sony_nc_values' table, and add a new
 entry to this table with your get/set method names using the
-HANDLE_NAMES macro).
+SNC_HANDLE_NAMES macro).
 
 Your mission, should you accept it, is to try finding out what
 those entries are for, by reading/writing random values from/to those
@@ -87,6 +95,9 @@ files and find out what is the impact on your laptop.
 Should you find anything interesting, please report it back to me,
 I will not disavow all knowledge of your actions :)
 
+See also http://www.linux.it/~malattia/wiki/index.php/Sony_drivers for other
+useful info.
+
 Bugs/Limitations:
 -----------------
 
diff --git a/Documentation/video4linux/meye.txt b/Documentation/video4linux/meye.txt
index ecb34160e61d..5e51c59bf2b0 100644
--- a/Documentation/video4linux/meye.txt
+++ b/Documentation/video4linux/meye.txt
@@ -5,10 +5,9 @@ Vaio Picturebook Motion Eye Camera Driver Readme
         Copyright (C) 2000 Andrew Tridgell <tridge@samba.org>
 
 This driver enable the use of video4linux compatible applications with the
-Motion Eye camera. This driver requires the "Sony Vaio Programmable I/O
-Control Device" driver (which can be found in the "Character drivers"
-section of the kernel configuration utility) to be compiled and installed
-(using its "camera=1" parameter).
+Motion Eye camera. This driver requires the "Sony Laptop Extras" driver (which
+can be found in the "Misc devices" section of the kernel configuration utility)
+to be compiled and installed (using its "camera=1" parameter).
 
 It can do at maximum 30 fps @ 320x240 or 15 fps @ 640x480.
 
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 625a21db0c2a..85f51e5a749f 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -293,7 +293,3 @@ Debugging
                         stuck (default)
 
 Miscellaneous
-
-  noreplacement  Don't replace instructions with more appropriate ones
-                 for the CPU. This may be useful on asymmetric MP systems
-                 where some CPUs have less capabilities than others.
diff --git a/MAINTAINERS b/MAINTAINERS
index 7d421831a0cc..d0243d07da20 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -198,10 +198,25 @@ L:	linux-sound@vger.kernel.org
 W:      http://www.stud.uni-karlsruhe.de/~uh1b/
 S:      Maintained
 
+IPS SCSI RAID DRIVER
+P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
+L:      linux-scsi@vger.kernel.org
+W:      http://www.adaptec.com/
+S:      Maintained
+
+DPT_I2O SCSI RAID DRIVER
+P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
+L:      linux-scsi@vger.kernel.org
+W:      http://www.adaptec.com/
+S:      Maintained
+
 AACRAID SCSI RAID DRIVER
 P:      Adaptec OEM Raid Solutions
+M:      aacraid@adaptec.com
 L:      linux-scsi@vger.kernel.org
-W:      http://linux.dell.com/storage.shtml
+W:      http://www.adaptec.com/
 S:      Supported
 
 ACPI
@@ -1303,7 +1318,7 @@ S:	Maintained
 ETHERNET BRIDGE
 P:      Stephen Hemminger
 M:      shemminger@linux-foundation.org
-L:      bridge@lists.osdl.org
+L:      bridge@lists.linux-foundation.org
 W:      http://bridge.sourceforge.net/
 S:      Maintained
 
@@ -1340,6 +1355,11 @@ M:	kevin.curtis@farsite.co.uk
 W:      http://www.farsite.co.uk/
 S:      Supported
 
+FAULT INJECTION SUPPORT
+P:      Akinobu Mita
+M:      akinobu.mita@gmail.com
+S:      Supported
+
 FRAMEBUFFER LAYER
 P:      Antonino Daplas
 M:      adaplas@gmail.com
@@ -1389,7 +1409,7 @@ M:	hch@infradead.org
 W:      ftp://ftp.openlinux.org/pub/people/hch/vxfs
 S:      Maintained
 
-FUJITSU FR-V PORT
+FUJITSU FR-V (FRV) PORT
 P:      David Howells
 M:      dhowells@redhat.com
 S:      Maintained
@@ -1585,12 +1605,6 @@ L:	i2c@lm-sensors.org
 T:      quilt http://khali.linux-fr.org/devel/linux-2.6/jdelvare-i2c/
 S:      Maintained
 
-I2O
-P:      Markus Lidel
-M:      markus.lidel@shadowconnect.com
-W:      http://i2o.shadowconnect.com/
-S:      Maintained
-
 i386 BOOT CODE
 P:      Riley H. Williams
 M:      Riley@Williams.Name
@@ -1672,7 +1686,7 @@ S:	Maintained
 
 IEEE 1394 SUBSYSTEM
 P:      Ben Collins
-M:      bcollins@debian.org
+M:      ben.collins@ubuntu.com
 P:      Stefan Richter
 M:      stefanr@s5r6.in-berlin.de
 L:      linux1394-devel@lists.sourceforge.net
@@ -1680,25 +1694,11 @@ W:	http://www.linux1394.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git
 S:      Maintained
 
-IEEE 1394 IPV4 DRIVER (eth1394)
-P:      Stefan Richter
-M:      stefanr@s5r6.in-berlin.de
-L:      linux1394-devel@lists.sourceforge.net
-S:      Odd Fixes
-
-IEEE 1394 PCILYNX DRIVER
-P:      Jody McIntyre
-M:      scjody@modernduck.com
-P:      Stefan Richter
-M:      stefanr@s5r6.in-berlin.de
-L:      linux1394-devel@lists.sourceforge.net
-S:      Odd Fixes
-
-IEEE 1394 RAW I/O DRIVER
-P:      Ben Collins
-M:      bcollins@debian.org
+IEEE 1394 RAW I/O DRIVER (raw1394)
 P:      Dan Dennedy
 M:      dan@dennedy.org
+P:      Stefan Richter
+M:      stefanr@s5r6.in-berlin.de
 L:      linux1394-devel@lists.sourceforge.net
 S:      Maintained
 
@@ -1933,7 +1933,7 @@ P:	Vivek Goyal
 M:      vgoyal@in.ibm.com
 P:      Haren Myneni
 M:      hbabu@us.ibm.com
-L:      fastboot@lists.osdl.org
+L:      fastboot@lists.linux-foundation.org
 L:      linux-kernel@vger.kernel.org
 W:      http://lse.sourceforge.net/kdump/
 S:      Maintained
@@ -1960,7 +1960,7 @@ S:	Maintained
 
 KERNEL JANITORS
 P:      Several
-L:      kernel-janitors@lists.osdl.org
+L:      kernel-janitors@lists.linux-foundation.org
 W:      http://www.kerneljanitors.org/
 S:      Maintained
 
@@ -1983,7 +1983,7 @@ P:	Eric Biederman
 M:      ebiederm@xmission.com
 W:      http://www.xmission.com/~ebiederm/files/kexec/
 L:      linux-kernel@vger.kernel.org
-L:      fastboot@lists.osdl.org
+L:      fastboot@lists.linux-foundation.org
 S:      Maintained
 
 KPROBES
@@ -2321,7 +2321,7 @@ S:	Maintained
 NETEM NETWORK EMULATOR
 P:      Stephen Hemminger
 M:      shemminger@linux-foundation.org
-L:      netem@lists.osdl.org
+L:      netem@lists.linux-foundation.org
 S:      Maintained
 
 NETFILTER/IPTABLES/IPCHAINS
@@ -2919,9 +2919,12 @@ L:	linux-scsi@vger.kernel.org
 S:      Maintained
 
 SCTP PROTOCOL
+P:      Vlad Yasevich
+M:      vladislav.yasevich@hp.com
 P:      Sridhar Samudrala
 M:      sri@us.ibm.com
 L:      lksctp-developers@lists.sourceforge.net
+W:      http://lksctp.sourceforge.net
 S:      Supported
 
 SCx200 CPU SUPPORT
@@ -3047,7 +3050,7 @@ S:	Supported
 SOFTWARE SUSPEND:
 P:      Pavel Machek
 M:      pavel@suse.cz
-L:      linux-pm@lists.osdl.org
+L:      linux-pm@lists.linux-foundation.org
 S:      Maintained
 
 SONIC NETWORK DRIVER
diff --git a/Makefile b/Makefile
index 2f57f57d0100..d970cb16545a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 21
-EXTRAVERSION = -rc5
+EXTRAVERSION =
 NAME = Nocturnal Monster Puppy
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/core_mcpcia.c b/arch/alpha/kernel/core_mcpcia.c
index 8d019071190a..381fec0af52e 100644
--- a/arch/alpha/kernel/core_mcpcia.c
+++ b/arch/alpha/kernel/core_mcpcia.c
@@ -40,8 +40,6 @@
 # define DBG_CFG(args)
 #endif
 
-#define MCPCIA_MAX_HOSES 4
-
 /*
  * Given a bus, device, and function number, compute resulting
  * configuration space address and setup the MCPCIA_HAXR2 register
diff --git a/arch/alpha/kernel/err_titan.c b/arch/alpha/kernel/err_titan.c
index febe71c6869f..543d96d7fa2b 100644
--- a/arch/alpha/kernel/err_titan.c
+++ b/arch/alpha/kernel/err_titan.c
@@ -16,6 +16,7 @@
 #include <asm/smp.h>
 #include <asm/err_common.h>
 #include <asm/err_ev6.h>
+#include <asm/irq_regs.h>
 
 #include "err_impl.h"
 #include "proto.h"
diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
index aac6d4b22f7a..bd03dc94c72b 100644
--- a/arch/alpha/kernel/module.c
+++ b/arch/alpha/kernel/module.c
@@ -285,12 +285,12 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
                 reloc_overflow:
                         if (ELF64_ST_TYPE (sym->st_info) == STT_SECTION)
                           printk(KERN_ERR
-                                 "module %s: Relocation overflow vs section %d\n",
-                                 me->name, sym->st_shndx);
+                                 "module %s: Relocation (type %lu) overflow vs section %d\n",
+                                 me->name, r_type, sym->st_shndx);
                         else
                           printk(KERN_ERR
-                                 "module %s: Relocation overflow vs %s\n",
-                                 me->name, strtab + sym->st_name);
+                                 "module %s: Relocation (type %lu) overflow vs %s\n",
+                                 me->name, r_type, strtab + sym->st_name);
                         return -ENOEXEC;
                 }
         }
diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
index e7594a7cf585..920196bcbb61 100644
--- a/arch/alpha/kernel/sys_nautilus.c
+++ b/arch/alpha/kernel/sys_nautilus.c
@@ -70,6 +70,12 @@ nautilus_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
         /* Preserve the IRQ set up by the console.  */
 
         u8 irq;
+        /* UP1500: AGP INTA is actually routed to IRQ 5, not IRQ 10 as
+           console reports. Check the device id of AGP bridge to distinguish
+           UP1500 from UP1000/1100. Note: 'pin' is 2 due to bridge swizzle. */
+        if (slot == 1 && pin == 2 &&
+            dev->bus->self && dev->bus->self->device == 0x700f)
+                return 5;
         pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq);
         return irq;
 }
diff --git a/arch/alpha/kernel/sys_noritake.c b/arch/alpha/kernel/sys_noritake.c
index de6ba3432e8a..eb2a1d63f484 100644
--- a/arch/alpha/kernel/sys_noritake.c
+++ b/arch/alpha/kernel/sys_noritake.c
@@ -66,6 +66,13 @@ noritake_startup_irq(unsigned int irq)
         return 0;
 }
 
+static void
+noritake_end_irq(unsigned int irq)
+{
+        if (!(irq_desc[irq].status & (IRQ_DISABLED|IRQ_INPROGRESS)))
+                noritake_enable_irq(irq);
+}
+
 static struct hw_interrupt_type noritake_irq_type = {
         .typename       = "NORITAKE",
         .startup        = noritake_startup_irq,
@@ -73,7 +80,7 @@ static struct hw_interrupt_type noritake_irq_type = {
         .enable         = noritake_enable_irq,
         .disable        = noritake_disable_irq,
         .ack            = noritake_disable_irq,
-        .end            = noritake_enable_irq,
+        .end            = noritake_end_irq,
 };
 
 static void 
diff --git a/arch/alpha/kernel/sys_rawhide.c b/arch/alpha/kernel/sys_rawhide.c
index 581d08c70b92..672cb2df53df 100644
--- a/arch/alpha/kernel/sys_rawhide.c
+++ b/arch/alpha/kernel/sys_rawhide.c
@@ -52,6 +52,9 @@ rawhide_update_irq_hw(int hose, int mask)
         *(vuip)MCPCIA_INT_MASK0(MCPCIA_HOSE2MID(hose));
 }
 
+#define hose_exists(h) \
+  (((h) < MCPCIA_MAX_HOSES) && (cached_irq_masks[(h)] != 0))
+
 static inline void 
 rawhide_enable_irq(unsigned int irq)
 {
@@ -59,6 +62,9 @@ rawhide_enable_irq(unsigned int irq)
 
         irq -= 16;
         hose = irq / 24;
+        if (!hose_exists(hose)) /* if hose non-existent, exit */
+                return;
+
         irq -= hose * 24;
         mask = 1 << irq;
 
@@ -76,6 +82,9 @@ rawhide_disable_irq(unsigned int irq)
 
         irq -= 16;
         hose = irq / 24;
+        if (!hose_exists(hose)) /* if hose non-existent, exit */
+                return;
+
         irq -= hose * 24;
         mask = ~(1 << irq) | hose_irq_masks[hose];
 
@@ -93,6 +102,9 @@ rawhide_mask_and_ack_irq(unsigned int irq)
 
         irq -= 16;
         hose = irq / 24;
+        if (!hose_exists(hose)) /* if hose non-existent, exit */
+                return;
+
         irq -= hose * 24;
         mask1 = 1 << irq;
         mask = ~mask1 | hose_irq_masks[hose];
@@ -169,6 +181,9 @@ rawhide_init_irq(void)
 
         mcpcia_init_hoses();
 
+        /* Clear them all; only hoses that exist will be non-zero. */
+        for (i = 0; i < MCPCIA_MAX_HOSES; i++) cached_irq_masks[i] = 0;
+
         for (hose = hose_head; hose; hose = hose->next) {
                 unsigned int h = hose->index;
                 unsigned int mask = hose_irq_masks[h];
diff --git a/arch/alpha/kernel/sys_sio.c b/arch/alpha/kernel/sys_sio.c
index a654014d202a..14b5a753aba5 100644
--- a/arch/alpha/kernel/sys_sio.c
+++ b/arch/alpha/kernel/sys_sio.c
@@ -84,12 +84,16 @@ alphabook1_init_arch(void)
 static void __init
 sio_pci_route(void)
 {
-#if defined(ALPHA_RESTORE_SRM_SETUP)
-        /* First, read and save the original setting. */
+        unsigned int orig_route_tab;
+
+        /* First, ALWAYS read and print the original setting. */
         pci_bus_read_config_dword(pci_isa_hose->bus, PCI_DEVFN(7, 0), 0x60,
-                                  &saved_config.orig_route_tab);
+                                  &orig_route_tab);
         printk("%s: PIRQ original 0x%x new 0x%x\n", __FUNCTION__,
-               saved_config.orig_route_tab, alpha_mv.sys.sio.route_tab);
+               orig_route_tab, alpha_mv.sys.sio.route_tab);
+
+#if defined(ALPHA_RESTORE_SRM_SETUP)
+        saved_config.orig_route_tab = orig_route_tab;
 #endif
 
         /* Now override with desired setting. */
@@ -334,7 +338,7 @@ struct alpha_machine_vector avanti_mv __initmv = {
         .pci_swizzle            = common_swizzle,
 
         .sys = { .sio = {
-                .route_tab      = 0x0b0a0e0f,
+                .route_tab      = 0x0b0a050f, /* leave 14 for IDE, 9 for SND */
         }}
 };
 ALIAS_MV(avanti)
diff --git a/arch/alpha/kernel/sys_sx164.c b/arch/alpha/kernel/sys_sx164.c
index 94ad68b7c0ae..41d4ad4c7c44 100644
--- a/arch/alpha/kernel/sys_sx164.c
+++ b/arch/alpha/kernel/sys_sx164.c
@@ -132,7 +132,7 @@ sx164_init_arch(void)
 
         if (amask(AMASK_MAX) != 0
             && alpha_using_srm
-            && (cpu->pal_revision & 0xffff) == 0x117) {
+            && (cpu->pal_revision & 0xffff) <= 0x117) {
                 __asm__ __volatile__(
                 "lda    $16,8($31)\n"
                 "call_pal 9\n"          /* Allow PALRES insns in kernel mode */
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index 29ab7db81c30..f009b7bc0943 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -257,8 +257,7 @@ titan_dispatch_irqs(u64 mask)
          */
         while (mask) {
                 /* convert to SRM vector... priority is <63> -> <0> */
-                __asm__("ctlz %1, %0" : "=r"(vector) : "r"(mask));
-                vector = 63 - vector;
+                vector = 63 - __kernel_ctlz(mask);
                 mask &= ~(1UL << vector);       /* clear it out          */
                 vector = 0x900 + (vector << 4); /* convert to SRM vector */
                 
diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
index d4ca0f06be5f..a850da377a29 100644
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -1,10 +1,11 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.21-rc1
-# Wed Feb 21 16:48:01 2007
+# Linux kernel version: 2.6.21-rc6
+# Mon Apr  9 10:12:58 2007
 #
 CONFIG_ARM=y
 CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_GENERIC_GPIO=y
 # CONFIG_GENERIC_TIME is not set
 CONFIG_MMU=y
 CONFIG_NO_IOPORT=y
@@ -45,6 +46,7 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_IKCONFIG is not set
 CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
@@ -531,7 +533,6 @@ CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
-CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 CONFIG_ATA_OVER_ETH=m
 
@@ -560,7 +561,6 @@ CONFIG_IDE_GENERIC=y
 CONFIG_BLK_DEV_IDE_BAST=y
 # CONFIG_IDE_CHIPSETS is not set
 # CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_IDEDMA_AUTO is not set
 # CONFIG_BLK_DEV_HD is not set
 
 #
@@ -941,6 +941,7 @@ CONFIG_LEDS_CLASS=m
 # LED drivers
 #
 CONFIG_LEDS_S3C24XX=m
+CONFIG_LEDS_H1940=m
 
 #
 # LED Triggers
@@ -1125,6 +1126,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1169,7 +1171,6 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_DS1672 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
 # CONFIG_RTC_DRV_PCF8563 is not set
-# CONFIG_RTC_DRV_PCF8583 is not set
 # CONFIG_RTC_DRV_RS5C348 is not set
 # CONFIG_RTC_DRV_RS5C372 is not set
 CONFIG_RTC_DRV_S3C=y
diff --git a/arch/arm/kernel/dma.c b/arch/arm/kernel/dma.c
index 5a0f4bc5da95..ba99a2035523 100644
--- a/arch/arm/kernel/dma.c
+++ b/arch/arm/kernel/dma.c
@@ -228,6 +228,7 @@ int dma_channel_active(dmach_t channel)
 {
         return dma_chan[channel].active;
 }
+EXPORT_SYMBOL(dma_channel_active);
 
 void set_dma_page(dmach_t channel, char pagenr)
 {
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index f7d342ccbebf..40586e22cd38 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -320,16 +320,16 @@ void __init at91_add_device_nand(struct at91_nand_data *data)
         at91_sys_write(AT91_SMC_SETUP(3), AT91_SMC_NWESETUP_(0) | AT91_SMC_NCS_WRSETUP_(0)
                         | AT91_SMC_NRDSETUP_(0) | AT91_SMC_NCS_RDSETUP_(0));
 
-        at91_sys_write(AT91_SMC_PULSE(3), AT91_SMC_NWEPULSE_(2) | AT91_SMC_NCS_WRPULSE_(5)
-                        | AT91_SMC_NRDPULSE_(2) | AT91_SMC_NCS_RDPULSE_(5));
+        at91_sys_write(AT91_SMC_PULSE(3), AT91_SMC_NWEPULSE_(3) | AT91_SMC_NCS_WRPULSE_(3)
+                        | AT91_SMC_NRDPULSE_(3) | AT91_SMC_NCS_RDPULSE_(3));
 
-        at91_sys_write(AT91_SMC_CYCLE(3), AT91_SMC_NWECYCLE_(7) | AT91_SMC_NRDCYCLE_(7));
+        at91_sys_write(AT91_SMC_CYCLE(3), AT91_SMC_NWECYCLE_(5) | AT91_SMC_NRDCYCLE_(5));
 
         if (data->bus_width_16)
                 mode = AT91_SMC_DBW_16;
         else
                 mode = AT91_SMC_DBW_8;
-        at91_sys_write(AT91_SMC_MODE(3), mode | AT91_SMC_READMODE | AT91_SMC_WRITEMODE | AT91_SMC_EXNWMODE_DISABLE | AT91_SMC_TDF_(1));
+        at91_sys_write(AT91_SMC_MODE(3), mode | AT91_SMC_READMODE | AT91_SMC_WRITEMODE | AT91_SMC_EXNWMODE_DISABLE | AT91_SMC_TDF_(2));
 
         /* enable pin */
         if (data->enable_pin)
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index bd78058b7178..b1142ce4ac47 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Tue Jan 16 16:52:56 2007
+# Last update: Mon Apr 16 21:01:04 2007
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -1190,13 +1190,12 @@ g500			MACH_G500		G500			1178
 bug                     MACH_BUG                BUG                     1179
 mx33ads                 MACH_MX33ADS            MX33ADS                 1180
 chub                    MACH_CHUB               CHUB                    1181
-gta01                   MACH_GTA01              GTA01                   1182
+neo1973_gta01           MACH_NEO1973_GTA01      NEO1973_GTA01           1182
 w90n740                 MACH_W90N740            W90N740                 1183
 medallion_sa2410        MACH_MEDALLION_SA2410   MEDALLION_SA2410        1184
 ia_cpu_9200_2           MACH_IA_CPU_9200_2      IA_CPU_9200_2           1185
 dimmrm9200              MACH_DIMMRM9200         DIMMRM9200              1186
 pm9261                  MACH_PM9261             PM9261                  1187
-mx21                    MACH_MX21               MX21                    1188
 ml7304                  MACH_ML7304             ML7304                  1189
 ucp250                  MACH_UCP250             UCP250                  1190
 intboard                MACH_INTBOARD           INTBOARD                1191
@@ -1242,3 +1241,97 @@ xscale_treo680		MACH_XSCALE_TREO680	XSCALE_TREO680		1230
 tecon_tmezon            MACH_TECON_TMEZON       TECON_TMEZON            1231
 zylonite                MACH_ZYLONITE           ZYLONITE                1233
 gene1270                MACH_GENE1270           GENE1270                1234
+zir2412                 MACH_ZIR2412            ZIR2412                 1235
+mx31lite                MACH_MX31LITE           MX31LITE                1236
+t700wx                  MACH_T700WX             T700WX                  1237
+vf100                   MACH_VF100              VF100                   1238
+nsb2                    MACH_NSB2               NSB2                    1239
+nxhmi_bb                MACH_NXHMI_BB           NXHMI_BB                1240
+nxhmi_re                MACH_NXHMI_RE           NXHMI_RE                1241
+n4100pro                MACH_N4100PRO           N4100PRO                1242
+sam9260                 MACH_SAM9260            SAM9260                 1243
+omap_treo600            MACH_OMAP_TREO600       OMAP_TREO600            1244
+indy2410                MACH_INDY2410           INDY2410                1245
+nelt_a                  MACH_NELT_A             NELT_A                  1246
+n311                    MACH_N311               N311                    1248
+at91sam9260vgk          MACH_AT91SAM9260VGK     AT91SAM9260VGK          1249
+at91leppe               MACH_AT91LEPPE          AT91LEPPE               1250
+at91lepccn              MACH_AT91LEPCCN         AT91LEPCCN              1251
+apc7100                 MACH_APC7100            APC7100                 1252
+stargazer               MACH_STARGAZER          STARGAZER               1253
+sonata                  MACH_SONATA             SONATA                  1254
+schmoogie               MACH_SCHMOOGIE          SCHMOOGIE               1255
+aztool                  MACH_AZTOOL             AZTOOL                  1256
+mioa701                 MACH_MIOA701            MIOA701                 1257
+sxni9260                MACH_SXNI9260           SXNI9260                1258
+mxc27520evb             MACH_MXC27520EVB        MXC27520EVB             1259
+armadillo5x0            MACH_ARMADILLO5X0       ARMADILLO5X0            1260
+mb9260                  MACH_MB9260             MB9260                  1261
+mb9263                  MACH_MB9263             MB9263                  1262
+ipac9302                MACH_IPAC9302           IPAC9302                1263
+cc9p9360js              MACH_CC9P9360JS         CC9P9360JS              1264
+gallium                 MACH_GALLIUM            GALLIUM                 1265
+msc2410                 MACH_MSC2410            MSC2410                 1266
+ghi270                  MACH_GHI270             GHI270                  1267
+davinci_leonardo        MACH_DAVINCI_LEONARDO   DAVINCI_LEONARDO        1268
+oiab                    MACH_OIAB               OIAB                    1269
+smdk6400                MACH_SMDK6400           SMDK6400                1270
+nokia_n800              MACH_NOKIA_N800         NOKIA_N800              1271
+greenphone              MACH_GREENPHONE         GREENPHONE              1272
+compex42x               MACH_COMPEXWP18         COMPEXWP18              1273
+xmate                   MACH_XMATE              XMATE                   1274
+energizer               MACH_ENERGIZER          ENERGIZER               1275
+ime1                    MACH_IME1               IME1                    1276
+sweda_tms               MACH_SWEDATMS           SWEDATMS                1277
+ntnp435c                MACH_NTNP435C           NTNP435C                1278
+spectro2                MACH_SPECTRO2           SPECTRO2                1279
+h6039                   MACH_H6039              H6039                   1280
+ep80219                 MACH_EP80219            EP80219                 1281
+samoa_ii                MACH_SAMOA_II           SAMOA_II                1282
+cwmxl                   MACH_CWMXL              CWMXL                   1283
+as9200                  MACH_AS9200             AS9200                  1284
+sfx1149                 MACH_SFX1149            SFX1149                 1285
+navi010                 MACH_NAVI010            NAVI010                 1286
+multmdp                 MACH_MULTMDP            MULTMDP                 1287
+scb9520                 MACH_SCB9520            SCB9520                 1288
+htcathena               MACH_HTCATHENA          HTCATHENA               1289
+xp179                   MACH_XP179              XP179                   1290
+h4300                   MACH_H4300              H4300                   1291
+goramo_mlr              MACH_GORAMO_MLR         GORAMO_MLR              1292
+mxc30020evb             MACH_MXC30020EVB        MXC30020EVB             1293
+adsbitsymx              MACH_ADSBITSIMX         ADSBITSIMX              1294
+adsportalplus           MACH_ADSPORTALPLUS      ADSPORTALPLUS           1295
+mmsp2plus               MACH_MMSP2PLUS          MMSP2PLUS               1296
+em_x270                 MACH_EM_X270            EM_X270                 1297
+tpp302                  MACH_TPP302             TPP302                  1298
+tpp104                  MACH_TPM104             TPM104                  1299
+tpm102                  MACH_TPM102             TPM102                  1300
+tpm109                  MACH_TPM109             TPM109                  1301
+fbxo1                   MACH_FBXO1              FBXO1                   1302
+hxd8                    MACH_HXD8               HXD8                    1303
+neo1973_gta02           MACH_NEO1973_GTA02      NEO1973_GTA02           1304
+emtest                  MACH_EMTEST             EMTEST                  1305
+ad6900                  MACH_AD6900             AD6900                  1306
+europa                  MACH_EUROPA             EUROPA                  1307
+metroconnect            MACH_METROCONNECT       METROCONNECT            1308
+ez_s2410                MACH_EZ_S2410           EZ_S2410                1309
+ez_s2440                MACH_EZ_S2440           EZ_S2440                1310
+ez_ep9312               MACH_EZ_EP9312          EZ_EP9312               1311
+ez_ep9315               MACH_EZ_EP9315          EZ_EP9315               1312
+ez_x7                   MACH_EZ_X7              EZ_X7                   1313
+godotdb                 MACH_GODOTDB            GODOTDB                 1314
+mistral                 MACH_MISTRAL            MISTRAL                 1315
+msm                     MACH_MSM                MSM                     1316
+ct5910                  MACH_CT5910             CT5910                  1317
+ct5912                  MACH_CT5912             CT5912                  1318
+hynet_ine               MACH_HYNET_INE          HYNET_INE               1319
+hynet_app               MACH_HYNET_APP          HYNET_APP               1320
+msm7200                 MACH_MSM7200            MSM7200                 1321
+msm7600                 MACH_MSM7600            MSM7600                 1322
+ceb255                  MACH_CEB255             CEB255                  1323
+ciel                    MACH_CIEL               CIEL                    1324
+slm5650                 MACH_SLM5650            SLM5650                 1325
+at91sam9rlek            MACH_AT91SAM9RLEK       AT91SAM9RLEK            1326
+comtech_router          MACH_COMTECH_ROUTER     COMTECH_ROUTER          1327
+sbc2410x                MACH_SBC2410X           SBC2410X                1328
+at4x0bd                 MACH_AT4X0BD            AT4X0BD                 1329
diff --git a/arch/cris/arch-v32/drivers/pci/bios.c b/arch/cris/arch-v32/drivers/pci/bios.c
index a2b9c60c2777..5b79a7a772d4 100644
--- a/arch/cris/arch-v32/drivers/pci/bios.c
+++ b/arch/cris/arch-v32/drivers/pci/bios.c
@@ -100,7 +100,9 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
         if ((err = pcibios_enable_resources(dev, mask)) < 0)
                 return err;
 
-        return pcibios_enable_irq(dev);
+        if (!dev->msi_enabled)
+                pcibios_enable_irq(dev);
+        return 0;
 }
 
 int pcibios_assign_resources(void)
diff --git a/arch/frv/mb93090-mb00/pci-vdk.c b/arch/frv/mb93090-mb00/pci-vdk.c
index f7279d78995a..0b581e3cf7c7 100644
--- a/arch/frv/mb93090-mb00/pci-vdk.c
+++ b/arch/frv/mb93090-mb00/pci-vdk.c
@@ -466,6 +466,7 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
 
         if ((err = pcibios_enable_resources(dev, mask)) < 0)
                 return err;
-        pcibios_enable_irq(dev);
+        if (!dev->msi_enabled)
+                pcibios_enable_irq(dev);
         return 0;
 }
diff --git a/arch/i386/boot/video.S b/arch/i386/boot/video.S
index 2c5b5cc55f79..8143c9516cb4 100644
--- a/arch/i386/boot/video.S
+++ b/arch/i386/boot/video.S
@@ -571,6 +571,16 @@ setr1:	lodsw
         jmp     _m_s
 
 check_vesa:
+#ifdef CONFIG_FIRMWARE_EDID
+        leaw    modelist+1024, %di
+        movw    $0x4f00, %ax
+        int     $0x10
+        cmpw    $0x004f, %ax
+        jnz     setbad
+
+        movw    4(%di), %ax
+        movw    %ax, vbe_version
+#endif
         leaw    modelist+1024, %di
         subb    $VIDEO_FIRST_VESA>>8, %bh
         movw    %bx, %cx                        # Get mode information structure
@@ -1945,6 +1955,9 @@ store_edid:
         rep
         stosl
 
+        cmpw    $0x0200, vbe_version            # only do EDID on >= VBE2.0
+        jl      no_edid
+
         pushw   %es                             # save ES
         xorw    %di, %di                        # Report Capability
         pushw   %di
@@ -1987,6 +2000,7 @@ do_restore:	.byte	0	# Screen contents altered during mode change
 svga_prefix:    .byte   VIDEO_FIRST_BIOS>>8     # Default prefix for BIOS modes
 graphic_mode:   .byte   0       # Graphic mode with a linear frame buffer
 dac_size:       .byte   6       # DAC bit depth
+vbe_version:    .word   0       # VBE bios version
 
 # Status messages
 keymsg:         .ascii  "Press <RETURN> to see video modes available, "
diff --git a/arch/i386/kernel/alternative.c b/arch/i386/kernel/alternative.c
index 9eca21b49f6b..426f59b0106b 100644
--- a/arch/i386/kernel/alternative.c
+++ b/arch/i386/kernel/alternative.c
@@ -5,15 +5,9 @@
 #include <asm/alternative.h>
 #include <asm/sections.h>
 
-static int no_replacement    = 0;
 static int smp_alt_once      = 0;
 static int debug_alternative = 0;
 
-static int __init noreplacement_setup(char *s)
-{
-        no_replacement = 1;
-        return 1;
-}
 static int __init bootonly(char *str)
 {
         smp_alt_once = 1;
@@ -25,7 +19,6 @@ static int __init debug_alt(char *str)
         return 1;
 }
 
-__setup("noreplacement", noreplacement_setup);
 __setup("smp-alt-boot", bootonly);
 __setup("debug-alternative", debug_alt);
 
@@ -252,9 +245,6 @@ void alternatives_smp_module_add(struct module *mod, char *name,
         struct smp_alt_module *smp;
         unsigned long flags;
 
-        if (no_replacement)
-                return;
-
         if (smp_alt_once) {
                 if (boot_cpu_has(X86_FEATURE_UP))
                         alternatives_smp_unlock(locks, locks_end,
@@ -289,7 +279,7 @@ void alternatives_smp_module_del(struct module *mod)
         struct smp_alt_module *item;
         unsigned long flags;
 
-        if (no_replacement || smp_alt_once)
+        if (smp_alt_once)
                 return;
 
         spin_lock_irqsave(&smp_alt, flags);
@@ -320,7 +310,7 @@ void alternatives_smp_switch(int smp)
         return;
 #endif
 
-        if (no_replacement || smp_alt_once)
+        if (smp_alt_once)
                 return;
         BUG_ON(!smp && (num_online_cpus() > 1));
 
@@ -386,13 +376,6 @@ extern struct paravirt_patch __start_parainstructions[],
 void __init alternative_instructions(void)
 {
         unsigned long flags;
-        if (no_replacement) {
-                printk(KERN_INFO "(SMP-)alternatives turned off\n");
-                free_init_pages("SMP alternatives",
-                                (unsigned long)__smp_alt_begin,
-                                (unsigned long)__smp_alt_end);
-                return;
-        }
 
         local_irq_save(flags);
         apply_alternatives(__alt_instructions, __alt_instructions_end);
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index e88415282a6f..93aa911646ad 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -272,32 +272,6 @@ static void __devinit setup_APIC_timer(void)
 }
 
 /*
- * Detect systems with known broken BIOS implementations
- */
-static int __init lapic_check_broken_bios(struct dmi_system_id *d)
-{
-        printk(KERN_NOTICE "%s detected: disabling lapic timer.\n",
-                       d->ident);
-        local_apic_timer_disabled = 1;
-        return 0;
-}
-
-static struct dmi_system_id __initdata broken_bios_dmi_table[] = {
-        {
-                /*
-                 * BIOS exports only C1 state, but uses deeper power
-                 * modes behind the kernels back.
-                 */
-                  .callback = lapic_check_broken_bios,
-                  .ident = "HP nx6325",
-                  .matches = {
-                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq nx6325"),
-                  },
-         },
-         {}
-};
-
-/*
  * In this functions we calibrate APIC bus clocks to the external timer.
  *
  * We want to do the calibration only once since we want to have local timer
@@ -372,12 +346,12 @@ void __init setup_boot_APIC_clock(void)
         long delta, deltapm;
         int pm_referenced = 0;
 
-        /* Detect know broken systems */
-        dmi_check_system(broken_bios_dmi_table);
+        if (boot_cpu_has(X86_FEATURE_LAPIC_TIMER_BROKEN))
+                local_apic_timer_disabled = 1;
 
         /*
          * The local apic timer can be disabled via the kernel
-         * commandline or from the dmi quirk above. Register the lapic
+         * commandline or from the test above. Register the lapic
          * timer as a dummy clock event source on SMP systems, so the
          * broadcast mechanism is used. On UP systems simply ignore it.
          */
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index 41cfea57232b..2d47db482972 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -22,6 +22,37 @@
 extern void vide(void);
 __asm__(".align 4\nvide: ret");
 
+#define ENABLE_C1E_MASK         0x18000000
+#define CPUID_PROCESSOR_SIGNATURE       1
+#define CPUID_XFAM              0x0ff00000
+#define CPUID_XFAM_K8           0x00000000
+#define CPUID_XFAM_10H          0x00100000
+#define CPUID_XFAM_11H          0x00200000
+#define CPUID_XMOD              0x000f0000
+#define CPUID_XMOD_REV_F        0x00040000
+
+/* AMD systems with C1E don't have a working lAPIC timer. Check for that. */
+static __cpuinit int amd_apic_timer_broken(void)
+{
+        u32 lo, hi;
+        u32 eax = cpuid_eax(CPUID_PROCESSOR_SIGNATURE);
+        switch (eax & CPUID_XFAM) {
+        case CPUID_XFAM_K8:
+                if ((eax & CPUID_XMOD) < CPUID_XMOD_REV_F)
+                        break;
+        case CPUID_XFAM_10H:
+        case CPUID_XFAM_11H:
+                rdmsr(MSR_K8_ENABLE_C1E, lo, hi);
+                if (lo & ENABLE_C1E_MASK)
+                        return 1;
+                break;
+        default:
+                /* err on the side of caution */
+                return 1;
+        }
+        return 0;
+}
+
 static void __cpuinit init_amd(struct cpuinfo_x86 *c)
 {
         u32 l, h;
@@ -241,6 +272,9 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
 
         if (cpuid_eax(0x80000000) >= 0x80000006)
                 num_cache_leaves = 3;
+
+        if (amd_apic_timer_broken())
+                set_bit(X86_FEATURE_LAPIC_TIMER_BROKEN, c->x86_capability);
 }
 
 static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 * c, unsigned int size)
diff --git a/arch/i386/kernel/cpu/cpufreq/longhaul.c b/arch/i386/kernel/cpu/cpufreq/longhaul.c
index a1f1b715bcf8..2b030d6ccbf7 100644
--- a/arch/i386/kernel/cpu/cpufreq/longhaul.c
+++ b/arch/i386/kernel/cpu/cpufreq/longhaul.c
@@ -758,7 +758,7 @@ static int __init longhaul_cpu_init(struct cpufreq_policy *policy)
                                 NULL, (void *)&pr);
 
         /* Check ACPI support for C3 state */
-        if (pr != NULL && longhaul_version != TYPE_LONGHAUL_V1) {
+        if (pr != NULL && longhaul_version == TYPE_POWERSAVER) {
                 cx = &pr->power.states[ACPI_STATE_C3];
                 if (cx->address > 0 && cx->latency <= 1000) {
                         longhaul_flags |= USE_ACPI_C3;
diff --git a/arch/i386/kernel/hpet.c b/arch/i386/kernel/hpet.c
index f3ab61ee7498..17d73459fc5f 100644
--- a/arch/i386/kernel/hpet.c
+++ b/arch/i386/kernel/hpet.c
@@ -3,6 +3,8 @@
 #include <linux/errno.h>
 #include <linux/hpet.h>
 #include <linux/init.h>
+#include <linux/sysdev.h>
+#include <linux/pm.h>
 
 #include <asm/hpet.h>
 #include <asm/io.h>
@@ -197,7 +199,7 @@ static int hpet_next_event(unsigned long delta,
         cnt += delta;
         hpet_writel(cnt, HPET_T0_CMP);
 
-        return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0);
+        return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0) ? -ETIME : 0;
 }
 
 /*
@@ -307,6 +309,7 @@ int __init hpet_enable(void)
 out_nohpet:
         iounmap(hpet_virt_address);
         hpet_virt_address = NULL;
+        boot_hpet_disable = 1;
         return 0;
 }
 
@@ -521,3 +524,68 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 #endif
+
+
+/*
+ * Suspend/resume part
+ */
+
+#ifdef CONFIG_PM
+
+static int hpet_suspend(struct sys_device *sys_device, pm_message_t state)
+{
+        unsigned long cfg = hpet_readl(HPET_CFG);
+
+        cfg &= ~(HPET_CFG_ENABLE|HPET_CFG_LEGACY);
+        hpet_writel(cfg, HPET_CFG);
+
+        return 0;
+}
+
+static int hpet_resume(struct sys_device *sys_device)
+{
+        unsigned int id;
+
+        hpet_start_counter();
+
+        id = hpet_readl(HPET_ID);
+
+        if (id & HPET_ID_LEGSUP)
+                hpet_enable_int();
+
+        return 0;
+}
+
+static struct sysdev_class hpet_class = {
+        set_kset_name("hpet"),
+        .suspend        = hpet_suspend,
+        .resume         = hpet_resume,
+};
+
+static struct sys_device hpet_device = {
+        .id             = 0,
+        .cls            = &hpet_class,
+};
+
+
+static __init int hpet_register_sysfs(void)
+{
+        int err;
+
+        if (!is_hpet_capable())
+                return 0;
+
+        err = sysdev_class_register(&hpet_class);
+
+        if (!err) {
+                err = sysdev_register(&hpet_device);
+                if (err)
+                        sysdev_class_unregister(&hpet_class);
+        }
+
+        return err;
+}
+
+device_initcall(hpet_register_sysfs);
+
+#endif
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index e4408ff4e674..b3ab8ffebd27 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -736,7 +736,7 @@ failed:
         return 0;
 }
 
-int __init irqbalance_disable(char *str)
+int __devinit irqbalance_disable(char *str)
 {
         irqbalance_disabled = 1;
         return 1;
diff --git a/arch/i386/kernel/microcode.c b/arch/i386/kernel/microcode.c
index b8f16633a6ec..cbe7ec8dbb9f 100644
--- a/arch/i386/kernel/microcode.c
+++ b/arch/i386/kernel/microcode.c
@@ -567,6 +567,53 @@ static int cpu_request_microcode(int cpu)
         return error;
 }
 
+static int apply_microcode_on_cpu(int cpu)
+{
+        struct cpuinfo_x86 *c = cpu_data + cpu;
+        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
+        cpumask_t old;
+        unsigned int val[2];
+        int err = 0;
+
+        if (!uci->mc)
+                return -EINVAL;
+
+        old = current->cpus_allowed;
+        set_cpus_allowed(current, cpumask_of_cpu(cpu));
+
+        /* Check if the microcode we have in memory matches the CPU */
+        if (c->x86_vendor != X86_VENDOR_INTEL || c->x86 < 6 ||
+            cpu_has(c, X86_FEATURE_IA64) || uci->sig != cpuid_eax(0x00000001))
+                err = -EINVAL;
+
+        if (!err && ((c->x86_model >= 5) || (c->x86 > 6))) {
+                /* get processor flags from MSR 0x17 */
+                rdmsr(MSR_IA32_PLATFORM_ID, val[0], val[1]);
+                if (uci->pf != (1 << ((val[1] >> 18) & 7)))
+                        err = -EINVAL;
+        }
+
+        if (!err) {
+                wrmsr(MSR_IA32_UCODE_REV, 0, 0);
+                /* see notes above for revision 1.07.  Apparent chip bug */
+                sync_core();
+                /* get the current revision from MSR 0x8B */
+                rdmsr(MSR_IA32_UCODE_REV, val[0], val[1]);
+                if (uci->rev != val[1])
+                        err = -EINVAL;
+        }
+
+        if (!err)
+                apply_microcode(cpu);
+        else
+                printk(KERN_ERR "microcode: Could not apply microcode to CPU%d:"
+                        " sig=0x%x, pf=0x%x, rev=0x%x\n",
+                        cpu, uci->sig, uci->pf, uci->rev);
+
+        set_cpus_allowed(current, old);
+        return err;
+}
+
 static void microcode_init_cpu(int cpu)
 {
         cpumask_t old;
@@ -577,7 +624,8 @@ static void microcode_init_cpu(int cpu)
         set_cpus_allowed(current, cpumask_of_cpu(cpu));
         mutex_lock(&microcode_mutex);
         collect_cpu_info(cpu);
-        if (uci->valid && system_state == SYSTEM_RUNNING)
+        if (uci->valid && system_state == SYSTEM_RUNNING &&
+            !suspend_cpu_hotplug)
                 cpu_request_microcode(cpu);
         mutex_unlock(&microcode_mutex);
         set_cpus_allowed(current, old);
@@ -663,13 +711,24 @@ static int mc_sysdev_add(struct sys_device *sys_dev)
                 return 0;
 
         pr_debug("Microcode:CPU %d added\n", cpu);
-        memset(uci, 0, sizeof(*uci));
+        /* If suspend_cpu_hotplug is set, the system is resuming and we should
+         * use the data from before the suspend.
+         */
+        if (suspend_cpu_hotplug) {
+                err = apply_microcode_on_cpu(cpu);
+                if (err)
+                        microcode_fini_cpu(cpu);
+        }
+        if (!uci->valid)
+                memset(uci, 0, sizeof(*uci));
 
         err = sysfs_create_group(&sys_dev->kobj, &mc_attr_group);
         if (err)
                 return err;
 
-        microcode_init_cpu(cpu);
+        if (!uci->valid)
+                microcode_init_cpu(cpu);
+
         return 0;
 }
 
@@ -680,7 +739,11 @@ static int mc_sysdev_remove(struct sys_device *sys_dev)
         if (!cpu_online(cpu))
                 return 0;
         pr_debug("Microcode:CPU %d removed\n", cpu);
-        microcode_fini_cpu(cpu);
+        /* If suspend_cpu_hotplug is set, the system is suspending and we should
+         * keep the microcode in memory for the resume.
+         */
+        if (!suspend_cpu_hotplug)
+                microcode_fini_cpu(cpu);
         sysfs_remove_group(&sys_dev->kobj, &mc_attr_group);
         return 0;
 }
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 14702427b104..84c3497efb60 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -41,16 +41,17 @@ int nmi_watchdog_enabled;
  *   different subsystems this reservation system just tries to coordinate
  *   things a little
  */
-static DEFINE_PER_CPU(unsigned long, perfctr_nmi_owner);
-static DEFINE_PER_CPU(unsigned long, evntsel_nmi_owner[3]);
-
-static cpumask_t backtrace_mask = CPU_MASK_NONE;
 
 /* this number is calculated from Intel's MSR_P4_CRU_ESCR5 register and it's
  * offset from MSR_P4_BSU_ESCR0.  It will be the max for all platforms (for now)
  */
 #define NMI_MAX_COUNTER_BITS 66
+#define NMI_MAX_COUNTER_LONGS BITS_TO_LONGS(NMI_MAX_COUNTER_BITS)
+
+static DEFINE_PER_CPU(unsigned long, perfctr_nmi_owner[NMI_MAX_COUNTER_LONGS]);
+static DEFINE_PER_CPU(unsigned long, evntsel_nmi_owner[NMI_MAX_COUNTER_LONGS]);
 
+static cpumask_t backtrace_mask = CPU_MASK_NONE;
 /* nmi_active:
  * >0: the lapic NMI watchdog is active, but can be disabled
  * <0: the lapic NMI watchdog has not been set up, and cannot
@@ -122,64 +123,129 @@ static inline unsigned int nmi_evntsel_msr_to_bit(unsigned int msr)
 /* checks for a bit availability (hack for oprofile) */
 int avail_to_resrv_perfctr_nmi_bit(unsigned int counter)
 {
+        int cpu;
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
-
-        return (!test_bit(counter, &__get_cpu_var(perfctr_nmi_owner)));
+        for_each_possible_cpu (cpu) {
+                if (test_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)[0]))
+                        return 0;
+        }
+        return 1;
 }
 
 /* checks the an msr for availability */
 int avail_to_resrv_perfctr_nmi(unsigned int msr)
 {
         unsigned int counter;
+        int cpu;
 
         counter = nmi_perfctr_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        return (!test_bit(counter, &__get_cpu_var(perfctr_nmi_owner)));
+        for_each_possible_cpu (cpu) {
+                if (test_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)[0]))
+                        return 0;
+        }
+        return 1;
 }
 
-int reserve_perfctr_nmi(unsigned int msr)
+static int __reserve_perfctr_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_perfctr_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        if (!test_and_set_bit(counter, &__get_cpu_var(perfctr_nmi_owner)))
+        if (!test_and_set_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)[0]))
                 return 1;
         return 0;
 }
 
-void release_perfctr_nmi(unsigned int msr)
+static void __release_perfctr_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_perfctr_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        clear_bit(counter, &__get_cpu_var(perfctr_nmi_owner));
+        clear_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)[0]);
 }
 
-int reserve_evntsel_nmi(unsigned int msr)
+int reserve_perfctr_nmi(unsigned int msr)
+{
+        int cpu, i;
+        for_each_possible_cpu (cpu) {
+                if (!__reserve_perfctr_nmi(cpu, msr)) {
+                        for_each_possible_cpu (i) {
+                                if (i >= cpu)
+                                        break;
+                                __release_perfctr_nmi(i, msr);
+                        }
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+void release_perfctr_nmi(unsigned int msr)
+{
+        int cpu;
+        for_each_possible_cpu (cpu) {
+                __release_perfctr_nmi(cpu, msr);
+        }
+}
+
+int __reserve_evntsel_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_evntsel_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        if (!test_and_set_bit(counter, &__get_cpu_var(evntsel_nmi_owner)[0]))
+        if (!test_and_set_bit(counter, &per_cpu(evntsel_nmi_owner, cpu)[0]))
                 return 1;
         return 0;
 }
 
-void release_evntsel_nmi(unsigned int msr)
+static void __release_evntsel_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_evntsel_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        clear_bit(counter, &__get_cpu_var(evntsel_nmi_owner)[0]);
+        clear_bit(counter, &per_cpu(evntsel_nmi_owner, cpu)[0]);
+}
+
+int reserve_evntsel_nmi(unsigned int msr)
+{
+        int cpu, i;
+        for_each_possible_cpu (cpu) {
+                if (!__reserve_evntsel_nmi(cpu, msr)) {
+                        for_each_possible_cpu (i) {
+                                if (i >= cpu)
+                                        break;
+                                __release_evntsel_nmi(i, msr);
+                        }
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+void release_evntsel_nmi(unsigned int msr)
+{
+        int cpu;
+        for_each_possible_cpu (cpu) {
+                __release_evntsel_nmi(cpu, msr);
+        }
 }
 
 static __cpuinit inline int nmi_known_cpu(void)
@@ -263,7 +329,7 @@ static int __init check_nmi_watchdog(void)
         for_each_possible_cpu(cpu)
                 prev_nmi_count[cpu] = per_cpu(irq_stat, cpu).__nmi_count;
         local_irq_enable();
-        mdelay((10*1000)/nmi_hz); // wait 10 ticks
+        mdelay((20*1000)/nmi_hz); // wait 20 ticks
 
         for_each_possible_cpu(cpu) {
 #ifdef CONFIG_SMP
@@ -507,10 +573,10 @@ static int setup_k7_watchdog(void)
 
         perfctr_msr = MSR_K7_PERFCTR0;
         evntsel_msr = MSR_K7_EVNTSEL0;
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         wrmsrl(perfctr_msr, 0UL);
@@ -533,7 +599,7 @@ static int setup_k7_watchdog(void)
         wd->check_bit = 1ULL<<63;
         return 1;
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -544,8 +610,8 @@ static void stop_k7_watchdog(void)
 
         wrmsr(wd->evntsel_msr, 0, 0);
 
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 #define P6_EVNTSEL0_ENABLE      (1 << 22)
@@ -563,10 +629,10 @@ static int setup_p6_watchdog(void)
 
         perfctr_msr = MSR_P6_PERFCTR0;
         evntsel_msr = MSR_P6_EVNTSEL0;
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         wrmsrl(perfctr_msr, 0UL);
@@ -590,7 +656,7 @@ static int setup_p6_watchdog(void)
         wd->check_bit = 1ULL<<39;
         return 1;
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -601,8 +667,8 @@ static void stop_p6_watchdog(void)
 
         wrmsr(wd->evntsel_msr, 0, 0);
 
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 /* Note that these events don't tick when the CPU idles. This means
@@ -668,10 +734,10 @@ static int setup_p4_watchdog(void)
                 cccr_val = P4_CCCR_OVF_PMI1 | P4_CCCR_ESCR_SELECT(4);
         }
 
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         evntsel = P4_ESCR_EVENT_SELECT(0x3F)
@@ -695,7 +761,7 @@ static int setup_p4_watchdog(void)
         wd->check_bit = 1ULL<<39;
         return 1;
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -707,8 +773,8 @@ static void stop_p4_watchdog(void)
         wrmsr(wd->cccr_msr, 0, 0);
         wrmsr(wd->evntsel_msr, 0, 0);
 
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 #define ARCH_PERFMON_NMI_EVENT_SEL      ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
@@ -736,10 +802,10 @@ static int setup_intel_arch_watchdog(void)
         perfctr_msr = MSR_ARCH_PERFMON_PERFCTR0;
         evntsel_msr = MSR_ARCH_PERFMON_EVENTSEL0;
 
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         wrmsrl(perfctr_msr, 0UL);
@@ -764,7 +830,7 @@ static int setup_intel_arch_watchdog(void)
         wd->check_bit = 1ULL << (eax.split.bit_width - 1);
         return 1;
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -787,8 +853,8 @@ static void stop_intel_arch_watchdog(void)
                 return;
 
         wrmsr(wd->evntsel_msr, 0, 0);
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 void setup_apic_nmi_watchdog (void *unused)
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index fb07a1aad225..697a70e8c0c9 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -69,6 +69,7 @@ struct {
         void (*flush_tlb)(int);
         void (*set_initial_ap_state)(int, int);
         void (*halt)(void);
+        void (*set_lazy_mode)(int mode);
 } vmi_ops;
 
 /* XXX move this to alternative.h */
@@ -574,6 +575,26 @@ vmi_startup_ipi_hook(int phys_apicid, unsigned long start_eip,
 }
 #endif
 
+static void vmi_set_lazy_mode(int mode)
+{
+        static DEFINE_PER_CPU(int, lazy_mode);
+
+        if (!vmi_ops.set_lazy_mode)
+                return;
+
+        /* Modes should never nest or overlap */
+        BUG_ON(__get_cpu_var(lazy_mode) && !(mode == PARAVIRT_LAZY_NONE ||
+                                             mode == PARAVIRT_LAZY_FLUSH));
+
+        if (mode == PARAVIRT_LAZY_FLUSH) {
+                vmi_ops.set_lazy_mode(0);
+                vmi_ops.set_lazy_mode(__get_cpu_var(lazy_mode));
+        } else {
+                vmi_ops.set_lazy_mode(mode);
+                __get_cpu_var(lazy_mode) = mode;
+        }
+}
+
 static inline int __init check_vmi_rom(struct vrom_header *rom)
 {
         struct pci_header *pci;
@@ -691,11 +712,14 @@ static void *vmi_get_function(int vmicall)
 do {                                                            \
         reloc = call_vrom_long_func(vmi_rom, get_reloc,         \
                                     VMI_CALL_##vmicall);        \
-        if (rel->type != VMI_RELOCATION_NONE) {                 \
-                BUG_ON(rel->type != VMI_RELOCATION_CALL_REL);   \
+        if (rel->type == VMI_RELOCATION_CALL_REL)               \
                 paravirt_ops.opname = (void *)rel->eip;         \
-        } else if (rel->type == VMI_RELOCATION_NOP)             \
+        else if (rel->type == VMI_RELOCATION_NOP)               \
                 paravirt_ops.opname = (void *)vmi_nop;          \
+        else if (rel->type != VMI_RELOCATION_NONE)              \
+                printk(KERN_WARNING "VMI: Unknown relocation "  \
+                                    "type %d for " #vmicall"\n",\
+                                        rel->type);             \
 } while (0)
 
 /*
@@ -804,7 +828,7 @@ static inline int __init activate_vmi(void)
         para_wrap(load_esp0, vmi_load_esp0, set_kernel_stack, UpdateKernelStack);
         para_fill(set_iopl_mask, SetIOPLMask);
         para_fill(io_delay, IODelay);
-        para_fill(set_lazy_mode, SetLazyMode);
+        para_wrap(set_lazy_mode, vmi_set_lazy_mode, set_lazy_mode, SetLazyMode);
 
         /* user and kernel flush are just handled with different flags to FlushTLB */
         para_wrap(flush_tlb_user, vmi_flush_tlb_user, flush_tlb, FlushTLB);
diff --git a/arch/i386/kernel/vmlinux.lds.S b/arch/i386/kernel/vmlinux.lds.S
index ca51610955df..6f38f818380b 100644
--- a/arch/i386/kernel/vmlinux.lds.S
+++ b/arch/i386/kernel/vmlinux.lds.S
@@ -26,7 +26,7 @@ OUTPUT_FORMAT("elf32-i386", "elf32-i386", "elf32-i386")
 OUTPUT_ARCH(i386)
 ENTRY(phys_startup_32)
 jiffies = jiffies_64;
-_proxy_pda = 0;
+_proxy_pda = 1;
 
 PHDRS {
         text PT_LOAD FLAGS(5);  /* R_E */
diff --git a/arch/i386/lib/usercopy.c b/arch/i386/lib/usercopy.c
index d22cfc9d656c..086b3726862a 100644
--- a/arch/i386/lib/usercopy.c
+++ b/arch/i386/lib/usercopy.c
@@ -10,6 +10,7 @@
 #include <linux/blkdev.h>
 #include <linux/module.h>
 #include <linux/backing-dev.h>
+#include <linux/interrupt.h>
 #include <asm/uaccess.h>
 #include <asm/mmx.h>
 
@@ -719,6 +720,14 @@ unsigned long __copy_to_user_ll(void __user *to, const void *from,
 #ifndef CONFIG_X86_WP_WORKS_OK
         if (unlikely(boot_cpu_data.wp_works_ok == 0) &&
                         ((unsigned long )to) < TASK_SIZE) {
+                /*
+                 * When we are in an atomic section (see
+                 * mm/filemap.c:file_read_actor), return the full
+                 * length to take the slow path.
+                 */
+                if (in_atomic())
+                        return n;
+
                 /* 
                  * CPU does not honor the WP bit when writing
                  * from supervisory mode, and due to preemption or SMP,
diff --git a/arch/i386/mm/highmem.c b/arch/i386/mm/highmem.c
index bb2de1089add..ac70d09df7ee 100644
--- a/arch/i386/mm/highmem.c
+++ b/arch/i386/mm/highmem.c
@@ -42,6 +42,7 @@ void *kmap_atomic(struct page *page, enum km_type type)
 
         vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
         set_pte(kmap_pte-idx, mk_pte(page, kmap_prot));
+        arch_flush_lazy_mmu_mode();
 
         return (void*) vaddr;
 }
@@ -82,6 +83,7 @@ void *kmap_atomic_pfn(unsigned long pfn, enum km_type type)
         idx = type + KM_TYPE_NR*smp_processor_id();
         vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
         set_pte(kmap_pte-idx, pfn_pte(pfn, kmap_prot));
+        arch_flush_lazy_mmu_mode();
 
         return (void*) vaddr;
 }
diff --git a/arch/i386/pci/common.c b/arch/i386/pci/common.c
index 1bb069372143..3f78d4d8ecf3 100644
--- a/arch/i386/pci/common.c
+++ b/arch/i386/pci/common.c
@@ -193,6 +193,14 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
         },
         {
                 .callback = set_bf_sort,
+                .ident = "Dell PowerEdge R900",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R900"),
+                },
+        },
+        {
+                .callback = set_bf_sort,
                 .ident = "HP ProLiant BL20p G3",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "HP"),
@@ -426,11 +434,13 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
         if ((err = pcibios_enable_resources(dev, mask)) < 0)
                 return err;
 
-        return pcibios_enable_irq(dev);
+        if (!dev->msi_enabled)
+                return pcibios_enable_irq(dev);
+        return 0;
 }
 
 void pcibios_disable_device (struct pci_dev *dev)
 {
-        if (pcibios_disable_irq)
+        if (!dev->msi_enabled && pcibios_disable_irq)
                 pcibios_disable_irq(dev);
 }
diff --git a/arch/ia64/kernel/msi_ia64.c b/arch/ia64/kernel/msi_ia64.c
index e7220900ea14..c81080df70df 100644
--- a/arch/ia64/kernel/msi_ia64.c
+++ b/arch/ia64/kernel/msi_ia64.c
@@ -68,7 +68,7 @@ int ia64_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
 {
         struct msi_msg  msg;
         unsigned long   dest_phys_id;
-        unsigned int    irq, vector;
+        int     irq, vector;
 
         irq = create_irq();
         if (irq < 0)
@@ -76,7 +76,7 @@ int ia64_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
 
         set_irq_msi(irq, desc);
         dest_phys_id = cpu_physical_id(first_cpu(cpu_online_map));
-        vector = irq;
+        vector = irq_to_vector(irq);
 
         msg.address_hi = 0;
         msg.address_lo =
@@ -110,7 +110,7 @@ static void ia64_ack_msi_irq(unsigned int irq)
 
 static int ia64_msi_retrigger_irq(unsigned int irq)
 {
-        unsigned int vector = irq;
+        unsigned int vector = irq_to_vector(irq);
         ia64_resend_irq(vector);
 
         return 1;
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index 69b9bb3fd7c5..dc7dd7648ec5 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -640,7 +640,7 @@ show_cpuinfo (struct seq_file *m, void *v)
                    "features   : %s\n"
                    "cpu number : %lu\n"
                    "cpu regs   : %u\n"
-                   "cpu MHz    : %lu.%06lu\n"
+                   "cpu MHz    : %lu.%03lu\n"
                    "itc MHz    : %lu.%06lu\n"
                    "BogoMIPS   : %lu.%02lu\n",
                    cpunum, c->vendor, c->family, c->model,
diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c
index b21ddecea943..ff7df439da6d 100644
--- a/arch/ia64/kernel/smpboot.c
+++ b/arch/ia64/kernel/smpboot.c
@@ -375,6 +375,7 @@ static void __devinit
 smp_callin (void)
 {
         int cpuid, phys_id, itc_master;
+        struct cpuinfo_ia64 *last_cpuinfo, *this_cpuinfo;
         extern void ia64_init_itm(void);
         extern volatile int time_keeper_id;
 
@@ -424,7 +425,21 @@ smp_callin (void)
          * Get our bogomips.
          */
         ia64_init_itm();
-        calibrate_delay();
+
+        /*
+         * Delay calibration can be skipped if new processor is identical to the
+         * previous processor.
+         */
+        last_cpuinfo = cpu_data(cpuid - 1);
+        this_cpuinfo = local_cpu_data;
+        if (last_cpuinfo->itc_freq != this_cpuinfo->itc_freq ||
+            last_cpuinfo->proc_freq != this_cpuinfo->proc_freq ||
+            last_cpuinfo->features != this_cpuinfo->features ||
+            last_cpuinfo->revision != this_cpuinfo->revision ||
+            last_cpuinfo->family != this_cpuinfo->family ||
+            last_cpuinfo->archrev != this_cpuinfo->archrev ||
+            last_cpuinfo->model != this_cpuinfo->model)
+                calibrate_delay();
         local_cpu_data->loops_per_jiffy = loops_per_jiffy;
 
 #ifdef CONFIG_IA32_SUPPORT
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index c8da621aab17..4f36987eea72 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -155,7 +155,7 @@ ia64_set_rbs_bot (void)
 
         if (stack_size > MAX_USER_STACK_SIZE)
                 stack_size = MAX_USER_STACK_SIZE;
-        current->thread.rbs_bot = STACK_TOP - stack_size;
+        current->thread.rbs_bot = PAGE_ALIGN(current->mm->start_stack - stack_size);
 }
 
 /*
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index 474d179966dc..0e83f3b419b5 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -557,14 +557,17 @@ pcibios_enable_device (struct pci_dev *dev, int mask)
         if (ret < 0)
                 return ret;
 
-        return acpi_pci_irq_enable(dev);
+        if (!dev->msi_enabled)
+                return acpi_pci_irq_enable(dev);
+        return 0;
 }
 
 void
 pcibios_disable_device (struct pci_dev *dev)
 {
         BUG_ON(atomic_read(&dev->enable_cnt));
-        acpi_pci_irq_disable(dev);
+        if (!dev->msi_enabled)
+                acpi_pci_irq_disable(dev);
 }
 
 void
diff --git a/arch/ia64/sn/kernel/bte_error.c b/arch/ia64/sn/kernel/bte_error.c
index f1ec1370b3e3..b6fcf8164f2b 100644
--- a/arch/ia64/sn/kernel/bte_error.c
+++ b/arch/ia64/sn/kernel/bte_error.c
@@ -78,7 +78,7 @@ int shub1_bte_error_handler(unsigned long _nodepda)
                  * There are errors which still need to be cleaned up by
                  * hubiio_crb_error_handler
                  */
-                mod_timer(recovery_timer, HZ * 5);
+                mod_timer(recovery_timer, jiffies + (HZ * 5));
                 BTE_PRINTK(("eh:%p:%d Marked Giving up\n", err_nodepda,
                             smp_processor_id()));
                 return 1;
@@ -95,7 +95,7 @@ int shub1_bte_error_handler(unsigned long _nodepda)
                         icrbd.ii_icrb0_d_regval =
                             REMOTE_HUB_L(nasid, IIO_ICRB_D(i));
                         if (icrbd.d_bteop) {
-                                mod_timer(recovery_timer, HZ * 5);
+                                mod_timer(recovery_timer, jiffies + (HZ * 5));
                                 BTE_PRINTK(("eh:%p:%d Valid %d, Giving up\n",
                                             err_nodepda, smp_processor_id(),
                                             i));
@@ -150,7 +150,7 @@ int shub2_bte_error_handler(unsigned long _nodepda)
                 status = BTE_LNSTAT_LOAD(bte);
                 if ((status & IBLS_ERROR) || !(status & IBLS_BUSY))
                         continue;
-                mod_timer(recovery_timer, HZ * 5);
+                mod_timer(recovery_timer, jiffies + (HZ * 5));
                 BTE_PRINTK(("eh:%p:%d Marked Giving up\n", err_nodepda,
                             smp_processor_id()));
                 return 1;
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
index 1ee977fb6ebb..95af40cb22f2 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
@@ -96,10 +96,14 @@ pcibr_dmamap_ate32(struct pcidev_info *info,
         }
 
         /*
-         * If we're mapping for MSI, set the MSI bit in the ATE
+         * If we're mapping for MSI, set the MSI bit in the ATE.  If it's a
+         * TIOCP based pci bus, we also need to set the PIO bit in the ATE.
          */
-        if (dma_flags & SN_DMA_MSI)
+        if (dma_flags & SN_DMA_MSI) {
                 ate |= PCI32_ATE_MSI;
+                if (IS_TIOCP_SOFT(pcibus_info))
+                        ate |= PCI32_ATE_PIO;
+        }
 
         ate_write(pcibus_info, ate_index, ate_count, ate);
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 656f0ca52782..c78b14380b3e 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1606,7 +1606,7 @@ config MIPS_MT_FPAFF
 
 config MIPS_MT_SMTC_INSTANT_REPLAY
         bool "Low-latency Dispatch of Deferred SMTC IPIs"
-        depends on MIPS_MT_SMTC
+        depends on MIPS_MT_SMTC && !PREEMPT
         default y
         help
           SMTC pseudo-interrupts between TCs are deferred and queued
diff --git a/arch/mips/gt64120/momenco_ocelot/prom.c b/arch/mips/gt64120/momenco_ocelot/prom.c
index 78f393b2afd9..c71c85276c74 100644
--- a/arch/mips/gt64120/momenco_ocelot/prom.c
+++ b/arch/mips/gt64120/momenco_ocelot/prom.c
@@ -32,7 +32,6 @@ void __init prom_init(void)
         char **arg = (char **) fw_arg1;
         char **env = (char **) fw_arg2;
         struct callvectors *cv = (struct callvectors *) fw_arg3;
-        uint32_t tmp;
         int i;
 
         /* save the PROM vectors for debugging use */
diff --git a/arch/mips/gt64120/momenco_ocelot/setup.c b/arch/mips/gt64120/momenco_ocelot/setup.c
index 94f94ebbda6c..98b6fb38096d 100644
--- a/arch/mips/gt64120/momenco_ocelot/setup.c
+++ b/arch/mips/gt64120/momenco_ocelot/setup.c
@@ -79,7 +79,7 @@ static char reset_reason;
 static void __init setup_l3cache(unsigned long size);
 
 /* setup code for a handoff from a version 1 PMON 2000 PROM */
-void PMON_v1_setup()
+static void PMON_v1_setup(void)
 {
         /* A wired TLB entry for the GT64120A and the serial port. The
            GT64120A is going to be hit on every IRQ anyway - there's
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index 0b78fcbf044a..686249c5c328 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -121,7 +121,11 @@ FEXPORT(restore_partial)		# restore partial frame
         SAVE_AT
         SAVE_TEMP
         LONG_L  v0, PT_STATUS(sp)
-        and     v0, 1
+#if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
+        and     v0, ST0_IEP
+#else
+        and     v0, ST0_IE
+#endif
         beqz    v0, 1f
         jal     trace_hardirqs_on
         b       2f
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 83843a229be7..297bd56c2347 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -128,6 +128,37 @@ handle_vcei:
 
         .align  5
 NESTED(handle_int, PT_SIZE, sp)
+#ifdef CONFIG_TRACE_IRQFLAGS
+        /*
+         * Check to see if the interrupted code has just disabled
+         * interrupts and ignore this interrupt for now if so.
+         *
+         * local_irq_disable() disables interrupts and then calls
+         * trace_hardirqs_off() to track the state. If an interrupt is taken
+         * after interrupts are disabled but before the state is updated
+         * it will appear to restore_all that it is incorrectly returning with
+         * interrupts disabled
+         */
+        .set    push
+        .set    noat
+        mfc0    k0, CP0_STATUS
+#if defined(CONFIG_CPU_R3000) || defined(CONFIG_CPU_TX39XX)
+        and     k0, ST0_IEP
+        bnez    k0, 1f
+
+        mfc0    k0, EP0_EPC
+        .set    noreorder
+        j       k0
+        rfe
+#else
+        and     k0, ST0_IE
+        bnez    k0, 1f
+
+        eret
+#endif
+1:
+        .set pop
+#endif
         SAVE_ALL
         CLI
         TRACE_IRQS_OFF
diff --git a/arch/mips/kernel/r2300_switch.S b/arch/mips/kernel/r2300_switch.S
index 28c2e2e6af73..656bde2e11b1 100644
--- a/arch/mips/kernel/r2300_switch.S
+++ b/arch/mips/kernel/r2300_switch.S
@@ -49,7 +49,8 @@ LEAF(resume)
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t2, CP0_STATUS
+        mfc0    t1, CP0_STATUS
+        sw      t1, THREAD_STATUS(a0)
         cpu_save_nonscratch a0
         sw      ra, THREAD_REG31(a0)
 
@@ -59,8 +60,8 @@ LEAF(resume)
         lw      t3, TASK_THREAD_INFO(a0)
         lw      t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t1, t0
-        beqz    t1, 1f
+        and     t2, t0, t1
+        beqz    t2, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -73,13 +74,10 @@ LEAF(resume)
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         sw      t0, ST_OFF(t3)
-        /* clear thread_struct CU1 bit */
-        and     t2, t1
 
         fpu_save_single a0, t0                  # clobbers t0
 
 1:
-        sw      t2, THREAD_STATUS(a0)
         /*
          * The order of restoring the registers takes care of the race
          * updating $28, $29 and kernelsp without disabling ints.
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index c7698fd9955c..cc566cf12246 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -48,7 +48,8 @@
 #ifndef CONFIG_CPU_HAS_LLSC
         sw      zero, ll_bit
 #endif
-        mfc0    t2, CP0_STATUS
+        mfc0    t1, CP0_STATUS
+        LONG_S  t1, THREAD_STATUS(a0)
         cpu_save_nonscratch a0
         LONG_S  ra, THREAD_REG31(a0)
 
@@ -58,8 +59,8 @@
         PTR_L   t3, TASK_THREAD_INFO(a0)
         LONG_L  t0, TI_FLAGS(t3)
         li      t1, _TIF_USEDFPU
-        and     t1, t0
-        beqz    t1, 1f
+        and     t2, t0, t1
+        beqz    t2, 1f
         nor     t1, zero, t1
 
         and     t0, t0, t1
@@ -72,13 +73,10 @@
         li      t1, ~ST0_CU1
         and     t0, t0, t1
         LONG_S  t0, ST_OFF(t3)
-        /* clear thread_struct CU1 bit */
-        and     t2, t1
 
         fpu_save_double a0 t0 t1                # c0_status passed in t0
                                                 # clobbers t1
 1:
-        LONG_S  t2, THREAD_STATUS(a0)
 
         /*
          * The order of restoring the registers takes care of the race
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index 297dfcb97524..c0faabd52010 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -34,4 +34,13 @@ extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
 /* Check and clear pending FPU exceptions in saved CSR */
 extern int fpcsr_pending(unsigned int __user *fpcsr);
 
+/* Make sure we will not lose FPU ownership */
+#ifdef CONFIG_PREEMPT
+#define lock_fpu_owner()        preempt_disable()
+#define unlock_fpu_owner()      preempt_enable()
+#else
+#define lock_fpu_owner()        pagefault_disable()
+#define unlock_fpu_owner()      pagefault_enable()
+#endif
+
 #endif  /* __SIGNAL_COMMON_H */
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 8c3c5a5789b0..07d67309451a 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -20,6 +20,7 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -27,7 +28,6 @@
 #include <asm/cacheflush.h>
 #include <asm/fpu.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/cpu-features.h>
 #include <asm/war.h>
@@ -78,6 +78,46 @@ struct rt_sigframe {
 /*
  * Helper routines
  */
+static int protected_save_fp_context(struct sigcontext __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context(struct sigcontext __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         int err = 0;
@@ -113,10 +153,7 @@ int setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                  * Save FPU state to signal context. Signal handler
                  * will "inherit" current FPU state.
                  */
-                own_fpu(1);
-                enable_fp_in_kernel();
-                err |= save_fp_context(sc);
-                disable_fp_in_kernel();
+                err |= protected_save_fp_context(sc);
         }
         return err;
 }
@@ -148,7 +185,7 @@ check_and_restore_fp_context(struct sigcontext __user *sc)
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= restore_fp_context(sc);
+        err |= protected_restore_fp_context(sc);
         return err ?: sig;
 }
 
@@ -187,11 +224,8 @@ int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 
         if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu(0);
-                enable_fp_in_kernel();
                 if (!err)
                         err = check_and_restore_fp_context(sc);
-                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 151fd2f0893a..b9a014411f83 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -22,6 +22,7 @@
 #include <linux/compat.h>
 #include <linux/suspend.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 
 #include <asm/abi.h>
 #include <asm/asm.h>
@@ -29,7 +30,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/sim.h>
-#include <asm/uaccess.h>
 #include <asm/ucontext.h>
 #include <asm/system.h>
 #include <asm/fpu.h>
@@ -176,6 +176,46 @@ struct rt_sigframe32 {
 /*
  * sigcontext handlers
  */
+static int protected_save_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(1);
+                err = save_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __put_user(0, &sc->sc_fpregs[0]) |
+                        __put_user(0, &sc->sc_fpregs[31]) |
+                        __put_user(0, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
+static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
+{
+        int err, tmp;
+        while (1) {
+                lock_fpu_owner();
+                own_fpu_inatomic(0);
+                err = restore_fp_context32(sc); /* this might fail */
+                unlock_fpu_owner();
+                if (likely(!err))
+                        break;
+                /* touch the sigcontext and try again */
+                err = __get_user(tmp, &sc->sc_fpregs[0]) |
+                        __get_user(tmp, &sc->sc_fpregs[31]) |
+                        __get_user(tmp, &sc->sc_fpc_csr);
+                if (err)
+                        break;  /* really bad sigcontext */
+        }
+        return err;
+}
+
 static int setup_sigcontext32(struct pt_regs *regs,
                               struct sigcontext32 __user *sc)
 {
@@ -209,10 +249,7 @@ static int setup_sigcontext32(struct pt_regs *regs,
                  * Save FPU state to signal context.  Signal handler
                  * will "inherit" current FPU state.
                  */
-                own_fpu(1);
-                enable_fp_in_kernel();
-                err |= save_fp_context32(sc);
-                disable_fp_in_kernel();
+                err |= protected_save_fp_context32(sc);
         }
         return err;
 }
@@ -225,7 +262,7 @@ check_and_restore_fp_context32(struct sigcontext32 __user *sc)
         err = sig = fpcsr_pending(&sc->sc_fpc_csr);
         if (err > 0)
                 err = 0;
-        err |= restore_fp_context32(sc);
+        err |= protected_restore_fp_context32(sc);
         return err ?: sig;
 }
 
@@ -261,11 +298,8 @@ static int restore_sigcontext32(struct pt_regs *regs,
 
         if (used_math) {
                 /* restore fpu context if we have used it before */
-                own_fpu(0);
-                enable_fp_in_kernel();
                 if (!err)
                         err = check_and_restore_fp_context32(sc);
-                disable_fp_in_kernel();
         } else {
                 /* signal handler may have used FPU.  Give it up. */
                 lose_fpu(0);
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index f253eda27fa3..5dcfab6b288e 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
+#include <linux/kernel_stat.h>
 #include <linux/module.h>
 
 #include <asm/cpu.h>
@@ -14,6 +15,7 @@
 #include <asm/hazards.h>
 #include <asm/mmu_context.h>
 #include <asm/smp.h>
+#include <asm/mips-boards/maltaint.h>
 #include <asm/mipsregs.h>
 #include <asm/cacheflush.h>
 #include <asm/time.h>
@@ -75,7 +77,7 @@ static struct smtc_ipi_q freeIPIq;
 
 void ipi_decode(struct smtc_ipi *);
 static void post_direct_ipi(int cpu, struct smtc_ipi *pipi);
-static void setup_cross_vpe_interrupts(void);
+static void setup_cross_vpe_interrupts(unsigned int nvpe);
 void init_smtc_stats(void);
 
 /* Global SMTC Status */
@@ -168,7 +170,10 @@ __setup("tintq=", tintq);
 
 int imstuckcount[2][8];
 /* vpemask represents IM/IE bits of per-VPE Status registers, low-to-high */
-int vpemask[2][8] = {{0,1,1,0,0,0,0,1},{0,1,0,0,0,0,0,1}};
+int vpemask[2][8] = {
+        {0, 0, 1, 0, 0, 0, 0, 1},
+        {0, 0, 0, 0, 0, 0, 0, 1}
+};
 int tcnoprog[NR_CPUS];
 static atomic_t idle_hook_initialized = {0};
 static int clock_hang_reported[NR_CPUS];
@@ -501,8 +506,7 @@ void mipsmt_prepare_cpus(void)
 
         /* If we have multiple VPEs running, set up the cross-VPE interrupt */
 
-        if (nvpe > 1)
-                setup_cross_vpe_interrupts();
+        setup_cross_vpe_interrupts(nvpe);
 
         /* Set up queue of free IPI "messages". */
         nipi = NR_CPUS * IPIBUF_PER_CPU;
@@ -607,7 +611,12 @@ void smtc_cpus_done(void)
 int setup_irq_smtc(unsigned int irq, struct irqaction * new,
                         unsigned long hwmask)
 {
+        unsigned int vpe = current_cpu_data.vpe_id;
+
         irq_hwmask[irq] = hwmask;
+#ifdef CONFIG_SMTC_IDLE_HOOK_DEBUG
+        vpemask[vpe][irq - MIPSCPU_INT_BASE] = 1;
+#endif
 
         return setup_irq(irq, new);
 }
@@ -812,12 +821,15 @@ void ipi_decode(struct smtc_ipi *pipi)
         smtc_ipi_nq(&freeIPIq, pipi);
         switch (type_copy) {
         case SMTC_CLOCK_TICK:
+                irq_enter();
+                kstat_this_cpu.irqs[MIPSCPU_INT_BASE + MIPSCPU_INT_CPUCTR]++;
                 /* Invoke Clock "Interrupt" */
                 ipi_timer_latch[dest_copy] = 0;
 #ifdef CONFIG_SMTC_IDLE_HOOK_DEBUG
                 clock_hang_reported[dest_copy] = 0;
 #endif /* CONFIG_SMTC_IDLE_HOOK_DEBUG */
                 local_timer_interrupt(0, NULL);
+                irq_exit();
                 break;
         case LINUX_SMP_IPI:
                 switch ((int)arg_copy) {
@@ -965,8 +977,11 @@ static void ipi_irq_dispatch(void)
 
 static struct irqaction irq_ipi;
 
-static void setup_cross_vpe_interrupts(void)
+static void setup_cross_vpe_interrupts(unsigned int nvpe)
 {
+        if (nvpe < 1)
+                return;
+
         if (!cpu_has_vint)
                 panic("SMTC Kernel requires Vectored Interupt support");
 
@@ -984,10 +999,17 @@ static void setup_cross_vpe_interrupts(void)
 
 /*
  * SMTC-specific hacks invoked from elsewhere in the kernel.
+ *
+ * smtc_ipi_replay is called from raw_local_irq_restore which is only ever
+ * called with interrupts disabled.  We do rely on interrupts being disabled
+ * here because using spin_lock_irqsave()/spin_unlock_irqrestore() would
+ * result in a recursive call to raw_local_irq_restore().
  */
 
-void smtc_ipi_replay(void)
+static void __smtc_ipi_replay(void)
 {
+        unsigned int cpu = smp_processor_id();
+
         /*
          * To the extent that we've ever turned interrupts off,
          * we may have accumulated deferred IPIs.  This is subtle.
@@ -1002,17 +1024,30 @@ void smtc_ipi_replay(void)
          * is clear, and we'll handle it as a real pseudo-interrupt
          * and not a pseudo-pseudo interrupt.
          */
-        if (IPIQ[smp_processor_id()].depth > 0) {
-                struct smtc_ipi *pipi;
-                extern void self_ipi(struct smtc_ipi *);
+        if (IPIQ[cpu].depth > 0) {
+                while (1) {
+                        struct smtc_ipi_q *q = &IPIQ[cpu];
+                        struct smtc_ipi *pipi;
+                        extern void self_ipi(struct smtc_ipi *);
+
+                        spin_lock(&q->lock);
+                        pipi = __smtc_ipi_dq(q);
+                        spin_unlock(&q->lock);
+                        if (!pipi)
+                                break;
 
-                while ((pipi = smtc_ipi_dq(&IPIQ[smp_processor_id()]))) {
                         self_ipi(pipi);
-                        smtc_cpu_stats[smp_processor_id()].selfipis++;
+                        smtc_cpu_stats[cpu].selfipis++;
                 }
         }
 }
 
+void smtc_ipi_replay(void)
+{
+        raw_local_irq_disable();
+        __smtc_ipi_replay();
+}
+
 EXPORT_SYMBOL(smtc_ipi_replay);
 
 void smtc_idle_loop_hook(void)
@@ -1117,7 +1152,13 @@ void smtc_idle_loop_hook(void)
          * is in use, there should never be any.
          */
 #ifndef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
-        smtc_ipi_replay();
+        {
+                unsigned long flags;
+
+                local_irq_save(flags);
+                __smtc_ipi_replay();
+                local_irq_restore(flags);
+        }
 #endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
 }
 
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 7d76a85422b2..493cb29b8a42 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -650,7 +650,7 @@ asmlinkage void do_bp(struct pt_regs *regs)
         unsigned int opcode, bcode;
         siginfo_t info;
 
-        if (get_user(opcode, (unsigned int __user *) exception_epc(regs)))
+        if (__get_user(opcode, (unsigned int __user *) exception_epc(regs)))
                 goto out_sigsegv;
 
         /*
@@ -700,7 +700,7 @@ asmlinkage void do_tr(struct pt_regs *regs)
         unsigned int opcode, tcode = 0;
         siginfo_t info;
 
-        if (get_user(opcode, (unsigned int __user *) exception_epc(regs)))
+        if (__get_user(opcode, (unsigned int __user *) exception_epc(regs)))
                 goto out_sigsegv;
 
         /* Immediate versions don't provide a code.  */
@@ -757,11 +757,12 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 {
         unsigned int cpid;
 
+        die_if_kernel("do_cpu invoked from kernel context!", regs);
+
         cpid = (regs->cp0_cause >> CAUSEB_CE) & 3;
 
         switch (cpid) {
         case 0:
-                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 if (!cpu_has_llsc)
                         if (!simulate_llsc(regs))
                                 return;
@@ -772,9 +773,6 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                 break;
 
         case 1:
-                if (!test_thread_flag(TIF_ALLOW_FP_IN_KERNEL))
-                        die_if_kernel("do_cpu invoked from kernel context!",
-                                      regs);
                 if (used_math())        /* Using the FPU again.  */
                         own_fpu(1);
                 else {                  /* First time FPU user.  */
@@ -782,19 +780,7 @@ asmlinkage void do_cpu(struct pt_regs *regs)
                         set_used_math();
                 }
 
-                if (raw_cpu_has_fpu) {
-                        if (test_thread_flag(TIF_ALLOW_FP_IN_KERNEL)) {
-                                local_irq_disable();
-                                if (cpu_has_fpu)
-                                        regs->cp0_status |= ST0_CU1;
-                                /*
-                                 * We must return without enabling
-                                 * interrupts to ensure keep FPU
-                                 * ownership until resume.
-                                 */
-                                return;
-                        }
-                } else {
+                if (!raw_cpu_has_fpu) {
                         int sig;
                         sig = fpu_emulator_cop1Handler(regs,
                                                 &current->thread.fpu, 0);
@@ -836,7 +822,6 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 
         case 2:
         case 3:
-                die_if_kernel("do_cpu invoked from kernel context!", regs);
                 break;
         }
 
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 6f90e7ef66ac..f9c595dceba9 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -42,7 +42,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write,
         siginfo_t info;
 
 #if 0
-        printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", smp_processor_id(),
+        printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
                current->comm, current->pid, field, address, write,
                field, regs->cp0_epc);
 #endif
@@ -165,7 +165,7 @@ no_context:
 
         printk(KERN_ALERT "CPU %d Unable to handle kernel paging request at "
                "virtual address %0*lx, epc == %0*lx, ra == %0*lx\n",
-               smp_processor_id(), field, address, field, regs->cp0_epc,
+               raw_smp_processor_id(), field, address, field, regs->cp0_epc,
                field,  regs->regs[31]);
         die("Oops", regs);
 
@@ -228,7 +228,7 @@ vmalloc_fault:
                 pmd_t *pmd, *pmd_k;
                 pte_t *pte_k;
 
-                pgd = (pgd_t *) pgd_current[smp_processor_id()] + offset;
+                pgd = (pgd_t *) pgd_current[raw_smp_processor_id()] + offset;
                 pgd_k = init_mm.pgd + offset;
 
                 if (!pgd_present(*pgd_k))
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index 69a8bcfe72b2..4f94fa261aae 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -35,7 +35,7 @@
 #define vpe_id()        smp_processor_id()
 #else
 #define WHAT            0
-#define vpe_id()        smp_processor_id()
+#define vpe_id()        0
 #endif
 
 #define __define_perf_accessors(r, n, np)                               \
diff --git a/arch/mips/pci/pci-ev64120.c b/arch/mips/pci/pci-ev64120.c
index 9cd859ef1842..a84f594b5a18 100644
--- a/arch/mips/pci/pci-ev64120.c
+++ b/arch/mips/pci/pci-ev64120.c
@@ -1,4 +1,5 @@
 #include <linux/pci.h>
+#include <asm/irq.h>
 
 int __init pcibios_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
 {
diff --git a/arch/mips/sibyte/bcm1480/irq.c b/arch/mips/sibyte/bcm1480/irq.c
index 20af0f1bb7bf..ba0c4b776c85 100644
--- a/arch/mips/sibyte/bcm1480/irq.c
+++ b/arch/mips/sibyte/bcm1480/irq.c
@@ -141,11 +141,11 @@ static void bcm1480_set_affinity(unsigned int irq, cpumask_t mask)
         unsigned long flags;
         unsigned int irq_dirty;
 
-        i = first_cpu(mask);
-        if (next_cpu(i, mask) <= NR_CPUS) {
+        if (cpus_weight(mask) != 1) {
                 printk("attempted to set irq affinity for irq %d to multiple CPUs\n", irq);
                 return;
         }
+        i = first_cpu(mask);
 
         /* Convert logical CPU to physical CPU */
         cpu = cpu_logical_map(i);
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index 87188f0f6fbe..f4a6169aa0a4 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -141,6 +141,18 @@ static int __init setup_bcm112x(void)
                 periph_rev = 3;
                 pass_str = "A2";
                 break;
+        case K_SYS_REVISION_BCM112x_A3:
+                periph_rev = 3;
+                pass_str = "A3";
+                break;
+        case K_SYS_REVISION_BCM112x_A4:
+                periph_rev = 3;
+                pass_str = "A4";
+                break;
+        case K_SYS_REVISION_BCM112x_B0:
+                periph_rev = 3;
+                pass_str = "B0";
+                break;
         default:
                 printk("Unknown %s rev %x\n", soc_str, soc_pass);
                 ret = 1;
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pic.c b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
index c75192567e55..fbfff95b4437 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_pic.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
@@ -128,7 +128,7 @@ static void mpc52xx_main_mask(unsigned int virq)
 
         pr_debug("%s: irq=%x. l2=%d\n", __func__, irq, l2irq);
 
-        io_be_setbit(&intr->main_mask, 15 - l2irq);
+        io_be_setbit(&intr->main_mask, 16 - l2irq);
 }
 
 static void mpc52xx_main_unmask(unsigned int virq)
@@ -141,7 +141,7 @@ static void mpc52xx_main_unmask(unsigned int virq)
 
         pr_debug("%s: irq=%x. l2=%d\n", __func__, irq, l2irq);
 
-        io_be_clrbit(&intr->main_mask, 15 - l2irq);
+        io_be_clrbit(&intr->main_mask, 16 - l2irq);
 }
 
 static struct irq_chip mpc52xx_main_irqchip = {
diff --git a/arch/powerpc/sysdev/dcr.c b/arch/powerpc/sysdev/dcr.c
index dffeeaeca1d9..1fc5819e7d18 100644
--- a/arch/powerpc/sysdev/dcr.c
+++ b/arch/powerpc/sysdev/dcr.c
@@ -129,7 +129,7 @@ void dcr_unmap(dcr_host_t host, unsigned int dcr_n, unsigned int dcr_c)
 
         if (h.token == NULL)
                 return;
-        h.token -= dcr_n * h.stride;
+        h.token += dcr_n * h.stride;
         iounmap(h.token);
         h.token = NULL;
 }
diff --git a/arch/powerpc/sysdev/qe_lib/qe.c b/arch/powerpc/sysdev/qe_lib/qe.c
index e3d71e083f35..43f6cc9d7ea0 100644
--- a/arch/powerpc/sysdev/qe_lib/qe.c
+++ b/arch/powerpc/sysdev/qe_lib/qe.c
@@ -251,13 +251,13 @@ static int qe_sdma_init(void)
 
         /* allocate 2 internal temporary buffers (512 bytes size each) for
          * the SDMA */
-        sdma_buf_offset = qe_muram_alloc(512 * 2, 64);
+        sdma_buf_offset = qe_muram_alloc(512 * 2, 4096);
         if (IS_MURAM_ERR(sdma_buf_offset))
                 return -ENOMEM;
 
         out_be32(&sdma->sdebcr, sdma_buf_offset & QE_SDEBCR_BA_MASK);
-        out_be32(&sdma->sdmr, (QE_SDMR_GLB_1_MSK | (0x1 >>
-                                        QE_SDMR_CEN_SHIFT)));
+        out_be32(&sdma->sdmr, (QE_SDMR_GLB_1_MSK |
+                                        (0x1 << QE_SDMR_CEN_SHIFT)));
 
         return 0;
 }
diff --git a/arch/ppc/8xx_io/commproc.c b/arch/ppc/8xx_io/commproc.c
index 3b23bcb35b7a..7a8722beac12 100644
--- a/arch/ppc/8xx_io/commproc.c
+++ b/arch/ppc/8xx_io/commproc.c
@@ -39,6 +39,21 @@
 #include <asm/tlbflush.h>
 #include <asm/rheap.h>
 
+#define immr_map(member)                                                \
+({                                                                      \
+        u32 offset = offsetof(immap_t, member);                         \
+        void *addr = ioremap (IMAP_ADDR + offset,                       \
+                              sizeof( ((immap_t*)0)->member));          \
+        addr;                                                           \
+})
+
+#define immr_map_size(member, size)                                     \
+({                                                                      \
+        u32 offset = offsetof(immap_t, member);                         \
+        void *addr = ioremap (IMAP_ADDR + offset, size);                \
+        addr;                                                           \
+})
+
 static void m8xx_cpm_dpinit(void);
 static  uint    host_buffer;    /* One page of host buffer */
 static  uint    host_end;       /* end + 1 */
@@ -364,11 +379,16 @@ static rh_block_t cpm_boot_dpmem_rh_block[16];
 static rh_info_t cpm_dpmem_info;
 
 #define CPM_DPMEM_ALIGNMENT     8
+static u8* dpram_vbase;
+static uint dpram_pbase;
 
 void m8xx_cpm_dpinit(void)
 {
         spin_lock_init(&cpm_dpmem_lock);
 
+        dpram_vbase = immr_map_size(im_cpm.cp_dpmem, CPM_DATAONLY_BASE + CPM_DATAONLY_SIZE);
+        dpram_pbase = (uint)&((immap_t *)IMAP_ADDR)->im_cpm.cp_dpmem;
+
         /* Initialize the info header */
         rh_init(&cpm_dpmem_info, CPM_DPMEM_ALIGNMENT,
                         sizeof(cpm_boot_dpmem_rh_block) /
@@ -442,3 +462,9 @@ void *cpm_dpram_addr(uint offset)
         return ((immap_t *)IMAP_ADDR)->im_cpm.cp_dpmem + offset;
 }
 EXPORT_SYMBOL(cpm_dpram_addr);
+
+uint cpm_dpram_phys(u8* addr)
+{
+        return (dpram_pbase + (uint)(addr - dpram_vbase));
+}
+EXPORT_SYMBOL(cpm_dpram_phys);
diff --git a/arch/ppc/configs/ads8272_defconfig b/arch/ppc/configs/ads8272_defconfig
index d1db7d14780e..6619f9118b00 100644
--- a/arch/ppc/configs/ads8272_defconfig
+++ b/arch/ppc/configs/ads8272_defconfig
@@ -1,42 +1,69 @@
 #
 # Automatically generated make config: don't edit
+# Linux kernel version: 2.6.21-rc5
+# Wed Apr  4 20:55:16 2007
 #
 CONFIG_MMU=y
+CONFIG_GENERIC_HARDIRQS=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
-CONFIG_HAVE_DEC_LOCK=y
+CONFIG_ARCH_HAS_ILOG2_U32=y
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_PPC=y
 CONFIG_PPC32=y
 CONFIG_GENERIC_NVRAM=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_GENERIC_BUG=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
-CONFIG_STANDALONE=y
 CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
 #
+CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
+CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
-CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_HOTPLUG is not set
 # CONFIG_IKCONFIG is not set
+CONFIG_SYSFS_DEPRECATED=y
+# CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
+CONFIG_SYSCTL_SYSCALL=y
 # CONFIG_KALLSYMS is not set
+# CONFIG_HOTPLUG is not set
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 # CONFIG_EPOLL is not set
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SHMEM=y
+CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
+# CONFIG_TINY_SHMEM is not set
+CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -44,66 +71,124 @@ CONFIG_IOSCHED_CFQ=y
 # CONFIG_MODULES is not set
 
 #
+# Block layer
+#
+CONFIG_BLOCK=y
+# CONFIG_LBD is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_LSF is not set
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_DEFAULT_AS is not set
+# CONFIG_DEFAULT_DEADLINE is not set
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+
+#
 # Processor
 #
 CONFIG_6xx=y
 # CONFIG_40x is not set
 # CONFIG_44x is not set
-# CONFIG_POWER3 is not set
-# CONFIG_POWER4 is not set
 # CONFIG_8xx is not set
+# CONFIG_E200 is not set
+# CONFIG_E500 is not set
+CONFIG_PPC_FPU=y
+# CONFIG_PPC_DCR_NATIVE is not set
+# CONFIG_KEXEC is not set
 # CONFIG_CPU_FREQ is not set
+# CONFIG_WANT_EARLY_SERIAL is not set
 CONFIG_EMBEDDEDBOOT=y
 CONFIG_PPC_STD_MMU=y
 
 #
 # Platform options
 #
-# CONFIG_PPC_MULTIPLATFORM is not set
+
+#
+# Freescale Ethernet driver platform-specific options
+#
+# CONFIG_PPC_PREP is not set
 # CONFIG_APUS is not set
+# CONFIG_KATANA is not set
 # CONFIG_WILLOW is not set
-# CONFIG_PCORE is not set
+# CONFIG_CPCI690 is not set
 # CONFIG_POWERPMC250 is not set
-# CONFIG_EV64260 is not set
+# CONFIG_CHESTNUT is not set
 # CONFIG_SPRUCE is not set
+# CONFIG_HDPU is not set
+# CONFIG_EV64260 is not set
 # CONFIG_LOPEC is not set
-# CONFIG_MCPN765 is not set
 # CONFIG_MVME5100 is not set
 # CONFIG_PPLUS is not set
 # CONFIG_PRPMC750 is not set
 # CONFIG_PRPMC800 is not set
 # CONFIG_SANDPOINT is not set
-# CONFIG_ADIR is not set
-# CONFIG_K2 is not set
+# CONFIG_RADSTONE_PPC7D is not set
 # CONFIG_PAL4 is not set
-# CONFIG_GEMINI is not set
 # CONFIG_EST8260 is not set
 # CONFIG_SBC82xx is not set
 # CONFIG_SBS8260 is not set
-# CONFIG_RPX6 is not set
+# CONFIG_RPX8260 is not set
 # CONFIG_TQM8260 is not set
 CONFIG_ADS8272=y
+# CONFIG_PQ2FADS is not set
+# CONFIG_LITE5200 is not set
+# CONFIG_MPC834x_SYS is not set
+# CONFIG_EV64360 is not set
 CONFIG_PQ2ADS=y
 CONFIG_8260=y
 CONFIG_8272=y
 CONFIG_CPM2=y
 # CONFIG_PC_KEYBOARD is not set
-CONFIG_SERIAL_CONSOLE=y
 # CONFIG_SMP is not set
-# CONFIG_PREEMPT is not set
 # CONFIG_HIGHMEM is not set
-CONFIG_KERNEL_ELF=y
+CONFIG_ARCH_POPULATES_NODE_MAP=y
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_SPARSEMEM_STATIC is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_RESOURCES_64BIT is not set
+CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BINFMT_ELF=y
 # CONFIG_BINFMT_MISC is not set
 # CONFIG_CMDLINE_BOOL is not set
+# CONFIG_PM is not set
+CONFIG_SECCOMP=y
+CONFIG_ISA_DMA_API=y
 
 #
 # Bus options
 #
+CONFIG_ZONE_DMA=y
+# CONFIG_PPC_I8259 is not set
+CONFIG_PPC_INDIRECT_PCI=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
-# CONFIG_PCI_LEGACY_PROC is not set
-# CONFIG_PCI_NAMES is not set
+CONFIG_PCI_8260=y
+
+#
+# PCCARD (PCMCIA/CardBus) support
+#
 
 #
 # Advanced setup
@@ -120,12 +205,110 @@ CONFIG_TASK_SIZE=0x80000000
 CONFIG_BOOT_LOAD=0x00400000
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+# CONFIG_NETDEBUG is not set
+CONFIG_PACKET=y
+# CONFIG_PACKET_MMAP is not set
+CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
+# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+# CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETFILTER is not set
+
+#
+# DCCP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
+# CONFIG_NET_SCHED is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_IEEE80211 is not set
+
+#
 # Device Drivers
 #
 
 #
 # Generic Driver Options
 #
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+# CONFIG_SYS_HYPERVISOR is not set
+
+#
+# Connector - unified userspace <-> kernelspace linker
+#
+# CONFIG_CONNECTOR is not set
 
 #
 # Memory Technology Devices (MTD)
@@ -140,6 +323,7 @@ CONFIG_BOOT_LOAD=0x00400000
 #
 # Plug and Play support
 #
+# CONFIG_PNPACPI is not set
 
 #
 # Block devices
@@ -149,14 +333,23 @@ CONFIG_BOOT_LOAD=0x00400000
 # CONFIG_BLK_CPQ_CISS_DA is not set
 # CONFIG_BLK_DEV_DAC960 is not set
 # CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
 # CONFIG_BLK_DEV_CRYPTOLOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
-# CONFIG_BLK_DEV_CARMEL is not set
+# CONFIG_BLK_DEV_SX8 is not set
 CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_BLK_DEV_INITRD=y
-# CONFIG_LBD is not set
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+
+#
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
@@ -166,7 +359,14 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # SCSI device support
 #
+# CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
+# CONFIG_SCSI_NETLINK is not set
+
+#
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+# CONFIG_ATA is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -176,6 +376,7 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # Fusion MPT device support
 #
+# CONFIG_FUSION is not set
 
 #
 # IEEE 1394 (FireWire) support
@@ -190,70 +391,12 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # Macintosh device drivers
 #
+# CONFIG_MAC_EMUMOUSEBTN is not set
+# CONFIG_WINDFARM is not set
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
+# Network device support
 #
-CONFIG_PACKET=y
-# CONFIG_PACKET_MMAP is not set
-# CONFIG_NETLINK_DEV is not set
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_IP_MROUTE is not set
-# CONFIG_ARPD is not set
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-# CONFIG_NET_HW_FLOWCONTROL is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-
-#
-# Network testing
-#
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
@@ -266,13 +409,31 @@ CONFIG_NETDEVICES=y
 # CONFIG_ARCNET is not set
 
 #
+# PHY device support
+#
+CONFIG_PHYLIB=y
+
+#
+# MII PHY device drivers
+#
+# CONFIG_MARVELL_PHY is not set
+CONFIG_DAVICOM_PHY=y
+# CONFIG_QSEMI_PHY is not set
+# CONFIG_LXT_PHY is not set
+# CONFIG_CICADA_PHY is not set
+# CONFIG_VITESSE_PHY is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_BROADCOM_PHY is not set
+# CONFIG_FIXED_PHY is not set
+
+#
 # Ethernet (10 or 100Mbit)
 #
 CONFIG_NET_ETHERNET=y
-# CONFIG_MII is not set
-# CONFIG_OAKNET is not set
+CONFIG_MII=y
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
 
 #
@@ -281,6 +442,9 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_NET_TULIP is not set
 # CONFIG_HP100 is not set
 # CONFIG_NET_PCI is not set
+CONFIG_FS_ENET=y
+# CONFIG_FS_ENET_HAS_SCC is not set
+CONFIG_FS_ENET_HAS_FCC=y
 
 #
 # Ethernet (1000 Mbit)
@@ -292,14 +456,24 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_HAMACHI is not set
 # CONFIG_YELLOWFIN is not set
 # CONFIG_R8169 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_TIGON3 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_QLA3XXX is not set
+# CONFIG_ATL1 is not set
 
 #
 # Ethernet (10000 Mbit)
 #
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_CHELSIO_T3 is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
+# CONFIG_MYRI10GE is not set
+# CONFIG_NETXEN_NIC is not set
 
 #
 # Token Ring devices
@@ -321,6 +495,8 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -336,6 +512,7 @@ CONFIG_NET_ETHERNET=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -347,14 +524,6 @@ CONFIG_INPUT=y
 # CONFIG_INPUT_EVBUG is not set
 
 #
-# Input I/O drivers
-#
-# CONFIG_GAMEPORT is not set
-CONFIG_SOUND_GAMEPORT=y
-# CONFIG_SERIO is not set
-# CONFIG_SERIO_I8042 is not set
-
-#
 # Input Device Drivers
 #
 # CONFIG_INPUT_KEYBOARD is not set
@@ -364,6 +533,12 @@ CONFIG_SOUND_GAMEPORT=y
 # CONFIG_INPUT_MISC is not set
 
 #
+# Hardware I/O ports
+#
+# CONFIG_SERIO is not set
+# CONFIG_GAMEPORT is not set
+
+#
 # Character devices
 #
 # CONFIG_VT is not set
@@ -377,10 +552,21 @@ CONFIG_SOUND_GAMEPORT=y
 #
 # Non-8250 serial port support
 #
+# CONFIG_SERIAL_UARTLITE is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_CPM=y
+CONFIG_SERIAL_CPM_CONSOLE=y
+CONFIG_SERIAL_CPM_SCC1=y
+# CONFIG_SERIAL_CPM_SCC2 is not set
+# CONFIG_SERIAL_CPM_SCC3 is not set
+CONFIG_SERIAL_CPM_SCC4=y
+# CONFIG_SERIAL_CPM_SMC1 is not set
+# CONFIG_SERIAL_CPM_SMC2 is not set
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
-# CONFIG_QIC02_TAPE is not set
 
 #
 # IPMI
@@ -391,29 +577,53 @@ CONFIG_LEGACY_PTY_COUNT=256
 # Watchdog Cards
 #
 # CONFIG_WATCHDOG is not set
+CONFIG_HW_RANDOM=y
 # CONFIG_NVRAM is not set
 CONFIG_GEN_RTC=y
 # CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
-
-#
-# Ftape, the floppy tape device driver
-#
-# CONFIG_FTAPE is not set
 # CONFIG_AGP is not set
 # CONFIG_DRM is not set
 # CONFIG_RAW_DRIVER is not set
 
 #
+# TPM devices
+#
+# CONFIG_TCG_TPM is not set
+
+#
 # I2C support
 #
 # CONFIG_I2C is not set
 
 #
-# Misc devices
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
 #
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
 
 #
 # Multimedia devices
@@ -428,7 +638,9 @@ CONFIG_GEN_RTC=y
 #
 # Graphics support
 #
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 # CONFIG_FB is not set
+# CONFIG_FB_IBM_GXT4500 is not set
 
 #
 # Sound
@@ -436,35 +648,110 @@ CONFIG_GEN_RTC=y
 # CONFIG_SOUND is not set
 
 #
+# HID Devices
+#
+CONFIG_HID=y
+# CONFIG_HID_DEBUG is not set
+
+#
 # USB support
 #
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_USB is not set
 
 #
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
 # USB Gadget Support
 #
 # CONFIG_USB_GADGET is not set
 
 #
+# MMC/SD Card support
+#
+# CONFIG_MMC is not set
+
+#
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
+#
+
+#
+# InfiniBand support
+#
+# CONFIG_INFINIBAND is not set
+
+#
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
+#
+
+#
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
+# DMA Engine support
+#
+# CONFIG_DMA_ENGINE is not set
+
+#
+# DMA Clients
+#
+
+#
+# DMA Devices
+#
+
+#
+# Auxiliary Display support
+#
+
+#
+# Virtualization
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
 CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
+CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
+CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
 
 #
 # CD-ROM/DVD Filesystems
@@ -475,7 +762,8 @@ CONFIG_FS_MBCACHE=y
 #
 # DOS/FAT/NT Filesystems
 #
-# CONFIG_FAT_FS is not set
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
 # CONFIG_NTFS_FS is not set
 
 #
@@ -483,12 +771,13 @@ CONFIG_FS_MBCACHE=y
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
-# CONFIG_DEVFS_FS is not set
-# CONFIG_DEVPTS_FS_XATTR is not set
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -511,20 +800,26 @@ CONFIG_RAMFS=y
 # Network File Systems
 #
 CONFIG_NFS_FS=y
-# CONFIG_NFS_V3 is not set
-# CONFIG_NFS_V4 is not set
+CONFIG_NFS_V3=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
 # CONFIG_NFS_DIRECTIO is not set
 # CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
-# CONFIG_EXPORTFS is not set
+CONFIG_LOCKD_V4=y
+CONFIG_NFS_ACL_SUPPORT=y
+CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
-# CONFIG_RPCSEC_GSS_KRB5 is not set
+CONFIG_SUNRPC_GSS=y
+CONFIG_RPCSEC_GSS_KRB5=y
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
 
 #
 # Partition Types
@@ -537,46 +832,99 @@ CONFIG_PARTITION_ADVANCED=y
 # CONFIG_MAC_PARTITION is not set
 # CONFIG_MSDOS_PARTITION is not set
 # CONFIG_LDM_PARTITION is not set
-# CONFIG_NEC98_PARTITION is not set
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
 # Native Language Support
 #
 # CONFIG_NLS is not set
+
+#
+# Distributed Lock Manager
+#
+# CONFIG_DLM is not set
 # CONFIG_SCC_ENET is not set
-CONFIG_FEC_ENET=y
-# CONFIG_USE_MDIO is not set
+# CONFIG_FEC_ENET is not set
 
 #
 # CPM2 Options
 #
-CONFIG_SCC_CONSOLE=y
-CONFIG_FCC1_ENET=y
-# CONFIG_FCC2_ENET is not set
-# CONFIG_FCC3_ENET is not set
 
 #
 # Library routines
 #
+# CONFIG_CRC_CCITT is not set
+# CONFIG_CRC16 is not set
 # CONFIG_CRC32 is not set
 # CONFIG_LIBCRC32C is not set
+CONFIG_PLIST=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+# CONFIG_PROFILING is not set
 
 #
 # Kernel hacking
 #
+# CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
+# CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
+CONFIG_LOG_BUF_SHIFT=14
+# CONFIG_DEBUG_BUGVERBOSE is not set
 # CONFIG_KGDB_CONSOLE is not set
 
 #
 # Security options
 #
+# CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
 
 #
 # Cryptographic options
 #
-# CONFIG_CRYPTO is not set
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_MANAGER=y
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_MD4 is not set
+CONFIG_CRYPTO_MD5=y
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_PCBC=y
+# CONFIG_CRYPTO_LRW is not set
+CONFIG_CRYPTO_DES=y
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_DEFLATE is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+
+#
+# Hardware crypto devices
+#
diff --git a/arch/ppc/platforms/mpc8272ads_setup.c b/arch/ppc/platforms/mpc8272ads_setup.c
index 0bc06768cf24..47f4b38edb5f 100644
--- a/arch/ppc/platforms/mpc8272ads_setup.c
+++ b/arch/ppc/platforms/mpc8272ads_setup.c
@@ -18,6 +18,7 @@
 #include <linux/ioport.h>
 #include <linux/fs_enet_pd.h>
 #include <linux/platform_device.h>
+#include <linux/phy.h>
 
 #include <asm/io.h>
 #include <asm/mpc8260.h>
@@ -30,10 +31,10 @@
 
 #include "pq2ads_pd.h"
 
-static void init_fcc1_ioports(void);
-static void init_fcc2_ioports(void);
-static void init_scc1_uart_ioports(void);
-static void init_scc4_uart_ioports(void);
+static void init_fcc1_ioports(struct fs_platform_info*);
+static void init_fcc2_ioports(struct fs_platform_info*);
+static void init_scc1_uart_ioports(struct fs_uart_platform_info*);
+static void init_scc4_uart_ioports(struct fs_uart_platform_info*);
 
 static struct fs_uart_platform_info mpc8272_uart_pdata[] = {
         [fsid_scc1_uart] = {
@@ -103,7 +104,7 @@ static struct fs_platform_info mpc82xx_enet_pdata[] = {
         },
 };
 
-static void init_fcc1_ioports(struct fs_platform_info*)
+static void init_fcc1_ioports(struct fs_platform_info* pdata)
 {
         struct io_port *io;
         u32 tempval;
@@ -144,7 +145,7 @@ static void init_fcc1_ioports(struct fs_platform_info*)
         iounmap(immap);
 }
 
-static void init_fcc2_ioports(struct fs_platform_info*)
+static void init_fcc2_ioports(struct fs_platform_info* pdata)
 {
         cpm2_map_t* immap = ioremap(CPM_MAP_ADDR, sizeof(cpm2_map_t));
         u32 *bcsr = ioremap(BCSR_ADDR+12, sizeof(u32));
@@ -229,7 +230,7 @@ static void mpc8272ads_fixup_uart_pdata(struct platform_device *pdev,
         }
 }
 
-static void init_scc1_uart_ioports(struct fs_uart_platform_info*)
+static void init_scc1_uart_ioports(struct fs_uart_platform_info* pdata)
 {
         cpm2_map_t* immap = ioremap(CPM_MAP_ADDR, sizeof(cpm2_map_t));
 
@@ -246,7 +247,7 @@ static void init_scc1_uart_ioports(struct fs_uart_platform_info*)
         iounmap(immap);
 }
 
-static void init_scc4_uart_ioports(struct fs_uart_platform_info*)
+static void init_scc4_uart_ioports(struct fs_uart_platform_info* pdata)
 {
         cpm2_map_t* immap = ioremap(CPM_MAP_ADDR, sizeof(cpm2_map_t));
 
diff --git a/arch/ppc/platforms/mpc866ads_setup.c b/arch/ppc/platforms/mpc866ads_setup.c
index 5b05d4bd0df7..7ce5364fdb3b 100644
--- a/arch/ppc/platforms/mpc866ads_setup.c
+++ b/arch/ppc/platforms/mpc866ads_setup.c
@@ -21,6 +21,7 @@
 #include <linux/fs_enet_pd.h>
 #include <linux/fs_uart_pd.h>
 #include <linux/mii.h>
+#include <linux/phy.h>
 
 #include <asm/delay.h>
 #include <asm/io.h>
@@ -37,10 +38,10 @@
 
 extern unsigned char __res[];
 
-static void setup_fec1_ioports(void);
-static void setup_scc1_ioports(void);
-static void setup_smc1_ioports(void);
-static void setup_smc2_ioports(void);
+static void setup_fec1_ioports(struct fs_platform_info*);
+static void setup_scc1_ioports(struct fs_platform_info*);
+static void setup_smc1_ioports(struct fs_uart_platform_info*);
+static void setup_smc2_ioports(struct fs_uart_platform_info*);
 
 static struct fs_mii_fec_platform_info  mpc8xx_mdio_fec_pdata;
 
@@ -137,7 +138,7 @@ void __init board_init(void)
         iounmap(bcsr_io);
 }
 
-static void setup_fec1_ioports(struct fs_platform_info*)
+static void setup_fec1_ioports(struct fs_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
 
@@ -145,7 +146,7 @@ static void setup_fec1_ioports(struct fs_platform_info*)
         setbits16(&immap->im_ioport.iop_pddir, 0x1fff);
 }
 
-static void setup_scc1_ioports(struct fs_platform_info*)
+static void setup_scc1_ioports(struct fs_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
         unsigned *bcsr_io;
@@ -194,7 +195,7 @@ static void setup_scc1_ioports(struct fs_platform_info*)
 
 }
 
-static void setup_smc1_ioports(struct fs_uart_platform_info*)
+static void setup_smc1_ioports(struct fs_uart_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
         unsigned *bcsr_io;
@@ -216,7 +217,7 @@ static void setup_smc1_ioports(struct fs_uart_platform_info*)
 
 }
 
-static void setup_smc2_ioports(struct fs_uart_platform_info*)
+static void setup_smc2_ioports(struct fs_uart_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
         unsigned *bcsr_io;
diff --git a/arch/ppc/platforms/mpc885ads_setup.c b/arch/ppc/platforms/mpc885ads_setup.c
index f8161f3557f5..87deaefd6c5b 100644
--- a/arch/ppc/platforms/mpc885ads_setup.c
+++ b/arch/ppc/platforms/mpc885ads_setup.c
@@ -35,13 +35,13 @@
 #include <asm/ppc_sys.h>
 
 extern unsigned char __res[];
-static void setup_smc1_ioports(void);
-static void setup_smc2_ioports(void);
+static void setup_smc1_ioports(struct fs_uart_platform_info*);
+static void setup_smc2_ioports(struct fs_uart_platform_info*);
 
 static struct fs_mii_fec_platform_info  mpc8xx_mdio_fec_pdata;
-static void setup_fec1_ioports(void);
-static void setup_fec2_ioports(void);
-static void setup_scc3_ioports(void);
+static void setup_fec1_ioports(struct fs_platform_info*);
+static void setup_fec2_ioports(struct fs_platform_info*);
+static void setup_scc3_ioports(struct fs_platform_info*);
 
 static struct fs_uart_platform_info mpc885_uart_pdata[] = {
         [fsid_smc1_uart] = {
@@ -161,7 +161,7 @@ void __init board_init(void)
 #endif
 }
 
-static void setup_fec1_ioports(struct fs_platform_info*)
+static void setup_fec1_ioports(struct fs_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
 
@@ -181,7 +181,7 @@ static void setup_fec1_ioports(struct fs_platform_info*)
         clrbits32(&immap->im_cpm.cp_cptr, 0x00000100);
 }
 
-static void setup_fec2_ioports(struct fs_platform_info*)
+static void setup_fec2_ioports(struct fs_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
 
@@ -193,7 +193,7 @@ static void setup_fec2_ioports(struct fs_platform_info*)
         clrbits32(&immap->im_cpm.cp_cptr, 0x00000080);
 }
 
-static void setup_scc3_ioports(struct fs_platform_info*)
+static void setup_scc3_ioports(struct fs_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
         unsigned *bcsr_io;
@@ -315,7 +315,7 @@ static void __init mpc885ads_fixup_scc_enet_pdata(struct platform_device *pdev,
         mpc885ads_fixup_enet_pdata(pdev, fsid_scc1 + pdev->id - 1);
 }
 
-static void setup_smc1_ioports(struct fs_uart_platform_info*)
+static void setup_smc1_ioports(struct fs_uart_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
         unsigned *bcsr_io;
@@ -335,7 +335,7 @@ static void setup_smc1_ioports(struct fs_uart_platform_info*)
         clrbits16(&immap->im_cpm.cp_pbodr, iobits);
 }
 
-static void setup_smc2_ioports(struct fs_uart_platform_info*)
+static void setup_smc2_ioports(struct fs_uart_platform_info* pdata)
 {
         immap_t *immap = (immap_t *) IMAP_ADDR;
         unsigned *bcsr_io;
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index 8af549e95730..993f35381496 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -167,7 +167,7 @@ static int __kprobes swap_instruction(void *aref)
          * shall not cross any page boundaries (vmalloc area!) when writing
          * the new instruction.
          */
-        addr = (u32 *)ALIGN((unsigned long)args->ptr, 4);
+        addr = (u32 *)((unsigned long)args->ptr & -4UL);
         if ((unsigned long)args->ptr & 2)
                 instr = ((*addr) & 0xffff0000) | args->new;
         else
diff --git a/arch/sh/kernel/sh_ksyms.c b/arch/sh/kernel/sh_ksyms.c
index fe1b276c97c6..6e0d10fac4a8 100644
--- a/arch/sh/kernel/sh_ksyms.c
+++ b/arch/sh/kernel/sh_ksyms.c
@@ -82,9 +82,6 @@ DECLARE_EXPORT(__movstr);
 DECLARE_EXPORT(__movmem_i4_even);
 DECLARE_EXPORT(__movmem_i4_odd);
 DECLARE_EXPORT(__movmemSI12_i4);
-DECLARE_EXPORT(__sdivsi3_i4i);
-DECLARE_EXPORT(__udiv_qrnnd_16);
-DECLARE_EXPORT(__udivsi3_i4i);
 #else /* GCC 3.x */
 DECLARE_EXPORT(__movstr_i4_even);
 DECLARE_EXPORT(__movstr_i4_odd);
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index 3fa5f95c4614..1c927c538b8b 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -601,7 +601,7 @@ pcic_fill_irq(struct linux_pcic *pcic, struct pci_dev *dev, int node)
 /*
  * Normally called from {do_}pci_scan_bus...
  */
-void __init pcibios_fixup_bus(struct pci_bus *bus)
+void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 {
         struct pci_dev *dev;
         int i, has_io, has_mem;
@@ -842,7 +842,7 @@ static void watchdog_reset() {
 /*
  * Other archs parse arguments here.
  */
-char * __init pcibios_setup(char *str)
+char * __devinit pcibios_setup(char *str)
 {
         return str;
 }
diff --git a/arch/sparc/kernel/sys_sunos.c b/arch/sparc/kernel/sys_sunos.c
index da6606f0cffc..f807172cab0e 100644
--- a/arch/sparc/kernel/sys_sunos.c
+++ b/arch/sparc/kernel/sys_sunos.c
@@ -910,7 +910,7 @@ asmlinkage long sunos_sysconf (int name)
                 ret = ARG_MAX;
                 break;
         case _SC_CHILD_MAX:
-                ret = -1; /* no limit */
+                ret = current->signal->rlim[RLIMIT_NPROC].rlim_cur;
                 break;
         case _SC_CLK_TCK:
                 ret = HZ;
@@ -919,7 +919,7 @@ asmlinkage long sunos_sysconf (int name)
                 ret = NGROUPS_MAX;
                 break;
         case _SC_OPEN_MAX:
-                ret = OPEN_MAX;
+                ret = current->signal->rlim[RLIMIT_NOFILE].rlim_cur;
                 break;
         case _SC_JOB_CONTROL:
                 ret = 1;        /* yes, we do support job control */
diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
index 53ddcd9d1e60..559335f4917d 100644
--- a/arch/sparc/lib/atomic32.c
+++ b/arch/sparc/lib/atomic32.c
@@ -52,6 +52,7 @@ int atomic_cmpxchg(atomic_t *v, int old, int new)
         spin_unlock_irqrestore(ATOMIC_HASH(v), flags);
         return ret;
 }
+EXPORT_SYMBOL(atomic_cmpxchg);
 
 int atomic_add_unless(atomic_t *v, int a, int u)
 {
@@ -65,6 +66,7 @@ int atomic_add_unless(atomic_t *v, int a, int u)
         spin_unlock_irqrestore(ATOMIC_HASH(v), flags);
         return ret != u;
 }
+EXPORT_SYMBOL(atomic_add_unless);
 
 /* Atomic operations are already serializing */
 void atomic_set(atomic_t *v, int i)
diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
index 196b4b72482b..12109886bb1e 100644
--- a/arch/sparc64/kernel/pci.c
+++ b/arch/sparc64/kernel/pci.c
@@ -327,7 +327,7 @@ static int __init pcibios_init(void)
 
 subsys_initcall(pcibios_init);
 
-void pcibios_fixup_bus(struct pci_bus *pbus)
+void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
 {
         struct pci_pbm_info *pbm = pbus->sysdata;
 
@@ -405,7 +405,7 @@ void pcibios_bus_to_resource(struct pci_dev *pdev, struct resource *res,
 }
 EXPORT_SYMBOL(pcibios_bus_to_resource);
 
-char * __init pcibios_setup(char *str)
+char * __devinit pcibios_setup(char *str)
 {
         return str;
 }
diff --git a/arch/sparc64/kernel/pci_iommu.c b/arch/sparc64/kernel/pci_iommu.c
index 2e7f1427088a..7aca0f33f885 100644
--- a/arch/sparc64/kernel/pci_iommu.c
+++ b/arch/sparc64/kernel/pci_iommu.c
@@ -64,7 +64,7 @@ static void __iommu_flushall(struct pci_iommu *iommu)
 #define IOPTE_IS_DUMMY(iommu, iopte)    \
         ((iopte_val(*iopte) & IOPTE_PAGE) == (iommu)->dummy_page_pa)
 
-static void inline iopte_make_dummy(struct pci_iommu *iommu, iopte_t *iopte)
+static inline void iopte_make_dummy(struct pci_iommu *iommu, iopte_t *iopte)
 {
         unsigned long val = iopte_val(*iopte);
 
diff --git a/arch/sparc64/kernel/sbus.c b/arch/sparc64/kernel/sbus.c
index 01d6d869ea2b..14f78fb5e890 100644
--- a/arch/sparc64/kernel/sbus.c
+++ b/arch/sparc64/kernel/sbus.c
@@ -24,48 +24,25 @@
 
 #include "iommu_common.h"
 
-/* These should be allocated on an SMP_CACHE_BYTES
- * aligned boundary for optimal performance.
- *
- * On SYSIO, using an 8K page size we have 1GB of SBUS
- * DMA space mapped.  We divide this space into equally
- * sized clusters. We allocate a DMA mapping from the
- * cluster that matches the order of the allocation, or
- * if the order is greater than the number of clusters,
- * we try to allocate from the last cluster.
- */
-
-#define NCLUSTERS       8UL
-#define ONE_GIG         (1UL * 1024UL * 1024UL * 1024UL)
-#define CLUSTER_SIZE    (ONE_GIG / NCLUSTERS)
-#define CLUSTER_MASK    (CLUSTER_SIZE - 1)
-#define CLUSTER_NPAGES  (CLUSTER_SIZE >> IO_PAGE_SHIFT)
 #define MAP_BASE        ((u32)0xc0000000)
 
+struct sbus_iommu_arena {
+        unsigned long   *map;
+        unsigned int    hint;
+        unsigned int    limit;
+};
+
 struct sbus_iommu {
-/*0x00*/spinlock_t              lock;
+        spinlock_t              lock;
 
-/*0x08*/iopte_t                 *page_table;
-/*0x10*/unsigned long           strbuf_regs;
-/*0x18*/unsigned long           iommu_regs;
-/*0x20*/unsigned long           sbus_control_reg;
+        struct sbus_iommu_arena arena;
 
-/*0x28*/volatile unsigned long  strbuf_flushflag;
+        iopte_t                 *page_table;
+        unsigned long           strbuf_regs;
+        unsigned long           iommu_regs;
+        unsigned long           sbus_control_reg;
 
-        /* If NCLUSTERS is ever decresed to 4 or lower,
-         * you must increase the size of the type of
-         * these counters.  You have been duly warned. -DaveM
-         */
-/*0x30*/struct {
-                u16     next;
-                u16     flush;
-        } alloc_info[NCLUSTERS];
-
-        /* The lowest used consistent mapping entry.  Since
-         * we allocate consistent maps out of cluster 0 this
-         * is relative to the beginning of closter 0.
-         */
-/*0x50*/u32             lowest_consistent_map;
+        volatile unsigned long  strbuf_flushflag;
 };
 
 /* Offsets from iommu_regs */
@@ -91,19 +68,6 @@ static void __iommu_flushall(struct sbus_iommu *iommu)
                 tag += 8UL;
         }
         upa_readq(iommu->sbus_control_reg);
-
-        for (entry = 0; entry < NCLUSTERS; entry++) {
-                iommu->alloc_info[entry].flush =
-                        iommu->alloc_info[entry].next;
-        }
-}
-
-static void iommu_flush(struct sbus_iommu *iommu, u32 base, unsigned long npages)
-{
-        while (npages--)
-                upa_writeq(base + (npages << IO_PAGE_SHIFT),
-                           iommu->iommu_regs + IOMMU_FLUSH);
-        upa_readq(iommu->sbus_control_reg);
 }
 
 /* Offsets from strbuf_regs */
@@ -156,178 +120,115 @@ static void sbus_strbuf_flush(struct sbus_iommu *iommu, u32 base, unsigned long
                        base, npages);
 }
 
-static iopte_t *alloc_streaming_cluster(struct sbus_iommu *iommu, unsigned long npages)
+/* Based largely upon the ppc64 iommu allocator.  */
+static long sbus_arena_alloc(struct sbus_iommu *iommu, unsigned long npages)
 {
-        iopte_t *iopte, *limit, *first, *cluster;
-        unsigned long cnum, ent, nent, flush_point, found;
-
-        cnum = 0;
-        nent = 1;
-        while ((1UL << cnum) < npages)
-                cnum++;
-        if(cnum >= NCLUSTERS) {
-                nent = 1UL << (cnum - NCLUSTERS);
-                cnum = NCLUSTERS - 1;
-        }
-        iopte  = iommu->page_table + (cnum * CLUSTER_NPAGES);
-
-        if (cnum == 0)
-                limit = (iommu->page_table +
-                         iommu->lowest_consistent_map);
-        else
-                limit = (iopte + CLUSTER_NPAGES);
-
-        iopte += ((ent = iommu->alloc_info[cnum].next) << cnum);
-        flush_point = iommu->alloc_info[cnum].flush;
-
-        first = iopte;
-        cluster = NULL;
-        found = 0;
-        for (;;) {
-                if (iopte_val(*iopte) == 0UL) {
-                        found++;
-                        if (!cluster)
-                                cluster = iopte;
+        struct sbus_iommu_arena *arena = &iommu->arena;
+        unsigned long n, i, start, end, limit;
+        int pass;
+
+        limit = arena->limit;
+        start = arena->hint;
+        pass = 0;
+
+again:
+        n = find_next_zero_bit(arena->map, limit, start);
+        end = n + npages;
+        if (unlikely(end >= limit)) {
+                if (likely(pass < 1)) {
+                        limit = start;
+                        start = 0;
+                        __iommu_flushall(iommu);
+                        pass++;
+                        goto again;
                 } else {
-                        /* Used cluster in the way */
-                        cluster = NULL;
-                        found = 0;
+                        /* Scanned the whole thing, give up. */
+                        return -1;
                 }
+        }
 
-                if (found == nent)
-                        break;
-
-                iopte += (1 << cnum);
-                ent++;
-                if (iopte >= limit) {
-                        iopte = (iommu->page_table + (cnum * CLUSTER_NPAGES));
-                        ent = 0;
-
-                        /* Multiple cluster allocations must not wrap */
-                        cluster = NULL;
-                        found = 0;
+        for (i = n; i < end; i++) {
+                if (test_bit(i, arena->map)) {
+                        start = i + 1;
+                        goto again;
                 }
-                if (ent == flush_point)
-                        __iommu_flushall(iommu);
-                if (iopte == first)
-                        goto bad;
         }
 
-        /* ent/iopte points to the last cluster entry we're going to use,
-         * so save our place for the next allocation.
-         */
-        if ((iopte + (1 << cnum)) >= limit)
-                ent = 0;
-        else
-                ent = ent + 1;
-        iommu->alloc_info[cnum].next = ent;
-        if (ent == flush_point)
-                __iommu_flushall(iommu);
-
-        /* I've got your streaming cluster right here buddy boy... */
-        return cluster;
-
-bad:
-        printk(KERN_EMERG "sbus: alloc_streaming_cluster of npages(%ld) failed!\n",
-               npages);
-        return NULL;
+        for (i = n; i < end; i++)
+                __set_bit(i, arena->map);
+
+        arena->hint = end;
+
+        return n;
 }
 
-static void free_streaming_cluster(struct sbus_iommu *iommu, u32 base, unsigned long npages)
+static void sbus_arena_free(struct sbus_iommu_arena *arena, unsigned long base, unsigned long npages)
 {
-        unsigned long cnum, ent, nent;
-        iopte_t *iopte;
+        unsigned long i;
 
-        cnum = 0;
-        nent = 1;
-        while ((1UL << cnum) < npages)
-                cnum++;
-        if(cnum >= NCLUSTERS) {
-                nent = 1UL << (cnum - NCLUSTERS);
-                cnum = NCLUSTERS - 1;
-        }
-        ent = (base & CLUSTER_MASK) >> (IO_PAGE_SHIFT + cnum);
-        iopte = iommu->page_table + ((base - MAP_BASE) >> IO_PAGE_SHIFT);
-        do {
-                iopte_val(*iopte) = 0UL;
-                iopte += 1 << cnum;
-        } while(--nent);
-
-        /* If the global flush might not have caught this entry,
-         * adjust the flush point such that we will flush before
-         * ever trying to reuse it.
-         */
-#define between(X,Y,Z)  (((Z) - (Y)) >= ((X) - (Y)))
-        if (between(ent, iommu->alloc_info[cnum].next, iommu->alloc_info[cnum].flush))
-                iommu->alloc_info[cnum].flush = ent;
-#undef between
+        for (i = base; i < (base + npages); i++)
+                __clear_bit(i, arena->map);
 }
 
-/* We allocate consistent mappings from the end of cluster zero. */
-static iopte_t *alloc_consistent_cluster(struct sbus_iommu *iommu, unsigned long npages)
+static void sbus_iommu_table_init(struct sbus_iommu *iommu, unsigned int tsbsize)
 {
-        iopte_t *iopte;
+        unsigned long tsbbase, order, sz, num_tsb_entries;
 
-        iopte = iommu->page_table + (1 * CLUSTER_NPAGES);
-        while (iopte > iommu->page_table) {
-                iopte--;
-                if (!(iopte_val(*iopte) & IOPTE_VALID)) {
-                        unsigned long tmp = npages;
+        num_tsb_entries = tsbsize / sizeof(iopte_t);
 
-                        while (--tmp) {
-                                iopte--;
-                                if (iopte_val(*iopte) & IOPTE_VALID)
-                                        break;
-                        }
-                        if (tmp == 0) {
-                                u32 entry = (iopte - iommu->page_table);
+        /* Setup initial software IOMMU state. */
+        spin_lock_init(&iommu->lock);
 
-                                if (entry < iommu->lowest_consistent_map)
-                                        iommu->lowest_consistent_map = entry;
-                                return iopte;
-                        }
-                }
+        /* Allocate and initialize the free area map.  */
+        sz = num_tsb_entries / 8;
+        sz = (sz + 7UL) & ~7UL;
+        iommu->arena.map = kzalloc(sz, GFP_KERNEL);
+        if (!iommu->arena.map) {
+                prom_printf("PCI_IOMMU: Error, kmalloc(arena.map) failed.\n");
+                prom_halt();
+        }
+        iommu->arena.limit = num_tsb_entries;
+
+        /* Now allocate and setup the IOMMU page table itself.  */
+        order = get_order(tsbsize);
+        tsbbase = __get_free_pages(GFP_KERNEL, order);
+        if (!tsbbase) {
+                prom_printf("IOMMU: Error, gfp(tsb) failed.\n");
+                prom_halt();
         }
-        return NULL;
+        iommu->page_table = (iopte_t *)tsbbase;
+        memset(iommu->page_table, 0, tsbsize);
 }
 
-static void free_consistent_cluster(struct sbus_iommu *iommu, u32 base, unsigned long npages)
+static inline iopte_t *alloc_npages(struct sbus_iommu *iommu, unsigned long npages)
 {
-        iopte_t *iopte = iommu->page_table + ((base - MAP_BASE) >> IO_PAGE_SHIFT);
+        long entry;
 
-        if ((iopte - iommu->page_table) == iommu->lowest_consistent_map) {
-                iopte_t *walk = iopte + npages;
-                iopte_t *limit;
+        entry = sbus_arena_alloc(iommu, npages);
+        if (unlikely(entry < 0))
+                return NULL;
 
-                limit = iommu->page_table + CLUSTER_NPAGES;
-                while (walk < limit) {
-                        if (iopte_val(*walk) != 0UL)
-                                break;
-                        walk++;
-                }
-                iommu->lowest_consistent_map =
-                        (walk - iommu->page_table);
-        }
+        return iommu->page_table + entry;
+}
 
-        while (npages--)
-                *iopte++ = __iopte(0UL);
+static inline void free_npages(struct sbus_iommu *iommu, dma_addr_t base, unsigned long npages)
+{
+        sbus_arena_free(&iommu->arena, base >> IO_PAGE_SHIFT, npages);
 }
 
 void *sbus_alloc_consistent(struct sbus_dev *sdev, size_t size, dma_addr_t *dvma_addr)
 {
-        unsigned long order, first_page, flags;
         struct sbus_iommu *iommu;
         iopte_t *iopte;
+        unsigned long flags, order, first_page;
         void *ret;
         int npages;
 
-        if (size <= 0 || sdev == NULL || dvma_addr == NULL)
-                return NULL;
-
         size = IO_PAGE_ALIGN(size);
         order = get_order(size);
         if (order >= 10)
                 return NULL;
+
         first_page = __get_free_pages(GFP_KERNEL|__GFP_COMP, order);
         if (first_page == 0UL)
                 return NULL;
@@ -336,108 +237,121 @@ void *sbus_alloc_consistent(struct sbus_dev *sdev, size_t size, dma_addr_t *dvma
         iommu = sdev->bus->iommu;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        iopte = alloc_consistent_cluster(iommu, size >> IO_PAGE_SHIFT);
-        if (iopte == NULL) {
-                spin_unlock_irqrestore(&iommu->lock, flags);
+        iopte = alloc_npages(iommu, size >> IO_PAGE_SHIFT);
+        spin_unlock_irqrestore(&iommu->lock, flags);
+
+        if (unlikely(iopte == NULL)) {
                 free_pages(first_page, order);
                 return NULL;
         }
 
-        /* Ok, we're committed at this point. */
-        *dvma_addr = MAP_BASE + ((iopte - iommu->page_table) << IO_PAGE_SHIFT);
+        *dvma_addr = (MAP_BASE +
+                      ((iopte - iommu->page_table) << IO_PAGE_SHIFT));
         ret = (void *) first_page;
         npages = size >> IO_PAGE_SHIFT;
+        first_page = __pa(first_page);
         while (npages--) {
-                *iopte++ = __iopte(IOPTE_VALID | IOPTE_CACHE | IOPTE_WRITE |
-                                   (__pa(first_page) & IOPTE_PAGE));
+                iopte_val(*iopte) = (IOPTE_VALID | IOPTE_CACHE |
+                                     IOPTE_WRITE |
+                                     (first_page & IOPTE_PAGE));
+                iopte++;
                 first_page += IO_PAGE_SIZE;
         }
-        iommu_flush(iommu, *dvma_addr, size >> IO_PAGE_SHIFT);
-        spin_unlock_irqrestore(&iommu->lock, flags);
 
         return ret;
 }
 
 void sbus_free_consistent(struct sbus_dev *sdev, size_t size, void *cpu, dma_addr_t dvma)
 {
-        unsigned long order, npages;
         struct sbus_iommu *iommu;
-
-        if (size <= 0 || sdev == NULL || cpu == NULL)
-                return;
+        iopte_t *iopte;
+        unsigned long flags, order, npages;
 
         npages = IO_PAGE_ALIGN(size) >> IO_PAGE_SHIFT;
         iommu = sdev->bus->iommu;
+        iopte = iommu->page_table +
+                ((dvma - MAP_BASE) >> IO_PAGE_SHIFT);
+
+        spin_lock_irqsave(&iommu->lock, flags);
+
+        free_npages(iommu, dvma - MAP_BASE, npages);
 
-        spin_lock_irq(&iommu->lock);
-        free_consistent_cluster(iommu, dvma, npages);
-        iommu_flush(iommu, dvma, npages);
-        spin_unlock_irq(&iommu->lock);
+        spin_unlock_irqrestore(&iommu->lock, flags);
 
         order = get_order(size);
         if (order < 10)
                 free_pages((unsigned long)cpu, order);
 }
 
-dma_addr_t sbus_map_single(struct sbus_dev *sdev, void *ptr, size_t size, int dir)
+dma_addr_t sbus_map_single(struct sbus_dev *sdev, void *ptr, size_t sz, int direction)
 {
-        struct sbus_iommu *iommu = sdev->bus->iommu;
-        unsigned long npages, pbase, flags;
-        iopte_t *iopte;
-        u32 dma_base, offset;
-        unsigned long iopte_bits;
+        struct sbus_iommu *iommu;
+        iopte_t *base;
+        unsigned long flags, npages, oaddr;
+        unsigned long i, base_paddr;
+        u32 bus_addr, ret;
+        unsigned long iopte_protection;
+
+        iommu = sdev->bus->iommu;
 
-        if (dir == SBUS_DMA_NONE)
+        if (unlikely(direction == SBUS_DMA_NONE))
                 BUG();
 
-        pbase = (unsigned long) ptr;
-        offset = (u32) (pbase & ~IO_PAGE_MASK);
-        size = (IO_PAGE_ALIGN(pbase + size) - (pbase & IO_PAGE_MASK));
-        pbase = (unsigned long) __pa(pbase & IO_PAGE_MASK);
+        oaddr = (unsigned long)ptr;
+        npages = IO_PAGE_ALIGN(oaddr + sz) - (oaddr & IO_PAGE_MASK);
+        npages >>= IO_PAGE_SHIFT;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        npages = size >> IO_PAGE_SHIFT;
-        iopte = alloc_streaming_cluster(iommu, npages);
-        if (iopte == NULL)
-                goto bad;
-        dma_base = MAP_BASE + ((iopte - iommu->page_table) << IO_PAGE_SHIFT);
-        npages = size >> IO_PAGE_SHIFT;
-        iopte_bits = IOPTE_VALID | IOPTE_STBUF | IOPTE_CACHE;
-        if (dir != SBUS_DMA_TODEVICE)
-                iopte_bits |= IOPTE_WRITE;
-        while (npages--) {
-                *iopte++ = __iopte(iopte_bits | (pbase & IOPTE_PAGE));
-                pbase += IO_PAGE_SIZE;
-        }
-        npages = size >> IO_PAGE_SHIFT;
+        base = alloc_npages(iommu, npages);
         spin_unlock_irqrestore(&iommu->lock, flags);
 
-        return (dma_base | offset);
+        if (unlikely(!base))
+                BUG();
 
-bad:
-        spin_unlock_irqrestore(&iommu->lock, flags);
-        BUG();
-        return 0;
+        bus_addr = (MAP_BASE +
+                    ((base - iommu->page_table) << IO_PAGE_SHIFT));
+        ret = bus_addr | (oaddr & ~IO_PAGE_MASK);
+        base_paddr = __pa(oaddr & IO_PAGE_MASK);
+
+        iopte_protection = IOPTE_VALID | IOPTE_STBUF | IOPTE_CACHE;
+        if (direction != SBUS_DMA_TODEVICE)
+                iopte_protection |= IOPTE_WRITE;
+
+        for (i = 0; i < npages; i++, base++, base_paddr += IO_PAGE_SIZE)
+                iopte_val(*base) = iopte_protection | base_paddr;
+
+        return ret;
 }
 
-void sbus_unmap_single(struct sbus_dev *sdev, dma_addr_t dma_addr, size_t size, int direction)
+void sbus_unmap_single(struct sbus_dev *sdev, dma_addr_t bus_addr, size_t sz, int direction)
 {
         struct sbus_iommu *iommu = sdev->bus->iommu;
-        u32 dma_base = dma_addr & IO_PAGE_MASK;
-        unsigned long flags;
+        iopte_t *base;
+        unsigned long flags, npages, i;
+
+        if (unlikely(direction == SBUS_DMA_NONE))
+                BUG();
+
+        npages = IO_PAGE_ALIGN(bus_addr + sz) - (bus_addr & IO_PAGE_MASK);
+        npages >>= IO_PAGE_SHIFT;
+        base = iommu->page_table +
+                ((bus_addr - MAP_BASE) >> IO_PAGE_SHIFT);
 
-        size = (IO_PAGE_ALIGN(dma_addr + size) - dma_base);
+        bus_addr &= IO_PAGE_MASK;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        free_streaming_cluster(iommu, dma_base, size >> IO_PAGE_SHIFT);
-        sbus_strbuf_flush(iommu, dma_base, size >> IO_PAGE_SHIFT, direction);
+        sbus_strbuf_flush(iommu, bus_addr, npages, direction);
+        for (i = 0; i < npages; i++)
+                iopte_val(base[i]) = 0UL;
+        free_npages(iommu, bus_addr - MAP_BASE, npages);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
 #define SG_ENT_PHYS_ADDRESS(SG) \
         (__pa(page_address((SG)->page)) + (SG)->offset)
 
-static inline void fill_sg(iopte_t *iopte, struct scatterlist *sg, int nused, int nelems, unsigned long iopte_bits)
+static inline void fill_sg(iopte_t *iopte, struct scatterlist *sg,
+                           int nused, int nelems, unsigned long iopte_protection)
 {
         struct scatterlist *dma_sg = sg;
         struct scatterlist *sg_end = sg + nelems;
@@ -462,7 +376,7 @@ static inline void fill_sg(iopte_t *iopte, struct scatterlist *sg, int nused, in
                         for (;;) {
                                 unsigned long tmp;
 
-                                tmp = (unsigned long) SG_ENT_PHYS_ADDRESS(sg);
+                                tmp = SG_ENT_PHYS_ADDRESS(sg);
                                 len = sg->length;
                                 if (((tmp ^ pteval) >> IO_PAGE_SHIFT) != 0UL) {
                                         pteval = tmp & IO_PAGE_MASK;
@@ -478,7 +392,7 @@ static inline void fill_sg(iopte_t *iopte, struct scatterlist *sg, int nused, in
                                 sg++;
                         }
 
-                        pteval = ((pteval & IOPTE_PAGE) | iopte_bits);
+                        pteval = iopte_protection | (pteval & IOPTE_PAGE);
                         while (len > 0) {
                                 *iopte++ = __iopte(pteval);
                                 pteval += IO_PAGE_SIZE;
@@ -509,103 +423,111 @@ static inline void fill_sg(iopte_t *iopte, struct scatterlist *sg, int nused, in
         }
 }
 
-int sbus_map_sg(struct sbus_dev *sdev, struct scatterlist *sg, int nents, int dir)
+int sbus_map_sg(struct sbus_dev *sdev, struct scatterlist *sglist, int nelems, int direction)
 {
-        struct sbus_iommu *iommu = sdev->bus->iommu;
-        unsigned long flags, npages;
-        iopte_t *iopte;
+        struct sbus_iommu *iommu;
+        unsigned long flags, npages, iopte_protection;
+        iopte_t *base;
         u32 dma_base;
         struct scatterlist *sgtmp;
         int used;
-        unsigned long iopte_bits;
-
-        if (dir == SBUS_DMA_NONE)
-                BUG();
 
         /* Fast path single entry scatterlists. */
-        if (nents == 1) {
-                sg->dma_address =
+        if (nelems == 1) {
+                sglist->dma_address =
                         sbus_map_single(sdev,
-                                        (page_address(sg->page) + sg->offset),
-                                        sg->length, dir);
-                sg->dma_length = sg->length;
+                                        (page_address(sglist->page) + sglist->offset),
+                                        sglist->length, direction);
+                sglist->dma_length = sglist->length;
                 return 1;
         }
 
-        npages = prepare_sg(sg, nents);
+        iommu = sdev->bus->iommu;
+
+        if (unlikely(direction == SBUS_DMA_NONE))
+                BUG();
+
+        npages = prepare_sg(sglist, nelems);
 
         spin_lock_irqsave(&iommu->lock, flags);
-        iopte = alloc_streaming_cluster(iommu, npages);
-        if (iopte == NULL)
-                goto bad;
-        dma_base = MAP_BASE + ((iopte - iommu->page_table) << IO_PAGE_SHIFT);
+        base = alloc_npages(iommu, npages);
+        spin_unlock_irqrestore(&iommu->lock, flags);
+
+        if (unlikely(base == NULL))
+                BUG();
+
+        dma_base = MAP_BASE +
+                ((base - iommu->page_table) << IO_PAGE_SHIFT);
 
         /* Normalize DVMA addresses. */
-        sgtmp = sg;
-        used = nents;
+        used = nelems;
 
+        sgtmp = sglist;
         while (used && sgtmp->dma_length) {
                 sgtmp->dma_address += dma_base;
                 sgtmp++;
                 used--;
         }
-        used = nents - used;
+        used = nelems - used;
 
-        iopte_bits = IOPTE_VALID | IOPTE_STBUF | IOPTE_CACHE;
-        if (dir != SBUS_DMA_TODEVICE)
-                iopte_bits |= IOPTE_WRITE;
+        iopte_protection = IOPTE_VALID | IOPTE_STBUF | IOPTE_CACHE;
+        if (direction != SBUS_DMA_TODEVICE)
+                iopte_protection |= IOPTE_WRITE;
+
+        fill_sg(base, sglist, used, nelems, iopte_protection);
 
-        fill_sg(iopte, sg, used, nents, iopte_bits);
 #ifdef VERIFY_SG
-        verify_sglist(sg, nents, iopte, npages);
+        verify_sglist(sglist, nelems, base, npages);
 #endif
-        spin_unlock_irqrestore(&iommu->lock, flags);
 
         return used;
-
-bad:
-        spin_unlock_irqrestore(&iommu->lock, flags);
-        BUG();
-        return 0;
 }
 
-void sbus_unmap_sg(struct sbus_dev *sdev, struct scatterlist *sg, int nents, int direction)
+void sbus_unmap_sg(struct sbus_dev *sdev, struct scatterlist *sglist, int nelems, int direction)
 {
-        unsigned long size, flags;
         struct sbus_iommu *iommu;
-        u32 dvma_base;
-        int i;
+        iopte_t *base;
+        unsigned long flags, i, npages;
+        u32 bus_addr;
 
-        /* Fast path single entry scatterlists. */
-        if (nents == 1) {
-                sbus_unmap_single(sdev, sg->dma_address, sg->dma_length, direction);
-                return;
-        }
+        if (unlikely(direction == SBUS_DMA_NONE))
+                BUG();
+
+        iommu = sdev->bus->iommu;
+
+        bus_addr = sglist->dma_address & IO_PAGE_MASK;
 
-        dvma_base = sg[0].dma_address & IO_PAGE_MASK;
-        for (i = 0; i < nents; i++) {
-                if (sg[i].dma_length == 0)
+        for (i = 1; i < nelems; i++)
+                if (sglist[i].dma_length == 0)
                         break;
-        }
         i--;
-        size = IO_PAGE_ALIGN(sg[i].dma_address + sg[i].dma_length) - dvma_base;
+        npages = (IO_PAGE_ALIGN(sglist[i].dma_address + sglist[i].dma_length) -
+                  bus_addr) >> IO_PAGE_SHIFT;
+
+        base = iommu->page_table +
+                ((bus_addr - MAP_BASE) >> IO_PAGE_SHIFT);
 
-        iommu = sdev->bus->iommu;
         spin_lock_irqsave(&iommu->lock, flags);
-        free_streaming_cluster(iommu, dvma_base, size >> IO_PAGE_SHIFT);
-        sbus_strbuf_flush(iommu, dvma_base, size >> IO_PAGE_SHIFT, direction);
+        sbus_strbuf_flush(iommu, bus_addr, npages, direction);
+        for (i = 0; i < npages; i++)
+                iopte_val(base[i]) = 0UL;
+        free_npages(iommu, bus_addr - MAP_BASE, npages);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-void sbus_dma_sync_single_for_cpu(struct sbus_dev *sdev, dma_addr_t base, size_t size, int direction)
+void sbus_dma_sync_single_for_cpu(struct sbus_dev *sdev, dma_addr_t bus_addr, size_t sz, int direction)
 {
-        struct sbus_iommu *iommu = sdev->bus->iommu;
-        unsigned long flags;
+        struct sbus_iommu *iommu;
+        unsigned long flags, npages;
+
+        iommu = sdev->bus->iommu;
 
-        size = (IO_PAGE_ALIGN(base + size) - (base & IO_PAGE_MASK));
+        npages = IO_PAGE_ALIGN(bus_addr + sz) - (bus_addr & IO_PAGE_MASK);
+        npages >>= IO_PAGE_SHIFT;
+        bus_addr &= IO_PAGE_MASK;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        sbus_strbuf_flush(iommu, base & IO_PAGE_MASK, size >> IO_PAGE_SHIFT, direction);
+        sbus_strbuf_flush(iommu, bus_addr, npages, direction);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
@@ -613,23 +535,25 @@ void sbus_dma_sync_single_for_device(struct sbus_dev *sdev, dma_addr_t base, siz
 {
 }
 
-void sbus_dma_sync_sg_for_cpu(struct sbus_dev *sdev, struct scatterlist *sg, int nents, int direction)
+void sbus_dma_sync_sg_for_cpu(struct sbus_dev *sdev, struct scatterlist *sglist, int nelems, int direction)
 {
-        struct sbus_iommu *iommu = sdev->bus->iommu;
-        unsigned long flags, size;
-        u32 base;
-        int i;
+        struct sbus_iommu *iommu;
+        unsigned long flags, npages, i;
+        u32 bus_addr;
+
+        iommu = sdev->bus->iommu;
 
-        base = sg[0].dma_address & IO_PAGE_MASK;
-        for (i = 0; i < nents; i++) {
-                if (sg[i].dma_length == 0)
+        bus_addr = sglist[0].dma_address & IO_PAGE_MASK;
+        for (i = 0; i < nelems; i++) {
+                if (!sglist[i].dma_length)
                         break;
         }
         i--;
-        size = IO_PAGE_ALIGN(sg[i].dma_address + sg[i].dma_length) - base;
+        npages = (IO_PAGE_ALIGN(sglist[i].dma_address + sglist[i].dma_length)
+                  - bus_addr) >> IO_PAGE_SHIFT;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        sbus_strbuf_flush(iommu, base, size >> IO_PAGE_SHIFT, direction);
+        sbus_strbuf_flush(iommu, bus_addr, npages, direction);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
@@ -1104,7 +1028,7 @@ static void __init sbus_iommu_init(int __node, struct sbus_bus *sbus)
         struct linux_prom64_registers *pr;
         struct device_node *dp;
         struct sbus_iommu *iommu;
-        unsigned long regs, tsb_base;
+        unsigned long regs;
         u64 control;
         int i;
 
@@ -1132,14 +1056,6 @@ static void __init sbus_iommu_init(int __node, struct sbus_bus *sbus)
 
         memset(iommu, 0, sizeof(*iommu));
 
-        /* We start with no consistent mappings. */
-        iommu->lowest_consistent_map = CLUSTER_NPAGES;
-
-        for (i = 0; i < NCLUSTERS; i++) {
-                iommu->alloc_info[i].flush = 0;
-                iommu->alloc_info[i].next = 0;
-        }
-
         /* Setup spinlock. */
         spin_lock_init(&iommu->lock);
 
@@ -1159,25 +1075,13 @@ static void __init sbus_iommu_init(int __node, struct sbus_bus *sbus)
                sbus->portid, regs);
 
         /* Setup for TSB_SIZE=7, TBW_SIZE=0, MMU_DE=1, MMU_EN=1 */
+        sbus_iommu_table_init(iommu, IO_TSB_SIZE);
+
         control = upa_readq(iommu->iommu_regs + IOMMU_CONTROL);
         control = ((7UL << 16UL)        |
                    (0UL << 2UL)         |
                    (1UL << 1UL)         |
                    (1UL << 0UL));
-
-        /* Using the above configuration we need 1MB iommu page
-         * table (128K ioptes * 8 bytes per iopte).  This is
-         * page order 7 on UltraSparc.
-         */
-        tsb_base = __get_free_pages(GFP_ATOMIC, get_order(IO_TSB_SIZE));
-        if (tsb_base == 0UL) {
-                prom_printf("sbus_iommu_init: Fatal error, cannot alloc TSB table.\n");
-                prom_halt();
-        }
-
-        iommu->page_table = (iopte_t *) tsb_base;
-        memset(iommu->page_table, 0, IO_TSB_SIZE);
-
         upa_writeq(control, iommu->iommu_regs + IOMMU_CONTROL);
 
         /* Clean out any cruft in the IOMMU using
@@ -1195,7 +1099,7 @@ static void __init sbus_iommu_init(int __node, struct sbus_bus *sbus)
         upa_readq(iommu->sbus_control_reg);
 
         /* Give the TSB to SYSIO. */
-        upa_writeq(__pa(tsb_base), iommu->iommu_regs + IOMMU_TSBBASE);
+        upa_writeq(__pa(iommu->page_table), iommu->iommu_regs + IOMMU_TSBBASE);
 
         /* Setup streaming buffer, DE=1 SB_EN=1 */
         control = (1UL << 1UL) | (1UL << 0UL);
diff --git a/arch/sparc64/kernel/sys32.S b/arch/sparc64/kernel/sys32.S
index c09ab4b9431d..010a737908ee 100644
--- a/arch/sparc64/kernel/sys32.S
+++ b/arch/sparc64/kernel/sys32.S
@@ -91,7 +91,6 @@ SIGN1(sys32_select, compat_sys_select, %o0)
 SIGN1(sys32_mkdir, sys_mkdir, %o1)
 SIGN3(sys32_futex, compat_sys_futex, %o1, %o2, %o5)
 SIGN1(sys32_sysfs, compat_sys_sysfs, %o0)
-SIGN3(sys32_ipc, compat_sys_ipc, %o1, %o2, %o3)
 SIGN2(sys32_sendfile, compat_sys_sendfile, %o0, %o1)
 SIGN2(sys32_sendfile64, compat_sys_sendfile64, %o0, %o1)
 SIGN1(sys32_prctl, sys_prctl, %o0)
diff --git a/arch/sparc64/kernel/sys_sunos32.c b/arch/sparc64/kernel/sys_sunos32.c
index 4cff95b7b3a4..8f7a06e2c7e7 100644
--- a/arch/sparc64/kernel/sys_sunos32.c
+++ b/arch/sparc64/kernel/sys_sunos32.c
@@ -871,7 +871,7 @@ asmlinkage s32 sunos_sysconf (int name)
                 ret = ARG_MAX;
                 break;
         case _SC_CHILD_MAX:
-                ret = -1; /* no limit */
+                ret = current->signal->rlim[RLIMIT_NPROC].rlim_cur;
                 break;
         case _SC_CLK_TCK:
                 ret = HZ;
@@ -880,7 +880,7 @@ asmlinkage s32 sunos_sysconf (int name)
                 ret = NGROUPS_MAX;
                 break;
         case _SC_OPEN_MAX:
-                ret = OPEN_MAX;
+                ret = current->signal->rlim[RLIMIT_NOFILE].rlim_cur;
                 break;
         case _SC_JOB_CONTROL:
                 ret = 1;        /* yes, we do support job control */
diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
index aaeb5e06735c..48c36fe6dc62 100644
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -62,7 +62,7 @@ sys_call_table32:
 /*200*/ .word sys32_ssetmask, sys_sigsuspend, compat_sys_newlstat, sys_uselib, compat_sys_old_readdir
         .word sys32_readahead, sys32_socketcall, sys32_syslog, sys32_lookup_dcookie, sys32_fadvise64
 /*210*/ .word sys32_fadvise64_64, sys32_tgkill, sys32_waitpid, sys_swapoff, compat_sys_sysinfo
-        .word sys32_ipc, sys32_sigreturn, sys_clone, sys32_ioprio_get, compat_sys_adjtimex
+        .word compat_sys_ipc, sys32_sigreturn, sys_clone, sys32_ioprio_get, compat_sys_adjtimex
 /*220*/ .word sys32_sigprocmask, sys_ni_syscall, sys32_delete_module, sys_ni_syscall, sys32_getpgid
         .word sys32_bdflush, sys32_sysfs, sys_nis_syscall, sys32_setfsuid16, sys32_setfsgid16
 /*230*/ .word sys32_select, compat_sys_time, sys32_splice, compat_sys_stime, compat_sys_statfs64
diff --git a/arch/sparc64/solaris/misc.c b/arch/sparc64/solaris/misc.c
index bca16e8c95c3..9fcaad6dd11f 100644
--- a/arch/sparc64/solaris/misc.c
+++ b/arch/sparc64/solaris/misc.c
@@ -363,8 +363,10 @@ asmlinkage int solaris_sysconf(int id)
 {
         switch (id) {
         case SOLARIS_CONFIG_NGROUPS:    return NGROUPS_MAX;
-        case SOLARIS_CONFIG_CHILD_MAX:  return -1; /* no limit */
-        case SOLARIS_CONFIG_OPEN_FILES: return OPEN_MAX;
+        case SOLARIS_CONFIG_CHILD_MAX:
+                return current->signal->rlim[RLIMIT_NPROC].rlim_cur;
+        case SOLARIS_CONFIG_OPEN_FILES:
+                return current->signal->rlim[RLIMIT_NOFILE].rlim_cur;
         case SOLARIS_CONFIG_POSIX_VER:  return 199309;
         case SOLARIS_CONFIG_PAGESIZE:   return PAGE_SIZE;
         case SOLARIS_CONFIG_XOPEN_VER:  return 3;
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 7b8baf146acc..9fdfad649536 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -236,11 +236,11 @@ void free_irqs(void)
         struct chan *chan;
         LIST_HEAD(list);
         struct list_head *ele;
+        unsigned long flags;
 
-        spin_lock_irq(&irqs_to_free_lock);
+        spin_lock_irqsave(&irqs_to_free_lock, flags);
         list_splice_init(&irqs_to_free, &list);
-        INIT_LIST_HEAD(&irqs_to_free);
-        spin_unlock_irq(&irqs_to_free_lock);
+        spin_unlock_irqrestore(&irqs_to_free_lock, flags);
 
         list_for_each(ele, &list){
                 chan = list_entry(ele, struct chan, free_list);
@@ -255,13 +255,15 @@ void free_irqs(void)
 
 static void close_one_chan(struct chan *chan, int delay_free_irq)
 {
+        unsigned long flags;
+
         if(!chan->opened)
                 return;
 
         if(delay_free_irq){
-                spin_lock_irq(&irqs_to_free_lock);
+                spin_lock_irqsave(&irqs_to_free_lock, flags);
                 list_add(&chan->free_list, &irqs_to_free);
-                spin_unlock_irq(&irqs_to_free_lock);
+                spin_unlock_irqrestore(&irqs_to_free_lock, flags);
         }
         else {
                 if(chan->input)
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 178b2eff4a8c..65ad2932672c 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -615,6 +615,9 @@ void mconsole_remove(struct mc_request *req)
         err_msg = NULL;
         err = (*dev->remove)(n, &err_msg);
         switch(err){
+        case 0:
+                err_msg = "";
+                break;
         case -ENODEV:
                 if(err_msg == NULL)
                         err_msg = "Device doesn't exist";
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index f98d26e51381..8bd9204ac1ab 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -109,10 +109,6 @@ static inline void ubd_set_bit(__u64 bit, unsigned char *data)
 
 static DEFINE_MUTEX(ubd_lock);
 
-/* XXX - this made sense in 2.4 days, now it's only used as a boolean, and
- * probably it doesn't make sense even for that. */
-static int do_ubd;
-
 static int ubd_open(struct inode * inode, struct file * filp);
 static int ubd_release(struct inode * inode, struct file * file);
 static int ubd_ioctl(struct inode * inode, struct file * file,
@@ -169,6 +165,7 @@ struct ubd {
         struct platform_device pdev;
         struct request_queue *queue;
         spinlock_t lock;
+        int active;
 };
 
 #define DEFAULT_COW { \
@@ -190,6 +187,7 @@ struct ubd {
         .shared =               0, \
         .cow =                  DEFAULT_COW, \
         .lock =                 SPIN_LOCK_UNLOCKED,     \
+        .active =               0, \
 }
 
 /* Protected by ubd_lock */
@@ -507,7 +505,6 @@ static void ubd_handler(void)
         struct ubd *dev;
         int n;
 
-        do_ubd = 0;
         n = os_read_file(thread_fd, &req, sizeof(req));
         if(n != sizeof(req)){
                 printk(KERN_ERR "Pid %d - spurious interrupt in ubd_handler, "
@@ -517,6 +514,7 @@ static void ubd_handler(void)
 
         rq = req.req;
         dev = rq->rq_disk->private_data;
+        dev->active = 0;
 
         ubd_finish(rq, req.error);
         reactivate_fd(thread_fd, UBD_IRQ);
@@ -1081,11 +1079,12 @@ static void do_ubd_request(request_queue_t *q)
                 }
         }
         else {
-                if(do_ubd || (req = elv_next_request(q)) == NULL)
+                struct ubd *dev = q->queuedata;
+                if(dev->active || (req = elv_next_request(q)) == NULL)
                         return;
                 err = prepare_request(req, &io_req);
                 if(!err){
-                        do_ubd = 1;
+                        dev->active = 1;
                         n = os_write_file(thread_fd, (char *) &io_req,
                                          sizeof(io_req));
                         if(n != sizeof(io_req))
diff --git a/arch/um/include/mconsole.h b/arch/um/include/mconsole.h
index 2666815b6af5..b282839c1625 100644
--- a/arch/um/include/mconsole.h
+++ b/arch/um/include/mconsole.h
@@ -12,6 +12,8 @@
 #define u32 uint32_t
 #endif
 
+#include "sysdep/ptrace.h"
+
 #define MCONSOLE_MAGIC (0xcafebabe)
 #define MCONSOLE_MAX_DATA (512)
 #define MCONSOLE_VERSION 2
diff --git a/arch/um/include/sysdep-x86_64/ptrace.h b/arch/um/include/sysdep-x86_64/ptrace.h
index 66cb400c2c92..62403bd99661 100644
--- a/arch/um/include/sysdep-x86_64/ptrace.h
+++ b/arch/um/include/sysdep-x86_64/ptrace.h
@@ -104,10 +104,6 @@ union uml_pt_regs {
 #endif
 #ifdef UML_CONFIG_MODE_SKAS
         struct skas_regs {
-                /* x86_64 ptrace uses sizeof(user_regs_struct) as its register
-                 * file size, while i386 uses FRAME_SIZE.  Therefore, we need
-                 * to use UM_FRAME_SIZE here instead of HOST_FRAME_SIZE.
-                 */
                 unsigned long regs[MAX_REG_NR];
                 unsigned long fp[HOST_FP_SIZE];
                 struct faultinfo faultinfo;
diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c
index e85d65deea0d..df7d662b98ce 100644
--- a/arch/um/kernel/mem.c
+++ b/arch/um/kernel/mem.c
@@ -64,8 +64,6 @@ static void setup_highmem(unsigned long highmem_start,
 
 void mem_init(void)
 {
-        max_low_pfn = (high_physmem - uml_physmem) >> PAGE_SHIFT;
-
         /* clear the zero-page */
         memset((void *) empty_zero_page, 0, PAGE_SIZE);
 
@@ -80,6 +78,7 @@ void mem_init(void)
 
         /* this will put all low memory onto the freelists */
         totalram_pages = free_all_bootmem();
+        max_low_pfn = totalram_pages;
 #ifdef CONFIG_HIGHMEM
         totalhigh_pages = highmem >> PAGE_SHIFT;
         totalram_pages += totalhigh_pages;
diff --git a/arch/um/os-Linux/skas/mem.c b/arch/um/os-Linux/skas/mem.c
index b3c11cfa995a..9383e8751ae7 100644
--- a/arch/um/os-Linux/skas/mem.c
+++ b/arch/um/os-Linux/skas/mem.c
@@ -48,7 +48,7 @@ int multi_op_count = 0;
 static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr)
 {
         unsigned long regs[MAX_REG_NR];
-        int n;
+        int n, i;
         long ret, offset;
         unsigned long * data;
         unsigned long * syscall;
@@ -66,9 +66,13 @@ static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr)
                  (unsigned long) &__syscall_stub_start);
 
         n = ptrace_setregs(pid, regs);
-        if(n < 0)
+        if(n < 0){
+                printk("Registers - \n");
+                for(i = 0; i < MAX_REG_NR; i++)
+                        printk("\t%d\t0x%lx\n", i, regs[i]);
                 panic("do_syscall_stub : PTRACE_SETREGS failed, errno = %d\n",
-                      n);
+                      -n);
+        }
 
         wait_stub_done(pid, 0, "do_syscall_stub");
 
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index dda06789bcb0..0564422c155f 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -67,7 +67,7 @@ void wait_stub_done(int pid, int sig, char * fname)
 
         if((n < 0) || !WIFSTOPPED(status) ||
            (WSTOPSIG(status) != SIGUSR1 && WSTOPSIG(status) != SIGTRAP)){
-                unsigned long regs[HOST_FRAME_SIZE];
+                unsigned long regs[MAX_REG_NR];
 
                 if(ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
                         printk("Failed to get registers from stub, "
@@ -76,7 +76,7 @@ void wait_stub_done(int pid, int sig, char * fname)
                         int i;
 
                         printk("Stub registers -\n");
-                        for(i = 0; i < HOST_FRAME_SIZE; i++)
+                        for(i = 0; i < ARRAY_SIZE(regs); i++)
                                 printk("\t%d - %lx\n", i, regs[i]);
                 }
                 panic("%s : failed to wait for SIGUSR1/SIGTRAP, "
@@ -328,7 +328,7 @@ void userspace(union uml_pt_regs *regs)
 int copy_context_skas0(unsigned long new_stack, int pid)
 {
         int err;
-        unsigned long regs[HOST_FRAME_SIZE];
+        unsigned long regs[MAX_REG_NR];
         unsigned long fp_regs[HOST_FP_SIZE];
         unsigned long current_stack = current_stub_stack();
         struct stub_data *data = (struct stub_data *) current_stack;
diff --git a/arch/um/os-Linux/sys-i386/registers.c b/arch/um/os-Linux/sys-i386/registers.c
index 79cd93c8c5ed..84b44f9cd42a 100644
--- a/arch/um/os-Linux/sys-i386/registers.c
+++ b/arch/um/os-Linux/sys-i386/registers.c
@@ -15,7 +15,7 @@
 
 /* These are set once at boot time and not changed thereafter */
 
-static unsigned long exec_regs[HOST_FRAME_SIZE];
+static unsigned long exec_regs[MAX_REG_NR];
 static unsigned long exec_fp_regs[HOST_FP_SIZE];
 static unsigned long exec_fpx_regs[HOST_XFP_SIZE];
 static int have_fpx_regs = 1;
@@ -101,6 +101,7 @@ void init_registers(int pid)
 {
         int err;
 
+        memset(exec_regs, 0, sizeof(exec_regs));
         err = ptrace(PTRACE_GETREGS, pid, 0, exec_regs);
         if(err)
                 panic("check_ptrace : PTRACE_GETREGS failed, errno = %d",
@@ -124,7 +125,7 @@ void init_registers(int pid)
 
 void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
-        memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long));
+        memcpy(regs, exec_regs, sizeof(exec_regs));
         if(fp_regs != NULL)
                 memcpy(fp_regs, exec_fp_regs,
                        HOST_FP_SIZE * sizeof(unsigned long));
diff --git a/arch/um/os-Linux/sys-x86_64/registers.c b/arch/um/os-Linux/sys-x86_64/registers.c
index a2d7e0c603f7..e6fc2179d1bc 100644
--- a/arch/um/os-Linux/sys-x86_64/registers.c
+++ b/arch/um/os-Linux/sys-x86_64/registers.c
@@ -14,7 +14,7 @@
 
 /* These are set once at boot time and not changed thereafter */
 
-static unsigned long exec_regs[HOST_FRAME_SIZE];
+static unsigned long exec_regs[MAX_REG_NR];
 static unsigned long exec_fp_regs[HOST_FP_SIZE];
 
 void init_thread_registers(union uml_pt_regs *to)
@@ -72,7 +72,7 @@ void init_registers(int pid)
 
 void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
-        memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long));
+        memcpy(regs, exec_regs, sizeof(exec_regs));
         if(fp_regs != NULL)
                 memcpy(fp_regs, exec_fp_regs,
                        HOST_FP_SIZE * sizeof(unsigned long));
diff --git a/arch/um/sys-i386/delay.c b/arch/um/sys-i386/delay.c
index 2c11b9770e8b..d623e074f41d 100644
--- a/arch/um/sys-i386/delay.c
+++ b/arch/um/sys-i386/delay.c
@@ -27,14 +27,3 @@ void __udelay(unsigned long usecs)
 }
 
 EXPORT_SYMBOL(__udelay);
-
-void __const_udelay(unsigned long usecs)
-{
-        int i, n;
-
-        n = (loops_per_jiffy * HZ * usecs) / MILLION;
-        for(i=0;i<n;i++)
-                cpu_relax();
-}
-
-EXPORT_SYMBOL(__const_udelay);
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index 4a8b4202ef9e..a939a7ef0227 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -394,7 +394,8 @@ static short * host_ldt_entries = NULL;
 static void ldt_get_host_info(void)
 {
         long ret;
-        struct ldt_entry * ldt, *tmp;
+        struct ldt_entry * ldt;
+        short *tmp;
         int i, size, k, order;
 
         spin_lock(&host_ldt_lock);
diff --git a/arch/um/sys-x86_64/delay.c b/arch/um/sys-x86_64/delay.c
index 137f4446b439..dee5be66da82 100644
--- a/arch/um/sys-x86_64/delay.c
+++ b/arch/um/sys-x86_64/delay.c
@@ -28,14 +28,3 @@ void __udelay(unsigned long usecs)
 }
 
 EXPORT_SYMBOL(__udelay);
-
-void __const_udelay(unsigned long usecs)
-{
-        unsigned long i, n;
-
-        n = (loops_per_jiffy * HZ * usecs) / MILLION;
-        for(i=0;i<n;i++)
-                cpu_relax();
-}
-
-EXPORT_SYMBOL(__const_udelay);
diff --git a/arch/x86_64/boot/video.S b/arch/x86_64/boot/video.S
index d6ff88f35135..6090516c9c7f 100644
--- a/arch/x86_64/boot/video.S
+++ b/arch/x86_64/boot/video.S
@@ -571,6 +571,16 @@ setr1:	lodsw
         jmp     _m_s
 
 check_vesa:
+#ifdef CONFIG_FIRMWARE_EDID
+        leaw    modelist+1024, %di
+        movw    $0x4f00, %ax
+        int     $0x10
+        cmpw    $0x004f, %ax
+        jnz     setbad
+
+        movw    4(%di), %ax
+        movw    %ax, vbe_version
+#endif
         leaw    modelist+1024, %di
         subb    $VIDEO_FIRST_VESA>>8, %bh
         movw    %bx, %cx                        # Get mode information structure
@@ -1945,6 +1955,9 @@ store_edid:
         rep
         stosl
 
+        cmpw    $0x0200, vbe_version            # only do EDID on >= VBE2.0
+        jl      no_edid
+
         pushw   %es                             # save ES
         xorw    %di, %di                        # Report Capability
         pushw   %di
@@ -1987,6 +2000,7 @@ do_restore:	.byte	0	# Screen contents altered during mode change
 svga_prefix:    .byte   VIDEO_FIRST_BIOS>>8     # Default prefix for BIOS modes
 graphic_mode:   .byte   0       # Graphic mode with a linear frame buffer
 dac_size:       .byte   6       # DAC bit depth
+vbe_version:    .word   0       # VBE bios version
 
 # Status messages
 keymsg:         .ascii  "Press <RETURN> to see video modes available, "
diff --git a/arch/x86_64/kernel/acpi/sleep.c b/arch/x86_64/kernel/acpi/sleep.c
index 23178ce6c783..e1548fbe95ae 100644
--- a/arch/x86_64/kernel/acpi/sleep.c
+++ b/arch/x86_64/kernel/acpi/sleep.c
@@ -66,8 +66,10 @@ static void init_low_mapping(void)
 {
         pgd_t *slot0 = pgd_offset(current->mm, 0UL);
         low_ptr = *slot0;
+        /* FIXME: We're playing with the current task's page tables here, which
+         * is potentially dangerous on SMP systems.
+         */
         set_pgd(slot0, *pgd_offset(current->mm, PAGE_OFFSET));
-        WARN_ON(num_online_cpus() != 1);
         local_flush_tlb();
 }
 
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 148c6bcf5bb4..fede55a53995 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -88,7 +88,7 @@ struct chipset {
         void (*f)(void);
 };
 
-static struct __initdata chipset early_qrk[] = {
+static struct chipset early_qrk[] __initdata = {
         { PCI_VENDOR_ID_NVIDIA, nvidia_bugs },
         { PCI_VENDOR_ID_VIA, via_bugs },
         { PCI_VENDOR_ID_ATI, ati_bugs },
diff --git a/arch/x86_64/kernel/functionlist b/arch/x86_64/kernel/functionlist
index 01fa23580c85..7ae18ec12454 100644
--- a/arch/x86_64/kernel/functionlist
+++ b/arch/x86_64/kernel/functionlist
@@ -514,7 +514,6 @@
 *(.text.dentry_open)
 *(.text.dentry_iput)
 *(.text.bio_alloc)
-*(.text.alloc_skb_from_cache)
 *(.text.wait_on_page_bit)
 *(.text.vfs_readdir)
 *(.text.vfs_lstat)
diff --git a/arch/x86_64/kernel/hpet.c b/arch/x86_64/kernel/hpet.c
index 8cf0b8a13778..b8286968662d 100644
--- a/arch/x86_64/kernel/hpet.c
+++ b/arch/x86_64/kernel/hpet.c
@@ -191,6 +191,7 @@ int hpet_reenable(void)
 
 #define TICK_COUNT 100000000
 #define TICK_MIN   5000
+#define MAX_TRIES  5
 
 /*
  * Some platforms take periodic SMI interrupts with 5ms duration. Make sure none
@@ -198,13 +199,15 @@ int hpet_reenable(void)
  */
 static void __init read_hpet_tsc(int *hpet, int *tsc)
 {
-        int tsc1, tsc2, hpet1;
+        int tsc1, tsc2, hpet1, i;
 
-        do {
+        for (i = 0; i < MAX_TRIES; i++) {
                 tsc1 = get_cycles_sync();
                 hpet1 = hpet_readl(HPET_COUNTER);
                 tsc2 = get_cycles_sync();
-        } while (tsc2 - tsc1 > TICK_MIN);
+                if (tsc2 - tsc1 > TICK_MIN)
+                        break;
+        }
         *hpet = hpet1;
         *tsc = tsc2;
 }
diff --git a/arch/x86_64/kernel/i8259.c b/arch/x86_64/kernel/i8259.c
index 21d95b747437..489426682772 100644
--- a/arch/x86_64/kernel/i8259.c
+++ b/arch/x86_64/kernel/i8259.c
@@ -45,7 +45,7 @@
 
 /*
  * ISA PIC or low IO-APIC triggered (INTA-cycle or APIC) interrupts:
- * (these are usually mapped to vectors 0x20-0x2f)
+ * (these are usually mapped to vectors 0x30-0x3f)
  */
 
 /*
@@ -299,7 +299,7 @@ void init_8259A(int auto_eoi)
          * outb_p - this has to work on a wide range of PC hardware.
          */
         outb_p(0x11, 0x20);     /* ICW1: select 8259A-1 init */
-        outb_p(IRQ0_VECTOR, 0x21);      /* ICW2: 8259A-1 IR0-7 mapped to 0x20-0x27 */
+        outb_p(IRQ0_VECTOR, 0x21);      /* ICW2: 8259A-1 IR0-7 mapped to 0x30-0x37 */
         outb_p(0x04, 0x21);     /* 8259A-1 (the master) has a slave on IR2 */
         if (auto_eoi)
                 outb_p(0x03, 0x21);     /* master does Auto EOI */
@@ -307,7 +307,7 @@ void init_8259A(int auto_eoi)
                 outb_p(0x01, 0x21);     /* master expects normal EOI */
 
         outb_p(0x11, 0xA0);     /* ICW1: select 8259A-2 init */
-        outb_p(IRQ8_VECTOR, 0xA1);      /* ICW2: 8259A-2 IR0-7 mapped to 0x28-0x2f */
+        outb_p(IRQ8_VECTOR, 0xA1);      /* ICW2: 8259A-2 IR0-7 mapped to 0x38-0x3f */
         outb_p(0x02, 0xA1);     /* 8259A-2 is a slave on master's IR2 */
         outb_p(0x01, 0xA1);     /* (slave's support for AEOI in flat mode
                                     is to be investigated) */
diff --git a/arch/x86_64/kernel/k8.c b/arch/x86_64/kernel/k8.c
index 6416682d33d0..bc11b32e8b4d 100644
--- a/arch/x86_64/kernel/k8.c
+++ b/arch/x86_64/kernel/k8.c
@@ -61,8 +61,8 @@ int cache_k8_northbridges(void)
         dev = NULL;
         i = 0;
         while ((dev = next_k8_northbridge(dev)) != NULL) {
-                k8_northbridges[i++] = dev;
-                pci_read_config_dword(dev, 0x9c, &flush_words[i]);
+                k8_northbridges[i] = dev;
+                pci_read_config_dword(dev, 0x9c, &flush_words[i++]);
         }
         k8_northbridges[i] = NULL;
         return 0;
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 82d9d85d5270..dfab9f167366 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -39,15 +39,17 @@ int panic_on_unrecovered_nmi;
  *   different subsystems this reservation system just tries to coordinate
  *   things a little
  */
-static DEFINE_PER_CPU(unsigned, perfctr_nmi_owner);
-static DEFINE_PER_CPU(unsigned, evntsel_nmi_owner[2]);
-
-static cpumask_t backtrace_mask = CPU_MASK_NONE;
 
 /* this number is calculated from Intel's MSR_P4_CRU_ESCR5 register and it's
  * offset from MSR_P4_BSU_ESCR0.  It will be the max for all platforms (for now)
  */
 #define NMI_MAX_COUNTER_BITS 66
+#define NMI_MAX_COUNTER_LONGS BITS_TO_LONGS(NMI_MAX_COUNTER_BITS)
+
+static DEFINE_PER_CPU(unsigned, perfctr_nmi_owner[NMI_MAX_COUNTER_LONGS]);
+static DEFINE_PER_CPU(unsigned, evntsel_nmi_owner[NMI_MAX_COUNTER_LONGS]);
+
+static cpumask_t backtrace_mask = CPU_MASK_NONE;
 
 /* nmi_active:
  * >0: the lapic NMI watchdog is active, but can be disabled
@@ -108,64 +110,128 @@ static inline unsigned int nmi_evntsel_msr_to_bit(unsigned int msr)
 /* checks for a bit availability (hack for oprofile) */
 int avail_to_resrv_perfctr_nmi_bit(unsigned int counter)
 {
+        int cpu;
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
-
-        return (!test_bit(counter, &__get_cpu_var(perfctr_nmi_owner)));
+        for_each_possible_cpu (cpu) {
+                if (test_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)))
+                        return 0;
+        }
+        return 1;
 }
 
 /* checks the an msr for availability */
 int avail_to_resrv_perfctr_nmi(unsigned int msr)
 {
         unsigned int counter;
+        int cpu;
 
         counter = nmi_perfctr_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        return (!test_bit(counter, &__get_cpu_var(perfctr_nmi_owner)));
+        for_each_possible_cpu (cpu) {
+                if (test_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)))
+                        return 0;
+        }
+        return 1;
 }
 
-int reserve_perfctr_nmi(unsigned int msr)
+static int __reserve_perfctr_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_perfctr_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        if (!test_and_set_bit(counter, &__get_cpu_var(perfctr_nmi_owner)))
+        if (!test_and_set_bit(counter, &per_cpu(perfctr_nmi_owner, cpu)))
                 return 1;
         return 0;
 }
 
-void release_perfctr_nmi(unsigned int msr)
+static void __release_perfctr_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_perfctr_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        clear_bit(counter, &__get_cpu_var(perfctr_nmi_owner));
+        clear_bit(counter, &per_cpu(perfctr_nmi_owner, cpu));
 }
 
-int reserve_evntsel_nmi(unsigned int msr)
+int reserve_perfctr_nmi(unsigned int msr)
+{
+        int cpu, i;
+        for_each_possible_cpu (cpu) {
+                if (!__reserve_perfctr_nmi(cpu, msr)) {
+                        for_each_possible_cpu (i) {
+                                if (i >= cpu)
+                                        break;
+                                __release_perfctr_nmi(i, msr);
+                        }
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+void release_perfctr_nmi(unsigned int msr)
+{
+        int cpu;
+        for_each_possible_cpu (cpu)
+                __release_perfctr_nmi(cpu, msr);
+}
+
+int __reserve_evntsel_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_evntsel_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        if (!test_and_set_bit(counter, &__get_cpu_var(evntsel_nmi_owner)))
+        if (!test_and_set_bit(counter, &per_cpu(evntsel_nmi_owner, cpu)[0]))
                 return 1;
         return 0;
 }
 
-void release_evntsel_nmi(unsigned int msr)
+static void __release_evntsel_nmi(int cpu, unsigned int msr)
 {
         unsigned int counter;
+        if (cpu < 0)
+                cpu = smp_processor_id();
 
         counter = nmi_evntsel_msr_to_bit(msr);
         BUG_ON(counter > NMI_MAX_COUNTER_BITS);
 
-        clear_bit(counter, &__get_cpu_var(evntsel_nmi_owner));
+        clear_bit(counter, &per_cpu(evntsel_nmi_owner, cpu)[0]);
+}
+
+int reserve_evntsel_nmi(unsigned int msr)
+{
+        int cpu, i;
+        for_each_possible_cpu (cpu) {
+                if (!__reserve_evntsel_nmi(cpu, msr)) {
+                        for_each_possible_cpu (i) {
+                                if (i >= cpu)
+                                        break;
+                                __release_evntsel_nmi(i, msr);
+                        }
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+void release_evntsel_nmi(unsigned int msr)
+{
+        int cpu;
+        for_each_possible_cpu (cpu) {
+                __release_evntsel_nmi(cpu, msr);
+        }
 }
 
 static __cpuinit inline int nmi_known_cpu(void)
@@ -253,7 +319,7 @@ int __init check_nmi_watchdog (void)
         for (cpu = 0; cpu < NR_CPUS; cpu++)
                 counts[cpu] = cpu_pda(cpu)->__nmi_count;
         local_irq_enable();
-        mdelay((10*1000)/nmi_hz); // wait 10 ticks
+        mdelay((20*1000)/nmi_hz); // wait 20 ticks
 
         for_each_online_cpu(cpu) {
                 if (!per_cpu(nmi_watchdog_ctlblk, cpu).enabled)
@@ -472,10 +538,10 @@ static int setup_k7_watchdog(void)
 
         perfctr_msr = MSR_K7_PERFCTR0;
         evntsel_msr = MSR_K7_EVNTSEL0;
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         /* Simulator may not support it */
@@ -501,9 +567,9 @@ static int setup_k7_watchdog(void)
         wd->check_bit = 1ULL<<63;
         return 1;
 fail2:
-        release_evntsel_nmi(evntsel_msr);
+        __release_evntsel_nmi(-1, evntsel_msr);
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -514,8 +580,8 @@ static void stop_k7_watchdog(void)
 
         wrmsr(wd->evntsel_msr, 0, 0);
 
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 /* Note that these events don't tick when the CPU idles. This means
@@ -581,10 +647,10 @@ static int setup_p4_watchdog(void)
                 cccr_val = P4_CCCR_OVF_PMI1 | P4_CCCR_ESCR_SELECT(4);
         }
 
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         evntsel = P4_ESCR_EVENT_SELECT(0x3F)
@@ -609,7 +675,7 @@ static int setup_p4_watchdog(void)
         wd->check_bit = 1ULL<<39;
         return 1;
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -621,8 +687,8 @@ static void stop_p4_watchdog(void)
         wrmsr(wd->cccr_msr, 0, 0);
         wrmsr(wd->evntsel_msr, 0, 0);
 
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 #define ARCH_PERFMON_NMI_EVENT_SEL      ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
@@ -650,10 +716,10 @@ static int setup_intel_arch_watchdog(void)
         perfctr_msr = MSR_ARCH_PERFMON_PERFCTR0;
         evntsel_msr = MSR_ARCH_PERFMON_EVENTSEL0;
 
-        if (!reserve_perfctr_nmi(perfctr_msr))
+        if (!__reserve_perfctr_nmi(-1, perfctr_msr))
                 goto fail;
 
-        if (!reserve_evntsel_nmi(evntsel_msr))
+        if (!__reserve_evntsel_nmi(-1, evntsel_msr))
                 goto fail1;
 
         wrmsrl(perfctr_msr, 0UL);
@@ -680,7 +746,7 @@ static int setup_intel_arch_watchdog(void)
         wd->check_bit = 1ULL << (eax.split.bit_width - 1);
         return 1;
 fail1:
-        release_perfctr_nmi(perfctr_msr);
+        __release_perfctr_nmi(-1, perfctr_msr);
 fail:
         return 0;
 }
@@ -704,8 +770,8 @@ static void stop_intel_arch_watchdog(void)
 
         wrmsr(wd->evntsel_msr, 0, 0);
 
-        release_evntsel_nmi(wd->evntsel_msr);
-        release_perfctr_nmi(wd->perfctr_msr);
+        __release_evntsel_nmi(-1, wd->evntsel_msr);
+        __release_perfctr_nmi(-1, wd->perfctr_msr);
 }
 
 void setup_apic_nmi_watchdog(void *unused)
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index 2bac8c60ad61..0bae862e9a55 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -519,7 +519,11 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
         gatt_size = (aper_size >> PAGE_SHIFT) * sizeof(u32); 
         gatt = (void *)__get_free_pages(GFP_KERNEL, get_order(gatt_size)); 
         if (!gatt) 
-                panic("Cannot allocate GATT table"); 
+                panic("Cannot allocate GATT table");
+        if (change_page_attr_addr((unsigned long)gatt, gatt_size >> PAGE_SHIFT, PAGE_KERNEL_NOCACHE))
+                panic("Could not set GART PTEs to uncacheable pages");
+        global_flush_tlb();
+
         memset(gatt, 0, gatt_size); 
         agp_gatt_table = gatt;
 
diff --git a/arch/x86_64/kernel/vmlinux.lds.S b/arch/x86_64/kernel/vmlinux.lds.S
index b73212c0a550..5176ecf006ee 100644
--- a/arch/x86_64/kernel/vmlinux.lds.S
+++ b/arch/x86_64/kernel/vmlinux.lds.S
@@ -13,7 +13,7 @@ OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
 OUTPUT_ARCH(i386:x86-64)
 ENTRY(phys_startup_64)
 jiffies_64 = jiffies;
-_proxy_pda = 0;
+_proxy_pda = 1;
 PHDRS {
         text PT_LOAD FLAGS(5);  /* R_E */
         data PT_LOAD FLAGS(7);  /* RWE */
diff --git a/arch/x86_64/mm/pageattr.c b/arch/x86_64/mm/pageattr.c
index 65c5eaa59905..081409aa3452 100644
--- a/arch/x86_64/mm/pageattr.c
+++ b/arch/x86_64/mm/pageattr.c
@@ -81,8 +81,8 @@ static void flush_kernel_map(void *arg)
                 void *adr = page_address(pg);
                 if (cpu_has_clflush)
                         cache_flush_page(adr);
-                __flush_tlb_one(adr);
         }
+        __flush_tlb_all();
 }
 
 static inline void flush_map(struct list_head *l)
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index b6491c020f26..f92ba2a869b4 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -532,6 +532,12 @@ static void cfq_add_rq_rb(struct request *rq)
 
         if (!cfq_cfqq_on_rr(cfqq))
                 cfq_add_cfqq_rr(cfqd, cfqq);
+
+        /*
+         * check if this request is a better next-serve candidate
+         */
+        cfqq->next_rq = cfq_choose_req(cfqd, cfqq->next_rq, rq);
+        BUG_ON(!cfqq->next_rq);
 }
 
 static inline void
@@ -986,9 +992,9 @@ __cfq_dispatch_requests(struct cfq_data *cfqd, struct cfq_queue *cfqq,
          * expire an async queue immediately if it has used up its slice. idle
          * queue always expire after 1 dispatch round.
          */
-        if ((!cfq_cfqq_sync(cfqq) &&
+        if (cfqd->busy_queues > 1 && ((!cfq_cfqq_sync(cfqq) &&
             cfqd->dispatch_slice >= cfq_prio_to_maxrq(cfqd, cfqq)) ||
-            cfq_class_idle(cfqq)) {
+            cfq_class_idle(cfqq))) {
                 cfqq->slice_end = jiffies + 1;
                 cfq_slice_expired(cfqd, 0, 0);
         }
@@ -1051,19 +1057,21 @@ cfq_dispatch_requests(request_queue_t *q, int force)
         while ((cfqq = cfq_select_queue(cfqd)) != NULL) {
                 int max_dispatch;
 
-                /*
-                 * Don't repeat dispatch from the previous queue.
-                 */
-                if (prev_cfqq == cfqq)
-                        break;
+                if (cfqd->busy_queues > 1) {
+                        /*
+                         * Don't repeat dispatch from the previous queue.
+                         */
+                        if (prev_cfqq == cfqq)
+                                break;
 
-                /*
-                 * So we have dispatched before in this round, if the
-                 * next queue has idling enabled (must be sync), don't
-                 * allow it service until the previous have continued.
-                 */
-                if (cfqd->rq_in_driver && cfq_cfqq_idle_window(cfqq))
-                        break;
+                        /*
+                         * So we have dispatched before in this round, if the
+                         * next queue has idling enabled (must be sync), don't
+                         * allow it service until the previous have continued.
+                         */
+                        if (cfqd->rq_in_driver && cfq_cfqq_idle_window(cfqq))
+                                break;
+                }
 
                 cfq_clear_cfqq_must_dispatch(cfqq);
                 cfq_clear_cfqq_wait_request(cfqq);
@@ -1370,7 +1378,9 @@ retry:
                 atomic_set(&cfqq->ref, 0);
                 cfqq->cfqd = cfqd;
 
-                cfq_mark_cfqq_idle_window(cfqq);
+                if (key != CFQ_KEY_ASYNC)
+                        cfq_mark_cfqq_idle_window(cfqq);
+
                 cfq_mark_cfqq_prio_changed(cfqq);
                 cfq_mark_cfqq_queue_new(cfqq);
                 cfq_init_prio_data(cfqq);
@@ -1635,12 +1645,6 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                 cfqq->meta_pending++;
 
         /*
-         * check if this request is a better next-serve candidate)) {
-         */
-        cfqq->next_rq = cfq_choose_req(cfqd, cfqq->next_rq, rq);
-        BUG_ON(!cfqq->next_rq);
-
-        /*
          * we never wait for an async request and we don't allow preemption
          * of an async request. so just return early
          */
diff --git a/block/elevator.c b/block/elevator.c
index 25f6ef28e3bb..96a00c822748 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -964,17 +964,18 @@ void elv_unregister_queue(struct request_queue *q)
 
 int elv_register(struct elevator_type *e)
 {
+        char *def = "";
         spin_lock_irq(&elv_list_lock);
         BUG_ON(elevator_find(e->elevator_name));
         list_add_tail(&e->list, &elv_list);
         spin_unlock_irq(&elv_list_lock);
 
-        printk(KERN_INFO "io scheduler %s registered", e->elevator_name);
         if (!strcmp(e->elevator_name, chosen_elevator) ||
                         (!*chosen_elevator &&
                          !strcmp(e->elevator_name, CONFIG_DEFAULT_IOSCHED)))
-                                printk(" (default)");
-        printk("\n");
+                                def = " (default)";
+
+        printk(KERN_INFO "io scheduler %s registered%s\n", e->elevator_name, def);
         return 0;
 }
 EXPORT_SYMBOL_GPL(elv_register);
diff --git a/block/genhd.c b/block/genhd.c
index 050a1f0f3a86..441432a142f2 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -62,8 +62,6 @@ int register_blkdev(unsigned int major, const char *name)
         /* temporary */
         if (major == 0) {
                 for (index = ARRAY_SIZE(major_names)-1; index > 0; index--) {
-                        if (is_lanana_major(index))
-                                continue;
                         if (major_names[index] == NULL)
                                 break;
                 }
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 38c293b987b7..3de06953ac33 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -1221,7 +1221,7 @@ void blk_recount_segments(request_queue_t *q, struct bio *bio)
                  * considered part of another segment, since that might
                  * change with the bounce page.
                  */
-                high = page_to_pfn(bv->bv_page) >= q->bounce_pfn;
+                high = page_to_pfn(bv->bv_page) > q->bounce_pfn;
                 if (high || highprv)
                         goto new_hw_segment;
                 if (cluster) {
@@ -3658,8 +3658,8 @@ int __init blk_dev_init(void)
         open_softirq(BLOCK_SOFTIRQ, blk_done_softirq, NULL);
         register_hotcpu_notifier(&blk_cpu_notifier);
 
-        blk_max_low_pfn = max_low_pfn;
-        blk_max_pfn = max_pfn;
+        blk_max_low_pfn = max_low_pfn - 1;
+        blk_max_pfn = max_pfn - 1;
 
         return 0;
 }
diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
index a66423121773..81afd1790a1d 100644
--- a/crypto/scatterwalk.c
+++ b/crypto/scatterwalk.c
@@ -59,8 +59,12 @@ EXPORT_SYMBOL_GPL(scatterwalk_map);
 static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
                                  unsigned int more)
 {
-        if (out)
-                flush_dcache_page(scatterwalk_page(walk));
+        if (out) {
+                struct page *page;
+
+                page = walk->sg->page + ((walk->offset - 1) >> PAGE_SHIFT);
+                flush_dcache_page(page);
+        }
 
         if (more) {
                 walk->offset += PAGE_SIZE - 1;
@@ -91,7 +95,7 @@ void scatterwalk_copychunks(void *buf, struct scatter_walk *walk,
                 memcpy_dir(buf, vaddr, len_this_page, out);
                 scatterwalk_unmap(vaddr, out);
 
-                scatterwalk_advance(walk, nbytes);
+                scatterwalk_advance(walk, len_this_page);
 
                 if (nbytes == len_this_page)
                         break;
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index 96792a6cc164..c3419182c9a7 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -42,7 +42,7 @@ static char *mps_inti_flags_trigger[] = { "dfl", "edge", "res", "level" };
 
 static struct acpi_table_desc initial_tables[ACPI_MAX_TABLES] __initdata;
 
-static int acpi_apic_instance __initdata = 2;
+static int acpi_apic_instance __initdata;
 
 void acpi_table_print_madt_entry(struct acpi_subtable_header *header)
 {
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 0ae8b9310cbf..589b98b7b216 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -758,7 +758,8 @@ static void acpi_thermal_check(void *data)
                         del_timer(&(tz->timer));
         } else {
                 if (timer_pending(&(tz->timer)))
-                        mod_timer(&(tz->timer), (HZ * sleep_time) / 1000);
+                        mod_timer(&(tz->timer),
+                                        jiffies + (HZ * sleep_time) / 1000);
                 else {
                         tz->timer.data = (unsigned long)tz;
                         tz->timer.function = acpi_thermal_run;
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index dc7b56225923..fd27227771b4 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -80,6 +80,7 @@ enum {
         board_ahci_pi           = 1,
         board_ahci_vt8251       = 2,
         board_ahci_ign_iferr    = 3,
+        board_ahci_sb600        = 4,
 
         /* global controller registers */
         HOST_CAP                = 0x00, /* host capabilities */
@@ -168,6 +169,7 @@ enum {
         AHCI_FLAG_NO_NCQ                = (1 << 24),
         AHCI_FLAG_IGN_IRQ_IF_ERR        = (1 << 25), /* ignore IRQ_IF_ERR */
         AHCI_FLAG_HONOR_PI              = (1 << 26), /* honor PORTS_IMPL */
+        AHCI_FLAG_IGN_SERR_INTERNAL     = (1 << 27), /* ignore SERR_INTERNAL */
 };
 
 struct ahci_cmd_hdr {
@@ -362,6 +364,18 @@ static const struct ata_port_info ahci_port_info[] = {
                 .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
                 .port_ops       = &ahci_ops,
         },
+        /* board_ahci_sb600 */
+        {
+                .sht            = &ahci_sht,
+                .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_MMIO | ATA_FLAG_PIO_DMA |
+                                  ATA_FLAG_SKIP_D2H_BSY |
+                                  AHCI_FLAG_IGN_SERR_INTERNAL,
+                .pio_mask       = 0x1f, /* pio0-4 */
+                .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
+                .port_ops       = &ahci_ops,
+        },
+
 };
 
 static const struct pci_device_id ahci_pci_tbl[] = {
@@ -399,7 +413,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci_ign_iferr },
 
         /* ATI */
-        { PCI_VDEVICE(ATI, 0x4380), board_ahci }, /* ATI SB600 non-raid */
+        { PCI_VDEVICE(ATI, 0x4380), board_ahci_sb600 }, /* ATI SB600 non-raid */
         { PCI_VDEVICE(ATI, 0x4381), board_ahci }, /* ATI SB600 raid */
 
         /* VIA */
@@ -1067,8 +1081,11 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat)
         if (ap->flags & AHCI_FLAG_IGN_IRQ_IF_ERR)
                 irq_stat &= ~PORT_IRQ_IF_ERR;
 
-        if (irq_stat & PORT_IRQ_TF_ERR)
+        if (irq_stat & PORT_IRQ_TF_ERR) {
                 err_mask |= AC_ERR_DEV;
+                if (ap->flags & AHCI_FLAG_IGN_SERR_INTERNAL)
+                        serror &= ~SERR_INTERNAL;
+        }
 
         if (irq_stat & (PORT_IRQ_HBUS_ERR | PORT_IRQ_HBUS_DATA_ERR)) {
                 err_mask |= AC_ERR_HOST_BUS;
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index c428a56e6f31..03a0acff6cfa 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -305,7 +305,7 @@ static int do_drive_get_GTF(struct ata_port *ap, int ix,
         *gtf_address = 0UL;
         *obj_loc = 0UL;
 
-        if (noacpi)
+        if (libata_noacpi)
                 return 0;
 
         if (ata_msg_probe(ap))
@@ -531,7 +531,7 @@ static int do_drive_set_taskfiles(struct ata_port *ap,
                 ata_dev_printk(atadev, KERN_DEBUG, "%s: ENTER: port#: %d\n",
                                __FUNCTION__, ap->port_no);
 
-        if (noacpi || !(ap->cbl == ATA_CBL_SATA))
+        if (libata_noacpi || !(ap->cbl == ATA_CBL_SATA))
                 return 0;
 
         if (!ata_dev_enabled(atadev) || (ap->flags & ATA_FLAG_DISABLED))
@@ -574,7 +574,7 @@ int ata_acpi_exec_tfs(struct ata_port *ap)
         unsigned long   gtf_address;
         unsigned long   obj_loc;
 
-        if (noacpi)
+        if (libata_noacpi)
                 return 0;
         /*
          * TBD - implement PATA support.  For now,
@@ -636,7 +636,7 @@ int ata_acpi_push_id(struct ata_port *ap, unsigned int ix)
         struct acpi_object_list         input;
         union acpi_object               in_params[1];
 
-        if (noacpi)
+        if (libata_noacpi)
                 return 0;
 
         if (ata_msg_probe(ap))
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index bf327d473ce9..0abd72d0dec2 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -93,8 +93,8 @@ static int ata_probe_timeout = ATA_TMOUT_INTERNAL / HZ;
 module_param(ata_probe_timeout, int, 0444);
 MODULE_PARM_DESC(ata_probe_timeout, "Set ATA probing timeout (seconds)");
 
-int noacpi;
-module_param(noacpi, int, 0444);
+int libata_noacpi = 1;
+module_param_named(noacpi, libata_noacpi, int, 0444);
 MODULE_PARM_DESC(noacpi, "Disables the use of ACPI in suspend/resume when set");
 
 MODULE_AUTHOR("Jeff Garzik");
@@ -1784,6 +1784,13 @@ int ata_dev_configure(struct ata_device *dev)
                 dev->max_sectors = ATA_MAX_SECTORS;
         }
 
+        if (ata_device_blacklisted(dev) & ATA_HORKAGE_MAX_SEC_128)
+                dev->max_sectors = min(ATA_MAX_SECTORS_128, dev->max_sectors);
+
+        /* limit ATAPI DMA to R/W commands only */
+        if (ata_device_blacklisted(dev) & ATA_HORKAGE_DMA_RW_ONLY)
+                dev->horkage |= ATA_HORKAGE_DMA_RW_ONLY;
+
         if (ap->ops->dev_config)
                 ap->ops->dev_config(ap, dev);
 
@@ -3352,6 +3359,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "_NEC DV5800A",       NULL,           ATA_HORKAGE_NODMA },
         { "SAMSUNG CD-ROM SN-124","N001",       ATA_HORKAGE_NODMA },
 
+        /* Weird ATAPI devices */
+        { "TORiSAN DVD-ROM DRD-N216", NULL,     ATA_HORKAGE_MAX_SEC_128 |
+                                                ATA_HORKAGE_DMA_RW_ONLY },
+
         /* Devices we expect to fail diagnostics */
 
         /* Devices where NCQ should be avoided */
@@ -3359,6 +3370,15 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "WDC WD740ADFD-00",   NULL,           ATA_HORKAGE_NONCQ },
         /* http://thread.gmane.org/gmane.linux.ide/14907 */
         { "FUJITSU MHT2060BH",  NULL,           ATA_HORKAGE_NONCQ },
+        /* NCQ is broken */
+        { "Maxtor 6L250S0",     "BANC1G10",     ATA_HORKAGE_NONCQ },
+        /* NCQ hard hangs device under heavier load, needs hard power cycle */
+        { "Maxtor 6B250S0",     "BANC1B70",     ATA_HORKAGE_NONCQ },
+        /* Blacklist entries taken from Silicon Image 3124/3132
+           Windows driver .inf file - also several Linux problem reports */
+        { "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
+        { "HTS541080G9SA00",    "MB4OC60D",     ATA_HORKAGE_NONCQ, },
+        { "HTS541010G9SA00",    "MBZOC60D",     ATA_HORKAGE_NONCQ, },
 
         /* Devices with NCQ limits */
 
@@ -3670,6 +3690,26 @@ int ata_check_atapi_dma(struct ata_queued_cmd *qc)
         struct ata_port *ap = qc->ap;
         int rc = 0; /* Assume ATAPI DMA is OK by default */
 
+        /* some drives can only do ATAPI DMA on read/write */
+        if (unlikely(qc->dev->horkage & ATA_HORKAGE_DMA_RW_ONLY)) {
+                struct scsi_cmnd *cmd = qc->scsicmd;
+                u8 *scsicmd = cmd->cmnd;
+
+                switch (scsicmd[0]) {
+                case READ_10:
+                case WRITE_10:
+                case READ_12:
+                case WRITE_12:
+                case READ_6:
+                case WRITE_6:
+                        /* atapi dma maybe ok */
+                        break;
+                default:
+                        /* turn off atapi dma */
+                        return 1;
+                }
+        }
+
         if (ap->ops->check_atapi_dma)
                 rc = ap->ops->check_atapi_dma(qc);
 
@@ -4713,8 +4753,8 @@ static void fill_result_tf(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
 
-        ap->ops->tf_read(ap, &qc->result_tf);
         qc->result_tf.flags = qc->tf.flags;
+        ap->ops->tf_read(ap, &qc->result_tf);
 }
 
 /**
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 361953a50203..39f556c02992 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -982,26 +982,27 @@ static int ata_eh_read_log_10h(struct ata_device *dev,
  *      RETURNS:
  *      0 on success, AC_ERR_* mask on failure
  */
-static unsigned int atapi_eh_request_sense(struct ata_device *dev,
-                                           unsigned char *sense_buf)
+static unsigned int atapi_eh_request_sense(struct ata_queued_cmd *qc)
 {
+        struct ata_device *dev = qc->dev;
+        unsigned char *sense_buf = qc->scsicmd->sense_buffer;
         struct ata_port *ap = dev->ap;
         struct ata_taskfile tf;
         u8 cdb[ATAPI_CDB_LEN];
 
         DPRINTK("ATAPI request sense\n");
 
-        ata_tf_init(dev, &tf);
-
         /* FIXME: is this needed? */
         memset(sense_buf, 0, SCSI_SENSE_BUFFERSIZE);
 
-        /* XXX: why tf_read here? */
-        ap->ops->tf_read(ap, &tf);
-
-        /* fill these in, for the case where they are -not- overwritten */
+        /* initialize sense_buf with the error register,
+         * for the case where they are -not- overwritten
+         */
         sense_buf[0] = 0x70;
-        sense_buf[2] = tf.feature >> 4;
+        sense_buf[2] = qc->result_tf.feature >> 4;
+
+        /* some devices time out if garbage left in tf */ 
+        ata_tf_init(dev, &tf);
 
         memset(cdb, 0, ATAPI_CDB_LEN);
         cdb[0] = REQUEST_SENSE;
@@ -1165,8 +1166,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc,
 
         case ATA_DEV_ATAPI:
                 if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) {
-                        tmp = atapi_eh_request_sense(qc->dev,
-                                                     qc->scsicmd->sense_buffer);
+                        tmp = atapi_eh_request_sense(qc);
                         if (!tmp) {
                                 /* ATA_QCFLAG_SENSE_VALID is used to
                                  * tell atapi_qc_complete() that sense
@@ -1743,12 +1743,17 @@ static int ata_eh_revalidate_and_attach(struct ata_port *ap,
 {
         struct ata_eh_context *ehc = &ap->eh_context;
         struct ata_device *dev;
+        unsigned int new_mask = 0;
         unsigned long flags;
         int i, rc = 0;
 
         DPRINTK("ENTER\n");
 
-        for (i = 0; i < ATA_MAX_DEVICES; i++) {
+        /* For PATA drive side cable detection to work, IDENTIFY must
+         * be done backwards such that PDIAG- is released by the slave
+         * device before the master device is identified.
+         */
+        for (i = ATA_MAX_DEVICES - 1; i >= 0; i--) {
                 unsigned int action, readid_flags = 0;
 
                 dev = &ap->device[i];
@@ -1760,13 +1765,13 @@ static int ata_eh_revalidate_and_attach(struct ata_port *ap,
                 if (action & ATA_EH_REVALIDATE && ata_dev_ready(dev)) {
                         if (ata_port_offline(ap)) {
                                 rc = -EIO;
-                                break;
+                                goto err;
                         }
 
                         ata_eh_about_to_do(ap, dev, ATA_EH_REVALIDATE);
                         rc = ata_dev_revalidate(dev, readid_flags);
                         if (rc)
-                                break;
+                                goto err;
 
                         ata_eh_done(ap, dev, ATA_EH_REVALIDATE);
 
@@ -1784,40 +1789,53 @@ static int ata_eh_revalidate_and_attach(struct ata_port *ap,
 
                         rc = ata_dev_read_id(dev, &dev->class, readid_flags,
                                              dev->id);
-                        if (rc == 0) {
-                                ehc->i.flags |= ATA_EHI_PRINTINFO;
-                                rc = ata_dev_configure(dev);
-                                ehc->i.flags &= ~ATA_EHI_PRINTINFO;
-                        } else if (rc == -ENOENT) {
+                        switch (rc) {
+                        case 0:
+                                new_mask |= 1 << i;
+                                break;
+                        case -ENOENT:
                                 /* IDENTIFY was issued to non-existent
                                  * device.  No need to reset.  Just
                                  * thaw and kill the device.
                                  */
                                 ata_eh_thaw_port(ap);
                                 dev->class = ATA_DEV_UNKNOWN;
-                                rc = 0;
-                        }
-
-                        if (rc) {
-                                dev->class = ATA_DEV_UNKNOWN;
                                 break;
+                        default:
+                                dev->class = ATA_DEV_UNKNOWN;
+                                goto err;
                         }
+                }
+        }
 
-                        if (ata_dev_enabled(dev)) {
-                                spin_lock_irqsave(ap->lock, flags);
-                                ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
-                                spin_unlock_irqrestore(ap->lock, flags);
+        /* Configure new devices forward such that user doesn't see
+         * device detection messages backwards.
+         */
+        for (i = 0; i < ATA_MAX_DEVICES; i++) {
+                dev = &ap->device[i];
 
-                                /* new device discovered, configure xfermode */
-                                ehc->i.flags |= ATA_EHI_SETMODE;
-                        }
-                }
+                if (!(new_mask & (1 << i)))
+                        continue;
+
+                ehc->i.flags |= ATA_EHI_PRINTINFO;
+                rc = ata_dev_configure(dev);
+                ehc->i.flags &= ~ATA_EHI_PRINTINFO;
+                if (rc)
+                        goto err;
+
+                spin_lock_irqsave(ap->lock, flags);
+                ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
+                spin_unlock_irqrestore(ap->lock, flags);
+
+                /* new device discovered, configure xfermode */
+                ehc->i.flags |= ATA_EHI_SETMODE;
         }
 
-        if (rc)
-                *r_failed_dev = dev;
+        return 0;
 
-        DPRINTK("EXIT\n");
+ err:
+        *r_failed_dev = dev;
+        DPRINTK("EXIT rc=%d\n", rc);
         return rc;
 }
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 6cc817a10204..e9364434182c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -333,7 +333,7 @@ int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
         scsi_cmd[8]  = args[3];
         scsi_cmd[10] = args[4];
         scsi_cmd[12] = args[5];
-        scsi_cmd[13] = args[6] & 0x0f;
+        scsi_cmd[13] = args[6] & 0x4f;
         scsi_cmd[14] = args[0];
 
         /* Good values for timeout and retries?  Values below
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index c42671493e8c..1f1e3a51f859 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -56,7 +56,7 @@ extern struct workqueue_struct *ata_aux_wq;
 extern int atapi_enabled;
 extern int atapi_dmadir;
 extern int libata_fua;
-extern int noacpi;
+extern int libata_noacpi;
 extern struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev);
 extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev,
                            u64 block, u32 n_block, unsigned int tf_flags,
diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
index acdc52cbe38a..0a1493398913 100644
--- a/drivers/ata/pata_pdc202xx_old.c
+++ b/drivers/ata/pata_pdc202xx_old.c
@@ -195,7 +195,7 @@ static void pdc2026x_bmdma_start(struct ata_queued_cmd *qc)
         /* Cases the state machine will not complete correctly without help */
         if ((tf->flags & ATA_TFLAG_LBA48) ||  tf->protocol == ATA_PROT_ATAPI_DMA)
         {
-                len = qc->nbytes;
+                len = qc->nbytes / 2;
 
                 if (tf->flags & ATA_TFLAG_WRITE)
                         len |= 0x06000000;
diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
index f48207865930..8dc3bc4f5863 100644
--- a/drivers/ata/pata_sis.c
+++ b/drivers/ata/pata_sis.c
@@ -878,6 +878,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         struct ata_port_info *port;
         struct pci_dev *host = NULL;
         struct sis_chipset *chipset = NULL;
+        struct sis_chipset *sets;
 
         static struct sis_chipset sis_chipsets[] = {
 
@@ -932,10 +933,11 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 
         /* We have to find the bridge first */
 
-        for (chipset = &sis_chipsets[0]; chipset->device; chipset++) {
-                host = pci_get_device(PCI_VENDOR_ID_SI, chipset->device, NULL);
+        for (sets = &sis_chipsets[0]; sets->device; sets++) {
+                host = pci_get_device(PCI_VENDOR_ID_SI, sets->device, NULL);
                 if (host != NULL) {
-                        if (chipset->device == 0x630) { /* SIS630 */
+                        chipset = sets;                 /* Match found */
+                        if (sets->device == 0x630) {    /* SIS630 */
                                 u8 host_rev;
                                 pci_read_config_byte(host, PCI_REVISION_ID, &host_rev);
                                 if (host_rev >= 0x30)   /* 630 ET */
@@ -946,7 +948,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         /* Look for concealed bridges */
-        if (host == NULL) {
+        if (chipset == NULL) {
                 /* Second check */
                 u32 idemisc;
                 u16 trueid;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index ad0f4a2f25c4..d7fcf823a42a 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -28,20 +28,6 @@ int (*platform_notify)(struct device * dev) = NULL;
 int (*platform_notify_remove)(struct device * dev) = NULL;
 
 /*
- * Detect the LANANA-assigned LOCAL/EXPERIMENTAL majors
- */
-bool is_lanana_major(unsigned int major)
-{
-        if (major >= 60 && major <= 63)
-                return 1;
-        if (major >= 120 && major <= 127)
-                return 1;
-        if (major >= 240 && major <= 254)
-                return 1;
-        return 0;
-}
-
-/*
  * sysfs bindings for devices.
  */
 
diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index 1214cbd17d86..082bfded3854 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -183,7 +183,14 @@ int driver_register(struct device_driver * drv)
 void driver_unregister(struct device_driver * drv)
 {
         bus_remove_driver(drv);
-        wait_for_completion(&drv->unloaded);
+        /*
+         * If the driver is a module, we are probably in
+         * the module unload path, and we want to wait
+         * for everything to unload before we can actually
+         * finish the unload.
+         */
+        if (drv->owner)
+                wait_for_completion(&drv->unloaded);
 }
 
 /**
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index fdfa3d0cf6af..bbbb973a9d3c 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -54,7 +54,8 @@ int device_pm_add(struct device * dev)
         int error;
 
         pr_debug("PM: Adding info for %s:%s\n",
-                 dev->bus ? dev->bus->name : "No Bus", dev->kobj.name);
+                 dev->bus ? dev->bus->name : "No Bus",
+                 kobject_name(&dev->kobj));
         down(&dpm_list_sem);
         list_add_tail(&dev->power.entry, &dpm_active);
         device_pm_set_parent(dev, dev->parent);
@@ -67,7 +68,8 @@ int device_pm_add(struct device * dev)
 void device_pm_remove(struct device * dev)
 {
         pr_debug("PM: Removing info for %s:%s\n",
-                 dev->bus ? dev->bus->name : "No Bus", dev->kobj.name);
+                 dev->bus ? dev->bus->name : "No Bus",
+                 kobject_name(&dev->kobj));
         down(&dpm_list_sem);
         dpm_sysfs_remove(dev);
         put_device(dev->power.pm_parent);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 072e18e6d76d..65a725cd3422 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1915,6 +1915,7 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
                                "does not support reading geometry\n");
                         drv->heads = 255;
                         drv->sectors = 32;      // Sectors per track
+                        drv->cylinders = total_size + 1;
                         drv->raid_level = RAID_UNKNOWN;
                 } else {
                         drv->heads = inq_buff->data_byte[6];
@@ -3422,6 +3423,25 @@ static void cciss_remove_one(struct pci_dev *pdev)
                        "already be removed \n");
                 return;
         }
+
+        remove_proc_entry(hba[i]->devname, proc_cciss);
+        unregister_blkdev(hba[i]->major, hba[i]->devname);
+
+        /* remove it from the disk list */
+        for (j = 0; j < CISS_MAX_LUN; j++) {
+                struct gendisk *disk = hba[i]->gendisk[j];
+                if (disk) {
+                        request_queue_t *q = disk->queue;
+
+                        if (disk->flags & GENHD_FL_UP)
+                                del_gendisk(disk);
+                        if (q)
+                                blk_cleanup_queue(q);
+                }
+        }
+
+        cciss_unregister_scsi(i);       /* unhook from SCSI subsystem */
+
         /* Turn board interrupts off  and send the flush cache command */
         /* sendcmd will turn off interrupt, and send the flush...
          * To write all data in the battery backed cache to disks */
@@ -3443,22 +3463,6 @@ static void cciss_remove_one(struct pci_dev *pdev)
 #endif                          /* CONFIG_PCI_MSI */
 
         iounmap(hba[i]->vaddr);
-        cciss_unregister_scsi(i);       /* unhook from SCSI subsystem */
-        unregister_blkdev(hba[i]->major, hba[i]->devname);
-        remove_proc_entry(hba[i]->devname, proc_cciss);
-
-        /* remove it from the disk list */
-        for (j = 0; j < CISS_MAX_LUN; j++) {
-                struct gendisk *disk = hba[i]->gendisk[j];
-                if (disk) {
-                        request_queue_t *q = disk->queue;
-
-                        if (disk->flags & GENHD_FL_UP)
-                                del_gendisk(disk);
-                        if (q)
-                                blk_cleanup_queue(q);
-                }
-        }
 
         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
                             hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index c852eed91e4b..1eeb8f2cde71 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -140,7 +140,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_SLV, D_DLY};
 #include <linux/blkdev.h>
 #include <asm/uaccess.h>
 
-static spinlock_t pcd_lock;
+static DEFINE_SPINLOCK(pcd_lock);
 
 module_param(verbose, bool, 0644);
 module_param(major, int, 0);
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index 7cdaa1951260..5826508f6731 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -154,7 +154,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_SLV, D_LUN, D_DLY};
 #include <linux/blkpg.h>
 #include <asm/uaccess.h>
 
-static spinlock_t pf_spin_lock;
+static DEFINE_SPINLOCK(pf_spin_lock);
 
 module_param(verbose, bool, 0644);
 module_param(major, int, 0);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index a4fb70383188..f1b9dd7d47d6 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -777,7 +777,8 @@ static int pkt_generic_packet(struct pktcdvd_device *pd, struct packet_command *
                 rq->cmd_flags |= REQ_QUIET;
 
         blk_execute_rq(rq->q, pd->bdev->bd_disk, rq, 0);
-        ret = rq->errors;
+        if (rq->errors)
+                ret = -EIO;
 out:
         blk_put_request(rq);
         return ret;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 3429ece4ef92..d0c978fbc204 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -386,6 +386,39 @@ config AU1000_SERIAL_CONSOLE
           If you have an Alchemy AU1000 processor (MIPS based) and you want
           to use a console on a serial port, say Y.  Otherwise, say N.
 
+config SERIAL_DEC
+        bool "DECstation serial support"
+        depends on MACH_DECSTATION
+        default y
+        help
+          This selects whether you want to be asked about drivers for
+          DECstation serial ports.
+
+          Note that the answer to this question won't directly affect the
+          kernel: saying N will just cause the configurator to skip all
+          the questions about DECstation serial ports.
+
+config SERIAL_DEC_CONSOLE
+        bool "Support for console on a DECstation serial port"
+        depends on SERIAL_DEC
+        default y
+        help
+          If you say Y here, it will be possible to use a serial port as the
+          system console (the system console is the device which receives all
+          kernel messages and warnings and which allows logins in single user
+          mode).  Note that the firmware uses ttyS0 as the serial console on
+          the Maxine and ttyS2 on the others.
+
+          If unsure, say Y.
+
+config ZS
+        bool "Z85C30 Serial Support"
+        depends on SERIAL_DEC
+        default y
+        help
+          Documentation on the Zilog 85C350 serial communications controller
+          is downloadable at <http://www.zilog.com/pdfs/serial/z85c30.pdf>
+
 config A2232
         tristate "Commodore A2232 serial support (EXPERIMENTAL)"
         depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index e542a628f1c7..55392a45a14b 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -18,11 +18,14 @@
 #define PCI_DEVICE_ID_INTEL_82965Q_IG       0x2992
 #define PCI_DEVICE_ID_INTEL_82965G_HB       0x29A0
 #define PCI_DEVICE_ID_INTEL_82965G_IG       0x29A2
+#define PCI_DEVICE_ID_INTEL_82965GM_HB      0x2A00
+#define PCI_DEVICE_ID_INTEL_82965GM_IG      0x2A02
 
 #define IS_I965 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82946GZ_HB || \
                  agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_1_HB || \
                  agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB)
+                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
+                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB)
 
 
 extern int agp_memory_reserved;
@@ -428,9 +431,8 @@ static void intel_i830_init_gtt_entries(void)
 
         if (IS_I965) {
                 u32 pgetbl_ctl;
+                pgetbl_ctl = readl(intel_i830_private.registers+I810_PGETBL_CTL);
 
-                pci_read_config_dword(agp_bridge->dev, I810_PGETBL_CTL,
-                                      &pgetbl_ctl);
                 /* The 965 has a field telling us the size of the GTT,
                  * which may be larger than what is necessary to map the
                  * aperture.
@@ -1921,7 +1923,13 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                         bridge->driver = &intel_845_driver;
                 name = "965G";
                 break;
-
+        case PCI_DEVICE_ID_INTEL_82965GM_HB:
+                if (find_i830(PCI_DEVICE_ID_INTEL_82965GM_IG))
+                        bridge->driver = &intel_i965_driver;
+                else
+                        bridge->driver = &intel_845_driver;
+                name = "965GM";
+                break;
         case PCI_DEVICE_ID_INTEL_7505_0:
                 bridge->driver = &intel_7505_driver;
                 name = "E7505";
@@ -2080,6 +2088,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_82965G_1_HB),
         ID(PCI_DEVICE_ID_INTEL_82965Q_HB),
         ID(PCI_DEVICE_ID_INTEL_82965G_HB),
+        ID(PCI_DEVICE_ID_INTEL_82965GM_HB),
         { }
 };
 
diff --git a/drivers/char/drm/Makefile b/drivers/char/drm/Makefile
index 3ad0f648c6b2..6915a0599dfb 100644
--- a/drivers/char/drm/Makefile
+++ b/drivers/char/drm/Makefile
@@ -15,7 +15,6 @@ i810-objs   := i810_drv.o i810_dma.o
 i830-objs   := i830_drv.o i830_dma.o i830_irq.o
 i915-objs   := i915_drv.o i915_dma.o i915_irq.o i915_mem.o
 radeon-objs := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o radeon_irq.o r300_cmdbuf.o
-ffb-objs    := ffb_drv.o ffb_context.o
 sis-objs    := sis_drv.o sis_mm.o
 savage-objs := savage_drv.o savage_bci.o savage_state.o
 via-objs    := via_irq.o via_drv.o via_map.o via_mm.o via_dma.o via_verifier.o via_video.o via_dmablit.o
@@ -36,7 +35,6 @@ obj-$(CONFIG_DRM_MGA)	+= mga.o
 obj-$(CONFIG_DRM_I810)  += i810.o
 obj-$(CONFIG_DRM_I830)  += i830.o
 obj-$(CONFIG_DRM_I915)  += i915.o
-obj-$(CONFIG_DRM_FFB)   += ffb.o
 obj-$(CONFIG_DRM_SIS)   += sis.o
 obj-$(CONFIG_DRM_SAVAGE)+= savage.o
 obj-$(CONFIG_DRM_VIA)   +=via.o
diff --git a/drivers/char/drm/ffb_context.c b/drivers/char/drm/ffb_context.c
deleted file mode 100644
index ac9ab40d57aa..000000000000
--- a/drivers/char/drm/ffb_context.c
+++ /dev/null
@@ -1,544 +0,0 @@
-/* $Id: ffb_context.c,v 1.5 2001/08/09 17:47:51 davem Exp $
- * ffb_context.c: Creator/Creator3D DRI/DRM context switching.
- *
- * Copyright (C) 2000 David S. Miller (davem@redhat.com)
- *
- * Almost entirely stolen from tdfx_context.c, see there
- * for authors.
- */
-
-#include <asm/upa.h>
-
-#include "ffb.h"
-#include "drmP.h"
-
-#include "ffb_drv.h"
-
-static int DRM(alloc_queue) (drm_device_t * dev, int is_2d_only) {
-        ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
-        int i;
-
-        for (i = 0; i < FFB_MAX_CTXS; i++) {
-                if (fpriv->hw_state[i] == NULL)
-                        break;
-        }
-        if (i == FFB_MAX_CTXS)
-                return -1;
-
-        fpriv->hw_state[i] = kmalloc(sizeof(struct ffb_hw_context), GFP_KERNEL);
-        if (fpriv->hw_state[i] == NULL)
-                return -1;
-
-        fpriv->hw_state[i]->is_2d_only = is_2d_only;
-
-        /* Plus one because 0 is the special DRM_KERNEL_CONTEXT. */
-        return i + 1;
-}
-
-static void ffb_save_context(ffb_dev_priv_t * fpriv, int idx)
-{
-        ffb_fbcPtr ffb = fpriv->regs;
-        struct ffb_hw_context *ctx;
-        int i;
-
-        ctx = fpriv->hw_state[idx - 1];
-        if (idx == 0 || ctx == NULL)
-                return;
-
-        if (ctx->is_2d_only) {
-                /* 2D applications only care about certain pieces
-                 * of state.
-                 */
-                ctx->drawop = upa_readl(&ffb->drawop);
-                ctx->ppc = upa_readl(&ffb->ppc);
-                ctx->wid = upa_readl(&ffb->wid);
-                ctx->fg = upa_readl(&ffb->fg);
-                ctx->bg = upa_readl(&ffb->bg);
-                ctx->xclip = upa_readl(&ffb->xclip);
-                ctx->fbc = upa_readl(&ffb->fbc);
-                ctx->rop = upa_readl(&ffb->rop);
-                ctx->cmp = upa_readl(&ffb->cmp);
-                ctx->matchab = upa_readl(&ffb->matchab);
-                ctx->magnab = upa_readl(&ffb->magnab);
-                ctx->pmask = upa_readl(&ffb->pmask);
-                ctx->xpmask = upa_readl(&ffb->xpmask);
-                ctx->lpat = upa_readl(&ffb->lpat);
-                ctx->fontxy = upa_readl(&ffb->fontxy);
-                ctx->fontw = upa_readl(&ffb->fontw);
-                ctx->fontinc = upa_readl(&ffb->fontinc);
-
-                /* stencil/stencilctl only exists on FFB2+ and later
-                 * due to the introduction of 3DRAM-III.
-                 */
-                if (fpriv->ffb_type == ffb2_vertical_plus ||
-                    fpriv->ffb_type == ffb2_horizontal_plus) {
-                        ctx->stencil = upa_readl(&ffb->stencil);
-                        ctx->stencilctl = upa_readl(&ffb->stencilctl);
-                }
-
-                for (i = 0; i < 32; i++)
-                        ctx->area_pattern[i] = upa_readl(&ffb->pattern[i]);
-                ctx->ucsr = upa_readl(&ffb->ucsr);
-                return;
-        }
-
-        /* Fetch drawop. */
-        ctx->drawop = upa_readl(&ffb->drawop);
-
-        /* If we were saving the vertex registers, this is where
-         * we would do it.  We would save 32 32-bit words starting
-         * at ffb->suvtx.
-         */
-
-        /* Capture rendering attributes. */
-
-        ctx->ppc = upa_readl(&ffb->ppc);        /* Pixel Processor Control */
-        ctx->wid = upa_readl(&ffb->wid);        /* Current WID */
-        ctx->fg = upa_readl(&ffb->fg);  /* Constant FG color */
-        ctx->bg = upa_readl(&ffb->bg);  /* Constant BG color */
-        ctx->consty = upa_readl(&ffb->consty);  /* Constant Y */
-        ctx->constz = upa_readl(&ffb->constz);  /* Constant Z */
-        ctx->xclip = upa_readl(&ffb->xclip);    /* X plane clip */
-        ctx->dcss = upa_readl(&ffb->dcss);      /* Depth Cue Scale Slope */
-        ctx->vclipmin = upa_readl(&ffb->vclipmin);      /* Primary XY clip, minimum */
-        ctx->vclipmax = upa_readl(&ffb->vclipmax);      /* Primary XY clip, maximum */
-        ctx->vclipzmin = upa_readl(&ffb->vclipzmin);    /* Primary Z clip, minimum */
-        ctx->vclipzmax = upa_readl(&ffb->vclipzmax);    /* Primary Z clip, maximum */
-        ctx->dcsf = upa_readl(&ffb->dcsf);      /* Depth Cue Scale Front Bound */
-        ctx->dcsb = upa_readl(&ffb->dcsb);      /* Depth Cue Scale Back Bound */
-        ctx->dczf = upa_readl(&ffb->dczf);      /* Depth Cue Scale Z Front */
-        ctx->dczb = upa_readl(&ffb->dczb);      /* Depth Cue Scale Z Back */
-        ctx->blendc = upa_readl(&ffb->blendc);  /* Alpha Blend Control */
-        ctx->blendc1 = upa_readl(&ffb->blendc1);        /* Alpha Blend Color 1 */
-        ctx->blendc2 = upa_readl(&ffb->blendc2);        /* Alpha Blend Color 2 */
-        ctx->fbc = upa_readl(&ffb->fbc);        /* Frame Buffer Control */
-        ctx->rop = upa_readl(&ffb->rop);        /* Raster Operation */
-        ctx->cmp = upa_readl(&ffb->cmp);        /* Compare Controls */
-        ctx->matchab = upa_readl(&ffb->matchab);        /* Buffer A/B Match Ops */
-        ctx->matchc = upa_readl(&ffb->matchc);  /* Buffer C Match Ops */
-        ctx->magnab = upa_readl(&ffb->magnab);  /* Buffer A/B Magnitude Ops */
-        ctx->magnc = upa_readl(&ffb->magnc);    /* Buffer C Magnitude Ops */
-        ctx->pmask = upa_readl(&ffb->pmask);    /* RGB Plane Mask */
-        ctx->xpmask = upa_readl(&ffb->xpmask);  /* X Plane Mask */
-        ctx->ypmask = upa_readl(&ffb->ypmask);  /* Y Plane Mask */
-        ctx->zpmask = upa_readl(&ffb->zpmask);  /* Z Plane Mask */
-
-        /* Auxiliary Clips. */
-        ctx->auxclip0min = upa_readl(&ffb->auxclip[0].min);
-        ctx->auxclip0max = upa_readl(&ffb->auxclip[0].max);
-        ctx->auxclip1min = upa_readl(&ffb->auxclip[1].min);
-        ctx->auxclip1max = upa_readl(&ffb->auxclip[1].max);
-        ctx->auxclip2min = upa_readl(&ffb->auxclip[2].min);
-        ctx->auxclip2max = upa_readl(&ffb->auxclip[2].max);
-        ctx->auxclip3min = upa_readl(&ffb->auxclip[3].min);
-        ctx->auxclip3max = upa_readl(&ffb->auxclip[3].max);
-
-        ctx->lpat = upa_readl(&ffb->lpat);      /* Line Pattern */
-        ctx->fontxy = upa_readl(&ffb->fontxy);  /* XY Font Coordinate */
-        ctx->fontw = upa_readl(&ffb->fontw);    /* Font Width */
-        ctx->fontinc = upa_readl(&ffb->fontinc);        /* Font X/Y Increment */
-
-        /* These registers/features only exist on FFB2 and later chips. */
-        if (fpriv->ffb_type >= ffb2_prototype) {
-                ctx->dcss1 = upa_readl(&ffb->dcss1);    /* Depth Cue Scale Slope 1 */
-                ctx->dcss2 = upa_readl(&ffb->dcss2);    /* Depth Cue Scale Slope 2 */
-                ctx->dcss2 = upa_readl(&ffb->dcss3);    /* Depth Cue Scale Slope 3 */
-                ctx->dcs2 = upa_readl(&ffb->dcs2);      /* Depth Cue Scale 2 */
-                ctx->dcs3 = upa_readl(&ffb->dcs3);      /* Depth Cue Scale 3 */
-                ctx->dcs4 = upa_readl(&ffb->dcs4);      /* Depth Cue Scale 4 */
-                ctx->dcd2 = upa_readl(&ffb->dcd2);      /* Depth Cue Depth 2 */
-                ctx->dcd3 = upa_readl(&ffb->dcd3);      /* Depth Cue Depth 3 */
-                ctx->dcd4 = upa_readl(&ffb->dcd4);      /* Depth Cue Depth 4 */
-
-                /* And stencil/stencilctl only exists on FFB2+ and later
-                 * due to the introduction of 3DRAM-III.
-                 */
-                if (fpriv->ffb_type == ffb2_vertical_plus ||
-                    fpriv->ffb_type == ffb2_horizontal_plus) {
-                        ctx->stencil = upa_readl(&ffb->stencil);
-                        ctx->stencilctl = upa_readl(&ffb->stencilctl);
-                }
-        }
-
-        /* Save the 32x32 area pattern. */
-        for (i = 0; i < 32; i++)
-                ctx->area_pattern[i] = upa_readl(&ffb->pattern[i]);
-
-        /* Finally, stash away the User Constol/Status Register. */
-        ctx->ucsr = upa_readl(&ffb->ucsr);
-}
-
-static void ffb_restore_context(ffb_dev_priv_t * fpriv, int old, int idx)
-{
-        ffb_fbcPtr ffb = fpriv->regs;
-        struct ffb_hw_context *ctx;
-        int i;
-
-        ctx = fpriv->hw_state[idx - 1];
-        if (idx == 0 || ctx == NULL)
-                return;
-
-        if (ctx->is_2d_only) {
-                /* 2D applications only care about certain pieces
-                 * of state.
-                 */
-                upa_writel(ctx->drawop, &ffb->drawop);
-
-                /* If we were restoring the vertex registers, this is where
-                 * we would do it.  We would restore 32 32-bit words starting
-                 * at ffb->suvtx.
-                 */
-
-                upa_writel(ctx->ppc, &ffb->ppc);
-                upa_writel(ctx->wid, &ffb->wid);
-                upa_writel(ctx->fg, &ffb->fg);
-                upa_writel(ctx->bg, &ffb->bg);
-                upa_writel(ctx->xclip, &ffb->xclip);
-                upa_writel(ctx->fbc, &ffb->fbc);
-                upa_writel(ctx->rop, &ffb->rop);
-                upa_writel(ctx->cmp, &ffb->cmp);
-                upa_writel(ctx->matchab, &ffb->matchab);
-                upa_writel(ctx->magnab, &ffb->magnab);
-                upa_writel(ctx->pmask, &ffb->pmask);
-                upa_writel(ctx->xpmask, &ffb->xpmask);
-                upa_writel(ctx->lpat, &ffb->lpat);
-                upa_writel(ctx->fontxy, &ffb->fontxy);
-                upa_writel(ctx->fontw, &ffb->fontw);
-                upa_writel(ctx->fontinc, &ffb->fontinc);
-
-                /* stencil/stencilctl only exists on FFB2+ and later
-                 * due to the introduction of 3DRAM-III.
-                 */
-                if (fpriv->ffb_type == ffb2_vertical_plus ||
-                    fpriv->ffb_type == ffb2_horizontal_plus) {
-                        upa_writel(ctx->stencil, &ffb->stencil);
-                        upa_writel(ctx->stencilctl, &ffb->stencilctl);
-                        upa_writel(0x80000000, &ffb->fbc);
-                        upa_writel((ctx->stencilctl | 0x80000),
-                                   &ffb->rawstencilctl);
-                        upa_writel(ctx->fbc, &ffb->fbc);
-                }
-
-                for (i = 0; i < 32; i++)
-                        upa_writel(ctx->area_pattern[i], &ffb->pattern[i]);
-                upa_writel((ctx->ucsr & 0xf0000), &ffb->ucsr);
-                return;
-        }
-
-        /* Restore drawop. */
-        upa_writel(ctx->drawop, &ffb->drawop);
-
-        /* If we were restoring the vertex registers, this is where
-         * we would do it.  We would restore 32 32-bit words starting
-         * at ffb->suvtx.
-         */
-
-        /* Restore rendering attributes. */
-
-        upa_writel(ctx->ppc, &ffb->ppc);        /* Pixel Processor Control */
-        upa_writel(ctx->wid, &ffb->wid);        /* Current WID */
-        upa_writel(ctx->fg, &ffb->fg);  /* Constant FG color */
-        upa_writel(ctx->bg, &ffb->bg);  /* Constant BG color */
-        upa_writel(ctx->consty, &ffb->consty);  /* Constant Y */
-        upa_writel(ctx->constz, &ffb->constz);  /* Constant Z */
-        upa_writel(ctx->xclip, &ffb->xclip);    /* X plane clip */
-        upa_writel(ctx->dcss, &ffb->dcss);      /* Depth Cue Scale Slope */
-        upa_writel(ctx->vclipmin, &ffb->vclipmin);      /* Primary XY clip, minimum */
-        upa_writel(ctx->vclipmax, &ffb->vclipmax);      /* Primary XY clip, maximum */
-        upa_writel(ctx->vclipzmin, &ffb->vclipzmin);    /* Primary Z clip, minimum */
-        upa_writel(ctx->vclipzmax, &ffb->vclipzmax);    /* Primary Z clip, maximum */
-        upa_writel(ctx->dcsf, &ffb->dcsf);      /* Depth Cue Scale Front Bound */
-        upa_writel(ctx->dcsb, &ffb->dcsb);      /* Depth Cue Scale Back Bound */
-        upa_writel(ctx->dczf, &ffb->dczf);      /* Depth Cue Scale Z Front */
-        upa_writel(ctx->dczb, &ffb->dczb);      /* Depth Cue Scale Z Back */
-        upa_writel(ctx->blendc, &ffb->blendc);  /* Alpha Blend Control */
-        upa_writel(ctx->blendc1, &ffb->blendc1);        /* Alpha Blend Color 1 */
-        upa_writel(ctx->blendc2, &ffb->blendc2);        /* Alpha Blend Color 2 */
-        upa_writel(ctx->fbc, &ffb->fbc);        /* Frame Buffer Control */
-        upa_writel(ctx->rop, &ffb->rop);        /* Raster Operation */
-        upa_writel(ctx->cmp, &ffb->cmp);        /* Compare Controls */
-        upa_writel(ctx->matchab, &ffb->matchab);        /* Buffer A/B Match Ops */
-        upa_writel(ctx->matchc, &ffb->matchc);  /* Buffer C Match Ops */
-        upa_writel(ctx->magnab, &ffb->magnab);  /* Buffer A/B Magnitude Ops */
-        upa_writel(ctx->magnc, &ffb->magnc);    /* Buffer C Magnitude Ops */
-        upa_writel(ctx->pmask, &ffb->pmask);    /* RGB Plane Mask */
-        upa_writel(ctx->xpmask, &ffb->xpmask);  /* X Plane Mask */
-        upa_writel(ctx->ypmask, &ffb->ypmask);  /* Y Plane Mask */
-        upa_writel(ctx->zpmask, &ffb->zpmask);  /* Z Plane Mask */
-
-        /* Auxiliary Clips. */
-        upa_writel(ctx->auxclip0min, &ffb->auxclip[0].min);
-        upa_writel(ctx->auxclip0max, &ffb->auxclip[0].max);
-        upa_writel(ctx->auxclip1min, &ffb->auxclip[1].min);
-        upa_writel(ctx->auxclip1max, &ffb->auxclip[1].max);
-        upa_writel(ctx->auxclip2min, &ffb->auxclip[2].min);
-        upa_writel(ctx->auxclip2max, &ffb->auxclip[2].max);
-        upa_writel(ctx->auxclip3min, &ffb->auxclip[3].min);
-        upa_writel(ctx->auxclip3max, &ffb->auxclip[3].max);
-
-        upa_writel(ctx->lpat, &ffb->lpat);      /* Line Pattern */
-        upa_writel(ctx->fontxy, &ffb->fontxy);  /* XY Font Coordinate */
-        upa_writel(ctx->fontw, &ffb->fontw);    /* Font Width */
-        upa_writel(ctx->fontinc, &ffb->fontinc);        /* Font X/Y Increment */
-
-        /* These registers/features only exist on FFB2 and later chips. */
-        if (fpriv->ffb_type >= ffb2_prototype) {
-                upa_writel(ctx->dcss1, &ffb->dcss1);    /* Depth Cue Scale Slope 1 */
-                upa_writel(ctx->dcss2, &ffb->dcss2);    /* Depth Cue Scale Slope 2 */
-                upa_writel(ctx->dcss3, &ffb->dcss2);    /* Depth Cue Scale Slope 3 */
-                upa_writel(ctx->dcs2, &ffb->dcs2);      /* Depth Cue Scale 2 */
-                upa_writel(ctx->dcs3, &ffb->dcs3);      /* Depth Cue Scale 3 */
-                upa_writel(ctx->dcs4, &ffb->dcs4);      /* Depth Cue Scale 4 */
-                upa_writel(ctx->dcd2, &ffb->dcd2);      /* Depth Cue Depth 2 */
-                upa_writel(ctx->dcd3, &ffb->dcd3);      /* Depth Cue Depth 3 */
-                upa_writel(ctx->dcd4, &ffb->dcd4);      /* Depth Cue Depth 4 */
-
-                /* And stencil/stencilctl only exists on FFB2+ and later
-                 * due to the introduction of 3DRAM-III.
-                 */
-                if (fpriv->ffb_type == ffb2_vertical_plus ||
-                    fpriv->ffb_type == ffb2_horizontal_plus) {
-                        /* Unfortunately, there is a hardware bug on
-                         * the FFB2+ chips which prevents a normal write
-                         * to the stencil control register from working
-                         * as it should.
-                         *
-                         * The state controlled by the FFB stencilctl register
-                         * really gets transferred to the per-buffer instances
-                         * of the stencilctl register in the 3DRAM chips.
-                         *
-                         * The bug is that FFB does not update buffer C correctly,
-                         * so we have to do it by hand for them.
-                         */
-
-                        /* This will update buffers A and B. */
-                        upa_writel(ctx->stencil, &ffb->stencil);
-                        upa_writel(ctx->stencilctl, &ffb->stencilctl);
-
-                        /* Force FFB to use buffer C 3dram regs. */
-                        upa_writel(0x80000000, &ffb->fbc);
-                        upa_writel((ctx->stencilctl | 0x80000),
-                                   &ffb->rawstencilctl);
-
-                        /* Now restore the correct FBC controls. */
-                        upa_writel(ctx->fbc, &ffb->fbc);
-                }
-        }
-
-        /* Restore the 32x32 area pattern. */
-        for (i = 0; i < 32; i++)
-                upa_writel(ctx->area_pattern[i], &ffb->pattern[i]);
-
-        /* Finally, stash away the User Constol/Status Register.
-         * The only state we really preserve here is the picking
-         * control.
-         */
-        upa_writel((ctx->ucsr & 0xf0000), &ffb->ucsr);
-}
-
-#define FFB_UCSR_FB_BUSY       0x01000000
-#define FFB_UCSR_RP_BUSY       0x02000000
-#define FFB_UCSR_ALL_BUSY      (FFB_UCSR_RP_BUSY|FFB_UCSR_FB_BUSY)
-
-static void FFBWait(ffb_fbcPtr ffb)
-{
-        int limit = 100000;
-
-        do {
-                u32 regval = upa_readl(&ffb->ucsr);
-
-                if ((regval & FFB_UCSR_ALL_BUSY) == 0)
-                        break;
-        } while (--limit);
-}
-
-int ffb_driver_context_switch(drm_device_t * dev, int old, int new)
-{
-        ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
-
-#ifdef DRM_DMA_HISTOGRAM
-        dev->ctx_start = get_cycles();
-#endif
-
-        DRM_DEBUG("Context switch from %d to %d\n", old, new);
-
-        if (new == dev->last_context || dev->last_context == 0) {
-                dev->last_context = new;
-                return 0;
-        }
-
-        FFBWait(fpriv->regs);
-        ffb_save_context(fpriv, old);
-        ffb_restore_context(fpriv, old, new);
-        FFBWait(fpriv->regs);
-
-        dev->last_context = new;
-
-        return 0;
-}
-
-int ffb_driver_resctx(struct inode *inode, struct file *filp, unsigned int cmd,
-                      unsigned long arg)
-{
-        drm_ctx_res_t res;
-        drm_ctx_t ctx;
-        int i;
-
-        DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS);
-        if (copy_from_user(&res, (drm_ctx_res_t __user *) arg, sizeof(res)))
-                return -EFAULT;
-        if (res.count >= DRM_RESERVED_CONTEXTS) {
-                memset(&ctx, 0, sizeof(ctx));
-                for (i = 0; i < DRM_RESERVED_CONTEXTS; i++) {
-                        ctx.handle = i;
-                        if (copy_to_user(&res.contexts[i], &i, sizeof(i)))
-                                return -EFAULT;
-                }
-        }
-        res.count = DRM_RESERVED_CONTEXTS;
-        if (copy_to_user((drm_ctx_res_t __user *) arg, &res, sizeof(res)))
-                return -EFAULT;
-        return 0;
-}
-
-int ffb_driver_addctx(struct inode *inode, struct file *filp, unsigned int cmd,
-                      unsigned long arg)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        drm_ctx_t ctx;
-        int idx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *) arg, sizeof(ctx)))
-                return -EFAULT;
-        idx = DRM(alloc_queue) (dev, (ctx.flags & _DRM_CONTEXT_2DONLY));
-        if (idx < 0)
-                return -ENFILE;
-
-        DRM_DEBUG("%d\n", ctx.handle);
-        ctx.handle = idx;
-        if (copy_to_user((drm_ctx_t __user *) arg, &ctx, sizeof(ctx)))
-                return -EFAULT;
-        return 0;
-}
-
-int ffb_driver_modctx(struct inode *inode, struct file *filp, unsigned int cmd,
-                      unsigned long arg)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
-        struct ffb_hw_context *hwctx;
-        drm_ctx_t ctx;
-        int idx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *) arg, sizeof(ctx)))
-                return -EFAULT;
-
-        idx = ctx.handle;
-        if (idx <= 0 || idx >= FFB_MAX_CTXS)
-                return -EINVAL;
-
-        hwctx = fpriv->hw_state[idx - 1];
-        if (hwctx == NULL)
-                return -EINVAL;
-
-        if ((ctx.flags & _DRM_CONTEXT_2DONLY) == 0)
-                hwctx->is_2d_only = 0;
-        else
-                hwctx->is_2d_only = 1;
-
-        return 0;
-}
-
-int ffb_driver_getctx(struct inode *inode, struct file *filp, unsigned int cmd,
-                      unsigned long arg)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
-        struct ffb_hw_context *hwctx;
-        drm_ctx_t ctx;
-        int idx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *) arg, sizeof(ctx)))
-                return -EFAULT;
-
-        idx = ctx.handle;
-        if (idx <= 0 || idx >= FFB_MAX_CTXS)
-                return -EINVAL;
-
-        hwctx = fpriv->hw_state[idx - 1];
-        if (hwctx == NULL)
-                return -EINVAL;
-
-        if (hwctx->is_2d_only != 0)
-                ctx.flags = _DRM_CONTEXT_2DONLY;
-        else
-                ctx.flags = 0;
-
-        if (copy_to_user((drm_ctx_t __user *) arg, &ctx, sizeof(ctx)))
-                return -EFAULT;
-
-        return 0;
-}
-
-int ffb_driver_switchctx(struct inode *inode, struct file *filp,
-                         unsigned int cmd, unsigned long arg)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        drm_ctx_t ctx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *) arg, sizeof(ctx)))
-                return -EFAULT;
-        DRM_DEBUG("%d\n", ctx.handle);
-        return ffb_driver_context_switch(dev, dev->last_context, ctx.handle);
-}
-
-int ffb_driver_newctx(struct inode *inode, struct file *filp, unsigned int cmd,
-                      unsigned long arg)
-{
-        drm_ctx_t ctx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *) arg, sizeof(ctx)))
-                return -EFAULT;
-        DRM_DEBUG("%d\n", ctx.handle);
-
-        return 0;
-}
-
-int ffb_driver_rmctx(struct inode *inode, struct file *filp, unsigned int cmd,
-                     unsigned long arg)
-{
-        drm_ctx_t ctx;
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev = priv->dev;
-        ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
-        int idx;
-
-        if (copy_from_user(&ctx, (drm_ctx_t __user *) arg, sizeof(ctx)))
-                return -EFAULT;
-        DRM_DEBUG("%d\n", ctx.handle);
-
-        idx = ctx.handle - 1;
-        if (idx < 0 || idx >= FFB_MAX_CTXS)
-                return -EINVAL;
-
-        kfree(fpriv->hw_state[idx]);
-        fpriv->hw_state[idx] = NULL;
-        return 0;
-}
-
-void ffb_set_context_ioctls(void)
-{
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_ADD_CTX)].func = ffb_driver_addctx;
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_RM_CTX)].func = ffb_driver_rmctx;
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_MOD_CTX)].func = ffb_driver_modctx;
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_GET_CTX)].func = ffb_driver_getctx;
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_SWITCH_CTX)].func =
-            ffb_driver_switchctx;
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_NEW_CTX)].func = ffb_driver_newctx;
-        DRM(ioctls)[DRM_IOCTL_NR(DRM_IOCTL_RES_CTX)].func = ffb_driver_resctx;
-
-}
diff --git a/drivers/char/drm/ffb_drv.c b/drivers/char/drm/ffb_drv.c
deleted file mode 100644
index 9a19879e3b68..000000000000
--- a/drivers/char/drm/ffb_drv.c
+++ /dev/null
@@ -1,355 +0,0 @@
-/* $Id: ffb_drv.c,v 1.16 2001/10/18 16:00:24 davem Exp $
- * ffb_drv.c: Creator/Creator3D direct rendering driver.
- *
- * Copyright (C) 2000 David S. Miller (davem@redhat.com)
- */
-
-#include "ffb.h"
-#include "drmP.h"
-
-#include "ffb_drv.h"
-
-#include <linux/smp_lock.h>
-#include <asm/shmparam.h>
-#include <asm/oplib.h>
-#include <asm/upa.h>
-
-#define DRIVER_AUTHOR           "David S. Miller"
-
-#define DRIVER_NAME             "ffb"
-#define DRIVER_DESC             "Creator/Creator3D"
-#define DRIVER_DATE             "20000517"
-
-#define DRIVER_MAJOR            0
-#define DRIVER_MINOR            0
-#define DRIVER_PATCHLEVEL       1
-
-typedef struct _ffb_position_t {
-        int node;
-        int root;
-} ffb_position_t;
-
-static ffb_position_t *ffb_position;
-
-static void get_ffb_type(ffb_dev_priv_t * ffb_priv, int instance)
-{
-        volatile unsigned char *strap_bits;
-        unsigned char val;
-
-        strap_bits = (volatile unsigned char *)
-            (ffb_priv->card_phys_base + 0x00200000UL);
-
-        /* Don't ask, you have to read the value twice for whatever
-         * reason to get correct contents.
-         */
-        val = upa_readb(strap_bits);
-        val = upa_readb(strap_bits);
-        switch (val & 0x78) {
-        case (0x0 << 5) | (0x0 << 3):
-                ffb_priv->ffb_type = ffb1_prototype;
-                printk("ffb%d: Detected FFB1 pre-FCS prototype\n", instance);
-                break;
-        case (0x0 << 5) | (0x1 << 3):
-                ffb_priv->ffb_type = ffb1_standard;
-                printk("ffb%d: Detected FFB1\n", instance);
-                break;
-        case (0x0 << 5) | (0x3 << 3):
-                ffb_priv->ffb_type = ffb1_speedsort;
-                printk("ffb%d: Detected FFB1-SpeedSort\n", instance);
-                break;
-        case (0x1 << 5) | (0x0 << 3):
-                ffb_priv->ffb_type = ffb2_prototype;
-                printk("ffb%d: Detected FFB2/vertical pre-FCS prototype\n",
-                       instance);
-                break;
-        case (0x1 << 5) | (0x1 << 3):
-                ffb_priv->ffb_type = ffb2_vertical;
-                printk("ffb%d: Detected FFB2/vertical\n", instance);
-                break;
-        case (0x1 << 5) | (0x2 << 3):
-                ffb_priv->ffb_type = ffb2_vertical_plus;
-                printk("ffb%d: Detected FFB2+/vertical\n", instance);
-                break;
-        case (0x2 << 5) | (0x0 << 3):
-                ffb_priv->ffb_type = ffb2_horizontal;
-                printk("ffb%d: Detected FFB2/horizontal\n", instance);
-                break;
-        case (0x2 << 5) | (0x2 << 3):
-                ffb_priv->ffb_type = ffb2_horizontal;
-                printk("ffb%d: Detected FFB2+/horizontal\n", instance);
-                break;
-        default:
-                ffb_priv->ffb_type = ffb2_vertical;
-                printk("ffb%d: Unknown boardID[%08x], assuming FFB2\n",
-                       instance, val);
-                break;
-        };
-}
-
-static void ffb_apply_upa_parent_ranges(int parent,
-                                        struct linux_prom64_registers *regs)
-{
-        struct linux_prom64_ranges ranges[PROMREG_MAX];
-        char name[128];
-        int len, i;
-
-        prom_getproperty(parent, "name", name, sizeof(name));
-        if (strcmp(name, "upa") != 0)
-                return;
-
-        len =
-            prom_getproperty(parent, "ranges", (void *)ranges, sizeof(ranges));
-        if (len <= 0)
-                return;
-
-        len /= sizeof(struct linux_prom64_ranges);
-        for (i = 0; i < len; i++) {
-                struct linux_prom64_ranges *rng = &ranges[i];
-                u64 phys_addr = regs->phys_addr;
-
-                if (phys_addr >= rng->ot_child_base &&
-                    phys_addr < (rng->ot_child_base + rng->or_size)) {
-                        regs->phys_addr -= rng->ot_child_base;
-                        regs->phys_addr += rng->ot_parent_base;
-                        return;
-                }
-        }
-
-        return;
-}
-
-static int ffb_init_one(drm_device_t * dev, int prom_node, int parent_node,
-                        int instance)
-{
-        struct linux_prom64_registers regs[2 * PROMREG_MAX];
-        ffb_dev_priv_t *ffb_priv = (ffb_dev_priv_t *) dev->dev_private;
-        int i;
-
-        ffb_priv->prom_node = prom_node;
-        if (prom_getproperty(ffb_priv->prom_node, "reg",
-                             (void *)regs, sizeof(regs)) <= 0) {
-                return -EINVAL;
-        }
-        ffb_apply_upa_parent_ranges(parent_node, &regs[0]);
-        ffb_priv->card_phys_base = regs[0].phys_addr;
-        ffb_priv->regs = (ffb_fbcPtr)
-            (regs[0].phys_addr + 0x00600000UL);
-        get_ffb_type(ffb_priv, instance);
-        for (i = 0; i < FFB_MAX_CTXS; i++)
-                ffb_priv->hw_state[i] = NULL;
-
-        return 0;
-}
-
-static drm_map_t *ffb_find_map(struct file *filp, unsigned long off)
-{
-        drm_file_t *priv = filp->private_data;
-        drm_device_t *dev;
-        drm_map_list_t *r_list;
-        struct list_head *list;
-        drm_map_t *map;
-
-        if (!priv || (dev = priv->dev) == NULL)
-                return NULL;
-
-        list_for_each(list, &dev->maplist->head) {
-                r_list = (drm_map_list_t *) list;
-                map = r_list->map;
-                if (!map)
-                        continue;
-                if (r_list->user_token == off)
-                        return map;
-        }
-
-        return NULL;
-}
-
-unsigned long ffb_get_unmapped_area(struct file *filp,
-                                    unsigned long hint,
-                                    unsigned long len,
-                                    unsigned long pgoff, unsigned long flags)
-{
-        drm_map_t *map = ffb_find_map(filp, pgoff << PAGE_SHIFT);
-        unsigned long addr = -ENOMEM;
-
-        if (!map)
-                return get_unmapped_area(NULL, hint, len, pgoff, flags);
-
-        if (map->type == _DRM_FRAME_BUFFER || map->type == _DRM_REGISTERS) {
-#ifdef HAVE_ARCH_FB_UNMAPPED_AREA
-                addr = get_fb_unmapped_area(filp, hint, len, pgoff, flags);
-#else
-                addr = get_unmapped_area(NULL, hint, len, pgoff, flags);
-#endif
-        } else if (map->type == _DRM_SHM && SHMLBA > PAGE_SIZE) {
-                unsigned long slack = SHMLBA - PAGE_SIZE;
-
-                addr = get_unmapped_area(NULL, hint, len + slack, pgoff, flags);
-                if (!(addr & ~PAGE_MASK)) {
-                        unsigned long kvirt = (unsigned long)map->handle;
-
-                        if ((kvirt & (SHMLBA - 1)) != (addr & (SHMLBA - 1))) {
-                                unsigned long koff, aoff;
-
-                                koff = kvirt & (SHMLBA - 1);
-                                aoff = addr & (SHMLBA - 1);
-                                if (koff < aoff)
-                                        koff += SHMLBA;
-
-                                addr += (koff - aoff);
-                        }
-                }
-        } else {
-                addr = get_unmapped_area(NULL, hint, len, pgoff, flags);
-        }
-
-        return addr;
-}
-
-static int ffb_presetup(drm_device_t * dev)
-{
-        ffb_dev_priv_t *ffb_priv;
-        int ret = 0;
-        int i = 0;
-
-        /* Check for the case where no device was found. */
-        if (ffb_position == NULL)
-                return -ENODEV;
-
-        /* code used to use numdevs no numdevs anymore */
-        ffb_priv = kmalloc(sizeof(ffb_dev_priv_t), GFP_KERNEL);
-        if (!ffb_priv)
-                return -ENOMEM;
-        memset(ffb_priv, 0, sizeof(*ffb_priv));
-        dev->dev_private = ffb_priv;
-
-        ret = ffb_init_one(dev, ffb_position[i].node, ffb_position[i].root, i);
-        return ret;
-}
-
-static void ffb_driver_release(drm_device_t * dev, struct file *filp)
-{
-        ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
-        int context = _DRM_LOCKING_CONTEXT(dev->lock.hw_lock->lock);
-        int idx;
-
-        idx = context - 1;
-        if (fpriv &&
-            context != DRM_KERNEL_CONTEXT && fpriv->hw_state[idx] != NULL) {
-                kfree(fpriv->hw_state[idx]);
-                fpriv->hw_state[idx] = NULL;
-        }
-}
-
-static void ffb_driver_pretakedown(drm_device_t * dev)
-{
-        kfree(dev->dev_private);
-}
-
-static int ffb_driver_postcleanup(drm_device_t * dev)
-{
-        kfree(ffb_position);
-        return 0;
-}
-
-static void ffb_driver_kernel_context_switch_unlock(struct drm_device *dev,
-                                                    drm_lock_t * lock)
-{
-        dev->lock.filp = 0;
-        {
-                __volatile__ unsigned int *plock = &dev->lock.hw_lock->lock;
-                unsigned int old, new, prev, ctx;
-
-                ctx = lock->context;
-                do {
-                        old = *plock;
-                        new = ctx;
-                        prev = cmpxchg(plock, old, new);
-                } while (prev != old);
-        }
-        wake_up_interruptible(&dev->lock.lock_queue);
-}
-
-static unsigned long ffb_driver_get_map_ofs(drm_map_t * map)
-{
-        return (map->offset & 0xffffffff);
-}
-
-static unsigned long ffb_driver_get_reg_ofs(drm_device_t * dev)
-{
-        ffb_dev_priv_t *ffb_priv = (ffb_dev_priv_t *) dev->dev_private;
-
-        if (ffb_priv)
-                return ffb_priv->card_phys_base;
-
-        return 0;
-}
-
-static int postinit(struct drm_device *dev, unsigned long flags)
-{
-        DRM_INFO("Initialized %s %d.%d.%d %s on minor %d\n",
-                 DRIVER_NAME,
-                 DRIVER_MAJOR,
-                 DRIVER_MINOR, DRIVER_PATCHLEVEL, DRIVER_DATE, dev->minor);
-        return 0;
-}
-
-static int version(drm_version_t * version)
-{
-        int len;
-
-        version->version_major = DRIVER_MAJOR;
-        version->version_minor = DRIVER_MINOR;
-        version->version_patchlevel = DRIVER_PATCHLEVEL;
-        DRM_COPY(version->name, DRIVER_NAME);
-        DRM_COPY(version->date, DRIVER_DATE);
-        DRM_COPY(version->desc, DRIVER_DESC);
-        return 0;
-}
-
-static drm_ioctl_desc_t ioctls[] = {
-
-};
-
-static struct drm_driver driver = {
-        .driver_features = 0,
-        .dev_priv_size = sizeof(u32),
-        .release = ffb_driver_release,
-        .presetup = ffb_presetup,
-        .pretakedown = ffb_driver_pretakedown,
-        .postcleanup = ffb_driver_postcleanup,
-        .kernel_context_switch = ffb_driver_context_switch,
-        .kernel_context_switch_unlock = ffb_driver_kernel_context_switch_unlock,
-        .get_map_ofs = ffb_driver_get_map_ofs,
-        .get_reg_ofs = ffb_driver_get_reg_ofs,
-        .postinit = postinit,
-        .version = version,
-        .ioctls = ioctls,
-        .num_ioctls = DRM_ARRAY_SIZE(ioctls),
-        .fops = {
-                 .owner = THIS_MODULE,
-                 .open = drm_open,
-                 .release = drm_release,
-                 .ioctl = drm_ioctl,
-                 .mmap = drm_mmap,
-                 .poll = drm_poll,
-                 .fasync = drm_fasync,
-                 }
-        ,
-};
-
-static int __init ffb_init(void)
-{
-        return -ENODEV;
-}
-
-static void __exit ffb_exit(void)
-{
-}
-
-module_init(ffb_init);
-module_exit(ffb_exit);
-
-MODULE_AUTHOR(DRIVER_AUTHOR);
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/char/drm/ffb_drv.h b/drivers/char/drm/ffb_drv.h
deleted file mode 100644
index 582afa6dd2b4..000000000000
--- a/drivers/char/drm/ffb_drv.h
+++ /dev/null
@@ -1,379 +0,0 @@
-/* $Id: ffb_drv.h,v 1.1 2000/06/01 04:24:39 davem Exp $
- * ffb_drv.h: Creator/Creator3D direct rendering driver.
- *
- * Copyright (C) 2000 David S. Miller (davem@redhat.com)
- */
-
-/* Auxilliary clips. */
-typedef struct {
-        volatile unsigned int min;
-        volatile unsigned int max;
-} ffb_auxclip, *ffb_auxclipPtr;
-
-/* FFB register set. */
-typedef struct _ffb_fbc {
-        /* Next vertex registers, on the right we list which drawops
-         * use said register and the logical name the register has in
-         * that context.
-         *//* DESCRIPTION          DRAWOP(NAME)    */
-                                        /*0x00*/ unsigned int pad1[3];
-                                        /* Reserved                             */
-                                                /*0x0c*/ volatile unsigned int alpha;
-                                                /* ALPHA Transparency                   */
-                                                /*0x10*/ volatile unsigned int red;
-                                                /* RED                                  */
-                                                /*0x14*/ volatile unsigned int green;
-                                                /* GREEN                                */
-                                                /*0x18*/ volatile unsigned int blue;
-                                                /* BLUE                                 */
-                                                /*0x1c*/ volatile unsigned int z;
-                                                /* DEPTH                                */
-                                                /*0x20*/ volatile unsigned int y;
-                                                /* Y                    triangle(DOYF)  */
-        /*                      aadot(DYF)      */
-        /*                      ddline(DYF)     */
-        /*                      aaline(DYF)     */
-                                                /*0x24*/ volatile unsigned int x;
-                                                /* X                    triangle(DOXF)  */
-        /*                      aadot(DXF)      */
-        /*                      ddline(DXF)     */
-        /*                      aaline(DXF)     */
-                                        /*0x28*/ unsigned int pad2[2];
-                                        /* Reserved                             */
-                                                /*0x30*/ volatile unsigned int ryf;
-                                                /* Y (alias to DOYF)    ddline(RYF)     */
-        /*                      aaline(RYF)     */
-        /*                      triangle(RYF)   */
-                                                /*0x34*/ volatile unsigned int rxf;
-                                                /* X                    ddline(RXF)     */
-        /*                      aaline(RXF)     */
-        /*                      triangle(RXF)   */
-                                        /*0x38*/ unsigned int pad3[2];
-                                        /* Reserved                             */
-                                                /*0x40*/ volatile unsigned int dmyf;
-                                                /* Y (alias to DOYF)    triangle(DMYF)  */
-                                                /*0x44*/ volatile unsigned int dmxf;
-                                                /* X                    triangle(DMXF)  */
-                                        /*0x48*/ unsigned int pad4[2];
-                                        /* Reserved                             */
-                                                /*0x50*/ volatile unsigned int ebyi;
-                                                /* Y (alias to RYI)     polygon(EBYI)   */
-                                                /*0x54*/ volatile unsigned int ebxi;
-                                                /* X                    polygon(EBXI)   */
-                                        /*0x58*/ unsigned int pad5[2];
-                                        /* Reserved                             */
-                                                /*0x60*/ volatile unsigned int by;
-                                                /* Y                    brline(RYI)     */
-        /*                      fastfill(OP)    */
-        /*                      polygon(YI)     */
-        /*                      rectangle(YI)   */
-        /*                      bcopy(SRCY)     */
-        /*                      vscroll(SRCY)   */
-                                                /*0x64*/ volatile unsigned int bx;
-                                                /* X                    brline(RXI)     */
-        /*                      polygon(XI)     */
-        /*                      rectangle(XI)   */
-        /*                      bcopy(SRCX)     */
-        /*                      vscroll(SRCX)   */
-        /*                      fastfill(GO)    */
-                                                /*0x68*/ volatile unsigned int dy;
-                                                /* destination Y        fastfill(DSTY)  */
-        /*                      bcopy(DSRY)     */
-        /*                      vscroll(DSRY)   */
-                                                /*0x6c*/ volatile unsigned int dx;
-                                                /* destination X        fastfill(DSTX)  */
-        /*                      bcopy(DSTX)     */
-        /*                      vscroll(DSTX)   */
-                                                /*0x70*/ volatile unsigned int bh;
-                                                /* Y (alias to RYI)     brline(DYI)     */
-        /*                      dot(DYI)        */
-        /*                      polygon(ETYI)   */
-        /* Height               fastfill(H)     */
-        /*                      bcopy(H)        */
-        /*                      vscroll(H)      */
-        /* Y count              fastfill(NY)    */
-                                                /*0x74*/ volatile unsigned int bw;
-                                                /* X                    dot(DXI)        */
-        /*                      brline(DXI)     */
-        /*                      polygon(ETXI)   */
-        /*                      fastfill(W)     */
-        /*                      bcopy(W)        */
-        /*                      vscroll(W)      */
-        /*                      fastfill(NX)    */
-                                        /*0x78*/ unsigned int pad6[2];
-                                        /* Reserved                             */
-                                        /*0x80*/ unsigned int pad7[32];
-                                        /* Reserved                             */
-
-        /* Setup Unit's vertex state register */
-/*100*/ volatile unsigned int suvtx;
-                                        /*104*/ unsigned int pad8[63];
-                                        /* Reserved                             */
-
-        /* Frame Buffer Control Registers */
-                                                /*200*/ volatile unsigned int ppc;
-                                                /* Pixel Processor Control              */
-                                                /*204*/ volatile unsigned int wid;
-                                                /* Current WID                          */
-                                                /*208*/ volatile unsigned int fg;
-                                                /* FG data                              */
-                                                /*20c*/ volatile unsigned int bg;
-                                                /* BG data                              */
-                                                /*210*/ volatile unsigned int consty;
-                                                /* Constant Y                           */
-                                                /*214*/ volatile unsigned int constz;
-                                                /* Constant Z                           */
-                                                /*218*/ volatile unsigned int xclip;
-                                                /* X Clip                               */
-                                                /*21c*/ volatile unsigned int dcss;
-                                                /* Depth Cue Scale Slope                */
-                                                /*220*/ volatile unsigned int vclipmin;
-                                                /* Viewclip XY Min Bounds               */
-                                                /*224*/ volatile unsigned int vclipmax;
-                                                /* Viewclip XY Max Bounds               */
-                                                        /*228*/ volatile unsigned int vclipzmin;
-                                                        /* Viewclip Z Min Bounds                */
-                                                        /*22c*/ volatile unsigned int vclipzmax;
-                                                        /* Viewclip Z Max Bounds                */
-                                                /*230*/ volatile unsigned int dcsf;
-                                                /* Depth Cue Scale Front Bound          */
-                                                /*234*/ volatile unsigned int dcsb;
-                                                /* Depth Cue Scale Back Bound           */
-                                                /*238*/ volatile unsigned int dczf;
-                                                /* Depth Cue Z Front                    */
-                                                /*23c*/ volatile unsigned int dczb;
-                                                /* Depth Cue Z Back                     */
-                                        /*240*/ unsigned int pad9;
-                                        /* Reserved                             */
-                                                /*244*/ volatile unsigned int blendc;
-                                                /* Alpha Blend Control                  */
-                                                /*248*/ volatile unsigned int blendc1;
-                                                /* Alpha Blend Color 1                  */
-                                                /*24c*/ volatile unsigned int blendc2;
-                                                /* Alpha Blend Color 2                  */
-                                                /*250*/ volatile unsigned int fbramitc;
-                                                /* FB RAM Interleave Test Control       */
-                                                /*254*/ volatile unsigned int fbc;
-                                                /* Frame Buffer Control                 */
-                                                /*258*/ volatile unsigned int rop;
-                                                /* Raster OPeration                     */
-                                                /*25c*/ volatile unsigned int cmp;
-                                                /* Frame Buffer Compare                 */
-                                                /*260*/ volatile unsigned int matchab;
-                                                /* Buffer AB Match Mask                 */
-                                                /*264*/ volatile unsigned int matchc;
-                                                /* Buffer C(YZ) Match Mask              */
-                                                /*268*/ volatile unsigned int magnab;
-                                                /* Buffer AB Magnitude Mask             */
-                                                /*26c*/ volatile unsigned int magnc;
-                                                /* Buffer C(YZ) Magnitude Mask          */
-                                                /*270*/ volatile unsigned int fbcfg0;
-                                                /* Frame Buffer Config 0                */
-                                                /*274*/ volatile unsigned int fbcfg1;
-                                                /* Frame Buffer Config 1                */
-                                                /*278*/ volatile unsigned int fbcfg2;
-                                                /* Frame Buffer Config 2                */
-                                                /*27c*/ volatile unsigned int fbcfg3;
-                                                /* Frame Buffer Config 3                */
-                                                /*280*/ volatile unsigned int ppcfg;
-                                                /* Pixel Processor Config               */
-                                                /*284*/ volatile unsigned int pick;
-                                                /* Picking Control                      */
-                                                /*288*/ volatile unsigned int fillmode;
-                                                /* FillMode                             */
-                                                /*28c*/ volatile unsigned int fbramwac;
-                                                /* FB RAM Write Address Control         */
-                                                /*290*/ volatile unsigned int pmask;
-                                                /* RGB PlaneMask                        */
-                                                /*294*/ volatile unsigned int xpmask;
-                                                /* X PlaneMask                          */
-                                                /*298*/ volatile unsigned int ypmask;
-                                                /* Y PlaneMask                          */
-                                                /*29c*/ volatile unsigned int zpmask;
-                                                /* Z PlaneMask                          */
-                                        /*2a0*/ ffb_auxclip auxclip[4];
-                                        /* Auxilliary Viewport Clip             */
-
-        /* New 3dRAM III support regs */
-/*2c0*/ volatile unsigned int rawblend2;
-/*2c4*/ volatile unsigned int rawpreblend;
-/*2c8*/ volatile unsigned int rawstencil;
-/*2cc*/ volatile unsigned int rawstencilctl;
-/*2d0*/ volatile unsigned int threedram1;
-/*2d4*/ volatile unsigned int threedram2;
-/*2d8*/ volatile unsigned int passin;
-/*2dc*/ volatile unsigned int rawclrdepth;
-/*2e0*/ volatile unsigned int rawpmask;
-/*2e4*/ volatile unsigned int rawcsrc;
-/*2e8*/ volatile unsigned int rawmatch;
-/*2ec*/ volatile unsigned int rawmagn;
-/*2f0*/ volatile unsigned int rawropblend;
-/*2f4*/ volatile unsigned int rawcmp;
-/*2f8*/ volatile unsigned int rawwac;
-/*2fc*/ volatile unsigned int fbramid;
-
-                                                /*300*/ volatile unsigned int drawop;
-                                                /* Draw OPeration                       */
-                                        /*304*/ unsigned int pad10[2];
-                                        /* Reserved                             */
-                                                /*30c*/ volatile unsigned int lpat;
-                                                /* Line Pattern control                 */
-                                        /*310*/ unsigned int pad11;
-                                        /* Reserved                             */
-                                                /*314*/ volatile unsigned int fontxy;
-                                                /* XY Font coordinate                   */
-                                                /*318*/ volatile unsigned int fontw;
-                                                /* Font Width                           */
-                                                /*31c*/ volatile unsigned int fontinc;
-                                                /* Font Increment                       */
-                                                /*320*/ volatile unsigned int font;
-                                                /* Font bits                            */
-                                        /*324*/ unsigned int pad12[3];
-                                        /* Reserved                             */
-/*330*/ volatile unsigned int blend2;
-/*334*/ volatile unsigned int preblend;
-/*338*/ volatile unsigned int stencil;
-/*33c*/ volatile unsigned int stencilctl;
-
-                                        /*340*/ unsigned int pad13[4];
-                                        /* Reserved                             */
-                                                /*350*/ volatile unsigned int dcss1;
-                                                /* Depth Cue Scale Slope 1              */
-                                                /*354*/ volatile unsigned int dcss2;
-                                                /* Depth Cue Scale Slope 2              */
-                                                /*358*/ volatile unsigned int dcss3;
-                                                /* Depth Cue Scale Slope 3              */
-/*35c*/ volatile unsigned int widpmask;
-/*360*/ volatile unsigned int dcs2;
-/*364*/ volatile unsigned int dcs3;
-/*368*/ volatile unsigned int dcs4;
-                                        /*36c*/ unsigned int pad14;
-                                        /* Reserved                             */
-/*370*/ volatile unsigned int dcd2;
-/*374*/ volatile unsigned int dcd3;
-/*378*/ volatile unsigned int dcd4;
-                                        /*37c*/ unsigned int pad15;
-                                        /* Reserved                             */
-                                                        /*380*/ volatile unsigned int pattern[32];
-                                                        /* area Pattern                         */
-                                        /*400*/ unsigned int pad16[8];
-                                        /* Reserved                             */
-                                                /*420*/ volatile unsigned int reset;
-                                                /* chip RESET                           */
-                                                /*424*/ unsigned int pad17[247];
-                                                /* Reserved                             */
-                                                /*800*/ volatile unsigned int devid;
-                                                /* Device ID                            */
-                                        /*804*/ unsigned int pad18[63];
-                                        /* Reserved                             */
-                                                /*900*/ volatile unsigned int ucsr;
-                                                /* User Control & Status Register       */
-                                        /*904*/ unsigned int pad19[31];
-                                        /* Reserved                             */
-                                                /*980*/ volatile unsigned int mer;
-                                                /* Mode Enable Register                 */
-                                                /*984*/ unsigned int pad20[1439];
-                                                /* Reserved                             */
-} ffb_fbc, *ffb_fbcPtr;
-
-struct ffb_hw_context {
-        int is_2d_only;
-
-        unsigned int ppc;
-        unsigned int wid;
-        unsigned int fg;
-        unsigned int bg;
-        unsigned int consty;
-        unsigned int constz;
-        unsigned int xclip;
-        unsigned int dcss;
-        unsigned int vclipmin;
-        unsigned int vclipmax;
-        unsigned int vclipzmin;
-        unsigned int vclipzmax;
-        unsigned int dcsf;
-        unsigned int dcsb;
-        unsigned int dczf;
-        unsigned int dczb;
-        unsigned int blendc;
-        unsigned int blendc1;
-        unsigned int blendc2;
-        unsigned int fbc;
-        unsigned int rop;
-        unsigned int cmp;
-        unsigned int matchab;
-        unsigned int matchc;
-        unsigned int magnab;
-        unsigned int magnc;
-        unsigned int pmask;
-        unsigned int xpmask;
-        unsigned int ypmask;
-        unsigned int zpmask;
-        unsigned int auxclip0min;
-        unsigned int auxclip0max;
-        unsigned int auxclip1min;
-        unsigned int auxclip1max;
-        unsigned int auxclip2min;
-        unsigned int auxclip2max;
-        unsigned int auxclip3min;
-        unsigned int auxclip3max;
-        unsigned int drawop;
-        unsigned int lpat;
-        unsigned int fontxy;
-        unsigned int fontw;
-        unsigned int fontinc;
-        unsigned int area_pattern[32];
-        unsigned int ucsr;
-        unsigned int stencil;
-        unsigned int stencilctl;
-        unsigned int dcss1;
-        unsigned int dcss2;
-        unsigned int dcss3;
-        unsigned int dcs2;
-        unsigned int dcs3;
-        unsigned int dcs4;
-        unsigned int dcd2;
-        unsigned int dcd3;
-        unsigned int dcd4;
-        unsigned int mer;
-};
-
-#define FFB_MAX_CTXS    32
-
-enum ffb_chip_type {
-        ffb1_prototype = 0,     /* Early pre-FCS FFB */
-        ffb1_standard,          /* First FCS FFB, 100Mhz UPA, 66MHz gclk */
-        ffb1_speedsort,         /* Second FCS FFB, 100Mhz UPA, 75MHz gclk */
-        ffb2_prototype,         /* Early pre-FCS vertical FFB2 */
-        ffb2_vertical,          /* First FCS FFB2/vertical, 100Mhz UPA, 100MHZ gclk,
-                                   75(SingleBuffer)/83(DoubleBuffer) MHz fclk */
-        ffb2_vertical_plus,     /* Second FCS FFB2/vertical, same timings */
-        ffb2_horizontal,        /* First FCS FFB2/horizontal, same timings as FFB2/vert */
-        ffb2_horizontal_plus,   /* Second FCS FFB2/horizontal, same timings */
-        afb_m3,                 /* FCS Elite3D, 3 float chips */
-        afb_m6                  /* FCS Elite3D, 6 float chips */
-};
-
-typedef struct ffb_dev_priv {
-        /* Misc software state. */
-        int prom_node;
-        enum ffb_chip_type ffb_type;
-        u64 card_phys_base;
-        struct miscdevice miscdev;
-
-        /* Controller registers. */
-        ffb_fbcPtr regs;
-
-        /* Context table. */
-        struct ffb_hw_context *hw_state[FFB_MAX_CTXS];
-} ffb_dev_priv_t;
-
-extern unsigned long ffb_get_unmapped_area(struct file *filp,
-                                           unsigned long hint,
-                                           unsigned long len,
-                                           unsigned long pgoff,
-                                           unsigned long flags);
-extern void ffb_set_context_ioctls(void);
-extern drm_ioctl_desc_t DRM(ioctls)[];
-
-extern int ffb_driver_context_switch(drm_device_t * dev, int old, int new);
diff --git a/drivers/char/generic_serial.c b/drivers/char/generic_serial.c
index 337bbcdcf13d..8ea02755b1c9 100644
--- a/drivers/char/generic_serial.c
+++ b/drivers/char/generic_serial.c
@@ -710,12 +710,6 @@ void gs_close(struct tty_struct * tty, struct file * filp)
 }
 
 
-static unsigned int     gs_baudrates[] = {
-  0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
-  9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600
-};
-
-
 void gs_set_termios (struct tty_struct * tty, 
                      struct ktermios * old_termios)
 {
@@ -771,7 +765,6 @@ void gs_set_termios (struct tty_struct * tty,
 
         baudrate = tty_get_baud_rate(tty);
 
-        baudrate = gs_baudrates[baudrate];
         if ((tiosp->c_cflag & CBAUD) == B38400) {
                 if (     (port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
                         baudrate = 57600;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index f5c160caf9f4..5f066963f171 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -248,7 +248,7 @@ static unsigned long get_unmapped_area_mem(struct file *file,
 {
         if (!valid_mmap_phys_addr_range(pgoff, len))
                 return (unsigned long) -EINVAL;
-        return pgoff;
+        return pgoff << PAGE_SHIFT;
 }
 
 /* can't do an in-place private mapping if there's no MMU */
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index a61fb6da5d03..80a01150b86c 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1338,43 +1338,23 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file, unsigned int c
                  *   (use |'ed TIOCM_RNG/DSR/CD/CTS for masking)
                  * Caller should use TIOCGICOUNT to see which one it was
                  */
-        case TIOCMIWAIT: {
-                        DECLARE_WAITQUEUE(wait, current);
-                        int ret;
+        case TIOCMIWAIT:
+                spin_lock_irqsave(&info->slock, flags);
+                cnow = info->icount;    /* note the counters on entry */
+                spin_unlock_irqrestore(&info->slock, flags);
+
+                wait_event_interruptible(info->delta_msr_wait, ({
+                        cprev = cnow;
                         spin_lock_irqsave(&info->slock, flags);
-                        cprev = info->icount;   /* note the counters on entry */
+                        cnow = info->icount;    /* atomic copy */
                         spin_unlock_irqrestore(&info->slock, flags);
 
-                        add_wait_queue(&info->delta_msr_wait, &wait);
-                        while (1) {
-                                spin_lock_irqsave(&info->slock, flags);
-                                cnow = info->icount;    /* atomic copy */
-                                spin_unlock_irqrestore(&info->slock, flags);
-
-                                set_current_state(TASK_INTERRUPTIBLE);
-                                if (((arg & TIOCM_RNG) &&
-                                                (cnow.rng != cprev.rng)) ||
-                                                ((arg & TIOCM_DSR) &&
-                                                (cnow.dsr != cprev.dsr)) ||
-                                                ((arg & TIOCM_CD) &&
-                                                (cnow.dcd != cprev.dcd)) ||
-                                                ((arg & TIOCM_CTS) &&
-                                                (cnow.cts != cprev.cts))) {
-                                        ret = 0;
-                                        break;
-                                }
-                                /* see if a signal did it */
-                                if (signal_pending(current)) {
-                                        ret = -ERESTARTSYS;
-                                        break;
-                                }
-                                cprev = cnow;
-                        }
-                        current->state = TASK_RUNNING;
-                        remove_wait_queue(&info->delta_msr_wait, &wait);
-                        break;
-                }
-                /* NOTREACHED */
+                        ((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+                        ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+                        ((arg & TIOCM_CD)  && (cnow.dcd != cprev.dcd)) ||
+                        ((arg & TIOCM_CTS) && (cnow.cts != cprev.cts));
+                }));
+                break;
                 /*
                  * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
                  * Return: write counters to the user passed counter struct
diff --git a/drivers/char/mxser_new.c b/drivers/char/mxser_new.c
index 9af07e4999d5..f7603b6aeb87 100644
--- a/drivers/char/mxser_new.c
+++ b/drivers/char/mxser_new.c
@@ -1758,43 +1758,23 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
                  *   (use |'ed TIOCM_RNG/DSR/CD/CTS for masking)
                  * Caller should use TIOCGICOUNT to see which one it was
                  */
-        case TIOCMIWAIT: {
-                DECLARE_WAITQUEUE(wait, current);
-                int ret;
+        case TIOCMIWAIT:
                 spin_lock_irqsave(&info->slock, flags);
-                cprev = info->icount;   /* note the counters on entry */
+                cnow = info->icount;    /* note the counters on entry */
                 spin_unlock_irqrestore(&info->slock, flags);
 
-                add_wait_queue(&info->delta_msr_wait, &wait);
-                while (1) {
+                wait_event_interruptible(info->delta_msr_wait, ({
+                        cprev = cnow;
                         spin_lock_irqsave(&info->slock, flags);
                         cnow = info->icount;    /* atomic copy */
                         spin_unlock_irqrestore(&info->slock, flags);
 
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        if (((arg & TIOCM_RNG) &&
-                                        (cnow.rng != cprev.rng)) ||
-                                        ((arg & TIOCM_DSR) &&
-                                        (cnow.dsr != cprev.dsr)) ||
-                                        ((arg & TIOCM_CD) &&
-                                        (cnow.dcd != cprev.dcd)) ||
-                                        ((arg & TIOCM_CTS) &&
-                                        (cnow.cts != cprev.cts))) {
-                                ret = 0;
-                                break;
-                        }
-                        /* see if a signal did it */
-                        if (signal_pending(current)) {
-                                ret = -ERESTARTSYS;
-                                break;
-                        }
-                        cprev = cnow;
-                }
-                current->state = TASK_RUNNING;
-                remove_wait_queue(&info->delta_msr_wait, &wait);
+                        ((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+                        ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+                        ((arg & TIOCM_CD)  && (cnow.dcd != cprev.dcd)) ||
+                        ((arg & TIOCM_CTS) && (cnow.cts != cprev.cts));
+                }));
                 break;
-        }
-        /* NOTREACHED */
         /*
          * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
          * Return: write counters to the user passed counter struct
@@ -2230,7 +2210,14 @@ end_intr:
         port->mon_data.rxcnt += cnt;
         port->mon_data.up_rxcnt += cnt;
 
+        /*
+         * We are called from an interrupt context with &port->slock
+         * being held. Drop it temporarily in order to prevent
+         * recursive locking.
+         */
+        spin_unlock(&port->slock);
         tty_flip_buffer_push(tty);
+        spin_lock(&port->slock);
 }
 
 static void mxser_transmit_chars(struct mxser_port *port)
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 78237577b05a..3ef593a9015f 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1,6 +1,8 @@
 /*
  * Sony Programmable I/O Control Device driver for VAIO
  *
+ * Copyright (C) 2007 Mattia Dongili <malattia@linux.it>
+ *
  * Copyright (C) 2001-2005 Stelian Pop <stelian@popies.net>
  *
  * Copyright (C) 2005 Narayanan R S <nars@kadamba.org>
@@ -95,6 +97,11 @@ module_param(useinput, int, 0444);
 MODULE_PARM_DESC(useinput,
                  "set this if you would like sonypi to feed events to the input subsystem");
 
+static int check_ioport = 1;
+module_param(check_ioport, int, 0444);
+MODULE_PARM_DESC(check_ioport,
+                 "set this to 0 if you think the automatic ioport check for sony-laptop is wrong");
+
 #define SONYPI_DEVICE_MODEL_TYPE1       1
 #define SONYPI_DEVICE_MODEL_TYPE2       2
 #define SONYPI_DEVICE_MODEL_TYPE3       3
@@ -477,7 +484,7 @@ static struct sonypi_device {
         u16 evtype_offset;
         int camera_power;
         int bluetooth_power;
-        struct semaphore lock;
+        struct mutex lock;
         struct kfifo *fifo;
         spinlock_t fifo_lock;
         wait_queue_head_t fifo_proc_list;
@@ -884,7 +891,7 @@ int sonypi_camera_command(int command, u8 value)
         if (!camera)
                 return -EIO;
 
-        down(&sonypi_device.lock);
+        mutex_lock(&sonypi_device.lock);
 
         switch (command) {
         case SONYPI_COMMAND_SETCAMERA:
@@ -919,7 +926,7 @@ int sonypi_camera_command(int command, u8 value)
                        command);
                 break;
         }
-        up(&sonypi_device.lock);
+        mutex_unlock(&sonypi_device.lock);
         return 0;
 }
 
@@ -938,20 +945,20 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
 static int sonypi_misc_release(struct inode *inode, struct file *file)
 {
         sonypi_misc_fasync(-1, file, 0);
-        down(&sonypi_device.lock);
+        mutex_lock(&sonypi_device.lock);
         sonypi_device.open_count--;
-        up(&sonypi_device.lock);
+        mutex_unlock(&sonypi_device.lock);
         return 0;
 }
 
 static int sonypi_misc_open(struct inode *inode, struct file *file)
 {
-        down(&sonypi_device.lock);
+        mutex_lock(&sonypi_device.lock);
         /* Flush input queue on first open */
         if (!sonypi_device.open_count)
                 kfifo_reset(sonypi_device.fifo);
         sonypi_device.open_count++;
-        up(&sonypi_device.lock);
+        mutex_unlock(&sonypi_device.lock);
         return 0;
 }
 
@@ -1001,7 +1008,7 @@ static int sonypi_misc_ioctl(struct inode *ip, struct file *fp,
         u8 val8;
         u16 val16;
 
-        down(&sonypi_device.lock);
+        mutex_lock(&sonypi_device.lock);
         switch (cmd) {
         case SONYPI_IOCGBRT:
                 if (sonypi_ec_read(SONYPI_LCD_LIGHT, &val8)) {
@@ -1101,7 +1108,7 @@ static int sonypi_misc_ioctl(struct inode *ip, struct file *fp,
         default:
                 ret = -EINVAL;
         }
-        up(&sonypi_device.lock);
+        mutex_unlock(&sonypi_device.lock);
         return ret;
 }
 
@@ -1260,6 +1267,28 @@ static int __devinit sonypi_create_input_devices(void)
 static int __devinit sonypi_setup_ioports(struct sonypi_device *dev,
                                 const struct sonypi_ioport_list *ioport_list)
 {
+        /* try to detect if sony-laptop is being used and thus
+         * has already requested one of the known ioports.
+         * As in the deprecated check_region this is racy has we have
+         * multiple ioports available and one of them can be requested
+         * between this check and the subsequent request. Anyway, as an
+         * attempt to be some more user-friendly as we currently are,
+         * this is enough.
+         */
+        const struct sonypi_ioport_list *check = ioport_list;
+        while (check_ioport && check->port1) {
+                if (!request_region(check->port1,
+                                   sonypi_device.region_size,
+                                   "Sony Programable I/O Device Check")) {
+                        printk(KERN_ERR "sonypi: ioport 0x%.4x busy, using sony-laptop? "
+                                        "if not use check_ioport=0\n",
+                                        check->port1);
+                        return -EBUSY;
+                }
+                release_region(check->port1, sonypi_device.region_size);
+                check++;
+        }
+
         while (ioport_list->port1) {
 
                 if (request_region(ioport_list->port1,
@@ -1321,6 +1350,10 @@ static int __devinit sonypi_probe(struct platform_device *dev)
         struct pci_dev *pcidev;
         int error;
 
+        printk(KERN_WARNING "sonypi: please try the sony-laptop module instead "
+                        "and report failures, see also "
+                        "http://www.linux.it/~malattia/wiki/index.php/Sony_drivers\n");
+
         spin_lock_init(&sonypi_device.fifo_lock);
         sonypi_device.fifo = kfifo_alloc(SONYPI_BUF_SIZE, GFP_KERNEL,
                                          &sonypi_device.fifo_lock);
@@ -1330,7 +1363,7 @@ static int __devinit sonypi_probe(struct platform_device *dev)
         }
 
         init_waitqueue_head(&sonypi_device.fifo_proc_list);
-        init_MUTEX(&sonypi_device.lock);
+        mutex_init(&sonypi_device.lock);
         sonypi_device.bluetooth_power = -1;
 
         if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 1fa2da8f4fbe..c9f2dd620e87 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -1039,10 +1039,22 @@ int vt_waitactive(int vt)
 
         add_wait_queue(&vt_activate_queue, &wait);
         for (;;) {
-                set_current_state(TASK_INTERRUPTIBLE);
                 retval = 0;
-                if (vt == fg_console)
+
+                /*
+                 * Synchronize with redraw_screen(). By acquiring the console
+                 * semaphore we make sure that the console switch is completed
+                 * before we return. If we didn't wait for the semaphore, we
+                 * could return at a point where fg_console has already been
+                 * updated, but the console switch hasn't been completed.
+                 */
+                acquire_console_sem();
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (vt == fg_console) {
+                        release_console_sem();
                         break;
+                }
+                release_console_sem();
                 retval = -EINTR;
                 if (signal_pending(current))
                         break;
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index d42060ede930..5ac309ee7f05 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -90,7 +90,7 @@ __setup("acpi_pm_good", acpi_pm_good_setup);
 static inline void acpi_pm_need_workaround(void)
 {
         clocksource_acpi_pm.read = acpi_pm_read_slow;
-        clocksource_acpi_pm.rating = 110;
+        clocksource_acpi_pm.rating = 120;
 }
 
 /*
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index f52facc570f5..3162010900c9 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1015,6 +1015,10 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
 {
         unsigned int cpu = sys_dev->id;
         int retval;
+
+        if (cpu_is_offline(cpu))
+                return 0;
+
         if (unlikely(lock_policy_rwsem_write(cpu)))
                 BUG();
 
diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
index 9e913629ef39..74edb1d0110f 100644
--- a/drivers/eisa/pci_eisa.c
+++ b/drivers/eisa/pci_eisa.c
@@ -19,8 +19,8 @@
 /* There is only *one* pci_eisa device per machine, right ? */
 static struct eisa_root_device pci_eisa_root;
 
-static int __devinit pci_eisa_init (struct pci_dev *pdev,
-                                    const struct pci_device_id *ent)
+static int __init pci_eisa_init(struct pci_dev *pdev,
+                                const struct pci_device_id *ent)
 {
         int rc;
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 67f3347afcf3..1cca32f46947 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -969,7 +969,7 @@ int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int i
 
         if (size < rsize) {
                 dbg("report %d is too short, (%d < %d)", report->id, size, rsize);
-                return -1;
+                memset(data + size, 0, rsize - size);
         }
 
         if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index da5828f2dfc2..30a76404f0af 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -121,9 +121,9 @@ superio_exit(void)
  * ISA constants
  */
 
-#define REGION_ALIGNMENT        ~7
-#define REGION_OFFSET           5
-#define REGION_LENGTH           2
+#define IOREGION_ALIGNMENT      ~7
+#define IOREGION_OFFSET         5
+#define IOREGION_LENGTH         2
 #define ADDR_REG_OFFSET         5
 #define DATA_REG_OFFSET         6
 
@@ -407,7 +407,7 @@ static void w83627ehf_write_fan_div(struct i2c_client *client, int nr)
                 break;
         case 4:
                 reg = (w83627ehf_read_value(client, W83627EHF_REG_DIODE) & 0x73)
-                    | ((data->fan_div[4] & 0x03) << 3)
+                    | ((data->fan_div[4] & 0x03) << 2)
                     | ((data->fan_div[4] & 0x04) << 5);
                 w83627ehf_write_value(client, W83627EHF_REG_DIODE, reg);
                 break;
@@ -471,9 +471,9 @@ static struct w83627ehf_data *w83627ehf_update_device(struct device *dev)
                            time */
                         if (data->fan[i] == 0xff
                          && data->fan_div[i] < 0x07) {
-                                dev_dbg(&client->dev, "Increasing fan %d "
+                                dev_dbg(&client->dev, "Increasing fan%d "
                                         "clock divider from %u to %u\n",
-                                        i, div_from_reg(data->fan_div[i]),
+                                        i + 1, div_from_reg(data->fan_div[i]),
                                         div_from_reg(data->fan_div[i] + 1));
                                 data->fan_div[i]++;
                                 w83627ehf_write_fan_div(client, i);
@@ -1194,7 +1194,7 @@ static int w83627ehf_detect(struct i2c_adapter *adapter)
         u8 fan4pin, fan5pin;
         int i, err = 0;
 
-        if (!request_region(address + REGION_OFFSET, REGION_LENGTH,
+        if (!request_region(address + IOREGION_OFFSET, IOREGION_LENGTH,
                             w83627ehf_driver.driver.name)) {
                 err = -EBUSY;
                 goto exit;
@@ -1322,7 +1322,7 @@ exit_remove:
 exit_free:
         kfree(data);
 exit_release:
-        release_region(address + REGION_OFFSET, REGION_LENGTH);
+        release_region(address + IOREGION_OFFSET, IOREGION_LENGTH);
 exit:
         return err;
 }
@@ -1337,7 +1337,7 @@ static int w83627ehf_detach_client(struct i2c_client *client)
 
         if ((err = i2c_detach_client(client)))
                 return err;
-        release_region(client->addr + REGION_OFFSET, REGION_LENGTH);
+        release_region(client->addr + IOREGION_OFFSET, IOREGION_LENGTH);
         kfree(data);
 
         return 0;
@@ -1380,7 +1380,7 @@ static int __init w83627ehf_find(int sioaddr, unsigned short *addr)
         superio_select(W83627EHF_LD_HWM);
         val = (superio_inb(SIO_REG_ADDR) << 8)
             | superio_inb(SIO_REG_ADDR + 1);
-        *addr = val & REGION_ALIGNMENT;
+        *addr = val & IOREGION_ALIGNMENT;
         if (*addr == 0) {
                 superio_exit();
                 return -ENODEV;
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index fb19dbb31e42..ece31d2c6c64 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -344,8 +344,7 @@ config I2C_PARPORT_LIGHT
 
 config I2C_PASEMI
         tristate "PA Semi SMBus interface"
-#       depends on PPC_PASEMI && I2C && PCI
-        depends on I2C && PCI
+        depends on PPC_PASEMI && I2C && PCI
         help
           Supports the PA Semi PWRficient on-chip SMBus interfaces.
 
diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
index f54fb5d65cc4..bf89eeef74e9 100644
--- a/drivers/i2c/busses/i2c-pasemi.c
+++ b/drivers/i2c/busses/i2c-pasemi.c
@@ -141,7 +141,7 @@ static int pasemi_i2c_xfer_msg(struct i2c_adapter *adapter,
                 for (i = 0; i < msg->len - 1; i++)
                         TXFIFO_WR(smbus, msg->buf[i]);
 
-                TXFIFO_WR(smbus, msg->buf[msg->len] |
+                TXFIFO_WR(smbus, msg->buf[msg->len-1] |
                           (stop ? MTXFIFO_STOP : 0));
         }
 
@@ -226,7 +226,7 @@ static int pasemi_smb_xfer(struct i2c_adapter *adapter,
                         rd = RXFIFO_RD(smbus);
                         len = min_t(u8, (rd & MRXFIFO_DATA_M),
                                     I2C_SMBUS_BLOCK_MAX);
-                        TXFIFO_WR(smbus, (len + 1) | MTXFIFO_READ |
+                        TXFIFO_WR(smbus, len | MTXFIFO_READ |
                                          MTXFIFO_STOP);
                 } else {
                         len = min_t(u8, data->block[0], I2C_SMBUS_BLOCK_MAX);
@@ -258,7 +258,7 @@ static int pasemi_smb_xfer(struct i2c_adapter *adapter,
                 rd = RXFIFO_RD(smbus);
                 len = min_t(u8, (rd & MRXFIFO_DATA_M),
                             I2C_SMBUS_BLOCK_MAX - len);
-                TXFIFO_WR(smbus, (len + 1) | MTXFIFO_READ | MTXFIFO_STOP);
+                TXFIFO_WR(smbus, len | MTXFIFO_READ | MTXFIFO_STOP);
                 break;
 
         default:
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 8f1fd017679b..5bdf64b77913 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -57,6 +57,7 @@ if IDE
 config IDE_MAX_HWIFS
         int "Max IDE interfaces"
         depends on ALPHA || SUPERH || IA64 || EMBEDDED
+        range 1 10
         default 4
         help
           This is the maximum number of IDE hardware interfaces that will
@@ -103,8 +104,10 @@ config BLK_DEV_IDE_SATA
         ---help---
           There are two drivers for Serial ATA controllers.
 
-          The main driver, "libata", exists inside the SCSI subsystem
-          and supports most modern SATA controllers.
+          The main driver, "libata", uses the SCSI subsystem
+          and supports most modern SATA controllers. In order to use it
+          you may take a look at "Serial ATA (prod) and Parallel ATA
+          (experimental) drivers".
 
           The IDE driver (which you are currently configuring) supports
           a few first-generation SATA controllers.
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 45a928c058cf..638becda81c6 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -735,6 +735,15 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                         cdrom_saw_media_change (drive);
                         /*printk("%s: media changed\n",drive->name);*/
                         return 0;
+                } else if ((sense_key == ILLEGAL_REQUEST) &&
+                           (rq->cmd[0] == GPCMD_START_STOP_UNIT)) {
+                        /*
+                         * Don't print error message for this condition--
+                         * SFF8090i indicates that 5/24/00 is the correct
+                         * response to a request to close the tray if the
+                         * drive doesn't have that capability.
+                         * cdrom_log_sense() knows this!
+                         */
                 } else if (!(rq->cmd_flags & REQ_QUIET)) {
                         /* Otherwise, print an error. */
                         ide_dump_status(drive, "packet command error", stat);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index c193553f6fe7..8670112f1d39 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -519,21 +519,24 @@ static ide_startstop_t ide_ata_error(ide_drive_t *drive, struct request *rq, u8
         if ((stat & DRQ_STAT) && rq_data_dir(rq) == READ && hwif->err_stops_fifo == 0)
                 try_to_flush_leftover_data(drive);
 
+        if (rq->errors >= ERROR_MAX || blk_noretry_request(rq)) {
+                ide_kill_rq(drive, rq);
+                return ide_stopped;
+        }
+
         if (hwif->INB(IDE_STATUS_REG) & (BUSY_STAT|DRQ_STAT))
-                /* force an abort */
-                hwif->OUTB(WIN_IDLEIMMEDIATE, IDE_COMMAND_REG);
+                rq->errors |= ERROR_RESET;
 
-        if (rq->errors >= ERROR_MAX || blk_noretry_request(rq))
-                ide_kill_rq(drive, rq);
-        else {
-                if ((rq->errors & ERROR_RESET) == ERROR_RESET) {
-                        ++rq->errors;
-                        return ide_do_reset(drive);
-                }
-                if ((rq->errors & ERROR_RECAL) == ERROR_RECAL)
-                        drive->special.b.recalibrate = 1;
+        if ((rq->errors & ERROR_RESET) == ERROR_RESET) {
                 ++rq->errors;
+                return ide_do_reset(drive);
         }
+
+        if ((rq->errors & ERROR_RECAL) == ERROR_RECAL)
+                drive->special.b.recalibrate = 1;
+
+        ++rq->errors;
+
         return ide_stopped;
 }
 
@@ -1025,6 +1028,13 @@ static ide_startstop_t start_request (ide_drive_t *drive, struct request *rq)
         if (!drive->special.all) {
                 ide_driver_t *drv;
 
+                /*
+                 * We reset the drive so we need to issue a SETFEATURES.
+                 * Do it _after_ do_special() restored device parameters.
+                 */
+                if (drive->current_speed == 0xff)
+                        ide_config_drive_speed(drive, drive->desired_speed);
+
                 if (rq->cmd_type == REQ_TYPE_ATA_CMD ||
                     rq->cmd_type == REQ_TYPE_ATA_TASK ||
                     rq->cmd_type == REQ_TYPE_ATA_TASKFILE)
@@ -1216,6 +1226,7 @@ static void ide_do_request (ide_hwgroup_t *hwgroup, int masked_irq)
 #endif
                                 /* so that ide_timer_expiry knows what to do */
                                 hwgroup->sleeping = 1;
+                                hwgroup->req_gen_timer = hwgroup->req_gen;
                                 mod_timer(&hwgroup->timer, sleep);
                                 /* we purposely leave hwgroup->busy==1
                                  * while sleeping */
@@ -1401,7 +1412,8 @@ void ide_timer_expiry (unsigned long data)
 
         spin_lock_irqsave(&ide_lock, flags);
 
-        if ((handler = hwgroup->handler) == NULL) {
+        if (((handler = hwgroup->handler) == NULL) ||
+            (hwgroup->req_gen != hwgroup->req_gen_timer)) {
                 /*
                  * Either a marginal timeout occurred
                  * (got the interrupt just as timer expired),
@@ -1429,6 +1441,7 @@ void ide_timer_expiry (unsigned long data)
                                 if ((wait = expiry(drive)) > 0) {
                                         /* reset timer */
                                         hwgroup->timer.expires  = jiffies + wait;
+                                        hwgroup->req_gen_timer = hwgroup->req_gen;
                                         add_timer(&hwgroup->timer);
                                         spin_unlock_irqrestore(&ide_lock, flags);
                                         return;
@@ -1643,6 +1656,7 @@ irqreturn_t ide_intr (int irq, void *dev_id)
                 printk(KERN_ERR "%s: ide_intr: hwgroup->busy was 0 ??\n", drive->name);
         }
         hwgroup->handler = NULL;
+        hwgroup->req_gen++;
         del_timer(&hwgroup->timer);
         spin_unlock(&ide_lock);
 
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index bd513f5a2323..3caa176b3155 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -583,8 +583,12 @@ u8 eighty_ninty_three (ide_drive_t *drive)
         if(!(drive->id->hw_config & 0x4000))
                 return 0;
 #endif /* CONFIG_IDEDMA_IVB */
-        if (!(drive->id->hw_config & 0x2000))
-                return 0;
+        /*
+         * FIXME:
+         * - change master/slave IDENTIFY order
+         * - force bit13 (80c cable present) check
+         *   (unless the slave device is pre-ATA3)
+         */
         return 1;
 }
 
@@ -885,6 +889,7 @@ static void __ide_set_handler (ide_drive_t *drive, ide_handler_t *handler,
         hwgroup->handler        = handler;
         hwgroup->expiry         = expiry;
         hwgroup->timer.expires  = jiffies + timeout;
+        hwgroup->req_gen_timer = hwgroup->req_gen;
         add_timer(&hwgroup->timer);
 }
 
@@ -925,6 +930,7 @@ void ide_execute_command(ide_drive_t *drive, task_ioreg_t cmd, ide_handler_t *ha
         hwgroup->handler        = handler;
         hwgroup->expiry         = expiry;
         hwgroup->timer.expires  = jiffies + timeout;
+        hwgroup->req_gen_timer = hwgroup->req_gen;
         add_timer(&hwgroup->timer);
         hwif->OUTBSYNC(drive, cmd, IDE_COMMAND_REG);
         /* Drive takes 400nS to respond, we must avoid the IRQ being
@@ -1090,6 +1096,9 @@ static void pre_reset(ide_drive_t *drive)
         if (HWIF(drive)->pre_reset != NULL)
                 HWIF(drive)->pre_reset(drive);
 
+        if (drive->current_speed != 0xff)
+                drive->desired_speed = drive->current_speed;
+        drive->current_speed = 0xff;
 }
 
 /*
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 695610f0e3e4..ae5bf2be6f52 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1124,17 +1124,40 @@ static int set_io_32bit(ide_drive_t *drive, int arg)
 static int set_using_dma (ide_drive_t *drive, int arg)
 {
 #ifdef CONFIG_BLK_DEV_IDEDMA
+        ide_hwif_t *hwif = drive->hwif;
+        int err = -EPERM;
+
         if (!drive->id || !(drive->id->capability & 1))
-                return -EPERM;
-        if (HWIF(drive)->ide_dma_check == NULL)
-                return -EPERM;
+                goto out;
+
+        if (hwif->ide_dma_check == NULL)
+                goto out;
+
+        err = -EBUSY;
+        if (ide_spin_wait_hwgroup(drive))
+                goto out;
+        /*
+         * set ->busy flag, unlock and let it ride
+         */
+        hwif->hwgroup->busy = 1;
+        spin_unlock_irq(&ide_lock);
+
+        err = 0;
+
         if (arg) {
-                if (ide_set_dma(drive))
-                        return -EIO;
-                if (HWIF(drive)->ide_dma_on(drive)) return -EIO;
+                if (ide_set_dma(drive) || hwif->ide_dma_on(drive))
+                        err = -EIO;
         } else
                 ide_dma_off(drive);
-        return 0;
+
+        /*
+         * lock, clear ->busy flag and unlock before leaving
+         */
+        spin_lock_irq(&ide_lock);
+        hwif->hwgroup->busy = 0;
+        spin_unlock_irq(&ide_lock);
+out:
+        return err;
 #else
         return -EPERM;
 #endif
@@ -1939,6 +1962,8 @@ static char *media_string(ide_drive_t *drive)
                 return "tape";
         case ide_floppy:
                 return "floppy";
+        case ide_optical:
+                return "optical";
         default:
                 return "UNKNOWN";
         }
diff --git a/drivers/ide/pci/delkin_cb.c b/drivers/ide/pci/delkin_cb.c
index d4b753e70119..dd7ec37fdeab 100644
--- a/drivers/ide/pci/delkin_cb.c
+++ b/drivers/ide/pci/delkin_cb.c
@@ -108,6 +108,7 @@ delkin_cb_remove (struct pci_dev *dev)
 
 static struct pci_device_id delkin_cb_pci_tbl[] __devinitdata = {
         { 0x1145, 0xf021, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { 0x1145, 0xf024, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, delkin_cb_pci_tbl);
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index 60ecdc258c7c..ab6fa271aeb3 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -1,10 +1,10 @@
 /*
- * linux/drivers/ide/pci/hpt366.c               Version 1.01    Dec 23, 2006
+ * linux/drivers/ide/pci/hpt366.c               Version 1.02    Apr 18, 2007
  *
  * Copyright (C) 1999-2003              Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001          Sun Microsystems, Inc.
  * Portions Copyright (C) 2003          Red Hat Inc
- * Portions Copyright (C) 2005-2006     MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2007     MontaVista Software, Inc.
  *
  * Thanks to HighPoint Technologies for their assistance, and hardware.
  * Special Thanks to Jon Burchmore in SanDiego for the deep pockets, his
@@ -494,6 +494,7 @@ static struct hpt_info hpt302n __devinitdata = {
         .chip_type      = HPT302N,
         .max_mode       = HPT302_ALLOW_ATA133_6 ? 4 : 3,
         .dpll_clk       = 77,
+        .settings       = hpt37x_settings
 };
 
 static struct hpt_info hpt371n __devinitdata = {
diff --git a/drivers/ide/pci/pdc202xx_new.c b/drivers/ide/pci/pdc202xx_new.c
index 6ceb25bc5a7b..ace98929cc3d 100644
--- a/drivers/ide/pci/pdc202xx_new.c
+++ b/drivers/ide/pci/pdc202xx_new.c
@@ -255,7 +255,7 @@ static int config_chipset_for_dma(ide_drive_t *drive)
                 printk(KERN_WARNING "%s reduced to Ultra33 mode.\n", drive->name);
         }
 
-        if (drive->media != ide_disk)
+        if (drive->media != ide_disk && drive->media != ide_cdrom)
                 return 0;
 
         if (id->capability & 4) {
@@ -545,6 +545,7 @@ static void __devinit init_hwif_pdc202new(ide_hwif_t *hwif)
 
         hwif->drives[0].autotune = hwif->drives[1].autotune = 1;
 
+        hwif->atapi_dma  = 1;
         hwif->ultra_mask = 0x7f;
         hwif->mwdma_mask = 0x07;
 
diff --git a/drivers/ieee1394/Kconfig b/drivers/ieee1394/Kconfig
index b8a47342cd2c..cd84a55ecf20 100644
--- a/drivers/ieee1394/Kconfig
+++ b/drivers/ieee1394/Kconfig
@@ -138,9 +138,9 @@ config IEEE1394_DV1394
         tristate "OHCI-DV I/O support (deprecated)"
         depends on IEEE1394 && IEEE1394_OHCI1394
         help
-          The dv1394 driver will be removed from Linux in a future release.
-          Its functionality is now provided by raw1394 together with libraries
-          such as libiec61883.
+          The dv1394 driver is unsupported and may be removed from Linux in a
+          future release.  Its functionality is now provided by raw1394 together
+          with libraries such as libiec61883.
 
 config IEEE1394_RAWIO
         tristate "Raw IEEE1394 I/O support"
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index dee9529aa8e7..026e38face5c 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -2564,8 +2564,8 @@ static int __init dv1394_init_module(void)
         int ret;
 
         printk(KERN_WARNING
-               "WARNING: The dv1394 driver is unsupported and will be removed "
-               "from Linux soon. Use raw1394 instead.\n");
+               "NOTE: The dv1394 driver is unsupported and may be removed in a "
+               "future Linux release. Use raw1394 instead.\n");
 
         cdev_init(&dv1394_cdev, &dv1394_fops);
         dv1394_cdev.owner = THIS_MODULE;
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 818cf1aee8c7..f5e9aeec6f6e 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -498,9 +498,9 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
         u64 sge_cmd, ctx0, ctx1;
         u64 base_addr;
         struct t3_modify_qp_wr *wqe;
-        struct sk_buff *skb = alloc_skb(sizeof(*wqe), GFP_KERNEL);
-
+        struct sk_buff *skb;
 
+        skb = alloc_skb(sizeof(*wqe), GFP_KERNEL);
         if (!skb) {
                 PDBG("%s alloc_skb failed\n", __FUNCTION__);
                 return -ENOMEM;
@@ -508,7 +508,7 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
         err = cxio_hal_init_ctrl_cq(rdev_p);
         if (err) {
                 PDBG("%s err %d initializing ctrl_cq\n", __FUNCTION__, err);
-                return err;
+                goto err;
         }
         rdev_p->ctrl_qp.workq = dma_alloc_coherent(
                                         &(rdev_p->rnic_info.pdev->dev),
@@ -518,7 +518,8 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
                                         GFP_KERNEL);
         if (!rdev_p->ctrl_qp.workq) {
                 PDBG("%s dma_alloc_coherent failed\n", __FUNCTION__);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto err;
         }
         pci_unmap_addr_set(&rdev_p->ctrl_qp, mapping,
                            rdev_p->ctrl_qp.dma_addr);
@@ -556,6 +557,9 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
              rdev_p->ctrl_qp.workq, 1 << T3_CTRL_QP_SIZE_LOG2);
         skb->priority = CPL_PRIORITY_CONTROL;
         return (cxgb3_ofld_send(rdev_p->t3cdev_p, skb));
+err:
+        kfree_skb(skb);
+        return err;
 }
 
 static int cxio_hal_destroy_ctrl_qp(struct cxio_rdev *rdev_p)
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index d0ed1d35ca3e..2d2de9b8b729 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -2026,6 +2026,17 @@ static int sched(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         return 0;
 }
 
+static int set_tcb_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct cpl_set_tcb_rpl *rpl = cplhdr(skb);
+
+        if (rpl->status != CPL_ERR_NONE) {
+                printk(KERN_ERR MOD "Unexpected SET_TCB_RPL status %u "
+                       "for tid %u\n", rpl->status, GET_TID(rpl));
+        }
+        return CPL_RET_BUF_DONE;
+}
+
 int __init iwch_cm_init(void)
 {
         skb_queue_head_init(&rxq);
@@ -2053,6 +2064,7 @@ int __init iwch_cm_init(void)
         t3c_handlers[CPL_ABORT_REQ_RSS] = sched;
         t3c_handlers[CPL_RDMA_TERMINATE] = sched;
         t3c_handlers[CPL_RDMA_EC_STATUS] = sched;
+        t3c_handlers[CPL_SET_TCB_RPL] = set_tcb_rpl;
 
         /*
          * These are the real handlers that are called from a
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 8e4846b5c641..ee561c569d5f 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -835,6 +835,7 @@ void mthca_arbel_fmr_unmap(struct mthca_dev *dev, struct mthca_fmr *fmr)
 
         key = arbel_key_to_hw_index(fmr->ibmr.lkey);
         key &= dev->limits.num_mpts - 1;
+        key = adjust_key(dev, key);
         fmr->ibmr.lkey = fmr->ibmr.rkey = arbel_hw_index_to_key(key);
 
         fmr->maps = 0;
@@ -881,8 +882,8 @@ int mthca_init_mr_table(struct mthca_dev *dev)
                 }
                 mpts = mtts = 1 << i;
         } else {
-                mpts = dev->limits.num_mtt_segs;
-                mtts = dev->limits.num_mpts;
+                mtts = dev->limits.num_mtt_segs;
+                mpts = dev->limits.num_mpts;
         }
 
         if (!mthca_is_memfree(dev) &&
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index e70492db74f6..2b242a4823f8 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -131,7 +131,7 @@ static struct sk_buff *ipoib_cm_alloc_rx_skb(struct net_device *dev, int id, int
                 skb_fill_page_desc(skb, i, page, 0, PAGE_SIZE);
 
                 mapping[i + 1] = ib_dma_map_page(priv->ca, skb_shinfo(skb)->frags[i].page,
-                                                 0, PAGE_SIZE, DMA_TO_DEVICE);
+                                                 0, PAGE_SIZE, DMA_FROM_DEVICE);
                 if (unlikely(ib_dma_mapping_error(priv->ca, mapping[i + 1])))
                         goto partial_error;
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 0741c6d1337c..f2a40ae8e7d0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -814,7 +814,7 @@ static void ipoib_set_mcast_list(struct net_device *dev)
         queue_work(ipoib_workqueue, &priv->restart_task);
 }
 
-static void ipoib_neigh_destructor(struct neighbour *n)
+static void ipoib_neigh_cleanup(struct neighbour *n)
 {
         struct ipoib_neigh *neigh;
         struct ipoib_dev_priv *priv = netdev_priv(n->dev);
@@ -822,7 +822,7 @@ static void ipoib_neigh_destructor(struct neighbour *n)
         struct ipoib_ah *ah = NULL;
 
         ipoib_dbg(priv,
-                  "neigh_destructor for %06x " IPOIB_GID_FMT "\n",
+                  "neigh_cleanup for %06x " IPOIB_GID_FMT "\n",
                   IPOIB_QPN(n->ha),
                   IPOIB_GID_RAW_ARG(n->ha + 4));
 
@@ -874,7 +874,7 @@ void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh)
 
 static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms)
 {
-        parms->neigh_destructor = ipoib_neigh_destructor;
+        parms->neigh_cleanup = ipoib_neigh_cleanup;
 
         return 0;
 }
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index cae8c96a55f8..8960196ffb0f 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -245,7 +245,6 @@ struct iser_conn {
         wait_queue_head_t            wait;          /* waitq for conn/disconn  */
         atomic_t                     post_recv_buf_count; /* posted rx count   */
         atomic_t                     post_send_buf_count; /* posted tx count   */
-        struct work_struct           comperror_work; /* conn term sleepable ctx*/
         char                         name[ISER_OBJECT_NAME_SIZE];
         struct iser_page_vec         *page_vec;     /* represents SG to fmr maps*
                                                      * maps serialized as tx is*/
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 89e37283c836..278fcbccc2d9 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -658,6 +658,7 @@ void iser_ctask_rdma_finalize(struct iscsi_iser_cmd_task *iser_ctask)
 {
         int deferred;
         int is_rdma_aligned = 1;
+        struct iser_regd_buf *regd;
 
         /* if we were reading, copy back to unaligned sglist,
          * anyway dma_unmap and free the copy
@@ -672,20 +673,20 @@ void iser_ctask_rdma_finalize(struct iscsi_iser_cmd_task *iser_ctask)
         }
 
         if (iser_ctask->dir[ISER_DIR_IN]) {
-                deferred = iser_regd_buff_release
-                        (&iser_ctask->rdma_regd[ISER_DIR_IN]);
+                regd = &iser_ctask->rdma_regd[ISER_DIR_IN];
+                deferred = iser_regd_buff_release(regd);
                 if (deferred) {
-                        iser_err("References remain for BUF-IN rdma reg\n");
-                        BUG();
+                        iser_err("%d references remain for BUF-IN rdma reg\n",
+                                 atomic_read(&regd->ref_count));
                 }
         }
 
         if (iser_ctask->dir[ISER_DIR_OUT]) {
-                deferred = iser_regd_buff_release
-                        (&iser_ctask->rdma_regd[ISER_DIR_OUT]);
+                regd = &iser_ctask->rdma_regd[ISER_DIR_OUT];
+                deferred = iser_regd_buff_release(regd);
                 if (deferred) {
-                        iser_err("References remain for BUF-OUT rdma reg\n");
-                        BUG();
+                        iser_err("%d references remain for BUF-OUT rdma reg\n",
+                                 atomic_read(&regd->ref_count));
                 }
         }
 
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 693b77002897..1fc967464a28 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -48,7 +48,6 @@
 
 static void iser_cq_tasklet_fn(unsigned long data);
 static void iser_cq_callback(struct ib_cq *cq, void *cq_context);
-static void iser_comp_error_worker(struct work_struct *work);
 
 static void iser_cq_event_callback(struct ib_event *cause, void *context)
 {
@@ -480,7 +479,6 @@ int iser_conn_init(struct iser_conn **ibconn)
         init_waitqueue_head(&ib_conn->wait);
         atomic_set(&ib_conn->post_recv_buf_count, 0);
         atomic_set(&ib_conn->post_send_buf_count, 0);
-        INIT_WORK(&ib_conn->comperror_work, iser_comp_error_worker);
         INIT_LIST_HEAD(&ib_conn->conn_list);
         spin_lock_init(&ib_conn->lock);
 
@@ -753,26 +751,6 @@ int iser_post_send(struct iser_desc *tx_desc)
         return ret_val;
 }
 
-static void iser_comp_error_worker(struct work_struct *work)
-{
-        struct iser_conn *ib_conn =
-                container_of(work, struct iser_conn, comperror_work);
-
-        /* getting here when the state is UP means that the conn is being *
-         * terminated asynchronously from the iSCSI layer's perspective.  */
-        if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
-                                      ISER_CONN_TERMINATING))
-                iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
-                                        ISCSI_ERR_CONN_FAILED);
-
-        /* complete the termination process if disconnect event was delivered *
-         * note there are no more non completed posts to the QP               */
-        if (ib_conn->disc_evt_flag) {
-                ib_conn->state = ISER_CONN_DOWN;
-                wake_up_interruptible(&ib_conn->wait);
-        }
-}
-
 static void iser_handle_comp_error(struct iser_desc *desc)
 {
         struct iser_dto  *dto     = &desc->dto;
@@ -791,8 +769,22 @@ static void iser_handle_comp_error(struct iser_desc *desc)
         }
 
         if (atomic_read(&ib_conn->post_recv_buf_count) == 0 &&
-            atomic_read(&ib_conn->post_send_buf_count) == 0)
-                schedule_work(&ib_conn->comperror_work);
+            atomic_read(&ib_conn->post_send_buf_count) == 0) {
+                /* getting here when the state is UP means that the conn is *
+                 * being terminated asynchronously from the iSCSI layer's   *
+                 * perspective.                                             */
+                if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
+                    ISER_CONN_TERMINATING))
+                        iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
+                                           ISCSI_ERR_CONN_FAILED);
+
+                /* complete the termination process if disconnect event was delivered *
+                 * note there are no more non completed posts to the QP               */
+                if (ib_conn->disc_evt_flag) {
+                        ib_conn->state = ISER_CONN_DOWN;
+                        wake_up_interruptible(&ib_conn->wait);
+                }
+        }
 }
 
 static void iser_cq_tasklet_fn(unsigned long data)
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index c7db4032ef02..e8606c48c9c3 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -553,6 +553,7 @@ static int ucb1400_ts_remove(struct device *dev)
 }
 
 static struct device_driver ucb1400_ts_driver = {
+        .name           = "ucb1400_ts",
         .owner          = THIS_MODULE,
         .bus            = &ac97_bus_type,
         .probe          = ucb1400_ts_probe,
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 63e51dd6debe..00e31609a238 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -54,7 +54,7 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define USB_SX353_PRODUCT_ID    0x0022
 
 /* table of devices that work with this driver */
-static struct usb_device_id gigaset_table [] = {
+static const struct usb_device_id gigaset_table [] = {
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3070_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3075_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
@@ -2305,7 +2305,7 @@ static void gigaset_disconnect(struct usb_interface *interface)
         gigaset_unassign(cs);
 }
 
-static struct gigaset_ops gigops = {
+static const struct gigaset_ops gigops = {
         gigaset_write_cmd,
         gigaset_write_room,
         gigaset_chars_in_buffer,
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index b460a73a7c85..6df336bdd571 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -944,8 +944,8 @@ static DEFINE_SPINLOCK(driver_lock);
 struct cardstate *gigaset_get_cs_by_id(int id)
 {
         unsigned long flags;
-        static struct cardstate *ret = NULL;
-        static struct cardstate *cs;
+        struct cardstate *ret = NULL;
+        struct cardstate *cs;
         struct gigaset_driver *drv;
         unsigned i;
 
@@ -999,7 +999,7 @@ void gigaset_debugdrivers(void)
 static struct cardstate *gigaset_get_cs_by_minor(unsigned minor)
 {
         unsigned long flags;
-        static struct cardstate *ret = NULL;
+        struct cardstate *ret = NULL;
         struct gigaset_driver *drv;
         unsigned index;
 
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 4661e2c722bc..cec1ef342fcc 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -409,7 +409,7 @@ static struct reply_t tab_cid[] = /* no dle mode */ //FIXME
 };
 #endif
 
-static struct resp_type_t resp_type[]=
+static const struct resp_type_t resp_type[] =
 {
         /*{"",          RSP_EMPTY,      RT_NOTHING},*/
         {"OK",          RSP_OK,         RT_NOTHING},
@@ -511,7 +511,7 @@ void gigaset_handle_modem_response(struct cardstate *cs)
         unsigned char *argv[MAX_REC_PARAMS + 1];
         int params;
         int i, j;
-        struct resp_type_t *rt;
+        const struct resp_type_t *rt;
         int curarg;
         unsigned long flags;
         unsigned next, tail, head;
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 8c0eb522dab1..e0505f238807 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -274,7 +274,7 @@ static inline void dump_bytes(enum debuglevel level, const char *tag,
  *        bit 12..10 = number of trailing '1' bits in result
  *        bit 14..13 = number of bits added by stuffing
  */
-static u16 stufftab[5 * 256] = {
+static const u16 stufftab[5 * 256] = {
 // previous 1s = 0:
  0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, 0x0008, 0x0009, 0x000a, 0x000b, 0x000c, 0x000d, 0x000e, 0x000f,
  0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017, 0x0018, 0x0019, 0x001a, 0x001b, 0x001c, 0x001d, 0x001e, 0x201f,
@@ -629,7 +629,7 @@ static inline void hdlc_frag(struct bc_state *bcs, unsigned inbits)
  *                   (replacing 8 by 7 to make it fit; the algorithm won't care)
  *        bit 7 set if there are 5 or more "interior" consecutive '1' bits
  */
-static unsigned char bitcounts[256] = {
+static const unsigned char bitcounts[256] = {
   0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x04,
   0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x05,
   0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x03, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x04,
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index c8b7db65e48f..ea44302e6e7e 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -459,7 +459,7 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
         return -EINVAL;
 }
 
-static struct gigaset_ops ops = {
+static const struct gigaset_ops ops = {
         gigaset_write_cmd,
         gigaset_write_room,
         gigaset_chars_in_buffer,
diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
index 04f2ad7ba8b0..2baef349c12d 100644
--- a/drivers/isdn/gigaset/usb-gigaset.c
+++ b/drivers/isdn/gigaset/usb-gigaset.c
@@ -50,7 +50,7 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define USB_M105_PRODUCT_ID     0x0009
 
 /* table of devices that work with this driver */
-static struct usb_device_id gigaset_table [] = {
+static const struct usb_device_id gigaset_table [] = {
         { USB_DEVICE(USB_M105_VENDOR_ID, USB_M105_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
@@ -860,7 +860,7 @@ static void gigaset_disconnect(struct usb_interface *interface)
         gigaset_unassign(cs);
 }
 
-static struct gigaset_ops ops = {
+static const struct gigaset_ops ops = {
         gigaset_write_cmd,
         gigaset_write_room,
         gigaset_chars_in_buffer,
diff --git a/drivers/isdn/hisax/isar.c b/drivers/isdn/hisax/isar.c
index 9df9e3548cf1..c547a6665052 100644
--- a/drivers/isdn/hisax/isar.c
+++ b/drivers/isdn/hisax/isar.c
@@ -440,7 +440,7 @@ isar_bh(struct work_struct *work)
 {
         struct BCState *bcs = container_of(work, struct BCState, tqueue);
 
-        BChannel_bh(bcs);
+        BChannel_bh(work);
         if (test_and_clear_bit(B_LL_NOCARRIER, &bcs->event))
                 ll_deliver_faxstat(bcs, ISDN_FAX_CLASS1_NOCARR);
         if (test_and_clear_bit(B_LL_CONNECT, &bcs->event))
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index e85b4c7c36f7..cab26f301eab 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -1171,6 +1171,7 @@ void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)
                          * and zap two pdes instead of one.
                          */
                         if (level == PT32_ROOT_LEVEL) {
+                                page_offset &= ~7; /* kill rounding error */
                                 page_offset <<= 1;
                                 npte = 2;
                         }
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index bfa0ce42ea92..fbbf9d6b299f 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -618,7 +618,7 @@ static void fix_pmode_dataseg(int seg, struct kvm_save_segment *save)
 {
         struct kvm_vmx_segment_field *sf = &kvm_vmx_segment_fields[seg];
 
-        if (vmcs_readl(sf->base) == save->base) {
+        if (vmcs_readl(sf->base) == save->base && (save->base & AR_S_MASK)) {
                 vmcs_write16(sf->selector, save->selector);
                 vmcs_writel(sf->base, save->base);
                 vmcs_write32(sf->limit, save->limit);
@@ -1888,6 +1888,27 @@ again:
                 [cr2]"i"(offsetof(struct kvm_vcpu, cr2))
               : "cc", "memory" );
 
+        /*
+         * Reload segment selectors ASAP. (it's needed for a functional
+         * kernel: x86 relies on having __KERNEL_PDA in %fs and x86_64
+         * relies on having 0 in %gs for the CPU PDA to work.)
+         */
+        if (fs_gs_ldt_reload_needed) {
+                load_ldt(ldt_sel);
+                load_fs(fs_sel);
+                /*
+                 * If we have to reload gs, we must take care to
+                 * preserve our gs base.
+                 */
+                local_irq_disable();
+                load_gs(gs_sel);
+#ifdef CONFIG_X86_64
+                wrmsrl(MSR_GS_BASE, vmcs_readl(HOST_GS_BASE));
+#endif
+                local_irq_enable();
+
+                reload_tss();
+        }
         ++kvm_stat.exits;
 
         save_msrs(vcpu->guest_msrs, NR_BAD_MSRS);
@@ -1905,22 +1926,6 @@ again:
                 kvm_run->exit_reason = vmcs_read32(VM_INSTRUCTION_ERROR);
                 r = 0;
         } else {
-                if (fs_gs_ldt_reload_needed) {
-                        load_ldt(ldt_sel);
-                        load_fs(fs_sel);
-                        /*
-                         * If we have to reload gs, we must take care to
-                         * preserve our gs base.
-                         */
-                        local_irq_disable();
-                        load_gs(gs_sel);
-#ifdef CONFIG_X86_64
-                        wrmsrl(MSR_GS_BASE, vmcs_readl(HOST_GS_BASE));
-#endif
-                        local_irq_enable();
-
-                        reload_tss();
-                }
                 /*
                  * Profile KVM exit RIPs:
                  */
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index 3096836d8bd3..c9f3dc4fd3ee 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -1259,9 +1259,9 @@ static int smu_release(struct inode *inode, struct file *file)
                         set_current_state(TASK_UNINTERRUPTIBLE);
                         if (pp->cmd.status != 1)
                                 break;
-                        spin_lock_irqsave(&pp->lock, flags);
-                        schedule();
                         spin_unlock_irqrestore(&pp->lock, flags);
+                        schedule();
+                        spin_lock_irqsave(&pp->lock, flags);
                 }
                 set_current_state(TASK_RUNNING);
                 remove_wait_queue(&pp->wait, &wait);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 5554adaa58f9..e61e0efe9ec7 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -863,9 +863,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 
         /* We need 4 bits per page, rounded up to a multiple of sizeof(unsigned long) */
         bitmap->filemap_attr = kzalloc(
-                (((num_pages*4/8)+sizeof(unsigned long)-1)
-                 /sizeof(unsigned long))
-                *sizeof(unsigned long),
+                roundup( DIV_ROUND_UP(num_pages*4, 8), sizeof(unsigned long)),
                 GFP_KERNEL);
         if (!bitmap->filemap_attr)
                 goto out;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6c06e825cff5..509171ca7fa8 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1318,6 +1318,7 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
         char b[BDEVNAME_SIZE];
         struct kobject *ko;
         char *s;
+        int err;
 
         if (rdev->mddev) {
                 MD_BUG();
@@ -1352,20 +1353,35 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
         while ( (s=strchr(rdev->kobj.k_name, '/')) != NULL)
                 *s = '!';
                         
-        list_add(&rdev->same_set, &mddev->disks);
         rdev->mddev = mddev;
         printk(KERN_INFO "md: bind<%s>\n", b);
 
         rdev->kobj.parent = &mddev->kobj;
-        kobject_add(&rdev->kobj);
+        if ((err = kobject_add(&rdev->kobj)))
+                goto fail;
 
         if (rdev->bdev->bd_part)
                 ko = &rdev->bdev->bd_part->kobj;
         else
                 ko = &rdev->bdev->bd_disk->kobj;
-        sysfs_create_link(&rdev->kobj, ko, "block");
+        if ((err = sysfs_create_link(&rdev->kobj, ko, "block"))) {
+                kobject_del(&rdev->kobj);
+                goto fail;
+        }
+        list_add(&rdev->same_set, &mddev->disks);
         bd_claim_by_disk(rdev->bdev, rdev, mddev->gendisk);
         return 0;
+
+ fail:
+        printk(KERN_WARNING "md: failed to register dev-%s for %s\n",
+               b, mdname(mddev));
+        return err;
+}
+
+static void delayed_delete(struct work_struct *ws)
+{
+        mdk_rdev_t *rdev = container_of(ws, mdk_rdev_t, del_work);
+        kobject_del(&rdev->kobj);
 }
 
 static void unbind_rdev_from_array(mdk_rdev_t * rdev)
@@ -1380,7 +1396,12 @@ static void unbind_rdev_from_array(mdk_rdev_t * rdev)
         printk(KERN_INFO "md: unbind<%s>\n", bdevname(rdev->bdev,b));
         rdev->mddev = NULL;
         sysfs_remove_link(&rdev->kobj, "block");
-        kobject_del(&rdev->kobj);
+
+        /* We need to delay this, otherwise we can deadlock when
+         * writing to 'remove' to "dev/state"
+         */
+        INIT_WORK(&rdev->del_work, delayed_delete);
+        schedule_work(&rdev->del_work);
 }
 
 /*
@@ -2966,7 +2987,9 @@ static struct kobject *md_probe(dev_t dev, int *part, void *data)
         mddev->kobj.k_name = NULL;
         snprintf(mddev->kobj.name, KOBJ_NAME_LEN, "%s", "md");
         mddev->kobj.ktype = &md_ktype;
-        kobject_register(&mddev->kobj);
+        if (kobject_register(&mddev->kobj))
+                printk(KERN_WARNING "md: cannot register %s/md - name in use\n",
+                       disk->disk_name);
         return NULL;
 }
 
@@ -3144,9 +3167,12 @@ static int do_md_run(mddev_t * mddev)
                 bitmap_destroy(mddev);
                 return err;
         }
-        if (mddev->pers->sync_request)
-                sysfs_create_group(&mddev->kobj, &md_redundancy_group);
-        else if (mddev->ro == 2) /* auto-readonly not meaningful */
+        if (mddev->pers->sync_request) {
+                if (sysfs_create_group(&mddev->kobj, &md_redundancy_group))
+                        printk(KERN_WARNING
+                               "md: cannot register extra attributes for %s\n",
+                               mdname(mddev));
+        } else if (mddev->ro == 2) /* auto-readonly not meaningful */
                 mddev->ro = 0;
 
         atomic_set(&mddev->writes_pending,0);
@@ -3160,7 +3186,9 @@ static int do_md_run(mddev_t * mddev)
                 if (rdev->raid_disk >= 0) {
                         char nm[20];
                         sprintf(nm, "rd%d", rdev->raid_disk);
-                        sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
+                        if (sysfs_create_link(&mddev->kobj, &rdev->kobj, nm))
+                                printk("md: cannot register %s for %s\n",
+                                       nm, mdname(mddev));
                 }
         
         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
@@ -3325,6 +3353,7 @@ static int do_md_stop(mddev_t * mddev, int mode)
                         mddev->queue->merge_bvec_fn = NULL;
                         mddev->queue->unplug_fn = NULL;
                         mddev->queue->issue_flush_fn = NULL;
+                        mddev->queue->backing_dev_info.congested_fn = NULL;
                         if (mddev->pers->sync_request)
                                 sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
 
@@ -3371,6 +3400,9 @@ static int do_md_stop(mddev_t * mddev, int mode)
                                 sysfs_remove_link(&mddev->kobj, nm);
                         }
 
+                /* make sure all delayed_delete calls have finished */
+                flush_scheduled_work();
+
                 export_array(mddev);
 
                 mddev->array_size = 0;
@@ -5385,8 +5417,12 @@ static int remove_and_add_spares(mddev_t *mddev)
                                 if (mddev->pers->hot_add_disk(mddev,rdev)) {
                                         char nm[20];
                                         sprintf(nm, "rd%d", rdev->raid_disk);
-                                        sysfs_create_link(&mddev->kobj,
-                                                          &rdev->kobj, nm);
+                                        if (sysfs_create_link(&mddev->kobj,
+                                                              &rdev->kobj, nm))
+                                                printk(KERN_WARNING
+                                                       "md: cannot register "
+                                                       "%s for %s\n",
+                                                       nm, mdname(mddev));
                                         spares++;
                                         md_new_event(mddev);
                                 } else
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 54a1ad5eef42..8d59914f2057 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3642,12 +3642,15 @@ static int run(mddev_t *mddev)
         }
 
         /* Ok, everything is just fine now */
-        sysfs_create_group(&mddev->kobj, &raid5_attrs_group);
+        if (sysfs_create_group(&mddev->kobj, &raid5_attrs_group))
+                printk(KERN_WARNING
+                       "raid5: failed to create sysfs attributes for %s\n",
+                       mdname(mddev));
 
         mddev->queue->unplug_fn = raid5_unplug_device;
         mddev->queue->issue_flush_fn = raid5_issue_flush;
-        mddev->queue->backing_dev_info.congested_fn = raid5_congested;
         mddev->queue->backing_dev_info.congested_data = mddev;
+        mddev->queue->backing_dev_info.congested_fn = raid5_congested;
 
         mddev->array_size =  mddev->size * (conf->previous_raid_disks -
                                             conf->max_degraded);
@@ -3678,6 +3681,7 @@ static int stop(mddev_t *mddev)
         mddev->thread = NULL;
         shrink_stripes(conf);
         kfree(conf->stripe_hashtbl);
+        mddev->queue->backing_dev_info.congested_fn = NULL;
         blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
         sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
         kfree(conf->disks);
@@ -3950,7 +3954,12 @@ static int raid5_start_reshape(mddev_t *mddev)
                                 added_devices++;
                                 rdev->recovery_offset = 0;
                                 sprintf(nm, "rd%d", rdev->raid_disk);
-                                sysfs_create_link(&mddev->kobj, &rdev->kobj, nm);
+                                if (sysfs_create_link(&mddev->kobj,
+                                                      &rdev->kobj, nm))
+                                        printk(KERN_WARNING
+                                               "raid5: failed to create "
+                                               " link %s for %s\n",
+                                               nm, mdname(mddev));
                         } else
                                 break;
                 }
@@ -4104,6 +4113,10 @@ static struct mdk_personality raid4_personality =
         .spare_active   = raid5_spare_active,
         .sync_request   = sync_request,
         .resize         = raid5_resize,
+#ifdef CONFIG_MD_RAID5_RESHAPE
+        .check_reshape  = raid5_check_reshape,
+        .start_reshape  = raid5_start_reshape,
+#endif
         .quiesce        = raid5_quiesce,
 };
 
diff --git a/drivers/media/common/ir-functions.c b/drivers/media/common/ir-functions.c
index cbf7c0564889..fcb194135627 100644
--- a/drivers/media/common/ir-functions.c
+++ b/drivers/media/common/ir-functions.c
@@ -310,13 +310,15 @@ void ir_rc5_timer_end(unsigned long data)
                     tv.tv_usec - ir->base_time.tv_usec;
         }
 
-        /* Allow some timmer jitter (RC5 is ~24ms anyway so this is ok) */
+        /* signal we're ready to start a new code */
+        ir->active = 0;
+
+        /* Allow some timer jitter (RC5 is ~24ms anyway so this is ok) */
         if (gap < 28000) {
                 dprintk(1, "ir-common: spurious timer_end\n");
                 return;
         }
 
-        ir->active = 0;
         if (ir->last_bit < 20) {
                 /* ignore spurious codes (caused by light/other remotes) */
                 dprintk(1, "ir-common: short code: %x\n", ir->code);
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index fc77de45ca4d..a5c0e1a3e6d1 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -180,8 +180,7 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
         struct dvb_device *dvbdev = file->private_data;
         struct dmxdev *dmxdev = dvbdev->priv;
 
-        if (mutex_lock_interruptible(&dmxdev->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dmxdev->mutex);
 
         if ((file->f_flags & O_ACCMODE) == O_WRONLY) {
                 dmxdev->demux->disconnect_frontend(dmxdev->demux);
@@ -673,13 +672,8 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
 static int dvb_dmxdev_filter_free(struct dmxdev *dmxdev,
                                   struct dmxdev_filter *dmxdevfilter)
 {
-        if (mutex_lock_interruptible(&dmxdev->mutex))
-                return -ERESTARTSYS;
-
-        if (mutex_lock_interruptible(&dmxdevfilter->mutex)) {
-                mutex_unlock(&dmxdev->mutex);
-                return -ERESTARTSYS;
-        }
+        mutex_lock(&dmxdev->mutex);
+        mutex_lock(&dmxdevfilter->mutex);
 
         dvb_dmxdev_filter_stop(dmxdevfilter);
         dvb_dmxdev_filter_reset(dmxdevfilter);
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index fcff5eab21a3..6d8d1c3df863 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -673,8 +673,7 @@ static int dmx_ts_feed_stop_filtering(struct dmx_ts_feed *ts_feed)
         struct dvb_demux *demux = feed->demux;
         int ret;
 
-        if (mutex_lock_interruptible(&demux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&demux->mutex);
 
         if (feed->state < DMX_STATE_GO) {
                 mutex_unlock(&demux->mutex);
@@ -748,8 +747,7 @@ static int dvbdmx_release_ts_feed(struct dmx_demux *dmx,
         struct dvb_demux *demux = (struct dvb_demux *)dmx;
         struct dvb_demux_feed *feed = (struct dvb_demux_feed *)ts_feed;
 
-        if (mutex_lock_interruptible(&demux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&demux->mutex);
 
         if (feed->state == DMX_STATE_FREE) {
                 mutex_unlock(&demux->mutex);
@@ -916,8 +914,7 @@ static int dmx_section_feed_stop_filtering(struct dmx_section_feed *feed)
         struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
         int ret;
 
-        if (mutex_lock_interruptible(&dvbdmx->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdmx->mutex);
 
         if (!dvbdmx->stop_feed) {
                 mutex_unlock(&dvbdmx->mutex);
@@ -942,8 +939,7 @@ static int dmx_section_feed_release_filter(struct dmx_section_feed *feed,
         struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
         struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
 
-        if (mutex_lock_interruptible(&dvbdmx->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdmx->mutex);
 
         if (dvbdmxfilter->feed != dvbdmxfeed) {
                 mutex_unlock(&dvbdmx->mutex);
@@ -1016,8 +1012,7 @@ static int dvbdmx_release_section_feed(struct dmx_demux *demux,
         struct dvb_demux_feed *dvbdmxfeed = (struct dvb_demux_feed *)feed;
         struct dvb_demux *dvbdmx = (struct dvb_demux *)demux;
 
-        if (mutex_lock_interruptible(&dvbdmx->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdmx->mutex);
 
         if (dvbdmxfeed->state == DMX_STATE_FREE) {
                 mutex_unlock(&dvbdmx->mutex);
@@ -1126,8 +1121,7 @@ static int dvbdmx_connect_frontend(struct dmx_demux *demux,
         if (demux->frontend)
                 return -EINVAL;
 
-        if (mutex_lock_interruptible(&dvbdemux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdemux->mutex);
 
         demux->frontend = frontend;
         mutex_unlock(&dvbdemux->mutex);
@@ -1138,8 +1132,7 @@ static int dvbdmx_disconnect_frontend(struct dmx_demux *demux)
 {
         struct dvb_demux *dvbdemux = (struct dvb_demux *)demux;
 
-        if (mutex_lock_interruptible(&dvbdemux->mutex))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdemux->mutex);
 
         demux->frontend = NULL;
         mutex_unlock(&dvbdemux->mutex);
diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
index 490337b5ee3e..14a372a0fe8b 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.c
+++ b/drivers/media/dvb/dvb-core/dvbdev.c
@@ -203,8 +203,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
 
         int id;
 
-        if (mutex_lock_interruptible(&dvbdev_register_lock))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdev_register_lock);
 
         if ((id = dvbdev_get_free_id (adap, type)) < 0){
                 mutex_unlock(&dvbdev_register_lock);
@@ -294,8 +293,7 @@ int dvb_register_adapter(struct dvb_adapter *adap, const char *name, struct modu
 {
         int num;
 
-        if (mutex_lock_interruptible(&dvbdev_register_lock))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdev_register_lock);
 
         if ((num = dvbdev_get_free_adapter_num ()) < 0) {
                 mutex_unlock(&dvbdev_register_lock);
@@ -323,8 +321,7 @@ EXPORT_SYMBOL(dvb_register_adapter);
 
 int dvb_unregister_adapter(struct dvb_adapter *adap)
 {
-        if (mutex_lock_interruptible(&dvbdev_register_lock))
-                return -ERESTARTSYS;
+        mutex_lock(&dvbdev_register_lock);
         list_del (&adap->list_head);
         mutex_unlock(&dvbdev_register_lock);
         return 0;
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-remote.c b/drivers/media/dvb/dvb-usb/dvb-usb-remote.c
index 9511a31c8f50..68ed3a788083 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-remote.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-remote.c
@@ -107,8 +107,6 @@ int dvb_usb_remote_init(struct dvb_usb_device *d)
                 return -ENOMEM;
 
         input_dev->evbit[0] = BIT(EV_KEY);
-        input_dev->keycodesize = sizeof(unsigned char);
-        input_dev->keycodemax = KEY_MAX;
         input_dev->name = "IR-receiver inside an USB DVB receiver";
         input_dev->phys = d->rc_phys;
         usb_to_input_id(d->udev, &input_dev->id);
diff --git a/drivers/media/dvb/frontends/isl6421.c b/drivers/media/dvb/frontends/isl6421.c
index ef319369ec26..c967148a5945 100644
--- a/drivers/media/dvb/frontends/isl6421.c
+++ b/drivers/media/dvb/frontends/isl6421.c
@@ -122,6 +122,7 @@ struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter
         /* detect if it is present or not */
         if (isl6421_set_voltage(fe, SEC_VOLTAGE_OFF)) {
                 kfree(isl6421);
+                fe->sec_priv = NULL;
                 return NULL;
         }
 
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index 4c27a2d90a38..ccc429cbbad0 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -212,7 +212,7 @@ static int tda10086_send_master_cmd (struct dvb_frontend* fe,
         for(i=0; i< cmd->msg_len; i++) {
                 tda10086_write_byte(state, 0x48+i, cmd->msg[i]);
         }
-        tda10086_write_byte(state, 0x36, 0x08 | ((cmd->msg_len + 1) << 4));
+        tda10086_write_byte(state, 0x36, 0x08 | ((cmd->msg_len - 1) << 4));
 
         tda10086_diseqc_wait(state);
 
diff --git a/drivers/media/dvb/pluto2/pluto2.c b/drivers/media/dvb/pluto2/pluto2.c
index ffda71dfdd65..058df5c10034 100644
--- a/drivers/media/dvb/pluto2/pluto2.c
+++ b/drivers/media/dvb/pluto2/pluto2.c
@@ -149,6 +149,15 @@ static inline void pluto_rw(struct pluto *pluto, u32 reg, u32 mask, u32 bits)
         writel(val, &pluto->io_mem[reg]);
 }
 
+static void pluto_write_tscr(struct pluto *pluto, u32 val)
+{
+        /* set the number of packets */
+        val &= ~TSCR_ADEF;
+        val |= TS_DMA_PACKETS / 2;
+
+        pluto_writereg(pluto, REG_TSCR, val);
+}
+
 static void pluto_setsda(void *data, int state)
 {
         struct pluto *pluto = data;
@@ -213,11 +222,11 @@ static void pluto_reset_ts(struct pluto *pluto, int reenable)
 
         if (val & TSCR_RSTN) {
                 val &= ~TSCR_RSTN;
-                pluto_writereg(pluto, REG_TSCR, val);
+                pluto_write_tscr(pluto, val);
         }
         if (reenable) {
                 val |= TSCR_RSTN;
-                pluto_writereg(pluto, REG_TSCR, val);
+                pluto_write_tscr(pluto, val);
         }
 }
 
@@ -339,7 +348,7 @@ static irqreturn_t pluto_irq(int irq, void *dev_id)
         }
 
         /* ACK the interrupt */
-        pluto_writereg(pluto, REG_TSCR, tscr | TSCR_IACK);
+        pluto_write_tscr(pluto, tscr | TSCR_IACK);
 
         return IRQ_HANDLED;
 }
@@ -348,9 +357,6 @@ static void __devinit pluto_enable_irqs(struct pluto *pluto)
 {
         u32 val = pluto_readreg(pluto, REG_TSCR);
 
-        /* set the number of packets */
-        val &= ~TSCR_ADEF;
-        val |= TS_DMA_PACKETS / 2;
         /* disable AFUL and LOCK interrupts */
         val |= (TSCR_MSKA | TSCR_MSKL);
         /* enable DMA and OVERFLOW interrupts */
@@ -358,7 +364,7 @@ static void __devinit pluto_enable_irqs(struct pluto *pluto)
         /* clear pending interrupts */
         val |= TSCR_IACK;
 
-        pluto_writereg(pluto, REG_TSCR, val);
+        pluto_write_tscr(pluto, val);
 }
 
 static void pluto_disable_irqs(struct pluto *pluto)
@@ -370,7 +376,7 @@ static void pluto_disable_irqs(struct pluto *pluto)
         /* clear pending interrupts */
         val |= TSCR_IACK;
 
-        pluto_writereg(pluto, REG_TSCR, val);
+        pluto_write_tscr(pluto, val);
 }
 
 static int __devinit pluto_hw_init(struct pluto *pluto)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index 920b63f8cf05..af66a5d5ecd8 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -3,7 +3,7 @@
 #
 
 menu "Radio Adapters"
-        depends on VIDEO_DEV!=n
+        depends on VIDEO_DEV
 
 config RADIO_CADET
         tristate "ADS Cadet AM/FM Tuner"
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 7a6105153f23..ff6aefde10df 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -577,14 +577,14 @@ config VIDEO_ZORAN_AVS6EYES
 
 config VIDEO_MEYE
         tristate "Sony Vaio Picturebook Motion Eye Video For Linux"
-        depends on PCI && SONYPI && VIDEO_V4L1
+        depends on PCI && SONY_LAPTOP && VIDEO_V4L1
         ---help---
           This is the video4linux driver for the Motion Eye camera found
           in the Vaio Picturebook laptops. Please read the material in
           <file:Documentation/video4linux/meye.txt> for more information.
 
-          If you say Y or M here, you need to say Y or M to "Sony Programmable
-          I/O Control Device" in the character device section.
+          If you say Y or M here, you need to say Y or M to "Sony Laptop
+          Extras" in the misc device section.
 
           To compile this driver as a module, choose M here: the
           module will be called meye.
diff --git a/drivers/media/video/meye.c b/drivers/media/video/meye.c
index 98681da5e3b9..664aba8b4d85 100644
--- a/drivers/media/video/meye.c
+++ b/drivers/media/video/meye.c
@@ -925,13 +925,13 @@ static int meye_do_ioctl(struct inode *inode, struct file *file,
                 if (p->palette != VIDEO_PALETTE_YUV422 && p->palette != VIDEO_PALETTE_YUYV)
                         return -EINVAL;
                 mutex_lock(&meye.lock);
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERABRIGHTNESS,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERABRIGHTNESS,
                                       p->brightness >> 10);
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERAHUE,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERAHUE,
                                       p->hue >> 10);
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERACOLOR,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERACOLOR,
                                       p->colour >> 10);
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERACONTRAST,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERACONTRAST,
                                       p->contrast >> 10);
                 meye.picture = *p;
                 mutex_unlock(&meye.lock);
@@ -1043,11 +1043,11 @@ static int meye_do_ioctl(struct inode *inode, struct file *file,
                     meye.params.quality != jp->quality)
                         mchip_hic_stop();       /* need restart */
                 meye.params = *jp;
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERASHARPNESS,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERASHARPNESS,
                                       meye.params.sharpness);
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERAAGC,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERAAGC,
                                       meye.params.agc);
-                sonypi_camera_command(SONYPI_COMMAND_SETCAMERAPICTURE,
+                sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERAPICTURE,
                                       meye.params.picture);
                 mutex_unlock(&meye.lock);
                 break;
@@ -1287,38 +1287,38 @@ static int meye_do_ioctl(struct inode *inode, struct file *file,
                 mutex_lock(&meye.lock);
                 switch (c->id) {
                 case V4L2_CID_BRIGHTNESS:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERABRIGHTNESS, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERABRIGHTNESS, c->value);
                         meye.picture.brightness = c->value << 10;
                         break;
                 case V4L2_CID_HUE:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERAHUE, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERAHUE, c->value);
                         meye.picture.hue = c->value << 10;
                         break;
                 case V4L2_CID_CONTRAST:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERACONTRAST, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERACONTRAST, c->value);
                         meye.picture.contrast = c->value << 10;
                         break;
                 case V4L2_CID_SATURATION:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERACOLOR, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERACOLOR, c->value);
                         meye.picture.colour = c->value << 10;
                         break;
                 case V4L2_CID_AGC:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERAAGC, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERAAGC, c->value);
                         meye.params.agc = c->value;
                         break;
                 case V4L2_CID_SHARPNESS:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERASHARPNESS, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERASHARPNESS, c->value);
                         meye.params.sharpness = c->value;
                         break;
                 case V4L2_CID_PICTURE:
-                        sonypi_camera_command(
-                                SONYPI_COMMAND_SETCAMERAPICTURE, c->value);
+                        sony_pic_camera_command(
+                                SONY_PIC_COMMAND_SETCAMERAPICTURE, c->value);
                         meye.params.picture = c->value;
                         break;
                 case V4L2_CID_JPEGQUAL:
@@ -1848,7 +1848,7 @@ static int __devinit meye_probe(struct pci_dev *pcidev,
         memcpy(meye.video_dev, &meye_template, sizeof(meye_template));
         meye.video_dev->dev = &meye.mchip_dev->dev;
 
-        if ((ret = sonypi_camera_command(SONYPI_COMMAND_SETCAMERA, 1))) {
+        if ((ret = sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERA, 1))) {
                 printk(KERN_ERR "meye: unable to power on the camera\n");
                 printk(KERN_ERR "meye: did you enable the camera in "
                                 "sonypi using the module options ?\n");
@@ -1928,13 +1928,13 @@ static int __devinit meye_probe(struct pci_dev *pcidev,
         meye.params.picture = 0;
         meye.params.framerate = 0;
 
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERABRIGHTNESS, 32);
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERAHUE, 32);
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERACOLOR, 32);
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERACONTRAST, 32);
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERASHARPNESS, 32);
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERAPICTURE, 0);
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERAAGC, 48);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERABRIGHTNESS, 32);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERAHUE, 32);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERACOLOR, 32);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERACONTRAST, 32);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERASHARPNESS, 32);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERAPICTURE, 0);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERAAGC, 48);
 
         printk(KERN_INFO "meye: Motion Eye Camera Driver v%s.\n",
                MEYE_DRIVER_VERSION);
@@ -1953,7 +1953,7 @@ outremap:
 outregions:
         pci_disable_device(meye.mchip_dev);
 outenabledev:
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERA, 0);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERA, 0);
 outsonypienable:
         kfifo_free(meye.doneq);
 outkfifoalloc2:
@@ -1986,7 +1986,7 @@ static void __devexit meye_remove(struct pci_dev *pcidev)
 
         pci_disable_device(meye.mchip_dev);
 
-        sonypi_camera_command(SONYPI_COMMAND_SETCAMERA, 0);
+        sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERA, 0);
 
         kfifo_free(meye.doneq);
         kfifo_free(meye.grabq);
diff --git a/drivers/media/video/meye.h b/drivers/media/video/meye.h
index ea107cb5c845..323d0074120d 100644
--- a/drivers/media/video/meye.h
+++ b/drivers/media/video/meye.h
@@ -255,7 +255,7 @@
 /****************************************************************************/
 
 /* Sony Programmable I/O Controller for accessing the camera commands */
-#include <linux/sonypi.h>
+#include <linux/sony-laptop.h>
 
 /* private API definitions */
 #include <linux/meye.h>
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index 2fb9fe6a1ae7..ba1af3c8525e 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -780,18 +780,16 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
         return 0;
 }
 
-static int msp_suspend(struct device * dev, pm_message_t state)
+static int msp_suspend(struct i2c_client *client, pm_message_t state)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
 
         v4l_dbg(1, msp_debug, client, "suspend\n");
         msp_reset(client);
         return 0;
 }
 
-static int msp_resume(struct device * dev)
+static int msp_resume(struct i2c_client *client)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
 
         v4l_dbg(1, msp_debug, client, "resume\n");
         msp_wake_thread(client);
@@ -825,7 +823,7 @@ static int msp_attach(struct i2c_adapter *adapter, int address, int kind)
         if (msp_reset(client) == -1) {
                 v4l_dbg(1, msp_debug, client, "msp3400 not found\n");
                 kfree(client);
-                return -1;
+                return 0;
         }
 
         state = kmalloc(sizeof(*state), GFP_KERNEL);
@@ -859,7 +857,7 @@ static int msp_attach(struct i2c_adapter *adapter, int address, int kind)
                 v4l_dbg(1, msp_debug, client, "not an msp3400 (cannot read chip version)\n");
                 kfree(state);
                 kfree(client);
-                return -1;
+                return 0;
         }
 
         msp_set_audio(client);
@@ -996,11 +994,11 @@ static struct i2c_driver i2c_driver = {
         .id             = I2C_DRIVERID_MSP3400,
         .attach_adapter = msp_probe,
         .detach_client  = msp_detach,
+        .suspend = msp_suspend,
+        .resume  = msp_resume,
         .command        = msp_command,
         .driver = {
                 .name    = "msp3400",
-                .suspend = msp_suspend,
-                .resume  = msp_resume,
         },
 };
 
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index 7735b6758921..4d5bbd859de1 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -961,7 +961,7 @@ static void saa711x_set_v4lstd(struct i2c_client *client, v4l2_std_id std)
                         reg |= 0x10;
                 } else if (std == V4L2_STD_NTSC_M_JP) {
                         reg |= 0x40;
-                } else if (std == V4L2_STD_SECAM) {
+                } else if (std & V4L2_STD_SECAM) {
                         reg |= 0x50;
                 }
                 saa711x_write(client, R_0E_CHROMA_CNTL_1, reg);
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index 7be73e3763de..15dbc6bf42a7 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -804,9 +804,8 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
         return 0;
 }
 
-static int tuner_suspend(struct device *dev, pm_message_t state)
+static int tuner_suspend(struct i2c_client *c, pm_message_t state)
 {
-        struct i2c_client *c = container_of (dev, struct i2c_client, dev);
         struct tuner *t = i2c_get_clientdata (c);
 
         tuner_dbg ("suspend\n");
@@ -814,9 +813,8 @@ static int tuner_suspend(struct device *dev, pm_message_t state)
         return 0;
 }
 
-static int tuner_resume(struct device *dev)
+static int tuner_resume(struct i2c_client *c)
 {
-        struct i2c_client *c = container_of (dev, struct i2c_client, dev);
         struct tuner *t = i2c_get_clientdata (c);
 
         tuner_dbg ("resume\n");
@@ -837,10 +835,10 @@ static struct i2c_driver driver = {
         .attach_adapter = tuner_probe,
         .detach_client = tuner_detach,
         .command = tuner_command,
+        .suspend = tuner_suspend,
+        .resume  = tuner_resume,
         .driver = {
                 .name    = "tuner",
-                .suspend = tuner_suspend,
-                .resume  = tuner_resume,
         },
 };
 static struct i2c_client client_template = {
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 404c014db1bd..1d2d03f77894 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -815,7 +815,7 @@ mptsas_taskmgmt_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
 static int
 mptsas_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
 {
-        MPT_SCSI_HOST   *hd = (MPT_SCSI_HOST *)ioc->sh->hostdata;
+        MPT_SCSI_HOST   *hd;
         struct mptsas_target_reset_event *target_reset_list, *n;
         int rc;
 
@@ -827,7 +827,10 @@ mptsas_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
         if (reset_phase != MPT_IOC_POST_RESET)
                 goto out;
 
-        if (!hd || !hd->ioc)
+        if (!ioc->sh || !ioc->sh->hostdata)
+                goto out;
+        hd = (MPT_SCSI_HOST *)ioc->sh->hostdata;
+        if (!hd->ioc)
                 goto out;
 
         if (list_empty(&hd->target_reset_list))
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index da9859f2caf2..b17c4b2bc9ef 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -390,13 +390,6 @@ static int i2o_block_prep_req_fn(struct request_queue *q, struct request *req)
                 return BLKPREP_KILL;
         }
 
-        /* request is already processed by us, so return */
-        if (blk_special_request(req)) {
-                osm_debug("REQ_SPECIAL already set!\n");
-                req->cmd_flags |= REQ_DONTPREP;
-                return BLKPREP_OK;
-        }
-
         /* connect the i2o_block_request to the request */
         if (!req->special) {
                 ireq = i2o_block_request_alloc();
@@ -408,11 +401,8 @@ static int i2o_block_prep_req_fn(struct request_queue *q, struct request *req)
                 ireq->i2o_blk_dev = i2o_blk_dev;
                 req->special = ireq;
                 ireq->req = req;
-        } else
-                ireq = req->special;
-
+        }
         /* do not come back here */
-        req->cmd_type = REQ_TYPE_SPECIAL;
         req->cmd_flags |= REQ_DONTPREP;
 
         return BLKPREP_OK;
diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index c707c8ebc1a2..b0b4458ae90b 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -319,7 +319,7 @@ int sm501_unit_power(struct device *dev, unsigned int unit, unsigned int to)
 
         mode &= 3;              /* get current power mode */
 
-        if (unit > ARRAY_SIZE(sm->unit_power)) {
+        if (unit >= ARRAY_SIZE(sm->unit_power)) {
                 dev_err(dev, "%s: bad unit %d\n", __FUNCTION__, unit);
                 goto already;
         }
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 445c4b10c41e..a3c525b2616a 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -112,16 +112,21 @@ config SONY_LAPTOP
         depends on X86 && ACPI
         select BACKLIGHT_CLASS_DEVICE
           ---help---
-          This mini-driver drives the SNC device present in the ACPI BIOS of
-          the Sony Vaio laptops.
+          This mini-driver drives the SNC and SPIC devices present in the ACPI
+          BIOS of the Sony Vaio laptops.
 
-          It gives access to some extra laptop functionalities. In its current
-          form, this driver let the user set or query the screen brightness
-          through the backlight subsystem and remove/apply power to some
+          It gives access to some extra laptop functionalities like Bluetooth,
+          screen brightness control, Fn keys and allows powering on/off some
           devices.
 
           Read <file:Documentation/sony-laptop.txt> for more information.
 
+config SONY_LAPTOP_OLD
+        bool "Sonypi compatibility"
+        depends on SONY_LAPTOP
+          ---help---
+          Build the sonypi driver compatibility code into the sony-laptop driver.
+
 config THINKPAD_ACPI
         tristate "ThinkPad ACPI Laptop Extras"
         depends on X86 && ACPI
diff --git a/drivers/misc/asus-laptop.c b/drivers/misc/asus-laptop.c
index 4b232124a1ab..65c32a95e121 100644
--- a/drivers/misc/asus-laptop.c
+++ b/drivers/misc/asus-laptop.c
@@ -3,7 +3,7 @@
  *
  *
  *  Copyright (C) 2002-2005 Julien Lerouge, 2003-2006 Karol Kozimor
- *  Copyright (C) 2006 Corentin Chary
+ *  Copyright (C) 2006-2007 Corentin Chary
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -48,7 +48,7 @@
 #include <acpi/acpi_bus.h>
 #include <asm/uaccess.h>
 
-#define ASUS_LAPTOP_VERSION "0.40"
+#define ASUS_LAPTOP_VERSION "0.41"
 
 #define ASUS_HOTK_NAME          "Asus Laptop Support"
 #define ASUS_HOTK_CLASS         "hotkey"
@@ -81,7 +81,8 @@
 #define TLED_ON     0x08        //touchpad LED
 #define RLED_ON     0x10        //Record LED
 #define PLED_ON     0x20        //Phone LED
-#define LCD_ON      0x40        //LCD backlight
+#define GLED_ON     0x40        //Gaming LED
+#define LCD_ON      0x80        //LCD backlight
 
 #define ASUS_LOG    ASUS_HOTK_FILE ": "
 #define ASUS_ERR    KERN_ERR    ASUS_LOG
@@ -94,6 +95,19 @@ MODULE_AUTHOR("Julien Lerouge, Karol Kozimor, Corentin Chary");
 MODULE_DESCRIPTION(ASUS_HOTK_NAME);
 MODULE_LICENSE("GPL");
 
+/* WAPF defines the behavior of the Fn+Fx wlan key
+ * The significance of values is yet to be found, but
+ * most of the time:
+ * 0x0 will do nothing
+ * 0x1 will allow to control the device with Fn+Fx key.
+ * 0x4 will send an ACPI event (0x88) while pressing the Fn+Fx key
+ * 0x5 like 0x1 or 0x4
+ * So, if something doesn't work as you want, just try other values =)
+ */
+static uint wapf = 1;
+module_param(wapf, uint, 0644);
+MODULE_PARM_DESC(wapf, "WAPF value");
+
 #define ASUS_HANDLE(object, paths...)                                   \
         static acpi_handle  object##_handle = NULL;                     \
         static char *object##_paths[] = { paths }
@@ -103,6 +117,7 @@ ASUS_HANDLE(mled_set, ASUS_HOTK_PREFIX "MLED");
 ASUS_HANDLE(tled_set, ASUS_HOTK_PREFIX "TLED");
 ASUS_HANDLE(rled_set, ASUS_HOTK_PREFIX "RLED"); /* W1JC */
 ASUS_HANDLE(pled_set, ASUS_HOTK_PREFIX "PLED"); /* A7J */
+ASUS_HANDLE(gled_set, ASUS_HOTK_PREFIX "GLED"); /* G1, G2 (probably) */
 
 /* LEDD */
 ASUS_HANDLE(ledd_set, ASUS_HOTK_PREFIX "SLCM");
@@ -221,6 +236,7 @@ ASUS_LED(mled, "mail");
 ASUS_LED(tled, "touchpad");
 ASUS_LED(rled, "record");
 ASUS_LED(pled, "phone");
+ASUS_LED(gled, "gaming");
 
 /*
  * This function evaluates an ACPI method, given an int as parameter, the
@@ -245,32 +261,19 @@ static int write_acpi_int(acpi_handle handle, const char *method, int val,
         return (status == AE_OK);
 }
 
-static int read_acpi_int(acpi_handle handle, const char *method, int *val,
-                         struct acpi_object_list *params)
-{
-        struct acpi_buffer output;
-        union acpi_object out_obj;
-        acpi_status status;
-
-        output.length = sizeof(out_obj);
-        output.pointer = &out_obj;
-
-        status = acpi_evaluate_object(handle, (char *)method, params, &output);
-        *val = out_obj.integer.value;
-        return (status == AE_OK) && (out_obj.type == ACPI_TYPE_INTEGER);
-}
-
 static int read_wireless_status(int mask)
 {
-        int status;
+        ulong status;
+        acpi_status rv = AE_OK;
 
         if (!wireless_status_handle)
                 return (hotk->status & mask) ? 1 : 0;
 
-        if (read_acpi_int(wireless_status_handle, NULL, &status, NULL)) {
-                return (status & mask) ? 1 : 0;
-        } else
+        rv = acpi_evaluate_integer(wireless_status_handle, NULL, NULL, &status);
+        if (ACPI_FAILURE(rv))
                 printk(ASUS_WARNING "Error reading Wireless status\n");
+        else
+                return (status & mask) ? 1 : 0;
 
         return (hotk->status & mask) ? 1 : 0;
 }
@@ -285,19 +288,28 @@ static int read_status(int mask)
         return (hotk->status & mask) ? 1 : 0;
 }
 
-static void write_status(acpi_handle handle, int out, int mask, int invert)
+static void write_status(acpi_handle handle, int out, int mask)
 {
         hotk->status = (out) ? (hotk->status | mask) : (hotk->status & ~mask);
 
-        if (invert)             /* invert target value */
+        switch (mask) {
+        case MLED_ON:
                 out = !out & 0x1;
+                break;
+        case GLED_ON:
+                out = (out & 0x1) + 1;
+                break;
+        default:
+                out &= 0x1;
+                break;
+        }
 
         if (handle && !write_acpi_int(handle, NULL, out, NULL))
-                printk(ASUS_WARNING " write failed\n");
+                printk(ASUS_WARNING " write failed %x\n", mask);
 }
 
 /* /sys/class/led handlers */
-#define ASUS_LED_HANDLER(object, mask, invert)                          \
+#define ASUS_LED_HANDLER(object, mask)                                  \
         static void object##_led_set(struct led_classdev *led_cdev,     \
                                      enum led_brightness value)         \
         {                                                               \
@@ -307,13 +319,14 @@ static void write_status(acpi_handle handle, int out, int mask, int invert)
         static void object##_led_update(struct work_struct *ignored)    \
         {                                                               \
                 int value = object##_led_wk;                            \
-                write_status(object##_set_handle, value, (mask), (invert)); \
+                write_status(object##_set_handle, value, (mask));       \
         }
 
-ASUS_LED_HANDLER(mled, MLED_ON, 1);
-ASUS_LED_HANDLER(pled, PLED_ON, 0);
-ASUS_LED_HANDLER(rled, RLED_ON, 0);
-ASUS_LED_HANDLER(tled, TLED_ON, 0);
+ASUS_LED_HANDLER(mled, MLED_ON);
+ASUS_LED_HANDLER(pled, PLED_ON);
+ASUS_LED_HANDLER(rled, RLED_ON);
+ASUS_LED_HANDLER(tled, TLED_ON);
+ASUS_LED_HANDLER(gled, GLED_ON);
 
 static int get_lcd_state(void)
 {
@@ -338,7 +351,7 @@ static int set_lcd_state(int value)
                         printk(ASUS_WARNING "Error switching LCD\n");
         }
 
-        write_status(NULL, lcd, LCD_ON, 0);
+        write_status(NULL, lcd, LCD_ON);
         return 0;
 }
 
@@ -354,9 +367,11 @@ static void lcd_blank(int blank)
 
 static int read_brightness(struct backlight_device *bd)
 {
-        int value;
+        ulong value;
+        acpi_status rv = AE_OK;
 
-        if (!read_acpi_int(brightness_get_handle, NULL, &value, NULL))
+        rv = acpi_evaluate_integer(brightness_get_handle, NULL, NULL, &value);
+        if (ACPI_FAILURE(rv))
                 printk(ASUS_WARNING "Error reading brightness\n");
 
         return value;
@@ -403,8 +418,10 @@ static ssize_t show_infos(struct device *dev,
                           struct device_attribute *attr, char *page)
 {
         int len = 0;
-        int temp;
+        ulong temp;
         char buf[16];           //enough for all info
+        acpi_status rv = AE_OK;
+
         /*
          * We use the easy way, we don't care of off and count, so we don't set eof
          * to 1
@@ -418,9 +435,10 @@ static ssize_t show_infos(struct device *dev,
          * bit signifies that the laptop is equipped with a Wi-Fi MiniPCI card.
          * The significance of others is yet to be found.
          */
-        if (read_acpi_int(hotk->handle, "SFUN", &temp, NULL))
-                len +=
-                    sprintf(page + len, "SFUN value         : 0x%04x\n", temp);
+        rv = acpi_evaluate_integer(hotk->handle, "SFUN", NULL, &temp);
+        if (!ACPI_FAILURE(rv))
+                len += sprintf(page + len, "SFUN value         : 0x%04x\n",
+                               (uint) temp);
         /*
          * Another value for userspace: the ASYM method returns 0x02 for
          * battery low and 0x04 for battery critical, its readings tend to be
@@ -428,9 +446,10 @@ static ssize_t show_infos(struct device *dev,
          * Note: since not all the laptops provide this method, errors are
          * silently ignored.
          */
-        if (read_acpi_int(hotk->handle, "ASYM", &temp, NULL))
-                len +=
-                    sprintf(page + len, "ASYM value         : 0x%04x\n", temp);
+        rv = acpi_evaluate_integer(hotk->handle, "ASYM", NULL, &temp);
+        if (!ACPI_FAILURE(rv))
+                len += sprintf(page + len, "ASYM value         : 0x%04x\n",
+                               (uint) temp);
         if (asus_info) {
                 snprintf(buf, 16, "%d", asus_info->length);
                 len += sprintf(page + len, "DSDT length        : %s\n", buf);
@@ -465,7 +484,7 @@ static int parse_arg(const char *buf, unsigned long count, int *val)
 }
 
 static ssize_t store_status(const char *buf, size_t count,
-                            acpi_handle handle, int mask, int invert)
+                            acpi_handle handle, int mask)
 {
         int rv, value;
         int out = 0;
@@ -474,7 +493,7 @@ static ssize_t store_status(const char *buf, size_t count,
         if (rv > 0)
                 out = value ? 1 : 0;
 
-        write_status(handle, out, mask, invert);
+        write_status(handle, out, mask);
 
         return rv;
 }
@@ -515,7 +534,7 @@ static ssize_t show_wlan(struct device *dev,
 static ssize_t store_wlan(struct device *dev, struct device_attribute *attr,
                           const char *buf, size_t count)
 {
-        return store_status(buf, count, wl_switch_handle, WL_ON, 0);
+        return store_status(buf, count, wl_switch_handle, WL_ON);
 }
 
 /*
@@ -531,7 +550,7 @@ static ssize_t store_bluetooth(struct device *dev,
                                struct device_attribute *attr, const char *buf,
                                size_t count)
 {
-        return store_status(buf, count, bt_switch_handle, BT_ON, 0);
+        return store_status(buf, count, bt_switch_handle, BT_ON);
 }
 
 /*
@@ -547,12 +566,15 @@ static void set_display(int value)
 
 static int read_display(void)
 {
-        int value = 0;
+        ulong value = 0;
+        acpi_status rv = AE_OK;
 
         /* In most of the case, we know how to set the display, but sometime
            we can't read it */
         if (display_get_handle) {
-                if (!read_acpi_int(display_get_handle, NULL, &value, NULL))
+                rv = acpi_evaluate_integer(display_get_handle, NULL,
+                                           NULL, &value);
+                if (ACPI_FAILURE(rv))
                         printk(ASUS_WARNING "Error reading display status\n");
         }
 
@@ -656,10 +678,10 @@ static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
          * switched
          */
         if (event == ATKD_LCD_ON) {
-                write_status(NULL, 1, LCD_ON, 0);
+                write_status(NULL, 1, LCD_ON);
                 lcd_blank(FB_BLANK_UNBLANK);
         } else if (event == ATKD_LCD_OFF) {
-                write_status(NULL, 0, LCD_ON, 0);
+                write_status(NULL, 0, LCD_ON);
                 lcd_blank(FB_BLANK_POWERDOWN);
         }
 
@@ -771,7 +793,7 @@ static int asus_hotk_get_info(void)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *model = NULL;
-        int bsts_result, hwrs_result;
+        ulong bsts_result, hwrs_result;
         char *string = NULL;
         acpi_status status;
 
@@ -794,11 +816,16 @@ static int asus_hotk_get_info(void)
         }
 
         /* This needs to be called for some laptops to init properly */
-        if (!read_acpi_int(hotk->handle, "BSTS", &bsts_result, NULL))
+        status =
+            acpi_evaluate_integer(hotk->handle, "BSTS", NULL, &bsts_result);
+        if (ACPI_FAILURE(status))
                 printk(ASUS_WARNING "Error calling BSTS\n");
         else if (bsts_result)
                 printk(ASUS_NOTICE "BSTS called, 0x%02x returned\n",
-                       bsts_result);
+                       (uint) bsts_result);
+
+        /* This too ... */
+        write_acpi_int(hotk->handle, "CWAP", wapf, NULL);
 
         /*
          * Try to match the object returned by INIT to the specific model.
@@ -831,6 +858,7 @@ static int asus_hotk_get_info(void)
         ASUS_HANDLE_INIT(tled_set);
         ASUS_HANDLE_INIT(rled_set);
         ASUS_HANDLE_INIT(pled_set);
+        ASUS_HANDLE_INIT(gled_set);
 
         ASUS_HANDLE_INIT(ledd_set);
 
@@ -840,7 +868,9 @@ static int asus_hotk_get_info(void)
          * The significance of others is yet to be found.
          * If we don't find the method, we assume the device are present.
          */
-        if (!read_acpi_int(hotk->handle, "HRWS", &hwrs_result, NULL))
+        status =
+            acpi_evaluate_integer(hotk->handle, "HRWS", NULL, &hwrs_result);
+        if (ACPI_FAILURE(status))
                 hwrs_result = WL_HWRS | BT_HWRS;
 
         if (hwrs_result & WL_HWRS)
@@ -928,11 +958,15 @@ static int asus_hotk_add(struct acpi_device *device)
         asus_hotk_found = 1;
 
         /* WLED and BLED are on by default */
-        write_status(bt_switch_handle, 1, BT_ON, 0);
-        write_status(wl_switch_handle, 1, WL_ON, 0);
+        write_status(bt_switch_handle, 1, BT_ON);
+        write_status(wl_switch_handle, 1, WL_ON);
+
+        /* If the h/w switch is off, we need to check the real status */
+        write_status(NULL, read_status(BT_ON), BT_ON);
+        write_status(NULL, read_status(WL_ON), WL_ON);
 
         /* LCD Backlight is on by default */
-        write_status(NULL, 1, LCD_ON, 0);
+        write_status(NULL, 1, LCD_ON);
 
         /* LED display is off by default */
         hotk->ledd_status = 0xFFF;
@@ -991,6 +1025,7 @@ static void asus_led_exit(void)
         ASUS_LED_UNREGISTER(tled);
         ASUS_LED_UNREGISTER(pled);
         ASUS_LED_UNREGISTER(rled);
+        ASUS_LED_UNREGISTER(gled);
 
         destroy_workqueue(led_workqueue);
 }
@@ -1062,6 +1097,10 @@ static int asus_led_init(struct device *dev)
         if (rv)
                 return rv;
 
+        rv = ASUS_LED_REGISTER(gled, dev);
+        if (rv)
+                return rv;
+
         led_workqueue = create_singlethread_workqueue("led_workqueue");
         if (!led_workqueue)
                 return -ENOMEM;
diff --git a/drivers/misc/sony-laptop.c b/drivers/misc/sony-laptop.c
index ac708bc2f9f3..c15c1f61bd1b 100644
--- a/drivers/misc/sony-laptop.c
+++ b/drivers/misc/sony-laptop.c
@@ -1,5 +1,5 @@
 /*
- * ACPI Sony Notebook Control Driver (SNC)
+ * ACPI Sony Notebook Control Driver (SNC and SPIC)
  *
  * Copyright (C) 2004-2005 Stelian Pop <stelian@popies.net>
  * Copyright (C) 2007 Mattia Dongili <malattia@linux.it>
@@ -7,6 +7,25 @@
  * Parts of this driver inspired from asus_acpi.c and ibm_acpi.c
  * which are copyrighted by their respective authors.
  *
+ * The SNY6001 driver part is based on the sonypi driver which includes
+ * material from:
+ *
+ * Copyright (C) 2001-2005 Stelian Pop <stelian@popies.net>
+ *
+ * Copyright (C) 2005 Narayanan R S <nars@kadamba.org>
+ *
+ * Copyright (C) 2001-2002 Alcôve <www.alcove.com>
+ *
+ * Copyright (C) 2001 Michael Ashley <m.ashley@unsw.edu.au>
+ *
+ * Copyright (C) 2001 Junichi Morita <jun1m@mars.dti.ne.jp>
+ *
+ * Copyright (C) 2000 Takaya Kinjo <t-kinjo@tc4.so-net.ne.jp>
+ *
+ * Copyright (C) 2000 Andrew Tridgell <tridge@valinux.com>
+ *
+ * Earlier work by Werner Almesberger, Paul `Rusty' Russell and Paul Mackerras.
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -31,40 +50,404 @@
 #include <linux/backlight.h>
 #include <linux/platform_device.h>
 #include <linux/err.h>
+#include <linux/dmi.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/input.h>
+#include <linux/kfifo.h>
+#include <linux/workqueue.h>
+#include <linux/acpi.h>
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 #include <asm/uaccess.h>
+#include <linux/sonypi.h>
+#include <linux/sony-laptop.h>
+#ifdef CONFIG_SONY_LAPTOP_OLD
+#include <linux/poll.h>
+#include <linux/miscdevice.h>
+#endif
 
-#define ACPI_SNC_CLASS          "sony"
-#define ACPI_SNC_HID            "SNY5001"
-#define ACPI_SNC_DRIVER_NAME    "ACPI Sony Notebook Control Driver v0.4"
+#define DRV_PFX                 "sony-laptop: "
+#define dprintk(msg...)         do {                    \
+        if (debug) printk(KERN_WARNING DRV_PFX  msg);   \
+} while (0)
 
-/* the device uses 1-based values, while the backlight subsystem uses
-   0-based values */
-#define SONY_MAX_BRIGHTNESS     8
+#define SONY_LAPTOP_DRIVER_VERSION      "0.5"
+
+#define SONY_NC_CLASS           "sony-nc"
+#define SONY_NC_HID             "SNY5001"
+#define SONY_NC_DRIVER_NAME     "Sony Notebook Control Driver"
 
-#define LOG_PFX                 KERN_WARNING "sony-laptop: "
+#define SONY_PIC_CLASS          "sony-pic"
+#define SONY_PIC_HID            "SNY6001"
+#define SONY_PIC_DRIVER_NAME    "Sony Programmable IO Control Driver"
 
 MODULE_AUTHOR("Stelian Pop, Mattia Dongili");
-MODULE_DESCRIPTION(ACPI_SNC_DRIVER_NAME);
+MODULE_DESCRIPTION("Sony laptop extras driver (SPIC and SNC ACPI device)");
 MODULE_LICENSE("GPL");
+MODULE_VERSION(SONY_LAPTOP_DRIVER_VERSION);
 
 static int debug;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "set this to 1 (and RTFM) if you want to help "
                  "the development of this driver");
 
-static ssize_t sony_acpi_show(struct device *, struct device_attribute *,
+static int no_spic;             /* = 0 */
+module_param(no_spic, int, 0444);
+MODULE_PARM_DESC(no_spic,
+                 "set this if you don't want to enable the SPIC device");
+
+static int compat;              /* = 0 */
+module_param(compat, int, 0444);
+MODULE_PARM_DESC(compat,
+                 "set this if you want to enable backward compatibility mode");
+
+static unsigned long mask = 0xffffffff;
+module_param(mask, ulong, 0644);
+MODULE_PARM_DESC(mask,
+                 "set this to the mask of event you want to enable (see doc)");
+
+static int camera;              /* = 0 */
+module_param(camera, int, 0444);
+MODULE_PARM_DESC(camera,
+                 "set this to 1 to enable Motion Eye camera controls "
+                 "(only use it if you have a C1VE or C1VN model)");
+
+#ifdef CONFIG_SONY_LAPTOP_OLD
+static int minor = -1;
+module_param(minor, int, 0);
+MODULE_PARM_DESC(minor,
+                 "minor number of the misc device for the SPIC compatibility code, "
+                 "default is -1 (automatic)");
+#endif
+
+/*********** Input Devices ***********/
+
+#define SONY_LAPTOP_BUF_SIZE    128
+struct sony_laptop_input_s {
+        atomic_t                users;
+        struct input_dev        *jog_dev;
+        struct input_dev        *key_dev;
+        struct kfifo            *fifo;
+        spinlock_t              fifo_lock;
+        struct workqueue_struct *wq;
+};
+static struct sony_laptop_input_s sony_laptop_input = {
+        .users = ATOMIC_INIT(0),
+};
+
+struct sony_laptop_keypress {
+        struct input_dev *dev;
+        int key;
+};
+
+/* Correspondance table between sonypi events and input layer events */
+static struct {
+        int sonypiev;
+        int inputev;
+} sony_laptop_inputkeys[] = {
+        { SONYPI_EVENT_CAPTURE_PRESSED,         KEY_CAMERA },
+        { SONYPI_EVENT_FNKEY_ONLY,              KEY_FN },
+        { SONYPI_EVENT_FNKEY_ESC,               KEY_FN_ESC },
+        { SONYPI_EVENT_FNKEY_F1,                KEY_FN_F1 },
+        { SONYPI_EVENT_FNKEY_F2,                KEY_FN_F2 },
+        { SONYPI_EVENT_FNKEY_F3,                KEY_FN_F3 },
+        { SONYPI_EVENT_FNKEY_F4,                KEY_FN_F4 },
+        { SONYPI_EVENT_FNKEY_F5,                KEY_FN_F5 },
+        { SONYPI_EVENT_FNKEY_F6,                KEY_FN_F6 },
+        { SONYPI_EVENT_FNKEY_F7,                KEY_FN_F7 },
+        { SONYPI_EVENT_FNKEY_F8,                KEY_FN_F8 },
+        { SONYPI_EVENT_FNKEY_F9,                KEY_FN_F9 },
+        { SONYPI_EVENT_FNKEY_F10,               KEY_FN_F10 },
+        { SONYPI_EVENT_FNKEY_F11,               KEY_FN_F11 },
+        { SONYPI_EVENT_FNKEY_F12,               KEY_FN_F12 },
+        { SONYPI_EVENT_FNKEY_1,                 KEY_FN_1 },
+        { SONYPI_EVENT_FNKEY_2,                 KEY_FN_2 },
+        { SONYPI_EVENT_FNKEY_D,                 KEY_FN_D },
+        { SONYPI_EVENT_FNKEY_E,                 KEY_FN_E },
+        { SONYPI_EVENT_FNKEY_F,                 KEY_FN_F },
+        { SONYPI_EVENT_FNKEY_S,                 KEY_FN_S },
+        { SONYPI_EVENT_FNKEY_B,                 KEY_FN_B },
+        { SONYPI_EVENT_BLUETOOTH_PRESSED,       KEY_BLUE },
+        { SONYPI_EVENT_BLUETOOTH_ON,            KEY_BLUE },
+        { SONYPI_EVENT_PKEY_P1,                 KEY_PROG1 },
+        { SONYPI_EVENT_PKEY_P2,                 KEY_PROG2 },
+        { SONYPI_EVENT_PKEY_P3,                 KEY_PROG3 },
+        { SONYPI_EVENT_BACK_PRESSED,            KEY_BACK },
+        { SONYPI_EVENT_HELP_PRESSED,            KEY_HELP },
+        { SONYPI_EVENT_ZOOM_PRESSED,            KEY_ZOOM },
+        { SONYPI_EVENT_THUMBPHRASE_PRESSED,     BTN_THUMB },
+        { 0, 0 },
+};
+
+/* release buttons after a short delay if pressed */
+static void do_sony_laptop_release_key(struct work_struct *work)
+{
+        struct sony_laptop_keypress kp;
+
+        while (kfifo_get(sony_laptop_input.fifo, (unsigned char *)&kp,
+                         sizeof(kp)) == sizeof(kp)) {
+                msleep(10);
+                input_report_key(kp.dev, kp.key, 0);
+                input_sync(kp.dev);
+        }
+}
+static DECLARE_WORK(sony_laptop_release_key_work,
+                do_sony_laptop_release_key);
+
+/* forward event to the input subsytem */
+static void sony_laptop_report_input_event(u8 event)
+{
+        struct input_dev *jog_dev = sony_laptop_input.jog_dev;
+        struct input_dev *key_dev = sony_laptop_input.key_dev;
+        struct sony_laptop_keypress kp = { NULL };
+        int i;
+
+        if (event == SONYPI_EVENT_FNKEY_RELEASED) {
+                /* Nothing, not all VAIOs generate this event */
+                return;
+        }
+
+        /* report events */
+        switch (event) {
+        /* jog_dev events */
+        case SONYPI_EVENT_JOGDIAL_UP:
+        case SONYPI_EVENT_JOGDIAL_UP_PRESSED:
+                input_report_rel(jog_dev, REL_WHEEL, 1);
+                input_sync(jog_dev);
+                return;
+
+        case SONYPI_EVENT_JOGDIAL_DOWN:
+        case SONYPI_EVENT_JOGDIAL_DOWN_PRESSED:
+                input_report_rel(jog_dev, REL_WHEEL, -1);
+                input_sync(jog_dev);
+                return;
+
+        /* key_dev events */
+        case SONYPI_EVENT_JOGDIAL_PRESSED:
+                kp.key = BTN_MIDDLE;
+                kp.dev = jog_dev;
+                break;
+
+        default:
+                for (i = 0; sony_laptop_inputkeys[i].sonypiev; i++)
+                        if (event == sony_laptop_inputkeys[i].sonypiev) {
+                                kp.dev = key_dev;
+                                kp.key = sony_laptop_inputkeys[i].inputev;
+                                break;
+                        }
+                break;
+        }
+
+        if (kp.dev) {
+                input_report_key(kp.dev, kp.key, 1);
+                input_sync(kp.dev);
+                kfifo_put(sony_laptop_input.fifo,
+                          (unsigned char *)&kp, sizeof(kp));
+
+                if (!work_pending(&sony_laptop_release_key_work))
+                        queue_work(sony_laptop_input.wq,
+                                        &sony_laptop_release_key_work);
+        } else
+                dprintk("unknown input event %.2x\n", event);
+}
+
+static int sony_laptop_setup_input(void)
+{
+        struct input_dev *jog_dev;
+        struct input_dev *key_dev;
+        int i;
+        int error;
+
+        /* don't run again if already initialized */
+        if (atomic_add_return(1, &sony_laptop_input.users) > 1)
+                return 0;
+
+        /* kfifo */
+        spin_lock_init(&sony_laptop_input.fifo_lock);
+        sony_laptop_input.fifo =
+                kfifo_alloc(SONY_LAPTOP_BUF_SIZE, GFP_KERNEL,
+                            &sony_laptop_input.fifo_lock);
+        if (IS_ERR(sony_laptop_input.fifo)) {
+                printk(KERN_ERR DRV_PFX "kfifo_alloc failed\n");
+                error = PTR_ERR(sony_laptop_input.fifo);
+                goto err_dec_users;
+        }
+
+        /* init workqueue */
+        sony_laptop_input.wq = create_singlethread_workqueue("sony-laptop");
+        if (!sony_laptop_input.wq) {
+                printk(KERN_ERR DRV_PFX
+                                "Unabe to create workqueue.\n");
+                error = -ENXIO;
+                goto err_free_kfifo;
+        }
+
+        /* input keys */
+        key_dev = input_allocate_device();
+        if (!key_dev) {
+                error = -ENOMEM;
+                goto err_destroy_wq;
+        }
+
+        key_dev->name = "Sony Vaio Keys";
+        key_dev->id.bustype = BUS_ISA;
+        key_dev->id.vendor = PCI_VENDOR_ID_SONY;
+
+        /* Initialize the Input Drivers: special keys */
+        key_dev->evbit[0] = BIT(EV_KEY);
+        for (i = 0; sony_laptop_inputkeys[i].sonypiev; i++)
+                if (sony_laptop_inputkeys[i].inputev)
+                        set_bit(sony_laptop_inputkeys[i].inputev,
+                                        key_dev->keybit);
+
+        error = input_register_device(key_dev);
+        if (error)
+                goto err_free_keydev;
+
+        sony_laptop_input.key_dev = key_dev;
+
+        /* jogdial */
+        jog_dev = input_allocate_device();
+        if (!jog_dev) {
+                error = -ENOMEM;
+                goto err_unregister_keydev;
+        }
+
+        jog_dev->name = "Sony Vaio Jogdial";
+        jog_dev->id.bustype = BUS_ISA;
+        jog_dev->id.vendor = PCI_VENDOR_ID_SONY;
+
+        jog_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REL);
+        jog_dev->keybit[LONG(BTN_MOUSE)] = BIT(BTN_MIDDLE);
+        jog_dev->relbit[0] = BIT(REL_WHEEL);
+
+        error = input_register_device(jog_dev);
+        if (error)
+                goto err_free_jogdev;
+
+        sony_laptop_input.jog_dev = jog_dev;
+
+        return 0;
+
+err_free_jogdev:
+        input_free_device(jog_dev);
+
+err_unregister_keydev:
+        input_unregister_device(key_dev);
+        /* to avoid kref underflow below at input_free_device */
+        key_dev = NULL;
+
+err_free_keydev:
+        input_free_device(key_dev);
+
+err_destroy_wq:
+        destroy_workqueue(sony_laptop_input.wq);
+
+err_free_kfifo:
+        kfifo_free(sony_laptop_input.fifo);
+
+err_dec_users:
+        atomic_dec(&sony_laptop_input.users);
+        return error;
+}
+
+static void sony_laptop_remove_input(void)
+{
+        /* cleanup only after the last user has gone */
+        if (!atomic_dec_and_test(&sony_laptop_input.users))
+                return;
+
+        /* flush workqueue first */
+        flush_workqueue(sony_laptop_input.wq);
+
+        /* destroy input devs */
+        input_unregister_device(sony_laptop_input.key_dev);
+        sony_laptop_input.key_dev = NULL;
+
+        if (sony_laptop_input.jog_dev) {
+                input_unregister_device(sony_laptop_input.jog_dev);
+                sony_laptop_input.jog_dev = NULL;
+        }
+
+        destroy_workqueue(sony_laptop_input.wq);
+        kfifo_free(sony_laptop_input.fifo);
+}
+
+/*********** Platform Device ***********/
+
+static atomic_t sony_pf_users = ATOMIC_INIT(0);
+static struct platform_driver sony_pf_driver = {
+        .driver = {
+                   .name = "sony-laptop",
+                   .owner = THIS_MODULE,
+                   }
+};
+static struct platform_device *sony_pf_device;
+
+static int sony_pf_add(void)
+{
+        int ret = 0;
+
+        /* don't run again if already initialized */
+        if (atomic_add_return(1, &sony_pf_users) > 1)
+                return 0;
+
+        ret = platform_driver_register(&sony_pf_driver);
+        if (ret)
+                goto out;
+
+        sony_pf_device = platform_device_alloc("sony-laptop", -1);
+        if (!sony_pf_device) {
+                ret = -ENOMEM;
+                goto out_platform_registered;
+        }
+
+        ret = platform_device_add(sony_pf_device);
+        if (ret)
+                goto out_platform_alloced;
+
+        return 0;
+
+      out_platform_alloced:
+        platform_device_put(sony_pf_device);
+        sony_pf_device = NULL;
+      out_platform_registered:
+        platform_driver_unregister(&sony_pf_driver);
+      out:
+        atomic_dec(&sony_pf_users);
+        return ret;
+}
+
+static void sony_pf_remove(void)
+{
+        /* deregister only after the last user has gone */
+        if (!atomic_dec_and_test(&sony_pf_users))
+                return;
+
+        platform_device_del(sony_pf_device);
+        platform_device_put(sony_pf_device);
+        platform_driver_unregister(&sony_pf_driver);
+}
+
+/*********** SNC (SNY5001) Device ***********/
+
+/* the device uses 1-based values, while the backlight subsystem uses
+   0-based values */
+#define SONY_MAX_BRIGHTNESS     8
+
+#define SNC_VALIDATE_IN         0
+#define SNC_VALIDATE_OUT        1
+
+static ssize_t sony_nc_sysfs_show(struct device *, struct device_attribute *,
                               char *);
-static ssize_t sony_acpi_store(struct device *, struct device_attribute *,
+static ssize_t sony_nc_sysfs_store(struct device *, struct device_attribute *,
                                const char *, size_t);
 static int boolean_validate(const int, const int);
 static int brightness_default_validate(const int, const int);
 
-#define SNC_VALIDATE_IN         0
-#define SNC_VALIDATE_OUT        1
-
-struct sony_acpi_value {
+struct sony_nc_value {
         char *name;             /* name of the entry */
         char **acpiget;         /* names of the ACPI get function */
         char **acpiset;         /* names of the ACPI set function */
@@ -75,65 +458,65 @@ struct sony_acpi_value {
         struct device_attribute devattr;        /* sysfs atribute */
 };
 
-#define HANDLE_NAMES(_name, _values...) \
+#define SNC_HANDLE_NAMES(_name, _values...) \
         static char *snc_##_name[] = { _values, NULL }
 
-#define SONY_ACPI_VALUE(_name, _getters, _setters, _validate, _debug) \
+#define SNC_HANDLE(_name, _getters, _setters, _validate, _debug) \
         { \
                 .name           = __stringify(_name), \
                 .acpiget        = _getters, \
                 .acpiset        = _setters, \
                 .validate       = _validate, \
                 .debug          = _debug, \
-                .devattr        = __ATTR(_name, 0, sony_acpi_show, sony_acpi_store), \
+                .devattr        = __ATTR(_name, 0, sony_nc_sysfs_show, sony_nc_sysfs_store), \
         }
 
-#define SONY_ACPI_VALUE_NULL    { .name = NULL }
+#define SNC_HANDLE_NULL { .name = NULL }
 
-HANDLE_NAMES(fnkey_get, "GHKE");
+SNC_HANDLE_NAMES(fnkey_get, "GHKE");
 
-HANDLE_NAMES(brightness_def_get, "GPBR");
-HANDLE_NAMES(brightness_def_set, "SPBR");
+SNC_HANDLE_NAMES(brightness_def_get, "GPBR");
+SNC_HANDLE_NAMES(brightness_def_set, "SPBR");
 
-HANDLE_NAMES(cdpower_get, "GCDP");
-HANDLE_NAMES(cdpower_set, "SCDP", "CDPW");
+SNC_HANDLE_NAMES(cdpower_get, "GCDP");
+SNC_HANDLE_NAMES(cdpower_set, "SCDP", "CDPW");
 
-HANDLE_NAMES(audiopower_get, "GAZP");
-HANDLE_NAMES(audiopower_set, "AZPW");
+SNC_HANDLE_NAMES(audiopower_get, "GAZP");
+SNC_HANDLE_NAMES(audiopower_set, "AZPW");
 
-HANDLE_NAMES(lanpower_get, "GLNP");
-HANDLE_NAMES(lanpower_set, "LNPW");
+SNC_HANDLE_NAMES(lanpower_get, "GLNP");
+SNC_HANDLE_NAMES(lanpower_set, "LNPW");
 
-HANDLE_NAMES(PID_get, "GPID");
+SNC_HANDLE_NAMES(PID_get, "GPID");
 
-HANDLE_NAMES(CTR_get, "GCTR");
-HANDLE_NAMES(CTR_set, "SCTR");
+SNC_HANDLE_NAMES(CTR_get, "GCTR");
+SNC_HANDLE_NAMES(CTR_set, "SCTR");
 
-HANDLE_NAMES(PCR_get, "GPCR");
-HANDLE_NAMES(PCR_set, "SPCR");
+SNC_HANDLE_NAMES(PCR_get, "GPCR");
+SNC_HANDLE_NAMES(PCR_set, "SPCR");
 
-HANDLE_NAMES(CMI_get, "GCMI");
-HANDLE_NAMES(CMI_set, "SCMI");
+SNC_HANDLE_NAMES(CMI_get, "GCMI");
+SNC_HANDLE_NAMES(CMI_set, "SCMI");
 
-static struct sony_acpi_value sony_acpi_values[] = {
-        SONY_ACPI_VALUE(brightness_default, snc_brightness_def_get,
+static struct sony_nc_value sony_nc_values[] = {
+        SNC_HANDLE(brightness_default, snc_brightness_def_get,
                         snc_brightness_def_set, brightness_default_validate, 0),
-        SONY_ACPI_VALUE(fnkey, snc_fnkey_get, NULL, NULL, 0),
-        SONY_ACPI_VALUE(cdpower, snc_cdpower_get, snc_cdpower_set, boolean_validate, 0),
-        SONY_ACPI_VALUE(audiopower, snc_audiopower_get, snc_audiopower_set,
+        SNC_HANDLE(fnkey, snc_fnkey_get, NULL, NULL, 0),
+        SNC_HANDLE(cdpower, snc_cdpower_get, snc_cdpower_set, boolean_validate, 0),
+        SNC_HANDLE(audiopower, snc_audiopower_get, snc_audiopower_set,
                         boolean_validate, 0),
-        SONY_ACPI_VALUE(lanpower, snc_lanpower_get, snc_lanpower_set,
+        SNC_HANDLE(lanpower, snc_lanpower_get, snc_lanpower_set,
                         boolean_validate, 1),
         /* unknown methods */
-        SONY_ACPI_VALUE(PID, snc_PID_get, NULL, NULL, 1),
-        SONY_ACPI_VALUE(CTR, snc_CTR_get, snc_CTR_set, NULL, 1),
-        SONY_ACPI_VALUE(PCR, snc_PCR_get, snc_PCR_set, NULL, 1),
-        SONY_ACPI_VALUE(CMI, snc_CMI_get, snc_CMI_set, NULL, 1),
-        SONY_ACPI_VALUE_NULL
+        SNC_HANDLE(PID, snc_PID_get, NULL, NULL, 1),
+        SNC_HANDLE(CTR, snc_CTR_get, snc_CTR_set, NULL, 1),
+        SNC_HANDLE(PCR, snc_PCR_get, snc_PCR_set, NULL, 1),
+        SNC_HANDLE(CMI, snc_CMI_get, snc_CMI_set, NULL, 1),
+        SNC_HANDLE_NULL
 };
 
-static acpi_handle sony_acpi_handle;
-static struct acpi_device *sony_acpi_acpi_device = NULL;
+static acpi_handle sony_nc_acpi_handle;
+static struct acpi_device *sony_nc_acpi_device = NULL;
 
 /*
  * acpi_evaluate_object wrappers
@@ -153,7 +536,7 @@ static int acpi_callgetfunc(acpi_handle handle, char *name, int *result)
                 return 0;
         }
 
-        printk(LOG_PFX "acpi_callreadfunc failed\n");
+        printk(KERN_WARNING DRV_PFX "acpi_callreadfunc failed\n");
 
         return -1;
 }
@@ -179,7 +562,7 @@ static int acpi_callsetfunc(acpi_handle handle, char *name, int value,
         if (status == AE_OK) {
                 if (result != NULL) {
                         if (out_obj.type != ACPI_TYPE_INTEGER) {
-                                printk(LOG_PFX "acpi_evaluate_object bad "
+                                printk(KERN_WARNING DRV_PFX "acpi_evaluate_object bad "
                                        "return type\n");
                                 return -1;
                         }
@@ -188,13 +571,13 @@ static int acpi_callsetfunc(acpi_handle handle, char *name, int value,
                 return 0;
         }
 
-        printk(LOG_PFX "acpi_evaluate_object failed\n");
+        printk(KERN_WARNING DRV_PFX "acpi_evaluate_object failed\n");
 
         return -1;
 }
 
 /*
- * sony_acpi_values input/output validate functions
+ * sony_nc_values input/output validate functions
  */
 
 /* brightness_default_validate:
@@ -229,19 +612,19 @@ static int boolean_validate(const int direction, const int value)
 }
 
 /*
- * Sysfs show/store common to all sony_acpi_values
+ * Sysfs show/store common to all sony_nc_values
  */
-static ssize_t sony_acpi_show(struct device *dev, struct device_attribute *attr,
+static ssize_t sony_nc_sysfs_show(struct device *dev, struct device_attribute *attr,
                               char *buffer)
 {
         int value;
-        struct sony_acpi_value *item =
-            container_of(attr, struct sony_acpi_value, devattr);
+        struct sony_nc_value *item =
+            container_of(attr, struct sony_nc_value, devattr);
 
         if (!*item->acpiget)
                 return -EIO;
 
-        if (acpi_callgetfunc(sony_acpi_handle, *item->acpiget, &value) < 0)
+        if (acpi_callgetfunc(sony_nc_acpi_handle, *item->acpiget, &value) < 0)
                 return -EIO;
 
         if (item->validate)
@@ -250,13 +633,13 @@ static ssize_t sony_acpi_show(struct device *dev, struct device_attribute *attr,
         return snprintf(buffer, PAGE_SIZE, "%d\n", value);
 }
 
-static ssize_t sony_acpi_store(struct device *dev,
+static ssize_t sony_nc_sysfs_store(struct device *dev,
                                struct device_attribute *attr,
                                const char *buffer, size_t count)
 {
         int value;
-        struct sony_acpi_value *item =
-            container_of(attr, struct sony_acpi_value, devattr);
+        struct sony_nc_value *item =
+            container_of(attr, struct sony_nc_value, devattr);
 
         if (!item->acpiset)
                 return -EIO;
@@ -272,118 +655,20 @@ static ssize_t sony_acpi_store(struct device *dev,
         if (value < 0)
                 return value;
 
-        if (acpi_callsetfunc(sony_acpi_handle, *item->acpiset, value, NULL) < 0)
+        if (acpi_callsetfunc(sony_nc_acpi_handle, *item->acpiset, value, NULL) < 0)
                 return -EIO;
         item->value = value;
         item->valid = 1;
         return count;
 }
 
-/*
- * Platform device
- */
-static struct platform_driver sncpf_driver = {
-        .driver = {
-                   .name = "sony-laptop",
-                   .owner = THIS_MODULE,
-                   }
-};
-static struct platform_device *sncpf_device;
-
-static int sony_snc_pf_add(void)
-{
-        acpi_handle handle;
-        struct sony_acpi_value *item;
-        int ret = 0;
-
-        ret = platform_driver_register(&sncpf_driver);
-        if (ret)
-                goto out;
-
-        sncpf_device = platform_device_alloc("sony-laptop", -1);
-        if (!sncpf_device) {
-                ret = -ENOMEM;
-                goto out_platform_registered;
-        }
-
-        ret = platform_device_add(sncpf_device);
-        if (ret)
-                goto out_platform_alloced;
-
-        for (item = sony_acpi_values; item->name; ++item) {
-
-                if (!debug && item->debug)
-                        continue;
-
-                /* find the available acpiget as described in the DSDT */
-                for (; item->acpiget && *item->acpiget; ++item->acpiget) {
-                        if (ACPI_SUCCESS(acpi_get_handle(sony_acpi_handle,
-                                                         *item->acpiget,
-                                                         &handle))) {
-                                if (debug)
-                                        printk(LOG_PFX "Found %s getter: %s\n",
-                                               item->name, *item->acpiget);
-                                item->devattr.attr.mode |= S_IRUGO;
-                                break;
-                        }
-                }
-
-                /* find the available acpiset as described in the DSDT */
-                for (; item->acpiset && *item->acpiset; ++item->acpiset) {
-                        if (ACPI_SUCCESS(acpi_get_handle(sony_acpi_handle,
-                                                         *item->acpiset,
-                                                         &handle))) {
-                                if (debug)
-                                        printk(LOG_PFX "Found %s setter: %s\n",
-                                               item->name, *item->acpiset);
-                                item->devattr.attr.mode |= S_IWUSR;
-                                break;
-                        }
-                }
-
-                if (item->devattr.attr.mode != 0) {
-                        ret =
-                            device_create_file(&sncpf_device->dev,
-                                               &item->devattr);
-                        if (ret)
-                                goto out_sysfs;
-                }
-        }
-
-        return 0;
-
-      out_sysfs:
-        for (item = sony_acpi_values; item->name; ++item) {
-                device_remove_file(&sncpf_device->dev, &item->devattr);
-        }
-        platform_device_del(sncpf_device);
-      out_platform_alloced:
-        platform_device_put(sncpf_device);
-      out_platform_registered:
-        platform_driver_unregister(&sncpf_driver);
-      out:
-        return ret;
-}
-
-static void sony_snc_pf_remove(void)
-{
-        struct sony_acpi_value *item;
-
-        for (item = sony_acpi_values; item->name; ++item) {
-                device_remove_file(&sncpf_device->dev, &item->devattr);
-        }
-
-        platform_device_del(sncpf_device);
-        platform_device_put(sncpf_device);
-        platform_driver_unregister(&sncpf_driver);
-}
 
 /*
  * Backlight device
  */
 static int sony_backlight_update_status(struct backlight_device *bd)
 {
-        return acpi_callsetfunc(sony_acpi_handle, "SBRT",
+        return acpi_callsetfunc(sony_nc_acpi_handle, "SBRT",
                                 bd->props.brightness + 1, NULL);
 }
 
@@ -391,7 +676,7 @@ static int sony_backlight_get_brightness(struct backlight_device *bd)
 {
         int value;
 
-        if (acpi_callgetfunc(sony_acpi_handle, "GBRT", &value))
+        if (acpi_callgetfunc(sony_nc_acpi_handle, "GBRT", &value))
                 return 0;
         /* brightness levels are 1-based, while backlight ones are 0-based */
         return value - 1;
@@ -408,9 +693,9 @@ static struct backlight_ops sony_backlight_ops = {
  */
 static void sony_acpi_notify(acpi_handle handle, u32 event, void *data)
 {
-        if (debug)
-                printk(LOG_PFX "sony_acpi_notify, event: %d\n", event);
-        acpi_bus_generate_event(sony_acpi_acpi_device, 1, event);
+        dprintk("sony_acpi_notify, event: %d\n", event);
+        sony_laptop_report_input_event(event);
+        acpi_bus_generate_event(sony_nc_acpi_device, 1, event);
 }
 
 static acpi_status sony_walk_callback(acpi_handle handle, u32 level,
@@ -422,7 +707,7 @@ static acpi_status sony_walk_callback(acpi_handle handle, u32 level,
         node = (struct acpi_namespace_node *)handle;
         operand = (union acpi_operand_object *)node->object;
 
-        printk(LOG_PFX "method: name: %4.4s, args %X\n", node->name.ascii,
+        printk(KERN_WARNING DRV_PFX "method: name: %4.4s, args %X\n", node->name.ascii,
                (u32) operand->method.param_count);
 
         return AE_OK;
@@ -431,16 +716,16 @@ static acpi_status sony_walk_callback(acpi_handle handle, u32 level,
 /*
  * ACPI device
  */
-static int sony_acpi_resume(struct acpi_device *device)
+static int sony_nc_resume(struct acpi_device *device)
 {
-        struct sony_acpi_value *item;
+        struct sony_nc_value *item;
 
-        for (item = sony_acpi_values; item->name; item++) {
+        for (item = sony_nc_values; item->name; item++) {
                 int ret;
 
                 if (!item->valid)
                         continue;
-                ret = acpi_callsetfunc(sony_acpi_handle, *item->acpiset,
+                ret = acpi_callsetfunc(sony_nc_acpi_handle, *item->acpiset,
                                        item->value, NULL);
                 if (ret < 0) {
                         printk("%s: %d\n", __FUNCTION__, ret);
@@ -450,42 +735,55 @@ static int sony_acpi_resume(struct acpi_device *device)
         return 0;
 }
 
-static int sony_acpi_add(struct acpi_device *device)
+static int sony_nc_add(struct acpi_device *device)
 {
         acpi_status status;
         int result = 0;
         acpi_handle handle;
+        struct sony_nc_value *item;
+
+        printk(KERN_INFO DRV_PFX "%s v%s.\n",
+                SONY_NC_DRIVER_NAME, SONY_LAPTOP_DRIVER_VERSION);
 
-        sony_acpi_acpi_device = device;
+        sony_nc_acpi_device = device;
+        strcpy(acpi_device_class(device), "sony/hotkey");
 
-        sony_acpi_handle = device->handle;
+        sony_nc_acpi_handle = device->handle;
 
         if (debug) {
-                status = acpi_walk_namespace(ACPI_TYPE_METHOD, sony_acpi_handle,
+                status = acpi_walk_namespace(ACPI_TYPE_METHOD, sony_nc_acpi_handle,
                                              1, sony_walk_callback, NULL, NULL);
                 if (ACPI_FAILURE(status)) {
-                        printk(LOG_PFX "unable to walk acpi resources\n");
+                        printk(KERN_WARNING DRV_PFX "unable to walk acpi resources\n");
                         result = -ENODEV;
                         goto outwalk;
                 }
         }
 
-        status = acpi_install_notify_handler(sony_acpi_handle,
+        /* setup input devices and helper fifo */
+        result = sony_laptop_setup_input();
+        if (result) {
+                printk(KERN_ERR DRV_PFX
+                                "Unabe to create input devices.\n");
+                goto outwalk;
+        }
+
+        status = acpi_install_notify_handler(sony_nc_acpi_handle,
                                              ACPI_DEVICE_NOTIFY,
                                              sony_acpi_notify, NULL);
         if (ACPI_FAILURE(status)) {
-                printk(LOG_PFX "unable to install notify handler\n");
+                printk(KERN_WARNING DRV_PFX "unable to install notify handler\n");
                 result = -ENODEV;
-                goto outwalk;
+                goto outinput;
         }
 
-        if (ACPI_SUCCESS(acpi_get_handle(sony_acpi_handle, "GBRT", &handle))) {
+        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "GBRT", &handle))) {
                 sony_backlight_device = backlight_device_register("sony", NULL,
                                                                   NULL,
                                                                   &sony_backlight_ops);
 
                 if (IS_ERR(sony_backlight_device)) {
-                        printk(LOG_PFX "unable to register backlight device\n");
+                        printk(KERN_WARNING DRV_PFX "unable to register backlight device\n");
                         sony_backlight_device = NULL;
                 } else {
                         sony_backlight_device->props.brightness =
@@ -497,68 +795,1497 @@ static int sony_acpi_add(struct acpi_device *device)
 
         }
 
-        if (sony_snc_pf_add())
+        result = sony_pf_add();
+        if (result)
                 goto outbacklight;
 
-        printk(KERN_INFO ACPI_SNC_DRIVER_NAME " successfully installed\n");
+        /* create sony_pf sysfs attributes related to the SNC device */
+        for (item = sony_nc_values; item->name; ++item) {
+
+                if (!debug && item->debug)
+                        continue;
+
+                /* find the available acpiget as described in the DSDT */
+                for (; item->acpiget && *item->acpiget; ++item->acpiget) {
+                        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle,
+                                                         *item->acpiget,
+                                                         &handle))) {
+                                dprintk("Found %s getter: %s\n",
+                                                item->name, *item->acpiget);
+                                item->devattr.attr.mode |= S_IRUGO;
+                                break;
+                        }
+                }
+
+                /* find the available acpiset as described in the DSDT */
+                for (; item->acpiset && *item->acpiset; ++item->acpiset) {
+                        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle,
+                                                         *item->acpiset,
+                                                         &handle))) {
+                                dprintk("Found %s setter: %s\n",
+                                                item->name, *item->acpiset);
+                                item->devattr.attr.mode |= S_IWUSR;
+                                break;
+                        }
+                }
+
+                if (item->devattr.attr.mode != 0) {
+                        result =
+                            device_create_file(&sony_pf_device->dev,
+                                               &item->devattr);
+                        if (result)
+                                goto out_sysfs;
+                }
+        }
 
         return 0;
 
+      out_sysfs:
+        for (item = sony_nc_values; item->name; ++item) {
+                device_remove_file(&sony_pf_device->dev, &item->devattr);
+        }
+        sony_pf_remove();
+
       outbacklight:
         if (sony_backlight_device)
                 backlight_device_unregister(sony_backlight_device);
 
-        status = acpi_remove_notify_handler(sony_acpi_handle,
+        status = acpi_remove_notify_handler(sony_nc_acpi_handle,
                                             ACPI_DEVICE_NOTIFY,
                                             sony_acpi_notify);
         if (ACPI_FAILURE(status))
-                printk(LOG_PFX "unable to remove notify handler\n");
+                printk(KERN_WARNING DRV_PFX "unable to remove notify handler\n");
+
+      outinput:
+        sony_laptop_remove_input();
+
       outwalk:
         return result;
 }
 
-static int sony_acpi_remove(struct acpi_device *device, int type)
+static int sony_nc_remove(struct acpi_device *device, int type)
 {
         acpi_status status;
+        struct sony_nc_value *item;
 
         if (sony_backlight_device)
                 backlight_device_unregister(sony_backlight_device);
 
-        sony_acpi_acpi_device = NULL;
+        sony_nc_acpi_device = NULL;
 
-        status = acpi_remove_notify_handler(sony_acpi_handle,
+        status = acpi_remove_notify_handler(sony_nc_acpi_handle,
                                             ACPI_DEVICE_NOTIFY,
                                             sony_acpi_notify);
         if (ACPI_FAILURE(status))
-                printk(LOG_PFX "unable to remove notify handler\n");
+                printk(KERN_WARNING DRV_PFX "unable to remove notify handler\n");
 
-        sony_snc_pf_remove();
+        for (item = sony_nc_values; item->name; ++item) {
+                device_remove_file(&sony_pf_device->dev, &item->devattr);
+        }
 
-        printk(KERN_INFO ACPI_SNC_DRIVER_NAME " successfully removed\n");
+        sony_pf_remove();
+        sony_laptop_remove_input();
+        dprintk(SONY_NC_DRIVER_NAME " removed.\n");
 
         return 0;
 }
 
-static struct acpi_driver sony_acpi_driver = {
-        .name = ACPI_SNC_DRIVER_NAME,
-        .class = ACPI_SNC_CLASS,
-        .ids = ACPI_SNC_HID,
+static struct acpi_driver sony_nc_driver = {
+        .name = SONY_NC_DRIVER_NAME,
+        .class = SONY_NC_CLASS,
+        .ids = SONY_NC_HID,
+        .owner = THIS_MODULE,
         .ops = {
-                .add = sony_acpi_add,
-                .remove = sony_acpi_remove,
-                .resume = sony_acpi_resume,
+                .add = sony_nc_add,
+                .remove = sony_nc_remove,
+                .resume = sony_nc_resume,
                 },
 };
 
-static int __init sony_acpi_init(void)
+/*********** SPIC (SNY6001) Device ***********/
+
+#define SONYPI_DEVICE_TYPE1     0x00000001
+#define SONYPI_DEVICE_TYPE2     0x00000002
+#define SONYPI_DEVICE_TYPE3     0x00000004
+
+#define SONY_PIC_EV_MASK        0xff
+
+struct sony_pic_ioport {
+        struct acpi_resource_io io;
+        struct list_head        list;
+};
+
+struct sony_pic_irq {
+        struct acpi_resource_irq        irq;
+        struct list_head                list;
+};
+
+struct sony_pic_dev {
+        int                     model;
+        u8                      camera_power;
+        u8                      bluetooth_power;
+        u8                      wwan_power;
+        struct acpi_device      *acpi_dev;
+        struct sony_pic_irq     *cur_irq;
+        struct sony_pic_ioport  *cur_ioport;
+        struct list_head        interrupts;
+        struct list_head        ioports;
+        struct mutex            lock;
+};
+
+static struct sony_pic_dev spic_dev = {
+        .interrupts     = LIST_HEAD_INIT(spic_dev.interrupts),
+        .ioports        = LIST_HEAD_INIT(spic_dev.ioports),
+};
+
+/* Event masks */
+#define SONYPI_JOGGER_MASK                      0x00000001
+#define SONYPI_CAPTURE_MASK                     0x00000002
+#define SONYPI_FNKEY_MASK                       0x00000004
+#define SONYPI_BLUETOOTH_MASK                   0x00000008
+#define SONYPI_PKEY_MASK                        0x00000010
+#define SONYPI_BACK_MASK                        0x00000020
+#define SONYPI_HELP_MASK                        0x00000040
+#define SONYPI_LID_MASK                         0x00000080
+#define SONYPI_ZOOM_MASK                        0x00000100
+#define SONYPI_THUMBPHRASE_MASK                 0x00000200
+#define SONYPI_MEYE_MASK                        0x00000400
+#define SONYPI_MEMORYSTICK_MASK                 0x00000800
+#define SONYPI_BATTERY_MASK                     0x00001000
+#define SONYPI_WIRELESS_MASK                    0x00002000
+
+struct sonypi_event {
+        u8      data;
+        u8      event;
+};
+
+/* The set of possible button release events */
+static struct sonypi_event sonypi_releaseev[] = {
+        { 0x00, SONYPI_EVENT_ANYBUTTON_RELEASED },
+        { 0, 0 }
+};
+
+/* The set of possible jogger events  */
+static struct sonypi_event sonypi_joggerev[] = {
+        { 0x1f, SONYPI_EVENT_JOGDIAL_UP },
+        { 0x01, SONYPI_EVENT_JOGDIAL_DOWN },
+        { 0x5f, SONYPI_EVENT_JOGDIAL_UP_PRESSED },
+        { 0x41, SONYPI_EVENT_JOGDIAL_DOWN_PRESSED },
+        { 0x1e, SONYPI_EVENT_JOGDIAL_FAST_UP },
+        { 0x02, SONYPI_EVENT_JOGDIAL_FAST_DOWN },
+        { 0x5e, SONYPI_EVENT_JOGDIAL_FAST_UP_PRESSED },
+        { 0x42, SONYPI_EVENT_JOGDIAL_FAST_DOWN_PRESSED },
+        { 0x1d, SONYPI_EVENT_JOGDIAL_VFAST_UP },
+        { 0x03, SONYPI_EVENT_JOGDIAL_VFAST_DOWN },
+        { 0x5d, SONYPI_EVENT_JOGDIAL_VFAST_UP_PRESSED },
+        { 0x43, SONYPI_EVENT_JOGDIAL_VFAST_DOWN_PRESSED },
+        { 0x40, SONYPI_EVENT_JOGDIAL_PRESSED },
+        { 0, 0 }
+};
+
+/* The set of possible capture button events */
+static struct sonypi_event sonypi_captureev[] = {
+        { 0x05, SONYPI_EVENT_CAPTURE_PARTIALPRESSED },
+        { 0x07, SONYPI_EVENT_CAPTURE_PRESSED },
+        { 0x01, SONYPI_EVENT_CAPTURE_PARTIALRELEASED },
+        { 0, 0 }
+};
+
+/* The set of possible fnkeys events */
+static struct sonypi_event sonypi_fnkeyev[] = {
+        { 0x10, SONYPI_EVENT_FNKEY_ESC },
+        { 0x11, SONYPI_EVENT_FNKEY_F1 },
+        { 0x12, SONYPI_EVENT_FNKEY_F2 },
+        { 0x13, SONYPI_EVENT_FNKEY_F3 },
+        { 0x14, SONYPI_EVENT_FNKEY_F4 },
+        { 0x15, SONYPI_EVENT_FNKEY_F5 },
+        { 0x16, SONYPI_EVENT_FNKEY_F6 },
+        { 0x17, SONYPI_EVENT_FNKEY_F7 },
+        { 0x18, SONYPI_EVENT_FNKEY_F8 },
+        { 0x19, SONYPI_EVENT_FNKEY_F9 },
+        { 0x1a, SONYPI_EVENT_FNKEY_F10 },
+        { 0x1b, SONYPI_EVENT_FNKEY_F11 },
+        { 0x1c, SONYPI_EVENT_FNKEY_F12 },
+        { 0x1f, SONYPI_EVENT_FNKEY_RELEASED },
+        { 0x21, SONYPI_EVENT_FNKEY_1 },
+        { 0x22, SONYPI_EVENT_FNKEY_2 },
+        { 0x31, SONYPI_EVENT_FNKEY_D },
+        { 0x32, SONYPI_EVENT_FNKEY_E },
+        { 0x33, SONYPI_EVENT_FNKEY_F },
+        { 0x34, SONYPI_EVENT_FNKEY_S },
+        { 0x35, SONYPI_EVENT_FNKEY_B },
+        { 0x36, SONYPI_EVENT_FNKEY_ONLY },
+        { 0, 0 }
+};
+
+/* The set of possible program key events */
+static struct sonypi_event sonypi_pkeyev[] = {
+        { 0x01, SONYPI_EVENT_PKEY_P1 },
+        { 0x02, SONYPI_EVENT_PKEY_P2 },
+        { 0x04, SONYPI_EVENT_PKEY_P3 },
+        { 0x5c, SONYPI_EVENT_PKEY_P1 },
+        { 0, 0 }
+};
+
+/* The set of possible bluetooth events */
+static struct sonypi_event sonypi_blueev[] = {
+        { 0x55, SONYPI_EVENT_BLUETOOTH_PRESSED },
+        { 0x59, SONYPI_EVENT_BLUETOOTH_ON },
+        { 0x5a, SONYPI_EVENT_BLUETOOTH_OFF },
+        { 0, 0 }
+};
+
+/* The set of possible wireless events */
+static struct sonypi_event sonypi_wlessev[] = {
+        { 0x59, SONYPI_EVENT_WIRELESS_ON },
+        { 0x5a, SONYPI_EVENT_WIRELESS_OFF },
+        { 0, 0 }
+};
+
+/* The set of possible back button events */
+static struct sonypi_event sonypi_backev[] = {
+        { 0x20, SONYPI_EVENT_BACK_PRESSED },
+        { 0, 0 }
+};
+
+/* The set of possible help button events */
+static struct sonypi_event sonypi_helpev[] = {
+        { 0x3b, SONYPI_EVENT_HELP_PRESSED },
+        { 0, 0 }
+};
+
+
+/* The set of possible lid events */
+static struct sonypi_event sonypi_lidev[] = {
+        { 0x51, SONYPI_EVENT_LID_CLOSED },
+        { 0x50, SONYPI_EVENT_LID_OPENED },
+        { 0, 0 }
+};
+
+/* The set of possible zoom events */
+static struct sonypi_event sonypi_zoomev[] = {
+        { 0x39, SONYPI_EVENT_ZOOM_PRESSED },
+        { 0, 0 }
+};
+
+/* The set of possible thumbphrase events */
+static struct sonypi_event sonypi_thumbphraseev[] = {
+        { 0x3a, SONYPI_EVENT_THUMBPHRASE_PRESSED },
+        { 0, 0 }
+};
+
+/* The set of possible motioneye camera events */
+static struct sonypi_event sonypi_meyeev[] = {
+        { 0x00, SONYPI_EVENT_MEYE_FACE },
+        { 0x01, SONYPI_EVENT_MEYE_OPPOSITE },
+        { 0, 0 }
+};
+
+/* The set of possible memorystick events */
+static struct sonypi_event sonypi_memorystickev[] = {
+        { 0x53, SONYPI_EVENT_MEMORYSTICK_INSERT },
+        { 0x54, SONYPI_EVENT_MEMORYSTICK_EJECT },
+        { 0, 0 }
+};
+
+/* The set of possible battery events */
+static struct sonypi_event sonypi_batteryev[] = {
+        { 0x20, SONYPI_EVENT_BATTERY_INSERT },
+        { 0x30, SONYPI_EVENT_BATTERY_REMOVE },
+        { 0, 0 }
+};
+
+static struct sonypi_eventtypes {
+        int                     model;
+        u8                      data;
+        unsigned long           mask;
+        struct sonypi_event *   events;
+} sony_pic_eventtypes[] = {
+        { SONYPI_DEVICE_TYPE1, 0, 0xffffffff, sonypi_releaseev },
+        { SONYPI_DEVICE_TYPE1, 0x70, SONYPI_MEYE_MASK, sonypi_meyeev },
+        { SONYPI_DEVICE_TYPE1, 0x30, SONYPI_LID_MASK, sonypi_lidev },
+        { SONYPI_DEVICE_TYPE1, 0x60, SONYPI_CAPTURE_MASK, sonypi_captureev },
+        { SONYPI_DEVICE_TYPE1, 0x10, SONYPI_JOGGER_MASK, sonypi_joggerev },
+        { SONYPI_DEVICE_TYPE1, 0x20, SONYPI_FNKEY_MASK, sonypi_fnkeyev },
+        { SONYPI_DEVICE_TYPE1, 0x30, SONYPI_BLUETOOTH_MASK, sonypi_blueev },
+        { SONYPI_DEVICE_TYPE1, 0x40, SONYPI_PKEY_MASK, sonypi_pkeyev },
+        { SONYPI_DEVICE_TYPE1, 0x30, SONYPI_MEMORYSTICK_MASK, sonypi_memorystickev },
+        { SONYPI_DEVICE_TYPE1, 0x40, SONYPI_BATTERY_MASK, sonypi_batteryev },
+
+        { SONYPI_DEVICE_TYPE2, 0, 0xffffffff, sonypi_releaseev },
+        { SONYPI_DEVICE_TYPE2, 0x38, SONYPI_LID_MASK, sonypi_lidev },
+        { SONYPI_DEVICE_TYPE2, 0x11, SONYPI_JOGGER_MASK, sonypi_joggerev },
+        { SONYPI_DEVICE_TYPE2, 0x61, SONYPI_CAPTURE_MASK, sonypi_captureev },
+        { SONYPI_DEVICE_TYPE2, 0x21, SONYPI_FNKEY_MASK, sonypi_fnkeyev },
+        { SONYPI_DEVICE_TYPE2, 0x31, SONYPI_BLUETOOTH_MASK, sonypi_blueev },
+        { SONYPI_DEVICE_TYPE2, 0x08, SONYPI_PKEY_MASK, sonypi_pkeyev },
+        { SONYPI_DEVICE_TYPE2, 0x11, SONYPI_BACK_MASK, sonypi_backev },
+        { SONYPI_DEVICE_TYPE2, 0x21, SONYPI_HELP_MASK, sonypi_helpev },
+        { SONYPI_DEVICE_TYPE2, 0x21, SONYPI_ZOOM_MASK, sonypi_zoomev },
+        { SONYPI_DEVICE_TYPE2, 0x20, SONYPI_THUMBPHRASE_MASK, sonypi_thumbphraseev },
+        { SONYPI_DEVICE_TYPE2, 0x31, SONYPI_MEMORYSTICK_MASK, sonypi_memorystickev },
+        { SONYPI_DEVICE_TYPE2, 0x41, SONYPI_BATTERY_MASK, sonypi_batteryev },
+        { SONYPI_DEVICE_TYPE2, 0x31, SONYPI_PKEY_MASK, sonypi_pkeyev },
+
+        { SONYPI_DEVICE_TYPE3, 0, 0xffffffff, sonypi_releaseev },
+        { SONYPI_DEVICE_TYPE3, 0x21, SONYPI_FNKEY_MASK, sonypi_fnkeyev },
+        { SONYPI_DEVICE_TYPE3, 0x31, SONYPI_WIRELESS_MASK, sonypi_wlessev },
+        { SONYPI_DEVICE_TYPE3, 0x31, SONYPI_MEMORYSTICK_MASK, sonypi_memorystickev },
+        { SONYPI_DEVICE_TYPE3, 0x41, SONYPI_BATTERY_MASK, sonypi_batteryev },
+        { SONYPI_DEVICE_TYPE3, 0x31, SONYPI_PKEY_MASK, sonypi_pkeyev },
+        { 0 }
+};
+
+static int sony_pic_detect_device_type(void)
+{
+        struct pci_dev *pcidev;
+        int model = 0;
+
+        if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                     PCI_DEVICE_ID_INTEL_82371AB_3, NULL)))
+                model = SONYPI_DEVICE_TYPE1;
+
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
+                model = SONYPI_DEVICE_TYPE3;
+
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+                model = SONYPI_DEVICE_TYPE3;
+
+        else
+                model = SONYPI_DEVICE_TYPE2;
+
+        if (pcidev)
+                pci_dev_put(pcidev);
+
+        printk(KERN_INFO DRV_PFX "detected Type%d model\n",
+                        model == SONYPI_DEVICE_TYPE1 ? 1 :
+                        model == SONYPI_DEVICE_TYPE2 ? 2 : 3);
+        return model;
+}
+
+#define ITERATIONS_LONG         10000
+#define ITERATIONS_SHORT        10
+#define wait_on_command(command, iterations) {                          \
+        unsigned int n = iterations;                                    \
+        while (--n && (command))                                        \
+                udelay(1);                                              \
+        if (!n)                                                         \
+                dprintk("command failed at %s : %s (line %d)\n",        \
+                                __FILE__, __FUNCTION__, __LINE__);      \
+}
+
+static u8 sony_pic_call1(u8 dev)
+{
+        u8 v1, v2;
+
+        wait_on_command(inb_p(spic_dev.cur_ioport->io.minimum + 4) & 2,
+                        ITERATIONS_LONG);
+        outb(dev, spic_dev.cur_ioport->io.minimum + 4);
+        v1 = inb_p(spic_dev.cur_ioport->io.minimum + 4);
+        v2 = inb_p(spic_dev.cur_ioport->io.minimum);
+        dprintk("sony_pic_call1: 0x%.4x\n", (v2 << 8) | v1);
+        return v2;
+}
+
+static u8 sony_pic_call2(u8 dev, u8 fn)
+{
+        u8 v1;
+
+        wait_on_command(inb_p(spic_dev.cur_ioport->io.minimum + 4) & 2,
+                        ITERATIONS_LONG);
+        outb(dev, spic_dev.cur_ioport->io.minimum + 4);
+        wait_on_command(inb_p(spic_dev.cur_ioport->io.minimum + 4) & 2,
+                        ITERATIONS_LONG);
+        outb(fn, spic_dev.cur_ioport->io.minimum);
+        v1 = inb_p(spic_dev.cur_ioport->io.minimum);
+        dprintk("sony_pic_call2: 0x%.4x\n", v1);
+        return v1;
+}
+
+static u8 sony_pic_call3(u8 dev, u8 fn, u8 v)
+{
+        u8 v1;
+
+        wait_on_command(inb_p(spic_dev.cur_ioport->io.minimum + 4) & 2, ITERATIONS_LONG);
+        outb(dev, spic_dev.cur_ioport->io.minimum + 4);
+        wait_on_command(inb_p(spic_dev.cur_ioport->io.minimum + 4) & 2, ITERATIONS_LONG);
+        outb(fn, spic_dev.cur_ioport->io.minimum);
+        wait_on_command(inb_p(spic_dev.cur_ioport->io.minimum + 4) & 2, ITERATIONS_LONG);
+        outb(v, spic_dev.cur_ioport->io.minimum);
+        v1 = inb_p(spic_dev.cur_ioport->io.minimum);
+        dprintk("sony_pic_call3: 0x%.4x\n", v1);
+        return v1;
+}
+
+/* camera tests and poweron/poweroff */
+#define SONYPI_CAMERA_PICTURE           5
+#define SONYPI_CAMERA_CONTROL           0x10
+
+#define SONYPI_CAMERA_BRIGHTNESS                0
+#define SONYPI_CAMERA_CONTRAST                  1
+#define SONYPI_CAMERA_HUE                       2
+#define SONYPI_CAMERA_COLOR                     3
+#define SONYPI_CAMERA_SHARPNESS                 4
+
+#define SONYPI_CAMERA_EXPOSURE_MASK             0xC
+#define SONYPI_CAMERA_WHITE_BALANCE_MASK        0x3
+#define SONYPI_CAMERA_PICTURE_MODE_MASK         0x30
+#define SONYPI_CAMERA_MUTE_MASK                 0x40
+
+/* the rest don't need a loop until not 0xff */
+#define SONYPI_CAMERA_AGC                       6
+#define SONYPI_CAMERA_AGC_MASK                  0x30
+#define SONYPI_CAMERA_SHUTTER_MASK              0x7
+
+#define SONYPI_CAMERA_SHUTDOWN_REQUEST          7
+#define SONYPI_CAMERA_CONTROL                   0x10
+
+#define SONYPI_CAMERA_STATUS                    7
+#define SONYPI_CAMERA_STATUS_READY              0x2
+#define SONYPI_CAMERA_STATUS_POSITION           0x4
+
+#define SONYPI_DIRECTION_BACKWARDS              0x4
+
+#define SONYPI_CAMERA_REVISION                  8
+#define SONYPI_CAMERA_ROMVERSION                9
+
+static int __sony_pic_camera_ready(void)
+{
+        u8 v;
+
+        v = sony_pic_call2(0x8f, SONYPI_CAMERA_STATUS);
+        return (v != 0xff && (v & SONYPI_CAMERA_STATUS_READY));
+}
+
+static int __sony_pic_camera_off(void)
+{
+        if (!camera) {
+                printk(KERN_WARNING DRV_PFX "camera control not enabled\n");
+                return -ENODEV;
+        }
+
+        wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_PICTURE,
+                                SONYPI_CAMERA_MUTE_MASK),
+                        ITERATIONS_SHORT);
+
+        if (spic_dev.camera_power) {
+                sony_pic_call2(0x91, 0);
+                spic_dev.camera_power = 0;
+        }
+        return 0;
+}
+
+static int __sony_pic_camera_on(void)
 {
-        return acpi_bus_register_driver(&sony_acpi_driver);
+        int i, j, x;
+
+        if (!camera) {
+                printk(KERN_WARNING DRV_PFX "camera control not enabled\n");
+                return -ENODEV;
+        }
+
+        if (spic_dev.camera_power)
+                return 0;
+
+        for (j = 5; j > 0; j--) {
+
+                for (x = 0; x < 100 && sony_pic_call2(0x91, 0x1); x++)
+                        msleep(10);
+                sony_pic_call1(0x93);
+
+                for (i = 400; i > 0; i--) {
+                        if (__sony_pic_camera_ready())
+                                break;
+                        msleep(10);
+                }
+                if (i)
+                        break;
+        }
+
+        if (j == 0) {
+                printk(KERN_WARNING DRV_PFX "failed to power on camera\n");
+                return -ENODEV;
+        }
+
+        wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_CONTROL,
+                                0x5a),
+                        ITERATIONS_SHORT);
+
+        spic_dev.camera_power = 1;
+        return 0;
+}
+
+/* External camera command (exported to the motion eye v4l driver) */
+int sony_pic_camera_command(int command, u8 value)
+{
+        if (!camera)
+                return -EIO;
+
+        mutex_lock(&spic_dev.lock);
+
+        switch (command) {
+        case SONY_PIC_COMMAND_SETCAMERA:
+                if (value)
+                        __sony_pic_camera_on();
+                else
+                        __sony_pic_camera_off();
+                break;
+        case SONY_PIC_COMMAND_SETCAMERABRIGHTNESS:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_BRIGHTNESS, value),
+                                ITERATIONS_SHORT);
+                break;
+        case SONY_PIC_COMMAND_SETCAMERACONTRAST:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_CONTRAST, value),
+                                ITERATIONS_SHORT);
+                break;
+        case SONY_PIC_COMMAND_SETCAMERAHUE:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_HUE, value),
+                                ITERATIONS_SHORT);
+                break;
+        case SONY_PIC_COMMAND_SETCAMERACOLOR:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_COLOR, value),
+                                ITERATIONS_SHORT);
+                break;
+        case SONY_PIC_COMMAND_SETCAMERASHARPNESS:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_SHARPNESS, value),
+                                ITERATIONS_SHORT);
+                break;
+        case SONY_PIC_COMMAND_SETCAMERAPICTURE:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_PICTURE, value),
+                                ITERATIONS_SHORT);
+                break;
+        case SONY_PIC_COMMAND_SETCAMERAAGC:
+                wait_on_command(sony_pic_call3(0x90, SONYPI_CAMERA_AGC, value),
+                                ITERATIONS_SHORT);
+                break;
+        default:
+                printk(KERN_ERR DRV_PFX "sony_pic_camera_command invalid: %d\n",
+                       command);
+                break;
+        }
+        mutex_unlock(&spic_dev.lock);
+        return 0;
+}
+EXPORT_SYMBOL(sony_pic_camera_command);
+
+/* gprs/edge modem (SZ460N and SZ210P), thanks to Joshua Wise */
+static void sony_pic_set_wwanpower(u8 state)
+{
+        state = !!state;
+        mutex_lock(&spic_dev.lock);
+        if (spic_dev.wwan_power == state) {
+                mutex_unlock(&spic_dev.lock);
+                return;
+        }
+        sony_pic_call2(0xB0, state);
+        spic_dev.wwan_power = state;
+        mutex_unlock(&spic_dev.lock);
+}
+
+static ssize_t sony_pic_wwanpower_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buffer, size_t count)
+{
+        unsigned long value;
+        if (count > 31)
+                return -EINVAL;
+
+        value = simple_strtoul(buffer, NULL, 10);
+        sony_pic_set_wwanpower(value);
+
+        return count;
+}
+
+static ssize_t sony_pic_wwanpower_show(struct device *dev,
+                struct device_attribute *attr, char *buffer)
+{
+        ssize_t count;
+        mutex_lock(&spic_dev.lock);
+        count = snprintf(buffer, PAGE_SIZE, "%d\n", spic_dev.wwan_power);
+        mutex_unlock(&spic_dev.lock);
+        return count;
+}
+
+/* bluetooth subsystem power state */
+static void __sony_pic_set_bluetoothpower(u8 state)
+{
+        state = !!state;
+        if (spic_dev.bluetooth_power == state)
+                return;
+        sony_pic_call2(0x96, state);
+        sony_pic_call1(0x82);
+        spic_dev.bluetooth_power = state;
+}
+
+static ssize_t sony_pic_bluetoothpower_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buffer, size_t count)
+{
+        unsigned long value;
+        if (count > 31)
+                return -EINVAL;
+
+        value = simple_strtoul(buffer, NULL, 10);
+        mutex_lock(&spic_dev.lock);
+        __sony_pic_set_bluetoothpower(value);
+        mutex_unlock(&spic_dev.lock);
+
+        return count;
+}
+
+static ssize_t sony_pic_bluetoothpower_show(struct device *dev,
+                struct device_attribute *attr, char *buffer)
+{
+        ssize_t count = 0;
+        mutex_lock(&spic_dev.lock);
+        count = snprintf(buffer, PAGE_SIZE, "%d\n", spic_dev.bluetooth_power);
+        mutex_unlock(&spic_dev.lock);
+        return count;
+}
+
+/* fan speed */
+/* FAN0 information (reverse engineered from ACPI tables) */
+#define SONY_PIC_FAN0_STATUS    0x93
+static int sony_pic_set_fanspeed(unsigned long value)
+{
+        return ec_write(SONY_PIC_FAN0_STATUS, value);
+}
+
+static int sony_pic_get_fanspeed(u8 *value)
+{
+        return ec_read(SONY_PIC_FAN0_STATUS, value);
+}
+
+static ssize_t sony_pic_fanspeed_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buffer, size_t count)
+{
+        unsigned long value;
+        if (count > 31)
+                return -EINVAL;
+
+        value = simple_strtoul(buffer, NULL, 10);
+        if (sony_pic_set_fanspeed(value))
+                return -EIO;
+
+        return count;
+}
+
+static ssize_t sony_pic_fanspeed_show(struct device *dev,
+                struct device_attribute *attr, char *buffer)
+{
+        u8 value = 0;
+        if (sony_pic_get_fanspeed(&value))
+                return -EIO;
+
+        return snprintf(buffer, PAGE_SIZE, "%d\n", value);
+}
+
+#define SPIC_ATTR(_name, _mode)                                 \
+struct device_attribute spic_attr_##_name = __ATTR(_name,       \
+                _mode, sony_pic_## _name ##_show,               \
+                sony_pic_## _name ##_store)
+
+static SPIC_ATTR(bluetoothpower, 0644);
+static SPIC_ATTR(wwanpower, 0644);
+static SPIC_ATTR(fanspeed, 0644);
+
+static struct attribute *spic_attributes[] = {
+        &spic_attr_bluetoothpower.attr,
+        &spic_attr_wwanpower.attr,
+        &spic_attr_fanspeed.attr,
+        NULL
+};
+
+static struct attribute_group spic_attribute_group = {
+        .attrs = spic_attributes
+};
+
+/******** SONYPI compatibility **********/
+#ifdef CONFIG_SONY_LAPTOP_OLD
+
+/* battery / brightness / temperature  addresses */
+#define SONYPI_BAT_FLAGS        0x81
+#define SONYPI_LCD_LIGHT        0x96
+#define SONYPI_BAT1_PCTRM       0xa0
+#define SONYPI_BAT1_LEFT        0xa2
+#define SONYPI_BAT1_MAXRT       0xa4
+#define SONYPI_BAT2_PCTRM       0xa8
+#define SONYPI_BAT2_LEFT        0xaa
+#define SONYPI_BAT2_MAXRT       0xac
+#define SONYPI_BAT1_MAXTK       0xb0
+#define SONYPI_BAT1_FULL        0xb2
+#define SONYPI_BAT2_MAXTK       0xb8
+#define SONYPI_BAT2_FULL        0xba
+#define SONYPI_TEMP_STATUS      0xC1
+
+struct sonypi_compat_s {
+        struct fasync_struct    *fifo_async;
+        struct kfifo            *fifo;
+        spinlock_t              fifo_lock;
+        wait_queue_head_t       fifo_proc_list;
+        atomic_t                open_count;
+};
+static struct sonypi_compat_s sonypi_compat = {
+        .open_count = ATOMIC_INIT(0),
+};
+
+static int sonypi_misc_fasync(int fd, struct file *filp, int on)
+{
+        int retval;
+
+        retval = fasync_helper(fd, filp, on, &sonypi_compat.fifo_async);
+        if (retval < 0)
+                return retval;
+        return 0;
+}
+
+static int sonypi_misc_release(struct inode *inode, struct file *file)
+{
+        sonypi_misc_fasync(-1, file, 0);
+        atomic_dec(&sonypi_compat.open_count);
+        return 0;
+}
+
+static int sonypi_misc_open(struct inode *inode, struct file *file)
+{
+        /* Flush input queue on first open */
+        if (atomic_inc_return(&sonypi_compat.open_count) == 1)
+                kfifo_reset(sonypi_compat.fifo);
+        return 0;
+}
+
+static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
+                                size_t count, loff_t *pos)
+{
+        ssize_t ret;
+        unsigned char c;
+
+        if ((kfifo_len(sonypi_compat.fifo) == 0) &&
+            (file->f_flags & O_NONBLOCK))
+                return -EAGAIN;
+
+        ret = wait_event_interruptible(sonypi_compat.fifo_proc_list,
+                                       kfifo_len(sonypi_compat.fifo) != 0);
+        if (ret)
+                return ret;
+
+        while (ret < count &&
+               (kfifo_get(sonypi_compat.fifo, &c, sizeof(c)) == sizeof(c))) {
+                if (put_user(c, buf++))
+                        return -EFAULT;
+                ret++;
+        }
+
+        if (ret > 0) {
+                struct inode *inode = file->f_path.dentry->d_inode;
+                inode->i_atime = current_fs_time(inode->i_sb);
+        }
+
+        return ret;
+}
+
+static unsigned int sonypi_misc_poll(struct file *file, poll_table *wait)
+{
+        poll_wait(file, &sonypi_compat.fifo_proc_list, wait);
+        if (kfifo_len(sonypi_compat.fifo))
+                return POLLIN | POLLRDNORM;
+        return 0;
+}
+
+static int ec_read16(u8 addr, u16 *value)
+{
+        u8 val_lb, val_hb;
+        if (ec_read(addr, &val_lb))
+                return -1;
+        if (ec_read(addr + 1, &val_hb))
+                return -1;
+        *value = val_lb | (val_hb << 8);
+        return 0;
+}
+
+static int sonypi_misc_ioctl(struct inode *ip, struct file *fp,
+                             unsigned int cmd, unsigned long arg)
+{
+        int ret = 0;
+        void __user *argp = (void __user *)arg;
+        u8 val8;
+        u16 val16;
+        int value;
+
+        mutex_lock(&spic_dev.lock);
+        switch (cmd) {
+        case SONYPI_IOCGBRT:
+                if (sony_backlight_device == NULL) {
+                        ret = -EIO;
+                        break;
+                }
+                if (acpi_callgetfunc(sony_nc_acpi_handle, "GBRT", &value)) {
+                        ret = -EIO;
+                        break;
+                }
+                val8 = ((value & 0xff) - 1) << 5;
+                if (copy_to_user(argp, &val8, sizeof(val8)))
+                                ret = -EFAULT;
+                break;
+        case SONYPI_IOCSBRT:
+                if (sony_backlight_device == NULL) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_from_user(&val8, argp, sizeof(val8))) {
+                        ret = -EFAULT;
+                        break;
+                }
+                if (acpi_callsetfunc(sony_nc_acpi_handle, "SBRT",
+                                (val8 >> 5) + 1, NULL)) {
+                        ret = -EIO;
+                        break;
+                }
+                /* sync the backlight device status */
+                sony_backlight_device->props.brightness =
+                    sony_backlight_get_brightness(sony_backlight_device);
+                break;
+        case SONYPI_IOCGBAT1CAP:
+                if (ec_read16(SONYPI_BAT1_FULL, &val16)) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_to_user(argp, &val16, sizeof(val16)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCGBAT1REM:
+                if (ec_read16(SONYPI_BAT1_LEFT, &val16)) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_to_user(argp, &val16, sizeof(val16)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCGBAT2CAP:
+                if (ec_read16(SONYPI_BAT2_FULL, &val16)) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_to_user(argp, &val16, sizeof(val16)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCGBAT2REM:
+                if (ec_read16(SONYPI_BAT2_LEFT, &val16)) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_to_user(argp, &val16, sizeof(val16)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCGBATFLAGS:
+                if (ec_read(SONYPI_BAT_FLAGS, &val8)) {
+                        ret = -EIO;
+                        break;
+                }
+                val8 &= 0x07;
+                if (copy_to_user(argp, &val8, sizeof(val8)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCGBLUE:
+                val8 = spic_dev.bluetooth_power;
+                if (copy_to_user(argp, &val8, sizeof(val8)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCSBLUE:
+                if (copy_from_user(&val8, argp, sizeof(val8))) {
+                        ret = -EFAULT;
+                        break;
+                }
+                __sony_pic_set_bluetoothpower(val8);
+                break;
+        /* FAN Controls */
+        case SONYPI_IOCGFAN:
+                if (sony_pic_get_fanspeed(&val8)) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_to_user(argp, &val8, sizeof(val8)))
+                        ret = -EFAULT;
+                break;
+        case SONYPI_IOCSFAN:
+                if (copy_from_user(&val8, argp, sizeof(val8))) {
+                        ret = -EFAULT;
+                        break;
+                }
+                if (sony_pic_set_fanspeed(val8))
+                        ret = -EIO;
+                break;
+        /* GET Temperature (useful under APM) */
+        case SONYPI_IOCGTEMP:
+                if (ec_read(SONYPI_TEMP_STATUS, &val8)) {
+                        ret = -EIO;
+                        break;
+                }
+                if (copy_to_user(argp, &val8, sizeof(val8)))
+                        ret = -EFAULT;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+        mutex_unlock(&spic_dev.lock);
+        return ret;
+}
+
+static const struct file_operations sonypi_misc_fops = {
+        .owner          = THIS_MODULE,
+        .read           = sonypi_misc_read,
+        .poll           = sonypi_misc_poll,
+        .open           = sonypi_misc_open,
+        .release        = sonypi_misc_release,
+        .fasync         = sonypi_misc_fasync,
+        .ioctl          = sonypi_misc_ioctl,
+};
+
+static struct miscdevice sonypi_misc_device = {
+        .minor          = MISC_DYNAMIC_MINOR,
+        .name           = "sonypi",
+        .fops           = &sonypi_misc_fops,
+};
+
+static void sonypi_compat_report_event(u8 event)
+{
+        kfifo_put(sonypi_compat.fifo, (unsigned char *)&event, sizeof(event));
+        kill_fasync(&sonypi_compat.fifo_async, SIGIO, POLL_IN);
+        wake_up_interruptible(&sonypi_compat.fifo_proc_list);
+}
+
+static int sonypi_compat_init(void)
+{
+        int error;
+
+        spin_lock_init(&sonypi_compat.fifo_lock);
+        sonypi_compat.fifo = kfifo_alloc(SONY_LAPTOP_BUF_SIZE, GFP_KERNEL,
+                                         &sonypi_compat.fifo_lock);
+        if (IS_ERR(sonypi_compat.fifo)) {
+                printk(KERN_ERR DRV_PFX "kfifo_alloc failed\n");
+                return PTR_ERR(sonypi_compat.fifo);
+        }
+
+        init_waitqueue_head(&sonypi_compat.fifo_proc_list);
+
+        if (minor != -1)
+                sonypi_misc_device.minor = minor;
+        error = misc_register(&sonypi_misc_device);
+        if (error) {
+                printk(KERN_ERR DRV_PFX "misc_register failed\n");
+                goto err_free_kfifo;
+        }
+        if (minor == -1)
+                printk(KERN_INFO DRV_PFX "device allocated minor is %d\n",
+                       sonypi_misc_device.minor);
+
+        return 0;
+
+err_free_kfifo:
+        kfifo_free(sonypi_compat.fifo);
+        return error;
+}
+
+static void sonypi_compat_exit(void)
+{
+        misc_deregister(&sonypi_misc_device);
+        kfifo_free(sonypi_compat.fifo);
+}
+#else
+static int sonypi_compat_init(void) { return 0; }
+static void sonypi_compat_exit(void) { }
+static void sonypi_compat_report_event(u8 event) { }
+#endif /* CONFIG_SONY_LAPTOP_OLD */
+
+/*
+ * ACPI callbacks
+ */
+static acpi_status
+sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
+{
+        u32 i;
+        struct sony_pic_dev *dev = (struct sony_pic_dev *)context;
+
+        switch (resource->type) {
+        case ACPI_RESOURCE_TYPE_START_DEPENDENT:
+        case ACPI_RESOURCE_TYPE_END_DEPENDENT:
+                return AE_OK;
+
+        case ACPI_RESOURCE_TYPE_IRQ:
+                {
+                        struct acpi_resource_irq *p = &resource->data.irq;
+                        struct sony_pic_irq *interrupt = NULL;
+                        if (!p || !p->interrupt_count) {
+                                /*
+                                 * IRQ descriptors may have no IRQ# bits set,
+                                 * particularly those those w/ _STA disabled
+                                 */
+                                dprintk("Blank IRQ resource\n");
+                                return AE_OK;
+                        }
+                        for (i = 0; i < p->interrupt_count; i++) {
+                                if (!p->interrupts[i]) {
+                                        printk(KERN_WARNING DRV_PFX
+                                                        "Invalid IRQ %d\n",
+                                                        p->interrupts[i]);
+                                        continue;
+                                }
+                                interrupt = kzalloc(sizeof(*interrupt),
+                                                GFP_KERNEL);
+                                if (!interrupt)
+                                        return AE_ERROR;
+
+                                list_add_tail(&interrupt->list, &dev->interrupts);
+                                interrupt->irq.triggering = p->triggering;
+                                interrupt->irq.polarity = p->polarity;
+                                interrupt->irq.sharable = p->sharable;
+                                interrupt->irq.interrupt_count = 1;
+                                interrupt->irq.interrupts[0] = p->interrupts[i];
+                        }
+                        return AE_OK;
+                }
+        case ACPI_RESOURCE_TYPE_IO:
+                {
+                        struct acpi_resource_io *io = &resource->data.io;
+                        struct sony_pic_ioport *ioport = NULL;
+                        if (!io) {
+                                dprintk("Blank IO resource\n");
+                                return AE_OK;
+                        }
+
+                        ioport = kzalloc(sizeof(*ioport), GFP_KERNEL);
+                        if (!ioport)
+                                return AE_ERROR;
+
+                        list_add_tail(&ioport->list, &dev->ioports);
+                        memcpy(&ioport->io, io, sizeof(*io));
+                        return AE_OK;
+                }
+        default:
+                dprintk("Resource %d isn't an IRQ nor an IO port\n",
+                                resource->type);
+
+        case ACPI_RESOURCE_TYPE_END_TAG:
+                return AE_OK;
+        }
+        return AE_CTRL_TERMINATE;
+}
+
+static int sony_pic_possible_resources(struct acpi_device *device)
+{
+        int result = 0;
+        acpi_status status = AE_OK;
+
+        if (!device)
+                return -EINVAL;
+
+        /* get device status */
+        /* see acpi_pci_link_get_current acpi_pci_link_get_possible */
+        dprintk("Evaluating _STA\n");
+        result = acpi_bus_get_status(device);
+        if (result) {
+                printk(KERN_WARNING DRV_PFX "Unable to read status\n");
+                goto end;
+        }
+
+        if (!device->status.enabled)
+                dprintk("Device disabled\n");
+        else
+                dprintk("Device enabled\n");
+
+        /*
+         * Query and parse 'method'
+         */
+        dprintk("Evaluating %s\n", METHOD_NAME__PRS);
+        status = acpi_walk_resources(device->handle, METHOD_NAME__PRS,
+                        sony_pic_read_possible_resource, &spic_dev);
+        if (ACPI_FAILURE(status)) {
+                printk(KERN_WARNING DRV_PFX
+                                "Failure evaluating %s\n",
+                                METHOD_NAME__PRS);
+                result = -ENODEV;
+        }
+end:
+        return result;
+}
+
+/*
+ *  Disable the spic device by calling its _DIS method
+ */
+static int sony_pic_disable(struct acpi_device *device)
+{
+        if (ACPI_FAILURE(acpi_evaluate_object(device->handle, "_DIS", 0, NULL)))
+                return -ENXIO;
+
+        dprintk("Device disabled\n");
+        return 0;
+}
+
+
+/*
+ *  Based on drivers/acpi/pci_link.c:acpi_pci_link_set
+ *
+ *  Call _SRS to set current resources
+ */
+static int sony_pic_enable(struct acpi_device *device,
+                struct sony_pic_ioport *ioport, struct sony_pic_irq *irq)
+{
+        acpi_status status;
+        int result = 0;
+        struct {
+                struct acpi_resource io_res;
+                struct acpi_resource irq_res;
+                struct acpi_resource end;
+        } *resource;
+        struct acpi_buffer buffer = { 0, NULL };
+
+        if (!ioport || !irq)
+                return -EINVAL;
+
+        /* init acpi_buffer */
+        resource = kzalloc(sizeof(*resource) + 1, GFP_KERNEL);
+        if (!resource)
+                return -ENOMEM;
+
+        buffer.length = sizeof(*resource) + 1;
+        buffer.pointer = resource;
+
+        /* setup io resource */
+        resource->io_res.type = ACPI_RESOURCE_TYPE_IO;
+        resource->io_res.length = sizeof(struct acpi_resource);
+        memcpy(&resource->io_res.data.io, &ioport->io,
+                        sizeof(struct acpi_resource_io));
+
+        /* setup irq resource */
+        resource->irq_res.type = ACPI_RESOURCE_TYPE_IRQ;
+        resource->irq_res.length = sizeof(struct acpi_resource);
+        memcpy(&resource->irq_res.data.irq, &irq->irq,
+                        sizeof(struct acpi_resource_irq));
+        /* we requested a shared irq */
+        resource->irq_res.data.irq.sharable = ACPI_SHARED;
+
+        resource->end.type = ACPI_RESOURCE_TYPE_END_TAG;
+
+        /* Attempt to set the resource */
+        dprintk("Evaluating _SRS\n");
+        status = acpi_set_current_resources(device->handle, &buffer);
+
+        /* check for total failure */
+        if (ACPI_FAILURE(status)) {
+                printk(KERN_ERR DRV_PFX "Error evaluating _SRS");
+                result = -ENODEV;
+                goto end;
+        }
+
+        /* Necessary device initializations calls (from sonypi) */
+        sony_pic_call1(0x82);
+        sony_pic_call2(0x81, 0xff);
+        sony_pic_call1(compat ? 0x92 : 0x82);
+
+end:
+        kfree(resource);
+        return result;
+}
+
+/*****************
+ *
+ * ISR: some event is available
+ *
+ *****************/
+static irqreturn_t sony_pic_irq(int irq, void *dev_id)
+{
+        int i, j;
+        u32 port_val = 0;
+        u8 ev = 0;
+        u8 data_mask = 0;
+        u8 device_event = 0;
+
+        struct sony_pic_dev *dev = (struct sony_pic_dev *) dev_id;
+
+        acpi_os_read_port(dev->cur_ioport->io.minimum, &port_val,
+                        dev->cur_ioport->io.address_length);
+        ev = port_val & SONY_PIC_EV_MASK;
+        data_mask = 0xff & (port_val >> (dev->cur_ioport->io.address_length - 8));
+
+        dprintk("event (0x%.8x [%.2x] [%.2x]) at port 0x%.4x\n",
+                        port_val, ev, data_mask, dev->cur_ioport->io.minimum);
+
+        if (ev == 0x00 || ev == 0xff)
+                return IRQ_HANDLED;
+
+        for (i = 0; sony_pic_eventtypes[i].model; i++) {
+
+                if (spic_dev.model != sony_pic_eventtypes[i].model)
+                        continue;
+
+                if ((data_mask & sony_pic_eventtypes[i].data) !=
+                    sony_pic_eventtypes[i].data)
+                        continue;
+
+                if (!(mask & sony_pic_eventtypes[i].mask))
+                        continue;
+
+                for (j = 0; sony_pic_eventtypes[i].events[j].event; j++) {
+                        if (ev == sony_pic_eventtypes[i].events[j].data) {
+                                device_event =
+                                        sony_pic_eventtypes[i].events[j].event;
+                                goto found;
+                        }
+                }
+        }
+        return IRQ_HANDLED;
+
+found:
+        sony_laptop_report_input_event(device_event);
+        acpi_bus_generate_event(spic_dev.acpi_dev, 1, device_event);
+        sonypi_compat_report_event(device_event);
+
+        return IRQ_HANDLED;
+}
+
+/*****************
+ *
+ *  ACPI driver
+ *
+ *****************/
+static int sony_pic_remove(struct acpi_device *device, int type)
+{
+        struct sony_pic_ioport *io, *tmp_io;
+        struct sony_pic_irq *irq, *tmp_irq;
+
+        sonypi_compat_exit();
+
+        if (sony_pic_disable(device)) {
+                printk(KERN_ERR DRV_PFX "Couldn't disable device.\n");
+                return -ENXIO;
+        }
+
+        free_irq(spic_dev.cur_irq->irq.interrupts[0], &spic_dev);
+        release_region(spic_dev.cur_ioport->io.minimum,
+                        spic_dev.cur_ioport->io.address_length);
+
+        sony_laptop_remove_input();
+
+        /* pf attrs */
+        sysfs_remove_group(&sony_pf_device->dev.kobj, &spic_attribute_group);
+        sony_pf_remove();
+
+        list_for_each_entry_safe(io, tmp_io, &spic_dev.ioports, list) {
+                list_del(&io->list);
+                kfree(io);
+        }
+        list_for_each_entry_safe(irq, tmp_irq, &spic_dev.interrupts, list) {
+                list_del(&irq->list);
+                kfree(irq);
+        }
+        spic_dev.cur_ioport = NULL;
+        spic_dev.cur_irq = NULL;
+
+        dprintk(SONY_PIC_DRIVER_NAME " removed.\n");
+        return 0;
+}
+
+static int sony_pic_add(struct acpi_device *device)
+{
+        int result;
+        struct sony_pic_ioport *io, *tmp_io;
+        struct sony_pic_irq *irq, *tmp_irq;
+
+        printk(KERN_INFO DRV_PFX "%s v%s.\n",
+                SONY_PIC_DRIVER_NAME, SONY_LAPTOP_DRIVER_VERSION);
+
+        spic_dev.acpi_dev = device;
+        strcpy(acpi_device_class(device), "sony/hotkey");
+        spic_dev.model = sony_pic_detect_device_type();
+        mutex_init(&spic_dev.lock);
+
+        /* read _PRS resources */
+        result = sony_pic_possible_resources(device);
+        if (result) {
+                printk(KERN_ERR DRV_PFX
+                                "Unabe to read possible resources.\n");
+                goto err_free_resources;
+        }
+
+        /* setup input devices and helper fifo */
+        result = sony_laptop_setup_input();
+        if (result) {
+                printk(KERN_ERR DRV_PFX
+                                "Unabe to create input devices.\n");
+                goto err_free_resources;
+        }
+
+        /* request io port */
+        list_for_each_entry(io, &spic_dev.ioports, list) {
+                if (request_region(io->io.minimum, io->io.address_length,
+                                        "Sony Programable I/O Device")) {
+                        dprintk("I/O port: 0x%.4x (0x%.4x) + 0x%.2x\n",
+                                        io->io.minimum, io->io.maximum,
+                                        io->io.address_length);
+                        spic_dev.cur_ioport = io;
+                        break;
+                }
+        }
+        if (!spic_dev.cur_ioport) {
+                printk(KERN_ERR DRV_PFX "Failed to request_region.\n");
+                result = -ENODEV;
+                goto err_remove_input;
+        }
+
+        /* request IRQ */
+        list_for_each_entry(irq, &spic_dev.interrupts, list) {
+                if (!request_irq(irq->irq.interrupts[0], sony_pic_irq,
+                                        IRQF_SHARED, "sony-laptop", &spic_dev)) {
+                        dprintk("IRQ: %d - triggering: %d - "
+                                        "polarity: %d - shr: %d\n",
+                                        irq->irq.interrupts[0],
+                                        irq->irq.triggering,
+                                        irq->irq.polarity,
+                                        irq->irq.sharable);
+                        spic_dev.cur_irq = irq;
+                        break;
+                }
+        }
+        if (!spic_dev.cur_irq) {
+                printk(KERN_ERR DRV_PFX "Failed to request_irq.\n");
+                result = -ENODEV;
+                goto err_release_region;
+        }
+
+        /* set resource status _SRS */
+        result = sony_pic_enable(device, spic_dev.cur_ioport, spic_dev.cur_irq);
+        if (result) {
+                printk(KERN_ERR DRV_PFX "Couldn't enable device.\n");
+                goto err_free_irq;
+        }
+
+        spic_dev.bluetooth_power = -1;
+        /* create device attributes */
+        result = sony_pf_add();
+        if (result)
+                goto err_disable_device;
+
+        result = sysfs_create_group(&sony_pf_device->dev.kobj, &spic_attribute_group);
+        if (result)
+                goto err_remove_pf;
+
+        if (sonypi_compat_init())
+                goto err_remove_pf;
+
+        return 0;
+
+err_remove_pf:
+        sony_pf_remove();
+
+err_disable_device:
+        sony_pic_disable(device);
+
+err_free_irq:
+        free_irq(spic_dev.cur_irq->irq.interrupts[0], &spic_dev);
+
+err_release_region:
+        release_region(spic_dev.cur_ioport->io.minimum,
+                        spic_dev.cur_ioport->io.address_length);
+
+err_remove_input:
+        sony_laptop_remove_input();
+
+err_free_resources:
+        list_for_each_entry_safe(io, tmp_io, &spic_dev.ioports, list) {
+                list_del(&io->list);
+                kfree(io);
+        }
+        list_for_each_entry_safe(irq, tmp_irq, &spic_dev.interrupts, list) {
+                list_del(&irq->list);
+                kfree(irq);
+        }
+        spic_dev.cur_ioport = NULL;
+        spic_dev.cur_irq = NULL;
+
+        return result;
+}
+
+static int sony_pic_suspend(struct acpi_device *device, pm_message_t state)
+{
+        if (sony_pic_disable(device))
+                return -ENXIO;
+        return 0;
+}
+
+static int sony_pic_resume(struct acpi_device *device)
+{
+        sony_pic_enable(device, spic_dev.cur_ioport, spic_dev.cur_irq);
+        return 0;
+}
+
+static struct acpi_driver sony_pic_driver = {
+        .name = SONY_PIC_DRIVER_NAME,
+        .class = SONY_PIC_CLASS,
+        .ids = SONY_PIC_HID,
+        .owner = THIS_MODULE,
+        .ops = {
+                .add = sony_pic_add,
+                .remove = sony_pic_remove,
+                .suspend = sony_pic_suspend,
+                .resume = sony_pic_resume,
+                },
+};
+
+static struct dmi_system_id __initdata sonypi_dmi_table[] = {
+        {
+                .ident = "Sony Vaio",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PCG-"),
+                },
+        },
+        {
+                .ident = "Sony Vaio",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-"),
+                },
+        },
+        { }
+};
+
+static int __init sony_laptop_init(void)
+{
+        int result;
+
+        if (!no_spic && dmi_check_system(sonypi_dmi_table)) {
+                result = acpi_bus_register_driver(&sony_pic_driver);
+                if (result) {
+                        printk(KERN_ERR DRV_PFX
+                                        "Unable to register SPIC driver.");
+                        goto out;
+                }
+        }
+
+        result = acpi_bus_register_driver(&sony_nc_driver);
+        if (result) {
+                printk(KERN_ERR DRV_PFX "Unable to register SNC driver.");
+                goto out_unregister_pic;
+        }
+
+        return 0;
+
+out_unregister_pic:
+        if (!no_spic)
+                acpi_bus_unregister_driver(&sony_pic_driver);
+out:
+        return result;
 }
 
-static void __exit sony_acpi_exit(void)
+static void __exit sony_laptop_exit(void)
 {
-        acpi_bus_unregister_driver(&sony_acpi_driver);
+        acpi_bus_unregister_driver(&sony_nc_driver);
+        if (!no_spic)
+                acpi_bus_unregister_driver(&sony_pic_driver);
 }
 
-module_init(sony_acpi_init);
-module_exit(sony_acpi_exit);
+module_init(sony_laptop_init);
+module_exit(sony_laptop_exit);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index c3f9f599f134..a3d46ea37126 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2263,6 +2263,7 @@ config GIANFAR
         tristate "Gianfar Ethernet"
         depends on 85xx || 83xx || PPC_86xx
         select PHYLIB
+        select CRC32
         help
           This driver supports the Gigabit TSEC on the MPC83xx, MPC85xx,
           and MPC86xx family of chips, and the FEC on the 8540.
diff --git a/drivers/net/atl1/atl1_hw.c b/drivers/net/atl1/atl1_hw.c
index 314dbaabb642..69482e0d849b 100644
--- a/drivers/net/atl1/atl1_hw.c
+++ b/drivers/net/atl1/atl1_hw.c
@@ -334,7 +334,6 @@ u32 atl1_hash_mc_addr(struct atl1_hw *hw, u8 *mc_addr)
         int i;
 
         crc32 = ether_crc_le(6, mc_addr);
-        crc32 = ~crc32;
         for (i = 0; i < 32; i++)
                 value |= (((crc32 >> i) & 1) << (31 - i));
 
diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index dee3638ad744..8606eac5bec8 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -2320,6 +2320,16 @@ static void __devexit atl1_remove(struct pci_dev *pdev)
                 return;
 
         adapter = netdev_priv(netdev);
+
+        /* Some atl1 boards lack persistent storage for their MAC, and get it
+         * from the BIOS during POST.  If we've been messing with the MAC
+         * address, we need to save the permanent one.
+         */
+        if (memcmp(adapter->hw.mac_addr, adapter->hw.perm_mac_addr, ETH_ALEN)) {
+                memcpy(adapter->hw.mac_addr, adapter->hw.perm_mac_addr, ETH_ALEN);
+                atl1_set_mac_addr(&adapter->hw);
+        }
+
         iowrite16(0, adapter->hw.hw_addr + REG_GPHY_ENABLE);
         unregister_netdev(netdev);
         pci_iounmap(pdev, adapter->hw.hw_addr);
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index aaada572732a..d742bfe24471 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1709,7 +1709,7 @@ static void __b44_set_rx_mode(struct net_device *dev)
                 bw32(bp, B44_RXCONFIG, val);
         } else {
                 unsigned char zero[6] = {0, 0, 0, 0, 0, 0};
-                int i = 0;
+                int i = 1;
 
                 __b44_set_mac_addr(bp);
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index c12e5ea61819..e85f5ec48f96 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.5"
-#define DRV_MODULE_RELDATE      "February 1, 2007"
+#define DRV_MODULE_VERSION      "1.5.8"
+#define DRV_MODULE_RELDATE      "April 24, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -2033,8 +2033,8 @@ bnx2_has_work(struct bnx2 *bp)
             (sblk->status_tx_quick_consumer_index0 != bp->hw_tx_cons))
                 return 1;
 
-        if (((sblk->status_attn_bits & STATUS_ATTN_BITS_LINK_STATE) != 0) !=
-            bp->link_up)
+        if ((sblk->status_attn_bits & STATUS_ATTN_BITS_LINK_STATE) !=
+            (sblk->status_attn_bits_ack & STATUS_ATTN_BITS_LINK_STATE))
                 return 1;
 
         return 0;
@@ -3099,20 +3099,18 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
 
         if ((align_start = (offset32 & 3))) {
                 offset32 &= ~3;
-                len32 += (4 - align_start);
+                len32 += align_start;
+                if (len32 < 4)
+                        len32 = 4;
                 if ((rc = bnx2_nvram_read(bp, offset32, start, 4)))
                         return rc;
         }
 
         if (len32 & 3) {
-                if ((len32 > 4) || !align_start) {
-                        align_end = 4 - (len32 & 3);
-                        len32 += align_end;
-                        if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4,
-                                end, 4))) {
-                                return rc;
-                        }
-                }
+                align_end = 4 - (len32 & 3);
+                len32 += align_end;
+                if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4, end, 4)))
+                        return rc;
         }
 
         if (align_start || align_end) {
@@ -3187,17 +3185,17 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 if ((rc = bnx2_enable_nvram_write(bp)) != 0)
                         goto nvram_write_end;
 
-                /* Erase the page */
-                if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
-                        goto nvram_write_end;
-
-                /* Re-enable the write again for the actual write */
-                bnx2_enable_nvram_write(bp);
-
                 /* Loop to write back the buffer data from page_start to
                  * data_start */
                 i = 0;
                 if (bp->flash_info->buffered == 0) {
+                        /* Erase the page */
+                        if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
+                                goto nvram_write_end;
+
+                        /* Re-enable the write again for the actual write */
+                        bnx2_enable_nvram_write(bp);
+
                         for (addr = page_start; addr < data_start;
                                 addr += 4, i += 4) {
 
@@ -3423,6 +3421,9 @@ bnx2_init_chip(struct bnx2 *bp)
         val = REG_RD(bp, BNX2_MQ_CONFIG);
         val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
         val |= BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE_256;
+        if (CHIP_ID(bp) == CHIP_ID_5709_A0 || CHIP_ID(bp) == CHIP_ID_5709_A1)
+                val |= BNX2_MQ_CONFIG_HALT_DIS;
+
         REG_WR(bp, BNX2_MQ_CONFIG, val);
 
         val = 0x10000 + (MAX_CID_CNT * MB_KERNEL_CTX_SIZE);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index ccbdf81c6599..878eee58f12a 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6518,6 +6518,7 @@ struct bnx2 {
 #define CHIP_ID_5708_B0                 0x57081000
 #define CHIP_ID_5708_B1                 0x57081010
 #define CHIP_ID_5709_A0                 0x57090000
+#define CHIP_ID_5709_A1                 0x57090010
 
 #define CHIP_BOND_ID(bp)                (((bp)->chip_id) & 0xf)
 
diff --git a/drivers/net/cxgb3/common.h b/drivers/net/cxgb3/common.h
index 85e5543cfb57..8d1379633698 100644
--- a/drivers/net/cxgb3/common.h
+++ b/drivers/net/cxgb3/common.h
@@ -112,8 +112,7 @@ enum {
 };
 
 enum {
-        SUPPORTED_OFFLOAD = 1 << 24,
-        SUPPORTED_IRQ = 1 << 25
+        SUPPORTED_IRQ      = 1 << 24
 };
 
 enum {                          /* adapter interrupt-maintained statistics */
@@ -358,6 +357,9 @@ enum {
         MC5_MODE_72_BIT = 2
 };
 
+/* MC5 min active region size */
+enum { MC5_MIN_TIDS = 16 };
+
 struct vpd_params {
         unsigned int cclk;
         unsigned int mclk;
@@ -402,6 +404,7 @@ struct adapter_params {
         unsigned int stats_update_period;       /* MAC stats accumulation period */
         unsigned int linkpoll_period;   /* link poll period in 0.1s */
         unsigned int rev;       /* chip revision */
+        unsigned int offload;
 };
 
 enum {                                      /* chip revisions */
@@ -475,8 +478,11 @@ struct cmac {
         struct adapter *adapter;
         unsigned int offset;
         unsigned int nucast;    /* # of address filters for unicast MACs */
-        unsigned int tcnt;
-        unsigned int xcnt;
+        unsigned int tx_tcnt;
+        unsigned int tx_xcnt;
+        u64 tx_mcnt;
+        unsigned int rx_xcnt;
+        u64 rx_mcnt;
         unsigned int toggle_cnt;
         unsigned int txen;
         struct mac_stats stats;
@@ -602,7 +608,7 @@ static inline int is_10G(const struct adapter *adap)
 
 static inline int is_offload(const struct adapter *adap)
 {
-        return adapter_info(adap)->caps & SUPPORTED_OFFLOAD;
+        return adap->params.offload;
 }
 
 static inline unsigned int core_ticks_per_usec(const struct adapter *adap)
diff --git a/drivers/net/cxgb3/cxgb3_defs.h b/drivers/net/cxgb3/cxgb3_defs.h
index e14862b43d17..483a594210a7 100644
--- a/drivers/net/cxgb3/cxgb3_defs.h
+++ b/drivers/net/cxgb3/cxgb3_defs.h
@@ -67,7 +67,10 @@ static inline union listen_entry *stid2entry(const struct tid_info *t,
 static inline struct t3c_tid_entry *lookup_tid(const struct tid_info *t,
                                                unsigned int tid)
 {
-        return tid < t->ntids ? &(t->tid_tab[tid]) : NULL;
+        struct t3c_tid_entry *t3c_tid = tid < t->ntids ?
+            &(t->tid_tab[tid]) : NULL;
+
+        return (t3c_tid && t3c_tid->client) ? t3c_tid : NULL;
 }
 
 /*
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index d55383610559..67b4b219d927 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -185,16 +185,24 @@ void t3_os_link_changed(struct adapter *adapter, int port_id, int link_stat,
                         int speed, int duplex, int pause)
 {
         struct net_device *dev = adapter->port[port_id];
+        struct port_info *pi = netdev_priv(dev);
+        struct cmac *mac = &pi->mac;
 
         /* Skip changes from disabled ports. */
         if (!netif_running(dev))
                 return;
 
         if (link_stat != netif_carrier_ok(dev)) {
-                if (link_stat)
+                if (link_stat) {
+                        t3_mac_enable(mac, MAC_DIRECTION_RX);
                         netif_carrier_on(dev);
-                else
+                } else {
                         netif_carrier_off(dev);
+                        pi->phy.ops->power_down(&pi->phy, 1);
+                        t3_mac_disable(mac, MAC_DIRECTION_RX);
+                        t3_link_start(&pi->phy, mac, &pi->link_config);
+                }
+
                 link_report(dev);
         }
 }
@@ -407,7 +415,7 @@ static void quiesce_rx(struct adapter *adap)
 static int setup_sge_qsets(struct adapter *adap)
 {
         int i, j, err, irq_idx = 0, qset_idx = 0, dummy_dev_idx = 0;
-        unsigned int ntxq = is_offload(adap) ? SGE_TXQ_PER_SET : 1;
+        unsigned int ntxq = SGE_TXQ_PER_SET;
 
         if (adap->params.rev > 0 && !(adap->flags & USING_MSI))
                 irq_idx = -1;
@@ -485,12 +493,14 @@ static ssize_t show_##name(struct device *d, struct device_attribute *attr, \
 static ssize_t set_nfilters(struct net_device *dev, unsigned int val)
 {
         struct adapter *adap = dev->priv;
+        int min_tids = is_offload(adap) ? MC5_MIN_TIDS : 0;
 
         if (adap->flags & FULL_INIT_DONE)
                 return -EBUSY;
         if (val && adap->params.rev == 0)
                 return -EINVAL;
-        if (val > t3_mc5_size(&adap->mc5) - adap->params.mc5.nservers)
+        if (val > t3_mc5_size(&adap->mc5) - adap->params.mc5.nservers -
+            min_tids)
                 return -EINVAL;
         adap->params.mc5.nfilters = val;
         return 0;
@@ -508,7 +518,8 @@ static ssize_t set_nservers(struct net_device *dev, unsigned int val)
 
         if (adap->flags & FULL_INIT_DONE)
                 return -EBUSY;
-        if (val > t3_mc5_size(&adap->mc5) - adap->params.mc5.nfilters)
+        if (val > t3_mc5_size(&adap->mc5) - adap->params.mc5.nfilters -
+            MC5_MIN_TIDS)
                 return -EINVAL;
         adap->params.mc5.nservers = val;
         return 0;
@@ -708,7 +719,7 @@ static void bind_qsets(struct adapter *adap)
         }
 }
 
-#define FW_FNAME "t3fw-%d.%d.bin"
+#define FW_FNAME "t3fw-%d.%d.%d.bin"
 
 static int upgrade_fw(struct adapter *adap)
 {
@@ -718,7 +729,7 @@ static int upgrade_fw(struct adapter *adap)
         struct device *dev = &adap->pdev->dev;
 
         snprintf(buf, sizeof(buf), FW_FNAME, FW_VERSION_MAJOR,
-                 FW_VERSION_MINOR);
+                 FW_VERSION_MINOR, FW_VERSION_MICRO);
         ret = request_firmware(&fw, buf, dev);
         if (ret < 0) {
                 dev_err(dev, "could not upgrade firmware: unable to load %s\n",
@@ -759,6 +770,8 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto out;
 
+                t3_write_reg(adap, A_ULPRX_TDDP_PSZ, V_HPZ0(PAGE_SHIFT - 12));
+                
                 err = setup_sge_qsets(adap);
                 if (err)
                         goto out;
@@ -919,7 +932,7 @@ static int cxgb_open(struct net_device *dev)
                 return err;
 
         set_bit(pi->port_id, &adapter->open_device_map);
-        if (!ofld_disable) {
+        if (is_offload(adapter) && !ofld_disable) {
                 err = offload_open(dev);
                 if (err)
                         printk(KERN_WARNING
@@ -2106,7 +2119,9 @@ static void check_t3b2_mac(struct adapter *adapter)
 {
         int i;
 
-        rtnl_lock();                      /* synchronize with ifdown */
+        if (!rtnl_trylock())    /* synchronize with ifdown */
+                return;
+
         for_each_port(adapter, i) {
                 struct net_device *dev = adapter->port[i];
                 struct port_info *p = netdev_priv(dev);
@@ -2116,7 +2131,7 @@ static void check_t3b2_mac(struct adapter *adapter)
                         continue;
 
                 status = 0;
-                if (netif_running(dev))
+                if (netif_running(dev) && netif_carrier_ok(dev))
                         status = t3b2_mac_watchdog_task(&p->mac);
                 if (status == 1)
                         p->mac.stats.num_toggled++;
@@ -2267,9 +2282,9 @@ static void __devinit print_port_info(struct adapter *adap,
 
                 if (!test_bit(i, &adap->registered_device_map))
                         continue;
-                printk(KERN_INFO "%s: %s %s RNIC (rev %d) %s%s\n",
+                printk(KERN_INFO "%s: %s %s %sNIC (rev %d) %s%s\n",
                        dev->name, ai->desc, pi->port_type->desc,
-                       adap->params.rev, buf,
+                       is_offload(adap) ? "R" : "", adap->params.rev, buf,
                        (adap->flags & USING_MSIX) ? " MSI-X" :
                        (adap->flags & USING_MSI) ? " MSI" : "");
                 if (adap->name == dev->name && adap->params.vpd.mclk)
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index f6ed033efb56..199e5066acf3 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -508,6 +508,7 @@ void cxgb3_queue_tid_release(struct t3cdev *tdev, unsigned int tid)
 
         spin_lock_bh(&td->tid_release_lock);
         p->ctx = (void *)td->tid_release_list;
+        p->client = NULL;
         td->tid_release_list = p;
         if (!p->ctx)
                 schedule_work(&td->tid_release_task);
@@ -553,7 +554,9 @@ int cxgb3_alloc_atid(struct t3cdev *tdev, struct cxgb3_client *client,
         struct tid_info *t = &(T3C_DATA(tdev))->tid_maps;
 
         spin_lock_bh(&t->atid_lock);
-        if (t->afree) {
+        if (t->afree &&
+            t->atids_in_use + atomic_read(&t->tids_in_use) + MC5_MIN_TIDS <=
+            t->ntids) {
                 union active_open_entry *p = t->afree;
 
                 atid = (p - t->atid_tab) + t->atid_base;
@@ -621,7 +624,8 @@ static int do_act_open_rpl(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_atid(&(T3C_DATA(dev))->tid_maps, atid);
-        if (t3c_tid->ctx && t3c_tid->client && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client &&
+            t3c_tid->client->handlers &&
             t3c_tid->client->handlers[CPL_ACT_OPEN_RPL]) {
                 return t3c_tid->client->handlers[CPL_ACT_OPEN_RPL] (dev, skb,
                                                                     t3c_tid->
@@ -640,7 +644,7 @@ static int do_stid_rpl(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_stid(&(T3C_DATA(dev))->tid_maps, stid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[p->opcode]) {
                 return t3c_tid->client->handlers[p->opcode] (dev, skb,
                                                              t3c_tid->ctx);
@@ -658,7 +662,7 @@ static int do_hwtid_rpl(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_tid(&(T3C_DATA(dev))->tid_maps, hwtid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[p->opcode]) {
                 return t3c_tid->client->handlers[p->opcode]
                     (dev, skb, t3c_tid->ctx);
@@ -687,6 +691,28 @@ static int do_cr(struct t3cdev *dev, struct sk_buff *skb)
         }
 }
 
+/*
+ * Returns an sk_buff for a reply CPL message of size len.  If the input
+ * sk_buff has no other users it is trimmed and reused, otherwise a new buffer
+ * is allocated.  The input skb must be of size at least len.  Note that this
+ * operation does not destroy the original skb data even if it decides to reuse
+ * the buffer.
+ */
+static struct sk_buff *cxgb3_get_cpl_reply_skb(struct sk_buff *skb, size_t len,
+                                               int gfp)
+{
+        if (likely(!skb_cloned(skb))) {
+                BUG_ON(skb->len < len);
+                __skb_trim(skb, len);
+                skb_get(skb);
+        } else {
+                skb = alloc_skb(len, gfp);
+                if (skb)
+                        __skb_put(skb, len);
+        }
+        return skb;
+}
+
 static int do_abort_req_rss(struct t3cdev *dev, struct sk_buff *skb)
 {
         union opcode_tid *p = cplhdr(skb);
@@ -694,30 +720,39 @@ static int do_abort_req_rss(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_tid(&(T3C_DATA(dev))->tid_maps, hwtid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[p->opcode]) {
                 return t3c_tid->client->handlers[p->opcode]
                     (dev, skb, t3c_tid->ctx);
         } else {
                 struct cpl_abort_req_rss *req = cplhdr(skb);
                 struct cpl_abort_rpl *rpl;
+                struct sk_buff *reply_skb;
+                unsigned int tid = GET_TID(req);
+                u8 cmd = req->status;
+
+                if (req->status == CPL_ERR_RTX_NEG_ADVICE ||
+                    req->status == CPL_ERR_PERSIST_NEG_ADVICE)
+                        goto out;
 
-                struct sk_buff *skb =
-                    alloc_skb(sizeof(struct cpl_abort_rpl), GFP_ATOMIC);
-                if (!skb) {
+                reply_skb = cxgb3_get_cpl_reply_skb(skb,
+                                                    sizeof(struct
+                                                           cpl_abort_rpl),
+                                                    GFP_ATOMIC);
+
+                if (!reply_skb) {
                         printk("do_abort_req_rss: couldn't get skb!\n");
                         goto out;
                 }
-                skb->priority = CPL_PRIORITY_DATA;
-                __skb_put(skb, sizeof(struct cpl_abort_rpl));
-                rpl = cplhdr(skb);
+                reply_skb->priority = CPL_PRIORITY_DATA;
+                __skb_put(reply_skb, sizeof(struct cpl_abort_rpl));
+                rpl = cplhdr(reply_skb);
                 rpl->wr.wr_hi =
                     htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_RPL));
-                rpl->wr.wr_lo = htonl(V_WR_TID(GET_TID(req)));
-                OPCODE_TID(rpl) =
-                    htonl(MK_OPCODE_TID(CPL_ABORT_RPL, GET_TID(req)));
-                rpl->cmd = req->status;
-                cxgb3_ofld_send(dev, skb);
+                rpl->wr.wr_lo = htonl(V_WR_TID(tid));
+                OPCODE_TID(rpl) = htonl(MK_OPCODE_TID(CPL_ABORT_RPL, tid));
+                rpl->cmd = cmd;
+                cxgb3_ofld_send(dev, reply_skb);
 out:
                 return CPL_RET_BUF_DONE;
         }
@@ -730,7 +765,7 @@ static int do_act_establish(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_atid(&(T3C_DATA(dev))->tid_maps, atid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[CPL_ACT_ESTABLISH]) {
                 return t3c_tid->client->handlers[CPL_ACT_ESTABLISH]
                     (dev, skb, t3c_tid->ctx);
@@ -741,17 +776,6 @@ static int do_act_establish(struct t3cdev *dev, struct sk_buff *skb)
         }
 }
 
-static int do_set_tcb_rpl(struct t3cdev *dev, struct sk_buff *skb)
-{
-        struct cpl_set_tcb_rpl *rpl = cplhdr(skb);
-
-        if (rpl->status != CPL_ERR_NONE)
-                printk(KERN_ERR
-                       "Unexpected SET_TCB_RPL status %u for tid %u\n",
-                       rpl->status, GET_TID(rpl));
-        return CPL_RET_BUF_DONE;
-}
-
 static int do_trace(struct t3cdev *dev, struct sk_buff *skb)
 {
         struct cpl_trace_pkt *p = cplhdr(skb);
@@ -771,7 +795,7 @@ static int do_term(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_tid(&(T3C_DATA(dev))->tid_maps, hwtid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[opcode]) {
                 return t3c_tid->client->handlers[opcode] (dev, skb,
                                                           t3c_tid->ctx);
@@ -970,7 +994,7 @@ void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
         for (tid = 0; tid < ti->ntids; tid++) {
                 te = lookup_tid(ti, tid);
                 BUG_ON(!te);
-                if (te->ctx && te->client && te->client->redirect) {
+                if (te && te->ctx && te->client && te->client->redirect) {
                         update_tcb = te->client->redirect(te->ctx, old, new, e);
                         if (update_tcb) {
                                 l2t_hold(L2DATA(tdev), e);
@@ -1213,7 +1237,8 @@ void __init cxgb3_offload_init(void)
         t3_register_cpl_handler(CPL_CLOSE_CON_RPL, do_hwtid_rpl);
         t3_register_cpl_handler(CPL_ABORT_REQ_RSS, do_abort_req_rss);
         t3_register_cpl_handler(CPL_ACT_ESTABLISH, do_act_establish);
-        t3_register_cpl_handler(CPL_SET_TCB_RPL, do_set_tcb_rpl);
+        t3_register_cpl_handler(CPL_SET_TCB_RPL, do_hwtid_rpl);
+        t3_register_cpl_handler(CPL_GET_TCB_RPL, do_hwtid_rpl);
         t3_register_cpl_handler(CPL_RDMA_TERMINATE, do_term);
         t3_register_cpl_handler(CPL_RDMA_EC_STATUS, do_hwtid_rpl);
         t3_register_cpl_handler(CPL_TRACE_PKT, do_trace);
diff --git a/drivers/net/cxgb3/mc5.c b/drivers/net/cxgb3/mc5.c
index 644d62ea86a6..84c1ffa8e2d3 100644
--- a/drivers/net/cxgb3/mc5.c
+++ b/drivers/net/cxgb3/mc5.c
@@ -328,6 +328,9 @@ int t3_mc5_init(struct mc5 *mc5, unsigned int nservers, unsigned int nfilters,
         unsigned int tcam_size = mc5->tcam_size;
         struct adapter *adap = mc5->adapter;
 
+        if (!tcam_size)
+                return 0;
+
         if (nroutes > MAX_ROUTES || nroutes + nservers + nfilters > tcam_size)
                 return -EINVAL;
 
diff --git a/drivers/net/cxgb3/regs.h b/drivers/net/cxgb3/regs.h
index b38629a244d0..e5a553410e24 100644
--- a/drivers/net/cxgb3/regs.h
+++ b/drivers/net/cxgb3/regs.h
@@ -1234,9 +1234,15 @@
 
 #define A_ULPRX_ISCSI_TAGMASK 0x514
 
+#define S_HPZ0    0
+#define M_HPZ0    0xf
+#define V_HPZ0(x) ((x) << S_HPZ0)
+#define G_HPZ0(x) (((x) >> S_HPZ0) & M_HPZ0)
+
 #define A_ULPRX_TDDP_LLIMIT 0x51c
 
 #define A_ULPRX_TDDP_ULIMIT 0x520
+#define A_ULPRX_TDDP_PSZ 0x528
 
 #define A_ULPRX_STAG_LLIMIT 0x52c
 
@@ -1940,6 +1946,10 @@
 
 #define V_TXFIFOTHRESH(x) ((x) << S_TXFIFOTHRESH)
 
+#define S_ENDROPPKT    21
+#define V_ENDROPPKT(x) ((x) << S_ENDROPPKT)
+#define F_ENDROPPKT    V_ENDROPPKT(1U)
+
 #define A_XGM_SERDES_CTRL 0x890
 #define A_XGM_SERDES_CTRL0 0x8e0
 
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index c23783432e51..027ab2c3825c 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2631,7 +2631,7 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
         q->txq[TXQ_ETH].stop_thres = nports *
             flits_to_desc(sgl_len(MAX_SKB_FRAGS + 1) + 3);
 
-        if (ntxq == 1) {
+        if (!is_offload(adapter)) {
 #ifdef USE_RX_PAGE
                 q->fl[0].buf_size = RX_PAGE_SIZE;
 #else
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index 791ed6dc1943..fb485d0a43d8 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -438,23 +438,23 @@ static const struct adapter_info t3_adap_info[] = {
         {2, 0, 0, 0,
          F_GPIO2_OEN | F_GPIO4_OEN |
          F_GPIO2_OUT_VAL | F_GPIO4_OUT_VAL, F_GPIO3 | F_GPIO5,
-         SUPPORTED_OFFLOAD,
+         0,
          &mi1_mdio_ops, "Chelsio PE9000"},
         {2, 0, 0, 0,
          F_GPIO2_OEN | F_GPIO4_OEN |
          F_GPIO2_OUT_VAL | F_GPIO4_OUT_VAL, F_GPIO3 | F_GPIO5,
-         SUPPORTED_OFFLOAD,
+         0,
          &mi1_mdio_ops, "Chelsio T302"},
         {1, 0, 0, 0,
          F_GPIO1_OEN | F_GPIO6_OEN | F_GPIO7_OEN | F_GPIO10_OEN |
          F_GPIO1_OUT_VAL | F_GPIO6_OUT_VAL | F_GPIO10_OUT_VAL, 0,
-         SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_OFFLOAD,
+         SUPPORTED_10000baseT_Full | SUPPORTED_AUI,
          &mi1_mdio_ext_ops, "Chelsio T310"},
         {2, 0, 0, 0,
          F_GPIO1_OEN | F_GPIO2_OEN | F_GPIO4_OEN | F_GPIO5_OEN | F_GPIO6_OEN |
          F_GPIO7_OEN | F_GPIO10_OEN | F_GPIO11_OEN | F_GPIO1_OUT_VAL |
          F_GPIO5_OUT_VAL | F_GPIO6_OUT_VAL | F_GPIO10_OUT_VAL, 0,
-         SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_OFFLOAD,
+         SUPPORTED_10000baseT_Full | SUPPORTED_AUI,
          &mi1_mdio_ext_ops, "Chelsio T320"},
 };
 
@@ -1523,19 +1523,25 @@ static int mac_intr_handler(struct adapter *adap, unsigned int idx)
  */
 int t3_phy_intr_handler(struct adapter *adapter)
 {
-        static const int intr_gpio_bits[] = { 8, 0x20 };
-
+        u32 mask, gpi = adapter_info(adapter)->gpio_intr;
         u32 i, cause = t3_read_reg(adapter, A_T3DBG_INT_CAUSE);
 
         for_each_port(adapter, i) {
-                if (cause & intr_gpio_bits[i]) {
-                        struct cphy *phy = &adap2pinfo(adapter, i)->phy;
-                        int phy_cause = phy->ops->intr_handler(phy);
+                struct port_info *p = adap2pinfo(adapter, i);
+
+                mask = gpi - (gpi & (gpi - 1));
+                gpi -= mask;
+
+                if (!(p->port_type->caps & SUPPORTED_IRQ))
+                        continue;
+
+                if (cause & mask) {
+                        int phy_cause = p->phy.ops->intr_handler(&p->phy);
 
                         if (phy_cause & cphy_cause_link_change)
                                 t3_link_changed(adapter, i);
                         if (phy_cause & cphy_cause_fifo_error)
-                                phy->fifo_errors++;
+                                p->phy.fifo_errors++;
                 }
         }
 
@@ -2900,6 +2906,9 @@ static int mc7_init(struct mc7 *mc7, unsigned int mc7_clock, int mem_type)
         struct adapter *adapter = mc7->adapter;
         const struct mc7_timing_params *p = &mc7_timings[mem_type];
 
+        if (!mc7->size)
+                return 0;
+
         val = t3_read_reg(adapter, mc7->offset + A_MC7_CFG);
         slow = val & F_SLOW;
         width = G_WIDTH(val);
@@ -3100,8 +3109,10 @@ int t3_init_hw(struct adapter *adapter, u32 fw_params)
         do {                    /* wait for uP to initialize */
                 msleep(20);
         } while (t3_read_reg(adapter, A_CIM_HOST_ACC_DATA) && --attempts);
-        if (!attempts)
+        if (!attempts) {
+                CH_ERR(adapter, "uP initialization timed out\n");
                 goto out_err;
+        }
 
         err = 0;
 out_err:
@@ -3201,7 +3212,7 @@ static void __devinit mc7_prep(struct adapter *adapter, struct mc7 *mc7,
         mc7->name = name;
         mc7->offset = base_addr - MC7_PMRX_BASE_ADDR;
         cfg = t3_read_reg(adapter, mc7->offset + A_MC7_CFG);
-        mc7->size = mc7_calc_size(cfg);
+        mc7->size = mc7->size = G_DEN(cfg) == M_DEN ? 0 : mc7_calc_size(cfg);
         mc7->width = G_WIDTH(cfg);
 }
 
@@ -3228,6 +3239,7 @@ void early_hw_init(struct adapter *adapter, const struct adapter_info *ai)
                      V_I2C_CLKDIV(adapter->params.vpd.cclk / 80 - 1));
         t3_write_reg(adapter, A_T3DBG_GPIO_EN,
                      ai->gpio_out | F_GPIO0_OEN | F_GPIO0_OUT_VAL);
+        t3_write_reg(adapter, A_MC5_DB_SERVER_INDEX, 0);
 
         if (adapter->params.rev == 0 || !uses_xaui(adapter))
                 val |= F_ENRGMII;
@@ -3326,7 +3338,13 @@ int __devinit t3_prep_adapter(struct adapter *adapter,
                 p->tx_num_pgs = pm_num_pages(p->chan_tx_size, p->tx_pg_size);
                 p->ntimer_qs = p->cm_size >= (128 << 20) ||
                     adapter->params.rev > 0 ? 12 : 6;
+        }
+
+        adapter->params.offload = t3_mc7_size(&adapter->pmrx) &&
+                                  t3_mc7_size(&adapter->pmtx) &&
+                                  t3_mc7_size(&adapter->cm);
 
+        if (is_offload(adapter)) {
                 adapter->params.mc5.nservers = DEFAULT_NSERVERS;
                 adapter->params.mc5.nfilters = adapter->params.rev > 0 ?
                     DEFAULT_NFILTERS : 0;
diff --git a/drivers/net/cxgb3/version.h b/drivers/net/cxgb3/version.h
index 82278f850259..042e27e291cd 100644
--- a/drivers/net/cxgb3/version.h
+++ b/drivers/net/cxgb3/version.h
@@ -36,6 +36,9 @@
 #define DRV_NAME "cxgb3"
 /* Driver version */
 #define DRV_VERSION "1.0-ko"
+
+/* Firmware version */
 #define FW_VERSION_MAJOR 3
-#define FW_VERSION_MINOR 2
+#define FW_VERSION_MINOR 3
+#define FW_VERSION_MICRO 0
 #endif                          /* __CHELSIO_VERSION_H */
diff --git a/drivers/net/cxgb3/xgmac.c b/drivers/net/cxgb3/xgmac.c
index 2b42c13ba8e0..a506792f9575 100644
--- a/drivers/net/cxgb3/xgmac.c
+++ b/drivers/net/cxgb3/xgmac.c
@@ -367,7 +367,8 @@ int t3_mac_enable(struct cmac *mac, int which)
         int idx = macidx(mac);
         struct adapter *adap = mac->adapter;
         unsigned int oft = mac->offset;
-
+        struct mac_stats *s = &mac->stats;
+        
         if (which & MAC_DIRECTION_TX) {
                 t3_write_reg(adap, A_XGM_TX_CTRL + oft, F_TXEN);
                 t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CFG_CH0 + idx);
@@ -376,10 +377,16 @@ int t3_mac_enable(struct cmac *mac, int which)
                 t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 1 << idx);
 
                 t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CNT_CH0 + idx);
-                mac->tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
-                                                            A_TP_PIO_DATA)));
-                mac->xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
-                                                A_XGM_TX_SPI4_SOP_EOP_CNT)));
+                mac->tx_mcnt = s->tx_frames;
+                mac->tx_tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
+                                                        A_TP_PIO_DATA)));
+                mac->tx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_TX_SPI4_SOP_EOP_CNT +
+                                                oft)));
+                mac->rx_mcnt = s->rx_frames;
+                mac->rx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_RX_SPI4_SOP_EOP_CNT +
+                                                oft)));
                 mac->txen = F_TXEN;
                 mac->toggle_cnt = 0;
         }
@@ -392,6 +399,7 @@ int t3_mac_disable(struct cmac *mac, int which)
 {
         int idx = macidx(mac);
         struct adapter *adap = mac->adapter;
+        int val;
 
         if (which & MAC_DIRECTION_TX) {
                 t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
@@ -401,44 +409,89 @@ int t3_mac_disable(struct cmac *mac, int which)
                 t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 1 << idx);
                 mac->txen = 0;
         }
-        if (which & MAC_DIRECTION_RX)
+        if (which & MAC_DIRECTION_RX) {
+                t3_set_reg_field(mac->adapter, A_XGM_RESET_CTRL + mac->offset,
+                                 F_PCS_RESET_, 0);
+                msleep(100);
                 t3_write_reg(adap, A_XGM_RX_CTRL + mac->offset, 0);
+                val = F_MAC_RESET_;
+                if (is_10G(adap))
+                        val |= F_PCS_RESET_;
+                else if (uses_xaui(adap))
+                        val |= F_PCS_RESET_ | F_XG2G_RESET_;
+                else
+                        val |= F_RGMII_RESET_ | F_XG2G_RESET_;
+                t3_write_reg(mac->adapter, A_XGM_RESET_CTRL + mac->offset, val);
+        }
         return 0;
 }
 
 int t3b2_mac_watchdog_task(struct cmac *mac)
 {
         struct adapter *adap = mac->adapter;
-        unsigned int tcnt, xcnt;
+        struct mac_stats *s = &mac->stats;
+        unsigned int tx_tcnt, tx_xcnt;
+        unsigned int tx_mcnt = s->tx_frames;
+        unsigned int rx_mcnt = s->rx_frames;
+        unsigned int rx_xcnt;
         int status;
 
-        t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CNT_CH0 + macidx(mac));
-        tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap, A_TP_PIO_DATA)));
-        xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap, 
-                                           A_XGM_TX_SPI4_SOP_EOP_CNT +
-                                           mac->offset)));
-
-        if (tcnt != mac->tcnt && xcnt == 0 && mac->xcnt == 0) {
-                if (mac->toggle_cnt > 4) {
-                        t3b2_mac_reset(mac);
+        if (tx_mcnt == mac->tx_mcnt) {
+                tx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_TX_SPI4_SOP_EOP_CNT +
+                                                mac->offset)));
+                if (tx_xcnt == 0) {
+                        t3_write_reg(adap, A_TP_PIO_ADDR,
+                                     A_TP_TX_DROP_CNT_CH0 + macidx(mac));
+                        tx_tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
+                                                      A_TP_PIO_DATA)));
+                } else {
                         mac->toggle_cnt = 0;
+                        return 0;
+                }
+        } else {
+                mac->toggle_cnt = 0;
+                return 0;
+        }
+
+        if (((tx_tcnt != mac->tx_tcnt) &&
+             (tx_xcnt == 0) && (mac->tx_xcnt == 0)) ||
+            ((mac->tx_mcnt == tx_mcnt) &&
+             (tx_xcnt != 0) && (mac->tx_xcnt != 0))) {
+                if (mac->toggle_cnt > 4)
                         status = 2;
-                } else {
-                        t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
-                        t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);
-                        t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset,
-                                     mac->txen);
-                        t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);
-                        mac->toggle_cnt++;
+                else 
                         status = 1;
-                }       
         } else {
                 mac->toggle_cnt = 0;
-                status = 0;
+                return 0;
         }
-        mac->tcnt = tcnt;
-        mac->xcnt = xcnt;
 
+        if (rx_mcnt != mac->rx_mcnt)
+                rx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_RX_SPI4_SOP_EOP_CNT +
+                                                mac->offset)));
+        else 
+                return 0;
+
+        if (mac->rx_mcnt != s->rx_frames && rx_xcnt == 0 && mac->rx_xcnt == 0) 
+                status = 2;
+        
+        mac->tx_tcnt = tx_tcnt;
+        mac->tx_xcnt = tx_xcnt;
+        mac->tx_mcnt = s->tx_frames;
+        mac->rx_xcnt = rx_xcnt;
+        mac->rx_mcnt = s->rx_frames;
+        if (status == 1) {
+                t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
+                t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);  /* flush */
+                t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, mac->txen);
+                t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);  /* flush */
+                mac->toggle_cnt++;
+        } else if (status == 2) {
+                t3b2_mac_reset(mac);
+                mac->toggle_cnt = 0;
+        }
         return status;
 }
 
@@ -471,7 +524,6 @@ const struct mac_stats *t3_mac_update_stats(struct cmac *mac)
         RMON_UPDATE(mac, rx_symbol_errs, RX_SYM_CODE_ERR_FRAMES);
 
         RMON_UPDATE(mac, rx_too_long, RX_OVERSIZE_FRAMES);
-        mac->stats.rx_too_long += RMON_READ(mac, A_XGM_RX_MAX_PKT_SIZE_ERR_CNT);
 
         v = RMON_READ(mac, A_XGM_RX_MAX_PKT_SIZE_ERR_CNT);
         if (mac->adapter->params.rev == T3_REV_B2)
diff --git a/drivers/net/depca.c b/drivers/net/depca.c
index 5113eef755b9..f3807aaf10aa 100644
--- a/drivers/net/depca.c
+++ b/drivers/net/depca.c
@@ -1491,8 +1491,9 @@ static void __init depca_platform_probe (void)
                 depca_io_ports[i].device = pldev;
 
                 if (platform_device_add(pldev)) {
-                        platform_device_put(pldev);
                         depca_io_ports[i].device = NULL;
+                        pldev->dev.platform_data = NULL;
+                        platform_device_put(pldev);
                         continue;
                 }
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 1d08e937af82..b28a915bd980 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3796,7 +3796,7 @@ e1000_intr_msi(int irq, void *data)
 
         for (i = 0; i < E1000_MAX_INTR; i++)
                 if (unlikely(!adapter->clean_rx(adapter, adapter->rx_ring) &
-                   e1000_clean_tx_irq(adapter, adapter->tx_ring)))
+                   !e1000_clean_tx_irq(adapter, adapter->tx_ring)))
                         break;
 
         if (likely(adapter->itr_setting & 3))
@@ -3899,7 +3899,7 @@ e1000_intr(int irq, void *data)
 
         for (i = 0; i < E1000_MAX_INTR; i++)
                 if (unlikely(!adapter->clean_rx(adapter, adapter->rx_ring) &
-                   e1000_clean_tx_irq(adapter, adapter->tx_ring)))
+                   !e1000_clean_tx_irq(adapter, adapter->tx_ring)))
                         break;
 
         if (likely(adapter->itr_setting & 3))
@@ -3949,7 +3949,7 @@ e1000_clean(struct net_device *poll_dev, int *budget)
         poll_dev->quota -= work_done;
 
         /* If no Tx and not enough Rx work done, exit the polling mode */
-        if ((tx_cleaned && (work_done < work_to_do)) ||
+        if ((!tx_cleaned && (work_done == 0)) ||
            !netif_running(poll_dev)) {
 quit_polling:
                 if (likely(adapter->itr_setting & 3))
@@ -3979,7 +3979,7 @@ e1000_clean_tx_irq(struct e1000_adapter *adapter,
 #ifdef CONFIG_E1000_NAPI
         unsigned int count = 0;
 #endif
-        boolean_t cleaned = TRUE;
+        boolean_t cleaned = FALSE;
         unsigned int total_tx_bytes=0, total_tx_packets=0;
 
         i = tx_ring->next_to_clean;
@@ -4013,10 +4013,7 @@ e1000_clean_tx_irq(struct e1000_adapter *adapter,
 #ifdef CONFIG_E1000_NAPI
 #define E1000_TX_WEIGHT 64
                 /* weight of a sort for tx, to avoid endless transmit cleanup */
-                if (count++ == E1000_TX_WEIGHT) {
-                        cleaned = FALSE;
-                        break;
-                }
+                if (count++ == E1000_TX_WEIGHT) break;
 #endif
         }
 
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 46e1697d9cfd..d04214e4e581 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -2050,9 +2050,10 @@ static void nv_tx_timeout(struct net_device *dev)
                 nv_drain_tx(dev);
                 nv_init_tx(dev);
                 setup_hw_rings(dev, NV_SETUP_TX_RING);
-                netif_wake_queue(dev);
         }
 
+        netif_wake_queue(dev);
+
         /* 4) restart tx engine */
         nv_start_tx(dev);
         spin_unlock_irq(&np->lock);
@@ -3536,7 +3537,10 @@ static void nv_do_nic_poll(unsigned long data)
         pci_push(base);
 
         if (!using_multi_irqs(dev)) {
-                nv_nic_irq(0, dev);
+                if (np->desc_ver == DESC_VER_3)
+                        nv_nic_irq_optimized(0, dev);
+                else
+                        nv_nic_irq(0, dev);
                 if (np->msi_flags & NV_MSI_X_ENABLED)
                         enable_irq_lockdep(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
                 else
diff --git a/drivers/net/hamradio/baycom_ser_fdx.c b/drivers/net/hamradio/baycom_ser_fdx.c
index 59214e74b9cf..30baf6ecfc63 100644
--- a/drivers/net/hamradio/baycom_ser_fdx.c
+++ b/drivers/net/hamradio/baycom_ser_fdx.c
@@ -75,12 +75,14 @@
 #include <linux/ioport.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <asm/uaccess.h>
-#include <asm/io.h>
 #include <linux/hdlcdrv.h>
 #include <linux/baycom.h>
 #include <linux/jiffies.h>
 
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+
 /* --------------------------------------------------------------------- */
 
 #define BAYCOM_DEBUG
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index ca2b21f9d444..07b4c0d7a75c 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -96,17 +96,24 @@ static void ri_tasklet(unsigned long dev)
                 skb->tc_verd = SET_TC_NCLS(skb->tc_verd);
                 stats->tx_packets++;
                 stats->tx_bytes +=skb->len;
+
+                skb->dev = __dev_get_by_index(skb->iif);
+                if (!skb->dev) {
+                        dev_kfree_skb(skb);
+                        stats->tx_dropped++;
+                        break;
+                }
+                skb->iif = _dev->ifindex;
+
                 if (from & AT_EGRESS) {
                         dp->st_rx_frm_egr++;
                         dev_queue_xmit(skb);
                 } else if (from & AT_INGRESS) {
-
                         dp->st_rx_frm_ing++;
+                        skb_pull(skb, skb->dev->hard_header_len);
                         netif_rx(skb);
-                } else {
-                        dev_kfree_skb(skb);
-                        stats->tx_dropped++;
-                }
+                } else
+                        BUG();
         }
 
         if (netif_tx_trylock(_dev)) {
@@ -157,26 +164,10 @@ static int ifb_xmit(struct sk_buff *skb, struct net_device *dev)
         stats->rx_packets++;
         stats->rx_bytes+=skb->len;
 
-        if (!from || !skb->input_dev) {
-dropped:
+        if (!(from & (AT_INGRESS|AT_EGRESS)) || !skb->iif) {
                 dev_kfree_skb(skb);
                 stats->rx_dropped++;
                 return ret;
-        } else {
-                /*
-                 * note we could be going
-                 * ingress -> egress or
-                 * egress -> ingress
-                */
-                skb->dev = skb->input_dev;
-                skb->input_dev = dev;
-                if (from & AT_INGRESS) {
-                        skb_pull(skb, skb->dev->hard_header_len);
-                } else {
-                        if (!(from & AT_EGRESS)) {
-                                goto dropped;
-                        }
-                }
         }
 
         if (skb_queue_len(&dp->rq) >= dev->tx_queue_len) {
diff --git a/drivers/net/irda/pxaficp_ir.c b/drivers/net/irda/pxaficp_ir.c
index 9137e239fac2..2272156af31e 100644
--- a/drivers/net/irda/pxaficp_ir.c
+++ b/drivers/net/irda/pxaficp_ir.c
@@ -321,15 +321,22 @@ static void pxa_irda_fir_dma_tx_irq(int channel, void *data)
                 pxa_irda_set_speed(si, si->newspeed);
                 si->newspeed = 0;
         } else {
+                int i = 64;
+
                 ICCR0 = 0;
                 pxa_irda_fir_dma_rx_start(si);
+                while ((ICSR1 & ICSR1_RNE) && i--)
+                        (void)ICDR;
                 ICCR0 = ICCR0_ITR | ICCR0_RXE;
+
+                if (i < 0)
+                        printk(KERN_ERR "pxa_ir: cannot clear Rx FIFO!\n");
         }
         netif_wake_queue(dev);
 }
 
 /* EIF(Error in FIFO/End in Frame) handler for FIR */
-static void pxa_irda_fir_irq_eif(struct pxa_irda *si, struct net_device *dev)
+static void pxa_irda_fir_irq_eif(struct pxa_irda *si, struct net_device *dev, int icsr0)
 {
         unsigned int len, stat, data;
 
@@ -350,7 +357,7 @@ static void pxa_irda_fir_irq_eif(struct pxa_irda *si, struct net_device *dev)
                         }
                         if (stat & ICSR1_ROR) {
                                 printk(KERN_DEBUG "pxa_ir: fir receive overrun\n");
-                                si->stats.rx_frame_errors++;
+                                si->stats.rx_over_errors++;
                         }
                 } else  {
                         si->dma_rx_buff[len++] = data;
@@ -362,7 +369,15 @@ static void pxa_irda_fir_irq_eif(struct pxa_irda *si, struct net_device *dev)
 
         if (stat & ICSR1_EOF) {
                 /* end of frame. */
-                struct sk_buff *skb = alloc_skb(len+1,GFP_ATOMIC);
+                struct sk_buff *skb;
+
+                if (icsr0 & ICSR0_FRE) {
+                        printk(KERN_ERR "pxa_ir: dropping erroneous frame\n");
+                        si->stats.rx_dropped++;
+                        return;
+                }
+
+                skb = alloc_skb(len+1,GFP_ATOMIC);
                 if (!skb)  {
                         printk(KERN_ERR "pxa_ir: fir out of memory for receive skb\n");
                         si->stats.rx_dropped++;
@@ -392,7 +407,7 @@ static irqreturn_t pxa_irda_fir_irq(int irq, void *dev_id)
 {
         struct net_device *dev = dev_id;
         struct pxa_irda *si = netdev_priv(dev);
-        int icsr0;
+        int icsr0, i = 64;
 
         /* stop RX DMA */
         DCSR(si->rxdma) &= ~DCSR_RUN;
@@ -412,13 +427,18 @@ static irqreturn_t pxa_irda_fir_irq(int irq, void *dev_id)
 
         if (icsr0 & ICSR0_EIF) {
                 /* An error in FIFO occured, or there is a end of frame */
-                pxa_irda_fir_irq_eif(si, dev);
+                pxa_irda_fir_irq_eif(si, dev, icsr0);
         }
 
         ICCR0 = 0;
         pxa_irda_fir_dma_rx_start(si);
+        while ((ICSR1 & ICSR1_RNE) && i--)
+                (void)ICDR;
         ICCR0 = ICCR0_ITR | ICCR0_RXE;
 
+        if (i < 0)
+                printk(KERN_ERR "pxa_ir: cannot clear Rx FIFO!\n");
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index c9f55bc57edb..8015a7c5b0c9 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1379,7 +1379,7 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
 
         spin_lock_init(&mp->lock);
 
-        port_num = pd->port_number;
+        port_num = mp->port_num = pd->port_number;
 
         /* set default config values */
         eth_port_uc_addr_get(dev, dev->dev_addr);
@@ -1411,8 +1411,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         duplex = pd->duplex;
         speed = pd->speed;
 
-        mp->port_num = port_num;
-
         /* Hook up MII support for ethtool */
         mp->mii.dev = dev;
         mp->mii.mdio_read = mv643xx_mdio_read;
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index b05b20ef8c0a..f8efe0e70a6b 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -71,7 +71,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
 
-#define MYRI10GE_VERSION_STR "1.3.0-1.226"
+#define MYRI10GE_VERSION_STR "1.3.0-1.233"
 
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -900,19 +900,9 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
         /* try to refill entire ring */
         while (rx->fill_cnt != (rx->cnt + rx->mask + 1)) {
                 idx = rx->fill_cnt & rx->mask;
-
-                if ((bytes < MYRI10GE_ALLOC_SIZE / 2) &&
-                    (rx->page_offset + bytes <= MYRI10GE_ALLOC_SIZE)) {
+                if (rx->page_offset + bytes <= MYRI10GE_ALLOC_SIZE) {
                         /* we can use part of previous page */
                         get_page(rx->page);
-#if MYRI10GE_ALLOC_SIZE > 4096
-                        /* Firmware cannot cross 4K boundary.. */
-                        if ((rx->page_offset >> 12) !=
-                            ((rx->page_offset + bytes - 1) >> 12)) {
-                                rx->page_offset =
-                                    (rx->page_offset + bytes) & ~4095;
-                        }
-#endif
                 } else {
                         /* we need a new page */
                         page =
@@ -941,6 +931,13 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
 
                 /* start next packet on a cacheline boundary */
                 rx->page_offset += SKB_DATA_ALIGN(bytes);
+
+#if MYRI10GE_ALLOC_SIZE > 4096
+                /* don't cross a 4KB boundary */
+                if ((rx->page_offset >> 12) !=
+                    ((rx->page_offset + bytes - 1) >> 12))
+                        rx->page_offset = (rx->page_offset + 4096) & ~4095;
+#endif
                 rx->fill_cnt++;
 
                 /* copy 8 descriptors to the firmware at a time */
@@ -2015,10 +2012,9 @@ again:
         mss = 0;
         max_segments = MXGEFW_MAX_SEND_DESC;
 
-        if (skb->len > (dev->mtu + ETH_HLEN)) {
+        if (skb_is_gso(skb)) {
                 mss = skb_shinfo(skb)->gso_size;
-                if (mss != 0)
-                        max_segments = MYRI10GE_MAX_SEND_DESC_TSO;
+                max_segments = MYRI10GE_MAX_SEND_DESC_TSO;
         }
 
         if ((unlikely(avail < max_segments))) {
@@ -2491,6 +2487,10 @@ static void myri10ge_enable_ecrc(struct myri10ge_priv *mgp)
 
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE23 0x25f7
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE47 0x25fa
+#define PCI_DEVICE_ID_INTEL_6300ESB_PCIEE1 0x3510
+#define PCI_DEVICE_ID_INTEL_6300ESB_PCIEE4 0x351b
+#define PCI_DEVICE_ID_INTEL_E3000_PCIE  0x2779
+#define PCI_DEVICE_ID_INTEL_E3010_PCIE  0x277a
 #define PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_FIRST 0x140
 #define PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_LAST 0x142
 
@@ -2530,6 +2530,18 @@ static void myri10ge_select_firmware(struct myri10ge_priv *mgp)
                                 PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_FIRST
                                 && bridge->device <=
                                 PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_LAST)
+                            /* All Intel E3000/E3010 PCIE ports */
+                            || (bridge->vendor == PCI_VENDOR_ID_INTEL
+                                && (bridge->device ==
+                                    PCI_DEVICE_ID_INTEL_E3000_PCIE
+                                    || bridge->device ==
+                                    PCI_DEVICE_ID_INTEL_E3010_PCIE))
+                            /* All Intel 6310/6311/6321ESB PCIE ports */
+                            || (bridge->vendor == PCI_VENDOR_ID_INTEL
+                                && bridge->device >=
+                                PCI_DEVICE_ID_INTEL_6300ESB_PCIEE1
+                                && bridge->device <=
+                                PCI_DEVICE_ID_INTEL_6300ESB_PCIEE4)
                             /* All Intel E5000 PCIE ports */
                             || (bridge->vendor == PCI_VENDOR_ID_INTEL
                                 && bridge->device >=
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 229aa1c4fb79..eff965dc5fff 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -438,6 +438,7 @@ do_rom_fast_read_words(struct netxen_adapter *adapter, int addr,
 
         for (addridx = addr; addridx < (addr + size); addridx += 4) {
                 ret = do_rom_fast_read(adapter, addridx, (int *)bytes);
+                *(int *)bytes = cpu_to_le32(*(int *)bytes);
                 if (ret != 0)
                         break;
                 bytes += 4;
@@ -497,7 +498,7 @@ static inline int do_rom_fast_write_words(struct netxen_adapter *adapter,
                 int timeout = 0;
                 int data;
 
-                data = *(u32*)bytes;
+                data = le32_to_cpu((*(u32*)bytes));
 
                 ret = do_rom_fast_write(adapter, addridx, data);
                 if (ret < 0)
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 933e2f3c77aa..caabbc408c34 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -802,9 +802,9 @@ process_input_packet(struct asyncppp *ap)
 
         /* check for address/control and protocol compression */
         p = skb->data;
-        if (p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) {
+        if (p[0] == PPP_ALLSTATIONS) {
                 /* chop off address/control */
-                if (skb->len < 3)
+                if (p[1] != PPP_UI || skb->len < 3)
                         goto err;
                 p = skb_pull(skb, 2);
         }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 11b575f89856..ef58e4128782 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2544,6 +2544,9 @@ static void ppp_destroy_interface(struct ppp *ppp)
         ppp->active_filter = NULL;
 #endif /* CONFIG_PPP_FILTER */
 
+        if (ppp->xmit_pending)
+                kfree_skb(ppp->xmit_pending);
+
         kfree(ppp);
 }
 
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index d3f65dab306c..a8246eb2f8d9 100755
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -1691,6 +1691,27 @@ static int ql_populate_free_queue(struct ql3_adapter *qdev)
 /*
  * Caller holds hw_lock.
  */
+static void ql_update_small_bufq_prod_index(struct ql3_adapter *qdev)
+{
+        struct ql3xxx_port_registers __iomem *port_regs = qdev->mem_map_registers;
+        if (qdev->small_buf_release_cnt >= 16) {
+                while (qdev->small_buf_release_cnt >= 16) {
+                        qdev->small_buf_q_producer_index++;
+
+                        if (qdev->small_buf_q_producer_index ==
+                            NUM_SBUFQ_ENTRIES)
+                                qdev->small_buf_q_producer_index = 0;
+                        qdev->small_buf_release_cnt -= 8;
+                }
+                wmb();
+                writel(qdev->small_buf_q_producer_index,
+                        &port_regs->CommonRegs.rxSmallQProducerIndex);
+        }
+}
+
+/*
+ * Caller holds hw_lock.
+ */
 static void ql_update_lrg_bufq_prod_index(struct ql3_adapter *qdev)
 {
         struct bufq_addr_element *lrg_buf_q_ele;
@@ -1732,13 +1753,10 @@ static void ql_update_lrg_bufq_prod_index(struct ql3_adapter *qdev)
                                 lrg_buf_q_ele = qdev->lrg_buf_q_virt_addr;
                         }
                 }
-
+                wmb();
                 qdev->lrg_buf_next_free = lrg_buf_q_ele;
-
-                ql_write_common_reg(qdev,
-                                    &port_regs->CommonRegs.
-                                    rxLargeQProducerIndex,
-                                    qdev->lrg_buf_q_producer_index);
+                writel(qdev->lrg_buf_q_producer_index,
+                        &port_regs->CommonRegs.rxLargeQProducerIndex);
         }
 }
 
@@ -1915,17 +1933,18 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
                 u16 checksum = le16_to_cpu(ib_ip_rsp_ptr->checksum);
                 if (checksum & 
                         (IB_IP_IOCB_RSP_3032_ICE | 
-                         IB_IP_IOCB_RSP_3032_CE | 
-                         IB_IP_IOCB_RSP_3032_NUC)) {
+                         IB_IP_IOCB_RSP_3032_CE)) { 
                         printk(KERN_ERR
                                "%s: Bad checksum for this %s packet, checksum = %x.\n",
                                __func__,
                                ((checksum & 
                                 IB_IP_IOCB_RSP_3032_TCP) ? "TCP" :
                                 "UDP"),checksum);
-                } else if (checksum & IB_IP_IOCB_RSP_3032_TCP) {
+                } else if ((checksum & IB_IP_IOCB_RSP_3032_TCP) ||
+                                (checksum & IB_IP_IOCB_RSP_3032_UDP &&
+                                !(checksum & IB_IP_IOCB_RSP_3032_NUC))) {
                         skb2->ip_summed = CHECKSUM_UNNECESSARY;
-                } 
+                }
         }
         skb2->dev = qdev->ndev;
         skb2->protocol = eth_type_trans(skb2, qdev->ndev);
@@ -1944,16 +1963,12 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
 static int ql_tx_rx_clean(struct ql3_adapter *qdev,
                           int *tx_cleaned, int *rx_cleaned, int work_to_do)
 {
-        struct ql3xxx_port_registers __iomem *port_regs = qdev->mem_map_registers;
         struct net_rsp_iocb *net_rsp;
         struct net_device *ndev = qdev->ndev;
-        unsigned long hw_flags;
         int work_done = 0;
 
-        u32 rsp_producer_index = le32_to_cpu(*(qdev->prsp_producer_index));
-
         /* While there are entries in the completion queue. */
-        while ((rsp_producer_index !=
+        while ((le32_to_cpu(*(qdev->prsp_producer_index)) !=
                 qdev->rsp_consumer_index) && (work_done < work_to_do)) {
 
                 net_rsp = qdev->rsp_current;
@@ -2009,33 +2024,7 @@ static int ql_tx_rx_clean(struct ql3_adapter *qdev,
                 work_done = *tx_cleaned + *rx_cleaned;
         }
 
-        if(work_done) {
-                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
-
-                ql_update_lrg_bufq_prod_index(qdev);
-
-                if (qdev->small_buf_release_cnt >= 16) {
-                        while (qdev->small_buf_release_cnt >= 16) {
-                                qdev->small_buf_q_producer_index++;
-
-                                if (qdev->small_buf_q_producer_index ==
-                                    NUM_SBUFQ_ENTRIES)
-                                        qdev->small_buf_q_producer_index = 0;
-                                qdev->small_buf_release_cnt -= 8;
-                        }
-
-                        wmb();
-                        ql_write_common_reg(qdev,
-                                            &port_regs->CommonRegs.
-                                            rxSmallQProducerIndex,
-                                            qdev->small_buf_q_producer_index);
-
-                }
-
-                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
-        }
-
-        return *tx_cleaned + *rx_cleaned;
+        return work_done;
 }
 
 static int ql_poll(struct net_device *ndev, int *budget)
@@ -2059,9 +2048,10 @@ quit_polling:
                 netif_rx_complete(ndev);
 
                 spin_lock_irqsave(&qdev->hw_lock, hw_flags);
-                ql_write_common_reg(qdev,
-                                    &port_regs->CommonRegs.rspQConsumerIndex,
-                                    qdev->rsp_consumer_index);
+                ql_update_small_bufq_prod_index(qdev);
+                ql_update_lrg_bufq_prod_index(qdev);
+                writel(qdev->rsp_consumer_index,
+                            &port_regs->CommonRegs.rspQConsumerIndex);
                 spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
 
                 ql_enable_interrupts(qdev);
@@ -2217,12 +2207,7 @@ static int ql_send_map(struct ql3_adapter *qdev,
         int seg_cnt, seg = 0;
         int frag_cnt = (int)skb_shinfo(skb)->nr_frags;
 
-        seg_cnt = tx_cb->seg_count = ql_get_seg_count(qdev,
-                                                      (skb_shinfo(skb)->nr_frags));
-        if(seg_cnt == -1) {
-                printk(KERN_ERR PFX"%s: invalid segment count!\n",__func__);
-                return NETDEV_TX_BUSY;
-        }
+        seg_cnt = tx_cb->seg_count;
         /*
          * Map the skb buffer first.
          */
@@ -2278,7 +2263,7 @@ static int ql_send_map(struct ql3_adapter *qdev,
                                 pci_unmap_addr_set(&tx_cb->map[seg], mapaddr,
                                                    map);
                                 pci_unmap_len_set(&tx_cb->map[seg], maplen,
-                                                  len);
+                                                  sizeof(struct oal));
                                 oal_entry = (struct oal_entry *)oal;
                                 oal++;
                                 seg++;
@@ -2380,6 +2365,7 @@ static int ql3xxx_send(struct sk_buff *skb, struct net_device *ndev)
         }
         
         mac_iocb_ptr = tx_cb->queue_entry;
+        memset((void *)mac_iocb_ptr, 0, sizeof(struct ob_mac_iocb_req));
         mac_iocb_ptr->opcode = qdev->mac_ob_opcode;
         mac_iocb_ptr->flags = OB_MAC_IOCB_REQ_X;
         mac_iocb_ptr->flags |= qdev->mb_bit_mask;
@@ -3054,15 +3040,6 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                         goto out;
                 }
 
-                if (qdev->mac_index)
-                        ql_write_page0_reg(qdev,
-                                           &port_regs->mac1MaxFrameLengthReg,
-                                           qdev->max_frame_size);
-                else
-                        ql_write_page0_reg(qdev,
-                                           &port_regs->mac0MaxFrameLengthReg,
-                                           qdev->max_frame_size);
-
                 value = qdev->nvram_data.tcpMaxWindowSize;
                 ql_write_page0_reg(qdev, &port_regs->tcpMaxWindow, value);
 
@@ -3082,6 +3059,14 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 ql_sem_unlock(qdev, QL_FLASH_SEM_MASK);
         }
 
+        if (qdev->mac_index)
+                ql_write_page0_reg(qdev,
+                                   &port_regs->mac1MaxFrameLengthReg,
+                                   qdev->max_frame_size);
+        else
+                ql_write_page0_reg(qdev,
+                                           &port_regs->mac0MaxFrameLengthReg,
+                                           qdev->max_frame_size);
 
         if(ql_sem_spinlock(qdev, QL_PHY_GIO_SEM_MASK,
                         (QL_RESOURCE_BITS_BASE_CODE | (qdev->mac_index) *
@@ -3152,7 +3137,8 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
         if (qdev->device_id == QL3032_DEVICE_ID) {
                 value =
                     (QL3032_PORT_CONTROL_EF | QL3032_PORT_CONTROL_KIE |
-                     QL3032_PORT_CONTROL_EIv6 | QL3032_PORT_CONTROL_EIv4);
+                     QL3032_PORT_CONTROL_EIv6 | QL3032_PORT_CONTROL_EIv4 |
+                        QL3032_PORT_CONTROL_ET);
                 ql_write_page0_reg(qdev, &port_regs->functionControl,
                                    ((value << 16) | value));
         } else {
diff --git a/drivers/net/qla3xxx.h b/drivers/net/qla3xxx.h
index 34cd6580fd07..0203f88f0544 100755
--- a/drivers/net/qla3xxx.h
+++ b/drivers/net/qla3xxx.h
@@ -1014,8 +1014,7 @@ struct eeprom_data {
 
 /* Transmit and Receive Buffers */
 #define NUM_LBUFQ_ENTRIES       128
-#define JUMBO_NUM_LBUFQ_ENTRIES         \
-(NUM_LBUFQ_ENTRIES/(JUMBO_MTU_SIZE/NORMAL_MTU_SIZE))
+#define JUMBO_NUM_LBUFQ_ENTRIES 32
 #define NUM_SBUFQ_ENTRIES       64
 #define QL_SMALL_BUFFER_SIZE    32
 #define QL_ADDR_ELE_PER_BUFQ_ENTRY \
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 521b5f0618a4..6a77b8a92245 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -66,6 +66,7 @@ VERSION 2.2LK	<2005/01/25>
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
 
+#include <asm/system.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 
@@ -486,6 +487,7 @@ static int rtl8169_rx_interrupt(struct net_device *, struct rtl8169_private *,
                                 void __iomem *);
 static int rtl8169_change_mtu(struct net_device *dev, int new_mtu);
 static void rtl8169_down(struct net_device *dev);
+static void rtl8169_rx_clear(struct rtl8169_private *tp);
 
 #ifdef CONFIG_R8169_NAPI
 static int rtl8169_poll(struct net_device *dev, int *budget);
@@ -1751,16 +1753,10 @@ static int rtl8169_open(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
         struct pci_dev *pdev = tp->pci_dev;
-        int retval;
+        int retval = -ENOMEM;
 
-        rtl8169_set_rxbufsize(tp, dev);
-
-        retval =
-            request_irq(dev->irq, rtl8169_interrupt, IRQF_SHARED, dev->name, dev);
-        if (retval < 0)
-                goto out;
 
-        retval = -ENOMEM;
+        rtl8169_set_rxbufsize(tp, dev);
 
         /*
          * Rx and Tx desscriptors needs 256 bytes alignment.
@@ -1769,19 +1765,26 @@ static int rtl8169_open(struct net_device *dev)
         tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES,
                                                &tp->TxPhyAddr);
         if (!tp->TxDescArray)
-                goto err_free_irq;
+                goto out;
 
         tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES,
                                                &tp->RxPhyAddr);
         if (!tp->RxDescArray)
-                goto err_free_tx;
+                goto err_free_tx_0;
 
         retval = rtl8169_init_ring(dev);
         if (retval < 0)
-                goto err_free_rx;
+                goto err_free_rx_1;
 
         INIT_DELAYED_WORK(&tp->task, NULL);
 
+        smp_mb();
+
+        retval = request_irq(dev->irq, rtl8169_interrupt, IRQF_SHARED,
+                             dev->name, dev);
+        if (retval < 0)
+                goto err_release_ring_2;
+
         rtl8169_hw_start(dev);
 
         rtl8169_request_timer(dev);
@@ -1790,14 +1793,14 @@ static int rtl8169_open(struct net_device *dev)
 out:
         return retval;
 
-err_free_rx:
+err_release_ring_2:
+        rtl8169_rx_clear(tp);
+err_free_rx_1:
         pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
                             tp->RxPhyAddr);
-err_free_tx:
+err_free_tx_0:
         pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
                             tp->TxPhyAddr);
-err_free_irq:
-        free_irq(dev->irq, dev);
         goto out;
 }
 
@@ -2887,7 +2890,7 @@ static int rtl8169_suspend(struct pci_dev *pdev, pm_message_t state)
         void __iomem *ioaddr = tp->mmio_addr;
 
         if (!netif_running(dev))
-                goto out;
+                goto out_pci_suspend;
 
         netif_device_detach(dev);
         netif_stop_queue(dev);
@@ -2901,10 +2904,11 @@ static int rtl8169_suspend(struct pci_dev *pdev, pm_message_t state)
 
         spin_unlock_irq(&tp->lock);
 
+out_pci_suspend:
         pci_save_state(pdev);
         pci_enable_wake(pdev, pci_choose_state(pdev, state), tp->wol_enabled);
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
-out:
+
         return 0;
 }
 
@@ -2912,15 +2916,15 @@ static int rtl8169_resume(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
 
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        pci_enable_wake(pdev, PCI_D0, 0);
+
         if (!netif_running(dev))
                 goto out;
 
         netif_device_attach(dev);
 
-        pci_set_power_state(pdev, PCI_D0);
-        pci_restore_state(pdev);
-        pci_enable_wake(pdev, PCI_D0, 0);
-
         rtl8169_schedule_work(dev, rtl8169_reset_task);
 out:
         return 0;
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 4a926f20b6ea..c32c21af3fdd 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -964,7 +964,7 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto out;
         }
 
-        spin_lock_bh(&priv->lock);
+        spin_lock(&priv->lock);
 
         if (unlikely(!netif_carrier_ok(dev))) {
                 err = -ENOLINK;
@@ -1005,7 +1005,7 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 netif_stop_queue(dev);
 
 out_unlock:
-        spin_unlock_bh(&priv->lock);
+        spin_unlock(&priv->lock);
 
 out:
         dev_kfree_skb(skb);
@@ -1042,12 +1042,12 @@ static int sc92031_open(struct net_device *dev)
         priv->pm_config = 0;
 
         /* Interrupts already disabled by sc92031_stop or sc92031_probe */
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
 
         _sc92031_reset(dev);
         mmiowb();
 
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
         sc92031_enable_interrupts(dev);
 
         if (netif_carrier_ok(dev))
@@ -1077,13 +1077,13 @@ static int sc92031_stop(struct net_device *dev)
         /* Disable interrupts, stop Tx and Rx. */
         sc92031_disable_interrupts(dev);
 
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
 
         _sc92031_disable_tx_rx(dev);
         _sc92031_tx_clear(dev);
         mmiowb();
 
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
 
         free_irq(pdev->irq, dev);
         pci_free_consistent(pdev, TX_BUF_TOT_LEN, priv->tx_bufs,
@@ -1539,13 +1539,13 @@ static int sc92031_suspend(struct pci_dev *pdev, pm_message_t state)
         /* Disable interrupts, stop Tx and Rx. */
         sc92031_disable_interrupts(dev);
 
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
 
         _sc92031_disable_tx_rx(dev);
         _sc92031_tx_clear(dev);
         mmiowb();
 
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
 
 out:
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -1565,12 +1565,12 @@ static int sc92031_resume(struct pci_dev *pdev)
                 goto out;
 
         /* Interrupts already disabled by sc92031_suspend */
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
 
         _sc92031_reset(dev);
         mmiowb();
 
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
         sc92031_enable_interrupts(dev);
 
         netif_device_attach(dev);
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index b08508b35833..34463ce6f132 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -324,6 +324,7 @@ static struct mii_chip_info {
         u32 feature;
 } mii_chip_table[] = {
         { "Broadcom PHY BCM5461", { 0x0020, 0x60c0 }, LAN, F_PHY_BCM5461 },
+        { "Broadcom PHY AC131",   { 0x0143, 0xbc70 }, LAN, 0 },
         { "Agere PHY ET1101B",    { 0x0282, 0xf010 }, LAN, 0 },
         { "Marvell PHY 88E1111",  { 0x0141, 0x0cc0 }, LAN, F_PHY_88E1111 },
         { "Realtek PHY RTL8201",  { 0x0000, 0x8200 }, LAN, 0 },
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index b3750f284279..b2a3b19d773a 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -1755,6 +1755,24 @@ static int sis900_rx(struct net_device *net_dev)
                 } else {
                         struct sk_buff * skb;
 
+                        pci_unmap_single(sis_priv->pci_dev,
+                                sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
+                                PCI_DMA_FROMDEVICE);
+
+                        /* refill the Rx buffer, what if there is not enought
+                         * memory for new socket buffer ?? */
+                        if ((skb = dev_alloc_skb(RX_BUF_SIZE)) == NULL) {
+                                /*
+                                 * Not enough memory to refill the buffer
+                                 * so we need to recycle the old one so
+                                 * as to avoid creating a memory hole
+                                 * in the rx ring
+                                 */
+                                skb = sis_priv->rx_skbuff[entry];
+                                sis_priv->stats.rx_dropped++;
+                                goto refill_rx_ring;
+                        }       
+
                         /* This situation should never happen, but due to
                            some unknow bugs, it is possible that
                            we are working on NULL sk_buff :-( */
@@ -1768,9 +1786,6 @@ static int sis900_rx(struct net_device *net_dev)
                                 break;
                         }
 
-                        pci_unmap_single(sis_priv->pci_dev,
-                                sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
-                                PCI_DMA_FROMDEVICE);
                         /* give the socket buffer to upper layers */
                         skb = sis_priv->rx_skbuff[entry];
                         skb_put(skb, rx_size);
@@ -1783,33 +1798,14 @@ static int sis900_rx(struct net_device *net_dev)
                         net_dev->last_rx = jiffies;
                         sis_priv->stats.rx_bytes += rx_size;
                         sis_priv->stats.rx_packets++;
-
-                        /* refill the Rx buffer, what if there is not enought
-                         * memory for new socket buffer ?? */
-                        if ((skb = dev_alloc_skb(RX_BUF_SIZE)) == NULL) {
-                                /* not enough memory for skbuff, this makes a
-                                 * "hole" on the buffer ring, it is not clear
-                                 * how the hardware will react to this kind
-                                 * of degenerated buffer */
-                                if (netif_msg_rx_status(sis_priv))
-                                        printk(KERN_INFO "%s: Memory squeeze,"
-                                                "deferring packet.\n",
-                                                net_dev->name);
-                                sis_priv->rx_skbuff[entry] = NULL;
-                                /* reset buffer descriptor state */
-                                sis_priv->rx_ring[entry].cmdsts = 0;
-                                sis_priv->rx_ring[entry].bufptr = 0;
-                                sis_priv->stats.rx_dropped++;
-                                sis_priv->cur_rx++;
-                                break;
-                        }
+                        sis_priv->dirty_rx++;
+refill_rx_ring:
                         skb->dev = net_dev;
                         sis_priv->rx_skbuff[entry] = skb;
                         sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE;
                         sis_priv->rx_ring[entry].bufptr =
                                 pci_map_single(sis_priv->pci_dev, skb->data,
                                         RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
-                        sis_priv->dirty_rx++;
                 }
                 sis_priv->cur_rx++;
                 entry = sis_priv->cur_rx % NUM_RX_DESC;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 39c6677dff5e..d476a3cc2e94 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -163,27 +163,46 @@ static void skge_wol_init(struct skge_port *skge)
 {
         struct skge_hw *hw = skge->hw;
         int port = skge->port;
-        enum pause_control save_mode;
-        u32 ctrl;
+        u16 ctrl;
 
-        /* Bring hardware out of reset */
         skge_write16(hw, B0_CTST, CS_RST_CLR);
         skge_write16(hw, SK_REG(port, GMAC_LINK_CTRL), GMLC_RST_CLR);
 
-        skge_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_CLR);
-        skge_write8(hw, SK_REG(port, GMAC_CTRL), GMC_RST_CLR);
+        /* Turn on Vaux */
+        skge_write8(hw, B0_POWER_CTRL,
+                    PC_VAUX_ENA | PC_VCC_ENA | PC_VAUX_ON | PC_VCC_OFF);
 
-        /* Force to 10/100 skge_reset will re-enable on resume   */
-        save_mode = skge->flow_control;
-        skge->flow_control = FLOW_MODE_SYMMETRIC;
+        /* WA code for COMA mode -- clear PHY reset */
+        if (hw->chip_id == CHIP_ID_YUKON_LITE &&
+            hw->chip_rev >= CHIP_REV_YU_LITE_A3) {
+                u32 reg = skge_read32(hw, B2_GP_IO);
+                reg |= GP_DIR_9;
+                reg &= ~GP_IO_9;
+                skge_write32(hw, B2_GP_IO, reg);
+        }
 
-        ctrl = skge->advertising;
-        skge->advertising &= ~(ADVERTISED_1000baseT_Half|ADVERTISED_1000baseT_Full);
+        skge_write32(hw, SK_REG(port, GPHY_CTRL),
+                     GPC_DIS_SLEEP |
+                     GPC_HWCFG_M_3 | GPC_HWCFG_M_2 | GPC_HWCFG_M_1 | GPC_HWCFG_M_0 |
+                     GPC_ANEG_1 | GPC_RST_SET);
 
-        skge_phy_reset(skge);
+        skge_write32(hw, SK_REG(port, GPHY_CTRL),
+                     GPC_DIS_SLEEP |
+                     GPC_HWCFG_M_3 | GPC_HWCFG_M_2 | GPC_HWCFG_M_1 | GPC_HWCFG_M_0 |
+                     GPC_ANEG_1 | GPC_RST_CLR);
+
+        skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_RST_CLR);
+
+        /* Force to 10/100 skge_reset will re-enable on resume   */
+        gm_phy_write(hw, port, PHY_MARV_AUNE_ADV,
+                     PHY_AN_100FULL | PHY_AN_100HALF |
+                     PHY_AN_10FULL | PHY_AN_10HALF| PHY_AN_CSMA);
+        /* no 1000 HD/FD */
+        gm_phy_write(hw, port, PHY_MARV_1000T_CTRL, 0);
+        gm_phy_write(hw, port, PHY_MARV_CTRL,
+                     PHY_CT_RESET | PHY_CT_SPS_LSB | PHY_CT_ANE |
+                     PHY_CT_RE_CFG | PHY_CT_DUP_MD);
 
-        skge->flow_control = save_mode;
-        skge->advertising = ctrl;
 
         /* Set GMAC to no flow control and auto update for speed/duplex */
         gma_write16(hw, port, GM_GP_CTRL,
@@ -227,12 +246,10 @@ static int skge_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         struct skge_port *skge = netdev_priv(dev);
         struct skge_hw *hw = skge->hw;
 
-        if (wol->wolopts & wol_supported(hw))
+        if (wol->wolopts & ~wol_supported(hw))
                 return -EOPNOTSUPP;
 
         skge->wol = wol->wolopts;
-        if (!netif_running(dev))
-                skge_wol_init(skge);
         return 0;
 }
 
@@ -2535,10 +2552,12 @@ static int skge_down(struct net_device *dev)
                 printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
 
         netif_stop_queue(dev);
+
         if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC)
                 del_timer_sync(&skge->link_timer);
 
         netif_poll_disable(dev);
+        netif_carrier_off(dev);
 
         spin_lock_irq(&hw->hw_lock);
         hw->intr_mask &= ~portmask[port];
@@ -3765,21 +3784,6 @@ static void __devexit skge_remove(struct pci_dev *pdev)
 }
 
 #ifdef CONFIG_PM
-static int vaux_avail(struct pci_dev *pdev)
-{
-        int pm_cap;
-
-        pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
-        if (pm_cap) {
-                u16 ctl;
-                pci_read_config_word(pdev, pm_cap + PCI_PM_PMC, &ctl);
-                if (ctl & PCI_PM_CAP_AUX_POWER)
-                        return 1;
-        }
-        return 0;
-}
-
-
 static int skge_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct skge_hw *hw  = pci_get_drvdata(pdev);
@@ -3801,10 +3805,6 @@ static int skge_suspend(struct pci_dev *pdev, pm_message_t state)
                 wol |= skge->wol;
         }
 
-        if (wol && vaux_avail(pdev))
-                skge_write8(hw, B0_POWER_CTRL,
-                            PC_VAUX_ENA | PC_VCC_ENA | PC_VAUX_ON | PC_VCC_OFF);
-
         skge_write32(hw, B0_IMSK, 0);
         pci_enable_wake(pdev, pci_choose_state(pdev, state), wol);
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -3850,6 +3850,28 @@ out:
 }
 #endif
 
+static void skge_shutdown(struct pci_dev *pdev)
+{
+        struct skge_hw *hw  = pci_get_drvdata(pdev);
+        int i, wol = 0;
+
+        for (i = 0; i < hw->ports; i++) {
+                struct net_device *dev = hw->dev[i];
+                struct skge_port *skge = netdev_priv(dev);
+
+                if (skge->wol)
+                        skge_wol_init(skge);
+                wol |= skge->wol;
+        }
+
+        pci_enable_wake(pdev, PCI_D3hot, wol);
+        pci_enable_wake(pdev, PCI_D3cold, wol);
+
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
+
+}
+
 static struct pci_driver skge_driver = {
         .name =         DRV_NAME,
         .id_table =     skge_id_table,
@@ -3859,6 +3881,7 @@ static struct pci_driver skge_driver = {
         .suspend =      skge_suspend,
         .resume =       skge_resume,
 #endif
+        .shutdown =     skge_shutdown,
 };
 
 static int __init skge_init_module(void)
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index ab0ab92583fe..ac36152c68bf 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -49,7 +49,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.13"
+#define DRV_VERSION             "1.14"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -123,7 +123,10 @@ static const struct pci_device_id sky2_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4361) }, /* 88E8050 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4362) }, /* 88E8053 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4363) }, /* 88E8055 */
+#ifdef broken
+        /* This device causes data corruption problems that are not resolved */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4364) }, /* 88E8056 */
+#endif
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4366) }, /* 88EC036 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4367) }, /* 88EC032 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4368) }, /* 88EC034 */
@@ -510,9 +513,9 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 ledover &= ~PHY_M_LED_MO_RX;
         }
 
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == CHIP_REV_YU_EC_A1) {
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U &&
+            hw->chip_rev == CHIP_REV_YU_EC_U_A1) {
                 /* apply fixes in PHY AFE */
-                pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 255);
 
                 /* increase differential signal amplitude in 10BASE-T */
@@ -524,7 +527,7 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 gm_phy_write(hw, port, 0x17, 0x2002);
 
                 /* set page register to 0 */
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 0);
         } else if (hw->chip_id != CHIP_ID_YUKON_EX) {
                 gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
 
@@ -740,12 +743,17 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
         if (hw->chip_id == CHIP_ID_YUKON_EC_U || hw->chip_id == CHIP_ID_YUKON_EX) {
                 sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8);
                 sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8);
-                if (hw->dev[port]->mtu > ETH_DATA_LEN) {
-                        /* set Tx GMAC FIFO Almost Empty Threshold */
-                        sky2_write32(hw, SK_REG(port, TX_GMF_AE_THR), 0x180);
-                        /* Disable Store & Forward mode for TX */
-                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T), TX_STFW_DIS);
-                }
+
+                /* set Tx GMAC FIFO Almost Empty Threshold */
+                sky2_write32(hw, SK_REG(port, TX_GMF_AE_THR),
+                             (ECU_JUMBO_WM << 16) | ECU_AE_THR);
+
+                if (hw->dev[port]->mtu > ETH_DATA_LEN)
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_ENA | TX_STFW_DIS);
+                else
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_DIS | TX_STFW_ENA);
         }
 
 }
@@ -1278,7 +1286,7 @@ static int sky2_up(struct net_device *dev)
         /* Set almost empty threshold */
         if (hw->chip_id == CHIP_ID_YUKON_EC_U
             && hw->chip_rev == CHIP_REV_YU_EC_U_A0)
-                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), 0x1a0);
+                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), ECU_TXFF_LEV);
 
         sky2_prefetch_init(hw, txqaddr[port], sky2->tx_le_map,
                            TX_RING_SIZE - 1);
@@ -1561,6 +1569,7 @@ static int sky2_down(struct net_device *dev)
 
         /* Stop more packets from being queued */
         netif_stop_queue(dev);
+        netif_carrier_off(dev);
 
         /* Disable port IRQ */
         imask = sky2_read32(hw, B0_IMSK);
@@ -1583,13 +1592,6 @@ static int sky2_down(struct net_device *dev)
         sky2_write32(hw, RB_ADDR(txqaddr[port], RB_CTRL),
                      RB_RST_SET | RB_DIS_OP_MD);
 
-        /* WA for dev. #4.209 */
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U
-            && (hw->chip_rev == CHIP_REV_YU_EC_U_A1 || hw->chip_rev == CHIP_REV_YU_EC_U_B0))
-                sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
-                             sky2->speed != SPEED_1000 ?
-                             TX_STFW_ENA : TX_STFW_DIS);
-
         ctrl = gma_read16(hw, port, GM_GP_CTRL);
         ctrl &= ~(GM_GPCR_TX_ENA | GM_GPCR_RX_ENA);
         gma_write16(hw, port, GM_GP_CTRL, ctrl);
@@ -1889,6 +1891,7 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
         struct sky2_hw *hw = sky2->hw;
+        unsigned port = sky2->port;
         int err;
         u16 ctl, mode;
         u32 imask;
@@ -1896,9 +1899,8 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         if (new_mtu < ETH_ZLEN || new_mtu > ETH_JUMBO_MTU)
                 return -EINVAL;
 
-        /* TSO on Yukon Ultra and MTU > 1500 not supported */
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U && new_mtu > ETH_DATA_LEN)
-                dev->features &= ~NETIF_F_TSO;
+        if (new_mtu > ETH_DATA_LEN && hw->chip_id == CHIP_ID_YUKON_FE)
+                return -EINVAL;
 
         if (!netif_running(dev)) {
                 dev->mtu = new_mtu;
@@ -1914,8 +1916,18 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
 
         synchronize_irq(hw->pdev->irq);
 
-        ctl = gma_read16(hw, sky2->port, GM_GP_CTRL);
-        gma_write16(hw, sky2->port, GM_GP_CTRL, ctl & ~GM_GPCR_RX_ENA);
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U || hw->chip_id == CHIP_ID_YUKON_EX) {
+                if (new_mtu > ETH_DATA_LEN) {
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_ENA | TX_STFW_DIS);
+                        dev->features &= NETIF_F_TSO | NETIF_F_SG | NETIF_F_IP_CSUM;
+                } else
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_DIS | TX_STFW_ENA);
+        }
+
+        ctl = gma_read16(hw, port, GM_GP_CTRL);
+        gma_write16(hw, port, GM_GP_CTRL, ctl & ~GM_GPCR_RX_ENA);
         sky2_rx_stop(sky2);
         sky2_rx_clean(sky2);
 
@@ -1927,9 +1939,9 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         if (dev->mtu > ETH_DATA_LEN)
                 mode |= GM_SMOD_JUMBO_ENA;
 
-        gma_write16(hw, sky2->port, GM_SERIAL_MODE, mode);
+        gma_write16(hw, port, GM_SERIAL_MODE, mode);
 
-        sky2_write8(hw, RB_ADDR(rxqaddr[sky2->port], RB_CTRL), RB_ENA_OP_MD);
+        sky2_write8(hw, RB_ADDR(rxqaddr[port], RB_CTRL), RB_ENA_OP_MD);
 
         err = sky2_rx_start(sky2);
         sky2_write32(hw, B0_IMSK, imask);
@@ -1937,7 +1949,7 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         if (err)
                 dev_close(dev);
         else {
-                gma_write16(hw, sky2->port, GM_GP_CTRL, ctl);
+                gma_write16(hw, port, GM_GP_CTRL, ctl);
 
                 netif_poll_enable(hw->dev[0]);
                 netif_wake_queue(dev);
@@ -2339,26 +2351,22 @@ static void sky2_mac_intr(struct sky2_hw *hw, unsigned port)
         }
 }
 
-/* This should never happen it is a fatal situation */
-static void sky2_descriptor_error(struct sky2_hw *hw, unsigned port,
-                                  const char *rxtx, u32 mask)
+/* This should never happen it is a bug. */
+static void sky2_le_error(struct sky2_hw *hw, unsigned port,
+                          u16 q, unsigned ring_size)
 {
         struct net_device *dev = hw->dev[port];
         struct sky2_port *sky2 = netdev_priv(dev);
-        u32 imask;
-
-        printk(KERN_ERR PFX "%s: %s descriptor error (hardware problem)\n",
-               dev ? dev->name : "<not registered>", rxtx);
+        unsigned idx;
+        const u64 *le = (q == Q_R1 || q == Q_R2)
+                ? (u64 *) sky2->rx_le : (u64 *) sky2->tx_le;
 
-        imask = sky2_read32(hw, B0_IMSK);
-        imask &= ~mask;
-        sky2_write32(hw, B0_IMSK, imask);
+        idx = sky2_read16(hw, Y2_QADDR(q, PREF_UNIT_GET_IDX));
+        printk(KERN_ERR PFX "%s: descriptor error q=%#x get=%u [%llx] put=%u\n",
+               dev->name, (unsigned) q, idx, (unsigned long long) le[idx],
+               (unsigned) sky2_read16(hw, Y2_QADDR(q, PREF_UNIT_PUT_IDX)));
 
-        if (dev) {
-                spin_lock(&sky2->phy_lock);
-                sky2_link_down(sky2);
-                spin_unlock(&sky2->phy_lock);
-        }
+        sky2_write32(hw, Q_ADDR(q, Q_CSR), BMU_CLR_IRQ_CHK);
 }
 
 /* If idle then force a fake soft NAPI poll once a second
@@ -2382,23 +2390,15 @@ static void sky2_idle(unsigned long arg)
         mod_timer(&hw->idle_timer, jiffies + msecs_to_jiffies(idle_timeout));
 }
 
-
-static int sky2_poll(struct net_device *dev0, int *budget)
+/* Hardware/software error handling */
+static void sky2_err_intr(struct sky2_hw *hw, u32 status)
 {
-        struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
-        int work_limit = min(dev0->quota, *budget);
-        int work_done = 0;
-        u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
+        if (net_ratelimit())
+                dev_warn(&hw->pdev->dev, "error interrupt status=%#x\n", status);
 
         if (status & Y2_IS_HW_ERR)
                 sky2_hw_intr(hw);
 
-        if (status & Y2_IS_IRQ_PHY1)
-                sky2_phy_intr(hw, 0);
-
-        if (status & Y2_IS_IRQ_PHY2)
-                sky2_phy_intr(hw, 1);
-
         if (status & Y2_IS_IRQ_MAC1)
                 sky2_mac_intr(hw, 0);
 
@@ -2406,16 +2406,33 @@ static int sky2_poll(struct net_device *dev0, int *budget)
                 sky2_mac_intr(hw, 1);
 
         if (status & Y2_IS_CHK_RX1)
-                sky2_descriptor_error(hw, 0, "receive", Y2_IS_CHK_RX1);
+                sky2_le_error(hw, 0, Q_R1, RX_LE_SIZE);
 
         if (status & Y2_IS_CHK_RX2)
-                sky2_descriptor_error(hw, 1, "receive", Y2_IS_CHK_RX2);
+                sky2_le_error(hw, 1, Q_R2, RX_LE_SIZE);
 
         if (status & Y2_IS_CHK_TXA1)
-                sky2_descriptor_error(hw, 0, "transmit", Y2_IS_CHK_TXA1);
+                sky2_le_error(hw, 0, Q_XA1, TX_RING_SIZE);
 
         if (status & Y2_IS_CHK_TXA2)
-                sky2_descriptor_error(hw, 1, "transmit", Y2_IS_CHK_TXA2);
+                sky2_le_error(hw, 1, Q_XA2, TX_RING_SIZE);
+}
+
+static int sky2_poll(struct net_device *dev0, int *budget)
+{
+        struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
+        int work_limit = min(dev0->quota, *budget);
+        int work_done = 0;
+        u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
+
+        if (unlikely(status & Y2_IS_ERROR))
+                sky2_err_intr(hw, status);
+
+        if (status & Y2_IS_IRQ_PHY1)
+                sky2_phy_intr(hw, 0);
+
+        if (status & Y2_IS_IRQ_PHY2)
+                sky2_phy_intr(hw, 1);
 
         work_done = sky2_status_intr(hw, work_limit);
         if (work_done < work_limit) {
@@ -2533,16 +2550,14 @@ static void sky2_reset(struct sky2_hw *hw)
         int i;
 
         /* disable ASF */
-        if (hw->chip_id <= CHIP_ID_YUKON_EC) {
-                if (hw->chip_id == CHIP_ID_YUKON_EX) {
-                        status = sky2_read16(hw, HCU_CCSR);
-                        status &= ~(HCU_CCSR_AHB_RST | HCU_CCSR_CPU_RST_MODE |
-                                    HCU_CCSR_UC_STATE_MSK);
-                        sky2_write16(hw, HCU_CCSR, status);
-                } else
-                        sky2_write8(hw, B28_Y2_ASF_STAT_CMD, Y2_ASF_RESET);
-                sky2_write16(hw, B0_CTST, Y2_ASF_DISABLE);
-        }
+        if (hw->chip_id == CHIP_ID_YUKON_EX) {
+                status = sky2_read16(hw, HCU_CCSR);
+                status &= ~(HCU_CCSR_AHB_RST | HCU_CCSR_CPU_RST_MODE |
+                            HCU_CCSR_UC_STATE_MSK);
+                sky2_write16(hw, HCU_CCSR, status);
+        } else
+                sky2_write8(hw, B28_Y2_ASF_STAT_CMD, Y2_ASF_RESET);
+        sky2_write16(hw, B0_CTST, Y2_ASF_DISABLE);
 
         /* do a SW reset */
         sky2_write8(hw, B0_CTST, CS_RST_SET);
@@ -3327,6 +3342,36 @@ static void sky2_get_regs(struct net_device *dev, struct ethtool_regs *regs,
                       regs->len - B3_RI_WTO_R1);
 }
 
+/* In order to do Jumbo packets on these chips, need to turn off the
+ * transmit store/forward. Therefore checksum offload won't work.
+ */
+static int no_tx_offload(struct net_device *dev)
+{
+        const struct sky2_port *sky2 = netdev_priv(dev);
+        const struct sky2_hw *hw = sky2->hw;
+
+        return dev->mtu > ETH_DATA_LEN &&
+                (hw->chip_id == CHIP_ID_YUKON_EX
+                 || hw->chip_id == CHIP_ID_YUKON_EC_U);
+}
+
+static int sky2_set_tx_csum(struct net_device *dev, u32 data)
+{
+        if (data && no_tx_offload(dev))
+                return -EINVAL;
+
+        return ethtool_op_set_tx_csum(dev, data);
+}
+
+
+static int sky2_set_tso(struct net_device *dev, u32 data)
+{
+        if (data && no_tx_offload(dev))
+                return -EINVAL;
+
+        return ethtool_op_set_tso(dev, data);
+}
+
 static const struct ethtool_ops sky2_ethtool_ops = {
         .get_settings = sky2_get_settings,
         .set_settings = sky2_set_settings,
@@ -3342,9 +3387,9 @@ static const struct ethtool_ops sky2_ethtool_ops = {
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
         .get_tx_csum = ethtool_op_get_tx_csum,
-        .set_tx_csum = ethtool_op_set_tx_csum,
+        .set_tx_csum = sky2_set_tx_csum,
         .get_tso = ethtool_op_get_tso,
-        .set_tso = ethtool_op_set_tso,
+        .set_tso = sky2_set_tso,
         .get_rx_csum = sky2_get_rx_csum,
         .set_rx_csum = sky2_set_rx_csum,
         .get_strings = sky2_get_strings,
@@ -3769,6 +3814,11 @@ static int sky2_resume(struct pci_dev *pdev)
                 goto out;
 
         pci_enable_wake(pdev, PCI_D0, 0);
+
+        /* Re-enable all clocks */
+        if (hw->chip_id == CHIP_ID_YUKON_EX || hw->chip_id == CHIP_ID_YUKON_EC_U)
+                sky2_pci_write32(hw, PCI_DEV_REG3, 0);
+
         sky2_reset(hw);
 
         sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index ac24bdc42976..5efb5afc45ba 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -288,6 +288,9 @@ enum {
                           | Y2_IS_CHK_TXA1 | Y2_IS_CHK_RX1,
         Y2_IS_PORT_2    = Y2_IS_IRQ_PHY2 | Y2_IS_IRQ_MAC2
                           | Y2_IS_CHK_TXA2 | Y2_IS_CHK_RX2,
+        Y2_IS_ERROR     = Y2_IS_HW_ERR |
+                          Y2_IS_IRQ_MAC1 | Y2_IS_CHK_TXA1 | Y2_IS_CHK_RX1 |
+                          Y2_IS_IRQ_MAC2 | Y2_IS_CHK_TXA2 | Y2_IS_CHK_RX2,
 };
 
 /*      B2_IRQM_HWE_MSK 32 bit  IRQ Moderation HW Error Mask */
@@ -738,6 +741,11 @@ enum {
         TX_GMF_RP       = 0x0d70,/* 32 bit      Tx GMAC FIFO Read Pointer */
         TX_GMF_RSTP     = 0x0d74,/* 32 bit      Tx GMAC FIFO Restart Pointer */
         TX_GMF_RLEV     = 0x0d78,/* 32 bit      Tx GMAC FIFO Read Level */
+
+        /* Threshold values for Yukon-EC Ultra and Extreme */
+        ECU_AE_THR      = 0x0070, /* Almost Empty Threshold */
+        ECU_TXFF_LEV    = 0x01a0, /* Tx BMU FIFO Level */
+        ECU_JUMBO_WM    = 0x0080, /* Jumbo Mode Watermark */
 };
 
 /* Descriptor Poll Timer Registers */
@@ -1631,6 +1639,9 @@ enum {
         TX_VLAN_TAG_ON  = 1<<25,/* enable  VLAN tagging */
         TX_VLAN_TAG_OFF = 1<<24,/* disable VLAN tagging */
 
+        TX_JUMBO_ENA    = 1<<23,/* PCI Jumbo Mode enable (Yukon-EC Ultra) */
+        TX_JUMBO_DIS    = 1<<22,/* PCI Jumbo Mode enable (Yukon-EC Ultra) */
+
         GMF_WSP_TST_ON  = 1<<18,/* Write Shadow Pointer Test On */
         GMF_WSP_TST_OFF = 1<<17,/* Write Shadow Pointer Test Off */
         GMF_WSP_STEP    = 1<<16,/* Write Shadow Pointer Step/Increment */
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 3b91af89e4c7..e3019d52c30f 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -719,7 +719,7 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
                         SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
         spin_unlock_irqrestore(&chain->lock, flags);
 
-        if (skb->protocol == htons(ETH_P_IP))
+        if (skb->protocol == htons(ETH_P_IP) && skb->ip_summed == CHECKSUM_PARTIAL)
                 switch (skb->nh.iph->protocol) {
                 case IPPROTO_TCP:
                         hwdescr->dmac_cmd_status |= SPIDER_NET_DMAC_TCP;
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index c62e85d89f41..7bee45b42a2c 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -336,13 +336,27 @@ static int __init lance_probe( struct net_device *dev)
 
         /* XXX - leak? */
         MEM = dvma_malloc_align(sizeof(struct lance_memory), 0x10000);
+        if (MEM == NULL) {
+#ifdef CONFIG_SUN3
+                iounmap((void __iomem *)ioaddr);
+#endif
+                printk(KERN_WARNING "SUN3 Lance couldn't allocate DVMA memory\n");
+                return 0;
+        }
 
         lp->iobase = (volatile unsigned short *)ioaddr;
         dev->base_addr = (unsigned long)ioaddr; /* informational only */
 
         REGA(CSR0) = CSR0_STOP;
 
-        request_irq(LANCE_IRQ, lance_interrupt, IRQF_DISABLED, "SUN3 Lance", dev);
+        if (request_irq(LANCE_IRQ, lance_interrupt, IRQF_DISABLED, "SUN3 Lance", dev) < 0) {
+#ifdef CONFIG_SUN3
+                iounmap((void __iomem *)ioaddr);
+#endif
+                dvma_free((void *)MEM);
+                printk(KERN_WARNING "SUN3 Lance unable to allocate IRQ\n");
+                return 0;
+        }
         dev->irq = (unsigned short)LANCE_IRQ;
 
 
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 616be8d0fa85..08ea61db46fe 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2530,6 +2530,35 @@ static struct net_device_stats *gem_get_stats(struct net_device *dev)
         return &gp->net_stats;
 }
 
+static int gem_set_mac_address(struct net_device *dev, void *addr)
+{
+        struct sockaddr *macaddr = (struct sockaddr *) addr;
+        struct gem *gp = dev->priv;
+        unsigned char *e = &dev->dev_addr[0];
+
+        if (!is_valid_ether_addr(macaddr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        if (!netif_running(dev) || !netif_device_present(dev)) {
+                /* We'll just catch it later when the
+                 * device is up'd or resumed.
+                 */
+                memcpy(dev->dev_addr, macaddr->sa_data, dev->addr_len);
+                return 0;
+        }
+
+        mutex_lock(&gp->pm_mutex);
+        memcpy(dev->dev_addr, macaddr->sa_data, dev->addr_len);
+        if (gp->running) {
+                writel((e[4] << 8) | e[5], gp->regs + MAC_ADDR0);
+                writel((e[2] << 8) | e[3], gp->regs + MAC_ADDR1);
+                writel((e[0] << 8) | e[1], gp->regs + MAC_ADDR2);
+        }
+        mutex_unlock(&gp->pm_mutex);
+
+        return 0;
+}
+
 static void gem_set_multicast(struct net_device *dev)
 {
         struct gem *gp = dev->priv;
@@ -3122,6 +3151,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
         dev->change_mtu = gem_change_mtu;
         dev->irq = pdev->irq;
         dev->dma = 0;
+        dev->set_mac_address = gem_set_mac_address;
 #ifdef CONFIG_NET_POLL_CONTROLLER
         dev->poll_controller = gem_poll_controller;
 #endif
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index ef671739cfea..192bbc91c731 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -3314,7 +3314,7 @@ static int __devexit hme_sbus_remove(struct of_device *dev)
         struct happy_meal *hp = dev_get_drvdata(&dev->dev);
         struct net_device *net_dev = hp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         /* XXX qfe parent interrupt... */
 
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 5b00d79b5573..b0929a457b60 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -1550,7 +1550,7 @@ static int __exit sunlance_sun4_remove(void)
         struct lance_private *lp = dev_get_drvdata(&sun4_sdev.ofdev.dev);
         struct net_device *net_dev = lp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         lance_free_hwresources(lp);
 
@@ -1590,7 +1590,7 @@ static int __devexit sunlance_sbus_remove(struct of_device *dev)
         struct lance_private *lp = dev_get_drvdata(&dev->dev);
         struct net_device *net_dev = lp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         lance_free_hwresources(lp);
 
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index 7874eb1ef043..f3bad56d476a 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -845,6 +845,8 @@ static int __init qec_ether_init(struct sbus_dev *sdev)
         if (!dev)
                 return -ENOMEM;
 
+        memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
+
         qe = netdev_priv(dev);
 
         i = of_getintprop_default(sdev->ofdev.node, "channel#", -1);
@@ -960,7 +962,7 @@ static int __devexit qec_sbus_remove(struct of_device *dev)
         struct sunqe *qp = dev_get_drvdata(&dev->dev);
         struct net_device *net_dev = qp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         sbus_iounmap(qp->qcregs, CREG_REG_SIZE);
         sbus_iounmap(qp->mregs, MREGS_REG_SIZE);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 8c8f9f4d47a5..256969e1300c 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.74"
-#define DRV_MODULE_RELDATE      "February 20, 2007"
+#define DRV_MODULE_VERSION      "3.75"
+#define DRV_MODULE_RELDATE      "March 23, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -3568,32 +3568,34 @@ static irqreturn_t tg3_interrupt(int irq, void *dev_id)
          * Reading the PCI State register will confirm whether the
          * interrupt is ours and will flush the status block.
          */
-        if ((sblk->status & SD_STATUS_UPDATED) ||
-            !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
-                /*
-                 * Writing any value to intr-mbox-0 clears PCI INTA# and
-                 * chip-internal interrupt pending events.
-                 * Writing non-zero to intr-mbox-0 additional tells the
-                 * NIC to stop sending us irqs, engaging "in-intr-handler"
-                 * event coalescing.
-                 */
-                tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                             0x00000001);
-                if (tg3_irq_sync(tp))
+        if (unlikely(!(sblk->status & SD_STATUS_UPDATED))) {
+                if ((tp->tg3_flags & TG3_FLAG_CHIP_RESETTING) ||
+                    (tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
+                        handled = 0;
                         goto out;
-                sblk->status &= ~SD_STATUS_UPDATED;
-                if (likely(tg3_has_work(tp))) {
-                        prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
-                        netif_rx_schedule(dev);         /* schedule NAPI poll */
-                } else {
-                        /* No work, shared interrupt perhaps?  re-enable
-                         * interrupts, and flush that PCI write
-                         */
-                        tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                                0x00000000);
                 }
-        } else {        /* shared interrupt */
-                handled = 0;
+        }
+
+        /*
+         * Writing any value to intr-mbox-0 clears PCI INTA# and
+         * chip-internal interrupt pending events.
+         * Writing non-zero to intr-mbox-0 additional tells the
+         * NIC to stop sending us irqs, engaging "in-intr-handler"
+         * event coalescing.
+         */
+        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+        if (tg3_irq_sync(tp))
+                goto out;
+        sblk->status &= ~SD_STATUS_UPDATED;
+        if (likely(tg3_has_work(tp))) {
+                prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
+                netif_rx_schedule(dev);         /* schedule NAPI poll */
+        } else {
+                /* No work, shared interrupt perhaps?  re-enable
+                 * interrupts, and flush that PCI write
+                 */
+                tw32_mailbox_f(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                               0x00000000);
         }
 out:
         return IRQ_RETVAL(handled);
@@ -3611,31 +3613,33 @@ static irqreturn_t tg3_interrupt_tagged(int irq, void *dev_id)
          * Reading the PCI State register will confirm whether the
          * interrupt is ours and will flush the status block.
          */
-        if ((sblk->status_tag != tp->last_tag) ||
-            !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
-                /*
-                 * writing any value to intr-mbox-0 clears PCI INTA# and
-                 * chip-internal interrupt pending events.
-                 * writing non-zero to intr-mbox-0 additional tells the
-                 * NIC to stop sending us irqs, engaging "in-intr-handler"
-                 * event coalescing.
-                 */
-                tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                             0x00000001);
-                if (tg3_irq_sync(tp))
+        if (unlikely(sblk->status_tag == tp->last_tag)) {
+                if ((tp->tg3_flags & TG3_FLAG_CHIP_RESETTING) ||
+                    (tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
+                        handled = 0;
                         goto out;
-                if (netif_rx_schedule_prep(dev)) {
-                        prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
-                        /* Update last_tag to mark that this status has been
-                         * seen. Because interrupt may be shared, we may be
-                         * racing with tg3_poll(), so only update last_tag
-                         * if tg3_poll() is not scheduled.
-                         */
-                        tp->last_tag = sblk->status_tag;
-                        __netif_rx_schedule(dev);
                 }
-        } else {        /* shared interrupt */
-                handled = 0;
+        }
+
+        /*
+         * writing any value to intr-mbox-0 clears PCI INTA# and
+         * chip-internal interrupt pending events.
+         * writing non-zero to intr-mbox-0 additional tells the
+         * NIC to stop sending us irqs, engaging "in-intr-handler"
+         * event coalescing.
+         */
+        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+        if (tg3_irq_sync(tp))
+                goto out;
+        if (netif_rx_schedule_prep(dev)) {
+                prefetch(&tp->rx_rcb[tp->rx_rcb_ptr]);
+                /* Update last_tag to mark that this status has been
+                 * seen. Because interrupt may be shared, we may be
+                 * racing with tg3_poll(), so only update last_tag
+                 * if tg3_poll() is not scheduled.
+                 */
+                tp->last_tag = sblk->status_tag;
+                __netif_rx_schedule(dev);
         }
 out:
         return IRQ_RETVAL(handled);
@@ -4823,6 +4827,21 @@ static int tg3_chip_reset(struct tg3 *tp)
         if (write_op == tg3_write_flush_reg32)
                 tp->write32 = tg3_write32;
 
+        /* Prevent the irq handler from reading or writing PCI registers
+         * during chip reset when the memory enable bit in the PCI command
+         * register may be cleared.  The chip does not generate interrupt
+         * at this time, but the irq handler may still be called due to irq
+         * sharing or irqpoll.
+         */
+        tp->tg3_flags |= TG3_FLAG_CHIP_RESETTING;
+        if (tp->hw_status) {
+                tp->hw_status->status = 0;
+                tp->hw_status->status_tag = 0;
+        }
+        tp->last_tag = 0;
+        smp_mb();
+        synchronize_irq(tp->pdev->irq);
+
         /* do the reset */
         val = GRC_MISC_CFG_CORECLK_RESET;
 
@@ -4904,6 +4923,8 @@ static int tg3_chip_reset(struct tg3 *tp)
 
         pci_restore_state(tp->pdev);
 
+        tp->tg3_flags &= ~TG3_FLAG_CHIP_RESETTING;
+
         /* Make sure PCI-X relaxed ordering bit is clear. */
         pci_read_config_dword(tp->pdev, TG3PCI_X_CAPS, &val);
         val &= ~PCIX_CAPS_RELAXED_ORDERING;
@@ -6321,8 +6342,6 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                       RDMAC_MODE_ADDROFLOW_ENAB | RDMAC_MODE_FIFOOFLOW_ENAB |
                       RDMAC_MODE_FIFOURUN_ENAB | RDMAC_MODE_FIFOOREAD_ENAB |
                       RDMAC_MODE_LNGREAD_ENAB);
-        if (tp->tg3_flags & TG3_FLAG_SPLIT_MODE)
-                rdmac_mode |= RDMAC_MODE_SPLIT_ENABLE;
 
         /* If statement applies to 5705 and 5750 PCI devices only */
         if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705 &&
@@ -6495,9 +6514,6 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
                         val &= ~(PCIX_CAPS_SPLIT_MASK | PCIX_CAPS_BURST_MASK);
                         val |= (PCIX_CAPS_MAX_BURST_CPIOB << PCIX_CAPS_BURST_SHIFT);
-                        if (tp->tg3_flags & TG3_FLAG_SPLIT_MODE)
-                                val |= (tp->split_mode_max_reqs <<
-                                        PCIX_CAPS_SPLIT_SHIFT);
                 }
                 tw32(TG3PCI_X_CAPS, val);
         }
@@ -10863,14 +10879,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         grc_misc_cfg = tr32(GRC_MISC_CFG);
         grc_misc_cfg &= GRC_MISC_CFG_BOARD_ID_MASK;
 
-        /* Broadcom's driver says that CIOBE multisplit has a bug */
-#if 0
-        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 &&
-            grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5704CIOBE) {
-                tp->tg3_flags |= TG3_FLAG_SPLIT_MODE;
-                tp->split_mode_max_reqs = SPLIT_MODE_5704_MAX_REQ;
-        }
-#endif
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705 &&
             (grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5788 ||
              grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5788M))
@@ -11968,14 +11976,12 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                        i == 5 ? '\n' : ':');
 
         printk(KERN_INFO "%s: RXcsums[%d] LinkChgREG[%d] "
-               "MIirq[%d] ASF[%d] Split[%d] WireSpeed[%d] "
-               "TSOcap[%d] \n",
+               "MIirq[%d] ASF[%d] WireSpeed[%d] TSOcap[%d]\n",
                dev->name,
                (tp->tg3_flags & TG3_FLAG_RX_CHECKSUMS) != 0,
                (tp->tg3_flags & TG3_FLAG_USE_LINKCHG_REG) != 0,
                (tp->tg3_flags & TG3_FLAG_USE_MI_INTERRUPT) != 0,
                (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0,
-               (tp->tg3_flags & TG3_FLAG_SPLIT_MODE) != 0,
                (tp->tg3_flags2 & TG3_FLG2_NO_ETH_WIRE_SPEED) == 0,
                (tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE) != 0);
         printk(KERN_INFO "%s: dma_rwctrl[%08x] dma_mask[%d-bit]\n",
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 086892d8c1f1..d515ed23841b 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2223,7 +2223,7 @@ struct tg3 {
 #define TG3_FLAG_40BIT_DMA_BUG          0x08000000
 #define TG3_FLAG_BROKEN_CHECKSUMS       0x10000000
 #define TG3_FLAG_GOT_SERDES_FLOWCTL     0x20000000
-#define TG3_FLAG_SPLIT_MODE             0x40000000
+#define TG3_FLAG_CHIP_RESETTING         0x40000000
 #define TG3_FLAG_INIT_COMPLETE          0x80000000
         u32                             tg3_flags2;
 #define TG3_FLG2_RESTART_TIMER          0x00000001
@@ -2262,9 +2262,6 @@ struct tg3 {
 #define TG3_FLG2_NO_FWARE_REPORTED      0x40000000
 #define TG3_FLG2_PHY_ADJUST_TRIM        0x80000000
 
-        u32                             split_mode_max_reqs;
-#define SPLIT_MODE_5704_MAX_REQ         3
-
         struct timer_list               timer;
         u16                             timer_counter;
         u16                             timer_multiplier;
diff --git a/drivers/net/wan/lmc/lmc_media.h b/drivers/net/wan/lmc/lmc_media.h
deleted file mode 100644
index ddcc00403563..000000000000
--- a/drivers/net/wan/lmc/lmc_media.h
+++ /dev/null
@@ -1,65 +0,0 @@
-#ifndef _LMC_MEDIA_H_
-#define _LMC_MEDIA_H_
-
-lmc_media_t lmc_ds3_media = {
-  lmc_ds3_init,                 /* special media init stuff */
-  lmc_ds3_default,              /* reset to default state */
-  lmc_ds3_set_status,           /* reset status to state provided */
-  lmc_dummy_set_1,              /* set clock source */
-  lmc_dummy_set2_1,             /* set line speed */
-  lmc_ds3_set_100ft,            /* set cable length */
-  lmc_ds3_set_scram,            /* set scrambler */
-  lmc_ds3_get_link_status,      /* get link status */
-  lmc_dummy_set_1,              /* set link status */
-  lmc_ds3_set_crc_length,       /* set CRC length */
-  lmc_dummy_set_1,              /* set T1 or E1 circuit type */
-  lmc_ds3_watchdog
-};
-
-lmc_media_t lmc_hssi_media = {
-  lmc_hssi_init,                /* special media init stuff */
-  lmc_hssi_default,             /* reset to default state */
-  lmc_hssi_set_status,          /* reset status to state provided */
-  lmc_hssi_set_clock,           /* set clock source */
-  lmc_dummy_set2_1,             /* set line speed */
-  lmc_dummy_set_1,              /* set cable length */
-  lmc_dummy_set_1,              /* set scrambler */
-  lmc_hssi_get_link_status,     /* get link status */
-  lmc_hssi_set_link_status,     /* set link status */
-  lmc_hssi_set_crc_length,      /* set CRC length */
-  lmc_dummy_set_1,              /* set T1 or E1 circuit type */
-  lmc_hssi_watchdog
-};
-
-lmc_media_t lmc_ssi_media = { lmc_ssi_init,     /* special media init stuff */
-  lmc_ssi_default,              /* reset to default state */
-  lmc_ssi_set_status,           /* reset status to state provided */
-  lmc_ssi_set_clock,            /* set clock source */
-  lmc_ssi_set_speed,            /* set line speed */
-  lmc_dummy_set_1,              /* set cable length */
-  lmc_dummy_set_1,              /* set scrambler */
-  lmc_ssi_get_link_status,      /* get link status */
-  lmc_ssi_set_link_status,      /* set link status */
-  lmc_ssi_set_crc_length,       /* set CRC length */
-  lmc_dummy_set_1,              /* set T1 or E1 circuit type */
-  lmc_ssi_watchdog
-};
-
-lmc_media_t lmc_t1_media = {
-  lmc_t1_init,                  /* special media init stuff */
-  lmc_t1_default,               /* reset to default state */
-  lmc_t1_set_status,            /* reset status to state provided */
-  lmc_t1_set_clock,             /* set clock source */
-  lmc_dummy_set2_1,             /* set line speed */
-  lmc_dummy_set_1,              /* set cable length */
-  lmc_dummy_set_1,              /* set scrambler */
-  lmc_t1_get_link_status,       /* get link status */
-  lmc_dummy_set_1,              /* set link status */
-  lmc_t1_set_crc_length,        /* set CRC length */
-  lmc_t1_set_circuit_type,      /* set T1 or E1 circuit type */
-  lmc_t1_watchdog
-};
-
-
-#endif
-
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 80cb88eb98c6..a38e7eec0e62 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -946,6 +946,7 @@ static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
         u8 channel;
         struct bcm43xx_phyinfo *phy;
         const char *iso_country;
+        u8 max_bg_channel;
 
         geo = kzalloc(sizeof(*geo), GFP_KERNEL);
         if (!geo)
@@ -967,6 +968,23 @@ static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
         }
         iso_country = bcm43xx_locale_iso(bcm->sprom.locale);
 
+/* set the maximum channel based on locale set in sprom or witle locale option */
+        switch (bcm->sprom.locale) {
+        case BCM43xx_LOCALE_THAILAND:
+        case BCM43xx_LOCALE_ISRAEL:
+        case BCM43xx_LOCALE_JORDAN:
+        case BCM43xx_LOCALE_USA_CANADA_ANZ:
+        case BCM43xx_LOCALE_USA_LOW:
+                max_bg_channel = 11;
+                break;
+        case BCM43xx_LOCALE_JAPAN:
+        case BCM43xx_LOCALE_JAPAN_HIGH:
+                max_bg_channel = 14;
+                break;
+        default:
+                max_bg_channel = 13;
+        }
+
         if (have_a) {
                 for (i = 0, channel = IEEE80211_52GHZ_MIN_CHANNEL;
                       channel <= IEEE80211_52GHZ_MAX_CHANNEL; channel++) {
@@ -978,7 +996,7 @@ static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
         }
         if (have_bg) {
                 for (i = 0, channel = IEEE80211_24GHZ_MIN_CHANNEL;
-                      channel <= IEEE80211_24GHZ_MAX_CHANNEL; channel++) {
+                      channel <= max_bg_channel; channel++) {
                         chan = &geo->bg[i++];
                         chan->freq = bcm43xx_channel_to_freq_bg(channel);
                         chan->channel = channel;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index cae89258a640..72529a440f15 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -757,7 +757,7 @@ static void bcm43xx_phy_initb5(struct bcm43xx_private *bcm)
         if (radio->version == 0x2050)
                 bcm43xx_phy_write(bcm, 0x0038, 0x0667);
 
-        if (phy->type == BCM43xx_PHYTYPE_G) {
+        if (phy->connected) {
                 if (radio->version == 0x2050) {
                         bcm43xx_radio_write16(bcm, 0x007A,
                                               bcm43xx_radio_read16(bcm, 0x007A)
@@ -978,7 +978,7 @@ static void bcm43xx_calc_loopback_gain(struct bcm43xx_private *bcm)
 {
         struct bcm43xx_phyinfo *phy = bcm43xx_current_phy(bcm);
         struct bcm43xx_radioinfo *radio = bcm43xx_current_radio(bcm);
-        u16 backup_phy[15];
+        u16 backup_phy[15] = {0};
         u16 backup_radio[3];
         u16 backup_bband;
         u16 i;
@@ -989,8 +989,10 @@ static void bcm43xx_calc_loopback_gain(struct bcm43xx_private *bcm)
         backup_phy[1] = bcm43xx_phy_read(bcm, 0x0001);
         backup_phy[2] = bcm43xx_phy_read(bcm, 0x0811);
         backup_phy[3] = bcm43xx_phy_read(bcm, 0x0812);
-        backup_phy[4] = bcm43xx_phy_read(bcm, 0x0814);
-        backup_phy[5] = bcm43xx_phy_read(bcm, 0x0815);
+        if (phy->rev != 1) {
+                backup_phy[4] = bcm43xx_phy_read(bcm, 0x0814);
+                backup_phy[5] = bcm43xx_phy_read(bcm, 0x0815);
+        }
         backup_phy[6] = bcm43xx_phy_read(bcm, 0x005A);
         backup_phy[7] = bcm43xx_phy_read(bcm, 0x0059);
         backup_phy[8] = bcm43xx_phy_read(bcm, 0x0058);
@@ -1018,14 +1020,16 @@ static void bcm43xx_calc_loopback_gain(struct bcm43xx_private *bcm)
                           bcm43xx_phy_read(bcm, 0x0811) | 0x0001);
         bcm43xx_phy_write(bcm, 0x0812,
                           bcm43xx_phy_read(bcm, 0x0812) & 0xFFFE);
-        bcm43xx_phy_write(bcm, 0x0814,
-                          bcm43xx_phy_read(bcm, 0x0814) | 0x0001);
-        bcm43xx_phy_write(bcm, 0x0815,
-                          bcm43xx_phy_read(bcm, 0x0815) & 0xFFFE);
-        bcm43xx_phy_write(bcm, 0x0814,
-                          bcm43xx_phy_read(bcm, 0x0814) | 0x0002);
-        bcm43xx_phy_write(bcm, 0x0815,
-                          bcm43xx_phy_read(bcm, 0x0815) & 0xFFFD);
+        if (phy->rev != 1) {
+                bcm43xx_phy_write(bcm, 0x0814,
+                                  bcm43xx_phy_read(bcm, 0x0814) | 0x0001);
+                bcm43xx_phy_write(bcm, 0x0815,
+                                  bcm43xx_phy_read(bcm, 0x0815) & 0xFFFE);
+                bcm43xx_phy_write(bcm, 0x0814,
+                                  bcm43xx_phy_read(bcm, 0x0814) | 0x0002);
+                bcm43xx_phy_write(bcm, 0x0815,
+                                  bcm43xx_phy_read(bcm, 0x0815) & 0xFFFD);
+        }
         bcm43xx_phy_write(bcm, 0x0811,
                           bcm43xx_phy_read(bcm, 0x0811) | 0x000C);
         bcm43xx_phy_write(bcm, 0x0812,
@@ -1048,10 +1052,12 @@ static void bcm43xx_calc_loopback_gain(struct bcm43xx_private *bcm)
                                   bcm43xx_phy_read(bcm, 0x000A)
                                   | 0x2000);
         }
-        bcm43xx_phy_write(bcm, 0x0814,
-                          bcm43xx_phy_read(bcm, 0x0814) | 0x0004);
-        bcm43xx_phy_write(bcm, 0x0815,
-                          bcm43xx_phy_read(bcm, 0x0815) & 0xFFFB);
+        if (phy->rev != 1) {
+                bcm43xx_phy_write(bcm, 0x0814,
+                                  bcm43xx_phy_read(bcm, 0x0814) | 0x0004);
+                bcm43xx_phy_write(bcm, 0x0815,
+                                  bcm43xx_phy_read(bcm, 0x0815) & 0xFFFB);
+        }
         bcm43xx_phy_write(bcm, 0x0003,
                           (bcm43xx_phy_read(bcm, 0x0003)
                            & 0xFF9F) | 0x0040);
@@ -1138,8 +1144,10 @@ static void bcm43xx_calc_loopback_gain(struct bcm43xx_private *bcm)
                 }
         }
 
-        bcm43xx_phy_write(bcm, 0x0814, backup_phy[4]);
-        bcm43xx_phy_write(bcm, 0x0815, backup_phy[5]);
+        if (phy->rev != 1) {
+                bcm43xx_phy_write(bcm, 0x0814, backup_phy[4]);
+                bcm43xx_phy_write(bcm, 0x0815, backup_phy[5]);
+        }
         bcm43xx_phy_write(bcm, 0x005A, backup_phy[6]);
         bcm43xx_phy_write(bcm, 0x0059, backup_phy[7]);
         bcm43xx_phy_write(bcm, 0x0058, backup_phy[8]);
@@ -1188,24 +1196,23 @@ static void bcm43xx_phy_initg(struct bcm43xx_private *bcm)
                 bcm43xx_phy_write(bcm, 0x0811, 0x0000);
                 bcm43xx_phy_write(bcm, 0x0015, 0x00C0);
         }
-        if (phy->rev >= 3) {
+        if (phy->rev > 5) {
                 bcm43xx_phy_write(bcm, 0x0811, 0x0400);
                 bcm43xx_phy_write(bcm, 0x0015, 0x00C0);
         }
-        if (phy->connected) {
+        if (phy->rev >= 2 && phy->connected) {
                 tmp = bcm43xx_phy_read(bcm, 0x0400) & 0xFF;
-                if (tmp < 6) {
+                if (tmp ==3 || tmp == 5) {
                         bcm43xx_phy_write(bcm, 0x04C2, 0x1816);
                         bcm43xx_phy_write(bcm, 0x04C3, 0x8006);
-                        if (tmp != 3) {
+                        if (tmp == 5) {
                                 bcm43xx_phy_write(bcm, 0x04CC,
                                                   (bcm43xx_phy_read(bcm, 0x04CC)
                                                    & 0x00FF) | 0x1F00);
                         }
                 }
-        }
-        if (phy->rev < 3 && phy->connected)
                 bcm43xx_phy_write(bcm, 0x047E, 0x0078);
+        }
         if (radio->revision == 8) {
                 bcm43xx_phy_write(bcm, 0x0801, bcm43xx_phy_read(bcm, 0x0801) | 0x0080);
                 bcm43xx_phy_write(bcm, 0x043E, bcm43xx_phy_read(bcm, 0x043E) | 0x0004);
@@ -1232,7 +1239,7 @@ static void bcm43xx_phy_initg(struct bcm43xx_private *bcm)
                 if (phy->rev >= 6) {
                         bcm43xx_phy_write(bcm, 0x0036,
                                           (bcm43xx_phy_read(bcm, 0x0036)
-                                           & 0xF000) | (radio->txctl2 << 12));
+                                           & 0x0FFF) | (radio->txctl2 << 12));
                 }
                 if (bcm->sprom.boardflags & BCM43xx_BFL_PACTRL)
                         bcm43xx_phy_write(bcm, 0x002E, 0x8075);
@@ -1243,7 +1250,7 @@ static void bcm43xx_phy_initg(struct bcm43xx_private *bcm)
                 else
                         bcm43xx_phy_write(bcm, 0x002F, 0x0202);
         }
-        if (phy->connected) {
+        if (phy->connected || phy->rev >= 2) {
                 bcm43xx_phy_lo_adjust(bcm, 0);
                 bcm43xx_phy_write(bcm, 0x080F, 0x8078);
         }
@@ -1257,7 +1264,7 @@ static void bcm43xx_phy_initg(struct bcm43xx_private *bcm)
                  */
                 bcm43xx_nrssi_hw_update(bcm, 0xFFFF);
                 bcm43xx_calc_nrssi_threshold(bcm);
-        } else if (phy->connected) {
+        } else if (phy->connected || phy->rev >= 2) {
                 if (radio->nrssi[0] == -1000) {
                         assert(radio->nrssi[1] == -1000);
                         bcm43xx_calc_nrssi_slope(bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_radio.c b/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
index ee1e7a2afc08..4025dd0089d2 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_radio.c
@@ -458,7 +458,7 @@ static void bcm43xx_calc_nrssi_offset(struct bcm43xx_private *bcm)
                 bcm43xx_phy_write(bcm, 0x005A, 0x0480);
                 bcm43xx_phy_write(bcm, 0x0059, 0x0810);
                 bcm43xx_phy_write(bcm, 0x0058, 0x000D);
-                if (phy->rev == 0) {
+                if (phy->analog == 0) {
                         bcm43xx_phy_write(bcm, 0x0003, 0x0122);
                 } else {
                         bcm43xx_phy_write(bcm, 0x000A,
@@ -570,9 +570,9 @@ void bcm43xx_calc_nrssi_slope(struct bcm43xx_private *bcm)
                 nrssi0 = (s16)bcm43xx_phy_read(bcm, 0x0027);
                 bcm43xx_radio_write16(bcm, 0x007A,
                                       bcm43xx_radio_read16(bcm, 0x007A) & 0x007F);
-                if (phy->rev >= 2) {
+                if (phy->analog >= 2) {
                         bcm43xx_write16(bcm, 0x03E6, 0x0040);
-                } else if (phy->rev == 0) {
+                } else if (phy->analog == 0) {
                         bcm43xx_write16(bcm, 0x03E6, 0x0122);
                 } else {
                         bcm43xx_write16(bcm, BCM43xx_MMIO_CHANNEL_EXT,
@@ -596,7 +596,7 @@ void bcm43xx_calc_nrssi_slope(struct bcm43xx_private *bcm)
                 bcm43xx_phy_write(bcm, 0x0015, backup[5]);
                 bcm43xx_phy_write(bcm, 0x002A, backup[6]);
                 bcm43xx_synth_pu_workaround(bcm, radio->channel);
-                if (phy->rev != 0)
+                if (phy->analog != 0)
                         bcm43xx_write16(bcm, 0x03F4, backup[13]);
 
                 bcm43xx_phy_write(bcm, 0x0020, backup[7]);
@@ -692,7 +692,7 @@ void bcm43xx_calc_nrssi_slope(struct bcm43xx_private *bcm)
 
                 bcm43xx_radio_write16(bcm, 0x007A,
                                       bcm43xx_radio_read16(bcm, 0x007A) & 0x007F);
-                if (phy->rev >= 2) {
+                if (phy->analog >= 2) {
                         bcm43xx_phy_write(bcm, 0x0003,
                                           (bcm43xx_phy_read(bcm, 0x0003)
                                            & 0xFF9F) | 0x0040);
@@ -1579,7 +1579,7 @@ void bcm43xx_radio_set_tx_iq(struct bcm43xx_private *bcm)
         
         for (i = 0; i < 5; i++) {
                 for (j = 0; j < 5; j++) {
-                        if (tmp == (data_high[i] << 4 | data_low[j])) {
+                        if (tmp == (data_high[i] | data_low[j])) {
                                 bcm43xx_phy_write(bcm, 0x0069, (i - j) << 8 | 0x00C0);
                                 return;
                         }
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 9c64f894b71b..87ee3ee020fe 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -337,6 +337,7 @@ static int read_pod(struct zd_chip *chip, u8 *rf_type)
         chip->patch_cr157 = (value >> 13) & 0x1;
         chip->patch_6m_band_edge = (value >> 21) & 0x1;
         chip->new_phy_layout = (value >> 31) & 0x1;
+        chip->al2230s_bit = (value >> 7) & 0x1;
         chip->link_led = ((value >> 4) & 1) ? LED1 : LED2;
         chip->supports_tx_led = 1;
         if (value & (1 << 24)) { /* LED scenario */
@@ -591,16 +592,16 @@ int zd_chip_unlock_phy_regs(struct zd_chip *chip)
         return r;
 }
 
-/* CR157 can be optionally patched by the EEPROM */
+/* CR157 can be optionally patched by the EEPROM for original ZD1211 */
 static int patch_cr157(struct zd_chip *chip)
 {
         int r;
-        u32 value;
+        u16 value;
 
         if (!chip->patch_cr157)
                 return 0;
 
-        r = zd_ioread32_locked(chip, &value, E2P_PHY_REG);
+        r = zd_ioread16_locked(chip, &value, E2P_PHY_REG);
         if (r)
                 return r;
 
@@ -790,11 +791,6 @@ static int zd1211b_hw_reset_phy(struct zd_chip *chip)
                 goto out;
 
         r = zd_iowrite16a_locked(chip, ioreqs, ARRAY_SIZE(ioreqs));
-        if (r)
-                goto unlock;
-
-        r = patch_cr157(chip);
-unlock:
         t = zd_chip_unlock_phy_regs(chip);
         if (t && !r)
                 r = t;
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index b07569e391ee..e57ed75d9425 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -641,8 +641,8 @@ enum {
  * also only 11 channels. */
 #define E2P_ALLOWED_CHANNEL     E2P_DATA(0x18)
 
-#define E2P_PHY_REG             E2P_DATA(0x1a)
 #define E2P_DEVICE_VER          E2P_DATA(0x20)
+#define E2P_PHY_REG             E2P_DATA(0x25)
 #define E2P_36M_CAL_VALUE1      E2P_DATA(0x28)
 #define E2P_36M_CAL_VALUE2      E2P_DATA(0x2a)
 #define E2P_36M_CAL_VALUE3      E2P_DATA(0x2c)
@@ -711,7 +711,7 @@ struct zd_chip {
         u16 link_led;
         unsigned int pa_type:4,
                 patch_cck_gain:1, patch_cr157:1, patch_6m_band_edge:1,
-                new_phy_layout:1,
+                new_phy_layout:1, al2230s_bit:1,
                 is_zd1211b:1, supports_tx_led:1;
 };
 
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_al2230.c b/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
index 25323a13a3db..5235a7827ac5 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
@@ -358,6 +358,12 @@ int zd_rf_init_al2230(struct zd_rf *rf)
 {
         struct zd_chip *chip = zd_rf_to_chip(rf);
 
+        if (chip->al2230s_bit) {
+                dev_err(zd_chip_dev(chip), "AL2230S devices are not yet "
+                        "supported by this driver.\n");
+                return -ENODEV;
+        }
+
         rf->switch_radio_off = al2230_switch_radio_off;
         if (chip->is_zd1211b) {
                 rf->init_hw = zd1211b_al2230_init_hw;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index aac8a1c5ba08..edaaad2f648b 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -62,6 +62,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x13b1, 0x0024), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0586, 0x340f), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0baf, 0x0121), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         {}
diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
index 00e937e9240e..e7fbac529935 100644
--- a/drivers/oprofile/event_buffer.c
+++ b/drivers/oprofile/event_buffer.c
@@ -70,11 +70,12 @@ void wake_up_buffer_waiter(void)
 int alloc_event_buffer(void)
 {
         int err = -ENOMEM;
+        unsigned long flags;
 
-        spin_lock(&oprofilefs_lock);
+        spin_lock_irqsave(&oprofilefs_lock, flags);
         buffer_size = fs_buffer_size;
         buffer_watershed = fs_buffer_watershed;
-        spin_unlock(&oprofilefs_lock);
+        spin_unlock_irqrestore(&oprofilefs_lock, flags);
  
         if (buffer_watershed >= buffer_size)
                 return -EINVAL;
diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
index 6e67b42ca46d..8543cb26cf34 100644
--- a/drivers/oprofile/oprofilefs.c
+++ b/drivers/oprofile/oprofilefs.c
@@ -65,6 +65,7 @@ ssize_t oprofilefs_ulong_to_user(unsigned long val, char __user * buf, size_t co
 int oprofilefs_ulong_from_user(unsigned long * val, char const __user * buf, size_t count)
 {
         char tmpbuf[TMPBUFSIZE];
+        unsigned long flags;
 
         if (!count)
                 return 0;
@@ -77,9 +78,9 @@ int oprofilefs_ulong_from_user(unsigned long * val, char const __user * buf, siz
         if (copy_from_user(tmpbuf, buf, count))
                 return -EFAULT;
 
-        spin_lock(&oprofilefs_lock);
+        spin_lock_irqsave(&oprofilefs_lock, flags);
         *val = simple_strtoul(tmpbuf, NULL, 0);
-        spin_unlock(&oprofilefs_lock);
+        spin_unlock_irqrestore(&oprofilefs_lock, flags);
         return 0;
 }
 
diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c
index 9793533276ec..400bb90084cf 100644
--- a/drivers/parport/parport_sunbpp.c
+++ b/drivers/parport/parport_sunbpp.c
@@ -126,7 +126,7 @@ static unsigned char status_sunbpp_to_pc(struct parport *p)
         if (!(value_tcr & P_TCR_BUSY))
                 bits |= PARPORT_STATUS_BUSY;
 
-        dprintk((KERN_DEBUG "tcr 0x%x ir 0x%x\n", regs->p_tcr, regs->p_ir));
+        dprintk((KERN_DEBUG "tcr 0x%x ir 0x%x\n", value_tcr, value_ir));
         dprintk((KERN_DEBUG "read status 0x%x\n", bits));
         return bits;
 }
@@ -147,7 +147,7 @@ static unsigned char control_sunbpp_to_pc(struct parport *p)
         if (value_or & P_OR_SLCT_IN)
                 bits |= PARPORT_CONTROL_SELECT;
 
-        dprintk((KERN_DEBUG "tcr 0x%x or 0x%x\n", regs->p_tcr, regs->p_or));
+        dprintk((KERN_DEBUG "tcr 0x%x or 0x%x\n", value_tcr, value_or));
         dprintk((KERN_DEBUG "read control 0x%x\n", bits));
         return bits;
 }
@@ -165,7 +165,8 @@ static unsigned char parport_sunbpp_frob_control(struct parport *p,
         unsigned char value_tcr = sbus_readb(&regs->p_tcr);
         unsigned char value_or = sbus_readb(&regs->p_or);
 
-        dprintk((KERN_DEBUG "frob1: tcr 0x%x or 0x%x\n", regs->p_tcr, regs->p_or));
+        dprintk((KERN_DEBUG "frob1: tcr 0x%x or 0x%x\n",
+                 value_tcr, value_or));
         if (mask & PARPORT_CONTROL_STROBE) {
                 if (val & PARPORT_CONTROL_STROBE) {
                         value_tcr &= ~P_TCR_DS;
@@ -197,7 +198,8 @@ static unsigned char parport_sunbpp_frob_control(struct parport *p,
 
         sbus_writeb(value_or, &regs->p_or);
         sbus_writeb(value_tcr, &regs->p_tcr);
-        dprintk((KERN_DEBUG "frob2: tcr 0x%x or 0x%x\n", regs->p_tcr, regs->p_or));
+        dprintk((KERN_DEBUG "frob2: tcr 0x%x or 0x%x\n",
+                 value_tcr, value_or));
         return parport_sunbpp_read_control(p);
 }
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index ad33e0159514..435c1958a7b7 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -94,6 +94,7 @@ static void msi_set_mask_bit(unsigned int irq, int flag)
                 int offset = entry->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE +
                         PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET;
                 writel(flag, entry->mask_base + offset);
+                readl(entry->mask_base + offset);
                 break;
         }
         default:
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 0be5a0b30725..df383645e366 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -93,7 +93,7 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
         if (!dev->irq && dev->pin) {
                 printk(KERN_WARNING 
                 "%s->Dev[%04x:%04x] has invalid IRQ. Check vendor BIOS\n", 
-                __FUNCTION__, dev->device, dev->vendor);
+                __FUNCTION__, dev->vendor, dev->device);
         }
         if (pcie_port_device_register(dev)) {
                 pci_disable_device(dev);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index a4a96826d9e0..2fe1d690eb13 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -682,34 +682,7 @@ static void pci_read_irq(struct pci_dev *dev)
         dev->irq = irq;
 }
 
-static void change_legacy_io_resource(struct pci_dev * dev, unsigned index,
-                                      unsigned start, unsigned end)
-{
-        unsigned base = start & PCI_BASE_ADDRESS_IO_MASK;
-        unsigned len = (end | ~PCI_BASE_ADDRESS_IO_MASK) - base + 1;
-
-        /*
-         * Some X versions get confused when the BARs reported through
-         * /sys or /proc differ from those seen in config space, thus
-         * try to update the config space values, too.
-         */
-        if (!(pci_resource_flags(dev, index) & IORESOURCE_IO))
-                printk(KERN_WARNING "%s: cannot adjust BAR%u (not I/O)\n",
-                       pci_name(dev), index);
-        else if (pci_resource_len(dev, index) != len)
-                printk(KERN_WARNING "%s: cannot adjust BAR%u (size %04X)\n",
-                       pci_name(dev), index, (unsigned)pci_resource_len(dev, index));
-        else {
-                printk(KERN_INFO "%s: trying to change BAR%u from %04X to %04X\n",
-                       pci_name(dev), index,
-                       (unsigned)pci_resource_start(dev, index), base);
-                pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + index * 4, base);
-        }
-        pci_resource_start(dev, index) = start;
-        pci_resource_end(dev, index)   = end;
-        pci_resource_flags(dev, index) =
-                IORESOURCE_IO | IORESOURCE_PCI_FIXED | PCI_BASE_ADDRESS_SPACE_IO;
-}
+#define LEGACY_IO_RESOURCE      (IORESOURCE_IO | IORESOURCE_PCI_FIXED)
 
 /**
  * pci_setup_device - fill in class and map information of a device
@@ -762,12 +735,20 @@ static int pci_setup_device(struct pci_dev * dev)
                         u8 progif;
                         pci_read_config_byte(dev, PCI_CLASS_PROG, &progif);
                         if ((progif & 1) == 0) {
-                                change_legacy_io_resource(dev, 0, 0x1F0, 0x1F7);
-                                change_legacy_io_resource(dev, 1, 0x3F6, 0x3F6);
+                                dev->resource[0].start = 0x1F0;
+                                dev->resource[0].end = 0x1F7;
+                                dev->resource[0].flags = LEGACY_IO_RESOURCE;
+                                dev->resource[1].start = 0x3F6;
+                                dev->resource[1].end = 0x3F6;
+                                dev->resource[1].flags = LEGACY_IO_RESOURCE;
                         }
                         if ((progif & 4) == 0) {
-                                change_legacy_io_resource(dev, 2, 0x170, 0x177);
-                                change_legacy_io_resource(dev, 3, 0x376, 0x376);
+                                dev->resource[2].start = 0x170;
+                                dev->resource[2].end = 0x177;
+                                dev->resource[2].flags = LEGACY_IO_RESOURCE;
+                                dev->resource[3].start = 0x376;
+                                dev->resource[3].end = 0x376;
+                                dev->resource[3].flags = LEGACY_IO_RESOURCE;
                         }
                 }
                 break;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 7f94fc098cd3..65d6f23ead41 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -963,6 +963,13 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_ho
  * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it 
  * becomes necessary to do this tweak in two steps -- I've chosen the Host
  * bridge as trigger.
+ *
+ * Note that we used to unhide the SMBus that way on Toshiba laptops
+ * (Satellite A40 and Tecra M2) but then found that the thermal management
+ * was done by SMM code, which could cause unsynchronized concurrent
+ * accesses to the SMBus registers, with potentially bad effects. Thus you
+ * should be very careful when adding new entries: if SMM is accessing the
+ * Intel SMBus, this is a very good reason to leave it hidden.
  */
 static int asus_hides_smbus;
 
@@ -1040,17 +1047,6 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
                         case 0x099c: /* HP Compaq nx6110 */
                                 asus_hides_smbus = 1;
                         }
-        } else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_TOSHIBA)) {
-                if (dev->device == PCI_DEVICE_ID_INTEL_82855GM_HB)
-                        switch(dev->subsystem_device) {
-                        case 0x0001: /* Toshiba Satellite A40 */
-                                asus_hides_smbus = 1;
-                        }
-                else if (dev->device == PCI_DEVICE_ID_INTEL_82855PM_HB)
-                        switch(dev->subsystem_device) {
-                        case 0x0001: /* Toshiba Tecra M2 */
-                                asus_hides_smbus = 1;
-                        }
        } else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG)) {
                if (dev->device ==  PCI_DEVICE_ID_INTEL_82855PM_HB)
                        switch(dev->subsystem_device) {
diff --git a/drivers/pcmcia/au1000_generic.c b/drivers/pcmcia/au1000_generic.c
index 551bde5d9430..b693367d38cd 100644
--- a/drivers/pcmcia/au1000_generic.c
+++ b/drivers/pcmcia/au1000_generic.c
@@ -372,7 +372,7 @@ int au1x00_pcmcia_socket_probe(struct device *dev, struct pcmcia_low_level *ops,
                 skt->socket.resource_ops = &pccard_static_ops;
                 skt->socket.ops = &au1x00_pcmcia_operations;
                 skt->socket.owner = ops->owner;
-                skt->socket.dev.dev = dev;
+                skt->socket.dev.parent = dev;
 
                 init_timer(&skt->poll_timer);
                 skt->poll_timer.function = au1x00_pcmcia_poll_event;
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index d77f75129f8a..2df216b00817 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -202,15 +202,14 @@ static struct pccard_operations omap_cf_ops = {
  * "what chipselect is used".  Boards could want more.
  */
 
-static int __devinit omap_cf_probe(struct device *dev)
+static int __init omap_cf_probe(struct platform_device *pdev)
 {
         unsigned                seg;
         struct omap_cf_socket   *cf;
-        struct platform_device  *pdev = to_platform_device(dev);
         int                     irq;
         int                     status;
 
-        seg = (int) dev->platform_data;
+        seg = (int) pdev->dev.platform_data;
         if (seg == 0 || seg > 3)
                 return -ENODEV;
 
@@ -227,7 +226,7 @@ static int __devinit omap_cf_probe(struct device *dev)
         cf->timer.data = (unsigned long) cf;
 
         cf->pdev = pdev;
-        dev_set_drvdata(dev, cf);
+        platform_set_drvdata(pdev, cf);
 
         /* this primarily just shuts up irq handling noise */
         status = request_irq(irq, omap_cf_irq, IRQF_SHARED,
@@ -291,7 +290,7 @@ static int __devinit omap_cf_probe(struct device *dev)
                 omap_cf_present() ? "present" : "(not present)");
 
         cf->socket.owner = THIS_MODULE;
-        cf->socket.dev.parent = dev;
+        cf->socket.dev.parent = &pdev->dev;
         cf->socket.ops = &omap_cf_ops;
         cf->socket.resource_ops = &pccard_static_ops;
         cf->socket.features = SS_CAP_PCCARD | SS_CAP_STATIC_MAP
@@ -318,9 +317,9 @@ fail0:
         return status;
 }
 
-static int __devexit omap_cf_remove(struct device *dev)
+static int __exit omap_cf_remove(struct platform_device *pdev)
 {
-        struct omap_cf_socket *cf = dev_get_drvdata(dev);
+        struct omap_cf_socket *cf = platform_get_drvdata(pdev);
 
         cf->active = 0;
         pcmcia_unregister_socket(&cf->socket);
@@ -332,26 +331,36 @@ static int __devexit omap_cf_remove(struct device *dev)
         return 0;
 }
 
-static struct device_driver omap_cf_driver = {
-        .name           = (char *) driver_name,
-        .bus            = &platform_bus_type,
-        .probe          = omap_cf_probe,
-        .remove         = __devexit_p(omap_cf_remove),
-        .suspend        = pcmcia_socket_dev_suspend,
-        .resume         = pcmcia_socket_dev_resume,
+static int omap_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
+{
+        return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
+}
+
+static int omap_cf_resume(struct platform_device *pdev)
+{
+        return pcmcia_socket_dev_resume(&pdev->dev);
+}
+
+static struct platform_driver omap_cf_driver = {
+        .driver = {
+                .name   = (char *) driver_name,
+        },
+        .remove         = __exit_p(omap_cf_remove),
+        .suspend        = omap_cf_suspend,
+        .resume         = omap_cf_resume,
 };
 
 static int __init omap_cf_init(void)
 {
         if (cpu_is_omap16xx())
-                return driver_register(&omap_cf_driver);
+                return platform_driver_probe(&omap_cf_driver, omap_cf_probe);
         return -ENODEV;
 }
 
 static void __exit omap_cf_exit(void)
 {
         if (cpu_is_omap16xx())
-                driver_unregister(&omap_cf_driver);
+                platform_driver_unregister(&omap_cf_driver);
 }
 
 module_init(omap_cf_init);
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 2065e74bb63f..a8a95540b1ef 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -22,7 +22,7 @@ static const struct pnp_device_id pnp_dev_table[] = {
         {       "",                     0       }
 };
 
-static void reserve_range(char *pnpid, int start, int end, int port)
+static void reserve_range(const char *pnpid, resource_size_t start, resource_size_t end, int port)
 {
         struct resource *res;
         char *regionid;
@@ -32,9 +32,9 @@ static void reserve_range(char *pnpid, int start, int end, int port)
                 return;
         snprintf(regionid, 16, "pnp %s", pnpid);
         if (port)
-                res = request_region(start,end-start+1,regionid);
+                res = request_region(start, end-start+1, regionid);
         else
-                res = request_mem_region(start,end-start+1,regionid);
+                res = request_mem_region(start, end-start+1, regionid);
         if (res == NULL)
                 kfree(regionid);
         else
@@ -45,12 +45,13 @@ static void reserve_range(char *pnpid, int start, int end, int port)
          * have double reservations.
          */
         printk(KERN_INFO
-                "pnp: %s: %s range 0x%x-0x%x %s reserved\n",
-                pnpid, port ? "ioport" : "iomem", start, end,
+                "pnp: %s: %s range 0x%llx-0x%llx %s reserved\n",
+                pnpid, port ? "ioport" : "iomem",
+                (unsigned long long)start, (unsigned long long)end,
                 NULL != res ? "has been" : "could not be");
 }
 
-static void reserve_resources_of_dev(struct pnp_dev *dev)
+static void reserve_resources_of_dev(const struct pnp_dev *dev)
 {
         int i;
 
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 85bf795abdcc..7c0d60910077 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -59,6 +59,19 @@ struct cmos_rtc {
 
 static const char driver_name[] = "rtc_cmos";
 
+/* The RTC_INTR register may have e.g. RTC_PF set even if RTC_PIE is clear;
+ * always mask it against the irq enable bits in RTC_CONTROL.  Bit values
+ * are the same: PF==PIE, AF=AIE, UF=UIE; so RTC_IRQMASK works with both.
+ */
+#define RTC_IRQMASK     (RTC_PF | RTC_AF | RTC_UF)
+
+static inline int is_intr(u8 rtc_intr)
+{
+        if (!(rtc_intr & RTC_IRQF))
+                return 0;
+        return rtc_intr & RTC_IRQMASK;
+}
+
 /*----------------------------------------------------------------*/
 
 static int cmos_read_time(struct device *dev, struct rtc_time *t)
@@ -188,7 +201,8 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
         rtc_control &= ~RTC_AIE;
         CMOS_WRITE(rtc_control, RTC_CONTROL);
         rtc_intr = CMOS_READ(RTC_INTR_FLAGS);
-        if (rtc_intr)
+        rtc_intr &= (rtc_control & RTC_IRQMASK) | RTC_IRQF;
+        if (is_intr(rtc_intr))
                 rtc_update_irq(&cmos->rtc->class_dev, 1, rtc_intr);
 
         /* update alarm */
@@ -207,7 +221,8 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
                 rtc_control |= RTC_AIE;
                 CMOS_WRITE(rtc_control, RTC_CONTROL);
                 rtc_intr = CMOS_READ(RTC_INTR_FLAGS);
-                if (rtc_intr)
+                rtc_intr &= (rtc_control & RTC_IRQMASK) | RTC_IRQF;
+                if (is_intr(rtc_intr))
                         rtc_update_irq(&cmos->rtc->class_dev, 1, rtc_intr);
         }
 
@@ -287,7 +302,8 @@ cmos_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
         }
         CMOS_WRITE(rtc_control, RTC_CONTROL);
         rtc_intr = CMOS_READ(RTC_INTR_FLAGS);
-        if (rtc_intr)
+        rtc_intr &= (rtc_control & RTC_IRQMASK) | RTC_IRQF;
+        if (is_intr(rtc_intr))
                 rtc_update_irq(&cmos->rtc->class_dev, 1, rtc_intr);
         spin_unlock_irqrestore(&rtc_lock, flags);
         return 0;
@@ -353,12 +369,10 @@ static irqreturn_t cmos_interrupt(int irq, void *p)
 
         spin_lock(&rtc_lock);
         irqstat = CMOS_READ(RTC_INTR_FLAGS);
+        irqstat &= (CMOS_READ(RTC_CONTROL) & RTC_IRQMASK) | RTC_IRQF;
         spin_unlock(&rtc_lock);
 
-        if (irqstat) {
-                /* NOTE: irqstat may have e.g. RTC_PF set
-                 * even when RTC_PIE is clear...
-                 */
+        if (is_intr(irqstat)) {
                 rtc_update_irq(p, 1, irqstat);
                 return IRQ_HANDLED;
         } else
@@ -525,25 +539,26 @@ static int cmos_suspend(struct device *dev, pm_message_t mesg)
 {
         struct cmos_rtc *cmos = dev_get_drvdata(dev);
         int             do_wake = device_may_wakeup(dev);
-        unsigned char   tmp, irqstat;
+        unsigned char   tmp;
 
         /* only the alarm might be a wakeup event source */
         spin_lock_irq(&rtc_lock);
         cmos->suspend_ctrl = tmp = CMOS_READ(RTC_CONTROL);
         if (tmp & (RTC_PIE|RTC_AIE|RTC_UIE)) {
+                unsigned char   irqstat;
+
                 if (do_wake)
                         tmp &= ~(RTC_PIE|RTC_UIE);
                 else
                         tmp &= ~(RTC_PIE|RTC_AIE|RTC_UIE);
                 CMOS_WRITE(tmp, RTC_CONTROL);
                 irqstat = CMOS_READ(RTC_INTR_FLAGS);
-        } else
-                irqstat = 0;
+                irqstat &= (tmp & RTC_IRQMASK) | RTC_IRQF;
+                if (is_intr(irqstat))
+                        rtc_update_irq(&cmos->rtc->class_dev, 1, irqstat);
+        }
         spin_unlock_irq(&rtc_lock);
 
-        if (irqstat)
-                rtc_update_irq(&cmos->rtc->class_dev, 1, irqstat);
-
         /* ACPI HOOK:  enable ACPI_EVENT_RTC when (tmp & RTC_AIE)
          * ... it'd be best if we could do that under rtc_lock.
          */
@@ -573,9 +588,10 @@ static int cmos_resume(struct device *dev)
                 spin_lock_irq(&rtc_lock);
                 CMOS_WRITE(tmp, RTC_CONTROL);
                 tmp = CMOS_READ(RTC_INTR_FLAGS);
-                spin_unlock_irq(&rtc_lock);
-                if (tmp)
+                tmp &= (cmos->suspend_ctrl & RTC_IRQMASK) | RTC_IRQF;
+                if (is_intr(tmp))
                         rtc_update_irq(&cmos->rtc->class_dev, 1, tmp);
+                spin_unlock_irq(&rtc_lock);
         }
 
         pr_debug("%s: resume, ctrl %02x\n",
@@ -594,7 +610,7 @@ static int cmos_resume(struct device *dev)
 /*----------------------------------------------------------------*/
 
 /* The "CMOS" RTC normally lives on the platform_bus.  On ACPI systems,
- * the device node may alternatively be created as a PNP device.
+ * the device node will always be created as a PNPACPI device.
  */
 
 #ifdef  CONFIG_PNPACPI
@@ -673,7 +689,7 @@ module_exit(cmos_exit);
 /*----------------------------------------------------------------*/
 
 /* Platform setup should have set up an RTC device, when PNPACPI is
- * unavailable ... this is the normal case, common even on PCs.
+ * unavailable ... this could happen even on (older) PCs.
  */
 
 static int __init cmos_platform_probe(struct platform_device *pdev)
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index ab782bb46ac1..e810e4a44ed4 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -65,7 +65,7 @@ static const u8 DASD_DIAG_CMS1[] = { 0xc3, 0xd4, 0xe2, 0xf1 };/* EBCDIC CMS1 */
  * resulting condition code and DIAG return code. */
 static inline int dia250(void *iob, int cmd)
 {
-        register unsigned long reg0 asm ("0") = (unsigned long) iob;
+        register unsigned long reg2 asm ("2") = (unsigned long) iob;
         typedef union {
                 struct dasd_diag_init_io init_io;
                 struct dasd_diag_rw_io rw_io;
@@ -74,15 +74,15 @@ static inline int dia250(void *iob, int cmd)
 
         rc = 3;
         asm volatile(
-                "       diag    0,%2,0x250\n"
+                "       diag    2,%2,0x250\n"
                 "0:     ipm     %0\n"
                 "       srl     %0,28\n"
-                "       or      %0,1\n"
+                "       or      %0,3\n"
                 "1:\n"
                 EX_TABLE(0b,1b)
                 : "+d" (rc), "=m" (*(addr_type *) iob)
-                : "d" (cmd), "d" (reg0), "m" (*(addr_type *) iob)
-                : "1", "cc");
+                : "d" (cmd), "d" (reg2), "m" (*(addr_type *) iob)
+                : "3", "cc");
         return rc;
 }
 
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 6b1caea622ea..aa96e6752592 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -221,6 +221,14 @@ ccw_device_accumulate_irb(struct ccw_device *cdev, struct irb *irb)
 
         cdev_irb = &cdev->private->irb;
 
+        /*
+         * If the clear function had been performed, all formerly pending
+         * status at the subchannel has been cleared and we must not pass
+         * intermediate accumulated status to the device driver.
+         */
+        if (irb->scsw.fctl & SCSW_FCTL_CLEAR_FUNC)
+                memset(&cdev->private->irb, 0, sizeof(struct irb));
+
         /* Copy bits which are valid only for the start function. */
         if (irb->scsw.fctl & SCSW_FCTL_START_FUNC) {
                 /* Copy key. */
@@ -263,7 +271,11 @@ ccw_device_accumulate_irb(struct ccw_device *cdev, struct irb *irb)
                 cdev_irb->scsw.cpa = irb->scsw.cpa;
         /* Accumulate device status, but not the device busy flag. */
         cdev_irb->scsw.dstat &= ~DEV_STAT_BUSY;
-        cdev_irb->scsw.dstat |= irb->scsw.dstat;
+        /* dstat is not always valid. */
+        if (irb->scsw.stctl &
+            (SCSW_STCTL_PRIM_STATUS | SCSW_STCTL_SEC_STATUS
+             | SCSW_STCTL_INTER_STATUS | SCSW_STCTL_ALERT_STATUS))
+                cdev_irb->scsw.dstat |= irb->scsw.dstat;
         /* Accumulate subchannel status. */
         cdev_irb->scsw.cstat |= irb->scsw.cstat;
         /* Copy residual count if it is valid. */
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 181b51772b1b..bf37cdf43fae 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -505,6 +505,9 @@ static int ap_device_remove(struct device *dev)
         spin_lock_bh(&ap_device_lock);
         list_del_init(&ap_dev->list);
         spin_unlock_bh(&ap_device_lock);
+        spin_lock_bh(&ap_dev->lock);
+        atomic_sub(ap_dev->queue_count, &ap_poll_requests);
+        spin_unlock_bh(&ap_dev->lock);
         return 0;
 }
 
@@ -757,10 +760,16 @@ static void ap_scan_bus(struct work_struct *unused)
                                       (void *)(unsigned long)qid,
                                       __ap_scan_bus);
                 rc = ap_query_queue(qid, &queue_depth, &device_type);
-                if (dev && rc) {
-                        put_device(dev);
-                        device_unregister(dev);
-                        continue;
+                if (dev) {
+                        ap_dev = to_ap_dev(dev);
+                        spin_lock_bh(&ap_dev->lock);
+                        if (rc || ap_dev->unregistered) {
+                                spin_unlock_bh(&ap_dev->lock);
+                                put_device(dev);
+                                device_unregister(dev);
+                                continue;
+                        } else
+                                spin_unlock_bh(&ap_dev->lock);
                 }
                 if (dev) {
                         put_device(dev);
@@ -861,6 +870,7 @@ static int ap_poll_read(struct ap_device *ap_dev, unsigned long *flags)
         case AP_RESPONSE_NO_PENDING_REPLY:
                 if (status.queue_empty) {
                         /* The card shouldn't forget requests but who knows. */
+                        atomic_sub(ap_dev->queue_count, &ap_poll_requests);
                         ap_dev->queue_count = 0;
                         list_splice_init(&ap_dev->pendingq, &ap_dev->requestq);
                         ap_dev->requestq_count += ap_dev->pendingq_count;
@@ -994,7 +1004,7 @@ void ap_queue_message(struct ap_device *ap_dev, struct ap_message *ap_msg)
                         ap_dev->unregistered = 1;
         } else {
                 ap_dev->drv->receive(ap_dev, ap_msg, ERR_PTR(-ENODEV));
-                rc = 0;
+                rc = -ENODEV;
         }
         spin_unlock_bh(&ap_dev->lock);
         if (rc == -ENODEV)
@@ -1044,18 +1054,12 @@ static void ap_poll_timeout(unsigned long unused)
  */
 static int __ap_poll_all(struct ap_device *ap_dev, unsigned long *flags)
 {
-        int rc;
-
         spin_lock(&ap_dev->lock);
         if (!ap_dev->unregistered) {
-                rc = ap_poll_queue(ap_dev, flags);
-                if (rc)
+                if (ap_poll_queue(ap_dev, flags))
                         ap_dev->unregistered = 1;
-        } else
-                rc = 0;
+        }
         spin_unlock(&ap_dev->lock);
-        if (rc)
-                device_unregister(&ap_dev->device);
         return 0;
 }
 
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index eec28c142a59..5041c9dfbe3b 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -249,7 +249,7 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
 #ifdef CONFIG_PCI
                 struct pci_dev *pdev;
                 struct pcidev_cookie *pcp;
-                pdev = pci_find_slot (((int *) op->oprom_array)[0],
+                pdev = pci_get_bus_and_slot (((int *) op->oprom_array)[0],
                                       ((int *) op->oprom_array)[1]);
 
                 pcp = pdev->sysdata;
@@ -260,6 +260,7 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
                         op->oprom_size = sizeof(int);
                         err = copyout(argp, op, bufsize + sizeof(int));
                 }
+                pci_dev_put(pdev);
 #endif
         }
 
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 8bfb67ccdcd4..c3135e2fbd5a 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -259,11 +259,10 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, void __user *argp)
                 if (copy_from_user(&inout, argp, sizeof(inout)))
                         return -EFAULT;
 
-                buffer = kmalloc(inout.len, GFP_KERNEL);
+                buffer = kzalloc(inout.len, GFP_KERNEL);
                 if (buffer == NULL)
                         return -ENOMEM;
 
-                memset(buffer,0,inout.len);
                 vfc_lock_device(dev);
                 inout.ret=
                         vfc_i2c_recvbuf(dev,inout.addr & 0xff
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index bf5d63e1beee..656bdb1352d8 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1864,10 +1864,17 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
 /* This function will handle the request sense scsi command */
 static int tw_scsiop_request_sense(TW_Device_Extension *tw_dev, int request_id)
 {
+        char request_buffer[18];
+
         dprintk(KERN_NOTICE "3w-xxxx: tw_scsiop_request_sense()\n");
 
-        /* For now we just zero the request buffer */
-        memset(tw_dev->srb[request_id]->request_buffer, 0, tw_dev->srb[request_id]->request_bufflen);
+        memset(request_buffer, 0, sizeof(request_buffer));
+        request_buffer[0] = 0x70; /* Immediate fixed format */
+        request_buffer[7] = 10; /* minimum size per SPC: 18 bytes */
+        /* leave all other fields zero, giving effectively NO_SENSE return */
+        tw_transfer_internal(tw_dev, request_id, request_buffer,
+                             sizeof(request_buffer));
+
         tw_dev->state[request_id] = TW_S_COMPLETED;
         tw_state_request_finish(tw_dev, request_id);
 
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 8c81cec85298..60446b88f721 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -3091,6 +3091,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
             cmdp->u.raw64.direction  = 
                 gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
             memcpy(cmdp->u.raw64.cmd,scp->cmnd,16);
+            cmdp->u.raw64.sg_ranz    = 0;
         } else {
             cmdp->u.raw.reserved   = 0;
             cmdp->u.raw.mdisc_time = 0;
@@ -3107,6 +3108,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
             cmdp->u.raw.direction  = 
                 gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
             memcpy(cmdp->u.raw.cmd,scp->cmnd,12);
+            cmdp->u.raw.sg_ranz    = 0;
         }
 
         if (scp->use_sg) {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 9d014e5a81c4..057fd7e0e379 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1817,10 +1817,9 @@ static pci_ers_result_t lpfc_io_error_detected(struct pci_dev *pdev,
         struct lpfc_sli *psli = &phba->sli;
         struct lpfc_sli_ring  *pring;
 
-        if (state == pci_channel_io_perm_failure) {
-                lpfc_pci_remove_one(pdev);
+        if (state == pci_channel_io_perm_failure)
                 return PCI_ERS_RESULT_DISCONNECT;
-        }
+
         pci_disable_device(pdev);
         /*
          * There may be I/Os dropped by the firmware.
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 9b827ceec501..9f10689905a8 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -1281,7 +1281,7 @@ static struct scsi_cmnd *qlogicpti_intr_handler(struct qlogicpti *qpti)
                                       (struct scatterlist *)Cmnd->request_buffer,
                                       Cmnd->use_sg,
                                       Cmnd->sc_data_direction);
-                } else {
+                } else if (Cmnd->request_bufflen) {
                         sbus_unmap_single(qpti->sdev,
                                           (__u32)((unsigned long)Cmnd->SCp.ptr),
                                           Cmnd->request_bufflen,
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index b8edcf5b5451..918bb6019540 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -716,7 +716,7 @@ static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd,
          */
         if (copy_sense) {
                 if (!SCSI_SENSE_VALID(scmd)) {
-                        memcpy(scmd->sense_buffer, scmd->request_buffer,
+                        memcpy(scmd->sense_buffer, page_address(sgl.page),
                                sizeof(scmd->sense_buffer));
                 }
                 __free_page(sgl.page);
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index c129a0e8e807..90621c3312bc 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1310,7 +1310,8 @@ static unsigned int check_modem_status(struct uart_8250_port *up)
 {
         unsigned int status = serial_in(up, UART_MSR);
 
-        if (status & UART_MSR_ANY_DELTA && up->ier & UART_IER_MSI) {
+        if (status & UART_MSR_ANY_DELTA && up->ier & UART_IER_MSI &&
+            up->port.info != NULL) {
                 if (status & UART_MSR_TERI)
                         up->port.icount.rng++;
                 if (status & UART_MSR_DDSR)
@@ -1333,8 +1334,9 @@ static inline void
 serial8250_handle_port(struct uart_8250_port *up)
 {
         unsigned int status;
+        unsigned long flags;
 
-        spin_lock(&up->port.lock);
+        spin_lock_irqsave(&up->port.lock, flags);
 
         status = serial_inp(up, UART_LSR);
 
@@ -1346,7 +1348,7 @@ serial8250_handle_port(struct uart_8250_port *up)
         if (status & UART_LSR_THRE)
                 transmit_chars(up);
 
-        spin_unlock(&up->port.lock);
+        spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
 /*
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index 41431d0d5512..246c5572667b 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -164,7 +164,7 @@ static void free_port_memory(struct icom_port *icom_port)
         }
 }
 
-static int __init get_port_memory(struct icom_port *icom_port)
+static int __devinit get_port_memory(struct icom_port *icom_port)
 {
         int index;
         unsigned long stgAddr;
@@ -1380,7 +1380,7 @@ static void icom_port_active(struct icom_port *icom_port, struct icom_adapter *i
                             0x8024 + 2 - 2 * (icom_port->port - 2);
         }
 }
-static int __init icom_load_ports(struct icom_adapter *icom_adapter)
+static int __devinit icom_load_ports(struct icom_adapter *icom_adapter)
 {
         struct icom_port *icom_port;
         int port_num;
@@ -1473,7 +1473,7 @@ static void icom_remove_adapter(struct icom_adapter *icom_adapter)
                 }
         }
 
-        free_irq(icom_adapter->irq_number, (void *) icom_adapter);
+        free_irq(icom_adapter->pci_dev->irq, (void *) icom_adapter);
         iounmap(icom_adapter->base_addr);
         icom_free_adapter(icom_adapter);
         pci_release_regions(icom_adapter->pci_dev);
@@ -1539,7 +1539,6 @@ static int __devinit icom_probe(struct pci_dev *dev,
         }
 
          icom_adapter->base_addr_pci = pci_resource_start(dev, 0);
-         icom_adapter->irq_number = dev->irq;
          icom_adapter->pci_dev = dev;
          icom_adapter->version = ent->driver_data;
          icom_adapter->subsystem_id = ent->subdevice;
@@ -1570,7 +1569,7 @@ static int __devinit icom_probe(struct pci_dev *dev,
                 icom_port = &icom_adapter->port_info[index];
 
                 if (icom_port->status == ICOM_PORT_ACTIVE) {
-                        icom_port->uart_port.irq = icom_port->adapter->irq_number;
+                        icom_port->uart_port.irq = icom_port->adapter->pci_dev->irq;
                         icom_port->uart_port.type = PORT_ICOM;
                         icom_port->uart_port.iotype = UPIO_MEM;
                         icom_port->uart_port.membase =
diff --git a/drivers/serial/icom.h b/drivers/serial/icom.h
index 798f1ef23712..e8578d8cd35e 100644
--- a/drivers/serial/icom.h
+++ b/drivers/serial/icom.h
@@ -258,7 +258,6 @@ struct icom_port {
 struct icom_adapter {
         void __iomem * base_addr;
         unsigned long base_addr_pci;
-        unsigned char irq_number;
         struct pci_dev *pci_dev;
         struct icom_port port_info[4];
         int index;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 2328128728be..6657331eed93 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -189,8 +189,8 @@ static DECLARE_MUTEX(board_lock);
  * this is exported so that for example a USB or parport based adapter
  * driver could add devices (which it would learn about out-of-band).
  */
-struct spi_device *__init_or_module
-spi_new_device(struct spi_master *master, struct spi_board_info *chip)
+struct spi_device *spi_new_device(struct spi_master *master,
+                                  struct spi_board_info *chip)
 {
         struct spi_device       *proxy;
         struct device           *dev = master->cdev.dev;
@@ -352,8 +352,7 @@ static struct class spi_master_class = {
  * the master's methods before calling spi_register_master(); and (after errors
  * adding the device) calling spi_master_put() to prevent a memory leak.
  */
-struct spi_master * __init_or_module
-spi_alloc_master(struct device *dev, unsigned size)
+struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
 {
         struct spi_master       *master;
 
@@ -392,8 +391,7 @@ EXPORT_SYMBOL_GPL(spi_alloc_master);
  * After a successful return, the caller is responsible for calling
  * spi_unregister_master().
  */
-int __init_or_module
-spi_register_master(struct spi_master *master)
+int spi_register_master(struct spi_master *master)
 {
         static atomic_t         dyn_bus_id = ATOMIC_INIT((1<<16) - 1);
         struct device           *dev = master->cdev.dev;
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 220abce63e4a..b10211c420ef 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -77,7 +77,7 @@ static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
 
         switch (value) {
         case BITBANG_CS_INACTIVE:
-                hw->pdata->set_cs(hw->pdata, spi->chip_select, cspol^1);
+                hw->set_cs(hw->pdata, spi->chip_select, cspol^1);
                 break;
 
         case BITBANG_CS_ACTIVE:
@@ -98,7 +98,7 @@ static void s3c24xx_spi_chipsel(struct spi_device *spi, int value)
                 /* write new configration */
 
                 writeb(spcon, hw->regs + S3C2410_SPCON);
-                hw->pdata->set_cs(hw->pdata, spi->chip_select, cspol);
+                hw->set_cs(hw->pdata, spi->chip_select, cspol);
 
                 break;
         }
diff --git a/drivers/tc/zs.c b/drivers/tc/zs.c
index 3d72aa5cfc71..3524e3fc08b9 100644
--- a/drivers/tc/zs.c
+++ b/drivers/tc/zs.c
@@ -70,7 +70,6 @@
 #include <asm/dec/machtype.h>
 #include <asm/dec/serial.h>
 #include <asm/dec/system.h>
-#include <asm/dec/tc.h>
 
 #ifdef CONFIG_KGDB
 #include <asm/kgdb.h>
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 0e5c646cb4f6..f08ec85a6d64 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -30,7 +30,8 @@
 static const struct usb_device_id usb_quirk_list[] = {
         /* HP 5300/5370C scanner */
         { USB_DEVICE(0x03f0, 0x0701), .driver_info = USB_QUIRK_STRING_FETCH_255 },
-
+        /* Seiko Epson Corp - Perfection 1670 */
+        { USB_DEVICE(0x04b8, 0x011f), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
         /* Elsa MicroLink 56k (V.250) */
         { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_NO_AUTOSUSPEND },
 
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 8f9a2b615422..b394e63894d2 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -296,6 +296,15 @@ omap_free_request(struct usb_ep *ep, struct usb_request *_req)
 
 /*-------------------------------------------------------------------------*/
 
+/*
+ * dma-coherent memory allocation (for dma-capable endpoints)
+ *
+ * NOTE: the dma_*_coherent() API calls suck.  Most implementations are
+ * (a) page-oriented, so small buffers lose big; and (b) asymmetric with
+ * respect to calls with irqs disabled:  alloc is safe, free is not.
+ * We currently work around (b), but not (a).
+ */
+
 static void *
 omap_alloc_buffer(
         struct usb_ep   *_ep,
@@ -307,6 +316,9 @@ omap_alloc_buffer(
         void            *retval;
         struct omap_ep  *ep;
 
+        if (!_ep)
+                return NULL;
+
         ep = container_of(_ep, struct omap_ep, ep);
         if (use_dma && ep->has_dma) {
                 static int      warned;
@@ -326,6 +338,35 @@ omap_alloc_buffer(
         return retval;
 }
 
+static DEFINE_SPINLOCK(buflock);
+static LIST_HEAD(buffers);
+
+struct free_record {
+        struct list_head        list;
+        struct device           *dev;
+        unsigned                bytes;
+        dma_addr_t              dma;
+};
+
+static void do_free(unsigned long ignored)
+{
+        spin_lock_irq(&buflock);
+        while (!list_empty(&buffers)) {
+                struct free_record      *buf;
+
+                buf = list_entry(buffers.next, struct free_record, list);
+                list_del(&buf->list);
+                spin_unlock_irq(&buflock);
+
+                dma_free_coherent(buf->dev, buf->bytes, buf, buf->dma);
+
+                spin_lock_irq(&buflock);
+        }
+        spin_unlock_irq(&buflock);
+}
+
+static DECLARE_TASKLET(deferred_free, do_free, 0);
+
 static void omap_free_buffer(
         struct usb_ep   *_ep,
         void            *buf,
@@ -333,13 +374,29 @@ static void omap_free_buffer(
         unsigned        bytes
 )
 {
-        struct omap_ep  *ep;
+        if (!_ep) {
+                WARN_ON(1);
+                return;
+        }
 
-        ep = container_of(_ep, struct omap_ep, ep);
-        if (use_dma && _ep && ep->has_dma)
-                dma_free_coherent(ep->udc->gadget.dev.parent, bytes, buf, dma);
-        else
-                kfree (buf);
+        /* free memory into the right allocator */
+        if (dma != DMA_ADDR_INVALID) {
+                struct omap_ep          *ep;
+                struct free_record      *rec = buf;
+                unsigned long           flags;
+
+                ep = container_of(_ep, struct omap_ep, ep);
+
+                rec->dev = ep->udc->gadget.dev.parent;
+                rec->bytes = bytes;
+                rec->dma = dma;
+
+                spin_lock_irqsave(&buflock, flags);
+                list_add_tail(&rec->list, &buffers);
+                tasklet_schedule(&deferred_free);
+                spin_unlock_irqrestore(&buflock, flags);
+        } else
+                kfree(buf);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1691,12 +1748,38 @@ ep0out_status_stage:
                         udc->ep0_pending = 0;
                         break;
                 case USB_REQ_GET_STATUS:
+                        /* USB_ENDPOINT_HALT status? */
+                        if (u.r.bRequestType != (USB_DIR_IN|USB_RECIP_ENDPOINT))
+                                goto intf_status;
+
+                        /* ep0 never stalls */
+                        if (!(w_index & 0xf))
+                                goto zero_status;
+
+                        /* only active endpoints count */
+                        ep = &udc->ep[w_index & 0xf];
+                        if (w_index & USB_DIR_IN)
+                                ep += 16;
+                        if (!ep->desc)
+                                goto do_stall;
+
+                        /* iso never stalls */
+                        if (ep->bmAttributes == USB_ENDPOINT_XFER_ISOC)
+                                goto zero_status;
+
+                        /* FIXME don't assume non-halted endpoints!! */
+                        ERR("%s status, can't report\n", ep->ep.name);
+                        goto do_stall;
+
+intf_status:
                         /* return interface status.  if we were pedantic,
                          * we'd detect non-existent interfaces, and stall.
                          */
                         if (u.r.bRequestType
                                         != (USB_DIR_IN|USB_RECIP_INTERFACE))
                                 goto delegate;
+
+zero_status:
                         /* return two zero bytes */
                         UDC_EP_NUM_REG = UDC_EP_SEL|UDC_EP_DIR;
                         UDC_DATA_REG = 0;
@@ -2068,7 +2151,7 @@ static irqreturn_t omap_udc_iso_irq(int irq, void *_dev)
 
 /*-------------------------------------------------------------------------*/
 
-static inline int machine_needs_vbus_session(void)
+static inline int machine_without_vbus_sense(void)
 {
         return (machine_is_omap_innovator()
                 || machine_is_omap_osk()
@@ -2156,7 +2239,7 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
         /* boards that don't have VBUS sensing can't autogate 48MHz;
          * can't enter deep sleep while a gadget driver is active.
          */
-        if (machine_needs_vbus_session())
+        if (machine_without_vbus_sense())
                 omap_vbus_session(&udc->gadget, 1);
 
 done:
@@ -2179,7 +2262,7 @@ int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
         if (udc->dc_clk != NULL)
                 omap_udc_enable_clock(1);
 
-        if (machine_needs_vbus_session())
+        if (machine_without_vbus_sense())
                 omap_vbus_session(&udc->gadget, 0);
 
         if (udc->transceiver)
@@ -2822,7 +2905,7 @@ static int __init omap_udc_probe(struct platform_device *pdev)
                 hmc = HMC_1510;
                 type = "(unknown)";
 
-                if (machine_is_omap_innovator() || machine_is_sx1()) {
+                if (machine_without_vbus_sense()) {
                         /* just set up software VBUS detect, and then
                          * later rig it so we always report VBUS.
                          * FIXME without really sensing VBUS, we can't
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index a74056488234..c7458f7e56cc 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -669,6 +669,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                          */
                         ehci->reset_done [i] = jiffies + msecs_to_jiffies (20);
                         ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
+                        mod_timer(&hcd->rh_timer, ehci->reset_done[i]);
                 }
         }
 
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index 8d24d3dc0a61..1497371583b9 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -145,7 +145,8 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
         return out - buf;
 }
 
-static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
+static int uhci_show_qh(struct uhci_hcd *uhci,
+                struct uhci_qh *qh, char *buf, int len, int space)
 {
         char *out = buf;
         int i, nurbs;
@@ -190,6 +191,9 @@ static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
 
         if (list_empty(&qh->queue)) {
                 out += sprintf(out, "%*s  queue is empty\n", space, "");
+                if (qh == uhci->skel_async_qh)
+                        out += uhci_show_td(uhci->term_td, out,
+                                        len - (out - buf), 0);
         } else {
                 struct urb_priv *urbp = list_entry(qh->queue.next,
                                 struct urb_priv, node);
@@ -343,6 +347,7 @@ static int uhci_sprint_schedule(struct uhci_hcd *uhci, char *buf, int len)
         struct list_head *tmp, *head;
         int nframes, nerrs;
         __le32 link;
+        __le32 fsbr_link;
 
         static const char * const qh_names[] = {
                 "unlink", "iso", "int128", "int64", "int32", "int16",
@@ -424,21 +429,22 @@ check_link:
 
         out += sprintf(out, "Skeleton QHs\n");
 
+        fsbr_link = 0;
         for (i = 0; i < UHCI_NUM_SKELQH; ++i) {
                 int cnt = 0;
-                __le32 fsbr_link = 0;
 
                 qh = uhci->skelqh[i];
                 out += sprintf(out, "- skel_%s_qh\n", qh_names[i]); \
-                out += uhci_show_qh(qh, out, len - (out - buf), 4);
+                out += uhci_show_qh(uhci, qh, out, len - (out - buf), 4);
 
                 /* Last QH is the Terminating QH, it's different */
                 if (i == SKEL_TERM) {
                         if (qh_element(qh) != LINK_TO_TD(uhci->term_td))
                                 out += sprintf(out, "    skel_term_qh element is not set to term_td!\n");
-                        if (link == LINK_TO_QH(uhci->skel_term_qh))
-                                goto check_qh_link;
-                        continue;
+                        link = fsbr_link;
+                        if (!link)
+                                link = LINK_TO_QH(uhci->skel_term_qh);
+                        goto check_qh_link;
                 }
 
                 head = &qh->node;
@@ -448,7 +454,7 @@ check_link:
                         qh = list_entry(tmp, struct uhci_qh, node);
                         tmp = tmp->next;
                         if (++cnt <= 10)
-                                out += uhci_show_qh(qh, out,
+                                out += uhci_show_qh(uhci, qh, out,
                                                 len - (out - buf), 4);
                         if (!fsbr_link && qh->skel >= SKEL_FSBR)
                                 fsbr_link = LINK_TO_QH(qh);
@@ -463,8 +469,6 @@ check_link:
                         link = LINK_TO_QH(uhci->skel_async_qh);
                 else if (!uhci->fsbr_is_on)
                         ;
-                else if (fsbr_link)
-                        link = fsbr_link;
                 else
                         link = LINK_TO_QH(uhci->skel_term_qh);
 check_qh_link:
@@ -573,8 +577,8 @@ static const struct file_operations uhci_debug_operations = {
 static inline void lprintk(char *buf)
 {}
 
-static inline int uhci_show_qh(struct uhci_qh *qh, char *buf,
-                int len, int space)
+static inline int uhci_show_qh(struct uhci_hcd *uhci,
+                struct uhci_qh *qh, char *buf, int len, int space)
 {
         return 0;
 }
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 44da4334f1d6..d22da26ff167 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -632,7 +632,8 @@ static int uhci_start(struct usb_hcd *hcd)
          */
         for (i = SKEL_ISO + 1; i < SKEL_ASYNC; ++i)
                 uhci->skelqh[i]->link = LINK_TO_QH(uhci->skel_async_qh);
-        uhci->skel_async_qh->link = uhci->skel_term_qh->link = UHCI_PTR_TERM;
+        uhci->skel_async_qh->link = UHCI_PTR_TERM;
+        uhci->skel_term_qh->link = LINK_TO_QH(uhci->skel_term_qh);
 
         /* This dummy TD is to work around a bug in Intel PIIX controllers */
         uhci_fill_td(uhci->term_td, 0, uhci_explen(0) |
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index f4ebdb3e488f..19a0cc02b9a2 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -45,43 +45,27 @@ static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
  */
 static void uhci_fsbr_on(struct uhci_hcd *uhci)
 {
-        struct uhci_qh *fsbr_qh, *lqh, *tqh;
+        struct uhci_qh *lqh;
 
+        /* The terminating skeleton QH always points back to the first
+         * FSBR QH.  Make the last async QH point to the terminating
+         * skeleton QH. */
         uhci->fsbr_is_on = 1;
         lqh = list_entry(uhci->skel_async_qh->node.prev,
                         struct uhci_qh, node);
-
-        /* Find the first FSBR QH.  Linear search through the list is
-         * acceptable because normally FSBR gets turned on as soon as
-         * one QH needs it. */
-        fsbr_qh = NULL;
-        list_for_each_entry_reverse(tqh, &uhci->skel_async_qh->node, node) {
-                if (tqh->skel < SKEL_FSBR)
-                        break;
-                fsbr_qh = tqh;
-        }
-
-        /* No FSBR QH means we must insert the terminating skeleton QH */
-        if (!fsbr_qh) {
-                uhci->skel_term_qh->link = LINK_TO_QH(uhci->skel_term_qh);
-                wmb();
-                lqh->link = uhci->skel_term_qh->link;
-
-        /* Otherwise loop the last QH to the first FSBR QH */
-        } else
-                lqh->link = LINK_TO_QH(fsbr_qh);
+        lqh->link = LINK_TO_QH(uhci->skel_term_qh);
 }
 
 static void uhci_fsbr_off(struct uhci_hcd *uhci)
 {
         struct uhci_qh *lqh;
 
+        /* Remove the link from the last async QH to the terminating
+         * skeleton QH. */
         uhci->fsbr_is_on = 0;
         lqh = list_entry(uhci->skel_async_qh->node.prev,
                         struct uhci_qh, node);
-
-        /* End the async list normally and unlink the terminating QH */
-        lqh->link = uhci->skel_term_qh->link = UHCI_PTR_TERM;
+        lqh->link = UHCI_PTR_TERM;
 }
 
 static void uhci_add_fsbr(struct uhci_hcd *uhci, struct urb *urb)
@@ -464,9 +448,8 @@ static void link_interrupt(struct uhci_hcd *uhci, struct uhci_qh *qh)
  */
 static void link_async(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct uhci_qh *pqh, *lqh;
+        struct uhci_qh *pqh;
         __le32 link_to_new_qh;
-        __le32 *extra_link = &link_to_new_qh;
 
         /* Find the predecessor QH for our new one and insert it in the list.
          * The list of QHs is expected to be short, so linear search won't
@@ -476,31 +459,17 @@ static void link_async(struct uhci_hcd *uhci, struct uhci_qh *qh)
                         break;
         }
         list_add(&qh->node, &pqh->node);
-        qh->link = pqh->link;
-
-        link_to_new_qh = LINK_TO_QH(qh);
-
-        /* If this is now the first FSBR QH, take special action */
-        if (uhci->fsbr_is_on && pqh->skel < SKEL_FSBR &&
-                        qh->skel >= SKEL_FSBR) {
-                lqh = list_entry(uhci->skel_async_qh->node.prev,
-                                struct uhci_qh, node);
-
-                /* If the new QH is also the last one, we must unlink
-                 * the terminating skeleton QH and make the new QH point
-                 * back to itself. */
-                if (qh == lqh) {
-                        qh->link = link_to_new_qh;
-                        extra_link = &uhci->skel_term_qh->link;
-
-                /* Otherwise the last QH must point to the new QH */
-                } else
-                        extra_link = &lqh->link;
-        }
 
         /* Link it into the schedule */
+        qh->link = pqh->link;
         wmb();
-        *extra_link = pqh->link = link_to_new_qh;
+        link_to_new_qh = LINK_TO_QH(qh);
+        pqh->link = link_to_new_qh;
+
+        /* If this is now the first FSBR QH, link the terminating skeleton
+         * QH to it. */
+        if (pqh->skel < SKEL_FSBR && qh->skel >= SKEL_FSBR)
+                uhci->skel_term_qh->link = link_to_new_qh;
 }
 
 /*
@@ -561,31 +530,16 @@ static void unlink_interrupt(struct uhci_hcd *uhci, struct uhci_qh *qh)
  */
 static void unlink_async(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct uhci_qh *pqh, *lqh;
+        struct uhci_qh *pqh;
         __le32 link_to_next_qh = qh->link;
 
         pqh = list_entry(qh->node.prev, struct uhci_qh, node);
-
-        /* If this is the first FSBQ QH, take special action */
-        if (uhci->fsbr_is_on && pqh->skel < SKEL_FSBR &&
-                        qh->skel >= SKEL_FSBR) {
-                lqh = list_entry(uhci->skel_async_qh->node.prev,
-                                struct uhci_qh, node);
-
-                /* If this QH is also the last one, we must link in
-                 * the terminating skeleton QH. */
-                if (qh == lqh) {
-                        link_to_next_qh = LINK_TO_QH(uhci->skel_term_qh);
-                        uhci->skel_term_qh->link = link_to_next_qh;
-                        wmb();
-                        qh->link = link_to_next_qh;
-
-                /* Otherwise the last QH must point to the new first FSBR QH */
-                } else
-                        lqh->link = link_to_next_qh;
-        }
-
         pqh->link = link_to_next_qh;
+
+        /* If this was the old first FSBR QH, link the terminating skeleton
+         * QH to the next (new first FSBR) QH. */
+        if (pqh->skel < SKEL_FSBR && qh->skel >= SKEL_FSBR)
+                uhci->skel_term_qh->link = link_to_next_qh;
         mb();
 }
 
@@ -1217,7 +1171,7 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
 
                                 if (debug > 1 && errbuf) {
                                         /* Print the chain for debugging */
-                                        uhci_show_qh(urbp->qh, errbuf,
+                                        uhci_show_qh(uhci, urbp->qh, errbuf,
                                                         ERRBUF_LEN, 0);
                                         lprintk(errbuf);
                                 }
diff --git a/drivers/usb/net/pegasus.c b/drivers/usb/net/pegasus.c
index d48c024cff59..6d12961cf9f9 100644
--- a/drivers/usb/net/pegasus.c
+++ b/drivers/usb/net/pegasus.c
@@ -316,6 +316,7 @@ static int update_eth_regs_async(pegasus_t * pegasus)
         return ret;
 }
 
+/* Returns 0 on success, error on failure */
 static int read_mii_word(pegasus_t * pegasus, __u8 phy, __u8 indx, __u16 * regd)
 {
         int i;
@@ -847,10 +848,16 @@ static void intr_callback(struct urb *urb)
                  * d[0].NO_CARRIER kicks in only with failed TX.
                  * ... so monitoring with MII may be safest.
                  */
-                if (d[0] & NO_CARRIER)
-                        netif_carrier_off(net); 
-                else
-                        netif_carrier_on(net);
+                if (pegasus->features & TRUST_LINK_STATUS) {
+                        if (d[5] & LINK_STATUS)
+                                netif_carrier_on(net);
+                        else
+                                netif_carrier_off(net);
+                } else {
+                        /* Never set carrier _on_ based on ! NO_CARRIER */
+                        if (d[0] & NO_CARRIER)
+                                netif_carrier_off(net); 
+                }
 
                 /* bytes 3-4 == rx_lostpkt, reg 2E/2F */
                 pegasus->stats.rx_missed_errors += ((d[3] & 0x7f) << 8) | d[4];
@@ -950,7 +957,7 @@ static void set_carrier(struct net_device *net)
         pegasus_t *pegasus = netdev_priv(net);
         u16 tmp;
 
-        if (!read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
+        if (read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
                 return;
 
         if (tmp & BMSR_LSTATUS)
diff --git a/drivers/usb/net/pegasus.h b/drivers/usb/net/pegasus.h
index c7467823cd1c..c7aadb413e8c 100644
--- a/drivers/usb/net/pegasus.h
+++ b/drivers/usb/net/pegasus.h
@@ -11,6 +11,7 @@
 
 #define PEGASUS_II              0x80000000
 #define HAS_HOME_PNA            0x40000000
+#define TRUST_LINK_STATUS       0x20000000
 
 #define PEGASUS_MTU             1536
 #define RX_SKBS                 4
@@ -203,7 +204,7 @@ PEGASUS_DEV( "AEI USB Fast Ethernet Adapter", VENDOR_AEILAB, 0x1701,
 PEGASUS_DEV( "Allied Telesyn Int. AT-USB100", VENDOR_ALLIEDTEL, 0xb100,
                 DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Belkin F5D5050 USB Ethernet", VENDOR_BELKIN, 0x0121,
-                DEFAULT_GPIO_RESET | PEGASUS_II )
+                DEFAULT_GPIO_RESET | PEGASUS_II | TRUST_LINK_STATUS )
 PEGASUS_DEV( "Billionton USB-100", VENDOR_BILLIONTON, 0x0986,
                 DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "Billionton USBLP-100", VENDOR_BILLIONTON, 0x0987,
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 7538c64a5097..39a498362594 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -18,7 +18,6 @@
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
-        { USB_DEVICE(0x1410, 0x1100) }, /* ExpressCard34 Qualcomm 3G CDMA */
         { USB_DEVICE(0x413c, 0x8115) }, /* Dell Wireless HSDPA 5500 */
         { },
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1633a0fd48e8..8ff9d54b21e6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -879,6 +879,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                 break;
         case FT232BM: /* FT232BM chip */
         case FT2232C: /* FT2232C chip */
+        case FT232RL:
                 if (baud <= 3000000) {
                         div_value = ftdi_232bm_baud_to_divisor(baud);
                 } else {
@@ -1021,9 +1022,12 @@ static void ftdi_determine_type(struct usb_serial_port *port)
                 /* (It might be a BM because of the iSerialNumber bug,
                  * but it will still work as an AM device.) */
                 priv->chip_type = FT8U232AM;
-        } else {
+        } else if (version < 0x600) {
                 /* Assume its an FT232BM (or FT245BM) */
                 priv->chip_type = FT232BM;
+        } else {
+                /* Assume its an FT232R  */
+                priv->chip_type = FT232RL;
         }
         info("Detected %s", ftdi_chip_name[priv->chip_type]);
 }
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 53baeec8f265..4f8282ad7720 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -20,13 +20,14 @@
 #include <linux/usb/serial.h>
 #include <asm/uaccess.h>
 
-static int generic_probe(struct usb_interface *interface,
-                         const struct usb_device_id *id);
-
 
 static int debug;
 
 #ifdef CONFIG_USB_SERIAL_GENERIC
+
+static int generic_probe(struct usb_interface *interface,
+                         const struct usb_device_id *id);
+
 static __u16 vendor  = 0x05f9;
 static __u16 product = 0xffff;
 
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index e13637dfb642..4a9d0d5c7282 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -327,6 +327,13 @@ UNUSUAL_DEV(  0x04b0, 0x040d, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY),
 
+/* Reported by Emil Larsson <emil@swip.net> */
+UNUSUAL_DEV(  0x04b0, 0x0411, 0x0100, 0x0100,
+                "NIKON",
+                "NIKON DSC D80",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
+
 /* BENQ DC5330
  * Reported by Manuel Fombuena <mfombuena@ya.com> and
  * Frank Copeland <fjc@thingy.apana.org.au> */
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index e4f0dd00ae85..8372ace4a0d9 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -139,7 +139,7 @@ config FB_TILEBLITTING
          This is particularly important to one driver, matroxfb.  If
          unsure, say N.
 
-comment "Frambuffer hardware drivers"
+comment "Frame buffer hardware drivers"
         depends on FB
 
 config FB_CIRRUS
diff --git a/drivers/video/cg3.c b/drivers/video/cg3.c
index ada6f7e3a891..767c850f8eb7 100644
--- a/drivers/video/cg3.c
+++ b/drivers/video/cg3.c
@@ -186,8 +186,7 @@ static int cg3_setcolreg(unsigned regno,
  *      @blank_mode: the blank mode we want.
  *      @info: frame buffer structure that represents a single frame buffer
  */
-static int
-cg3_blank(int blank, struct fb_info *info)
+static int cg3_blank(int blank, struct fb_info *info)
 {
         struct cg3_par *par = (struct cg3_par *) info->par;
         struct cg3_regs __iomem *regs = par->regs;
@@ -251,8 +250,8 @@ static int cg3_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg)
  *  Initialisation
  */
 
-static void
-cg3_init_fix(struct fb_info *info, int linebytes, struct device_node *dp)
+static void __devinit cg3_init_fix(struct fb_info *info, int linebytes,
+                                   struct device_node *dp)
 {
         strlcpy(info->fix.id, dp->name, sizeof(info->fix.id));
 
@@ -264,8 +263,8 @@ cg3_init_fix(struct fb_info *info, int linebytes, struct device_node *dp)
         info->fix.accel = FB_ACCEL_SUN_CGTHREE;
 }
 
-static void cg3_rdi_maybe_fixup_var(struct fb_var_screeninfo *var,
-                                    struct device_node *dp)
+static void __devinit cg3_rdi_maybe_fixup_var(struct fb_var_screeninfo *var,
+                                              struct device_node *dp)
 {
         char *params;
         char *p;
@@ -287,36 +286,36 @@ static void cg3_rdi_maybe_fixup_var(struct fb_var_screeninfo *var,
         }
 }
 
-static u8 cg3regvals_66hz[] __initdata = {      /* 1152 x 900, 66 Hz */
+static u8 cg3regvals_66hz[] __devinitdata = {   /* 1152 x 900, 66 Hz */
         0x14, 0xbb,     0x15, 0x2b,     0x16, 0x04,     0x17, 0x14,
         0x18, 0xae,     0x19, 0x03,     0x1a, 0xa8,     0x1b, 0x24,
         0x1c, 0x01,     0x1d, 0x05,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x20,     0
 };
 
-static u8 cg3regvals_76hz[] __initdata = {      /* 1152 x 900, 76 Hz */
+static u8 cg3regvals_76hz[] __devinitdata = {   /* 1152 x 900, 76 Hz */
         0x14, 0xb7,     0x15, 0x27,     0x16, 0x03,     0x17, 0x0f,
         0x18, 0xae,     0x19, 0x03,     0x1a, 0xae,     0x1b, 0x2a,
         0x1c, 0x01,     0x1d, 0x09,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x24,     0
 };
 
-static u8 cg3regvals_rdi[] __initdata = {       /* 640 x 480, cgRDI */
+static u8 cg3regvals_rdi[] __devinitdata = {    /* 640 x 480, cgRDI */
         0x14, 0x70,     0x15, 0x20,     0x16, 0x08,     0x17, 0x10,
         0x18, 0x06,     0x19, 0x02,     0x1a, 0x31,     0x1b, 0x51,
         0x1c, 0x06,     0x1d, 0x0c,     0x1e, 0xff,     0x1f, 0x01,
         0x10, 0x22,     0
 };
 
-static u8 *cg3_regvals[] __initdata = {
+static u8 *cg3_regvals[] __devinitdata = {
         cg3regvals_66hz, cg3regvals_76hz, cg3regvals_rdi
 };
 
-static u_char cg3_dacvals[] __initdata = {
+static u_char cg3_dacvals[] __devinitdata = {
         4, 0xff,        5, 0x00,        6, 0x70,        7, 0x00,        0
 };
 
-static void cg3_do_default_mode(struct cg3_par *par)
+static void __devinit cg3_do_default_mode(struct cg3_par *par)
 {
         enum cg3_type type;
         u8 *p;
@@ -433,7 +432,8 @@ static int __devinit cg3_init_one(struct of_device *op)
         return 0;
 }
 
-static int __devinit cg3_probe(struct of_device *dev, const struct of_device_id *match)
+static int __devinit cg3_probe(struct of_device *dev,
+                               const struct of_device_id *match)
 {
         struct of_device *op = to_of_device(&dev->dev);
 
diff --git a/drivers/video/ffb.c b/drivers/video/ffb.c
index 15854aec3180..1d4e8354b561 100644
--- a/drivers/video/ffb.c
+++ b/drivers/video/ffb.c
@@ -336,14 +336,30 @@ struct ffb_dac {
         u32     value2;
 };
 
+#define FFB_DAC_UCTRL   0x1001 /* User Control */
+#define  FFB_DAC_UCTRL_MANREV   0x00000f00 /* 4-bit Manufacturing Revision */
+#define  FFB_DAC_UCTRL_MANREV_SHIFT 8
+#define FFB_DAC_TGEN    0x6000 /* Timing Generator */
+#define  FFB_DAC_TGEN_VIDE      0x00000001 /* Video Enable */
+#define FFB_DAC_DID     0x8000 /* Device Identification */
+#define  FFB_DAC_DID_PNUM       0x0ffff000 /* Device Part Number */
+#define  FFB_DAC_DID_PNUM_SHIFT 12
+#define  FFB_DAC_DID_REV        0xf0000000 /* Device Revision */
+#define  FFB_DAC_DID_REV_SHIFT 28
+
+#define FFB_DAC_CUR_CTRL        0x100
+#define  FFB_DAC_CUR_CTRL_P0    0x00000001
+#define  FFB_DAC_CUR_CTRL_P1    0x00000002
+
 struct ffb_par {
         spinlock_t              lock;
         struct ffb_fbc __iomem  *fbc;
         struct ffb_dac __iomem  *dac;
 
         u32                     flags;
-#define FFB_FLAG_AFB            0x00000001
-#define FFB_FLAG_BLANKED        0x00000002
+#define FFB_FLAG_AFB            0x00000001 /* AFB m3 or m6 */
+#define FFB_FLAG_BLANKED        0x00000002 /* screen is blanked */
+#define FFB_FLAG_INVCURSOR      0x00000004 /* DAC has inverted cursor logic */
 
         u32                     fg_cache __attribute__((aligned (8)));
         u32                     bg_cache;
@@ -354,7 +370,6 @@ struct ffb_par {
         unsigned long           physbase;
         unsigned long           fbsize;
 
-        int                     dac_rev;
         int                     board_type;
 };
 
@@ -426,11 +441,12 @@ static void ffb_switch_from_graph(struct ffb_par *par)
         FFBWait(par);
 
         /* Disable cursor.  */
-        upa_writel(0x100, &dac->type2);
-        if (par->dac_rev <= 2)
+        upa_writel(FFB_DAC_CUR_CTRL, &dac->type2);
+        if (par->flags & FFB_FLAG_INVCURSOR)
                 upa_writel(0, &dac->value2);
         else
-                upa_writel(3, &dac->value2);
+                upa_writel((FFB_DAC_CUR_CTRL_P0 |
+                            FFB_DAC_CUR_CTRL_P1), &dac->value2);
 
         spin_unlock_irqrestore(&par->lock, flags);
 }
@@ -664,18 +680,18 @@ ffb_blank(int blank, struct fb_info *info)
         struct ffb_par *par = (struct ffb_par *) info->par;
         struct ffb_dac __iomem *dac = par->dac;
         unsigned long flags;
-        u32 tmp;
+        u32 val;
+        int i;
 
         spin_lock_irqsave(&par->lock, flags);
 
         FFBWait(par);
 
+        upa_writel(FFB_DAC_TGEN, &dac->type);
+        val = upa_readl(&dac->value);
         switch (blank) {
         case FB_BLANK_UNBLANK: /* Unblanking */
-                upa_writel(0x6000, &dac->type);
-                tmp = (upa_readl(&dac->value) | 0x1);
-                upa_writel(0x6000, &dac->type);
-                upa_writel(tmp, &dac->value);
+                val |= FFB_DAC_TGEN_VIDE;
                 par->flags &= ~FFB_FLAG_BLANKED;
                 break;
 
@@ -683,13 +699,16 @@ ffb_blank(int blank, struct fb_info *info)
         case FB_BLANK_VSYNC_SUSPEND: /* VESA blank (vsync off) */
         case FB_BLANK_HSYNC_SUSPEND: /* VESA blank (hsync off) */
         case FB_BLANK_POWERDOWN: /* Poweroff */
-                upa_writel(0x6000, &dac->type);
-                tmp = (upa_readl(&dac->value) & ~0x1);
-                upa_writel(0x6000, &dac->type);
-                upa_writel(tmp, &dac->value);
+                val &= ~FFB_DAC_TGEN_VIDE;
                 par->flags |= FFB_FLAG_BLANKED;
                 break;
         }
+        upa_writel(FFB_DAC_TGEN, &dac->type);
+        upa_writel(val, &dac->value);
+        for (i = 0; i < 10; i++) {
+                upa_writel(FFB_DAC_TGEN, &dac->type);
+                upa_readl(&dac->value);
+        }
 
         spin_unlock_irqrestore(&par->lock, flags);
 
@@ -894,6 +913,7 @@ static int ffb_init_one(struct of_device *op)
         struct ffb_dac __iomem *dac;
         struct all_info *all;
         int err;
+        u32 dac_pnum, dac_rev, dac_mrev;
 
         all = kzalloc(sizeof(*all), GFP_KERNEL);
         if (!all)
@@ -948,17 +968,31 @@ static int ffb_init_one(struct of_device *op)
         if ((upa_readl(&fbc->ucsr) & FFB_UCSR_ALL_ERRORS) != 0)
                 upa_writel(FFB_UCSR_ALL_ERRORS, &fbc->ucsr);
 
-        ffb_switch_from_graph(&all->par);
-
         dac = all->par.dac;
-        upa_writel(0x8000, &dac->type);
-        all->par.dac_rev = upa_readl(&dac->value) >> 0x1c;
+        upa_writel(FFB_DAC_DID, &dac->type);
+        dac_pnum = upa_readl(&dac->value);
+        dac_rev = (dac_pnum & FFB_DAC_DID_REV) >> FFB_DAC_DID_REV_SHIFT;
+        dac_pnum = (dac_pnum & FFB_DAC_DID_PNUM) >> FFB_DAC_DID_PNUM_SHIFT;
+
+        upa_writel(FFB_DAC_UCTRL, &dac->type);
+        dac_mrev = upa_readl(&dac->value);
+        dac_mrev = (dac_mrev & FFB_DAC_UCTRL_MANREV) >>
+                FFB_DAC_UCTRL_MANREV_SHIFT;
 
         /* Elite3D has different DAC revision numbering, and no DAC revisions
-         * have the reversed meaning of cursor enable.
+         * have the reversed meaning of cursor enable.  Otherwise, Pacifica 1
+         * ramdacs with manufacturing revision less than 3 have inverted
+         * cursor logic.  We identify Pacifica 1 as not Pacifica 2, the
+         * latter having a part number value of 0x236e.
          */
-        if (all->par.flags & FFB_FLAG_AFB)
-                all->par.dac_rev = 10;
+        if ((all->par.flags & FFB_FLAG_AFB) || dac_pnum == 0x236e) {
+                all->par.flags &= ~FFB_FLAG_INVCURSOR;
+        } else {
+                if (dac_mrev < 3)
+                        all->par.flags |= FFB_FLAG_INVCURSOR;
+        }
+
+        ffb_switch_from_graph(&all->par);
 
         /* Unblank it just to be sure.  When there are multiple
          * FFB/AFB cards in the system, or it is not the OBP
@@ -993,10 +1027,12 @@ static int ffb_init_one(struct of_device *op)
 
         dev_set_drvdata(&op->dev, all);
 
-        printk("%s: %s at %016lx, type %d, DAC revision %d\n",
+        printk("%s: %s at %016lx, type %d, "
+               "DAC pnum[%x] rev[%d] manuf_rev[%d]\n",
                dp->full_name,
                ((all->par.flags & FFB_FLAG_AFB) ? "AFB" : "FFB"),
-               all->par.physbase, all->par.board_type, all->par.dac_rev);
+               all->par.physbase, all->par.board_type,
+               dac_pnum, dac_rev, dac_mrev);
 
         return 0;
 }
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 8ada4c5c5d70..6a82d39dc498 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -40,7 +40,6 @@
 extern struct file_system_type v9fs_fs_type;
 extern const struct address_space_operations v9fs_addr_operations;
 extern const struct file_operations v9fs_file_operations;
-extern const struct file_operations v9fs_cached_file_operations;
 extern const struct file_operations v9fs_dir_operations;
 extern struct dentry_operations v9fs_dentry_operations;
 extern struct dentry_operations v9fs_cached_dentry_operations;
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 653dfa5b2531..c7b677253843 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -42,6 +42,8 @@
 #include "v9fs_vfs.h"
 #include "fid.h"
 
+static const struct file_operations v9fs_cached_file_operations;
+
 /**
  * v9fs_file_open - open a file (or directory)
  * @inode: inode to be opened
@@ -245,7 +247,7 @@ v9fs_file_write(struct file *filp, const char __user * data,
         return total;
 }
 
-const struct file_operations v9fs_cached_file_operations = {
+static const struct file_operations v9fs_cached_file_operations = {
         .llseek = generic_file_llseek,
         .read = do_sync_read,
         .aio_read = generic_file_aio_read,
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 124a085d1f2e..b01b0a457932 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -415,7 +415,7 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         file_inode = file->d_inode;
         sb = file_inode->i_sb;
         v9ses = v9fs_inode2v9ses(file_inode);
-        v9fid = v9fs_fid_lookup(file);
+        v9fid = v9fs_fid_clone(file);
         if(IS_ERR(v9fid))
                 return PTR_ERR(v9fid);
 
diff --git a/fs/aio.c b/fs/aio.c
index 0b4ee0a5c83e..e4598d6d49dd 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -136,7 +136,6 @@ static int aio_setup_ring(struct kioctx *ctx)
                                   0);
         if (IS_ERR((void *)info->mmap_base)) {
                 up_write(&ctx->mm->mmap_sem);
-                printk("mmap err: %ld\n", -info->mmap_base);
                 info->mmap_size = 0;
                 aio_free_ring(ctx);
                 return -EAGAIN;
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index b4631046867e..d0e9b3a3905d 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -470,9 +470,6 @@ void autofs4_dentry_release(struct dentry *de)
         if (inf) {
                 struct autofs_sb_info *sbi = autofs4_sbi(de->d_sb);
 
-                inf->dentry = NULL;
-                inf->inode = NULL;
-
                 if (sbi) {
                         spin_lock(&sbi->rehash_lock);
                         if (!list_empty(&inf->rehash))
@@ -480,6 +477,9 @@ void autofs4_dentry_release(struct dentry *de)
                         spin_unlock(&sbi->rehash_lock);
                 }
 
+                inf->dentry = NULL;
+                inf->inode = NULL;
+
                 autofs4_free_ino(inf);
         }
 }
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index a2fceba7ef8e..9cc4f0a8aaae 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1704,7 +1704,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
                                 DUMP_SEEK(PAGE_SIZE);
                         } else {
                                 if (page == ZERO_PAGE(addr)) {
-                                        DUMP_SEEK(PAGE_SIZE);
+                                        if (!dump_seek(file, PAGE_SIZE)) {
+                                                page_cache_release(page);
+                                                goto end_coredump;
+                                        }
                                 } else {
                                         void *kaddr;
                                         flush_cache_page(vma, addr,
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 47d6d49d1fb9..f3ddca4a387b 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1480,8 +1480,8 @@ static int elf_fdpic_dump_segments(struct file *file, struct mm_struct *mm,
                                 DUMP_SEEK(file->f_pos + PAGE_SIZE);
                         }
                         else if (page == ZERO_PAGE(addr)) {
-                                DUMP_SEEK(file->f_pos + PAGE_SIZE);
                                 page_cache_release(page);
+                                DUMP_SEEK(file->f_pos + PAGE_SIZE);
                         }
                         else {
                                 void *kaddr;
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 78ced721554d..164a45cdaf5f 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -109,8 +109,6 @@ __register_chrdev_region(unsigned int major, unsigned int baseminor,
         /* temporary */
         if (major == 0) {
                 for (i = ARRAY_SIZE(chrdevs)-1; i > 0; i--) {
-                        if (is_lanana_major(i))
-                                continue;
                         if (chrdevs[i] == NULL)
                                 break;
                 }
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index c81c958b3e1d..8b1c5d8bf4ef 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -2553,11 +2553,15 @@ HANDLE_IOCTL(I2C_RDWR, do_i2c_rdwr_ioctl)
 HANDLE_IOCTL(I2C_SMBUS, do_i2c_smbus_ioctl)
 /* wireless */
 HANDLE_IOCTL(SIOCGIWRANGE, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCGIWPRIV, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCGIWSTATS, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCSIWSPY, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWSPY, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCSIWTHRSPY, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWTHRSPY, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCSIWMLME, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWAPLIST, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCSIWSCAN, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWSCAN, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCSIWESSID, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWESSID, do_wireless_ioctl)
@@ -2565,6 +2569,11 @@ HANDLE_IOCTL(SIOCSIWNICKN, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWNICKN, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCSIWENCODE, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCGIWENCODE, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCSIWGENIE, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCGIWGENIE, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCSIWENCODEEXT, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCGIWENCODEEXT, do_wireless_ioctl)
+HANDLE_IOCTL(SIOCSIWPMKSA, do_wireless_ioctl)
 HANDLE_IOCTL(SIOCSIFBR, old_bridge_ioctl)
 HANDLE_IOCTL(SIOCGIFBR, old_bridge_ioctl)
 HANDLE_IOCTL(RTC_IRQP_READ32, rtc_ioctl)
diff --git a/fs/exec.c b/fs/exec.c
index 7e36c6f6f538..3155e915307a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1244,13 +1244,17 @@ EXPORT_SYMBOL(set_binfmt);
  * name into corename, which must have space for at least
  * CORENAME_MAX_SIZE bytes plus one byte for the zero terminator.
  */
-static void format_corename(char *corename, const char *pattern, long signr)
+static int format_corename(char *corename, const char *pattern, long signr)
 {
         const char *pat_ptr = pattern;
         char *out_ptr = corename;
         char *const out_end = corename + CORENAME_MAX_SIZE;
         int rc;
         int pid_in_pattern = 0;
+        int ispipe = 0;
+
+        if (*pattern == '|')
+                ispipe = 1;
 
         /* Repeat as long as we have more pattern to process and more output
            space */
@@ -1341,8 +1345,8 @@ static void format_corename(char *corename, const char *pattern, long signr)
          *
          * If core_pattern does not include a %p (as is the default)
          * and core_uses_pid is set, then .%pid will be appended to
-         * the filename */
-        if (!pid_in_pattern
+         * the filename. Do not do this for piped commands. */
+        if (!ispipe && !pid_in_pattern
             && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {
                 rc = snprintf(out_ptr, out_end - out_ptr,
                               ".%d", current->tgid);
@@ -1350,8 +1354,9 @@ static void format_corename(char *corename, const char *pattern, long signr)
                         goto out;
                 out_ptr += rc;
         }
-      out:
+out:
         *out_ptr = 0;
+        return ispipe;
 }
 
 static void zap_process(struct task_struct *start)
@@ -1502,16 +1507,15 @@ int do_coredump(long signr, int exit_code, struct pt_regs * regs)
          * uses lock_kernel()
          */
         lock_kernel();
-        format_corename(corename, core_pattern, signr);
+        ispipe = format_corename(corename, core_pattern, signr);
         unlock_kernel();
-        if (corename[0] == '|') {
+        if (ispipe) {
                 /* SIGPIPE can happen, but it's just never processed */
                 if(call_usermodehelper_pipe(corename+1, NULL, NULL, &file)) {
                         printk(KERN_INFO "Core dump to %s pipe failed\n",
                                corename);
                         goto fail_unlock;
                 }
-                ispipe = 1;
         } else
                 file = filp_open(corename,
                                  O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 8a824f4ce5c6..a5b150f7e8a2 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1148,102 +1148,37 @@ static int do_journal_get_write_access(handle_t *handle,
         return ext3_journal_get_write_access(handle, bh);
 }
 
-/*
- * The idea of this helper function is following:
- * if prepare_write has allocated some blocks, but not all of them, the
- * transaction must include the content of the newly allocated blocks.
- * This content is expected to be set to zeroes by block_prepare_write().
- * 2006/10/14  SAW
- */
-static int ext3_prepare_failure(struct file *file, struct page *page,
-                                unsigned from, unsigned to)
-{
-        struct address_space *mapping;
-        struct buffer_head *bh, *head, *next;
-        unsigned block_start, block_end;
-        unsigned blocksize;
-        int ret;
-        handle_t *handle = ext3_journal_current_handle();
-
-        mapping = page->mapping;
-        if (ext3_should_writeback_data(mapping->host)) {
-                /* optimization: no constraints about data */
-skip:
-                return ext3_journal_stop(handle);
-        }
-
-        head = page_buffers(page);
-        blocksize = head->b_size;
-        for (   bh = head, block_start = 0;
-                bh != head || !block_start;
-                block_start = block_end, bh = next)
-        {
-                next = bh->b_this_page;
-                block_end = block_start + blocksize;
-                if (block_end <= from)
-                        continue;
-                if (block_start >= to) {
-                        block_start = to;
-                        break;
-                }
-                if (!buffer_mapped(bh))
-                /* prepare_write failed on this bh */
-                        break;
-                if (ext3_should_journal_data(mapping->host)) {
-                        ret = do_journal_get_write_access(handle, bh);
-                        if (ret) {
-                                ext3_journal_stop(handle);
-                                return ret;
-                        }
-                }
-        /*
-         * block_start here becomes the first block where the current iteration
-         * of prepare_write failed.
-         */
-        }
-        if (block_start <= from)
-                goto skip;
-
-        /* commit allocated and zeroed buffers */
-        return mapping->a_ops->commit_write(file, page, from, block_start);
-}
-
 static int ext3_prepare_write(struct file *file, struct page *page,
                               unsigned from, unsigned to)
 {
         struct inode *inode = page->mapping->host;
-        int ret, ret2;
-        int needed_blocks = ext3_writepage_trans_blocks(inode);
+        int ret, needed_blocks = ext3_writepage_trans_blocks(inode);
         handle_t *handle;
         int retries = 0;
 
 retry:
         handle = ext3_journal_start(inode, needed_blocks);
-        if (IS_ERR(handle))
-                return PTR_ERR(handle);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out;
+        }
         if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode))
                 ret = nobh_prepare_write(page, from, to, ext3_get_block);
         else
                 ret = block_prepare_write(page, from, to, ext3_get_block);
         if (ret)
-                goto failure;
+                goto prepare_write_failed;
 
         if (ext3_should_journal_data(inode)) {
                 ret = walk_page_buffers(handle, page_buffers(page),
                                 from, to, NULL, do_journal_get_write_access);
-                if (ret)
-                        /* fatal error, just put the handle and return */
-                        journal_stop(handle);
         }
-        return ret;
-
-failure:
-        ret2 = ext3_prepare_failure(file, page, from, to);
-        if (ret2 < 0)
-                return ret2;
+prepare_write_failed:
+        if (ret)
+                ext3_journal_stop(handle);
         if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
                 goto retry;
-        /* retry number exceeded, or other error like -EDQUOT */
+out:
         return ret;
 }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index fbff4b9e122a..810b6d6474bf 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1147,102 +1147,37 @@ static int do_journal_get_write_access(handle_t *handle,
         return ext4_journal_get_write_access(handle, bh);
 }
 
-/*
- * The idea of this helper function is following:
- * if prepare_write has allocated some blocks, but not all of them, the
- * transaction must include the content of the newly allocated blocks.
- * This content is expected to be set to zeroes by block_prepare_write().
- * 2006/10/14  SAW
- */
-static int ext4_prepare_failure(struct file *file, struct page *page,
-                                unsigned from, unsigned to)
-{
-        struct address_space *mapping;
-        struct buffer_head *bh, *head, *next;
-        unsigned block_start, block_end;
-        unsigned blocksize;
-        int ret;
-        handle_t *handle = ext4_journal_current_handle();
-
-        mapping = page->mapping;
-        if (ext4_should_writeback_data(mapping->host)) {
-                /* optimization: no constraints about data */
-skip:
-                return ext4_journal_stop(handle);
-        }
-
-        head = page_buffers(page);
-        blocksize = head->b_size;
-        for (   bh = head, block_start = 0;
-                bh != head || !block_start;
-                block_start = block_end, bh = next)
-        {
-                next = bh->b_this_page;
-                block_end = block_start + blocksize;
-                if (block_end <= from)
-                        continue;
-                if (block_start >= to) {
-                        block_start = to;
-                        break;
-                }
-                if (!buffer_mapped(bh))
-                /* prepare_write failed on this bh */
-                        break;
-                if (ext4_should_journal_data(mapping->host)) {
-                        ret = do_journal_get_write_access(handle, bh);
-                        if (ret) {
-                                ext4_journal_stop(handle);
-                                return ret;
-                        }
-                }
-        /*
-         * block_start here becomes the first block where the current iteration
-         * of prepare_write failed.
-         */
-        }
-        if (block_start <= from)
-                goto skip;
-
-        /* commit allocated and zeroed buffers */
-        return mapping->a_ops->commit_write(file, page, from, block_start);
-}
-
 static int ext4_prepare_write(struct file *file, struct page *page,
                               unsigned from, unsigned to)
 {
         struct inode *inode = page->mapping->host;
-        int ret, ret2;
-        int needed_blocks = ext4_writepage_trans_blocks(inode);
+        int ret, needed_blocks = ext4_writepage_trans_blocks(inode);
         handle_t *handle;
         int retries = 0;
 
 retry:
         handle = ext4_journal_start(inode, needed_blocks);
-        if (IS_ERR(handle))
-                return PTR_ERR(handle);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out;
+        }
         if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
                 ret = nobh_prepare_write(page, from, to, ext4_get_block);
         else
                 ret = block_prepare_write(page, from, to, ext4_get_block);
         if (ret)
-                goto failure;
+                goto prepare_write_failed;
 
         if (ext4_should_journal_data(inode)) {
                 ret = walk_page_buffers(handle, page_buffers(page),
                                 from, to, NULL, do_journal_get_write_access);
-                if (ret)
-                        /* fatal error, just put the handle and return */
-                        ext4_journal_stop(handle);
         }
-        return ret;
-
-failure:
-        ret2 = ext4_prepare_failure(file, page, from, to);
-        if (ret2 < 0)
-                return ret2;
+prepare_write_failed:
+        if (ret)
+                ext4_journal_stop(handle);
         if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
                 goto retry;
-        /* retry number exceeded, or other error like -EDQUOT */
+out:
         return ret;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 406bf61ed510..8890eba1db52 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -195,7 +195,7 @@ static struct dentry_operations fuse_dentry_operations = {
         .d_revalidate   = fuse_dentry_revalidate,
 };
 
-static int valid_mode(int m)
+int fuse_valid_type(int m)
 {
         return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
                 S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
@@ -248,7 +248,8 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         fuse_put_request(fc, req);
         /* Zero nodeid is same as -ENOENT, but with valid timeout */
         if (!err && outarg.nodeid &&
-            (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))
+            (invalid_nodeid(outarg.nodeid) ||
+             !fuse_valid_type(outarg.attr.mode)))
                 err = -EIO;
         if (!err && outarg.nodeid) {
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index b98b20de7405..68ae87cbafab 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -552,3 +552,8 @@ int fuse_ctl_add_conn(struct fuse_conn *fc);
  * Remove connection from control filesystem
  */
 void fuse_ctl_remove_conn(struct fuse_conn *fc);
+
+/**
+ * Is file type valid?
+ */
+int fuse_valid_type(int m);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 5ab8e50e7808..608db81219a0 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -330,6 +330,8 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev)
                 case OPT_ROOTMODE:
                         if (match_octal(&args[0], &value))
                                 return 0;
+                        if (!fuse_valid_type(value))
+                                return 0;
                         d->rootmode = value;
                         d->rootmode_present = 1;
                         break;
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 9baf69773ed1..fd301a910122 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -20,7 +20,6 @@
 #include "hostfs.h"
 #include "kern_util.h"
 #include "kern.h"
-#include "user_util.h"
 #include "init.h"
 
 struct hostfs_inode_info {
@@ -939,7 +938,7 @@ static const struct address_space_operations hostfs_link_aops = {
 static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
 {
         struct inode *root_inode;
-        char *name, *data = d;
+        char *host_root_path, *req_root = d;
         int err;
 
         sb->s_blocksize = 1024;
@@ -948,16 +947,16 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
         sb->s_op = &hostfs_sbops;
 
         /* NULL is printed as <NULL> by sprintf: avoid that. */
-        if (data == NULL)
-                data = "";
+        if (req_root == NULL)
+                req_root = "";
 
         err = -ENOMEM;
-        name = kmalloc(strlen(root_ino) + 1
-                        + strlen(data) + 1, GFP_KERNEL);
-        if(name == NULL)
+        host_root_path = kmalloc(strlen(root_ino) + 1
+                                 + strlen(req_root) + 1, GFP_KERNEL);
+        if(host_root_path == NULL)
                 goto out;
 
-        sprintf(name, "%s/%s", root_ino, data);
+        sprintf(host_root_path, "%s/%s", root_ino, req_root);
 
         root_inode = iget(sb, 0);
         if(root_inode == NULL)
@@ -967,10 +966,10 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
         if(err)
                 goto out_put;
 
-        HOSTFS_I(root_inode)->host_filename = name;
-        /* Avoid that in the error path, iput(root_inode) frees again name through
-         * hostfs_destroy_inode! */
-        name = NULL;
+        HOSTFS_I(root_inode)->host_filename = host_root_path;
+        /* Avoid that in the error path, iput(root_inode) frees again
+         * host_root_path through hostfs_destroy_inode! */
+        host_root_path = NULL;
 
         err = -ENOMEM;
         sb->s_root = d_alloc_root(root_inode);
@@ -990,7 +989,7 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
  out_put:
         iput(root_inode);
  out_free:
-        kfree(name);
+        kfree(host_root_path);
  out:
         return(err);
 }
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 92d8ec859e22..cd3469720cbf 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1684,7 +1684,8 @@ go_ahead:
          * ... prune child dentries and writebacks if needed.
          */
         if (atomic_read(&old_dentry->d_count) > 1) {
-                nfs_wb_all(old_inode);
+                if (S_ISREG(old_inode->i_mode))
+                        nfs_wb_all(old_inode);
                 shrink_dcache_parent(old_dentry);
         }
         nfs_inode_return_delegation(old_inode);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index b1c98ea39b72..2877744cb606 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -432,10 +432,10 @@ static void nfs_direct_commit_result(struct rpc_task *task, void *calldata)
         if (NFS_PROTO(data->inode)->commit_done(task, data) != 0)
                 return;
         if (unlikely(task->tk_status < 0)) {
-                dreq->error = task->tk_status;
+                dprintk("NFS: %5u commit failed with error %d.\n",
+                                task->tk_pid, task->tk_status);
                 dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
-        }
-        if (memcmp(&dreq->verf, &data->verf, sizeof(data->verf))) {
+        } else if (memcmp(&dreq->verf, &data->verf, sizeof(data->verf))) {
                 dprintk("NFS: %5u commit verify failed\n", task->tk_pid);
                 dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
         }
@@ -531,9 +531,12 @@ static void nfs_direct_write_result(struct rpc_task *task, void *calldata)
 
         spin_lock(&dreq->lock);
 
+        if (unlikely(dreq->error != 0))
+                goto out_unlock;
         if (unlikely(status < 0)) {
+                /* An error has occured, so we should not commit */
+                dreq->flags = 0;
                 dreq->error = status;
-                goto out_unlock;
         }
 
         dreq->count += data->res.count;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 93d046c85f52..44aa9b726573 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -341,8 +341,10 @@ nfs_setattr(struct dentry *dentry, struct iattr *attr)
         lock_kernel();
         nfs_begin_data_update(inode);
         /* Write all dirty data */
-        filemap_write_and_wait(inode->i_mapping);
-        nfs_wb_all(inode);
+        if (S_ISREG(inode->i_mode)) {
+                filemap_write_and_wait(inode->i_mapping);
+                nfs_wb_all(inode);
+        }
         /*
          * Return any delegations if we're going to change ACLs
          */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 2867e6b7096f..797558941745 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -38,7 +38,6 @@
 static struct nfs_page * nfs_update_request(struct nfs_open_context*,
                                             struct page *,
                                             unsigned int, unsigned int);
-static void nfs_mark_request_dirty(struct nfs_page *req);
 static long nfs_flush_mapping(struct address_space *mapping, struct writeback_control *wbc, int how);
 static const struct rpc_call_ops nfs_write_partial_ops;
 static const struct rpc_call_ops nfs_write_full_ops;
@@ -218,9 +217,11 @@ int nfs_congestion_kb;
 #define NFS_CONGESTION_OFF_THRESH       \
         (NFS_CONGESTION_ON_THRESH - (NFS_CONGESTION_ON_THRESH >> 2))
 
-static void nfs_set_page_writeback(struct page *page)
+static int nfs_set_page_writeback(struct page *page)
 {
-        if (!test_set_page_writeback(page)) {
+        int ret = test_set_page_writeback(page);
+
+        if (!ret) {
                 struct inode *inode = page->mapping->host;
                 struct nfs_server *nfss = NFS_SERVER(inode);
 
@@ -228,6 +229,7 @@ static void nfs_set_page_writeback(struct page *page)
                                 NFS_CONGESTION_ON_THRESH)
                         set_bdi_congested(&nfss->backing_dev_info, WRITE);
         }
+        return ret;
 }
 
 static void nfs_end_page_writeback(struct page *page)
@@ -252,7 +254,8 @@ static void nfs_end_page_writeback(struct page *page)
 static int nfs_page_mark_flush(struct page *page)
 {
         struct nfs_page *req;
-        spinlock_t *req_lock = &NFS_I(page->mapping->host)->req_lock;
+        struct nfs_inode *nfsi = NFS_I(page->mapping->host);
+        spinlock_t *req_lock = &nfsi->req_lock;
         int ret;
 
         spin_lock(req_lock);
@@ -276,11 +279,23 @@ static int nfs_page_mark_flush(struct page *page)
                         return ret;
                 spin_lock(req_lock);
         }
-        spin_unlock(req_lock);
-        if (test_and_set_bit(PG_FLUSHING, &req->wb_flags) == 0) {
-                nfs_mark_request_dirty(req);
-                nfs_set_page_writeback(page);
+        if (test_bit(PG_NEED_COMMIT, &req->wb_flags)) {
+                /* This request is marked for commit */
+                spin_unlock(req_lock);
+                nfs_unlock_request(req);
+                return 1;
         }
+        if (nfs_set_page_writeback(page) == 0) {
+                nfs_list_remove_request(req);
+                /* add the request to the inode's dirty list. */
+                radix_tree_tag_set(&nfsi->nfs_page_tree,
+                                req->wb_index, NFS_PAGE_TAG_DIRTY);
+                nfs_list_add_request(req, &nfsi->dirty);
+                nfsi->ndirty++;
+                spin_unlock(req_lock);
+                __mark_inode_dirty(page->mapping->host, I_DIRTY_PAGES);
+        } else
+                spin_unlock(req_lock);
         ret = test_bit(PG_NEED_FLUSH, &req->wb_flags);
         nfs_unlock_request(req);
         return ret;
@@ -373,6 +388,8 @@ static int nfs_inode_add_request(struct inode *inode, struct nfs_page *req)
         }
         SetPagePrivate(req->wb_page);
         set_page_private(req->wb_page, (unsigned long)req);
+        if (PageDirty(req->wb_page))
+                set_bit(PG_NEED_FLUSH, &req->wb_flags);
         nfsi->npages++;
         atomic_inc(&req->wb_count);
         return 0;
@@ -392,6 +409,8 @@ static void nfs_inode_remove_request(struct nfs_page *req)
         set_page_private(req->wb_page, 0);
         ClearPagePrivate(req->wb_page);
         radix_tree_delete(&nfsi->nfs_page_tree, req->wb_index);
+        if (test_and_clear_bit(PG_NEED_FLUSH, &req->wb_flags))
+                __set_page_dirty_nobuffers(req->wb_page);
         nfsi->npages--;
         if (!nfsi->npages) {
                 spin_unlock(&nfsi->req_lock);
@@ -403,28 +422,9 @@ static void nfs_inode_remove_request(struct nfs_page *req)
         nfs_release_request(req);
 }
 
-/*
- * Add a request to the inode's dirty list.
- */
-static void
-nfs_mark_request_dirty(struct nfs_page *req)
-{
-        struct inode *inode = req->wb_context->dentry->d_inode;
-        struct nfs_inode *nfsi = NFS_I(inode);
-
-        spin_lock(&nfsi->req_lock);
-        radix_tree_tag_set(&nfsi->nfs_page_tree,
-                        req->wb_index, NFS_PAGE_TAG_DIRTY);
-        nfs_list_add_request(req, &nfsi->dirty);
-        nfsi->ndirty++;
-        spin_unlock(&nfsi->req_lock);
-        __mark_inode_dirty(inode, I_DIRTY_PAGES);
-}
-
 static void
 nfs_redirty_request(struct nfs_page *req)
 {
-        clear_bit(PG_FLUSHING, &req->wb_flags);
         __set_page_dirty_nobuffers(req->wb_page);
 }
 
@@ -434,7 +434,11 @@ nfs_redirty_request(struct nfs_page *req)
 static inline int
 nfs_dirty_request(struct nfs_page *req)
 {
-        return test_bit(PG_FLUSHING, &req->wb_flags) == 0;
+        struct page *page = req->wb_page;
+
+        if (page == NULL || test_bit(PG_NEED_COMMIT, &req->wb_flags))
+                return 0;
+        return !PageWriteback(req->wb_page);
 }
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
@@ -450,10 +454,48 @@ nfs_mark_request_commit(struct nfs_page *req)
         spin_lock(&nfsi->req_lock);
         nfs_list_add_request(req, &nfsi->commit);
         nfsi->ncommit++;
+        set_bit(PG_NEED_COMMIT, &(req)->wb_flags);
         spin_unlock(&nfsi->req_lock);
         inc_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
         __mark_inode_dirty(inode, I_DIRTY_DATASYNC);
 }
+
+static inline
+int nfs_write_need_commit(struct nfs_write_data *data)
+{
+        return data->verf.committed != NFS_FILE_SYNC;
+}
+
+static inline
+int nfs_reschedule_unstable_write(struct nfs_page *req)
+{
+        if (test_bit(PG_NEED_COMMIT, &req->wb_flags)) {
+                nfs_mark_request_commit(req);
+                return 1;
+        }
+        if (test_and_clear_bit(PG_NEED_RESCHED, &req->wb_flags)) {
+                nfs_redirty_request(req);
+                return 1;
+        }
+        return 0;
+}
+#else
+static inline void
+nfs_mark_request_commit(struct nfs_page *req)
+{
+}
+
+static inline
+int nfs_write_need_commit(struct nfs_write_data *data)
+{
+        return 0;
+}
+
+static inline
+int nfs_reschedule_unstable_write(struct nfs_page *req)
+{
+        return 0;
+}
 #endif
 
 /*
@@ -500,6 +542,7 @@ static void nfs_cancel_dirty_list(struct list_head *head)
         while(!list_empty(head)) {
                 req = nfs_list_entry(head->next);
                 nfs_list_remove_request(req);
+                nfs_end_page_writeback(req->wb_page);
                 nfs_inode_remove_request(req);
                 nfs_clear_page_writeback(req);
         }
@@ -513,6 +556,7 @@ static void nfs_cancel_commit_list(struct list_head *head)
                 req = nfs_list_entry(head->next);
                 dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
                 nfs_list_remove_request(req);
+                clear_bit(PG_NEED_COMMIT, &(req)->wb_flags);
                 nfs_inode_remove_request(req);
                 nfs_unlock_request(req);
         }
@@ -739,26 +783,12 @@ int nfs_updatepage(struct file *file, struct page *page,
 
 static void nfs_writepage_release(struct nfs_page *req)
 {
-        nfs_end_page_writeback(req->wb_page);
-
-#if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-        if (!PageError(req->wb_page)) {
-                if (NFS_NEED_RESCHED(req)) {
-                        nfs_redirty_request(req);
-                        goto out;
-                } else if (NFS_NEED_COMMIT(req)) {
-                        nfs_mark_request_commit(req);
-                        goto out;
-                }
-        }
-        nfs_inode_remove_request(req);
 
-out:
-        nfs_clear_commit(req);
-        nfs_clear_reschedule(req);
-#else
-        nfs_inode_remove_request(req);
-#endif
+        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req)) {
+                nfs_end_page_writeback(req->wb_page);
+                nfs_inode_remove_request(req);
+        } else
+                nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_writeback(req);
 }
 
@@ -891,6 +921,7 @@ out_bad:
                 nfs_writedata_release(data);
         }
         nfs_redirty_request(req);
+        nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_writeback(req);
         return -ENOMEM;
 }
@@ -936,6 +967,7 @@ static int nfs_flush_one(struct inode *inode, struct list_head *head, int how)
                 struct nfs_page *req = nfs_list_entry(head->next);
                 nfs_list_remove_request(req);
                 nfs_redirty_request(req);
+                nfs_end_page_writeback(req->wb_page);
                 nfs_clear_page_writeback(req);
         }
         return -ENOMEM;
@@ -971,6 +1003,7 @@ out_err:
                 req = nfs_list_entry(head->next);
                 nfs_list_remove_request(req);
                 nfs_redirty_request(req);
+                nfs_end_page_writeback(req->wb_page);
                 nfs_clear_page_writeback(req);
         }
         return error;
@@ -998,22 +1031,28 @@ static void nfs_writeback_done_partial(struct rpc_task *task, void *calldata)
                 nfs_set_pageerror(page);
                 req->wb_context->error = task->tk_status;
                 dprintk(", error = %d\n", task->tk_status);
-        } else {
-#if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-                if (data->verf.committed < NFS_FILE_SYNC) {
-                        if (!NFS_NEED_COMMIT(req)) {
-                                nfs_defer_commit(req);
-                                memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
-                                dprintk(" defer commit\n");
-                        } else if (memcmp(&req->wb_verf, &data->verf, sizeof(req->wb_verf))) {
-                                nfs_defer_reschedule(req);
-                                dprintk(" server reboot detected\n");
-                        }
-                } else
-#endif
-                        dprintk(" OK\n");
+                goto out;
         }
 
+        if (nfs_write_need_commit(data)) {
+                spinlock_t *req_lock = &NFS_I(page->mapping->host)->req_lock;
+
+                spin_lock(req_lock);
+                if (test_bit(PG_NEED_RESCHED, &req->wb_flags)) {
+                        /* Do nothing we need to resend the writes */
+                } else if (!test_and_set_bit(PG_NEED_COMMIT, &req->wb_flags)) {
+                        memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
+                        dprintk(" defer commit\n");
+                } else if (memcmp(&req->wb_verf, &data->verf, sizeof(req->wb_verf))) {
+                        set_bit(PG_NEED_RESCHED, &req->wb_flags);
+                        clear_bit(PG_NEED_COMMIT, &req->wb_flags);
+                        dprintk(" server reboot detected\n");
+                }
+                spin_unlock(req_lock);
+        } else
+                dprintk(" OK\n");
+
+out:
         if (atomic_dec_and_test(&req->wb_complete))
                 nfs_writepage_release(req);
 }
@@ -1054,25 +1093,21 @@ static void nfs_writeback_done_full(struct rpc_task *task, void *calldata)
                 if (task->tk_status < 0) {
                         nfs_set_pageerror(page);
                         req->wb_context->error = task->tk_status;
-                        nfs_end_page_writeback(page);
-                        nfs_inode_remove_request(req);
                         dprintk(", error = %d\n", task->tk_status);
-                        goto next;
+                        goto remove_request;
                 }
-                nfs_end_page_writeback(page);
 
-#if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-                if (data->args.stable != NFS_UNSTABLE || data->verf.committed == NFS_FILE_SYNC) {
-                        nfs_inode_remove_request(req);
-                        dprintk(" OK\n");
+                if (nfs_write_need_commit(data)) {
+                        memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
+                        nfs_mark_request_commit(req);
+                        nfs_end_page_writeback(page);
+                        dprintk(" marked for commit\n");
                         goto next;
                 }
-                memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
-                nfs_mark_request_commit(req);
-                dprintk(" marked for commit\n");
-#else
+                dprintk(" OK\n");
+remove_request:
+                nfs_end_page_writeback(page);
                 nfs_inode_remove_request(req);
-#endif
         next:
                 nfs_clear_page_writeback(req);
         }
@@ -1260,6 +1295,7 @@ static void nfs_commit_done(struct rpc_task *task, void *calldata)
         while (!list_empty(&data->pages)) {
                 req = nfs_list_entry(data->pages.next);
                 nfs_list_remove_request(req);
+                clear_bit(PG_NEED_COMMIT, &(req)->wb_flags);
                 dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
 
                 dprintk("NFS: commit (%s/%Ld %d@%Ld)",
@@ -1495,15 +1531,22 @@ int nfs_wb_page(struct inode *inode, struct page* page)
 
 int nfs_set_page_dirty(struct page *page)
 {
+        spinlock_t *req_lock = &NFS_I(page->mapping->host)->req_lock;
         struct nfs_page *req;
+        int ret;
 
-        req = nfs_page_find_request(page);
+        spin_lock(req_lock);
+        req = nfs_page_find_request_locked(page);
         if (req != NULL) {
                 /* Mark any existing write requests for flushing */
-                set_bit(PG_NEED_FLUSH, &req->wb_flags);
+                ret = !test_and_set_bit(PG_NEED_FLUSH, &req->wb_flags);
+                spin_unlock(req_lock);
                 nfs_release_request(req);
+                return ret;
         }
-        return __set_page_dirty_nobuffers(page);
+        ret = __set_page_dirty_nobuffers(page);
+        spin_unlock(req_lock);
+        return ret;
 }
 
 
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 6f677988c71d..7e4bb0af24d7 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -859,8 +859,8 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
 #define NFS3_ENTRY_BAGGAGE      (2 + 1 + 2 + 1)
 #define NFS3_ENTRYPLUS_BAGGAGE  (1 + 21 + 1 + (NFS3_FHSIZE >> 2))
 static int
-encode_entry(struct readdir_cd *ccd, const char *name,
-             int namlen, off_t offset, ino_t ino, unsigned int d_type, int plus)
+encode_entry(struct readdir_cd *ccd, const char *name, int namlen,
+             loff_t offset, ino_t ino, unsigned int d_type, int plus)
 {
         struct nfsd3_readdirres *cd = container_of(ccd, struct nfsd3_readdirres,
                                                         common);
@@ -880,7 +880,7 @@ encode_entry(struct readdir_cd *ccd, const char *name,
                         *cd->offset1 = htonl(offset64 & 0xffffffff);
                         cd->offset1 = NULL;
                 } else {
-                        xdr_encode_hyper(cd->offset, (u64) offset);
+                        xdr_encode_hyper(cd->offset, offset64);
                 }
         }
 
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 832673b14587..673a53c014a3 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -228,7 +228,7 @@ _posix_to_nfsv4_one(struct posix_acl *pacl, struct nfs4_acl *acl,
         struct posix_acl_summary pas;
         unsigned short deny;
         int eflag = ((flags & NFS4_ACL_TYPE_DEFAULT) ?
-                                        NFS4_INHERITANCE_FLAGS : 0);
+                NFS4_INHERITANCE_FLAGS | NFS4_ACE_INHERIT_ONLY_ACE : 0);
 
         BUG_ON(pacl->a_count < 3);
         summarize_posix_acl(pacl, &pas);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 9e4067999209..af360705e551 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -750,9 +750,8 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 status = nfserr_clid_inuse;
                 if (!cmp_creds(&conf->cl_cred, &rqstp->rq_cred)
                                 || conf->cl_addr != sin->sin_addr.s_addr) {
-                        printk("NFSD: setclientid: string in use by client"
-                        "(clientid %08x/%08x)\n",
-                        conf->cl_clientid.cl_boot, conf->cl_clientid.cl_id);
+                        dprintk("NFSD: setclientid: string in use by client"
+                                "at %u.%u.%u.%u\n", NIPQUAD(conf->cl_addr));
                         goto out;
                 }
         }
@@ -3261,7 +3260,6 @@ __nfs4_state_shutdown(void)
                 unhash_delegation(dp);
         }
 
-        cancel_delayed_work(&laundromat_work);
         nfsd4_shutdown_recdir();
         nfs4_init = 0;
 }
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 6087c4749fee..c558442a0b44 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -138,8 +138,10 @@ static void dlm_unregister_domain_handlers(struct dlm_ctxt *dlm);
 
 void __dlm_unhash_lockres(struct dlm_lock_resource *lockres)
 {
-        hlist_del_init(&lockres->hash_node);
-        dlm_lockres_put(lockres);
+        if (!hlist_unhashed(&lockres->hash_node)) {
+                hlist_del_init(&lockres->hash_node);
+                dlm_lockres_put(lockres);
+        }
 }
 
 void __dlm_insert_lockres(struct dlm_ctxt *dlm,
@@ -655,6 +657,8 @@ void dlm_unregister_domain(struct dlm_ctxt *dlm)
                 dlm_kick_thread(dlm, NULL);
 
                 while (dlm_migrate_all_locks(dlm)) {
+                        /* Give dlm_thread time to purge the lockres' */
+                        msleep(500);
                         mlog(0, "%s: more migration to do\n", dlm->name);
                 }
                 dlm_mark_domain_leaving(dlm);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 9229e04362f6..6edffca99d98 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2424,6 +2424,57 @@ static void dlm_deref_lockres_worker(struct dlm_work_item *item, void *data)
         dlm_lockres_put(res);
 }
 
+/* Checks whether the lockres can be migrated. Returns 0 if yes, < 0
+ * if not. If 0, numlocks is set to the number of locks in the lockres.
+ */
+static int dlm_is_lockres_migrateable(struct dlm_ctxt *dlm,
+                                      struct dlm_lock_resource *res,
+                                      int *numlocks)
+{
+        int ret;
+        int i;
+        int count = 0;
+        struct list_head *queue, *iter;
+        struct dlm_lock *lock;
+
+        assert_spin_locked(&res->spinlock);
+
+        ret = -EINVAL;
+        if (res->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+                mlog(0, "cannot migrate lockres with unknown owner!\n");
+                goto leave;
+        }
+
+        if (res->owner != dlm->node_num) {
+                mlog(0, "cannot migrate lockres this node doesn't own!\n");
+                goto leave;
+        }
+
+        ret = 0;
+        queue = &res->granted;
+        for (i = 0; i < 3; i++) {
+                list_for_each(iter, queue) {
+                        lock = list_entry(iter, struct dlm_lock, list);
+                        ++count;
+                        if (lock->ml.node == dlm->node_num) {
+                                mlog(0, "found a lock owned by this node still "
+                                     "on the %s queue!  will not migrate this "
+                                     "lockres\n", (i == 0 ? "granted" :
+                                                   (i == 1 ? "converting" :
+                                                    "blocked")));
+                                ret = -ENOTEMPTY;
+                                goto leave;
+                        }
+                }
+                queue++;
+        }
+
+        *numlocks = count;
+        mlog(0, "migrateable lockres having %d locks\n", *numlocks);
+
+leave:
+        return ret;
+}
 
 /*
  * DLM_MIGRATE_LOCKRES
@@ -2437,14 +2488,12 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
         struct dlm_master_list_entry *mle = NULL;
         struct dlm_master_list_entry *oldmle = NULL;
         struct dlm_migratable_lockres *mres = NULL;
-        int ret = -EINVAL;
+        int ret = 0;
         const char *name;
         unsigned int namelen;
         int mle_added = 0;
-        struct list_head *queue, *iter;
-        int i;
-        struct dlm_lock *lock;
-        int empty = 1, wake = 0;
+        int numlocks;
+        int wake = 0;
 
         if (!dlm_grab(dlm))
                 return -EINVAL;
@@ -2458,42 +2507,16 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
          * ensure this lockres is a proper candidate for migration
          */
         spin_lock(&res->spinlock);
-        if (res->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
-                mlog(0, "cannot migrate lockres with unknown owner!\n");
-                spin_unlock(&res->spinlock);
-                goto leave;
-        }
-        if (res->owner != dlm->node_num) {
-                mlog(0, "cannot migrate lockres this node doesn't own!\n");
+        ret = dlm_is_lockres_migrateable(dlm, res, &numlocks);
+        if (ret < 0) {
                 spin_unlock(&res->spinlock);
                 goto leave;
         }
-        mlog(0, "checking queues...\n");
-        queue = &res->granted;
-        for (i=0; i<3; i++) {
-                list_for_each(iter, queue) {
-                        lock = list_entry (iter, struct dlm_lock, list);
-                        empty = 0;
-                        if (lock->ml.node == dlm->node_num) {
-                                mlog(0, "found a lock owned by this node "
-                                     "still on the %s queue!  will not "
-                                     "migrate this lockres\n",
-                                     i==0 ? "granted" :
-                                     (i==1 ? "converting" : "blocked"));
-                                spin_unlock(&res->spinlock);
-                                ret = -ENOTEMPTY;
-                                goto leave;
-                        }
-                }
-                queue++;
-        }
-        mlog(0, "all locks on this lockres are nonlocal.  continuing\n");
         spin_unlock(&res->spinlock);
 
         /* no work to do */
-        if (empty) {
+        if (numlocks == 0) {
                 mlog(0, "no locks were found on this lockres! done!\n");
-                ret = 0;
                 goto leave;
         }
 
@@ -2729,6 +2752,7 @@ int dlm_empty_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
 {
         int ret;
         int lock_dropped = 0;
+        int numlocks;
 
         spin_lock(&res->spinlock);
         if (res->owner != dlm->node_num) {
@@ -2740,6 +2764,13 @@ int dlm_empty_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
                 spin_unlock(&res->spinlock);
                 goto leave;
         }
+
+        /* No need to migrate a lockres having no locks */
+        ret = dlm_is_lockres_migrateable(dlm, res, &numlocks);
+        if (ret >= 0 && numlocks == 0) {
+                spin_unlock(&res->spinlock);
+                goto leave;
+        }
         spin_unlock(&res->spinlock);
 
         /* Wheee! Migrate lockres here! Will sleep so drop spinlock. */
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 6421a8fae1de..2b264c6ba039 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -256,20 +256,14 @@ static void dlm_run_purge_list(struct dlm_ctxt *dlm,
                         break;
                 }
 
-                mlog(0, "removing lockres %.*s:%p from purgelist\n",
-                     lockres->lockname.len, lockres->lockname.name, lockres);
-                list_del_init(&lockres->purge);
-                dlm_lockres_put(lockres);
-                dlm->purge_count--;
+                dlm_lockres_get(lockres);
 
                 /* This may drop and reacquire the dlm spinlock if it
                  * has to do migration. */
-                mlog(0, "calling dlm_purge_lockres!\n");
-                dlm_lockres_get(lockres);
                 if (dlm_purge_lockres(dlm, lockres))
                         BUG();
+
                 dlm_lockres_put(lockres);
-                mlog(0, "DONE calling dlm_purge_lockres!\n");
 
                 /* Avoid adding any scheduling latencies */
                 cond_resched_lock(&dlm->spinlock);
diff --git a/fs/proc/Makefile b/fs/proc/Makefile
index a6b3a8f878f0..bce38e3f06cb 100644
--- a/fs/proc/Makefile
+++ b/fs/proc/Makefile
@@ -8,8 +8,9 @@ proc-y			:= nommu.o task_nommu.o
 proc-$(CONFIG_MMU)      := mmu.o task_mmu.o
 
 proc-y       += inode.o root.o base.o generic.o array.o \
-                proc_tty.o proc_misc.o proc_sysctl.o
+                proc_tty.o proc_misc.o
 
+proc-$(CONFIG_PROC_SYSCTL)      += proc_sysctl.o
 proc-$(CONFIG_PROC_KCORE)       += kcore.o
 proc-$(CONFIG_PROC_VMCORE)      += vmcore.o
 proc-$(CONFIG_PROC_DEVICETREE)  += proc_devtree.o
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index c932aa65e198..f771889183c3 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -11,7 +11,11 @@
 
 #include <linux/proc_fs.h>
 
+#ifdef CONFIG_PROC_SYSCTL
 extern int proc_sys_init(void);
+#else
+static inline void proc_sys_init(void) { }
+#endif
 
 struct vmalloc_info {
         unsigned long   used;
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 5834a744c2a9..41f17037f738 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -79,9 +79,7 @@ void __init proc_root_init(void)
         proc_device_tree_init();
 #endif
         proc_bus = proc_mkdir("bus", NULL);
-#ifdef CONFIG_SYSCTL
         proc_sys_init();
-#endif
 }
 
 static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
diff --git a/fs/reiserfs/item_ops.c b/fs/reiserfs/item_ops.c
index b9b423b22a8b..9475557ab499 100644
--- a/fs/reiserfs/item_ops.c
+++ b/fs/reiserfs/item_ops.c
@@ -23,7 +23,7 @@ static void sd_decrement_key(struct cpu_key *key)
 {
         key->on_disk_key.k_objectid--;
         set_cpu_key_k_type(key, TYPE_ANY);
-        set_cpu_key_k_offset(key, (loff_t) (-1));
+        set_cpu_key_k_offset(key, (loff_t)(~0ULL >> 1));
 }
 
 static int sd_is_left_mergeable(struct reiserfs_key *key, unsigned long bsize)
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index f01389fd162e..c8178b7b9212 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -54,82 +54,48 @@
 static struct reiserfs_xattr_handler *find_xattr_handler_prefix(const char
                                                                 *prefix);
 
-static struct dentry *create_xa_root(struct super_block *sb)
+/* Returns the dentry referring to the root of the extended attribute
+ * directory tree. If it has already been retrieved, it is used. If it
+ * hasn't been created and the flags indicate creation is allowed, we
+ * attempt to create it. On error, we return a pointer-encoded error.
+ */
+static struct dentry *get_xa_root(struct super_block *sb, int flags)
 {
         struct dentry *privroot = dget(REISERFS_SB(sb)->priv_root);
         struct dentry *xaroot;
 
         /* This needs to be created at mount-time */
         if (!privroot)
-                return ERR_PTR(-EOPNOTSUPP);
+                return ERR_PTR(-ENODATA);
 
-        xaroot = lookup_one_len(XAROOT_NAME, privroot, strlen(XAROOT_NAME));
-        if (IS_ERR(xaroot)) {
+        mutex_lock(&privroot->d_inode->i_mutex);
+        if (REISERFS_SB(sb)->xattr_root) {
+                xaroot = dget(REISERFS_SB(sb)->xattr_root);
                 goto out;
-        } else if (!xaroot->d_inode) {
-                int err;
-                mutex_lock(&privroot->d_inode->i_mutex);
-                err =
-                    privroot->d_inode->i_op->mkdir(privroot->d_inode, xaroot,
-                                                   0700);
-                mutex_unlock(&privroot->d_inode->i_mutex);
-
-                if (err) {
-                        dput(xaroot);
-                        dput(privroot);
-                        return ERR_PTR(err);
-                }
-                REISERFS_SB(sb)->xattr_root = dget(xaroot);
         }
 
-      out:
-        dput(privroot);
-        return xaroot;
-}
-
-/* This will return a dentry, or error, refering to the xa root directory.
- * If the xa root doesn't exist yet, the dentry will be returned without
- * an associated inode. This dentry can be used with ->mkdir to create
- * the xa directory. */
-static struct dentry *__get_xa_root(struct super_block *s)
-{
-        struct dentry *privroot = dget(REISERFS_SB(s)->priv_root);
-        struct dentry *xaroot = NULL;
-
-        if (IS_ERR(privroot) || !privroot)
-                return privroot;
-
         xaroot = lookup_one_len(XAROOT_NAME, privroot, strlen(XAROOT_NAME));
         if (IS_ERR(xaroot)) {
                 goto out;
         } else if (!xaroot->d_inode) {
-                dput(xaroot);
-                xaroot = NULL;
-                goto out;
+                int err = -ENODATA;
+                if (flags == 0 || flags & XATTR_CREATE)
+                        err = privroot->d_inode->i_op->mkdir(privroot->d_inode,
+                                                             xaroot, 0700);
+                if (err) {
+                        dput(xaroot);
+                        xaroot = ERR_PTR(err);
+                        goto out;
+                }
         }
-
-        REISERFS_SB(s)->xattr_root = dget(xaroot);
+        REISERFS_SB(sb)->xattr_root = dget(xaroot);
 
       out:
+        mutex_unlock(&privroot->d_inode->i_mutex);
         dput(privroot);
         return xaroot;
 }
 
-/* Returns the dentry (or NULL) referring to the root of the extended
- * attribute directory tree. If it has already been retrieved, it is used.
- * Otherwise, we attempt to retrieve it from disk. It may also return
- * a pointer-encoded error.
- */
-static inline struct dentry *get_xa_root(struct super_block *s)
-{
-        struct dentry *dentry = dget(REISERFS_SB(s)->xattr_root);
-
-        if (!dentry)
-                dentry = __get_xa_root(s);
-
-        return dentry;
-}
-
 /* Opens the directory corresponding to the inode's extended attribute store.
  * If flags allow, the tree to the directory may be created. If creation is
  * prohibited, -ENODATA is returned. */
@@ -138,21 +104,11 @@ static struct dentry *open_xa_dir(const struct inode *inode, int flags)
         struct dentry *xaroot, *xadir;
         char namebuf[17];
 
-        xaroot = get_xa_root(inode->i_sb);
-        if (IS_ERR(xaroot)) {
+        xaroot = get_xa_root(inode->i_sb, flags);
+        if (IS_ERR(xaroot))
                 return xaroot;
-        } else if (!xaroot) {
-                if (flags == 0 || flags & XATTR_CREATE) {
-                        xaroot = create_xa_root(inode->i_sb);
-                        if (IS_ERR(xaroot))
-                                return xaroot;
-                }
-                if (!xaroot)
-                        return ERR_PTR(-ENODATA);
-        }
 
         /* ok, we have xaroot open */
-
         snprintf(namebuf, sizeof(namebuf), "%X.%X",
                  le32_to_cpu(INODE_PKEY(inode)->k_objectid),
                  inode->i_generation);
@@ -821,7 +777,7 @@ int reiserfs_delete_xattrs(struct inode *inode)
 
         /* Leftovers besides . and .. -- that's not good. */
         if (dir->d_inode->i_nlink <= 2) {
-                root = get_xa_root(inode->i_sb);
+                root = get_xa_root(inode->i_sb, XATTR_REPLACE);
                 reiserfs_write_lock_xattrs(inode->i_sb);
                 err = vfs_rmdir(root->d_inode, dir);
                 reiserfs_write_unlock_xattrs(inode->i_sb);
diff --git a/fs/splice.c b/fs/splice.c
index 2fca6ebf4cc2..5428b0ff3b6f 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -576,76 +576,21 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
         if (this_len + offset > PAGE_CACHE_SIZE)
                 this_len = PAGE_CACHE_SIZE - offset;
 
-        /*
-         * Reuse buf page, if SPLICE_F_MOVE is set and we are doing a full
-         * page.
-         */
-        if ((sd->flags & SPLICE_F_MOVE) && this_len == PAGE_CACHE_SIZE) {
-                /*
-                 * If steal succeeds, buf->page is now pruned from the
-                 * pagecache and we can reuse it. The page will also be
-                 * locked on successful return.
-                 */
-                if (buf->ops->steal(pipe, buf))
-                        goto find_page;
-
-                page = buf->page;
-                if (add_to_page_cache(page, mapping, index, GFP_KERNEL)) {
-                        unlock_page(page);
-                        goto find_page;
-                }
-
-                page_cache_get(page);
-
-                if (!(buf->flags & PIPE_BUF_FLAG_LRU))
-                        lru_cache_add(page);
-        } else {
 find_page:
-                page = find_lock_page(mapping, index);
-                if (!page) {
-                        ret = -ENOMEM;
-                        page = page_cache_alloc_cold(mapping);
-                        if (unlikely(!page))
-                                goto out_ret;
-
-                        /*
-                         * This will also lock the page
-                         */
-                        ret = add_to_page_cache_lru(page, mapping, index,
-                                                    GFP_KERNEL);
-                        if (unlikely(ret))
-                                goto out;
-                }
+        page = find_lock_page(mapping, index);
+        if (!page) {
+                ret = -ENOMEM;
+                page = page_cache_alloc_cold(mapping);
+                if (unlikely(!page))
+                        goto out_ret;
 
                 /*
-                 * We get here with the page locked. If the page is also
-                 * uptodate, we don't need to do more. If it isn't, we
-                 * may need to bring it in if we are not going to overwrite
-                 * the full page.
+                 * This will also lock the page
                  */
-                if (!PageUptodate(page)) {
-                        if (this_len < PAGE_CACHE_SIZE) {
-                                ret = mapping->a_ops->readpage(file, page);
-                                if (unlikely(ret))
-                                        goto out;
-
-                                lock_page(page);
-
-                                if (!PageUptodate(page)) {
-                                        /*
-                                         * Page got invalidated, repeat.
-                                         */
-                                        if (!page->mapping) {
-                                                unlock_page(page);
-                                                page_cache_release(page);
-                                                goto find_page;
-                                        }
-                                        ret = -EIO;
-                                        goto out;
-                                }
-                        } else
-                                SetPageUptodate(page);
-                }
+                ret = add_to_page_cache_lru(page, mapping, index,
+                                            GFP_KERNEL);
+                if (unlikely(ret))
+                        goto out;
         }
 
         ret = mapping->a_ops->prepare_write(file, page, offset, offset+this_len);
@@ -682,18 +627,25 @@ find_page:
         }
 
         ret = mapping->a_ops->commit_write(file, page, offset, offset+this_len);
-        if (!ret) {
+        if (ret) {
+                if (ret == AOP_TRUNCATED_PAGE) {
+                        page_cache_release(page);
+                        goto find_page;
+                }
+                if (ret < 0)
+                        goto out;
                 /*
-                 * Return the number of bytes written and mark page as
-                 * accessed, we are now done!
+                 * Partial write has happened, so 'ret' already initialized by
+                 * number of bytes written, Where is nothing we have to do here.
                  */
+        } else
                 ret = this_len;
-                mark_page_accessed(page);
-                balance_dirty_pages_ratelimited(mapping);
-        } else if (ret == AOP_TRUNCATED_PAGE) {
-                page_cache_release(page);
-                goto find_page;
-        }
+        /*
+         * Return the number of bytes written and mark page as
+         * accessed, we are now done!
+         */
+        mark_page_accessed(page);
+        balance_dirty_pages_ratelimited(mapping);
 out:
         page_cache_release(page);
         unlock_page(page);
@@ -706,9 +658,9 @@ out_ret:
  * key here is the 'actor' worker passed in that actually moves the data
  * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
  */
-static ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
-                                  struct file *out, loff_t *ppos, size_t len,
-                                  unsigned int flags, splice_actor *actor)
+ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
+                           struct file *out, loff_t *ppos, size_t len,
+                           unsigned int flags, splice_actor *actor)
 {
         int ret, do_wakeup, err;
         struct splice_desc sd;
@@ -802,6 +754,7 @@ static ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
 
         return ret;
 }
+EXPORT_SYMBOL(__splice_from_pipe);
 
 ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                          loff_t *ppos, size_t len, unsigned int flags,
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 013d7afe7cde..f18b79122fa3 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -601,7 +601,7 @@ static void ufs_set_inode_ops(struct inode *inode)
                                    ufs_get_inode_dev(inode->i_sb, UFS_I(inode)));
 }
 
-static void ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
+static int ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
 {
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
@@ -613,8 +613,10 @@ static void ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
          */
         inode->i_mode = mode = fs16_to_cpu(sb, ufs_inode->ui_mode);
         inode->i_nlink = fs16_to_cpu(sb, ufs_inode->ui_nlink);
-        if (inode->i_nlink == 0)
+        if (inode->i_nlink == 0) {
                 ufs_error (sb, "ufs_read_inode", "inode %lu has zero nlink\n", inode->i_ino);
+                return -1;
+        }
         
         /*
          * Linux now has 32-bit uid and gid, so we can support EFT.
@@ -643,9 +645,10 @@ static void ufs1_read_inode(struct inode *inode, struct ufs_inode *ufs_inode)
                 for (i = 0; i < (UFS_NDADDR + UFS_NINDIR) * 4; i++)
                         ufsi->i_u1.i_symlink[i] = ufs_inode->ui_u2.ui_symlink[i];
         }
+        return 0;
 }
 
-static void ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
+static int ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
 {
         struct ufs_inode_info *ufsi = UFS_I(inode);
         struct super_block *sb = inode->i_sb;
@@ -658,8 +661,10 @@ static void ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
          */
         inode->i_mode = mode = fs16_to_cpu(sb, ufs2_inode->ui_mode);
         inode->i_nlink = fs16_to_cpu(sb, ufs2_inode->ui_nlink);
-        if (inode->i_nlink == 0)
+        if (inode->i_nlink == 0) {
                 ufs_error (sb, "ufs_read_inode", "inode %lu has zero nlink\n", inode->i_ino);
+                return -1;
+        }
 
         /*
          * Linux now has 32-bit uid and gid, so we can support EFT.
@@ -690,6 +695,7 @@ static void ufs2_read_inode(struct inode *inode, struct ufs2_inode *ufs2_inode)
                 for (i = 0; i < (UFS_NDADDR + UFS_NINDIR) * 4; i++)
                         ufsi->i_u1.i_symlink[i] = ufs2_inode->ui_u2.ui_symlink[i];
         }
+        return 0;
 }
 
 void ufs_read_inode(struct inode * inode)
@@ -698,6 +704,7 @@ void ufs_read_inode(struct inode * inode)
         struct super_block * sb;
         struct ufs_sb_private_info * uspi;
         struct buffer_head * bh;
+        int err;
 
         UFSD("ENTER, ino %lu\n", inode->i_ino);
 
@@ -720,14 +727,17 @@ void ufs_read_inode(struct inode * inode)
         if ((UFS_SB(sb)->s_flags & UFS_TYPE_MASK) == UFS_TYPE_UFS2) {
                 struct ufs2_inode *ufs2_inode = (struct ufs2_inode *)bh->b_data;
 
-                ufs2_read_inode(inode,
-                                ufs2_inode + ufs_inotofsbo(inode->i_ino));
+                err = ufs2_read_inode(inode,
+                                      ufs2_inode + ufs_inotofsbo(inode->i_ino));
         } else {
                 struct ufs_inode *ufs_inode = (struct ufs_inode *)bh->b_data;
 
-                ufs1_read_inode(inode, ufs_inode + ufs_inotofsbo(inode->i_ino));
+                err = ufs1_read_inode(inode,
+                                      ufs_inode + ufs_inotofsbo(inode->i_ino));
         }
 
+        if (err)
+                goto bad_inode;
         inode->i_version++;
         ufsi->i_lastfrag =
                 (inode->i_size + uspi->s_fsize - 1) >> uspi->s_fshift;
@@ -888,6 +898,8 @@ void ufs_delete_inode (struct inode * inode)
         loff_t old_i_size;
 
         truncate_inode_pages(&inode->i_data, 0);
+        if (is_bad_inode(inode))
+                goto no_delete;
         /*UFS_I(inode)->i_dtime = CURRENT_TIME;*/
         lock_kernel();
         mark_inode_dirty(inode);
@@ -898,4 +910,7 @@ void ufs_delete_inode (struct inode * inode)
                 ufs_warning(inode->i_sb, __FUNCTION__, "ufs_truncate failed\n");
         ufs_free_inode (inode);
         unlock_kernel();
+        return;
+no_delete:
+        clear_inode(inode);     /* We must guarantee clearing of inode... */
 }
diff --git a/include/asm-alpha/compiler.h b/include/asm-alpha/compiler.h
index d2768cc3d7a4..da6bb199839c 100644
--- a/include/asm-alpha/compiler.h
+++ b/include/asm-alpha/compiler.h
@@ -17,9 +17,6 @@
 # define __kernel_extbl(val, shift)     __builtin_alpha_extbl(val, shift)
 # define __kernel_extwl(val, shift)     __builtin_alpha_extwl(val, shift)
 # define __kernel_cmpbge(a, b)          __builtin_alpha_cmpbge(a, b)
-# define __kernel_cttz(x)               __builtin_ctzl(x)
-# define __kernel_ctlz(x)               __builtin_clzl(x)
-# define __kernel_ctpop(x)              __builtin_popcountl(x)
 #else
 # define __kernel_insbl(val, shift)                                     \
   ({ unsigned long __kir;                                               \
@@ -49,17 +46,39 @@
   ({ unsigned long __kir;                                               \
      __asm__("cmpbge %r2,%1,%0" : "=r"(__kir) : "rI"(b), "rJ"(a));      \
      __kir; })
+#endif
+
+#ifdef __alpha_cix__
+# if __GNUC__ == 3 && __GNUC_MINOR__ >= 4 || __GNUC__ > 3
+#  define __kernel_cttz(x)              __builtin_ctzl(x)
+#  define __kernel_ctlz(x)              __builtin_clzl(x)
+#  define __kernel_ctpop(x)             __builtin_popcountl(x)
+# else
+#  define __kernel_cttz(x)                                              \
+   ({ unsigned long __kir;                                              \
+      __asm__("cttz %1,%0" : "=r"(__kir) : "r"(x));                     \
+      __kir; })
+#  define __kernel_ctlz(x)                                              \
+   ({ unsigned long __kir;                                              \
+      __asm__("ctlz %1,%0" : "=r"(__kir) : "r"(x));                     \
+      __kir; })
+#  define __kernel_ctpop(x)                                             \
+   ({ unsigned long __kir;                                              \
+      __asm__("ctpop %1,%0" : "=r"(__kir) : "r"(x));                    \
+      __kir; })
+# endif
+#else
 # define __kernel_cttz(x)                                               \
   ({ unsigned long __kir;                                               \
-     __asm__("cttz %1,%0" : "=r"(__kir) : "r"(x));                      \
+     __asm__(".arch ev67; cttz %1,%0" : "=r"(__kir) : "r"(x));          \
      __kir; })
 # define __kernel_ctlz(x)                                               \
   ({ unsigned long __kir;                                               \
-     __asm__("ctlz %1,%0" : "=r"(__kir) : "r"(x));                      \
+     __asm__(".arch ev67; ctlz %1,%0" : "=r"(__kir) : "r"(x));          \
      __kir; })
 # define __kernel_ctpop(x)                                              \
   ({ unsigned long __kir;                                               \
-     __asm__("ctpop %1,%0" : "=r"(__kir) : "r"(x));                     \
+     __asm__(".arch ev67; ctpop %1,%0" : "=r"(__kir) : "r"(x));         \
      __kir; })
 #endif
 
@@ -78,16 +97,20 @@
 #else
 #define __kernel_ldbu(mem)                              \
   ({ unsigned char __kir;                               \
-     __asm__("ldbu %0,%1" : "=r"(__kir) : "m"(mem));    \
+     __asm__(".arch ev56;                               \
+              ldbu %0,%1" : "=r"(__kir) : "m"(mem));    \
      __kir; })
 #define __kernel_ldwu(mem)                              \
   ({ unsigned short __kir;                              \
-     __asm__("ldwu %0,%1" : "=r"(__kir) : "m"(mem));    \
+     __asm__(".arch ev56;                               \
+              ldwu %0,%1" : "=r"(__kir) : "m"(mem));    \
      __kir; })
-#define __kernel_stb(val,mem) \
-  __asm__("stb %1,%0" : "=m"(mem) : "r"(val))
-#define __kernel_stw(val,mem) \
-  __asm__("stw %1,%0" : "=m"(mem) : "r"(val))
+#define __kernel_stb(val,mem)                           \
+  __asm__(".arch ev56;                                  \
+           stb %1,%0" : "=m"(mem) : "r"(val))
+#define __kernel_stw(val,mem)                           \
+  __asm__(".arch ev56;                                  \
+           stw %1,%0" : "=m"(mem) : "r"(val))
 #endif
 
 #ifdef __KERNEL__
diff --git a/include/asm-alpha/core_mcpcia.h b/include/asm-alpha/core_mcpcia.h
index 980a3c51b18e..525b4f6a7ace 100644
--- a/include/asm-alpha/core_mcpcia.h
+++ b/include/asm-alpha/core_mcpcia.h
@@ -72,6 +72,8 @@
  *
  */
 
+#define MCPCIA_MAX_HOSES 4
+
 #define MCPCIA_MID(m)           ((unsigned long)(m) << 33)
 
 /* Dodge has PCI0 and PCI1 at MID 4 and 5 respectively. 
diff --git a/include/asm-alpha/io.h b/include/asm-alpha/io.h
index 24bdcc8b63aa..21a86f1a05b3 100644
--- a/include/asm-alpha/io.h
+++ b/include/asm-alpha/io.h
@@ -113,6 +113,7 @@ static inline unsigned long virt_to_bus(void *address)
         unsigned long bus = phys + __direct_map_base;
         return phys <= __direct_map_size ? bus : 0;
 }
+#define isa_virt_to_bus virt_to_bus
 
 static inline void *bus_to_virt(unsigned long address)
 {
diff --git a/include/asm-arm/arch-ixp4xx/io.h b/include/asm-arm/arch-ixp4xx/io.h
index b7b5414d9320..a41ba229c564 100644
--- a/include/asm-arm/arch-ixp4xx/io.h
+++ b/include/asm-arm/arch-ixp4xx/io.h
@@ -238,23 +238,6 @@ __ixp4xx_readsl(const volatile void __iomem *bus_addr, u32 *vaddr, u32 count)
 #define memcpy_fromio(a,c,l)            _memcpy_fromio((a),(c),(l))
 #define memcpy_toio(c,a,l)              _memcpy_toio((c),(a),(l))
 
-static inline int
-check_signature(const unsigned char __iomem *bus_addr, const unsigned char *signature,
-                int length)
-{
-        int retval = 0;
-        do {
-                if (readb(bus_addr) != *signature)
-                        goto out;
-                bus_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 #endif
 
 #ifndef CONFIG_PCI
diff --git a/include/asm-arm/system.h b/include/asm-arm/system.h
index f06d8a43fdee..69134c7518c1 100644
--- a/include/asm-arm/system.h
+++ b/include/asm-arm/system.h
@@ -3,6 +3,7 @@
 
 #ifdef __KERNEL__
 
+#include <asm/memory.h>
 
 #define CPU_ARCH_UNKNOWN        0
 #define CPU_ARCH_ARMv3          1
@@ -154,7 +155,7 @@ extern unsigned int user_debug;
 #define vectors_high()  (0)
 #endif
 
-#if __LINUX_ARM_ARCH__ >= 6
+#if defined(CONFIG_CPU_XSC3) || __LINUX_ARM_ARCH__ >= 6
 #define isb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c5, 4" \
                                     : : "r" (0) : "memory")
 #define dsb() __asm__ __volatile__ ("mcr p15, 0, %0, c7, c10, 4" \
@@ -168,22 +169,23 @@ extern unsigned int user_debug;
 #define dmb() __asm__ __volatile__ ("" : : : "memory")
 #endif
 
-#define mb()                    barrier()
-#define rmb()                   barrier()
-#define wmb()                   barrier()
-#define read_barrier_depends()  do { } while(0)
-
-#ifdef CONFIG_SMP
-#define smp_mb()                dmb()
-#define smp_rmb()               dmb()
-#define smp_wmb()               dmb()
-#define smp_read_barrier_depends()      read_barrier_depends()
+#ifndef CONFIG_SMP
+#define mb()    do { if (arch_is_coherent()) dmb(); else barrier(); } while (0)
+#define rmb()   do { if (arch_is_coherent()) dmb(); else barrier(); } while (0)
+#define wmb()   do { if (arch_is_coherent()) dmb(); else barrier(); } while (0)
+#define smp_mb()        barrier()
+#define smp_rmb()       barrier()
+#define smp_wmb()       barrier()
 #else
-#define smp_mb()                barrier()
-#define smp_rmb()               barrier()
-#define smp_wmb()               barrier()
-#define smp_read_barrier_depends()      read_barrier_depends()
-#endif /* CONFIG_SMP */
+#define mb()            dmb()
+#define rmb()           dmb()
+#define wmb()           dmb()
+#define smp_mb()        dmb()
+#define smp_rmb()       dmb()
+#define smp_wmb()       dmb()
+#endif
+#define read_barrier_depends()          do { } while(0)
+#define smp_read_barrier_depends()      do { } while(0)
 
 #define set_mb(var, value)      do { var = value; smp_mb(); } while (0)
 #define nop() __asm__ __volatile__("mov\tr0,r0\t@ nop\n\t");
diff --git a/include/asm-arm/unistd.h b/include/asm-arm/unistd.h
index 0991b7bc3f78..c025ab47e4b9 100644
--- a/include/asm-arm/unistd.h
+++ b/include/asm-arm/unistd.h
@@ -372,7 +372,7 @@
 #define __NR_move_pages                 (__NR_SYSCALL_BASE+344)
 #define __NR_getcpu                     (__NR_SYSCALL_BASE+345)
                                         /* 346 for epoll_pwait */
-#define __NR_sys_kexec_load             (__NR_SYSCALL_BASE+347)
+#define __NR_kexec_load                 (__NR_SYSCALL_BASE+347)
 
 /*
  * The following SWIs are ARM private.
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 00c23433b39f..6d7e279b1490 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -180,6 +180,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #ifndef __HAVE_ARCH_ENTER_LAZY_MMU_MODE
 #define arch_enter_lazy_mmu_mode()      do {} while (0)
 #define arch_leave_lazy_mmu_mode()      do {} while (0)
+#define arch_flush_lazy_mmu_mode()      do {} while (0)
 #endif
 
 /*
@@ -193,6 +194,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #ifndef __HAVE_ARCH_ENTER_LAZY_CPU_MODE
 #define arch_enter_lazy_cpu_mode()      do {} while (0)
 #define arch_leave_lazy_cpu_mode()      do {} while (0)
+#define arch_flush_lazy_cpu_mode()      do {} while (0)
 #endif
 
 /*
diff --git a/include/asm-i386/cpufeature.h b/include/asm-i386/cpufeature.h
index 3f92b94e0d75..d1b8e4ab6c1a 100644
--- a/include/asm-i386/cpufeature.h
+++ b/include/asm-i386/cpufeature.h
@@ -75,6 +75,7 @@
 #define X86_FEATURE_ARCH_PERFMON (3*32+11) /* Intel Architectural PerfMon */
 #define X86_FEATURE_PEBS        (3*32+12)  /* Precise-Event Based Sampling */
 #define X86_FEATURE_BTS         (3*32+13)  /* Branch Trace Store */
+#define X86_FEATURE_LAPIC_TIMER_BROKEN (3*32+ 14) /* lapic timer broken in C1 */
 
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3        (4*32+ 0) /* Streaming SIMD Extensions-3 */
diff --git a/include/asm-i386/msr.h b/include/asm-i386/msr.h
index ec3b6803fd36..2ad3f30b1a68 100644
--- a/include/asm-i386/msr.h
+++ b/include/asm-i386/msr.h
@@ -275,6 +275,8 @@ static inline void wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 #define MSR_K7_FID_VID_CTL              0xC0010041
 #define MSR_K7_FID_VID_STATUS           0xC0010042
 
+#define MSR_K8_ENABLE_C1E               0xC0010055
+
 /* extended feature register */
 #define MSR_EFER                        0xc0000080
 
diff --git a/include/asm-i386/paravirt.h b/include/asm-i386/paravirt.h
index 46dc34ca887a..e63f1e444fcf 100644
--- a/include/asm-i386/paravirt.h
+++ b/include/asm-i386/paravirt.h
@@ -421,14 +421,17 @@ static inline void pmd_clear(pmd_t *pmdp)
 #define PARAVIRT_LAZY_NONE 0
 #define PARAVIRT_LAZY_MMU  1
 #define PARAVIRT_LAZY_CPU  2
+#define PARAVIRT_LAZY_FLUSH 3
 
 #define  __HAVE_ARCH_ENTER_LAZY_CPU_MODE
 #define arch_enter_lazy_cpu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_CPU)
 #define arch_leave_lazy_cpu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_NONE)
+#define arch_flush_lazy_cpu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_FLUSH)
 
 #define  __HAVE_ARCH_ENTER_LAZY_MMU_MODE
 #define arch_enter_lazy_mmu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_MMU)
 #define arch_leave_lazy_mmu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_NONE)
+#define arch_flush_lazy_mmu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_FLUSH)
 
 /* These all sit in the .parainstructions section to tell us what to patch. */
 struct paravirt_patch {
diff --git a/include/asm-i386/termbits.h b/include/asm-i386/termbits.h
index 12baf1d6343f..2e6237693814 100644
--- a/include/asm-i386/termbits.h
+++ b/include/asm-i386/termbits.h
@@ -144,7 +144,7 @@ struct ktermios {
 #define  B3000000 0010015
 #define  B3500000 0010016
 #define  B4000000 0010017
-#define CIBAUD    002003600000  /* input baud rate (not used) */
+#define CIBAUD    002003600000
 #define CMSPAR    010000000000          /* mark or space (stick) parity */
 #define CRTSCTS   020000000000          /* flow control */
 
diff --git a/include/asm-ia64/processor.h b/include/asm-ia64/processor.h
index 5830d36fd8e6..4f4ee1c2db2f 100644
--- a/include/asm-ia64/processor.h
+++ b/include/asm-ia64/processor.h
@@ -210,7 +210,7 @@ struct desc_struct {
         unsigned int a, b;
 };
 
-#define desc_empty(desc)                (!((desc)->a + (desc)->b))
+#define desc_empty(desc)                (!((desc)->a | (desc)->b))
 #define desc_equal(desc1, desc2)        (((desc1)->a == (desc2)->a) && ((desc1)->b == (desc2)->b))
 
 #define GDT_ENTRY_TLS_ENTRIES   3
diff --git a/include/asm-ia64/sn/pcibr_provider.h b/include/asm-ia64/sn/pcibr_provider.h
index 17cb6cc3f21a..da205b7cdaac 100644
--- a/include/asm-ia64/sn/pcibr_provider.h
+++ b/include/asm-ia64/sn/pcibr_provider.h
@@ -21,6 +21,7 @@
 #define IS_PCI_BRIDGE_ASIC(asic) (asic == PCIIO_ASIC_TYPE_PIC || \
                 asic == PCIIO_ASIC_TYPE_TIOCP)
 #define IS_PIC_SOFT(ps)     (ps->pbi_bridge_type == PCIBR_BRIDGETYPE_PIC)
+#define IS_TIOCP_SOFT(ps)   (ps->pbi_bridge_type == PCIBR_BRIDGETYPE_TIOCP)
 
 
 /*
@@ -53,8 +54,8 @@
  * Bridge PMU Address Transaltion Entry Attibutes
  */
 #define PCI32_ATE_V                     (0x1 << 0)
-#define PCI32_ATE_CO                    (0x1 << 1)
-#define PCI32_ATE_PREC                  (0x1 << 2)
+#define PCI32_ATE_CO                    (0x1 << 1)      /* PIC ASIC ONLY */
+#define PCI32_ATE_PIO                   (0x1 << 1)      /* TIOCP ASIC ONLY */
 #define PCI32_ATE_MSI                   (0x1 << 2)
 #define PCI32_ATE_PREF                  (0x1 << 3)
 #define PCI32_ATE_BAR                   (0x1 << 4)
diff --git a/include/asm-mips/bug.h b/include/asm-mips/bug.h
index 4d560a533940..7eb63de808bc 100644
--- a/include/asm-mips/bug.h
+++ b/include/asm-mips/bug.h
@@ -18,7 +18,8 @@ do {									\
 
 #define BUG_ON(condition)                                               \
 do {                                                                    \
-        __asm__ __volatile__("tne $0, %0" : : "r" (condition));         \
+        __asm__ __volatile__("tne $0, %0, %1"                           \
+                             : : "r" (condition), "i" (BRK_BUG));       \
 } while (0)
 
 #define HAVE_ARCH_BUG_ON
diff --git a/include/asm-mips/checksum.h b/include/asm-mips/checksum.h
index 20a81e1548f5..290485ac5407 100644
--- a/include/asm-mips/checksum.h
+++ b/include/asm-mips/checksum.h
@@ -166,7 +166,7 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr,
 #else
           "r" (proto + len),
 #endif
-          "r" (sum));
+          "r" ((__force unsigned long)sum));
 
         return sum;
 }
diff --git a/include/asm-mips/fpu.h b/include/asm-mips/fpu.h
index 4e12d1f9534f..b414a7d9db43 100644
--- a/include/asm-mips/fpu.h
+++ b/include/asm-mips/fpu.h
@@ -68,8 +68,6 @@ do {									\
         /* We don't care about the c0 hazard here  */                   \
 } while (0)
 
-#define __fpu_enabled() (read_c0_status() & ST0_CU1)
-
 #define enable_fpu()                                                    \
 do {                                                                    \
         if (cpu_has_fpu)                                                \
@@ -102,14 +100,19 @@ static inline void __own_fpu(void)
         set_thread_flag(TIF_USEDFPU);
 }
 
-static inline void own_fpu(int restore)
+static inline void own_fpu_inatomic(int restore)
 {
-        preempt_disable();
         if (cpu_has_fpu && !__is_fpu_owner()) {
                 __own_fpu();
                 if (restore)
                         _restore_fp(current);
         }
+}
+
+static inline void own_fpu(int restore)
+{
+        preempt_disable();
+        own_fpu_inatomic(restore);
         preempt_enable();
 }
 
@@ -162,18 +165,4 @@ static inline fpureg_t *get_fpu_regs(struct task_struct *tsk)
         return tsk->thread.fpu.fpr;
 }
 
-static inline void enable_fp_in_kernel(void)
-{
-        set_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
-        /* make sure CU1 and FPU ownership are consistent */
-        if (!__is_fpu_owner() && __fpu_enabled())
-                __disable_fpu();
-}
-
-static inline void disable_fp_in_kernel(void)
-{
-        BUG_ON(!__is_fpu_owner() && __fpu_enabled());
-        clear_thread_flag(TIF_ALLOW_FP_IN_KERNEL);
-}
-
 #endif /* _ASM_FPU_H */
diff --git a/include/asm-mips/irqflags.h b/include/asm-mips/irqflags.h
index af3b07dfad4b..e459fa05db83 100644
--- a/include/asm-mips/irqflags.h
+++ b/include/asm-mips/irqflags.h
@@ -13,29 +13,9 @@
 
 #ifndef __ASSEMBLY__
 
+#include <linux/compiler.h>
 #include <asm/hazards.h>
 
-/*
- * CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY does prompt replay of deferred IPIs,
- * at the cost of branch and call overhead on each local_irq_restore()
- */
-
-#ifdef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
-
-extern void smtc_ipi_replay(void);
-
-#define irq_restore_epilog(flags)                               \
-do {                                                            \
-        if (!(flags & 0x0400))                                  \
-                smtc_ipi_replay();                              \
-} while (0)
-
-#else
-
-#define irq_restore_epilog(ignore) do { } while (0)
-
-#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
-
 __asm__ (
         "       .macro  raw_local_irq_enable                            \n"
         "       .set    push                                            \n"
@@ -205,17 +185,28 @@ __asm__ (
         "       .set    pop                                             \n"
         "       .endm                                                   \n");
 
-#define raw_local_irq_restore(flags)                                    \
-do {                                                                    \
-        unsigned long __tmp1;                                           \
-                                                                        \
-        __asm__ __volatile__(                                           \
-                "raw_local_irq_restore\t%0"                             \
-                : "=r" (__tmp1)                                         \
-                : "0" (flags)                                           \
-                : "memory");                                            \
-        irq_restore_epilog(flags);                                      \
-} while(0)
+extern void smtc_ipi_replay(void);
+
+static inline void raw_local_irq_restore(unsigned long flags)
+{
+        unsigned long __tmp1;
+
+#ifdef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
+        /*
+         * CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY does prompt replay of deferred
+         * IPIs, at the cost of branch and call overhead on each
+         * local_irq_restore()
+         */
+        if (unlikely(!(flags & 0x0400)))
+                smtc_ipi_replay();
+#endif
+
+        __asm__ __volatile__(
+                "raw_local_irq_restore\t%0"
+                : "=r" (__tmp1)
+                : "0" (flags)
+                : "memory");
+}
 
 static inline int raw_irqs_disabled_flags(unsigned long flags)
 {
diff --git a/include/asm-mips/marvell.h b/include/asm-mips/marvell.h
index df94955b098a..b6144bafc565 100644
--- a/include/asm-mips/marvell.h
+++ b/include/asm-mips/marvell.h
@@ -54,5 +54,6 @@ struct mv_pci_controller {
 };
 
 extern void ll_mv64340_irq(void);
+extern void mv64340_irq_init(unsigned int base);
 
 #endif  /* __ASM_MIPS_MARVELL_H */
diff --git a/include/asm-mips/sibyte/sb1250_scd.h b/include/asm-mips/sibyte/sb1250_scd.h
index 7ed0bb611e56..b6a7d8f6ced5 100644
--- a/include/asm-mips/sibyte/sb1250_scd.h
+++ b/include/asm-mips/sibyte/sb1250_scd.h
@@ -84,6 +84,7 @@
 #define K_SYS_REVISION_BCM112x_A2       0x21
 #define K_SYS_REVISION_BCM112x_A3       0x22
 #define K_SYS_REVISION_BCM112x_A4       0x23
+#define K_SYS_REVISION_BCM112x_B0       0x30
 
 #define K_SYS_REVISION_BCM1480_S0       0x01
 #define K_SYS_REVISION_BCM1480_A1       0x02
diff --git a/include/asm-mips/smtc_ipi.h b/include/asm-mips/smtc_ipi.h
index 360ea6d250c7..a52a4a7a36e0 100644
--- a/include/asm-mips/smtc_ipi.h
+++ b/include/asm-mips/smtc_ipi.h
@@ -65,12 +65,10 @@ static inline void smtc_ipi_nq(struct smtc_ipi_q *q, struct smtc_ipi *p)
         spin_unlock_irqrestore(&q->lock, flags);
 }
 
-static inline struct smtc_ipi *smtc_ipi_dq(struct smtc_ipi_q *q)
+static inline struct smtc_ipi *__smtc_ipi_dq(struct smtc_ipi_q *q)
 {
         struct smtc_ipi *p;
-        long flags;
 
-        spin_lock_irqsave(&q->lock, flags);
         if (q->head == NULL)
                 p = NULL;
         else {
@@ -81,7 +79,19 @@ static inline struct smtc_ipi *smtc_ipi_dq(struct smtc_ipi_q *q)
                 if (q->head == NULL)
                         q->tail = NULL;
         }
+
+        return p;
+}
+
+static inline struct smtc_ipi *smtc_ipi_dq(struct smtc_ipi_q *q)
+{
+        unsigned long flags;
+        struct smtc_ipi *p;
+
+        spin_lock_irqsave(&q->lock, flags);
+        p = __smtc_ipi_dq(q);
         spin_unlock_irqrestore(&q->lock, flags);
+
         return p;
 }
 
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index 6cf05f4a4e7e..fbcda8204473 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -119,7 +119,6 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
 #define TIF_FREEZE              19
-#define TIF_ALLOW_FP_IN_KERNEL  20
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
 
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
diff --git a/include/asm-powerpc/immap_qe.h b/include/asm-powerpc/immap_qe.h
index 9fdd0491f6a3..1020b7fc0129 100644
--- a/include/asm-powerpc/immap_qe.h
+++ b/include/asm-powerpc/immap_qe.h
@@ -258,8 +258,9 @@ struct ucc_slow {
         u8      uccs;           /* UCCx status register */
         u8      res3[0x24];
         __be16  utpt;
+        u8      res4[0x52];
         u8      guemr;          /* UCC general extended mode register */
-        u8      res4[0x200 - 0x091];
+        u8      res5[0x200 - 0x091];
 } __attribute__ ((packed));
 
 /* QE UCC Fast */
diff --git a/include/asm-powerpc/systbl.h b/include/asm-powerpc/systbl.h
index 8d853c554631..0b00068313f9 100644
--- a/include/asm-powerpc/systbl.h
+++ b/include/asm-powerpc/systbl.h
@@ -288,7 +288,7 @@ COMPAT_SYS(ppoll)
 SYSCALL_SPU(unshare)
 SYSCALL_SPU(splice)
 SYSCALL_SPU(tee)
-SYSCALL_SPU(vmsplice)
+COMPAT_SYS_SPU(vmsplice)
 COMPAT_SYS_SPU(openat)
 SYSCALL_SPU(mkdirat)
 SYSCALL_SPU(mknodat)
diff --git a/include/asm-s390/checksum.h b/include/asm-s390/checksum.h
index 0a3cd7ec8451..d5a8e7c1477c 100644
--- a/include/asm-s390/checksum.h
+++ b/include/asm-s390/checksum.h
@@ -121,50 +121,21 @@ csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
                    unsigned short len, unsigned short proto,
                    __wsum sum)
 {
-#ifndef __s390x__
-        asm volatile(
-                "       alr     %0,%1\n" /* sum += saddr */
-                "       brc     12,0f\n"
-                "       ahi     %0,1\n"  /* add carry */
-                "0:"
-                : "+&d" (sum) : "d" (saddr) : "cc");
-        asm volatile(
-                "       alr     %0,%1\n" /* sum += daddr */
-                "       brc     12,1f\n"
-                "       ahi     %0,1\n"  /* add carry */
-                "1:"
-                : "+&d" (sum) : "d" (daddr) : "cc");
-        asm volatile(
-                "       alr     %0,%1\n" /* sum += len + proto */
-                "       brc     12,2f\n"
-                "       ahi     %0,1\n"  /* add carry */
-                "2:"
-                : "+&d" (sum)
-                : "d" (len + proto)
-                : "cc");
-#else /* __s390x__ */
-        asm volatile(
-                "       lgfr    %0,%0\n"
-                "       algr    %0,%1\n"  /* sum += saddr */
-                "       brc     12,0f\n"
-                "       aghi    %0,1\n"   /* add carry */
-                "0:     algr    %0,%2\n"  /* sum += daddr */
-                "       brc     12,1f\n"
-                "       aghi    %0,1\n"   /* add carry */
-                "1:     algfr   %0,%3\n"  /* sum += len + proto */
-                "       brc     12,2f\n"
-                "       aghi    %0,1\n"   /* add carry */
-                "2:     srlg    0,%0,32\n"
-                "       alr     %0,0\n"   /* fold to 32 bits */
-                "       brc     12,3f\n"
-                "       ahi     %0,1\n"   /* add carry */
-                "3:     llgfr   %0,%0"
-                : "+&d" (sum)
-                : "d" (saddr), "d" (daddr),
-                  "d" (len + proto)
-                : "cc", "0");
-#endif /* __s390x__ */
-        return sum;
+        __u32 csum = (__force __u32)sum;
+
+        csum += (__force __u32)saddr;
+        if (csum < (__force __u32)saddr)
+                csum++;
+
+        csum += (__force __u32)daddr;
+        if (csum < (__force __u32)daddr)
+                csum++;
+
+        csum += len + proto;
+        if (csum < len + proto)
+                csum++;
+
+        return (__force __wsum)csum;
 }
 
 /*
diff --git a/include/asm-sh/hp6xx.h b/include/asm-sh/hp6xx.h
index f35134c159dd..53ca5643d9c7 100644
--- a/include/asm-sh/hp6xx.h
+++ b/include/asm-sh/hp6xx.h
@@ -10,9 +10,9 @@
  *
  */
 
-#define HP680_BTN_IRQ           IRQ0_IRQ
-#define HP680_TS_IRQ            IRQ3_IRQ
-#define HP680_HD64461_IRQ       IRQ4_IRQ
+#define HP680_BTN_IRQ           32            /* IRQ0_IRQ */
+#define HP680_TS_IRQ            35            /* IRQ3_IRQ */
+#define HP680_HD64461_IRQ       36            /* IRQ4_IRQ */
 
 #define DAC_LCD_BRIGHTNESS      0
 #define DAC_SPEAKER_VOLUME      1
diff --git a/include/asm-sh/system.h b/include/asm-sh/system.h
index b1e42e7f998b..4a6a19f4f8a4 100644
--- a/include/asm-sh/system.h
+++ b/include/asm-sh/system.h
@@ -7,6 +7,7 @@
  */
 
 #include <linux/irqflags.h>
+#include <linux/compiler.h>
 #include <asm/types.h>
 
 /*
diff --git a/include/asm-sparc/a.out.h b/include/asm-sparc/a.out.h
index e4e83eb0161e..9090060a23e6 100644
--- a/include/asm-sparc/a.out.h
+++ b/include/asm-sparc/a.out.h
@@ -80,7 +80,7 @@ struct relocation_info /* used when header.a_machtype == M_SPARC */
         unsigned long   r_address;  /* relocation addr */
         unsigned int    r_index:24; /* segment index or symbol index */
         unsigned int    r_extern:1; /* if F, r_index==SEG#; if T, SYM idx */
-        int             r_pad:2;    /* <unused> */
+        unsigned int    r_pad:2;    /* <unused> */
         enum reloc_type r_type:5;   /* type of relocation to perform */
         long            r_addend;   /* addend for relocation value */
 };
diff --git a/include/asm-sparc/mostek.h b/include/asm-sparc/mostek.h
index bd92a78f4937..958d0513a6d4 100644
--- a/include/asm-sparc/mostek.h
+++ b/include/asm-sparc/mostek.h
@@ -87,7 +87,7 @@ extern void __iomem *mstk48t02_regs;
 #define MSTK_DOW_MASK   0x07
 #define MSTK_DOM_MASK   0x3f
 #define MSTK_MONTH_MASK 0x1f
-#define MSTK_YEAR_MASK  0xff
+#define MSTK_YEAR_MASK  0xffU
 
 /* Binary coded decimal conversion macros. */
 #define MSTK_REGVAL_TO_DECIMAL(x)  (((x) & 0x0F) + 0x0A * ((x) >> 0x04))
diff --git a/include/asm-sparc64/a.out.h b/include/asm-sparc64/a.out.h
index 35cb5c9e0c92..eb3b8e90b279 100644
--- a/include/asm-sparc64/a.out.h
+++ b/include/asm-sparc64/a.out.h
@@ -86,7 +86,7 @@ struct relocation_info /* used when header.a_machtype == M_SPARC */
         unsigned int    r_address;  /* relocation addr */
         unsigned int    r_index:24; /* segment index or symbol index */
         unsigned int    r_extern:1; /* if F, r_index==SEG#; if T, SYM idx */
-        int             r_pad:2;    /* <unused> */
+        unsigned int    r_pad:2;    /* <unused> */
         enum reloc_type r_type:5;   /* type of relocation to perform */
         int             r_addend;   /* addend for relocation value */
 };
diff --git a/include/asm-sparc64/mostek.h b/include/asm-sparc64/mostek.h
index 09b5aba6678a..d14dd8988161 100644
--- a/include/asm-sparc64/mostek.h
+++ b/include/asm-sparc64/mostek.h
@@ -89,7 +89,7 @@ extern void __iomem *mstk48t02_regs;
 #define MSTK_DOW_MASK   0x07
 #define MSTK_DOM_MASK   0x3f
 #define MSTK_MONTH_MASK 0x1f
-#define MSTK_YEAR_MASK  0xff
+#define MSTK_YEAR_MASK  0xffU
 
 /* Binary coded decimal conversion macros. */
 #define MSTK_REGVAL_TO_DECIMAL(x)  (((x) & 0x0F) + 0x0A * ((x) >> 0x04))
diff --git a/include/asm-um/common.lds.S b/include/asm-um/common.lds.S
index f0454516dd31..f5de80c31e88 100644
--- a/include/asm-um/common.lds.S
+++ b/include/asm-um/common.lds.S
@@ -15,6 +15,7 @@
   PROVIDE (_unprotected_end = .);
 
   . = ALIGN(4096);
+  .note : { *(.note.*) }
   __start___ex_table = .;
   __ex_table : { *(__ex_table) }
   __stop___ex_table = .;
diff --git a/include/asm-um/delay.h b/include/asm-um/delay.h
index 0985bda66750..c71e32b6741e 100644
--- a/include/asm-um/delay.h
+++ b/include/asm-um/delay.h
@@ -1,9 +1,20 @@
 #ifndef __UM_DELAY_H
 #define __UM_DELAY_H
 
-#include "asm/arch/delay.h"
-#include "asm/archparam.h"
-
 #define MILLION 1000000
 
+/* Undefined on purpose */
+extern void __bad_udelay(void);
+
+extern void __udelay(unsigned long usecs);
+extern void __delay(unsigned long loops);
+
+#define udelay(n) ((__builtin_constant_p(n) && (n) > 20000) ? \
+        __bad_udelay() : __udelay(n))
+
+/* It appears that ndelay is not used at all for UML, and has never been
+ * implemented. */
+extern void __unimplemented_ndelay(void);
+#define ndelay(n) __unimplemented_ndelay()
+
 #endif
diff --git a/include/asm-um/pgtable-2level.h b/include/asm-um/pgtable-2level.h
index 6050e0eb257e..172a75fde512 100644
--- a/include/asm-um/pgtable-2level.h
+++ b/include/asm-um/pgtable-2level.h
@@ -45,12 +45,12 @@ static inline void pgd_mkuptodate(pgd_t pgd)	{ }
         ((unsigned long) __va(pmd_val(pmd) & PAGE_MASK))
 
 /*
- * Bits 0 through 3 are taken
+ * Bits 0 through 4 are taken
  */
-#define PTE_FILE_MAX_BITS       28
+#define PTE_FILE_MAX_BITS       27
 
-#define pte_to_pgoff(pte) (pte_val(pte) >> 4)
+#define pte_to_pgoff(pte) (pte_val(pte) >> 5)
 
-#define pgoff_to_pte(off) ((pte_t) { ((off) << 4) + _PAGE_FILE })
+#define pgoff_to_pte(off) ((pte_t) { ((off) << 5) + _PAGE_FILE })
 
 #endif
diff --git a/include/asm-x86_64/hw_irq.h b/include/asm-x86_64/hw_irq.h
index 2e4b7a5ed1c4..6153ae5df2e8 100644
--- a/include/asm-x86_64/hw_irq.h
+++ b/include/asm-x86_64/hw_irq.h
@@ -38,7 +38,7 @@
 #define IRQ_MOVE_CLEANUP_VECTOR FIRST_EXTERNAL_VECTOR
  
 /*
- * Vectors 0x20-0x2f are used for ISA interrupts.
+ * Vectors 0x30-0x3f are used for ISA interrupts.
  */
 #define IRQ0_VECTOR             FIRST_EXTERNAL_VECTOR + 0x10
 #define IRQ1_VECTOR             IRQ0_VECTOR + 1
diff --git a/include/linux/ata.h b/include/linux/ata.h
index c331da2da5f7..6caeb98e29dd 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -40,6 +40,7 @@ enum {
         ATA_MAX_DEVICES         = 2,    /* per bus/port */
         ATA_MAX_PRD             = 256,  /* we could make these 256/256 */
         ATA_SECT_SIZE           = 512,
+        ATA_MAX_SECTORS_128     = 128,
         ATA_MAX_SECTORS         = 256,
         ATA_MAX_SECTORS_LBA48   = 65535,/* TODO: 65536? */
 
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index aca66984aafd..3b6949b41745 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -15,8 +15,8 @@
 # define __acquire(x)   __context__(x,1)
 # define __release(x)   __context__(x,-1)
 # define __cond_lock(x,c)       ((c) ? ({ __acquire(x); 1; }) : 0)
-extern void __chk_user_ptr(void __user *);
-extern void __chk_io_ptr(void __iomem *);
+extern void __chk_user_ptr(const void __user *);
+extern void __chk_io_ptr(const void __iomem *);
 #else
 # define __user
 # define __kernel
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index 769ddc6df492..c22b0dfcbcd2 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -127,9 +127,13 @@ static inline int cpu_is_offline(int cpu) { return 0; }
 #endif          /* CONFIG_HOTPLUG_CPU */
 
 #ifdef CONFIG_SUSPEND_SMP
+extern int suspend_cpu_hotplug;
+
 extern int disable_nonboot_cpus(void);
 extern void enable_nonboot_cpus(void);
 #else
+#define suspend_cpu_hotplug     0
+
 static inline int disable_nonboot_cpus(void) { return 0; }
 static inline void enable_nonboot_cpus(void) {}
 #endif
diff --git a/include/linux/device.h b/include/linux/device.h
index caad9bba9652..5cf30e95c8b6 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -128,6 +128,7 @@ struct device_driver {
 
         struct module           * owner;
         const char              * mod_name;     /* used for built-in modules */
+        struct module_kobject   * mkobj;
 
         int     (*probe)        (struct device * dev);
         int     (*remove)       (struct device * dev);
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
index 84cfa8bbdc36..d2a96cbf4f0e 100644
--- a/include/linux/eventpoll.h
+++ b/include/linux/eventpoll.h
@@ -31,12 +31,19 @@
 /* 
  * On x86-64 make the 64bit structure have the same alignment as the
  * 32bit structure. This makes 32bit emulation easier.
+ *
+ * UML/x86_64 needs the same packing as x86_64 - UML + UML_X86 +
+ * 64_BIT adds up to UML/x86_64.
  */
 #ifdef __x86_64__
 #define EPOLL_PACKED __attribute__((packed))
 #else
+#if defined(CONFIG_UML) && defined(CONFIG_UML_X86) && defined(CONFIG_64BIT)
+#define EPOLL_PACKED __attribute__((packed))
+#else
 #define EPOLL_PACKED
 #endif
+#endif
 
 struct epoll_event {
         __u32 events;
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 5bdbc744e773..17c29dca8354 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -206,6 +206,7 @@ struct hrtimer_cpu_base {
 struct clock_event_device;
 
 extern void clock_was_set(void);
+extern void hres_timers_resume(void);
 extern void hrtimer_interrupt(struct clock_event_device *dev);
 
 /*
@@ -236,6 +237,8 @@ static inline ktime_t hrtimer_cb_get_time(struct hrtimer *timer)
  */
 static inline void clock_was_set(void) { }
 
+static inline void hres_timers_resume(void) { }
+
 /*
  * In non high resolution mode the time reference is taken from
  * the base softirq time variable.
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 34f2676b3c62..d3bbc7188b6a 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -615,6 +615,7 @@ typedef struct ide_drive_s {
         u8      init_speed;     /* transfer rate set at boot */
         u8      pio_speed;      /* unused by core, used by some drivers for fallback from DMA */
         u8      current_speed;  /* current transfer rate set */
+        u8      desired_speed;  /* desired transfer rate set */
         u8      dn;             /* now wide spread use */
         u8      wcache;         /* status of write cache */
         u8      acoustic;       /* acoustic management */
@@ -860,6 +861,8 @@ typedef struct hwgroup_s {
         int (*expiry)(ide_drive_t *);
                 /* ide_system_bus_speed */
         int pio_clock;
+        int req_gen;
+        int req_gen_timer;
 
         unsigned char cmd_buf[4];
 } ide_hwgroup_t;
diff --git a/include/linux/io.h b/include/linux/io.h
index c244a0cc9319..09d351236379 100644
--- a/include/linux/io.h
+++ b/include/linux/io.h
@@ -33,9 +33,22 @@ int ioremap_page_range(unsigned long addr, unsigned long end,
 /*
  * Managed iomap interface
  */
+#ifdef CONFIG_HAS_IOPORT
 void __iomem * devm_ioport_map(struct device *dev, unsigned long port,
                                unsigned int nr);
 void devm_ioport_unmap(struct device *dev, void __iomem *addr);
+#else
+static inline void __iomem *devm_ioport_map(struct device *dev,
+                                             unsigned long port,
+                                             unsigned int nr)
+{
+        return NULL;
+}
+
+static inline void devm_ioport_unmap(struct device *dev, void __iomem *addr)
+{
+}
+#endif
 
 void __iomem * devm_ioremap(struct device *dev, unsigned long offset,
                             unsigned long size);
diff --git a/include/linux/ipc.h b/include/linux/ipc.h
index 636094c29b16..6da6772c19ff 100644
--- a/include/linux/ipc.h
+++ b/include/linux/ipc.h
@@ -92,19 +92,16 @@ extern struct ipc_namespace init_ipc_ns;
 
 #ifdef CONFIG_SYSVIPC
 #define INIT_IPC_NS(ns)         .ns             = &init_ipc_ns,
+extern int copy_ipcs(unsigned long flags, struct task_struct *tsk);
 #else
 #define INIT_IPC_NS(ns)
+static inline int copy_ipcs(unsigned long flags, struct task_struct *tsk)
+{ return 0; }
 #endif
 
 #ifdef CONFIG_IPC_NS
 extern void free_ipc_ns(struct kref *kref);
-extern int copy_ipcs(unsigned long flags, struct task_struct *tsk);
 extern int unshare_ipcs(unsigned long flags, struct ipc_namespace **ns);
-#else
-static inline int copy_ipcs(unsigned long flags, struct task_struct *tsk)
-{
-        return 0;
-}
 #endif
 
 static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns)
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index f8241130f5ea..713eb5eaa81f 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -177,6 +177,7 @@ struct ipv6_devconf {
 #endif
 #endif
         __s32           proxy_ndp;
+        __s32           accept_source_route;
         void            *sysctl;
 };
 
@@ -205,6 +206,8 @@ enum {
         DEVCONF_RTR_PROBE_INTERVAL,
         DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN,
         DEVCONF_PROXY_NDP,
+        __DEVCONF_OPTIMISTIC_DAD,
+        DEVCONF_ACCEPT_SOURCE_ROUTE,
         DEVCONF_MAX
 };
 
diff --git a/include/linux/kdev_t.h b/include/linux/kdev_t.h
index 4c2c3737e415..2dacab8beccb 100644
--- a/include/linux/kdev_t.h
+++ b/include/linux/kdev_t.h
@@ -87,8 +87,6 @@ static inline unsigned sysv_minor(u32 dev)
         return dev & 0x3ffff;
 }
 
-bool is_lanana_major(unsigned int major);
-
 #else /* __KERNEL__ */
 
 /*
diff --git a/include/linux/libata.h b/include/linux/libata.h
index e3f32f3189b2..0cfbcb6f08eb 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -311,15 +311,17 @@ enum {
         ATA_HORKAGE_DIAGNOSTIC  = (1 << 0),     /* Failed boot diag */
         ATA_HORKAGE_NODMA       = (1 << 1),     /* DMA problems */
         ATA_HORKAGE_NONCQ       = (1 << 2),     /* Don't use NCQ */
+        ATA_HORKAGE_MAX_SEC_128 = (1 << 3),     /* Limit max sects to 128 */
+        ATA_HORKAGE_DMA_RW_ONLY = (1 << 4),     /* ATAPI DMA for RW only */
 };
 
 enum hsm_task_states {
         HSM_ST_IDLE,            /* no command on going */
+        HSM_ST_FIRST,           /* (waiting the device to)
+                                   write CDB or first data block */
         HSM_ST,                 /* (waiting the device to) transfer data */
         HSM_ST_LAST,            /* (waiting the device to) complete command */
         HSM_ST_ERR,             /* error */
-        HSM_ST_FIRST,           /* (waiting the device to)
-                                   write CDB or first data block */
 };
 
 enum ata_completion_errors {
diff --git a/include/linux/nfs_page.h b/include/linux/nfs_page.h
index 2e555d49c9b7..16b0266b14fd 100644
--- a/include/linux/nfs_page.h
+++ b/include/linux/nfs_page.h
@@ -31,7 +31,6 @@
 #define PG_NEED_COMMIT          1
 #define PG_NEED_RESCHED         2
 #define PG_NEED_FLUSH           3
-#define PG_FLUSHING             4
 
 struct nfs_inode;
 struct nfs_page {
@@ -50,8 +49,6 @@ struct nfs_page {
 };
 
 #define NFS_WBACK_BUSY(req)     (test_bit(PG_BUSY,&(req)->wb_flags))
-#define NFS_NEED_COMMIT(req)    (test_bit(PG_NEED_COMMIT,&(req)->wb_flags))
-#define NFS_NEED_RESCHED(req)   (test_bit(PG_NEED_RESCHED,&(req)->wb_flags))
 
 extern  struct nfs_page *nfs_create_request(struct nfs_open_context *ctx,
                                             struct inode *inode,
@@ -122,34 +119,6 @@ nfs_list_remove_request(struct nfs_page *req)
         req->wb_list_head = NULL;
 }
 
-static inline int
-nfs_defer_commit(struct nfs_page *req)
-{
-        return !test_and_set_bit(PG_NEED_COMMIT, &req->wb_flags);
-}
-
-static inline void
-nfs_clear_commit(struct nfs_page *req)
-{
-        smp_mb__before_clear_bit();
-        clear_bit(PG_NEED_COMMIT, &req->wb_flags);
-        smp_mb__after_clear_bit();
-}
-
-static inline int
-nfs_defer_reschedule(struct nfs_page *req)
-{
-        return !test_and_set_bit(PG_NEED_RESCHED, &req->wb_flags);
-}
-
-static inline void
-nfs_clear_reschedule(struct nfs_page *req)
-{
-        smp_mb__before_clear_bit();
-        clear_bit(PG_NEED_RESCHED, &req->wb_flags);
-        smp_mb__after_clear_bit();
-}
-
 static inline struct nfs_page *
 nfs_list_entry(struct list_head *head)
 {
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 2e19478e9e84..8bcbc54e1b48 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -99,4 +99,8 @@ extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
                                 loff_t *, size_t, unsigned int,
                                 splice_actor *);
 
+extern ssize_t __splice_from_pipe(struct pipe_inode_info *, struct file *,
+                                  loff_t *, size_t, unsigned int,
+                                  splice_actor *);
+
 #endif
diff --git a/include/linux/plist.h b/include/linux/plist.h
index b95818a037ad..85de2f055874 100644
--- a/include/linux/plist.h
+++ b/include/linux/plist.h
@@ -97,9 +97,9 @@ struct plist_node {
 #endif
 
 /**
- * #PLIST_HEAD_INIT - static struct plist_head initializer
- *
+ * PLIST_HEAD_INIT - static struct plist_head initializer
  * @head:       struct plist_head variable name
+ * @_lock:      lock to initialize for this list
  */
 #define PLIST_HEAD_INIT(head, _lock)                    \
 {                                                       \
@@ -109,8 +109,7 @@ struct plist_node {
 }
 
 /**
- * #PLIST_NODE_INIT - static struct plist_node initializer
- *
+ * PLIST_NODE_INIT - static struct plist_node initializer
  * @node:       struct plist_node variable name
  * @__prio:     initial node priority
  */
@@ -122,8 +121,8 @@ struct plist_node {
 
 /**
  * plist_head_init - dynamic struct plist_head initializer
- *
  * @head:       &struct plist_head pointer
+ * @lock:       list spinlock, remembered for debugging
  */
 static inline void
 plist_head_init(struct plist_head *head, spinlock_t *lock)
@@ -137,7 +136,6 @@ plist_head_init(struct plist_head *head, spinlock_t *lock)
 
 /**
  * plist_node_init - Dynamic struct plist_node initializer
- *
  * @node:       &struct plist_node pointer
  * @prio:       initial node priority
  */
@@ -152,49 +150,46 @@ extern void plist_del(struct plist_node *node, struct plist_head *head);
 
 /**
  * plist_for_each - iterate over the plist
- *
- * @pos1:       the type * to use as a loop counter.
- * @head:       the head for your list.
+ * @pos:        the type * to use as a loop counter
+ * @head:       the head for your list
  */
 #define plist_for_each(pos, head)       \
          list_for_each_entry(pos, &(head)->node_list, plist.node_list)
 
 /**
- * plist_for_each_entry_safe - iterate over a plist of given type safe
- * against removal of list entry
+ * plist_for_each_safe - iterate safely over a plist of given type
+ * @pos:        the type * to use as a loop counter
+ * @n:  another type * to use as temporary storage
+ * @head:       the head for your list
  *
- * @pos1:       the type * to use as a loop counter.
- * @n1: another type * to use as temporary storage
- * @head:       the head for your list.
+ * Iterate over a plist of given type, safe against removal of list entry.
  */
 #define plist_for_each_safe(pos, n, head)       \
          list_for_each_entry_safe(pos, n, &(head)->node_list, plist.node_list)
 
 /**
  * plist_for_each_entry - iterate over list of given type
- *
- * @pos:        the type * to use as a loop counter.
- * @head:       the head for your list.
- * @member:     the name of the list_struct within the struct.
+ * @pos:        the type * to use as a loop counter
+ * @head:       the head for your list
+ * @mem:        the name of the list_struct within the struct
  */
 #define plist_for_each_entry(pos, head, mem)    \
          list_for_each_entry(pos, &(head)->node_list, mem.plist.node_list)
 
 /**
- * plist_for_each_entry_safe - iterate over list of given type safe against
- * removal of list entry
- *
- * @pos:        the type * to use as a loop counter.
+ * plist_for_each_entry_safe - iterate safely over list of given type
+ * @pos:        the type * to use as a loop counter
  * @n:          another type * to use as temporary storage
- * @head:       the head for your list.
- * @m:          the name of the list_struct within the struct.
+ * @head:       the head for your list
+ * @m:          the name of the list_struct within the struct
+ *
+ * Iterate over list of given type, safe against removal of list entry.
  */
 #define plist_for_each_entry_safe(pos, n, head, m)      \
         list_for_each_entry_safe(pos, n, &(head)->node_list, m.plist.node_list)
 
 /**
  * plist_head_empty - return !0 if a plist_head is empty
- *
  * @head:       &struct plist_head pointer
  */
 static inline int plist_head_empty(const struct plist_head *head)
@@ -204,7 +199,6 @@ static inline int plist_head_empty(const struct plist_head *head)
 
 /**
  * plist_node_empty - return !0 if plist_node is not on a list
- *
  * @node:       &struct plist_node pointer
  */
 static inline int plist_node_empty(const struct plist_node *node)
@@ -216,10 +210,9 @@ static inline int plist_node_empty(const struct plist_node *node)
 
 /**
  * plist_first_entry - get the struct for the first entry
- *
- * @ptr:        the &struct plist_head pointer.
- * @type:       the type of the struct this is embedded in.
- * @member:     the name of the list_struct within the struct.
+ * @head:       the &struct plist_head pointer
+ * @type:       the type of the struct this is embedded in
+ * @member:     the name of the list_struct within the struct
  */
 #ifdef CONFIG_DEBUG_PI_LIST
 # define plist_first_entry(head, type, member)  \
@@ -234,7 +227,6 @@ static inline int plist_node_empty(const struct plist_node *node)
 
 /**
  * plist_first - return the first node (and thus, highest priority)
- *
  * @head:       the &struct plist_head pointer
  *
  * Assumes the plist is _not_ empty.
diff --git a/include/linux/raid/md_k.h b/include/linux/raid/md_k.h
index 8245c282168b..de72c49747c8 100644
--- a/include/linux/raid/md_k.h
+++ b/include/linux/raid/md_k.h
@@ -104,6 +104,7 @@ struct mdk_rdev_s
                                            * for reporting to userspace and storing
                                            * in superblock.
                                            */
+        struct work_struct del_work;    /* used for delayed sysfs removal */
 };
 
 struct mddev_s
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 4ff3940210d8..5992f65b4184 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -188,7 +188,7 @@ enum {
  *      @sk: Socket we are owned by
  *      @tstamp: Time we arrived
  *      @dev: Device we arrived on/are leaving by
- *      @input_dev: Device we arrived on
+ *      @iif: ifindex of device we arrived on
  *      @h: Transport layer header
  *      @nh: Network layer header
  *      @mac: Link layer header
@@ -235,7 +235,8 @@ struct sk_buff {
         struct sock             *sk;
         struct skb_timeval      tstamp;
         struct net_device       *dev;
-        struct net_device       *input_dev;
+        int                     iif;
+        /* 4 byte hole on 64 bit*/
 
         union {
                 struct tcphdr   *th;
@@ -345,9 +346,6 @@ static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
         return __alloc_skb(size, priority, 1, -1);
 }
 
-extern struct sk_buff *alloc_skb_from_cache(struct kmem_cache *cp,
-                                            unsigned int size,
-                                            gfp_t priority);
 extern void            kfree_skbmem(struct sk_buff *skb);
 extern struct sk_buff *skb_clone(struct sk_buff *skb,
                                  gfp_t priority);
@@ -621,6 +619,13 @@ static inline void skb_queue_head_init(struct sk_buff_head *list)
         list->qlen = 0;
 }
 
+static inline void skb_queue_head_init_class(struct sk_buff_head *list,
+                struct lock_class_key *class)
+{
+        skb_queue_head_init(list);
+        lockdep_set_class(&list->lock, class);
+}
+
 /*
  *      Insert an sk_buff at the start of a list.
  *
diff --git a/include/linux/sony-laptop.h b/include/linux/sony-laptop.h
new file mode 100644
index 000000000000..e2e036d94e4a
--- /dev/null
+++ b/include/linux/sony-laptop.h
@@ -0,0 +1,34 @@
+#ifndef _SONYLAPTOP_H_
+#define _SONYLAPTOP_H_
+
+#include <linux/types.h>
+
+#ifdef __KERNEL__
+
+/* used only for communication between v4l and sony-laptop */
+
+#define SONY_PIC_COMMAND_GETCAMERA               1      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERA               2
+#define SONY_PIC_COMMAND_GETCAMERABRIGHTNESS     3      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERABRIGHTNESS     4
+#define SONY_PIC_COMMAND_GETCAMERACONTRAST       5      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERACONTRAST       6
+#define SONY_PIC_COMMAND_GETCAMERAHUE            7      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERAHUE            8
+#define SONY_PIC_COMMAND_GETCAMERACOLOR          9      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERACOLOR         10
+#define SONY_PIC_COMMAND_GETCAMERASHARPNESS     11      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERASHARPNESS     12
+#define SONY_PIC_COMMAND_GETCAMERAPICTURE       13      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERAPICTURE       14
+#define SONY_PIC_COMMAND_GETCAMERAAGC           15      /* obsolete */
+#define SONY_PIC_COMMAND_SETCAMERAAGC           16
+#define SONY_PIC_COMMAND_GETCAMERADIRECTION     17      /* obsolete */
+#define SONY_PIC_COMMAND_GETCAMERAROMVERSION    18      /* obsolete */
+#define SONY_PIC_COMMAND_GETCAMERAREVISION      19      /* obsolete */
+
+int sony_pic_camera_command(int command, u8 value);
+
+#endif  /* __KERNEL__ */
+
+#endif /* _SONYLAPTOP_H_ */
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 2c5fb38d9392..9a8970bf99a6 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -580,6 +580,7 @@ enum {
         NET_IPV6_RTR_PROBE_INTERVAL=21,
         NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
         NET_IPV6_PROXY_NDP=23,
+        NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
         __NET_IPV6_MAX
 };
 
diff --git a/include/linux/taskstats.h b/include/linux/taskstats.h
index 3fced4798255..a46104a28f66 100644
--- a/include/linux/taskstats.h
+++ b/include/linux/taskstats.h
@@ -31,7 +31,7 @@
  */
 
 
-#define TASKSTATS_VERSION       3
+#define TASKSTATS_VERSION       4
 #define TS_COMM_LEN             32      /* should be >= TASK_COMM_LEN
                                          * in linux/sched.h */
 
@@ -66,7 +66,7 @@ struct taskstats {
         /* Delay waiting for cpu, while runnable
          * count, delay_total NOT updated atomically
          */
-        __u64   cpu_count;
+        __u64   cpu_count __attribute__((aligned(8)));
         __u64   cpu_delay_total;
 
         /* Following four fields atomically updated using task->delays->lock */
@@ -101,14 +101,17 @@ struct taskstats {
 
         /* Basic Accounting Fields start */
         char    ac_comm[TS_COMM_LEN];   /* Command name */
-        __u8    ac_sched;               /* Scheduling discipline */
+        __u8    ac_sched __attribute__((aligned(8)));
+                                        /* Scheduling discipline */
         __u8    ac_pad[3];
-        __u32   ac_uid;                 /* User ID */
+        __u32   ac_uid __attribute__((aligned(8)));
+                                        /* User ID */
         __u32   ac_gid;                 /* Group ID */
         __u32   ac_pid;                 /* Process ID */
         __u32   ac_ppid;                /* Parent process ID */
         __u32   ac_btime;               /* Begin time [sec since 1970] */
-        __u64   ac_etime;               /* Elapsed time [usec] */
+        __u64   ac_etime __attribute__((aligned(8)));
+                                        /* Elapsed time [usec] */
         __u64   ac_utime;               /* User CPU time [usec] */
         __u64   ac_stime;               /* SYstem CPU time [usec] */
         __u64   ac_minflt;              /* Minor Page Fault Count */
diff --git a/include/linux/utsname.h b/include/linux/utsname.h
index a4555fe3754c..e10267d402c5 100644
--- a/include/linux/utsname.h
+++ b/include/linux/utsname.h
@@ -70,6 +70,8 @@ static inline int unshare_utsname(unsigned long unshare_flags,
 
 static inline int copy_utsname(int flags, struct task_struct *tsk)
 {
+        if (flags & CLONE_NEWUTS)
+                return -EINVAL;
         return 0;
 }
 static inline void put_uts_ns(struct uts_namespace *ns)
diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 447c52beb691..48759b2f57d7 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -1,10 +1,10 @@
 /*
  * This file define a set of standard wireless extensions
  *
- * Version :    21      14.3.06
+ * Version :    22      16.3.07
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 1997-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
  */
 
 #ifndef _LINUX_WIRELESS_H
@@ -85,7 +85,7 @@
  * (there is some stuff that will be added in the future...)
  * I just plan to increment with each new version.
  */
-#define WIRELESS_EXT    21
+#define WIRELESS_EXT    22
 
 /*
  * Changes :
@@ -221,6 +221,10 @@
  *      - Add IW_RETRY_SHORT/IW_RETRY_LONG retry modifiers
  *      - Power/Retry relative values no longer * 100000
  *      - Add explicit flag to tell stats are in 802.11k RCPI : IW_QUAL_RCPI
+ *
+ * V21 to V22
+ * ----------
+ *      - Prevent leaking of kernel space in stream on 64 bits.
  */
 
 /**************************** CONSTANTS ****************************/
@@ -1085,4 +1089,15 @@ struct iw_event
 #define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \
                          IW_EV_POINT_OFF)
 
+/* Size of the Event prefix when packed in stream */
+#define IW_EV_LCP_PK_LEN        (4)
+/* Size of the various events when packed in stream */
+#define IW_EV_CHAR_PK_LEN       (IW_EV_LCP_PK_LEN + IFNAMSIZ)
+#define IW_EV_UINT_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(__u32))
+#define IW_EV_FREQ_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct iw_freq))
+#define IW_EV_PARAM_PK_LEN      (IW_EV_LCP_PK_LEN + sizeof(struct iw_param))
+#define IW_EV_ADDR_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct sockaddr))
+#define IW_EV_QUAL_PK_LEN       (IW_EV_LCP_PK_LEN + sizeof(struct iw_quality))
+#define IW_EV_POINT_PK_LEN      (IW_EV_LCP_LEN + 4)
+
 #endif  /* _LINUX_WIRELESS_H */
diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
index 83fe2e3d1e25..50e33b0e9349 100644
--- a/include/media/saa7146_vv.h
+++ b/include/media/saa7146_vv.h
@@ -239,7 +239,8 @@ void saa7146_res_free(struct saa7146_fh *fh, unsigned int bits);
 #define SAA7146_HPS_SYNC_PORT_B         0x01
 
 /* some memory sizes */
-#define SAA7146_CLIPPING_MEM    (14*PAGE_SIZE)
+/* max. 16 clipping rectangles */
+#define SAA7146_CLIPPING_MEM    (16 * 4 * sizeof(u32))
 
 /* some defines for the various clipping-modes */
 #define SAA7146_CLIPPING_RECT           0x4
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index bc3c26494c3d..d585ea9fa97d 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -34,6 +34,7 @@ struct fib_rules_ops
         int                     family;
         struct list_head        list;
         int                     rule_size;
+        int                     addr_size;
 
         int                     (*action)(struct fib_rule *,
                                           struct flowi *, int,
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 9eda572a2a65..cf355a3c2ad5 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -58,6 +58,7 @@ struct fib6_node
         __u16                   fn_bit;         /* bit key */
         __u16                   fn_flags;
         __u32                   fn_sernum;
+        struct rt6_info         *rr_ptr;
 };
 
 #ifndef CONFIG_IPV6_SUBTREES
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 10559e937d27..8a830188354d 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -1,10 +1,10 @@
 /*
  * This file define the new driver API for Wireless Extensions
  *
- * Version :    7       18.3.05
+ * Version :    8       16.3.07
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 2001-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 2001-2007 Jean Tourrilhes, All Rights Reserved.
  */
 
 #ifndef _IW_HANDLER_H
@@ -207,7 +207,7 @@
  * will be needed...
  * I just plan to increment with each new version.
  */
-#define IW_HANDLER_VERSION      7
+#define IW_HANDLER_VERSION      8
 
 /*
  * Changes :
@@ -239,6 +239,10 @@
  *      - Remove (struct iw_point *)->pointer from events and streams
  *      - Remove spy_offset from struct iw_handler_def
  *      - Add "check" version of event macros for ieee802.11 stack
+ *
+ * V7 to V8
+ * ----------
+ *      - Prevent leaking of kernel space in stream on 64 bits.
  */
 
 /**************************** CONSTANTS ****************************/
@@ -500,7 +504,11 @@ iwe_stream_add_event(char *	stream,		/* Stream of events */
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, event_len);
+                /* Beware of alignement issues on 64 bits */
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
+                memcpy(stream + IW_EV_LCP_LEN,
+                       ((char *) iwe) + IW_EV_LCP_LEN,
+                       event_len - IW_EV_LCP_LEN);
                 stream += event_len;
         }
         return stream;
@@ -521,10 +529,10 @@ iwe_stream_add_point(char *	stream,		/* Stream of events */
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_LEN);
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_LCP_LEN,
                        ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
                 stream += event_len;
         }
@@ -574,7 +582,11 @@ iwe_stream_check_add_event(char *	stream,		/* Stream of events */
         /* Check if it's possible, set error if not */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, event_len);
+                /* Beware of alignement issues on 64 bits */
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
+                memcpy(stream + IW_EV_LCP_LEN,
+                       ((char *) iwe) + IW_EV_LCP_LEN,
+                       event_len - IW_EV_LCP_LEN);
                 stream += event_len;
         } else
                 *perr = -E2BIG;
@@ -598,10 +610,10 @@ iwe_stream_check_add_point(char *	stream,		/* Stream of events */
         /* Check if it's possible */
         if(likely((stream + event_len) < ends)) {
                 iwe->len = event_len;
-                memcpy(stream, (char *) iwe, IW_EV_LCP_LEN);
+                memcpy(stream, (char *) iwe, IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_LCP_LEN,
                        ((char *) iwe) + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                 memcpy(stream + IW_EV_POINT_LEN, extra, iwe->u.data.length);
                 stream += event_len;
         } else
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 3725b93c52f3..ad7fe1121412 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -36,7 +36,7 @@ struct neigh_parms
         struct net_device *dev;
         struct neigh_parms *next;
         int     (*neigh_setup)(struct neighbour *);
-        void    (*neigh_destructor)(struct neighbour *);
+        void    (*neigh_cleanup)(struct neighbour *);
         struct neigh_table *tbl;
 
         void    *sysctl_table;
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index b902d24a3256..02647fe3d74b 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -352,10 +352,13 @@ tcf_change_indev(struct tcf_proto *tp, char *indev, struct rtattr *indev_tlv)
 static inline int
 tcf_match_indev(struct sk_buff *skb, char *indev)
 {
+        struct net_device *dev;
+
         if (indev[0]) {
-                if  (!skb->input_dev)
+                if  (!skb->iif)
                         return 0;
-                if (strcmp(indev, skb->input_dev->name))
+                dev = __dev_get_by_index(skb->iif);
+                if (!dev || strcmp(indev, dev->name))
                         return 0;
         }
 
diff --git a/ipc/util.c b/ipc/util.c
index 08a647965b9e..0b652387d169 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -144,6 +144,13 @@ void free_ipc_ns(struct kref *kref)
         shm_exit_ns(ns);
         kfree(ns);
 }
+#else
+int copy_ipcs(unsigned long flags, struct task_struct *tsk)
+{
+        if (flags & CLONE_NEWIPC)
+                return -EINVAL;
+        return 0;
+}
 #endif
 
 /**
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 3d4206ada5c9..36e70845cfc3 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -254,6 +254,12 @@ int __cpuinit cpu_up(unsigned int cpu)
 }
 
 #ifdef CONFIG_SUSPEND_SMP
+/* Needed to prevent the microcode driver from requesting firmware in its CPU
+ * hotplug notifier during the suspend/resume.
+ */
+int suspend_cpu_hotplug;
+EXPORT_SYMBOL(suspend_cpu_hotplug);
+
 static cpumask_t frozen_cpus;
 
 int disable_nonboot_cpus(void)
@@ -261,16 +267,8 @@ int disable_nonboot_cpus(void)
         int cpu, first_cpu, error = 0;
 
         mutex_lock(&cpu_add_remove_lock);
-        first_cpu = first_cpu(cpu_present_map);
-        if (!cpu_online(first_cpu)) {
-                error = _cpu_up(first_cpu);
-                if (error) {
-                        printk(KERN_ERR "Could not bring CPU%d up.\n",
-                                first_cpu);
-                        goto out;
-                }
-        }
-
+        suspend_cpu_hotplug = 1;
+        first_cpu = first_cpu(cpu_online_map);
         /* We take down all of the non-boot CPUs in one shot to avoid races
          * with the userspace trying to use the CPU hotplug at the same time
          */
@@ -296,7 +294,7 @@ int disable_nonboot_cpus(void)
         } else {
                 printk(KERN_ERR "Non-boot CPUs are not disabled\n");
         }
-out:
+        suspend_cpu_hotplug = 0;
         mutex_unlock(&cpu_add_remove_lock);
         return error;
 }
@@ -308,20 +306,22 @@ void enable_nonboot_cpus(void)
         /* Allow everyone to use the CPU hotplug again */
         mutex_lock(&cpu_add_remove_lock);
         cpu_hotplug_disabled = 0;
-        mutex_unlock(&cpu_add_remove_lock);
         if (cpus_empty(frozen_cpus))
-                return;
+                goto out;
 
+        suspend_cpu_hotplug = 1;
         printk("Enabling non-boot CPUs ...\n");
         for_each_cpu_mask(cpu, frozen_cpus) {
-                error = cpu_up(cpu);
+                error = _cpu_up(cpu);
                 if (!error) {
                         printk("CPU%d is up\n", cpu);
                         continue;
                 }
-                printk(KERN_WARNING "Error taking CPU%d up: %d\n",
-                        cpu, error);
+                printk(KERN_WARNING "Error taking CPU%d up: %d\n", cpu, error);
         }
         cpus_clear(frozen_cpus);
+        suspend_cpu_hotplug = 0;
+out:
+        mutex_unlock(&cpu_add_remove_lock);
 }
 #endif
diff --git a/kernel/exit.c b/kernel/exit.c
index f132349c0325..b55ed4cc9104 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -790,7 +790,7 @@ static void exit_notify(struct task_struct *tsk)
         
         pgrp = task_pgrp(tsk);
         if ((task_pgrp(t) != pgrp) &&
-            (task_session(t) != task_session(tsk)) &&
+            (task_session(t) == task_session(tsk)) &&
             will_become_orphaned_pgrp(pgrp, tsk) &&
             has_stopped_jobs(pgrp)) {
                 __kill_pgrp_info(SIGHUP, SEND_SIG_PRIV, pgrp);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 6a7938a0d513..b74860aaf5f1 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -459,6 +459,18 @@ void clock_was_set(void)
 }
 
 /*
+ * During resume we might have to reprogram the high resolution timer
+ * interrupt (on the local CPU):
+ */
+void hres_timers_resume(void)
+{
+        WARN_ON_ONCE(num_online_cpus() > 1);
+
+        /* Retrigger the CPU local events: */
+        retrigger_next_event(NULL);
+}
+
+/*
  * Check, whether the timer is on the callback pending list
  */
 static inline int hrtimer_cb_pending(const struct hrtimer *timer)
@@ -814,7 +826,12 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
 
         timer_stats_hrtimer_set_start_info(timer);
 
-        enqueue_hrtimer(timer, new_base, base == new_base);
+        /*
+         * Only allow reprogramming if the new base is on this CPU.
+         * (it might still be on another CPU if the timer was pending)
+         */
+        enqueue_hrtimer(timer, new_base,
+                        new_base->cpu_base == &__get_cpu_var(hrtimer_bases));
 
         unlock_hrtimer_base(timer, &flags);
 
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
index 85a430da0fb6..d8ee241115f5 100644
--- a/kernel/irq/devres.c
+++ b/kernel/irq/devres.c
@@ -54,7 +54,7 @@ int devm_request_irq(struct device *dev, unsigned int irq,
 
         rc = request_irq(irq, handler, irqflags, devname, dev_id);
         if (rc) {
-                kfree(dr);
+                devres_free(dr);
                 return rc;
         }
 
diff --git a/kernel/module.c b/kernel/module.c
index fbc51de6444e..dcdb32b8b13c 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2384,8 +2384,13 @@ void module_add_driver(struct module *mod, struct device_driver *drv)
 
                 /* Lookup built-in module entry in /sys/modules */
                 mkobj = kset_find_obj(&module_subsys.kset, drv->mod_name);
-                if (mkobj)
+                if (mkobj) {
                         mk = container_of(mkobj, struct module_kobject, kobj);
+                        /* remember our module structure */
+                        drv->mkobj = mk;
+                        /* kset_find_obj took a reference */
+                        kobject_put(mkobj);
+                }
         }
 
         if (!mk)
@@ -2405,17 +2410,22 @@ EXPORT_SYMBOL(module_add_driver);
 
 void module_remove_driver(struct device_driver *drv)
 {
+        struct module_kobject *mk = NULL;
         char *driver_name;
 
         if (!drv)
                 return;
 
         sysfs_remove_link(&drv->kobj, "module");
-        if (drv->owner && drv->owner->mkobj.drivers_dir) {
+
+        if (drv->owner)
+                mk = &drv->owner->mkobj;
+        else if (drv->mkobj)
+                mk = drv->mkobj;
+        if (mk && mk->drivers_dir) {
                 driver_name = make_driver_name(drv);
                 if (driver_name) {
-                        sysfs_remove_link(drv->owner->mkobj.drivers_dir,
-                                          driver_name);
+                        sysfs_remove_link(mk->drivers_dir, driver_name);
                         kfree(driver_name);
                 }
         }
diff --git a/kernel/params.c b/kernel/params.c
index e265b13195b1..1fc4ac746cd8 100644
--- a/kernel/params.c
+++ b/kernel/params.c
@@ -356,6 +356,10 @@ int param_set_copystring(const char *val, struct kernel_param *kp)
 {
         struct kparam_string *kps = kp->arg;
 
+        if (!val) {
+                printk(KERN_ERR "%s: missing param set value\n", kp->name);
+                return -EINVAL;
+        }
         if (strlen(val)+1 > kps->maxlen) {
                 printk(KERN_ERR "%s: string doesn't fit in %u chars.\n",
                        kp->name, kps->maxlen-1);
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index dee0ff40befd..aec19b063e3f 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -58,7 +58,6 @@ static inline int platform_prepare(void)
 
 static void power_down(suspend_disk_method_t mode)
 {
-        disable_nonboot_cpus();
         switch(mode) {
         case PM_DISK_PLATFORM:
                 if (pm_ops && pm_ops->enter) {
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index 7fb834397a0d..175370824f37 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -229,13 +229,13 @@ int swsusp_shrink_memory(void)
                 size += highmem_size;
                 for_each_zone (zone)
                         if (populated_zone(zone)) {
+                                tmp += snapshot_additional_pages(zone);
                                 if (is_highmem(zone)) {
                                         highmem_size -=
                                         zone_page_state(zone, NR_FREE_PAGES);
                                 } else {
                                         tmp -= zone_page_state(zone, NR_FREE_PAGES);
                                         tmp += zone->lowmem_reserve[ZONE_NORMAL];
-                                        tmp += snapshot_additional_pages(zone);
                                 }
                         }
 
diff --git a/kernel/power/user.c b/kernel/power/user.c
index bf211fee1222..7cf6713b2325 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -401,10 +401,9 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
 
                 case PMOPS_ENTER:
                         if (data->platform_suspend) {
-                                disable_nonboot_cpus();
                                 kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
                                 error = pm_ops->enter(PM_SUSPEND_DISK);
-                                enable_nonboot_cpus();
+                                error = 0;
                         }
                         break;
 
diff --git a/kernel/sched.c b/kernel/sched.c
index a4ca632c477c..b9a683730148 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4687,32 +4687,10 @@ out_unlock:
         return retval;
 }
 
-static inline struct task_struct *eldest_child(struct task_struct *p)
-{
-        if (list_empty(&p->children))
-                return NULL;
-        return list_entry(p->children.next,struct task_struct,sibling);
-}
-
-static inline struct task_struct *older_sibling(struct task_struct *p)
-{
-        if (p->sibling.prev==&p->parent->children)
-                return NULL;
-        return list_entry(p->sibling.prev,struct task_struct,sibling);
-}
-
-static inline struct task_struct *younger_sibling(struct task_struct *p)
-{
-        if (p->sibling.next==&p->parent->children)
-                return NULL;
-        return list_entry(p->sibling.next,struct task_struct,sibling);
-}
-
 static const char stat_nam[] = "RSDTtZX";
 
 static void show_task(struct task_struct *p)
 {
-        struct task_struct *relative;
         unsigned long free = 0;
         unsigned state;
 
@@ -4738,19 +4716,7 @@ static void show_task(struct task_struct *p)
                 free = (unsigned long)n - (unsigned long)end_of_stack(p);
         }
 #endif
-        printk("%5lu %5d %6d ", free, p->pid, p->parent->pid);
-        if ((relative = eldest_child(p)))
-                printk("%5d ", relative->pid);
-        else
-                printk("      ");
-        if ((relative = younger_sibling(p)))
-                printk("%7d", relative->pid);
-        else
-                printk("       ");
-        if ((relative = older_sibling(p)))
-                printk(" %5d", relative->pid);
-        else
-                printk("      ");
+        printk("%5lu %5d %6d", free, p->pid, p->parent->pid);
         if (!p->mm)
                 printk(" (L-TLB)\n");
         else
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 1b255df4fcd0..c904748f2290 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1676,7 +1676,7 @@ static int proc_dointvec_taint(ctl_table *table, int write, struct file *filp,
 {
         int op;
 
-        if (!capable(CAP_SYS_ADMIN))
+        if (write && !capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
         op = OP_OR;
diff --git a/kernel/time.c b/kernel/time.c
index c6c80ea5d0ea..2f47888e46c9 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -635,6 +635,7 @@ timeval_to_jiffies(const struct timeval *value)
                 (((u64)usec * USEC_CONVERSION + USEC_ROUND) >>
                  (USEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
 }
+EXPORT_SYMBOL(timeval_to_jiffies);
 
 void jiffies_to_timeval(const unsigned long jiffies, struct timeval *value)
 {
@@ -649,6 +650,7 @@ void jiffies_to_timeval(const unsigned long jiffies, struct timeval *value)
         tv_usec /= NSEC_PER_USEC;
         value->tv_usec = tv_usec;
 }
+EXPORT_SYMBOL(jiffies_to_timeval);
 
 /*
  * Convert jiffies/jiffies_64 to clock_t and back.
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 67932ea78c17..76212b2a99de 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -274,72 +274,3 @@ void clockevents_notify(unsigned long reason, void *arg)
 }
 EXPORT_SYMBOL_GPL(clockevents_notify);
 
-#ifdef CONFIG_SYSFS
-
-/**
- * clockevents_show_registered - sysfs interface for listing clockevents
- * @dev:        unused
- * @buf:        char buffer to be filled with clock events list
- *
- * Provides sysfs interface for listing registered clock event devices
- */
-static ssize_t clockevents_show_registered(struct sys_device *dev, char *buf)
-{
-        struct list_head *tmp;
-        char *p = buf;
-        int cpu;
-
-        spin_lock(&clockevents_lock);
-
-        list_for_each(tmp, &clockevent_devices) {
-                struct clock_event_device *ce;
-
-                ce = list_entry(tmp, struct clock_event_device, list);
-                p += sprintf(p, "%-20s F:%04x M:%d", ce->name,
-                             ce->features, ce->mode);
-                p += sprintf(p, " C:");
-                if (!cpus_equal(ce->cpumask, cpu_possible_map)) {
-                        for_each_cpu_mask(cpu, ce->cpumask)
-                                p += sprintf(p, " %d", cpu);
-                } else {
-                        /*
-                         * FIXME: Add the cpu which is handling this sucker
-                         */
-                }
-                p += sprintf(p, "\n");
-        }
-
-        spin_unlock(&clockevents_lock);
-
-        return p - buf;
-}
-
-/*
- * Sysfs setup bits:
- */
-static SYSDEV_ATTR(registered, 0600,
-                   clockevents_show_registered, NULL);
-
-static struct sysdev_class clockevents_sysclass = {
-        set_kset_name("clockevents"),
-};
-
-static struct sys_device clockevents_sys_device = {
-        .id     = 0,
-        .cls    = &clockevents_sysclass,
-};
-
-static int __init clockevents_sysfs_init(void)
-{
-        int error = sysdev_class_register(&clockevents_sysclass);
-
-        if (!error)
-                error = sysdev_register(&clockevents_sys_device);
-        if (!error)
-                error = sysdev_create_file(
-                                &clockevents_sys_device,
-                                &attr_registered);
-        return error;
-}
-device_initcall(clockevents_sysfs_init);
-#endif
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 3be8da8fed7e..4c256fdb8875 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -69,4 +69,4 @@ static int __init init_jiffies_clocksource(void)
         return clocksource_register(&clocksource_jiffies);
 }
 
-module_init(init_jiffies_clocksource);
+core_initcall(init_jiffies_clocksource);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index eb12509e00bd..cb25649c6f50 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -32,7 +32,7 @@ static u64 tick_length, tick_length_base;
 /* TIME_ERROR prevents overwriting the CMOS clock */
 static int time_state = TIME_OK;        /* clock synchronization status */
 int time_status = STA_UNSYNC;           /* clock status bits            */
-static long time_offset;                /* time adjustment (ns)         */
+static s64 time_offset;         /* time adjustment (ns)         */
 static long time_constant = 2;          /* pll time constant            */
 long time_maxerror = NTP_PHASE_LIMIT;   /* maximum error (us)           */
 long time_esterror = NTP_PHASE_LIMIT;   /* estimated error (us)         */
@@ -196,7 +196,7 @@ void __attribute__ ((weak)) notify_arch_cmos_timer(void)
  */
 int do_adjtimex(struct timex *txc)
 {
-        long ltemp, mtemp, save_adjust;
+        long mtemp, save_adjust, rem;
         s64 freq_adj, temp64;
         int result;
 
@@ -277,14 +277,14 @@ int do_adjtimex(struct timex *txc)
                     time_adjust = txc->offset;
                 }
                 else if (time_status & STA_PLL) {
-                    ltemp = txc->offset * NSEC_PER_USEC;
+                    time_offset = txc->offset * NSEC_PER_USEC;
 
                     /*
                      * Scale the phase adjustment and
                      * clamp to the operating range.
                      */
-                    time_offset = min(ltemp, MAXPHASE * NSEC_PER_USEC);
-                    time_offset = max(time_offset, -MAXPHASE * NSEC_PER_USEC);
+                    time_offset = min(time_offset, (s64)MAXPHASE * NSEC_PER_USEC);
+                    time_offset = max(time_offset, (s64)-MAXPHASE * NSEC_PER_USEC);
 
                     /*
                      * Select whether the frequency is to be controlled
@@ -297,11 +297,11 @@ int do_adjtimex(struct timex *txc)
                     mtemp = xtime.tv_sec - time_reftime;
                     time_reftime = xtime.tv_sec;
 
-                    freq_adj = (s64)time_offset * mtemp;
+                    freq_adj = time_offset * mtemp;
                     freq_adj = shift_right(freq_adj, time_constant * 2 +
                                            (SHIFT_PLL + 2) * 2 - SHIFT_NSEC);
                     if (mtemp >= MINSEC && (time_status & STA_FLL || mtemp > MAXSEC)) {
-                        temp64 = (s64)time_offset << (SHIFT_NSEC - SHIFT_FLL);
+                        temp64 = time_offset << (SHIFT_NSEC - SHIFT_FLL);
                         if (time_offset < 0) {
                             temp64 = -temp64;
                             do_div(temp64, mtemp);
@@ -314,8 +314,10 @@ int do_adjtimex(struct timex *txc)
                     freq_adj += time_freq;
                     freq_adj = min(freq_adj, (s64)MAXFREQ_NSEC);
                     time_freq = max(freq_adj, (s64)-MAXFREQ_NSEC);
-                    time_offset = (time_offset / NTP_INTERVAL_FREQ)
-                                        << SHIFT_UPDATE;
+                    time_offset = div_long_long_rem_signed(time_offset,
+                                                           NTP_INTERVAL_FREQ,
+                                                           &rem);
+                    time_offset <<= SHIFT_UPDATE;
                 } /* STA_PLL */
             } /* txc->modes & ADJ_OFFSET */
             if (txc->modes & ADJ_TICK)
@@ -328,12 +330,12 @@ leave:	if ((time_status & (STA_UNSYNC|STA_CLOCKERR)) != 0)
                 result = TIME_ERROR;
 
         if ((txc->modes & ADJ_OFFSET_SINGLESHOT) == ADJ_OFFSET_SINGLESHOT)
-            txc->offset    = save_adjust;
+                txc->offset = save_adjust;
         else
-            txc->offset    = shift_right(time_offset, SHIFT_UPDATE)
-                                * NTP_INTERVAL_FREQ / 1000;
-        txc->freq          = (time_freq / NSEC_PER_USEC)
-                                << (SHIFT_USEC - SHIFT_NSEC);
+                txc->offset = ((long)shift_right(time_offset, SHIFT_UPDATE)) *
+                                NTP_INTERVAL_FREQ / 1000;
+        txc->freq          = (time_freq / NSEC_PER_USEC) <<
+                                (SHIFT_USEC - SHIFT_NSEC);
         txc->maxerror      = time_maxerror;
         txc->esterror      = time_esterror;
         txc->status        = time_status;
diff --git a/kernel/timer.c b/kernel/timer.c
index 440048acaea1..dd6c2c1c561b 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1016,7 +1016,7 @@ static int timekeeping_resume(struct sys_device *dev)
         clockevents_notify(CLOCK_EVT_NOTIFY_RESUME, NULL);
 
         /* Resume hrtimers */
-        clock_was_set();
+        hres_timers_resume();
 
         return 0;
 }
diff --git a/mm/bounce.c b/mm/bounce.c
index 643efbe82402..ad401fc57440 100644
--- a/mm/bounce.c
+++ b/mm/bounce.c
@@ -204,7 +204,7 @@ static void __blk_queue_bounce(request_queue_t *q, struct bio **bio_orig,
                 /*
                  * is destination page below bounce pfn?
                  */
-                if (page_to_pfn(page) < q->bounce_pfn)
+                if (page_to_pfn(page) <= q->bounce_pfn)
                         continue;
 
                 /*
diff --git a/mm/filemap_xip.c b/mm/filemap_xip.c
index 9dd9fbb75139..cbb335813ec0 100644
--- a/mm/filemap_xip.c
+++ b/mm/filemap_xip.c
@@ -17,6 +17,29 @@
 #include "filemap.h"
 
 /*
+ * We do use our own empty page to avoid interference with other users
+ * of ZERO_PAGE(), such as /dev/zero
+ */
+static struct page *__xip_sparse_page;
+
+static struct page *xip_sparse_page(void)
+{
+        if (!__xip_sparse_page) {
+                unsigned long zeroes = get_zeroed_page(GFP_HIGHUSER);
+                if (zeroes) {
+                        static DEFINE_SPINLOCK(xip_alloc_lock);
+                        spin_lock(&xip_alloc_lock);
+                        if (!__xip_sparse_page)
+                                __xip_sparse_page = virt_to_page(zeroes);
+                        else
+                                free_page(zeroes);
+                        spin_unlock(&xip_alloc_lock);
+                }
+        }
+        return __xip_sparse_page;
+}
+
+/*
  * This is a file read routine for execute in place files, and uses
  * the mapping->a_ops->get_xip_page() function for the actual low-level
  * stuff.
@@ -162,7 +185,7 @@ EXPORT_SYMBOL_GPL(xip_file_sendfile);
  * xip_write
  *
  * This function walks all vmas of the address_space and unmaps the
- * ZERO_PAGE when found at pgoff. Should it go in rmap.c?
+ * __xip_sparse_page when found at pgoff.
  */
 static void
 __xip_unmap (struct address_space * mapping,
@@ -177,13 +200,16 @@ __xip_unmap (struct address_space * mapping,
         spinlock_t *ptl;
         struct page *page;
 
+        page = __xip_sparse_page;
+        if (!page)
+                return;
+
         spin_lock(&mapping->i_mmap_lock);
         vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
                 mm = vma->vm_mm;
                 address = vma->vm_start +
                         ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
                 BUG_ON(address < vma->vm_start || address >= vma->vm_end);
-                page = ZERO_PAGE(0);
                 pte = page_check_address(page, mm, address, &ptl);
                 if (pte) {
                         /* Nuke the page table entry. */
@@ -222,16 +248,14 @@ xip_file_nopage(struct vm_area_struct * area,
                 + area->vm_pgoff;
 
         size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-        if (pgoff >= size) {
-                return NULL;
-        }
+        if (pgoff >= size)
+                return NOPAGE_SIGBUS;
 
         page = mapping->a_ops->get_xip_page(mapping, pgoff*(PAGE_SIZE/512), 0);
-        if (!IS_ERR(page)) {
+        if (!IS_ERR(page))
                 goto out;
-        }
         if (PTR_ERR(page) != -ENODATA)
-                return NULL;
+                return NOPAGE_SIGBUS;
 
         /* sparse block */
         if ((area->vm_flags & (VM_WRITE | VM_MAYWRITE)) &&
@@ -241,12 +265,14 @@ xip_file_nopage(struct vm_area_struct * area,
                 page = mapping->a_ops->get_xip_page (mapping,
                         pgoff*(PAGE_SIZE/512), 1);
                 if (IS_ERR(page))
-                        return NULL;
+                        return NOPAGE_SIGBUS;
                 /* unmap page at pgoff from all other vmas */
                 __xip_unmap(mapping, pgoff);
         } else {
-                /* not shared and writable, use ZERO_PAGE() */
-                page = ZERO_PAGE(0);
+                /* not shared and writable, use xip_sparse_page() */
+                page = xip_sparse_page();
+                if (!page)
+                        return NOPAGE_OOM;
         }
 
 out:
diff --git a/mm/madvise.c b/mm/madvise.c
index 77916e9fc52b..603c5257ed6e 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -159,9 +159,10 @@ static long madvise_remove(struct vm_area_struct *vma,
                                 unsigned long start, unsigned long end)
 {
         struct address_space *mapping;
-        loff_t offset, endoff;
+        loff_t offset, endoff;
+        int error;
 
-        *prev = vma;
+        *prev = NULL;   /* tell sys_madvise we drop mmap_sem */
 
         if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
                 return -EINVAL;
@@ -180,7 +181,12 @@ static long madvise_remove(struct vm_area_struct *vma,
                         + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
         endoff = (loff_t)(end - vma->vm_start - 1)
                         + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-        return  vmtruncate_range(mapping->host, offset, endoff);
+
+        /* vmtruncate_range needs to take i_mutex and i_alloc_sem */
+        up_write(&current->mm->mmap_sem);
+        error = vmtruncate_range(mapping->host, offset, endoff);
+        down_write(&current->mm->mmap_sem);
+        return error;
 }
 
 static long
@@ -315,12 +321,15 @@ asmlinkage long sys_madvise(unsigned long start, size_t len_in, int behavior)
                 if (error)
                         goto out;
                 start = tmp;
-                if (start < prev->vm_end)
+                if (prev && start < prev->vm_end)
                         start = prev->vm_end;
                 error = unmapped_error;
                 if (start >= end)
                         goto out;
-                vma = prev->vm_next;
+                if (prev)
+                        vma = prev->vm_next;
+                else    /* madvise_remove dropped mmap_sem */
+                        vma = find_vma(current->mm, start);
         }
 out:
         up_write(&current->mm->mmap_sem);
diff --git a/mm/migrate.c b/mm/migrate.c
index 7a66ca25dc8a..a91ca00abebe 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -297,7 +297,7 @@ static int migrate_page_move_mapping(struct address_space *mapping,
         void **pslot;
 
         if (!mapping) {
-                /* Anonymous page */
+                /* Anonymous page without mapping */
                 if (page_count(page) != 1)
                         return -EAGAIN;
                 return 0;
@@ -333,6 +333,19 @@ static int migrate_page_move_mapping(struct address_space *mapping,
          */
         __put_page(page);
 
+        /*
+         * If moved to a different zone then also account
+         * the page for that zone. Other VM counters will be
+         * taken care of when we establish references to the
+         * new page and drop references to the old page.
+         *
+         * Note that anonymous pages are accounted for
+         * via NR_FILE_PAGES and NR_ANON_PAGES if they
+         * are mapped to swap space.
+         */
+        __dec_zone_page_state(page, NR_FILE_PAGES);
+        __inc_zone_page_state(newpage, NR_FILE_PAGES);
+
         write_unlock_irq(&mapping->tree_lock);
 
         return 0;
diff --git a/mm/nommu.c b/mm/nommu.c
index cbbc13774819..1f60194d9b9b 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -45,6 +45,7 @@ int heap_stack_gap = 0;
 
 EXPORT_SYMBOL(mem_map);
 EXPORT_SYMBOL(__vm_enough_memory);
+EXPORT_SYMBOL(num_physpages);
 
 /* list of shareable VMAs */
 struct rb_root nommu_vma_tree = RB_ROOT;
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 2f3916986abf..3791edfffeeb 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -176,6 +176,8 @@ static inline int constrained_alloc(struct zonelist *zonelist, gfp_t gfp_mask)
         struct zone **z;
         nodemask_t nodes;
         int node;
+
+        nodes_clear(nodes);
         /* node has memory ? */
         for_each_online_node(node)
                 if (NODE_DATA(node)->node_present_pages)
@@ -333,7 +335,7 @@ static int oom_kill_task(struct task_struct *p)
          */
         do_each_thread(g, q) {
                 if (q->mm == mm && q->tgid != p->tgid)
-                        force_sig(SIGKILL, p);
+                        force_sig(SIGKILL, q);
         } while_each_thread(g, q);
 
         return 0;
diff --git a/mm/rmap.c b/mm/rmap.c
index 22ed3f71a674..b82146e6dfc9 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -498,9 +498,9 @@ int page_mkclean(struct page *page)
                 struct address_space *mapping = page_mapping(page);
                 if (mapping)
                         ret = page_mkclean_file(mapping, page);
+                if (page_test_and_clear_dirty(page))
+                        ret = 1;
         }
-        if (page_test_and_clear_dirty(page))
-                ret = 1;
 
         return ret;
 }
diff --git a/mm/shmem.c b/mm/shmem.c
index b8c429a2d271..b2a35ebf071a 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -402,26 +402,38 @@ static swp_entry_t *shmem_swp_alloc(struct shmem_inode_info *info, unsigned long
 /*
  * shmem_free_swp - free some swap entries in a directory
  *
- * @dir:   pointer to the directory
- * @edir:  pointer after last entry of the directory
+ * @dir:        pointer to the directory
+ * @edir:       pointer after last entry of the directory
+ * @punch_lock: pointer to spinlock when needed for the holepunch case
  */
-static int shmem_free_swp(swp_entry_t *dir, swp_entry_t *edir)
+static int shmem_free_swp(swp_entry_t *dir, swp_entry_t *edir,
+                                                spinlock_t *punch_lock)
 {
+        spinlock_t *punch_unlock = NULL;
         swp_entry_t *ptr;
         int freed = 0;
 
         for (ptr = dir; ptr < edir; ptr++) {
                 if (ptr->val) {
+                        if (unlikely(punch_lock)) {
+                                punch_unlock = punch_lock;
+                                punch_lock = NULL;
+                                spin_lock(punch_unlock);
+                                if (!ptr->val)
+                                        continue;
+                        }
                         free_swap_and_cache(*ptr);
                         *ptr = (swp_entry_t){0};
                         freed++;
                 }
         }
+        if (punch_unlock)
+                spin_unlock(punch_unlock);
         return freed;
 }
 
-static int shmem_map_and_free_swp(struct page *subdir,
-                int offset, int limit, struct page ***dir)
+static int shmem_map_and_free_swp(struct page *subdir, int offset,
+                int limit, struct page ***dir, spinlock_t *punch_lock)
 {
         swp_entry_t *ptr;
         int freed = 0;
@@ -431,7 +443,8 @@ static int shmem_map_and_free_swp(struct page *subdir,
                 int size = limit - offset;
                 if (size > LATENCY_LIMIT)
                         size = LATENCY_LIMIT;
-                freed += shmem_free_swp(ptr+offset, ptr+offset+size);
+                freed += shmem_free_swp(ptr+offset, ptr+offset+size,
+                                                        punch_lock);
                 if (need_resched()) {
                         shmem_swp_unmap(ptr);
                         if (*dir) {
@@ -481,7 +494,10 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
         long nr_swaps_freed = 0;
         int offset;
         int freed;
-        int punch_hole = 0;
+        int punch_hole;
+        spinlock_t *needs_lock;
+        spinlock_t *punch_lock;
+        unsigned long upper_limit;
 
         inode->i_ctime = inode->i_mtime = CURRENT_TIME;
         idx = (start + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
@@ -492,11 +508,20 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
         info->flags |= SHMEM_TRUNCATE;
         if (likely(end == (loff_t) -1)) {
                 limit = info->next_index;
+                upper_limit = SHMEM_MAX_INDEX;
                 info->next_index = idx;
+                needs_lock = NULL;
+                punch_hole = 0;
         } else {
-                limit = (end + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-                if (limit > info->next_index)
-                        limit = info->next_index;
+                if (end + 1 >= inode->i_size) { /* we may free a little more */
+                        limit = (inode->i_size + PAGE_CACHE_SIZE - 1) >>
+                                                        PAGE_CACHE_SHIFT;
+                        upper_limit = SHMEM_MAX_INDEX;
+                } else {
+                        limit = (end + 1) >> PAGE_CACHE_SHIFT;
+                        upper_limit = limit;
+                }
+                needs_lock = &info->lock;
                 punch_hole = 1;
         }
 
@@ -513,17 +538,30 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
                 size = limit;
                 if (size > SHMEM_NR_DIRECT)
                         size = SHMEM_NR_DIRECT;
-                nr_swaps_freed = shmem_free_swp(ptr+idx, ptr+size);
+                nr_swaps_freed = shmem_free_swp(ptr+idx, ptr+size, needs_lock);
         }
 
         /*
          * If there are no indirect blocks or we are punching a hole
          * below indirect blocks, nothing to be done.
          */
-        if (!topdir || (punch_hole && (limit <= SHMEM_NR_DIRECT)))
+        if (!topdir || limit <= SHMEM_NR_DIRECT)
                 goto done2;
 
-        BUG_ON(limit <= SHMEM_NR_DIRECT);
+        /*
+         * The truncation case has already dropped info->lock, and we're safe
+         * because i_size and next_index have already been lowered, preventing
+         * access beyond.  But in the punch_hole case, we still need to take
+         * the lock when updating the swap directory, because there might be
+         * racing accesses by shmem_getpage(SGP_CACHE), shmem_unuse_inode or
+         * shmem_writepage.  However, whenever we find we can remove a whole
+         * directory page (not at the misaligned start or end of the range),
+         * we first NULLify its pointer in the level above, and then have no
+         * need to take the lock when updating its contents: needs_lock and
+         * punch_lock (either pointing to info->lock or NULL) manage this.
+         */
+
+        upper_limit -= SHMEM_NR_DIRECT;
         limit -= SHMEM_NR_DIRECT;
         idx = (idx > SHMEM_NR_DIRECT)? (idx - SHMEM_NR_DIRECT): 0;
         offset = idx % ENTRIES_PER_PAGE;
@@ -543,8 +581,14 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
                 if (*dir) {
                         diroff = ((idx - ENTRIES_PER_PAGEPAGE/2) %
                                 ENTRIES_PER_PAGEPAGE) / ENTRIES_PER_PAGE;
-                        if (!diroff && !offset) {
-                                *dir = NULL;
+                        if (!diroff && !offset && upper_limit >= stage) {
+                                if (needs_lock) {
+                                        spin_lock(needs_lock);
+                                        *dir = NULL;
+                                        spin_unlock(needs_lock);
+                                        needs_lock = NULL;
+                                } else
+                                        *dir = NULL;
                                 nr_pages_to_free++;
                                 list_add(&middir->lru, &pages_to_free);
                         }
@@ -570,39 +614,55 @@ static void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end)
                         }
                         stage = idx + ENTRIES_PER_PAGEPAGE;
                         middir = *dir;
-                        *dir = NULL;
-                        nr_pages_to_free++;
-                        list_add(&middir->lru, &pages_to_free);
+                        if (punch_hole)
+                                needs_lock = &info->lock;
+                        if (upper_limit >= stage) {
+                                if (needs_lock) {
+                                        spin_lock(needs_lock);
+                                        *dir = NULL;
+                                        spin_unlock(needs_lock);
+                                        needs_lock = NULL;
+                                } else
+                                        *dir = NULL;
+                                nr_pages_to_free++;
+                                list_add(&middir->lru, &pages_to_free);
+                        }
                         shmem_dir_unmap(dir);
                         cond_resched();
                         dir = shmem_dir_map(middir);
                         diroff = 0;
                 }
+                punch_lock = needs_lock;
                 subdir = dir[diroff];
-                if (subdir && page_private(subdir)) {
+                if (subdir && !offset && upper_limit-idx >= ENTRIES_PER_PAGE) {
+                        if (needs_lock) {
+                                spin_lock(needs_lock);
+                                dir[diroff] = NULL;
+                                spin_unlock(needs_lock);
+                                punch_lock = NULL;
+                        } else
+                                dir[diroff] = NULL;
+                        nr_pages_to_free++;
+                        list_add(&subdir->lru, &pages_to_free);
+                }
+                if (subdir && page_private(subdir) /* has swap entries */) {
                         size = limit - idx;
                         if (size > ENTRIES_PER_PAGE)
                                 size = ENTRIES_PER_PAGE;
                         freed = shmem_map_and_free_swp(subdir,
-                                                offset, size, &dir);
+                                        offset, size, &dir, punch_lock);
                         if (!dir)
                                 dir = shmem_dir_map(middir);
                         nr_swaps_freed += freed;
-                        if (offset)
+                        if (offset || punch_lock) {
                                 spin_lock(&info->lock);
-                        set_page_private(subdir, page_private(subdir) - freed);
-                        if (offset)
+                                set_page_private(subdir,
+                                        page_private(subdir) - freed);
                                 spin_unlock(&info->lock);
-                        if (!punch_hole)
-                                BUG_ON(page_private(subdir) > offset);
-                }
-                if (offset)
-                        offset = 0;
-                else if (subdir && !page_private(subdir)) {
-                        dir[diroff] = NULL;
-                        nr_pages_to_free++;
-                        list_add(&subdir->lru, &pages_to_free);
+                        } else
+                                BUG_ON(page_private(subdir) != freed);
                 }
+                offset = 0;
         }
 done1:
         shmem_dir_unmap(dir);
@@ -614,8 +674,16 @@ done2:
                  * generic_delete_inode did it, before we lowered next_index.
                  * Also, though shmem_getpage checks i_size before adding to
                  * cache, no recheck after: so fix the narrow window there too.
+                 *
+                 * Recalling truncate_inode_pages_range and unmap_mapping_range
+                 * every time for punch_hole (which never got a chance to clear
+                 * SHMEM_PAGEIN at the start of vmtruncate_range) is expensive,
+                 * yet hardly ever necessary: try to optimize them out later.
                  */
                 truncate_inode_pages_range(inode->i_mapping, start, end);
+                if (punch_hole)
+                        unmap_mapping_range(inode->i_mapping, start,
+                                                        end - start, 1);
         }
 
         spin_lock(&info->lock);
diff --git a/mm/slab.c b/mm/slab.c
index 57f7aa420064..4cbac24ae2f1 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1802,8 +1802,8 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
                         /* Print header */
                         if (lines == 0) {
                                 printk(KERN_ERR
-                                        "Slab corruption: start=%p, len=%d\n",
-                                        realobj, size);
+                                        "Slab corruption: %s start=%p, len=%d\n",
+                                        cachep->name, realobj, size);
                                 print_objinfo(cachep, objp, 0);
                         }
                         /* Hexdump the affected line */
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 2fc8fe2cb366..b6e0eea1e39e 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -380,6 +380,9 @@ int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                 } else {
                         vhdr->h_vlan_encapsulated_proto = htons(len);
                 }
+
+                skb->protocol = htons(ETH_P_8021Q);
+                skb->nh.raw = skb->data;
         }
 
         /* Before delegating work to the lower layer, enter our MAC-address */
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 113c175f1715..c8b7dc2c3257 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1417,10 +1417,13 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         /*
          * Size check to see if ddp->deh_len was crap
          * (Otherwise we'll detonate most spectacularly
-         * in the middle of recvmsg()).
+         * in the middle of atalk_checksum() or recvmsg()).
          */
-        if (skb->len < sizeof(*ddp))
+        if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) {
+                pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, "
+                         "skb->len=%u)\n", len_hops & 1023, skb->len);
                 goto freeit;
+        }
 
         /*
          * Any checksums. Note we don't do htons() on this == is assumed to be
diff --git a/net/atm/clip.c b/net/atm/clip.c
index ebb5d0ce8b6f..8c3825816085 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -261,14 +261,6 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         spin_unlock_irqrestore(&PRIV(dev)->xoff_lock, flags);
 }
 
-static void clip_neigh_destroy(struct neighbour *neigh)
-{
-        DPRINTK("clip_neigh_destroy (neigh %p)\n", neigh);
-        if (NEIGH2ENTRY(neigh)->vccs)
-                printk(KERN_CRIT "clip_neigh_destroy: vccs != NULL !!!\n");
-        NEIGH2ENTRY(neigh)->vccs = (void *) NEIGHBOR_DEAD;
-}
-
 static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
         DPRINTK("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
@@ -342,7 +334,6 @@ static struct neigh_table clip_tbl = {
         /* parameters are copied from ARP ... */
         .parms = {
                 .tbl                    = &clip_tbl,
-                .neigh_destructor       = clip_neigh_destroy,
                 .base_reachable_time    = 30 * HZ,
                 .retrans_time           = 1 * HZ,
                 .gc_staletime           = 60 * HZ,
diff --git a/net/ax25/Kconfig b/net/ax25/Kconfig
index a8993a041724..43dd86fca4d3 100644
--- a/net/ax25/Kconfig
+++ b/net/ax25/Kconfig
@@ -1,30 +1,27 @@
 #
 # Amateur Radio protocols and AX.25 device configuration
 #
-# 19971130      Now in an own category to make correct compilation of the
-#               AX.25 stuff easier...
-#               Joerg Reuter DL1BKE <jreuter@yaina.de>
-# 19980129      Moved to net/ax25/Config.in, sourcing device drivers.
 
 menuconfig HAMRADIO
         depends on NET
         bool "Amateur Radio support"
         help
           If you want to connect your Linux box to an amateur radio, answer Y
-          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html> and
-          the AX25-HOWTO, available from <http://www.tldp.org/docs.html#howto>.
+          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html>
+          and more specifically about AX.25 on Linux
+          <http://www.linux-ax25.org/>.
 
           Note that the answer to this question won't directly affect the
           kernel: saying N will just cause the configurator to skip all
           the questions about amateur radio.
 
 comment "Packet Radio protocols"
-        depends on HAMRADIO && NET
+        depends on HAMRADIO
 
 config AX25
         tristate "Amateur Radio AX.25 Level 2 protocol"
-        depends on HAMRADIO && NET
-        ---help---
+        depends on HAMRADIO
+        help
           This is the protocol used for computer communication over amateur
           radio. It is either used by itself for point-to-point links, or to
           carry other protocols such as tcp/ip. To use it, you need a device
@@ -52,6 +49,7 @@ config AX25
 
 config AX25_DAMA_SLAVE
         bool "AX.25 DAMA Slave support"
+        default y
         depends on AX25
         help
           DAMA is a mechanism to prevent collisions when doing AX.25
@@ -59,23 +57,38 @@ config AX25_DAMA_SLAVE
           from clients (called "slaves") and redistributes it to other slaves.
           If you say Y here, your Linux box will act as a DAMA slave; this is
           transparent in that you don't have to do any special DAMA
-          configuration. (Linux cannot yet act as a DAMA server.) If unsure,
-          say N.
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be enabled at runtime.  For more about DAMA see
+          <http://www.linux-ax25.org>.  If unsure, say Y.
+
+# placeholder until implemented
+config AX25_DAMA_MASTER
+        bool 'AX.25 DAMA Master support'
+        depends on AX25_DAMA_SLAVE && BROKEN
+        help
+          DAMA is a mechanism to prevent collisions when doing AX.25
+          networking. A DAMA server (called "master") accepts incoming traffic
+          from clients (called "slaves") and redistributes it to other slaves.
+          If you say Y here, your Linux box will act as a DAMA master; this is
+          transparent in that you don't have to do any special DAMA
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be explicitly enabled, so if unsure, say Y.
 
-#        bool '    AX.25 DAMA Master support' CONFIG_AX25_DAMA_MASTER
 config NETROM
         tristate "Amateur Radio NET/ROM protocol"
         depends on AX25
-        ---help---
+        help
           NET/ROM is a network layer protocol on top of AX.25 useful for
           routing.
 
           A comprehensive listing of all the software for Linux amateur radio
           users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>. You also might want to
-          check out the file <file:Documentation/networking/ax25.txt>. More
-          information about digital amateur radio in general is on the WWW at
+          contained in the Linux Ham Wiki, available from
+          <http://www.linux-ax25.org>. You also might want to check out the
+          file <file:Documentation/networking/ax25.txt>. More information about
+          digital amateur radio in general is on the WWW at
           <http://www.tapr.org/tapr/html/pkthome.html>.
 
           To compile this driver as a module, choose M here: the
@@ -84,27 +97,25 @@ config NETROM
 config ROSE
         tristate "Amateur Radio X.25 PLP (Rose)"
         depends on AX25
-        ---help---
+        help
           The Packet Layer Protocol (PLP) is a way to route packets over X.25
           connections in general and amateur radio AX.25 connections in
           particular, essentially an alternative to NET/ROM.
 
           A comprehensive listing of all the software for Linux amateur radio
           users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>.  You also might want to
-          check out the file <file:Documentation/networking/ax25.txt>. More
-          information about digital amateur radio in general is on the WWW at
+          contained in the Linux Ham Wiki, available from
+          <http://www.linux-ax25.org>.  You also might want to check out the
+          file <file:Documentation/networking/ax25.txt>. More information about
+          digital amateur radio in general is on the WWW at
           <http://www.tapr.org/tapr/html/pkthome.html>.
 
           To compile this driver as a module, choose M here: the
           module will be called rose.
 
-
 menu "AX.25 network device drivers"
-        depends on HAMRADIO && NET && AX25!=n
+        depends on HAMRADIO && AX25
 
 source "drivers/net/hamradio/Kconfig"
 
 endmenu
-
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index ecfe8da1ce6b..d342e89b8bdd 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -679,6 +679,27 @@ static void hidp_close(struct hid_device *hid)
 {
 }
 
+static const struct {
+        __u16 idVendor;
+        __u16 idProduct;
+        unsigned quirks;
+} hidp_blacklist[] = {
+        /* Apple wireless Mighty Mouse */
+        { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
+
+        { }     /* Terminating entry */
+};
+
+static void hidp_setup_quirks(struct hid_device *hid)
+{
+        unsigned int n;
+
+        for (n = 0; hidp_blacklist[n].idVendor; n++)
+                if (hidp_blacklist[n].idVendor == le16_to_cpu(hid->vendor) &&
+                                hidp_blacklist[n].idProduct == le16_to_cpu(hid->product))
+                        hid->quirks = hidp_blacklist[n].quirks;
+}
+
 static inline void hidp_setup_hid(struct hidp_session *session, struct hidp_connadd_req *req)
 {
         struct hid_device *hid = session->hid;
@@ -708,6 +729,8 @@ static inline void hidp_setup_hid(struct hidp_session *session, struct hidp_conn
 
         hid->hidinput_input_event = hidp_hidinput_event;
 
+        hidp_setup_quirks(hid);
+
         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].report_list, list)
                 hidp_send_report(session, report);
 
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 58d13f2bd121..a285897a2fb4 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -126,7 +126,9 @@ void br_stp_disable_port(struct net_bridge_port *p)
 /* called under bridge lock */
 void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
 {
-        unsigned char oldaddr[6];
+        /* should be aligned on 2 bytes for compare_ether_addr() */
+        unsigned short oldaddr_aligned[ETH_ALEN >> 1];
+        unsigned char *oldaddr = (unsigned char *)oldaddr_aligned;
         struct net_bridge_port *p;
         int wasroot;
 
@@ -151,11 +153,14 @@ void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *addr)
                 br_become_root_bridge(br);
 }
 
-static const unsigned char br_mac_zero[6];
+/* should be aligned on 2 bytes for compare_ether_addr() */
+static const unsigned short br_mac_zero_aligned[ETH_ALEN >> 1];
 
 /* called under bridge lock */
 void br_stp_recalculate_bridge_id(struct net_bridge *br)
 {
+        const unsigned char *br_mac_zero =
+                        (const unsigned char *)br_mac_zero_aligned;
         const unsigned char *addr = br_mac_zero;
         struct net_bridge_port *p;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index cf71614dae93..4dc93cc4d5b7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -751,13 +751,10 @@ int dev_change_name(struct net_device *dev, char *newname)
         else
                 strlcpy(dev->name, newname, IFNAMSIZ);
 
-        err = device_rename(&dev->dev, dev->name);
-        if (!err) {
-                hlist_del(&dev->name_hlist);
-                hlist_add_head(&dev->name_hlist, dev_name_hash(dev->name));
-                raw_notifier_call_chain(&netdev_chain,
-                                NETDEV_CHANGENAME, dev);
-        }
+        device_rename(&dev->dev, dev->name);
+        hlist_del(&dev->name_hlist);
+        hlist_add_head(&dev->name_hlist, dev_name_hash(dev->name));
+        raw_notifier_call_chain(&netdev_chain, NETDEV_CHANGENAME, dev);
 
         return err;
 }
@@ -1741,8 +1738,8 @@ static int ing_filter(struct sk_buff *skb)
         if (dev->qdisc_ingress) {
                 __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
                 if (MAX_RED_LOOP < ttl++) {
-                        printk(KERN_WARNING "Redir loop detected Dropping packet (%s->%s)\n",
-                                skb->input_dev->name, skb->dev->name);
+                        printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n",
+                                skb->iif, skb->dev->ifindex);
                         return TC_ACT_SHOT;
                 }
 
@@ -1750,10 +1747,10 @@ static int ing_filter(struct sk_buff *skb)
 
                 skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS);
 
-                spin_lock(&dev->ingress_lock);
+                spin_lock(&dev->queue_lock);
                 if ((q = dev->qdisc_ingress) != NULL)
                         result = q->enqueue(skb, q);
-                spin_unlock(&dev->ingress_lock);
+                spin_unlock(&dev->queue_lock);
 
         }
 
@@ -1775,8 +1772,8 @@ int netif_receive_skb(struct sk_buff *skb)
         if (!skb->tstamp.off_sec)
                 net_timestamp(skb);
 
-        if (!skb->input_dev)
-                skb->input_dev = skb->dev;
+        if (!skb->iif)
+                skb->iif = skb->dev->ifindex;
 
         orig_dev = skb_bond(skb);
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 3aea4e87d3d7..7174ced75efc 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -143,7 +143,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
                 }
         }
 
-        err = -ENETUNREACH;
+        err = -ESRCH;
 out:
         rcu_read_unlock();
 
@@ -152,6 +152,28 @@ out:
 
 EXPORT_SYMBOL_GPL(fib_rules_lookup);
 
+static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
+                            struct fib_rules_ops *ops)
+{
+        int err = -EINVAL;
+
+        if (frh->src_len)
+                if (tb[FRA_SRC] == NULL ||
+                    frh->src_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_SRC]) != ops->addr_size)
+                        goto errout;
+
+        if (frh->dst_len)
+                if (tb[FRA_DST] == NULL ||
+                    frh->dst_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_DST]) != ops->addr_size)
+                        goto errout;
+
+        err = 0;
+errout:
+        return err;
+}
+
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
         struct fib_rule_hdr *frh = nlmsg_data(nlh);
@@ -173,6 +195,10 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 goto errout;
 
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
+
         rule = kzalloc(ops->rule_size, GFP_KERNEL);
         if (rule == NULL) {
                 err = -ENOMEM;
@@ -260,6 +286,10 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 goto errout;
 
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
+
         list_for_each_entry(rule, ops->rules_list, list) {
                 if (frh->action && (frh->action != rule->action))
                         continue;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 3183142c6044..841e3f32cab1 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -140,6 +140,8 @@ static int neigh_forced_gc(struct neigh_table *tbl)
                                 n->dead = 1;
                                 shrunk  = 1;
                                 write_unlock(&n->lock);
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                 neigh_release(n);
                                 continue;
                         }
@@ -211,6 +213,8 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
                                 NEIGH_PRINTK2("neigh %p is stray.\n", n);
                         }
                         write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                         neigh_release(n);
                 }
         }
@@ -582,9 +586,6 @@ void neigh_destroy(struct neighbour *neigh)
                         kfree(hh);
         }
 
-        if (neigh->parms->neigh_destructor)
-                (neigh->parms->neigh_destructor)(neigh);
-
         skb_queue_purge(&neigh->arp_queue);
 
         dev_put(neigh->dev);
@@ -675,6 +676,8 @@ static void neigh_periodic_timer(unsigned long arg)
                         *np = n->next;
                         n->dead = 1;
                         write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                         neigh_release(n);
                         continue;
                 }
@@ -1328,6 +1331,8 @@ void neigh_parms_destroy(struct neigh_parms *parms)
         kfree(parms);
 }
 
+static struct lock_class_key neigh_table_proxy_queue_class;
+
 void neigh_table_init_no_netlink(struct neigh_table *tbl)
 {
         unsigned long now = jiffies;
@@ -1376,7 +1381,8 @@ void neigh_table_init_no_netlink(struct neigh_table *tbl)
         init_timer(&tbl->proxy_timer);
         tbl->proxy_timer.data     = (unsigned long)tbl;
         tbl->proxy_timer.function = neigh_proxy_process;
-        skb_queue_head_init(&tbl->proxy_queue);
+        skb_queue_head_init_class(&tbl->proxy_queue,
+                        &neigh_table_proxy_queue_class);
 
         tbl->last_flush = now;
         tbl->last_rand  = now + tbl->parms.reachable_time * 20;
@@ -2088,8 +2094,11 @@ void __neigh_for_each_release(struct neigh_table *tbl,
                         } else
                                 np = &n->next;
                         write_unlock(&n->lock);
-                        if (release)
+                        if (release) {
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                 neigh_release(n);
+                        }
                 }
         }
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index da1019451ccb..4581ece48bb2 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -471,6 +471,13 @@ int __netpoll_rx(struct sk_buff *skb)
         if (skb->len < len || len < iph->ihl*4)
                 goto out;
 
+        /*
+         * Our transport medium may have padded the buffer out.
+         * Now We trim to the true length of the frame.
+         */
+        if (pskb_trim_rcsum(skb, len))
+                goto out;
+
         if (iph->protocol != IPPROTO_UDP)
                 goto out;
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 74a9a32b906d..4b01496dc33d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -129,6 +129,7 @@
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/capability.h>
+#include <linux/freezer.h>
 #include <linux/delay.h>
 #include <linux/timer.h>
 #include <linux/list.h>
@@ -3333,6 +3334,8 @@ static int pktgen_thread_worker(void *arg)
                         t->control &= ~(T_REMDEV);
                 }
 
+                try_to_freeze();
+
                 set_current_state(TASK_INTERRUPTIBLE);
         }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 6055074c4b81..33ea8eac7fe0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -621,7 +621,8 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 if (err < 0)
                         goto errout;
 
-                iw += IW_EV_POINT_OFF;
+                /* Payload is at an offset in buffer */
+                iw = iw_buf + IW_EV_POINT_OFF;
         }
 #endif  /* CONFIG_NET_WIRELESS_RTNETLINK */
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 702fa8f08747..336958fbbcb2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -197,61 +197,6 @@ nodata:
 }
 
 /**
- *      alloc_skb_from_cache    -       allocate a network buffer
- *      @cp: kmem_cache from which to allocate the data area
- *           (object size must be big enough for @size bytes + skb overheads)
- *      @size: size to allocate
- *      @gfp_mask: allocation mask
- *
- *      Allocate a new &sk_buff. The returned buffer has no headroom and
- *      tail room of size bytes. The object has a reference count of one.
- *      The return is the buffer. On a failure the return is %NULL.
- *
- *      Buffers may only be allocated from interrupts using a @gfp_mask of
- *      %GFP_ATOMIC.
- */
-struct sk_buff *alloc_skb_from_cache(struct kmem_cache *cp,
-                                     unsigned int size,
-                                     gfp_t gfp_mask)
-{
-        struct sk_buff *skb;
-        u8 *data;
-
-        /* Get the HEAD */
-        skb = kmem_cache_alloc(skbuff_head_cache,
-                               gfp_mask & ~__GFP_DMA);
-        if (!skb)
-                goto out;
-
-        /* Get the DATA. */
-        size = SKB_DATA_ALIGN(size);
-        data = kmem_cache_alloc(cp, gfp_mask);
-        if (!data)
-                goto nodata;
-
-        memset(skb, 0, offsetof(struct sk_buff, truesize));
-        skb->truesize = size + sizeof(struct sk_buff);
-        atomic_set(&skb->users, 1);
-        skb->head = data;
-        skb->data = data;
-        skb->tail = data;
-        skb->end  = data + size;
-
-        atomic_set(&(skb_shinfo(skb)->dataref), 1);
-        skb_shinfo(skb)->nr_frags  = 0;
-        skb_shinfo(skb)->gso_size = 0;
-        skb_shinfo(skb)->gso_segs = 0;
-        skb_shinfo(skb)->gso_type = 0;
-        skb_shinfo(skb)->frag_list = NULL;
-out:
-        return skb;
-nodata:
-        kmem_cache_free(skbuff_head_cache, skb);
-        skb = NULL;
-        goto out;
-}
-
-/**
  *      __netdev_alloc_skb - allocate an skbuff for rx on a specific device
  *      @dev: network device to receive on
  *      @length: length to allocate
@@ -496,7 +441,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
         n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
         n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-        C(input_dev);
+        C(iif);
 #endif
         skb_copy_secmark(n, skb);
 #endif
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 9936ab11e6e0..b07fe270a508 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -2,7 +2,7 @@
  * This file implement the Wireless Extensions APIs.
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 1997-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
@@ -76,6 +76,9 @@
  *      o Change length in ESSID and NICK to strlen() instead of strlen()+1
  *      o Make standard_ioctl_num and standard_event_num unsigned
  *      o Remove (struct net_device *)->get_wireless_stats()
+ *
+ * v10 - 16.3.07 - Jean II
+ *      o Prevent leaking of kernel space in stream on 64 bits.
  */
 
 /***************************** INCLUDES *****************************/
@@ -427,6 +430,21 @@ static const int event_type_size[] = {
         IW_EV_QUAL_LEN,                 /* IW_HEADER_TYPE_QUAL */
 };
 
+/* Size (in bytes) of various events, as packed */
+static const int event_type_pk_size[] = {
+        IW_EV_LCP_PK_LEN,               /* IW_HEADER_TYPE_NULL */
+        0,
+        IW_EV_CHAR_PK_LEN,              /* IW_HEADER_TYPE_CHAR */
+        0,
+        IW_EV_UINT_PK_LEN,              /* IW_HEADER_TYPE_UINT */
+        IW_EV_FREQ_PK_LEN,              /* IW_HEADER_TYPE_FREQ */
+        IW_EV_ADDR_PK_LEN,              /* IW_HEADER_TYPE_ADDR */
+        0,
+        IW_EV_POINT_PK_LEN,             /* Without variable payload */
+        IW_EV_PARAM_PK_LEN,             /* IW_HEADER_TYPE_PARAM */
+        IW_EV_QUAL_PK_LEN,              /* IW_HEADER_TYPE_QUAL */
+};
+
 /************************ COMMON SUBROUTINES ************************/
 /*
  * Stuff that may be used in various place or doesn't fit in one
@@ -1217,7 +1235,7 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                 memcpy(buffer + IW_EV_POINT_OFF, request, request_len);
                 /* Use our own copy of wrqu */
                 wrqu = (union iwreq_data *) (buffer + IW_EV_POINT_OFF
-                                             + IW_EV_LCP_LEN);
+                                             + IW_EV_LCP_PK_LEN);
 
                 /* No extra arguments. Trivial to handle */
                 ret = handler(dev, &info, wrqu, NULL);
@@ -1229,8 +1247,8 @@ static int rtnetlink_standard_get(struct net_device *	dev,
 
                 /* Get a temp copy of wrqu (skip pointer) */
                 memcpy(((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       ((char *) request) + IW_EV_LCP_LEN,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       ((char *) request) + IW_EV_LCP_PK_LEN,
+                       IW_EV_POINT_LEN - IW_EV_LCP_PK_LEN);
 
                 /* Calculate space needed by arguments. Always allocate
                  * for max space. Easier, and won't last long... */
@@ -1240,7 +1258,7 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                    (wrqu_point.data.length > descr->max_tokens))
                         extra_size = (wrqu_point.data.length
                                       * descr->token_size);
-                buffer_size = extra_size + IW_EV_POINT_LEN + IW_EV_POINT_OFF;
+                buffer_size = extra_size + IW_EV_POINT_PK_LEN + IW_EV_POINT_OFF;
 #ifdef WE_RTNETLINK_DEBUG
                 printk(KERN_DEBUG "%s (WE.r) : Malloc %d bytes (%d bytes)\n",
                        dev->name, extra_size, buffer_size);
@@ -1254,15 +1272,15 @@ static int rtnetlink_standard_get(struct net_device *	dev,
 
                 /* Put wrqu in the right place (just before extra).
                  * Leave space for IWE header and dummy pointer...
-                 * Note that IW_EV_LCP_LEN==4 bytes, so it's still aligned...
+                 * Note that IW_EV_LCP_PK_LEN==4 bytes, so it's still aligned.
                  */
-                memcpy(buffer + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
+                memcpy(buffer + IW_EV_LCP_PK_LEN + IW_EV_POINT_OFF,
                        ((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
-                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
+                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_PK_LEN);
 
                 /* Extra comes logically after that. Offset +12 bytes. */
-                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_LEN;
+                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_PK_LEN;
 
                 /* Call the handler */
                 ret = handler(dev, &info, wrqu, extra);
@@ -1270,11 +1288,11 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                 /* Calculate real returned length */
                 extra_size = (wrqu->data.length * descr->token_size);
                 /* Re-adjust reply size */
-                request->len = extra_size + IW_EV_POINT_LEN;
+                request->len = extra_size + IW_EV_POINT_PK_LEN;
 
                 /* Put the iwe header where it should, i.e. scrap the
                  * dummy pointer. */
-                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_LEN);
+                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_PK_LEN);
 
 #ifdef WE_RTNETLINK_DEBUG
                 printk(KERN_DEBUG "%s (WE.r) : Reply 0x%04X, hdr_len %d, tokens %d, extra_size %d, buffer_size %d\n", dev->name, cmd, hdr_len, wrqu->data.length, extra_size, buffer_size);
@@ -1331,10 +1349,10 @@ static inline int rtnetlink_standard_set(struct net_device *	dev,
 #endif  /* WE_RTNETLINK_DEBUG */
 
         /* Extract fixed header from request. This is properly aligned. */
-        wrqu = &request->u;
+        wrqu = (union iwreq_data *) (((char *) request) + IW_EV_LCP_PK_LEN);
 
         /* Check if wrqu is complete */
-        hdr_len = event_type_size[descr->header_type];
+        hdr_len = event_type_pk_size[descr->header_type];
         if(request_len < hdr_len) {
 #ifdef WE_RTNETLINK_DEBUG
                 printk(KERN_DEBUG
@@ -1359,7 +1377,7 @@ static inline int rtnetlink_standard_set(struct net_device *	dev,
 
                 /* Put wrqu in the right place (skip pointer) */
                 memcpy(((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       wrqu, IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       wrqu, IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                 /* Don't forget about the event code... */
                 wrqu = &wrqu_point;
 
@@ -1483,7 +1501,7 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                 hdr_len = extra_size;
                 extra_size = 0;
         } else {
-                hdr_len = IW_EV_POINT_LEN;
+                hdr_len = IW_EV_POINT_PK_LEN;
         }
 
         /* Check if wrqu is complete */
@@ -1514,7 +1532,7 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                 memcpy(buffer + IW_EV_POINT_OFF, request, request_len);
                 /* Use our own copy of wrqu */
                 wrqu = (union iwreq_data *) (buffer + IW_EV_POINT_OFF
-                                             + IW_EV_LCP_LEN);
+                                             + IW_EV_LCP_PK_LEN);
 
                 /* No extra arguments. Trivial to handle */
                 ret = handler(dev, &info, wrqu, (char *) wrqu);
@@ -1523,7 +1541,7 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                 char *  extra;
 
                 /* Buffer for full reply */
-                buffer_size = extra_size + IW_EV_POINT_LEN + IW_EV_POINT_OFF;
+                buffer_size = extra_size + IW_EV_POINT_PK_LEN + IW_EV_POINT_OFF;
 
 #ifdef WE_RTNETLINK_DEBUG
                 printk(KERN_DEBUG "%s (WE.r) : Malloc %d bytes (%d bytes)\n",
@@ -1538,15 +1556,15 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
 
                 /* Put wrqu in the right place (just before extra).
                  * Leave space for IWE header and dummy pointer...
-                 * Note that IW_EV_LCP_LEN==4 bytes, so it's still aligned...
+                 * Note that IW_EV_LCP_PK_LEN==4 bytes, so it's still aligned.
                  */
-                memcpy(buffer + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
-                       ((char *) request) + IW_EV_LCP_LEN,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
-                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_LEN);
+                memcpy(buffer + IW_EV_LCP_PK_LEN + IW_EV_POINT_OFF,
+                       ((char *) request) + IW_EV_LCP_PK_LEN,
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
+                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_PK_LEN);
 
                 /* Extra comes logically after that. Offset +12 bytes. */
-                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_LEN;
+                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_PK_LEN;
 
                 /* Call the handler */
                 ret = handler(dev, &info, wrqu, extra);
@@ -1556,11 +1574,11 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                 if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
                         extra_size = adjust_priv_size(descr->get_args, wrqu);
                 /* Re-adjust reply size */
-                request->len = extra_size + IW_EV_POINT_LEN;
+                request->len = extra_size + IW_EV_POINT_PK_LEN;
 
                 /* Put the iwe header where it should, i.e. scrap the
                  * dummy pointer. */
-                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_LEN);
+                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_PK_LEN);
 
 #ifdef WE_RTNETLINK_DEBUG
                 printk(KERN_DEBUG "%s (WE.r) : Reply 0x%04X, hdr_len %d, tokens %d, extra_size %d, buffer_size %d\n", dev->name, cmd, hdr_len, wrqu->data.length, extra_size, buffer_size);
@@ -1641,14 +1659,14 @@ static inline int rtnetlink_private_set(struct net_device *	dev,
         /* Does it fits in wrqu ? */
         if((descr->set_args & IW_PRIV_SIZE_FIXED) &&
            (extra_size <= IFNAMSIZ)) {
-                hdr_len = IW_EV_LCP_LEN + extra_size;
+                hdr_len = IW_EV_LCP_PK_LEN + extra_size;
                 extra_size = 0;
         } else {
-                hdr_len = IW_EV_POINT_LEN;
+                hdr_len = IW_EV_POINT_PK_LEN;
         }
 
         /* Extract fixed header from request. This is properly aligned. */
-        wrqu = &request->u;
+        wrqu = (union iwreq_data *) (((char *) request) + IW_EV_LCP_PK_LEN);
 
         /* Check if wrqu is complete */
         if(request_len < hdr_len) {
@@ -1675,7 +1693,7 @@ static inline int rtnetlink_private_set(struct net_device *	dev,
 
                 /* Put wrqu in the right place (skip pointer) */
                 memcpy(((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       wrqu, IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       wrqu, IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
 
                 /* Does it fits within bounds ? */
                 if(wrqu_point.data.length > (descr->set_args &
@@ -1738,7 +1756,7 @@ int wireless_rtnetlink_get(struct net_device *	dev,
         iw_handler              handler;
 
         /* Check length */
-        if(len < IW_EV_LCP_LEN) {
+        if(len < IW_EV_LCP_PK_LEN) {
                 printk(KERN_DEBUG "%s (WE.r) : RtNetlink request too short (%d)\n",
                        dev->name, len);
                 return -EINVAL;
@@ -1822,7 +1840,7 @@ int wireless_rtnetlink_set(struct net_device *	dev,
         iw_handler              handler;
 
         /* Check length */
-        if(len < IW_EV_LCP_LEN) {
+        if(len < IW_EV_LCP_PK_LEN) {
                 printk(KERN_DEBUG "%s (WE.r) : RtNetlink request too short (%d)\n",
                        dev->name, len);
                 return -EINVAL;
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index a0e7cd183a5d..e33a9edb4036 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -191,7 +191,6 @@ extern void dccp_send_sync(struct sock *sk, const u64 seq,
                            const enum dccp_pkt_type pkt_type);
 
 extern void dccp_write_xmit(struct sock *sk, int block);
-extern void dccp_write_xmit_timer(unsigned long data);
 extern void dccp_write_space(struct sock *sk);
 
 extern void dccp_init_xmit_timers(struct sock *sk);
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index cf28c53a389a..6607b7b14f34 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -575,7 +575,7 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
         if (get_user(len, optlen))
                 return -EFAULT;
 
-        if (len < sizeof(int))
+        if (len < (int)sizeof(int))
                 return -EINVAL;
 
         dp = dccp_sk(sk);
@@ -589,9 +589,11 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
                                                (__be32 __user *)optval, optlen);
         case DCCP_SOCKOPT_SEND_CSCOV:
                 val = dp->dccps_pcslen;
+                len = sizeof(val);
                 break;
         case DCCP_SOCKOPT_RECV_CSCOV:
                 val = dp->dccps_pcrlen;
+                len = sizeof(val);
                 break;
         case 128 ... 191:
                 return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index b038a0a3ad40..0197a41c256a 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -262,7 +262,7 @@ out:
 }
 
 /* Transmit-delay timer: used by the CCIDs to delay actual send time */
-void dccp_write_xmit_timer(unsigned long data)
+static void dccp_write_xmit_timer(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
         struct dccp_sock *dp = dccp_sk(sk);
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 3cbfddc98430..82d58a977e6f 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -63,7 +63,7 @@ static struct
 {
         int error;
         u8 scope;
-} dn_fib_props[RTA_MAX+1] = {
+} dn_fib_props[RTN_MAX+1] = {
         [RTN_UNSPEC] =      { .error = 0,       .scope = RT_SCOPE_NOWHERE },
         [RTN_UNICAST] =     { .error = 0,       .scope = RT_SCOPE_UNIVERSE },
         [RTN_LOCAL] =       { .error = 0,       .scope = RT_SCOPE_HOST },
@@ -276,6 +276,9 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
         struct dn_fib_info *ofi;
         int nhs = 1;
 
+        if (r->rtm_type > RTN_MAX)
+                goto err_inval;
+
         if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
                 goto err_inval;
 
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index b6c98ac93dc8..5e86dd542302 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -109,8 +109,6 @@ errout:
 
 static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U16 },
-        [FRA_DST]       = { .type = NLA_U16 },
 };
 
 static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
@@ -133,7 +131,7 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
 
-        if (frh->src_len > 16 || frh->dst_len > 16 || frh->tos)
+        if (frh->tos)
                 goto  errout;
 
         if (rule->table == RT_TABLE_UNSPEC) {
@@ -150,10 +148,10 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 r->src = nla_get_le16(tb[FRA_SRC]);
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 r->dst = nla_get_le16(tb[FRA_DST]);
 
         r->src_len = frh->src_len;
@@ -176,10 +174,10 @@ static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->dst_len && (r->dst_len != frh->dst_len))
                 return 0;
 
-        if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC])))
+        if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST])))
+        if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -249,6 +247,7 @@ int dn_fib_dump_rules(struct sk_buff *skb, struct netlink_callback *cb)
 static struct fib_rules_ops dn_fib_rules_ops = {
         .family         = AF_DECnet,
         .rule_size      = sizeof(struct dn_fib_rule),
+        .addr_size      = sizeof(u16),
         .action         = dn_fib_rule_action,
         .match          = dn_fib_rule_match,
         .configure      = dn_fib_rule_configure,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 1fba6439fc57..cac06c43f004 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -493,6 +493,11 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
         cfg->fc_nlinfo.nlh = nlh;
 
+        if (cfg->fc_type > RTN_MAX) {
+                err = -EINVAL;
+                goto errout;
+        }
+
         nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
                 switch (attr->nla_type) {
                 case RTA_DST:
@@ -771,6 +776,8 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                                        .nl_u = { .ip4_u = { .daddr = frn->fl_addr,
                                                             .tos = frn->fl_tos,
                                                             .scope = frn->fl_scope } } };
+
+        frn->err = -ENOENT;
         if (tb) {
                 local_bh_disable();
 
@@ -782,6 +789,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                         frn->nh_sel = res.nh_sel;
                         frn->type = res.type;
                         frn->scope = res.scope;
+                        fib_res_put(&res);
                 }
                 local_bh_enable();
         }
@@ -796,6 +804,9 @@ static void nl_fib_input(struct sock *sk, int len)
         struct fib_table *tb;
 
         skb = skb_dequeue(&sk->sk_receive_queue);
+        if (skb == NULL)
+                return;
+
         nlh = (struct nlmsghdr *)skb->data;
         if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
             nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
@@ -808,7 +819,7 @@ static void nl_fib_input(struct sock *sk, int len)
 
         nl_fib_lookup(frn, tb);
 
-        pid = nlh->nlmsg_pid;           /*pid of sending process */
+        pid = NETLINK_CB(skb).pid;       /* pid of sending process */
         NETLINK_CB(skb).pid = 0;         /* from kernel */
         NETLINK_CB(skb).dst_group = 0;  /* unicast */
         netlink_unicast(sk, skb, pid, MSG_DONTWAIT);
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index b837c33e0404..c660c074c76c 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -171,8 +171,6 @@ static struct fib_table *fib_empty_table(void)
 
 static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U32 },
-        [FRA_DST]       = { .type = NLA_U32 },
         [FRA_FLOW]      = { .type = NLA_U32 },
 };
 
@@ -183,8 +181,7 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib4_rule *rule4 = (struct fib4_rule *) rule;
 
-        if (frh->src_len > 32 || frh->dst_len > 32 ||
-            (frh->tos & ~IPTOS_TOS_MASK))
+        if (frh->tos & ~IPTOS_TOS_MASK)
                 goto errout;
 
         if (rule->table == RT_TABLE_UNSPEC) {
@@ -201,10 +198,10 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 rule4->src = nla_get_be32(tb[FRA_SRC]);
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 rule4->dst = nla_get_be32(tb[FRA_DST]);
 
 #ifdef CONFIG_NET_CLS_ROUTE
@@ -242,10 +239,10 @@ static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
                 return 0;
 #endif
 
-        if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC])))
+        if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST])))
+        if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -309,6 +306,7 @@ static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib4_rules_ops = {
         .family         = AF_INET,
         .rule_size      = sizeof(struct fib4_rule),
+        .addr_size      = sizeof(u32),
         .action         = fib4_rule_action,
         .match          = fib4_rule_match,
         .configure      = fib4_rule_configure,
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 2f1fdae6efa6..3dad12ee76c3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -89,7 +89,7 @@ static const struct
 {
         int     error;
         u8      scope;
-} fib_props[RTA_MAX + 1] = {
+} fib_props[RTN_MAX + 1] = {
         {
                 .error  = 0,
                 .scope  = RT_SCOPE_NOWHERE,
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ada9b3db507d..214c34732e84 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1123,6 +1123,9 @@ err:
         return fa_head;
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
@@ -1540,6 +1543,9 @@ static int trie_leaf_remove(struct trie *t, t_key key)
         return 1;
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
@@ -1718,6 +1724,9 @@ up:
         return NULL; /* Ready. Root of trie */
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 5170f5c75f9d..57b0221f9e24 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -166,13 +166,9 @@ static inline int arp_packet_match(const struct arphdr *arphdr,
                 return 0;
         }
 
-        for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
-                unsigned long odev;
-                memcpy(&odev, outdev + i*sizeof(unsigned long),
-                       sizeof(unsigned long));
-                ret |= (odev
-                        ^ ((const unsigned long *)arpinfo->outiface)[i])
-                        & ((const unsigned long *)arpinfo->outiface_mask)[i];
+        for (i = 0, ret = 0; i < IFNAMSIZ; i++) {
+                ret |= (outdev[i] ^ arpinfo->outiface[i])
+                        & arpinfo->outiface_mask[i];
         }
 
         if (FWINV(ret != 0, ARPT_INV_VIA_OUT)) {
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e965b333c997..42b08029e867 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -411,12 +411,10 @@ checkentry(const char *tablename,
                                        "has invalid config pointer!\n");
                                 return 0;
                         }
-                        clusterip_config_entry_get(cipinfo->config);
                 } else {
                         /* Case B: This is a new rule referring to an existing
                          * clusterip config. */
                         cipinfo->config = config;
-                        clusterip_config_entry_get(cipinfo->config);
                 }
         } else {
                 /* Case C: This is a completely new clusterip config */
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index a26404dbe212..9acc018766f2 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -61,6 +61,7 @@
 #include <linux/netfilter_ipv4/ipt_ULOG.h>
 #include <net/sock.h>
 #include <linux/bitops.h>
+#include <asm/unaligned.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
@@ -236,9 +237,9 @@ static void ipt_ulog_packet(unsigned int hooknum,
 
         /* copy hook, prefix, timestamp, payload, etc. */
         pm->data_len = copy_len;
-        pm->timestamp_sec = skb->tstamp.off_sec;
-        pm->timestamp_usec = skb->tstamp.off_usec;
-        pm->mark = skb->mark;
+        put_unaligned(skb->tstamp.off_sec, &pm->timestamp_sec);
+        put_unaligned(skb->tstamp.off_usec, &pm->timestamp_usec);
+        put_unaligned(skb->mark, &pm->mark);
         pm->hook = hooknum;
         if (prefix != NULL)
                 strncpy(pm->prefix, prefix, sizeof(pm->prefix));
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 5c8caf4a1244..34ae3f13483a 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -77,18 +77,19 @@ void tcp_init_congestion_control(struct sock *sk)
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_congestion_ops *ca;
 
-        if (icsk->icsk_ca_ops != &tcp_init_congestion_ops)
-                return;
+        /* if no choice made yet assign the current value set as default */
+        if (icsk->icsk_ca_ops == &tcp_init_congestion_ops) {
+                rcu_read_lock();
+                list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
+                        if (try_module_get(ca->owner)) {
+                                icsk->icsk_ca_ops = ca;
+                                break;
+                        }
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
-                if (try_module_get(ca->owner)) {
-                        icsk->icsk_ca_ops = ca;
-                        break;
+                        /* fallback to next available */
                 }
-
+                rcu_read_unlock();
         }
-        rcu_read_unlock();
 
         if (icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
@@ -236,6 +237,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 
         rcu_read_lock();
         ca = tcp_ca_find(name);
+
         /* no change asking for existing value */
         if (ca == icsk->icsk_ca_ops)
                 goto out;
@@ -261,7 +263,8 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
         else {
                 tcp_cleanup_congestion_control(sk);
                 icsk->icsk_ca_ops = ca;
-                if (icsk->icsk_ca_ops->init)
+
+                if (sk->sk_state != TCP_CLOSE && icsk->icsk_ca_ops->init)
                         icsk->icsk_ca_ops->init(sk);
         }
  out:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dc151139b5af..3c24881f2a65 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -943,7 +943,8 @@ static void tcp_cwnd_validate(struct sock *sk, struct tcp_sock *tp)
                 if (tp->packets_out > tp->snd_cwnd_used)
                         tp->snd_cwnd_used = tp->packets_out;
 
-                if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
+                if (sysctl_tcp_slow_start_after_idle &&
+                    (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
                         tcp_cwnd_application_limited(sk);
         }
 }
@@ -1607,6 +1608,9 @@ u32 __tcp_select_window(struct sock *sk)
                  */
                 if (window <= free_space - mss || window > free_space)
                         window = (free_space/mss)*mss;
+                else if (mss == full_space &&
+                         free_space > window + full_space/2)
+                        window = free_space;
         }
 
         return window;
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 89cf59ea7bbe..d419e15d9803 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -42,10 +42,9 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->nh.raw = skb_push(skb, x->props.header_len + hdrlen);
         top_iph = skb->nh.iph;
-        hdrlen = iph->ihl * 4 - optlen;
-        skb->h.raw += hdrlen;
+        skb->h.raw += sizeof(*iph) - hdrlen;
 
-        memmove(top_iph, iph, hdrlen);
+        memmove(top_iph, iph, sizeof(*iph));
         if (unlikely(optlen)) {
                 struct ip_beet_phdr *ph;
 
@@ -53,8 +52,10 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 
                 ph = (struct ip_beet_phdr *)skb->h.raw;
                 ph->padlen = 4 - (optlen & 4);
-                ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8;
+                ph->hdrlen = optlen / 8;
                 ph->nexthdr = top_iph->protocol;
+                if (ph->padlen)
+                        memset(ph + 1, IPOPT_NOP, ph->padlen);
 
                 top_iph->protocol = IPPROTO_BEETPH;
                 top_iph->ihl = sizeof(struct iphdr) / 4;
@@ -77,29 +78,32 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
         protocol = iph->protocol;
 
         if (unlikely(iph->protocol == IPPROTO_BEETPH)) {
-                struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(iph + 1);
+                struct ip_beet_phdr *ph;
 
                 if (!pskb_may_pull(skb, sizeof(*ph)))
                         goto out;
+                ph = (struct ip_beet_phdr *)(skb->h.ipiph + 1);
 
-                phlen = ph->hdrlen * 8;
-                optlen = phlen - ph->padlen - sizeof(*ph);
+                phlen = sizeof(*ph) + ph->padlen;
+                optlen = ph->hdrlen * 8 + (IPV4_BEET_PHMAXLEN - phlen);
                 if (optlen < 0 || optlen & 3 || optlen > 250)
                         goto out;
 
-                if (!pskb_may_pull(skb, phlen))
+                if (!pskb_may_pull(skb, phlen + optlen))
                         goto out;
+                skb->len -= phlen + optlen;
 
                 ph_nexthdr = ph->nexthdr;
         }
 
-        skb_push(skb, sizeof(*iph) - phlen + optlen);
-        memmove(skb->data, skb->nh.raw, sizeof(*iph));
-        skb->nh.raw = skb->data;
+        skb->nh.raw = skb->data + (phlen - sizeof(*iph));
+        memmove(skb->nh.raw, iph, sizeof(*iph));
+        skb->h.raw = skb->data + (phlen + optlen);
+        skb->data = skb->h.raw;
 
         iph = skb->nh.iph;
         iph->ihl = (sizeof(*iph) + optlen) / 4;
-        iph->tot_len = htons(skb->len);
+        iph->tot_len = htons(skb->len + iph->ihl * 4);
         iph->daddr = x->sel.daddr.a4;
         iph->saddr = x->sel.saddr.a4;
         if (ph_nexthdr)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1b616992d916..452a82ce4796 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -172,6 +172,7 @@ struct ipv6_devconf ipv6_devconf __read_mostly = {
 #endif
 #endif
         .proxy_ndp              = 0,
+        .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 };
 
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -203,6 +204,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 #endif
 #endif
         .proxy_ndp              = 0,
+        .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 };
 
 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -342,6 +344,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         }
 #endif
 
+        if (netif_running(dev) && netif_carrier_ok(dev))
+                ndev->if_flags |= IF_READY;
+
         ipv6_mc_init_dev(ndev);
         ndev->tstamp = jiffies;
 #ifdef CONFIG_SYSCTL
@@ -3353,6 +3358,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
 #endif
         array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
+        array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
 }
 
 static inline size_t inet6_if_nlmsg_size(void)
@@ -3881,6 +3887,14 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       &proc_dointvec,
                 },
                 {
+                        .ctl_name       =       NET_IPV6_ACCEPT_SOURCE_ROUTE,
+                        .procname       =       "accept_source_route",
+                        .data           =       &ipv6_devconf.accept_source_route,
+                        .maxlen         =       sizeof(int),
+                        .mode           =       0644,
+                        .proc_handler   =       &proc_dointvec,
+                },
+                {
                         .ctl_name       =       0,      /* sentinel */
                 }
         },
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 28e0c6568272..fb39604c3d09 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -362,10 +362,27 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct in6_addr *addr = NULL;
         struct in6_addr daddr;
+        struct inet6_dev *idev;
         int n, i;
-
         struct ipv6_rt_hdr *hdr;
         struct rt0_hdr *rthdr;
+        int accept_source_route = ipv6_devconf.accept_source_route;
+
+        if (accept_source_route < 0 ||
+            ((idev = in6_dev_get(skb->dev)) == NULL)) {
+                kfree_skb(skb);
+                return -1;
+        }
+        if (idev->cnf.accept_source_route < 0) {
+                in6_dev_put(idev);
+                kfree_skb(skb);
+                return -1;
+        }
+
+        if (accept_source_route > idev->cnf.accept_source_route)
+                accept_source_route = idev->cnf.accept_source_route;
+
+        in6_dev_put(idev);
 
         if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
             !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
@@ -377,6 +394,22 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         hdr = (struct ipv6_rt_hdr *) skb->h.raw;
 
+        switch (hdr->type) {
+#ifdef CONFIG_IPV6_MIP6
+                break;
+#endif
+        case IPV6_SRCRT_TYPE_0:
+                if (accept_source_route > 0)
+                        break;
+                kfree_skb(skb);
+                return -1;
+        default:
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
+                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
+                return -1;
+        }
+
         if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||
             skb->pkt_type != PACKET_HOST) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -434,11 +467,6 @@ looped_back:
                 }
                 break;
 #endif
-        default:
-                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
-                                 IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
-                return -1;
         }
 
         /*
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0862809ffcf7..ea3035b4e3e8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
-        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
-        if (frh->src_len > 128 || frh->dst_len > 128)
-                goto errout;
-
         if (rule->action == FR_ACT_TO_TBL) {
                 if (rule->table == RT6_TABLE_UNSPEC)
                         goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
                            sizeof(struct in6_addr));
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                            sizeof(struct in6_addr));
 
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->tos && (rule6->tclass != frh->tos))
                 return 0;
 
-        if (tb[FRA_SRC] &&
+        if (frh->src_len &&
             nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
                 return 0;
 
-        if (tb[FRA_DST] &&
+        if (frh->dst_len &&
             nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                 return 0;
 
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib6_rules_ops = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
+        .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
         .match                  = fib6_rule_match,
         .configure              = fib6_rule_configure,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f4d7be77eb0f..268f476ef3db 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -658,6 +658,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 ins = &iter->u.dst.rt6_next;
         }
 
+        /* Reset round-robin state, if necessary */
+        if (ins == &fn->leaf)
+                fn->rr_ptr = NULL;
+
         /*
          *      insert node
          */
@@ -1109,6 +1113,10 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         rt6_stats.fib_rt_entries--;
         rt6_stats.fib_discarded_routes++;
 
+        /* Reset round-robin state, if necessary */
+        if (fn->rr_ptr == rt)
+                fn->rr_ptr = NULL;
+
         /* Adjust walkers */
         read_lock(&fib6_walker_lock);
         FOR_WALKERS(w) {
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 11bfc7c43182..61e7a6c8141d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -108,8 +108,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         /* pkt_len may be zero if Jumbo payload option is present */
         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
-                if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
-                        goto truncated;
+                if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
+                        goto drop;
+                }
                 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
                         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
                         goto drop;
@@ -128,8 +130,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         rcu_read_unlock();
 
         return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
-truncated:
-        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 err:
         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
 drop:
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 306d5d83c068..203e069e7fe9 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int err;
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
          */
-        if (len < 0)
+        if (len > INT_MAX)
                 return -EMSGSIZE;
 
         /* Mirror BSD error message compatibility */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a6b3117df546..aebb4e2d5ae3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -311,21 +311,12 @@ static inline void rt6_probe(struct rt6_info *rt)
 static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
         struct net_device *dev = rt->rt6i_dev;
-        int ret = 0;
-
-        if (!oif)
-                return 2;
-        if (dev->flags & IFF_LOOPBACK) {
-                if (!WARN_ON(rt->rt6i_idev == NULL) &&
-                    rt->rt6i_idev->dev->ifindex == oif)
-                        ret = 1;
-                else
-                        return 0;
-        }
-        if (dev->ifindex == oif)
+        if (!oif || dev->ifindex == oif)
                 return 2;
-
-        return ret;
+        if ((dev->flags & IFF_LOOPBACK) &&
+            rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
+                return 1;
+        return 0;
 }
 
 static inline int rt6_check_neigh(struct rt6_info *rt)
@@ -363,55 +354,76 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         return m;
 }
 
-static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
-                                   int strict)
+static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+                                   int *mpri, struct rt6_info *match)
 {
-        struct rt6_info *match = NULL, *last = NULL;
-        struct rt6_info *rt, *rt0 = *head;
-        u32 metric;
+        int m;
+
+        if (rt6_check_expired(rt))
+                goto out;
+
+        m = rt6_score_route(rt, oif, strict);
+        if (m < 0)
+                goto out;
+
+        if (m > *mpri) {
+                if (strict & RT6_LOOKUP_F_REACHABLE)
+                        rt6_probe(match);
+                *mpri = m;
+                match = rt;
+        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
+                rt6_probe(rt);
+        }
+
+out:
+        return match;
+}
+
+static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *rr_head,
+                                     u32 metric, int oif, int strict)
+{
+        struct rt6_info *rt, *match;
         int mpri = -1;
 
-        RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n",
-                  __FUNCTION__, head, head ? *head : NULL, oif);
+        match = NULL;
+        for (rt = rr_head; rt && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
+        for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
 
-        for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
-             rt = rt->u.dst.rt6_next) {
-                int m;
+        return match;
+}
 
-                if (rt6_check_expired(rt))
-                        continue;
+static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+{
+        struct rt6_info *match, *rt0;
 
-                last = rt;
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __FUNCTION__, fn->leaf, oif);
 
-                m = rt6_score_route(rt, oif, strict);
-                if (m < 0)
-                        continue;
+        rt0 = fn->rr_ptr;
+        if (!rt0)
+                fn->rr_ptr = rt0 = fn->leaf;
 
-                if (m > mpri) {
-                        if (strict & RT6_LOOKUP_F_REACHABLE)
-                                rt6_probe(match);
-                        match = rt;
-                        mpri = m;
-                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                        rt6_probe(rt);
-                }
-        }
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
 
         if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE) &&
-            last && last != rt0) {
+            (strict & RT6_LOOKUP_F_REACHABLE)) {
+                struct rt6_info *next = rt0->u.dst.rt6_next;
+
                 /* no entries matched; do round-robin */
-                static DEFINE_SPINLOCK(lock);
-                spin_lock(&lock);
-                *head = rt0->u.dst.rt6_next;
-                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
-                last->u.dst.rt6_next = rt0;
-                spin_unlock(&lock);
+                if (!next || next->rt6i_metric != rt0->rt6i_metric)
+                        next = fn->leaf;
+
+                if (next != rt0)
+                        fn->rr_ptr = next;
         }
 
-        RT6_TRACE("%s() => %p, score=%d\n",
-                  __FUNCTION__, match, mpri);
+        RT6_TRACE("%s() => %p\n",
+                  __FUNCTION__, match);
 
         return (match ? match : &ip6_null_entry);
 }
@@ -657,7 +669,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
+        rt = rt6_select(fn, fl->iif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -752,7 +764,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
+        rt = rt6_select(fn, fl->oif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -1754,13 +1766,22 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
  *      Drop the packet on the floor
  */
 
-static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
+static inline int ip6_pkt_drop(struct sk_buff *skb, int code,
+                               int ipstats_mib_noroutes)
 {
-        int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
-        if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
-                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INADDRERRORS);
-
-        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_OUTNOROUTES);
+        int type;
+        switch (ipstats_mib_noroutes) {
+        case IPSTATS_MIB_INNOROUTES:
+                type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
+                if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED) {
+                        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INADDRERRORS);
+                        break;
+                }
+                /* FALLTHROUGH */
+        case IPSTATS_MIB_OUTNOROUTES:
+                IP6_INC_STATS(ip6_dst_idev(skb->dst), ipstats_mib_noroutes);
+                break;
+        }
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
         kfree_skb(skb);
         return 0;
@@ -1768,26 +1789,26 @@ static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
 
 static int ip6_pkt_discard(struct sk_buff *skb)
 {
-        return ip6_pkt_drop(skb, ICMPV6_NOROUTE);
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
 }
 
 static int ip6_pkt_discard_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
-        return ip6_pkt_discard(skb);
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
 }
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 
 static int ip6_pkt_prohibit(struct sk_buff *skb)
 {
-        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED);
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
 }
 
 static int ip6_pkt_prohibit_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
-        return ip6_pkt_prohibit(skb);
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 }
 
 static int ip6_pkt_blk_hole(struct sk_buff *skb)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0ad471909881..f590db57a7c9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -615,7 +615,7 @@ do_udp_sendmsg:
                 return udp_sendmsg(iocb, sk, msg, len);
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
            */
         if (len > INT_MAX - sizeof(struct udphdr))
                 return -EMSGSIZE;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index eabd6838f50a..0eb7d596d470 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -138,7 +138,6 @@ static void irda_disconnect_indication(void *instance, void *sap,
                 sk->sk_shutdown |= SEND_SHUTDOWN;
 
                 sk->sk_state_change(sk);
-                sock_orphan(sk);
                 release_sock(sk);
 
                 /* Close our TSAP.
@@ -1446,7 +1445,7 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
                          */
                         ret = sock_error(sk);
                         if (ret)
-                                break;
+                                ;
                         else if (sk->sk_shutdown & RCV_SHUTDOWN)
                                 ;
                         else if (noblock)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index a4e7e2db0ff3..345019345f09 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -630,6 +630,35 @@ pfkey_sockaddr_size(sa_family_t family)
         /* NOTREACHED */
 }
 
+static inline int pfkey_mode_from_xfrm(int mode)
+{
+        switch(mode) {
+        case XFRM_MODE_TRANSPORT:
+                return IPSEC_MODE_TRANSPORT;
+        case XFRM_MODE_TUNNEL:
+                return IPSEC_MODE_TUNNEL;
+        case XFRM_MODE_BEET:
+                return IPSEC_MODE_BEET;
+        default:
+                return -1;
+        }
+}
+
+static inline int pfkey_mode_to_xfrm(int mode)
+{
+        switch(mode) {
+        case IPSEC_MODE_ANY:    /*XXX*/
+        case IPSEC_MODE_TRANSPORT:
+                return XFRM_MODE_TRANSPORT;
+        case IPSEC_MODE_TUNNEL:
+                return XFRM_MODE_TUNNEL;
+        case IPSEC_MODE_BEET:
+                return XFRM_MODE_BEET;
+        default:
+                return -1;
+        }
+}
+
 static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys, int hsc)
 {
         struct sk_buff *skb;
@@ -651,6 +680,7 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
         int encrypt_key_size = 0;
         int sockaddr_size;
         struct xfrm_encap_tmpl *natt = NULL;
+        int mode;
 
         /* address family check */
         sockaddr_size = pfkey_sockaddr_size(x->props.family);
@@ -928,7 +958,11 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
         sa2 = (struct sadb_x_sa2 *)  skb_put(skb, sizeof(struct sadb_x_sa2));
         sa2->sadb_x_sa2_len = sizeof(struct sadb_x_sa2)/sizeof(uint64_t);
         sa2->sadb_x_sa2_exttype = SADB_X_EXT_SA2;
-        sa2->sadb_x_sa2_mode = x->props.mode + 1;
+        if ((mode = pfkey_mode_from_xfrm(x->props.mode)) < 0) {
+                kfree_skb(skb);
+                return ERR_PTR(-EINVAL);
+        }
+        sa2->sadb_x_sa2_mode = mode;
         sa2->sadb_x_sa2_reserved1 = 0;
         sa2->sadb_x_sa2_reserved2 = 0;
         sa2->sadb_x_sa2_sequence = 0;
@@ -1155,9 +1189,12 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
 
         if (ext_hdrs[SADB_X_EXT_SA2-1]) {
                 struct sadb_x_sa2 *sa2 = (void*)ext_hdrs[SADB_X_EXT_SA2-1];
-                x->props.mode = sa2->sadb_x_sa2_mode;
-                if (x->props.mode)
-                        x->props.mode--;
+                int mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode);
+                if (mode < 0) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                x->props.mode = mode;
                 x->props.reqid = sa2->sadb_x_sa2_reqid;
         }
 
@@ -1218,7 +1255,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         struct sadb_address *saddr, *daddr;
         struct sadb_msg *out_hdr;
         struct xfrm_state *x = NULL;
-        u8 mode;
+        int mode;
         u32 reqid;
         u8 proto;
         unsigned short family;
@@ -1233,7 +1270,9 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
                 return -EINVAL;
 
         if ((sa2 = ext_hdrs[SADB_X_EXT_SA2-1]) != NULL) {
-                mode = sa2->sadb_x_sa2_mode - 1;
+                mode = pfkey_mode_to_xfrm(sa2->sadb_x_sa2_mode);
+                if (mode < 0)
+                        return -EINVAL;
                 reqid = sa2->sadb_x_sa2_reqid;
         } else {
                 mode = 0;
@@ -1756,6 +1795,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         struct sockaddr_in6 *sin6;
 #endif
+        int mode;
 
         if (xp->xfrm_nr >= XFRM_MAX_DEPTH)
                 return -ELOOP;
@@ -1764,7 +1804,9 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
                 return -EINVAL;
 
         t->id.proto = rq->sadb_x_ipsecrequest_proto; /* XXX check proto */
-        t->mode = rq->sadb_x_ipsecrequest_mode-1;
+        if ((mode = pfkey_mode_to_xfrm(rq->sadb_x_ipsecrequest_mode)) < 0)
+                return -EINVAL;
+        t->mode = mode;
         if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_USE)
                 t->optional = 1;
         else if (rq->sadb_x_ipsecrequest_level == IPSEC_LEVEL_UNIQUE) {
@@ -1877,7 +1919,7 @@ static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp)
         return skb;
 }
 
-static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir)
+static int pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, int dir)
 {
         struct sadb_msg *hdr;
         struct sadb_address *addr;
@@ -2014,6 +2056,7 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                 struct sadb_x_ipsecrequest *rq;
                 struct xfrm_tmpl *t = xp->xfrm_vec + i;
                 int req_size;
+                int mode;
 
                 req_size = sizeof(struct sadb_x_ipsecrequest);
                 if (t->mode == XFRM_MODE_TUNNEL)
@@ -2027,7 +2070,9 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                 memset(rq, 0, sizeof(*rq));
                 rq->sadb_x_ipsecrequest_len = req_size;
                 rq->sadb_x_ipsecrequest_proto = t->id.proto;
-                rq->sadb_x_ipsecrequest_mode = t->mode+1;
+                if ((mode = pfkey_mode_from_xfrm(t->mode)) < 0)
+                        return -EINVAL;
+                rq->sadb_x_ipsecrequest_mode = mode;
                 rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
                 if (t->reqid)
                         rq->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE;
@@ -2089,6 +2134,8 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
 
         hdr->sadb_msg_len = size / sizeof(uint64_t);
         hdr->sadb_msg_reserved = atomic_read(&xp->refcnt);
+
+        return 0;
 }
 
 static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
@@ -2102,7 +2149,9 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c
                 err = PTR_ERR(out_skb);
                 goto out;
         }
-        pfkey_xfrm_policy2msg(out_skb, xp, dir);
+        err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+        if (err < 0)
+                return err;
 
         out_hdr = (struct sadb_msg *) out_skb->data;
         out_hdr->sadb_msg_version = PF_KEY_V2;
@@ -2327,7 +2376,9 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb
                 err =  PTR_ERR(out_skb);
                 goto out;
         }
-        pfkey_xfrm_policy2msg(out_skb, xp, dir);
+        err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+        if (err < 0)
+                goto out;
 
         out_hdr = (struct sadb_msg *) out_skb->data;
         out_hdr->sadb_msg_version = hdr->sadb_msg_version;
@@ -2409,6 +2460,7 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
 {
         int err;
         struct sadb_x_ipsecrequest *rq2;
+        int mode;
 
         if (len <= sizeof(struct sadb_x_ipsecrequest) ||
             len < rq1->sadb_x_ipsecrequest_len)
@@ -2439,7 +2491,9 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
                 return -EINVAL;
 
         m->proto = rq1->sadb_x_ipsecrequest_proto;
-        m->mode = rq1->sadb_x_ipsecrequest_mode - 1;
+        if ((mode = pfkey_mode_to_xfrm(rq1->sadb_x_ipsecrequest_mode)) < 0)
+                return -EINVAL;
+        m->mode = mode;
         m->reqid = rq1->sadb_x_ipsecrequest_reqid;
 
         return ((int)(rq1->sadb_x_ipsecrequest_len +
@@ -2579,12 +2633,15 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
         struct pfkey_dump_data *data = ptr;
         struct sk_buff *out_skb;
         struct sadb_msg *out_hdr;
+        int err;
 
         out_skb = pfkey_xfrm_policy2msg_prep(xp);
         if (IS_ERR(out_skb))
                 return PTR_ERR(out_skb);
 
-        pfkey_xfrm_policy2msg(out_skb, xp, dir);
+        err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
+        if (err < 0)
+                return err;
 
         out_hdr = (struct sadb_msg *) out_skb->data;
         out_hdr->sadb_msg_version = data->hdr->sadb_msg_version;
@@ -3513,7 +3570,10 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
 
         for (i = 0, mp = m; i < num_bundles; i++, mp++) {
                 /* old ipsecrequest */
-                if (set_ipsecrequest(skb, mp->proto, mp->mode + 1,
+                int mode = pfkey_mode_from_xfrm(mp->mode);
+                if (mode < 0)
+                        return -EINVAL;
+                if (set_ipsecrequest(skb, mp->proto, mode,
                                      (mp->reqid ?  IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
                                      mp->reqid, mp->old_family,
                                      &mp->old_saddr, &mp->old_daddr) < 0) {
@@ -3521,7 +3581,7 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
                 }
 
                 /* new ipsecrequest */
-                if (set_ipsecrequest(skb, mp->proto, mp->mode + 1,
+                if (set_ipsecrequest(skb, mp->proto, mode,
                                      (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
                                      mp->reqid, mp->new_family,
                                      &mp->new_saddr, &mp->new_daddr) < 0) {
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e73d8f546c6b..c48b0f49f003 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -443,6 +443,7 @@ static int netlink_release(struct socket *sock)
                 return 0;
 
         netlink_remove(sk);
+        sock_orphan(sk);
         nlk = nlk_sk(sk);
 
         spin_lock(&nlk->cb_lock);
@@ -457,7 +458,6 @@ static int netlink_release(struct socket *sock)
         /* OK. Socket is unlinked, and, therefore,
            no new packets will arrive */
 
-        sock_orphan(sk);
         sock->sk = NULL;
         wake_up_interruptible_all(&nlk->wait);
 
@@ -1412,9 +1412,9 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
                 return -ECONNREFUSED;
         }
         nlk = nlk_sk(sk);
-        /* A dump is in progress... */
+        /* A dump or destruction is in progress... */
         spin_lock(&nlk->cb_lock);
-        if (nlk->cb) {
+        if (nlk->cb || sock_flag(sk, SOCK_DEAD)) {
                 spin_unlock(&nlk->cb_lock);
                 netlink_destroy_callback(cb);
                 sock_put(sk);
diff --git a/net/sched/Makefile b/net/sched/Makefile
index ff2d6e5e282c..020767a204d4 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -17,7 +17,6 @@ obj-$(CONFIG_NET_ACT_SIMP)	+= act_simple.o
 obj-$(CONFIG_NET_SCH_FIFO)      += sch_fifo.o
 obj-$(CONFIG_NET_SCH_CBQ)       += sch_cbq.o
 obj-$(CONFIG_NET_SCH_HTB)       += sch_htb.o
-obj-$(CONFIG_NET_SCH_HPFQ)      += sch_hpfq.o
 obj-$(CONFIG_NET_SCH_HFSC)      += sch_hfsc.o
 obj-$(CONFIG_NET_SCH_RED)       += sch_red.o
 obj-$(CONFIG_NET_SCH_GRED)      += sch_gred.o
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 68f26cb278f9..3e93683e9ab3 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -198,7 +198,7 @@ bad_mirred:
                 skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at);
 
         skb2->dev = dev;
-        skb2->input_dev = skb->dev;
+        skb2->iif = skb->dev->ifindex;
         dev_queue_xmit(skb2);
         spin_unlock(&m->tcf_lock);
         return m->tcf_action;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index fad08e521c24..4a91f082a81d 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
 
 static int basic_init(struct tcf_proto *tp)
 {
+        struct basic_head *head;
+
+        head = kzalloc(sizeof(*head), GFP_KERNEL);
+        if (head == NULL)
+                return -ENOBUFS;
+        INIT_LIST_HEAD(&head->flist);
+        tp->root = head;
         return 0;
 }
 
@@ -102,6 +109,7 @@ static void basic_destroy(struct tcf_proto *tp)
                 list_del(&f->link);
                 basic_delete_filter(tp, f);
         }
+        kfree(head);
 }
 
 static int basic_delete(struct tcf_proto *tp, unsigned long arg)
@@ -176,15 +184,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
         }
 
         err = -ENOBUFS;
-        if (head == NULL) {
-                head = kzalloc(sizeof(*head), GFP_KERNEL);
-                if (head == NULL)
-                        goto errout;
-
-                INIT_LIST_HEAD(&head->flist);
-                tp->root = head;
-        }
-
         f = kzalloc(sizeof(*f), GFP_KERNEL);
         if (f == NULL)
                 goto errout;
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 040e2d2d281a..7563fdcef4b7 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -245,9 +245,9 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
         }
 
         if (tb[TCA_TCINDEX_SHIFT-1]) {
-                if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(u16))
+                if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(int))
                         goto errout;
-                cp.shift = *(u16 *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
+                cp.shift = *(int *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
         }
 
         err = -EBUSY;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 396deb71480f..407c6fb1ba14 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1184,10 +1184,12 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        list_del(&cl->hlist);
         list_del(&cl->siblings);
         hfsc_adjust_levels(cl->cl_parent);
+
         hfsc_purge_queue(sch, cl);
+        list_del(&cl->hlist);
+
         if (--cl->refcnt == 0)
                 hfsc_destroy_class(sch, cl);
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 97cbb9aec946..3c3294d01041 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1380,15 +1380,15 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
 
         sch_tree_lock(sch);
 
-        /* delete from hash and active; remainder in destroy_class */
-        hlist_del_init(&cl->hlist);
-
         if (!cl->level) {
                 qlen = cl->un.leaf.q->q.qlen;
                 qdisc_reset(cl->un.leaf.q);
                 qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen);
         }
 
+        /* delete from hash and active; remainder in destroy_class */
+        hlist_del_init(&cl->hlist);
+
         if (cl->prio_activity)
                 htb_deactivate(q, cl);
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 536298c2eda2..a1d026f12b0e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -627,6 +627,12 @@ int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
                         retval = -EINVAL;
                         goto err_bindx_rem;
                 }
+
+                if (!af->addr_valid(sa_addr, sp, NULL)) {
+                        retval = -EADDRNOTAVAIL;
+                        goto err_bindx_rem;
+                }
+
                 if (sa_addr->v4.sin_port != htons(bp->port)) {
                         retval = -EINVAL;
                         goto err_bindx_rem;
@@ -5638,6 +5644,36 @@ void sctp_wait_for_close(struct sock *sk, long timeout)
         finish_wait(sk->sk_sleep, &wait);
 }
 
+static void sctp_sock_rfree_frag(struct sk_buff *skb)
+{
+        struct sk_buff *frag;
+
+        if (!skb->data_len)
+                goto done;
+
+        /* Don't forget the fragments. */
+        for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next)
+                sctp_sock_rfree_frag(frag);
+
+done:
+        sctp_sock_rfree(skb);
+}
+
+static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
+{
+        struct sk_buff *frag;
+
+        if (!skb->data_len)
+                goto done;
+
+        /* Don't forget the fragments. */
+        for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next)
+                sctp_skb_set_owner_r_frag(frag, sk);
+
+done:
+        sctp_skb_set_owner_r(skb, sk);
+}
+
 /* Populate the fields of the newsk from the oldsk and migrate the assoc
  * and its messages to the newsk.
  */
@@ -5692,10 +5728,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
                 event = sctp_skb2event(skb);
                 if (event->asoc == assoc) {
-                        sctp_sock_rfree(skb);
+                        sctp_sock_rfree_frag(skb);
                         __skb_unlink(skb, &oldsk->sk_receive_queue);
                         __skb_queue_tail(&newsk->sk_receive_queue, skb);
-                        sctp_skb_set_owner_r(skb, newsk);
+                        sctp_skb_set_owner_r_frag(skb, newsk);
                 }
         }
 
@@ -5723,10 +5759,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
                         event = sctp_skb2event(skb);
                         if (event->asoc == assoc) {
-                                sctp_sock_rfree(skb);
+                                sctp_sock_rfree_frag(skb);
                                 __skb_unlink(skb, &oldsp->pd_lobby);
                                 __skb_queue_tail(queue, skb);
-                                sctp_skb_set_owner_r(skb, newsk);
+                                sctp_skb_set_owner_r_frag(skb, newsk);
                         }
                 }
 
@@ -5738,6 +5774,16 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 
         }
 
+        sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp) {
+                sctp_sock_rfree_frag(skb);
+                sctp_skb_set_owner_r_frag(skb, newsk);
+        }
+
+        sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp) {
+                sctp_sock_rfree_frag(skb);
+                sctp_skb_set_owner_r_frag(skb, newsk);
+        }
+
         /* Set the type of socket to indicate that it is peeled off from the
          * original UDP-style socket or created with the accept() call on a
          * TCP-style socket..
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index bfb197e37da3..b29e3e4b72c9 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -190,7 +190,14 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
         if (!sctp_sk(sk)->pd_mode) {
                 queue = &sk->sk_receive_queue;
         } else if (ulpq->pd_mode) {
-                if (event->msg_flags & MSG_NOTIFICATION)
+                /* If the association is in partial delivery, we
+                 * need to finish delivering the partially processed
+                 * packet before passing any other data.  This is
+                 * because we don't truly support stream interleaving.
+                 */
+                if ((event->msg_flags & MSG_NOTIFICATION) ||
+                    (SCTP_DATA_NOT_FRAG ==
+                            (event->msg_flags & SCTP_DATA_FRAG_MASK)))
                         queue = &sctp_sk(sk)->pd_lobby;
                 else {
                         clear_pd = event->msg_flags & MSG_EOR;
diff --git a/net/socket.c b/net/socket.c
index 9566e57ac7f5..ea8f81abc45c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
 
         err = sock_attach_fd(newsock, newfile);
         if (err < 0)
-                goto out_fd;
+                goto out_fd_simple;
 
         err = security_socket_accept(sock, newsock);
         if (err)
@@ -1414,6 +1414,11 @@ out_put:
         fput_light(sock->file, fput_needed);
 out:
         return err;
+out_fd_simple:
+        sock_release(newsock);
+        put_filp(newfile);
+        put_unused_fd(newfd);
+        goto out_put;
 out_fd:
         fput(newfile);
         put_unused_fd(newfd);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 6d7221fe990a..396cdbe249d1 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1046,6 +1046,8 @@ call_status(struct rpc_task *task)
                 rpc_delay(task, 3*HZ);
         case -ETIMEDOUT:
                 task->tk_action = call_timeout;
+                if (task->tk_client->cl_discrtry)
+                        xprt_disconnect(task->tk_xprt);
                 break;
         case -ECONNREFUSED:
         case -ENOTCONN:
@@ -1169,6 +1171,8 @@ call_decode(struct rpc_task *task)
 out_retry:
         req->rq_received = req->rq_private_buf.len = 0;
         task->tk_status = 0;
+        if (task->tk_client->cl_discrtry)
+                xprt_disconnect(task->tk_xprt);
 }
 
 /*
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 9bae4090254c..2bd23ea2aa8b 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -383,7 +383,10 @@ void svcauth_unix_purge(void)
 static inline struct ip_map *
 ip_map_cached_get(struct svc_rqst *rqstp)
 {
-        struct ip_map *ipm = rqstp->rq_sock->sk_info_authunix;
+        struct ip_map *ipm;
+        struct svc_sock *svsk = rqstp->rq_sock;
+        spin_lock_bh(&svsk->sk_defer_lock);
+        ipm = svsk->sk_info_authunix;
         if (ipm != NULL) {
                 if (!cache_valid(&ipm->h)) {
                         /*
@@ -391,12 +394,14 @@ ip_map_cached_get(struct svc_rqst *rqstp)
                          * remembered, e.g. by a second mount from the
                          * same IP address.
                          */
-                        rqstp->rq_sock->sk_info_authunix = NULL;
+                        svsk->sk_info_authunix = NULL;
+                        spin_unlock_bh(&svsk->sk_defer_lock);
                         cache_put(&ipm->h, &ip_map_cache);
                         return NULL;
                 }
                 cache_get(&ipm->h);
         }
+        spin_unlock_bh(&svsk->sk_defer_lock);
         return ipm;
 }
 
@@ -405,9 +410,15 @@ ip_map_cached_put(struct svc_rqst *rqstp, struct ip_map *ipm)
 {
         struct svc_sock *svsk = rqstp->rq_sock;
 
-        if (svsk->sk_sock->type == SOCK_STREAM && svsk->sk_info_authunix == NULL)
-                svsk->sk_info_authunix = ipm;   /* newly cached, keep the reference */
-        else
+        spin_lock_bh(&svsk->sk_defer_lock);
+        if (svsk->sk_sock->type == SOCK_STREAM &&
+            svsk->sk_info_authunix == NULL) {
+                /* newly cached, keep the reference */
+                svsk->sk_info_authunix = ipm;
+                ipm = NULL;
+        }
+        spin_unlock_bh(&svsk->sk_defer_lock);
+        if (ipm)
                 cache_put(&ipm->h, &ip_map_cache);
 }
 
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index f6e1eb1ea720..2772fee93881 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -452,6 +452,8 @@ union svc_pktinfo_u {
         struct in_pktinfo pkti;
         struct in6_pktinfo pkti6;
 };
+#define SVC_PKTINFO_SPACE \
+        CMSG_SPACE(sizeof(union svc_pktinfo_u))
 
 static void svc_set_cmsg_data(struct svc_rqst *rqstp, struct cmsghdr *cmh)
 {
@@ -491,8 +493,11 @@ svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
         struct svc_sock *svsk = rqstp->rq_sock;
         struct socket   *sock = svsk->sk_sock;
         int             slen;
-        char            buffer[CMSG_SPACE(sizeof(union svc_pktinfo_u))];
-        struct cmsghdr *cmh = (struct cmsghdr *)buffer;
+        union {
+                struct cmsghdr  hdr;
+                long            all[SVC_PKTINFO_SPACE / sizeof(long)];
+        } buffer;
+        struct cmsghdr *cmh = &buffer.hdr;
         int             len = 0;
         int             result;
         int             size;
@@ -745,8 +750,11 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
         struct svc_sock *svsk = rqstp->rq_sock;
         struct svc_serv *serv = svsk->sk_server;
         struct sk_buff  *skb;
-        char            buffer[CMSG_SPACE(sizeof(union svc_pktinfo_u))];
-        struct cmsghdr *cmh = (struct cmsghdr *)buffer;
+        union {
+                struct cmsghdr  hdr;
+                long            all[SVC_PKTINFO_SPACE / sizeof(long)];
+        } buffer;
+        struct cmsghdr *cmh = &buffer.hdr;
         int             err, len;
         struct msghdr msg = {
                 .msg_name = svc_addr(rqstp),
@@ -779,8 +787,8 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
         }
 
         clear_bit(SK_DATA, &svsk->sk_flags);
-        while ((err == kernel_recvmsg(svsk->sk_sock, &msg, NULL,
-                                      0, 0, MSG_PEEK | MSG_DONTWAIT)) < 0 ||
+        while ((err = kernel_recvmsg(svsk->sk_sock, &msg, NULL,
+                                     0, 0, MSG_PEEK | MSG_DONTWAIT)) < 0 ||
                (skb = skb_recv_datagram(svsk->sk_sk, 0, 1, &err)) == NULL) {
                 if (err == -EAGAIN) {
                         svc_sock_received(svsk);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index ee6ffa01dfb1..456a14510308 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -735,16 +735,6 @@ void xprt_transmit(struct rpc_task *task)
                         xprt_reset_majortimeo(req);
                         /* Turn off autodisconnect */
                         del_singleshot_timer_sync(&xprt->timer);
-                } else {
-                        /* If all request bytes have been sent,
-                         * then we must be retransmitting this one */
-                        if (!req->rq_bytes_sent) {
-                                if (task->tk_client->cl_discrtry) {
-                                        xprt_disconnect(xprt);
-                                        task->tk_status = -ENOTCONN;
-                                        return;
-                                }
-                        }
                 }
         } else if (!req->rq_bytes_sent)
                 return;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5c5f6dcab974..e3a0bcfa5df1 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1371,7 +1371,8 @@ int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
                 return 0;
 
         diff = x->replay.seq - seq;
-        if (diff >= x->props.replay_window) {
+        if (diff >= min_t(unsigned int, x->props.replay_window,
+                          sizeof(x->replay.bitmap) * 8)) {
                 x->stats.replay_window++;
                 return -EINVAL;
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e81e2fb3d429..816e3690b60f 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -272,9 +272,8 @@ static int attach_encap_tmpl(struct xfrm_encap_tmpl **encapp, struct rtattr *u_a
 }
 
 
-static inline int xfrm_user_sec_ctx_size(struct xfrm_policy *xp)
+static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
 {
-        struct xfrm_sec_ctx *xfrm_ctx = xp->security;
         int len = 0;
 
         if (xfrm_ctx) {
@@ -2170,7 +2169,7 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
-        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+        len += RTA_SPACE(xfrm_user_sec_ctx_size(x->security));
 #ifdef CONFIG_XFRM_SUB_POLICY
         len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
 #endif
@@ -2280,7 +2279,7 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
 
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
-        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp->security));
 #ifdef CONFIG_XFRM_SUB_POLICY
         len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
 #endif
diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
index 668a11a8b383..6bc7e7cfccf6 100644
--- a/scripts/basic/fixdep.c
+++ b/scripts/basic/fixdep.c
@@ -28,9 +28,11 @@
  * the dependency on linux/autoconf.h by a dependency on every config
  * option which is mentioned in any of the listed prequisites.
  *
- * To be exact, split-include populates a tree in include/config/,
- * e.g. include/config/his/driver.h, which contains the #define/#undef
- * for the CONFIG_HIS_DRIVER option.
+ * kconfig populates a tree in include/config/ with an empty file
+ * for each config symbol and when the configuration is updated
+ * the files representing changed config options are touched
+ * which then let make pick up the changes and the files that use
+ * the config symbols are rebuilt.
  *
  * So if the user changes his CONFIG_HIS_DRIVER option, only the objects
  * which depend on "include/linux/config/his/driver.h" will be rebuilt,
@@ -245,6 +247,8 @@ void parse_config_file(char *map, size_t len)
                 continue;
 
         found:
+                if (!memcmp(q - 7, "_MODULE", 7))
+                        q -= 7;
                 use_config(p+7, q-p-7);
         }
 }