220 files changed, 1976 insertions, 1172 deletions

diff --git a/Documentation/DocBook/kernel-api.tmpl b/Documentation/DocBook/kernel-api.tmpl
index 1ae4dc0fd856..f8fe882e33dc 100644
--- a/Documentation/DocBook/kernel-api.tmpl
+++ b/Documentation/DocBook/kernel-api.tmpl
@@ -59,6 +59,9 @@
 !Iinclude/linux/hrtimer.h
 !Ekernel/hrtimer.c
      </sect1>
+     <sect1><title>Workqueues and Kevents</title>
+!Ekernel/workqueue.c
+     </sect1>
      <sect1><title>Internal Functions</title>
 !Ikernel/exit.c
 !Ikernel/signal.c
@@ -300,7 +303,7 @@ X!Ekernel/module.c
      </sect1>
 
      <sect1><title>Resources Management</title>
-!Ekernel/resource.c
+!Ikernel/resource.c
      </sect1>
 
      <sect1><title>MTRR Handling</title>
@@ -312,9 +315,7 @@ X!Ekernel/module.c
 !Edrivers/pci/pci-driver.c
 !Edrivers/pci/remove.c
 !Edrivers/pci/pci-acpi.c
-<!-- kerneldoc does not understand __devinit
-X!Edrivers/pci/search.c
- -->
+!Edrivers/pci/search.c
 !Edrivers/pci/msi.c
 !Edrivers/pci/bus.c
 <!-- FIXME: Removed for now since no structured comments in source
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index c2c85bcb3d43..2cd7f02ffd0b 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -10,7 +10,9 @@ kernel, the process can sometimes be daunting if you're not familiar
 with "the system."  This text is a collection of suggestions which
 can greatly increase the chances of your change being accepted.
 
-If you are submitting a driver, also read Documentation/SubmittingDrivers.
+Read Documentation/SubmitChecklist for a list of items to check
+before submitting code.  If you are submitting a driver, also read
+Documentation/SubmittingDrivers.
 
 
 
@@ -74,9 +76,6 @@ There are a number of scripts which can aid in this:
 Quilt:
 http://savannah.nongnu.org/projects/quilt
 
-Randy Dunlap's patch scripts:
-http://www.xenotime.net/linux/scripts/patching-scripts-002.tar.gz
-
 Andrew Morton's patch scripts:
 http://www.zip.com.au/~akpm/linux/patches/
 Instead of these scripts, quilt is the recommended patch management
@@ -484,7 +483,7 @@ Greg Kroah-Hartman "How to piss off a kernel subsystem maintainer".
   <http://www.kroah.com/log/2005/10/19/>
   <http://www.kroah.com/log/2006/01/11/>
 
-NO!!!! No more huge patch bombs to linux-kernel@vger.kernel.org people!.
+NO!!!! No more huge patch bombs to linux-kernel@vger.kernel.org people!
   <http://marc.theaimsgroup.com/?l=linux-kernel&m=112112749912944&w=2>
 
 Kernel Documentation/CodingStyle
@@ -493,4 +492,3 @@ Kernel Documentation/CodingStyle
 Linus Torvald's mail on the canonical patch format:
   <http://lkml.org/lkml/2005/4/7/183>
 --
-Last updated on 17 Nov 2005.
diff --git a/Documentation/accounting/delay-accounting.txt b/Documentation/accounting/delay-accounting.txt
index be215e58423b..1443cd71d263 100644
--- a/Documentation/accounting/delay-accounting.txt
+++ b/Documentation/accounting/delay-accounting.txt
@@ -64,11 +64,13 @@ Compile the kernel with
         CONFIG_TASK_DELAY_ACCT=y
         CONFIG_TASKSTATS=y
 
-Enable the accounting at boot time by adding
-the following to the kernel boot options
-        delayacct
+Delay accounting is enabled by default at boot up.
+To disable, add
+   nodelayacct
+to the kernel boot options. The rest of the instructions
+below assume this has not been done.
 
-and after the system has booted up, use a utility
+After the system has booted up, use a utility
 similar to  getdelays.c to access the delays
 seen by a given task or a task group (tgid).
 The utility also allows a given command to be
diff --git a/Documentation/cpu-hotplug.txt b/Documentation/cpu-hotplug.txt
index 1bcf69996c9d..bc107cb157a8 100644
--- a/Documentation/cpu-hotplug.txt
+++ b/Documentation/cpu-hotplug.txt
@@ -251,16 +251,24 @@ A: This is what you would need in your kernel code to receive notifications.
                 return NOTIFY_OK;
         }
 
-        static struct notifier_block foobar_cpu_notifer =
+        static struct notifier_block __cpuinitdata foobar_cpu_notifer =
         {
            .notifier_call = foobar_cpu_callback,
         };
 
+You need to call register_cpu_notifier() from your init function.
+Init functions could be of two types:
+1. early init (init function called when only the boot processor is online).
+2. late init (init function called _after_ all the CPUs are online).
 
-In your init function,
+For the first case, you should add the following to your init function
 
         register_cpu_notifier(&foobar_cpu_notifier);
 
+For the second case, you should add the following to your init function
+
+        register_hotcpu_notifier(&foobar_cpu_notifier);
+
 You can fail PREPARE notifiers if something doesn't work to prepare resources.
 This will stop the activity and send a following CANCELED event back.
 
diff --git a/Documentation/devices.txt b/Documentation/devices.txt
index 4aaf68fafebe..66c725f530f3 100644
--- a/Documentation/devices.txt
+++ b/Documentation/devices.txt
@@ -2565,10 +2565,10 @@ Your cooperation is appreciated.
                 243 = /dev/usb/dabusb3  Fourth dabusb device
 
 180 block       USB block devices
-                0 = /dev/uba            First USB block device
-                8 = /dev/ubb            Second USB block device
-                16 = /dev/ubc           Thrid USB block device
-                ...
+                  0 = /dev/uba          First USB block device
+                  8 = /dev/ubb          Second USB block device
+                 16 = /dev/ubc          Third USB block device
+                    ...
 
 181 char        Conrad Electronic parallel port radio clocks
                   0 = /dev/pcfclock0    First Conrad radio clock
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 9d3a0775a11d..87851efb0228 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -258,3 +258,19 @@ Why:	These drivers never compiled since they were added to the kernel
 Who:    Jean Delvare <khali@linux-fr.org>
 
 ---------------------------
+
+What:   Bridge netfilter deferred IPv4/IPv6 output hook calling
+When:   January 2007
+Why:    The deferred output hooks are a layering violation causing unusual
+        and broken behaviour on bridge devices. Examples of things they
+        break include QoS classifation using the MARK or CLASSIFY targets,
+        the IPsec policy match and connection tracking with VLANs on a
+        bridge. Their only use is to enable bridge output port filtering
+        within iptables with the physdev match, which can also be done by
+        combining iptables and ebtables using netfilter marks. Until it
+        will get removed the hook deferral is disabled by default and is
+        only enabled when needed.
+
+Who:    Patrick McHardy <kaber@trash.net>
+
+---------------------------
diff --git a/Documentation/initrd.txt b/Documentation/initrd.txt
index b1b6440237a6..15f1b35deb34 100644
--- a/Documentation/initrd.txt
+++ b/Documentation/initrd.txt
@@ -72,6 +72,22 @@ initrd adds the following new options:
     initrd is mounted as root, and the normal boot procedure is followed,
     with the RAM disk still mounted as root.
 
+Compressed cpio images
+----------------------
+
+Recent kernels have support for populating a ramdisk from a compressed cpio
+archive, on such systems, the creation of a ramdisk image doesn't need to
+involve special block devices or loopbacks, you merely create a directory on
+disk with the desired initrd content, cd to that directory, and run (as an
+example):
+
+find . | cpio --quiet -c -o | gzip -9 -n > /boot/imagefile.img
+
+Examining the contents of an existing image file is just as simple:
+
+mkdir /tmp/imagefile
+cd /tmp/imagefile
+gzip -cd /boot/imagefile.img | cpio -imd --quiet
 
 Installation
 ------------
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index 14ef3868a328..0706699c9da9 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -407,6 +407,20 @@ more details, with real examples.
         The second argument is optional, and if supplied will be used
         if first argument is not supported.
 
+    ld-option
+        ld-option is used to check if $(CC) when used to link object files
+        supports the given option.  An optional second option may be
+        specified if first option are not supported.
+
+        Example:
+                #arch/i386/kernel/Makefile
+                vsyscall-flags += $(call ld-option, -Wl$(comma)--hash-style=sysv)
+
+        In the above example vsyscall-flags will be assigned the option
+        -Wl$(comma)--hash-style=sysv if it is supported by $(CC).
+        The second argument is optional, and if supplied will be used
+        if first argument is not supported.
+
     cc-option
         cc-option is used to check if $(CC) support a given option, and not
         supported to use an optional second option.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e11f7728ec6f..b50595a0550f 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -448,8 +448,6 @@ running once the system is up.
                         Format: <area>[,<node>]
                         See also Documentation/networking/decnet.txt.
 
-        delayacct       [KNL] Enable per-task delay accounting
-
         dhash_entries=  [KNL]
                         Set number of hash buckets for dentry cache.
 
@@ -1031,6 +1029,8 @@ running once the system is up.
 
         nocache         [ARM]
 
+        nodelayacct     [KNL] Disable per-task delay accounting
+
         nodisconnect    [HW,SCSI,M68K] Disables SCSI disconnects.
 
         noexec          [IA-64]
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 6887d44d2661..6da24e7a56cb 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -238,6 +238,13 @@ Debugging
   pagefaulttrace Dump all page faults. Only useful for extreme debugging
                 and will create a lot of output.
 
+  call_trace=[old|both|newfallback|new]
+                old: use old inexact backtracer
+                new: use new exact dwarf2 unwinder
+                both: print entries from both
+                newfallback: use new unwinder but fall back to old if it gets
+                        stuck (default)
+
 Misc
 
   noreplacement  Don't replace instructions with more appropriate ones
diff --git a/MAINTAINERS b/MAINTAINERS
index b2afc7ae965b..32aa30d1504a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -968,6 +968,10 @@ P:	Andrey V. Savochkin
 M:      saw@saw.sw.com.sg
 S:      Maintained
 
+EFS FILESYSTEM
+W:      http://aeschi.ch.eu.org/efs/
+S:      Orphan
+
 EMU10K1 SOUND DRIVER
 P:      James Courtier-Dutton
 M:      James@superbug.demon.co.uk
@@ -1598,7 +1602,7 @@ W:	http://jfs.sourceforge.net/
 T:      git kernel.org:/pub/scm/linux/kernel/git/shaggy/jfs-2.6.git
 S:      Supported
 
-JOURNALLING LAYER FOR BLOCK DEVICS (JBD)
+JOURNALLING LAYER FOR BLOCK DEVICES (JBD)
 P:      Stephen Tweedie, Andrew Morton
 M:      sct@redhat.com, akpm@osdl.org
 L:      ext2-devel@lists.sourceforge.net
@@ -1642,9 +1646,8 @@ S:	Maintained
 
 KERNEL JANITORS
 P:      Several
-L:      kernel-janitors@osdl.org
+L:      kernel-janitors@lists.osdl.org
 W:      http://www.kerneljanitors.org/
-W:      http://sf.net/projects/kernel-janitor/
 S:      Maintained
 
 KERNEL NFSD
@@ -1882,6 +1885,12 @@ S:     linux-scsi@vger.kernel.org
 W:     http://megaraid.lsilogic.com
 S:     Maintained
 
+MEMORY MANAGEMENT
+L:      linux-mm@kvack.org
+L:      linux-kernel@vger.kernel.org
+W:      http://www.linux-mm.org
+S:      Maintained
+
 MEMORY TECHNOLOGY DEVICES (MTD)
 P:      David Woodhouse
 M:      dwmw2@infradead.org
diff --git a/Makefile b/Makefile
index 1dd58d35d72c..c9b7dbb64c71 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 18
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME=Crazed Snow-Weasel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/err_ev7.c b/arch/alpha/kernel/err_ev7.c
index bf52ba691957..fed6b3d1b803 100644
--- a/arch/alpha/kernel/err_ev7.c
+++ b/arch/alpha/kernel/err_ev7.c
@@ -274,16 +274,14 @@ ev7_process_pal_subpacket(struct el_subpacket *header)
 struct el_subpacket_handler ev7_pal_subpacket_handler =
         SUBPACKET_HANDLER_INIT(EL_CLASS__PAL, ev7_process_pal_subpacket);
 
-void 
+void
 ev7_register_error_handlers(void)
 {
         int i;
 
-        for(i = 0;
-            i<sizeof(el_ev7_pal_annotations)/sizeof(el_ev7_pal_annotations[1]);
-            i++) {
+        for (i = 0; i < ARRAY_SIZE(el_ev7_pal_annotations); i++)
                 cdl_register_subpacket_annotation(&el_ev7_pal_annotations[i]);
-        }       
+
         cdl_register_subpacket_handler(&ev7_pal_subpacket_handler);
 }
 
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index e15dcf4f3dcd..73c7622b5297 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -623,12 +623,12 @@ osf_sysinfo(int command, char __user *buf, long count)
         long len, err = -EINVAL;
 
         offset = command-1;
-        if (offset >= sizeof(sysinfo_table)/sizeof(char *)) {
+        if (offset >= ARRAY_SIZE(sysinfo_table)) {
                 /* Digital UNIX has a few unpublished interfaces here */
                 printk("sysinfo(%d)", command);
                 goto out;
         }
-        
+
         down_read(&uts_sem);
         res = sysinfo_table[offset];
         len = strlen(res)+1;
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index 2cb9c4380113..fd4a8fa0c93d 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -114,8 +114,6 @@ struct alpha_machine_vector alpha_mv;
 int alpha_using_srm;
 #endif
 
-#define N(a) (sizeof(a)/sizeof(a[0]))
-
 static struct alpha_machine_vector *get_sysvec(unsigned long, unsigned long,
                                                unsigned long);
 static struct alpha_machine_vector *get_sysvec_byname(const char *);
@@ -240,7 +238,7 @@ reserve_std_resources(void)
         standard_io_resources[0].start = RTC_PORT(0);
         standard_io_resources[0].end = RTC_PORT(0) + 0x10;
 
-        for (i = 0; i < N(standard_io_resources); ++i)
+        for (i = 0; i < ARRAY_SIZE(standard_io_resources); ++i)
                 request_resource(io, standard_io_resources+i);
 }
 
@@ -918,13 +916,13 @@ get_sysvec(unsigned long type, unsigned long variation, unsigned long cpu)
 
         /* Search the system tables first... */
         vec = NULL;
-        if (type < N(systype_vecs)) {
+        if (type < ARRAY_SIZE(systype_vecs)) {
                 vec = systype_vecs[type];
         } else if ((type > ST_API_BIAS) &&
-                   (type - ST_API_BIAS) < N(api_vecs)) {
+                   (type - ST_API_BIAS) < ARRAY_SIZE(api_vecs)) {
                 vec = api_vecs[type - ST_API_BIAS];
         } else if ((type > ST_UNOFFICIAL_BIAS) &&
-                   (type - ST_UNOFFICIAL_BIAS) < N(unofficial_vecs)) {
+                   (type - ST_UNOFFICIAL_BIAS) < ARRAY_SIZE(unofficial_vecs)) {
                 vec = unofficial_vecs[type - ST_UNOFFICIAL_BIAS];
         }
 
@@ -938,11 +936,11 @@ get_sysvec(unsigned long type, unsigned long variation, unsigned long cpu)
 
                 switch (type) {
                 case ST_DEC_ALCOR:
-                        if (member < N(alcor_indices))
+                        if (member < ARRAY_SIZE(alcor_indices))
                                 vec = alcor_vecs[alcor_indices[member]];
                         break;
                 case ST_DEC_EB164:
-                        if (member < N(eb164_indices))
+                        if (member < ARRAY_SIZE(eb164_indices))
                                 vec = eb164_vecs[eb164_indices[member]];
                         /* PC164 may show as EB164 variation with EV56 CPU,
                            but, since no true EB164 had anything but EV5... */
@@ -950,24 +948,24 @@ get_sysvec(unsigned long type, unsigned long variation, unsigned long cpu)
                                 vec = &pc164_mv;
                         break;
                 case ST_DEC_EB64P:
-                        if (member < N(eb64p_indices))
+                        if (member < ARRAY_SIZE(eb64p_indices))
                                 vec = eb64p_vecs[eb64p_indices[member]];
                         break;
                 case ST_DEC_EB66:
-                        if (member < N(eb66_indices))
+                        if (member < ARRAY_SIZE(eb66_indices))
                                 vec = eb66_vecs[eb66_indices[member]];
                         break;
                 case ST_DEC_MARVEL:
-                        if (member < N(marvel_indices))
+                        if (member < ARRAY_SIZE(marvel_indices))
                                 vec = marvel_vecs[marvel_indices[member]];
                         break;
                 case ST_DEC_TITAN:
                         vec = titan_vecs[0];    /* default */
-                        if (member < N(titan_indices))
+                        if (member < ARRAY_SIZE(titan_indices))
                                 vec = titan_vecs[titan_indices[member]];
                         break;
                 case ST_DEC_TSUNAMI:
-                        if (member < N(tsunami_indices))
+                        if (member < ARRAY_SIZE(tsunami_indices))
                                 vec = tsunami_vecs[tsunami_indices[member]];
                         break;
                 case ST_DEC_1000:
@@ -1039,7 +1037,7 @@ get_sysvec_byname(const char *name)
 
         size_t i;
 
-        for (i = 0; i < N(all_vecs); ++i) {
+        for (i = 0; i < ARRAY_SIZE(all_vecs); ++i) {
                 struct alpha_machine_vector *mv = all_vecs[i];
                 if (strcasecmp(mv->vector_name, name) == 0)
                         return mv;
@@ -1055,13 +1053,13 @@ get_sysnames(unsigned long type, unsigned long variation, unsigned long cpu,
 
         /* If not in the tables, make it UNKNOWN,
            else set type name to family */
-        if (type < N(systype_names)) {
+        if (type < ARRAY_SIZE(systype_names)) {
                 *type_name = systype_names[type];
         } else if ((type > ST_API_BIAS) &&
-                   (type - ST_API_BIAS) < N(api_names)) {
+                   (type - ST_API_BIAS) < ARRAY_SIZE(api_names)) {
                 *type_name = api_names[type - ST_API_BIAS];
         } else if ((type > ST_UNOFFICIAL_BIAS) &&
-                   (type - ST_UNOFFICIAL_BIAS) < N(unofficial_names)) {
+                   (type - ST_UNOFFICIAL_BIAS) < ARRAY_SIZE(unofficial_names)) {
                 *type_name = unofficial_names[type - ST_UNOFFICIAL_BIAS];
         } else {
                 *type_name = sys_unknown;
@@ -1083,7 +1081,7 @@ get_sysnames(unsigned long type, unsigned long variation, unsigned long cpu,
         default: /* default to variation "0" for now */
                 break;
         case ST_DEC_EB164:
-                if (member < N(eb164_indices))
+                if (member < ARRAY_SIZE(eb164_indices))
                         *variation_name = eb164_names[eb164_indices[member]];
                 /* PC164 may show as EB164 variation, but with EV56 CPU,
                    so, since no true EB164 had anything but EV5... */
@@ -1091,32 +1089,32 @@ get_sysnames(unsigned long type, unsigned long variation, unsigned long cpu,
                         *variation_name = eb164_names[1]; /* make it PC164 */
                 break;
         case ST_DEC_ALCOR:
-                if (member < N(alcor_indices))
+                if (member < ARRAY_SIZE(alcor_indices))
                         *variation_name = alcor_names[alcor_indices[member]];
                 break;
         case ST_DEC_EB64P:
-                if (member < N(eb64p_indices))
+                if (member < ARRAY_SIZE(eb64p_indices))
                         *variation_name = eb64p_names[eb64p_indices[member]];
                 break;
         case ST_DEC_EB66:
-                if (member < N(eb66_indices))
+                if (member < ARRAY_SIZE(eb66_indices))
                         *variation_name = eb66_names[eb66_indices[member]];
                 break;
         case ST_DEC_MARVEL:
-                if (member < N(marvel_indices))
+                if (member < ARRAY_SIZE(marvel_indices))
                         *variation_name = marvel_names[marvel_indices[member]];
                 break;
         case ST_DEC_RAWHIDE:
-                if (member < N(rawhide_indices))
+                if (member < ARRAY_SIZE(rawhide_indices))
                         *variation_name = rawhide_names[rawhide_indices[member]];
                 break;
         case ST_DEC_TITAN:
                 *variation_name = titan_names[0];       /* default */
-                if (member < N(titan_indices))
+                if (member < ARRAY_SIZE(titan_indices))
                         *variation_name = titan_names[titan_indices[member]];
                 break;
         case ST_DEC_TSUNAMI:
-                if (member < N(tsunami_indices))
+                if (member < ARRAY_SIZE(tsunami_indices))
                         *variation_name = tsunami_names[tsunami_indices[member]];
                 break;
         }
@@ -1211,7 +1209,7 @@ show_cpuinfo(struct seq_file *f, void *slot)
 
         cpu_index = (unsigned) (cpu->type - 1);
         cpu_name = "Unknown";
-        if (cpu_index < N(cpu_names))
+        if (cpu_index < ARRAY_SIZE(cpu_names))
                 cpu_name = cpu_names[cpu_index];
 
         get_sysnames(hwrpb->sys_type, hwrpb->sys_variation,
diff --git a/arch/alpha/kernel/sys_ruffian.c b/arch/alpha/kernel/sys_ruffian.c
index 78c30decf3ff..5b99cf3cd69c 100644
--- a/arch/alpha/kernel/sys_ruffian.c
+++ b/arch/alpha/kernel/sys_ruffian.c
@@ -182,16 +182,16 @@ static unsigned long __init
 ruffian_get_bank_size(unsigned long offset)
 {
         unsigned long bank_addr, bank, ret = 0;
-  
+
         /* Valid offsets are: 0x800, 0x840 and 0x880
            since Ruffian only uses three banks.  */
         bank_addr = (unsigned long)PYXIS_MCR + offset;
         bank = *(vulp)bank_addr;
-    
+
         /* Check BANK_ENABLE */
         if (bank & 0x01) {
                 static unsigned long size[] __initdata = {
-                        0x40000000UL, /* 0x00,   1G */ 
+                        0x40000000UL, /* 0x00,   1G */
                         0x20000000UL, /* 0x02, 512M */
                         0x10000000UL, /* 0x04, 256M */
                         0x08000000UL, /* 0x06, 128M */
@@ -203,7 +203,7 @@ ruffian_get_bank_size(unsigned long offset)
                 };
 
                 bank = (bank & 0x1e) >> 1;
-                if (bank < sizeof(size)/sizeof(*size))
+                if (bank < ARRAY_SIZE(size))
                         ret = size[bank];
         }
 
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index 50eccde2dcd8..b191cc759737 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -233,7 +233,7 @@ validate_cc_value(unsigned long cc)
         index = cpu->type & 0xffffffff;
 
         /* If index out of bounds, no way to validate.  */
-        if (index >= sizeof(cpu_hz)/sizeof(cpu_hz[0]))
+        if (index >= ARRAY_SIZE(cpu_hz))
                 return cc;
 
         /* If index contains no data, no way to validate.  */
diff --git a/arch/arm/configs/ep93xx_defconfig b/arch/arm/configs/ep93xx_defconfig
index c0de6fcd488a..2948b4589a8b 100644
--- a/arch/arm/configs/ep93xx_defconfig
+++ b/arch/arm/configs/ep93xx_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
-# Sun Jul  9 15:21:30 2006
+# Linux kernel version: 2.6.18-rc1-git9
+# Sat Jul 15 15:08:10 2006
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
@@ -30,6 +30,7 @@ CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_TASKSTATS is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
@@ -749,7 +750,7 @@ CONFIG_VIDEO_V4L2=y
 # USB support
 #
 CONFIG_USB_ARCH_HAS_HCD=y
-# CONFIG_USB_ARCH_HAS_OHCI is not set
+CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_USB_ARCH_HAS_EHCI is not set
 CONFIG_USB=y
 CONFIG_USB_DEBUG=y
@@ -766,6 +767,9 @@ CONFIG_USB_DYNAMIC_MINORS=y
 # USB Host Controller Drivers
 #
 # CONFIG_USB_ISP116X_HCD is not set
+CONFIG_USB_OHCI_HCD=y
+# CONFIG_USB_OHCI_BIG_ENDIAN is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_SL811_HCD is not set
 
 #
@@ -855,6 +859,7 @@ CONFIG_USB_SERIAL_CONSOLE=y
 CONFIG_USB_SERIAL_PL2303=y
 # CONFIG_USB_SERIAL_HP4X is not set
 # CONFIG_USB_SERIAL_SAFE is not set
+# CONFIG_USB_SERIAL_SIERRAWIRELESS is not set
 # CONFIG_USB_SERIAL_TI is not set
 # CONFIG_USB_SERIAL_CYBERJACK is not set
 # CONFIG_USB_SERIAL_XIRCOM is not set
@@ -871,7 +876,7 @@ CONFIG_USB_SERIAL_PL2303=y
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
-# CONFIG_USB_CY7C63 is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
@@ -916,6 +921,7 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_X1205 is not set
 # CONFIG_RTC_DRV_DS1307 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_ISL1208 is not set
 # CONFIG_RTC_DRV_DS1672 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
 # CONFIG_RTC_DRV_PCF8563 is not set
@@ -1023,7 +1029,6 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 2242f5f7cb7d..4fe386eea4b4 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -114,9 +114,9 @@ ENTRY(secondary_startup)
          * Use the page tables supplied from  __cpu_up.
          */
         adr     r4, __secondary_data
-        ldmia   r4, {r5, r6, r13}               @ address to jump to after
+        ldmia   r4, {r5, r7, r13}               @ address to jump to after
         sub     r4, r4, r5                      @ mmu has been enabled
-        ldr     r4, [r6, r4]                    @ get secondary_data.pgdir
+        ldr     r4, [r7, r4]                    @ get secondary_data.pgdir
         adr     lr, __enable_mmu                @ return address
         add     pc, r10, #12                    @ initialise processor
                                                 @ (return control reg)
@@ -125,7 +125,7 @@ ENTRY(secondary_startup)
          * r6  = &secondary_data
          */
 ENTRY(__secondary_switched)
-        ldr     sp, [r6, #4]                    @ get secondary_data.stack
+        ldr     sp, [r7, #4]                    @ get secondary_data.stack
         mov     fp, #0
         b       secondary_start_kernel
 
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 35a052fc177a..4e29dd03e582 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -232,11 +232,8 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
         bust_spinlocks(0);
         spin_unlock_irq(&die_lock);
 
-        if (panic_on_oops) {
-                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
-                ssleep(5);
-                panic("Fatal exception");
-        }
+        if (panic_on_oops)
+                panic("Fatal exception: panic_on_oops");
 
         do_exit(SIGSEGV);
 }
diff --git a/arch/arm/mach-footbridge/cats-hw.c b/arch/arm/mach-footbridge/cats-hw.c
index 5b64d5c5b967..ef6ccc8993e9 100644
--- a/arch/arm/mach-footbridge/cats-hw.c
+++ b/arch/arm/mach-footbridge/cats-hw.c
@@ -8,7 +8,7 @@
 #include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/tty.h>
+#include <linux/screen_info.h>
 
 #include <asm/hardware/dec21285.h>
 #include <asm/io.h>
diff --git a/arch/arm/mach-s3c2410/mach-anubis.c b/arch/arm/mach-s3c2410/mach-anubis.c
index 4a92d6f92d6b..60641d452db3 100644
--- a/arch/arm/mach-s3c2410/mach-anubis.c
+++ b/arch/arm/mach-s3c2410/mach-anubis.c
@@ -60,11 +60,12 @@ static struct map_desc anubis_iodesc[] __initdata = {
         .virtual        = (u32)S3C24XX_VA_ISA_BYTE,
         .pfn            = __phys_to_pfn(0x0),
         .length         = SZ_4M,
-        .type           = MT_DEVICE
+        .type           = MT_DEVICE,
   }, {
         .virtual        = (u32)S3C24XX_VA_ISA_WORD,
         .pfn            = __phys_to_pfn(0x0),
-        .length         = SZ_4M, MT_DEVICE
+        .length         = SZ_4M,
+        .type           = MT_DEVICE,
   },
 
   /* we could possibly compress the next set down into a set of smaller tables
@@ -78,36 +79,12 @@ static struct map_desc anubis_iodesc[] __initdata = {
         .virtual        = (u32)ANUBIS_VA_CTRL1,
         .pfn            = __phys_to_pfn(ANUBIS_PA_CTRL1),
         .length         = SZ_4K,
-        .type           = MT_DEVICE
+        .type           = MT_DEVICE,
   }, {
         .virtual        = (u32)ANUBIS_VA_CTRL2,
         .pfn            = __phys_to_pfn(ANUBIS_PA_CTRL2),
         .length         = SZ_4K,
-        .type           =MT_DEVICE
-  },
-
-  /* IDE drives */
-
-  {
-        .virtual        = (u32)ANUBIS_IDEPRI,
-        .pfn            = __phys_to_pfn(S3C2410_CS3),
-        .length         = SZ_1M,
-        .type           = MT_DEVICE
-  }, {
-        .virtual        = (u32)ANUBIS_IDEPRIAUX,
-        .pfn            = __phys_to_pfn(S3C2410_CS3+(1<<26)),
-        .length         = SZ_1M,
-        .type           = MT_DEVICE
-  }, {
-        .virtual        = (u32)ANUBIS_IDESEC,
-        .pfn            = __phys_to_pfn(S3C2410_CS4),
-        .length         = SZ_1M,
-        .type           = MT_DEVICE
-  }, {
-        .virtual        = (u32)ANUBIS_IDESECAUX,
-        .pfn            = __phys_to_pfn(S3C2410_CS4+(1<<26)),
-        .length         = SZ_1M,
-        .type           = MT_DEVICE
+        .type           = MT_DEVICE,
   },
 };
 
@@ -126,7 +103,7 @@ static struct s3c24xx_uart_clksrc anubis_serial_clocks[] = {
                 .name           = "pclk",
                 .divisor        = 1,
                 .min_baud       = 0,
-                .max_baud       = 0.
+                .max_baud       = 0,
         }
 };
 
@@ -139,7 +116,7 @@ static struct s3c2410_uartcfg anubis_uartcfgs[] __initdata = {
                 .ulcon       = ULCON,
                 .ufcon       = UFCON,
                 .clocks      = anubis_serial_clocks,
-                .clocks_size = ARRAY_SIZE(anubis_serial_clocks)
+                .clocks_size = ARRAY_SIZE(anubis_serial_clocks),
         },
         [1] = {
                 .hwport      = 2,
@@ -148,7 +125,7 @@ static struct s3c2410_uartcfg anubis_uartcfgs[] __initdata = {
                 .ulcon       = ULCON,
                 .ufcon       = UFCON,
                 .clocks      = anubis_serial_clocks,
-                .clocks_size = ARRAY_SIZE(anubis_serial_clocks)
+                .clocks_size = ARRAY_SIZE(anubis_serial_clocks),
         },
 };
 
@@ -162,7 +139,7 @@ static struct mtd_partition anubis_default_nand_part[] = {
         [0] = {
                 .name   = "Boot Agent",
                 .size   = SZ_16K,
-                .offset = 0
+                .offset = 0,
         },
         [1] = {
                 .name   = "/boot",
@@ -194,21 +171,21 @@ static struct s3c2410_nand_set anubis_nand_sets[] = {
                 .nr_chips       = 1,
                 .nr_map         = external_map,
                 .nr_partitions  = ARRAY_SIZE(anubis_default_nand_part),
-                .partitions     = anubis_default_nand_part
+                .partitions     = anubis_default_nand_part,
         },
         [0] = {
                 .name           = "chip0",
                 .nr_chips       = 1,
                 .nr_map         = chip0_map,
                 .nr_partitions  = ARRAY_SIZE(anubis_default_nand_part),
-                .partitions     = anubis_default_nand_part
+                .partitions     = anubis_default_nand_part,
         },
         [2] = {
                 .name           = "chip1",
                 .nr_chips       = 1,
                 .nr_map         = chip1_map,
                 .nr_partitions  = ARRAY_SIZE(anubis_default_nand_part),
-                .partitions     = anubis_default_nand_part
+                .partitions     = anubis_default_nand_part,
         },
 };
 
@@ -313,7 +290,7 @@ static struct s3c24xx_board anubis_board __initdata = {
         .devices       = anubis_devices,
         .devices_count = ARRAY_SIZE(anubis_devices),
         .clocks        = anubis_clocks,
-        .clocks_count  = ARRAY_SIZE(anubis_clocks)
+        .clocks_count  = ARRAY_SIZE(anubis_clocks),
 };
 
 static void __init anubis_map_io(void)
diff --git a/arch/arm/mach-s3c2410/mach-osiris.c b/arch/arm/mach-s3c2410/mach-osiris.c
index 858fd03c6bc5..e193ba69e652 100644
--- a/arch/arm/mach-s3c2410/mach-osiris.c
+++ b/arch/arm/mach-s3c2410/mach-osiris.c
@@ -67,12 +67,12 @@ static struct map_desc osiris_iodesc[] __initdata = {
           .virtual      = (u32)OSIRIS_VA_CTRL1,
           .pfn          = __phys_to_pfn(OSIRIS_PA_CTRL1),
           .length       = SZ_16K,
-          .type         = MT_DEVICE
+          .type         = MT_DEVICE,
   }, {
           .virtual      = (u32)OSIRIS_VA_CTRL2,
           .pfn          = __phys_to_pfn(OSIRIS_PA_CTRL2),
           .length       = SZ_16K,
-          .type         = MT_DEVICE
+          .type         = MT_DEVICE,
   },
 };
 
@@ -91,7 +91,7 @@ static struct s3c24xx_uart_clksrc osiris_serial_clocks[] = {
                 .name           = "pclk",
                 .divisor        = 1,
                 .min_baud       = 0,
-                .max_baud       = 0.
+                .max_baud       = 0,
         }
 };
 
@@ -103,7 +103,7 @@ static struct s3c2410_uartcfg osiris_uartcfgs[] __initdata = {
                 .ulcon       = ULCON,
                 .ufcon       = UFCON,
                 .clocks      = osiris_serial_clocks,
-                .clocks_size = ARRAY_SIZE(osiris_serial_clocks)
+                .clocks_size = ARRAY_SIZE(osiris_serial_clocks),
         },
         [1] = {
                 .hwport      = 1,
@@ -112,7 +112,7 @@ static struct s3c2410_uartcfg osiris_uartcfgs[] __initdata = {
                 .ulcon       = ULCON,
                 .ufcon       = UFCON,
                 .clocks      = osiris_serial_clocks,
-                .clocks_size = ARRAY_SIZE(osiris_serial_clocks)
+                .clocks_size = ARRAY_SIZE(osiris_serial_clocks),
         },
 };
 
@@ -126,7 +126,7 @@ static struct mtd_partition osiris_default_nand_part[] = {
         [0] = {
                 .name   = "Boot Agent",
                 .size   = SZ_16K,
-                .offset = 0
+                .offset = 0,
         },
         [1] = {
                 .name   = "/boot",
@@ -158,21 +158,21 @@ static struct s3c2410_nand_set osiris_nand_sets[] = {
                 .nr_chips       = 1,
                 .nr_map         = external_map,
                 .nr_partitions  = ARRAY_SIZE(osiris_default_nand_part),
-                .partitions     = osiris_default_nand_part
+                .partitions     = osiris_default_nand_part,
         },
         [0] = {
                 .name           = "chip0",
                 .nr_chips       = 1,
                 .nr_map         = chip0_map,
                 .nr_partitions  = ARRAY_SIZE(osiris_default_nand_part),
-                .partitions     = osiris_default_nand_part
+                .partitions     = osiris_default_nand_part,
         },
         [2] = {
                 .name           = "chip1",
                 .nr_chips       = 1,
                 .nr_map         = chip1_map,
                 .nr_partitions  = ARRAY_SIZE(osiris_default_nand_part),
-                .partitions     = osiris_default_nand_part
+                .partitions     = osiris_default_nand_part,
         },
 };
 
@@ -245,7 +245,7 @@ static struct s3c24xx_board osiris_board __initdata = {
         .devices       = osiris_devices,
         .devices_count = ARRAY_SIZE(osiris_devices),
         .clocks        = osiris_clocks,
-        .clocks_count  = ARRAY_SIZE(osiris_clocks)
+        .clocks_count  = ARRAY_SIZE(osiris_clocks),
 };
 
 static void __init osiris_map_io(void)
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index dba7dddfe57d..88a999df0ab3 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -363,7 +363,9 @@ EXPORT_SYMBOL(__ioremap);
 
 void __iounmap(void __iomem *addr)
 {
+#ifndef CONFIG_SMP
         struct vm_struct **p, *tmp;
+#endif
         unsigned int section_mapping = 0;
 
         addr = (void __iomem *)(PAGE_MASK & (unsigned long)addr);
diff --git a/arch/arm/mm/proc-syms.c b/arch/arm/mm/proc-syms.c
index 6c5f0fe578a5..ab143557e688 100644
--- a/arch/arm/mm/proc-syms.c
+++ b/arch/arm/mm/proc-syms.c
@@ -13,6 +13,7 @@
 #include <asm/cacheflush.h>
 #include <asm/proc-fns.h>
 #include <asm/tlbflush.h>
+#include <asm/page.h>
 
 #ifndef MULTI_CPU
 EXPORT_SYMBOL(cpu_dcache_clean_area);
@@ -30,6 +31,13 @@ EXPORT_SYMBOL(__cpuc_coherent_kern_range);
 EXPORT_SYMBOL(cpu_cache);
 #endif
 
+#ifndef MULTI_USER
+EXPORT_SYMBOL(__cpu_clear_user_page);
+EXPORT_SYMBOL(__cpu_copy_user_page);
+#else
+EXPORT_SYMBOL(cpu_user);
+#endif
+
 /*
  * No module should need to touch the TLB (and currently
  * no modules do.  We export this for "loadkernel" support
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 521538671f4c..561bff73a036 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -536,6 +536,11 @@ cpu_80200_name:
         .asciz  "XScale-80200"
         .size   cpu_80200_name, . - cpu_80200_name
 
+        .type   cpu_80219_name, #object
+cpu_80219_name:
+        .asciz  "XScale-80219"
+        .size   cpu_80219_name, . - cpu_80219_name
+
         .type   cpu_8032x_name, #object
 cpu_8032x_name:
         .asciz  "XScale-IOP8032x Family"
@@ -613,10 +618,33 @@ __80200_proc_info:
         .long   xscale_cache_fns
         .size   __80200_proc_info, . - __80200_proc_info
 
+        .type   __80219_proc_info,#object
+__80219_proc_info:
+        .long   0x69052e20
+        .long   0xffffffe0
+        .long   PMD_TYPE_SECT | \
+                PMD_SECT_BUFFERABLE | \
+                PMD_SECT_CACHEABLE | \
+                PMD_SECT_AP_WRITE | \
+                PMD_SECT_AP_READ
+        .long   PMD_TYPE_SECT | \
+                PMD_SECT_AP_WRITE | \
+                PMD_SECT_AP_READ
+        b       __xscale_setup
+        .long   cpu_arch_name
+        .long   cpu_elf_name
+        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP
+        .long   cpu_80219_name
+        .long   xscale_processor_functions
+        .long   v4wbi_tlb_fns
+        .long   xscale_mc_user_fns
+        .long   xscale_cache_fns
+        .size   __80219_proc_info, . - __80219_proc_info
+
         .type   __8032x_proc_info,#object
 __8032x_proc_info:
         .long   0x69052420
-        .long   0xfffff5e0      @ mask should accomodate IOP80219 also
+        .long   0xffffffe0
         .long   PMD_TYPE_SECT | \
                 PMD_SECT_BUFFERABLE | \
                 PMD_SECT_CACHEABLE | \
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index daa75ce4b777..f71fb4a029cb 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -672,7 +672,7 @@ config MTRR
           See <file:Documentation/mtrr.txt> for more information.
 
 config EFI
-        bool "Boot from EFI support (EXPERIMENTAL)"
+        bool "Boot from EFI support"
         depends on ACPI
         default n
         ---help---
diff --git a/arch/i386/kernel/Makefile b/arch/i386/kernel/Makefile
index 1b452a1665c4..ab98fc21a541 100644
--- a/arch/i386/kernel/Makefile
+++ b/arch/i386/kernel/Makefile
@@ -59,7 +59,8 @@ quiet_cmd_syscall = SYSCALL $@
 
 export CPPFLAGS_vsyscall.lds += -P -C -U$(ARCH)
 
-vsyscall-flags = -shared -s -Wl,-soname=linux-gate.so.1
+vsyscall-flags = -shared -s -Wl,-soname=linux-gate.so.1 \
+                 $(call ld-option, -Wl$(comma)--hash-style=sysv)
 SYSCFLAGS_vsyscall-sysenter.so  = $(vsyscall-flags)
 SYSCFLAGS_vsyscall-int80.so     = $(vsyscall-flags)
 
diff --git a/arch/i386/kernel/cpu/intel_cacheinfo.c b/arch/i386/kernel/cpu/intel_cacheinfo.c
index e9f0b928b0a9..5c43be47587f 100644
--- a/arch/i386/kernel/cpu/intel_cacheinfo.c
+++ b/arch/i386/kernel/cpu/intel_cacheinfo.c
@@ -759,7 +759,7 @@ static int __cpuinit cache_sysfs_init(void)
         if (num_cache_leaves == 0)
                 return 0;
 
-        register_cpu_notifier(&cacheinfo_cpu_notifier);
+        register_hotcpu_notifier(&cacheinfo_cpu_notifier);
 
         for_each_online_cpu(i) {
                 cacheinfo_cpu_callback(&cacheinfo_cpu_notifier, CPU_ONLINE,
diff --git a/arch/i386/kernel/cpu/mcheck/mce.h b/arch/i386/kernel/cpu/mcheck/mce.h
index dc2416dfef15..84fd4cf7d0fb 100644
--- a/arch/i386/kernel/cpu/mcheck/mce.h
+++ b/arch/i386/kernel/cpu/mcheck/mce.h
@@ -9,6 +9,6 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c);
 /* Call the installed machine check handler for this CPU setup. */
 extern fastcall void (*machine_check_vector)(struct pt_regs *, long error_code);
 
-extern int mce_disabled __initdata;
+extern int mce_disabled;
 extern int nr_mce_banks;
 
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index d9a260f2efb4..37a7d2eaf4a0 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -204,7 +204,7 @@ VM_MASK		= 0x00020000
 ENTRY(ret_from_fork)
         CFI_STARTPROC
         pushl %eax
-        CFI_ADJUST_CFA_OFFSET -4
+        CFI_ADJUST_CFA_OFFSET 4
         call schedule_tail
         GET_THREAD_INFO(%ebp)
         popl %eax
diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index de2e16e561c0..afe6505ca0b3 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -256,11 +256,6 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
         int ret = 0;
         kprobe_opcode_t *addr;
         struct kprobe_ctlblk *kcb;
-#ifdef CONFIG_PREEMPT
-        unsigned pre_preempt_count = preempt_count();
-#else
-        unsigned pre_preempt_count = 1;
-#endif
 
         addr = (kprobe_opcode_t *)(regs->eip - sizeof(kprobe_opcode_t));
 
@@ -338,13 +333,15 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                 return 1;
 
 ss_probe:
-        if (pre_preempt_count && p->ainsn.boostable == 1 && !p->post_handler){
+#ifndef CONFIG_PREEMPT
+        if (p->ainsn.boostable == 1 && !p->post_handler){
                 /* Boost up -- we can execute copied instructions directly */
                 reset_current_kprobe();
                 regs->eip = (unsigned long)p->ainsn.insn;
                 preempt_enable_no_resched();
                 return 1;
         }
+#endif
         prepare_singlestep(p, regs);
         kcb->kprobe_status = KPROBE_HIT_SS;
         return 1;
diff --git a/arch/i386/kernel/machine_kexec.c b/arch/i386/kernel/machine_kexec.c
index 511abe52a94e..6b1ae6ba76f0 100644
--- a/arch/i386/kernel/machine_kexec.c
+++ b/arch/i386/kernel/machine_kexec.c
@@ -189,14 +189,11 @@ NORET_TYPE void machine_kexec(struct kimage *image)
         memcpy((void *)reboot_code_buffer, relocate_new_kernel,
                                                 relocate_new_kernel_size);
 
-        /* The segment registers are funny things, they are
-         * automatically loaded from a table, in memory wherever you
-         * set them to a specific selector, but this table is never
-         * accessed again you set the segment to a different selector.
-         *
-         * The more common model is are caches where the behide
-         * the scenes work is done, but is also dropped at arbitrary
-         * times.
+        /* The segment registers are funny things, they have both a
+         * visible and an invisible part.  Whenever the visible part is
+         * set to a specific selector, the invisible part is loaded
+         * with from a table in memory.  At no other time is the
+         * descriptor table in memory accessed.
          *
          * I take advantage of this here by force loading the
          * segments, before I zap the gdt with an invalid value.
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 2dd928a84645..acb351478e42 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -575,6 +575,7 @@ void touch_nmi_watchdog (void)
          */
         touch_softlockup_watchdog();
 }
+EXPORT_SYMBOL(touch_nmi_watchdog);
 
 extern void die_nmi(struct pt_regs *, const char *msg);
 
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index 923bb292f47f..8657c739656a 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -690,8 +690,8 @@ struct task_struct fastcall * __switch_to(struct task_struct *prev_p, struct tas
         /*
          * Now maybe handle debug registers and/or IO bitmaps
          */
-        if (unlikely((task_thread_info(next_p)->flags & _TIF_WORK_CTXSW))
-            || test_tsk_thread_flag(prev_p, TIF_IO_BITMAP))
+        if (unlikely((task_thread_info(next_p)->flags & _TIF_WORK_CTXSW)
+            || test_tsk_thread_flag(prev_p, TIF_IO_BITMAP)))
                 __switch_to_xtra(next_p, tss);
 
         disable_tsc(prev_p, next_p);
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index 6f5fea05f1d7..f948419c888a 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -212,14 +212,20 @@ valid_k7:
  * then we print a warning if not, and always resync.
  */
 
-static atomic_t tsc_start_flag = ATOMIC_INIT(0);
-static atomic_t tsc_count_start = ATOMIC_INIT(0);
-static atomic_t tsc_count_stop = ATOMIC_INIT(0);
-static unsigned long long tsc_values[NR_CPUS];
+static struct {
+        atomic_t start_flag;
+        atomic_t count_start;
+        atomic_t count_stop;
+        unsigned long long values[NR_CPUS];
+} tsc __initdata = {
+        .start_flag = ATOMIC_INIT(0),
+        .count_start = ATOMIC_INIT(0),
+        .count_stop = ATOMIC_INIT(0),
+};
 
 #define NR_LOOPS 5
 
-static void __init synchronize_tsc_bp (void)
+static void __init synchronize_tsc_bp(void)
 {
         int i;
         unsigned long long t0;
@@ -233,7 +239,7 @@ static void __init synchronize_tsc_bp (void)
         /* convert from kcyc/sec to cyc/usec */
         one_usec = cpu_khz / 1000;
 
-        atomic_set(&tsc_start_flag, 1);
+        atomic_set(&tsc.start_flag, 1);
         wmb();
 
         /*
@@ -250,16 +256,16 @@ static void __init synchronize_tsc_bp (void)
                 /*
                  * all APs synchronize but they loop on '== num_cpus'
                  */
-                while (atomic_read(&tsc_count_start) != num_booting_cpus()-1)
+                while (atomic_read(&tsc.count_start) != num_booting_cpus()-1)
                         cpu_relax();
-                atomic_set(&tsc_count_stop, 0);
+                atomic_set(&tsc.count_stop, 0);
                 wmb();
                 /*
                  * this lets the APs save their current TSC:
                  */
-                atomic_inc(&tsc_count_start);
+                atomic_inc(&tsc.count_start);
 
-                rdtscll(tsc_values[smp_processor_id()]);
+                rdtscll(tsc.values[smp_processor_id()]);
                 /*
                  * We clear the TSC in the last loop:
                  */
@@ -269,56 +275,54 @@ static void __init synchronize_tsc_bp (void)
                 /*
                  * Wait for all APs to leave the synchronization point:
                  */
-                while (atomic_read(&tsc_count_stop) != num_booting_cpus()-1)
+                while (atomic_read(&tsc.count_stop) != num_booting_cpus()-1)
                         cpu_relax();
-                atomic_set(&tsc_count_start, 0);
+                atomic_set(&tsc.count_start, 0);
                 wmb();
-                atomic_inc(&tsc_count_stop);
+                atomic_inc(&tsc.count_stop);
         }
 
         sum = 0;
         for (i = 0; i < NR_CPUS; i++) {
                 if (cpu_isset(i, cpu_callout_map)) {
-                        t0 = tsc_values[i];
+                        t0 = tsc.values[i];
                         sum += t0;
                 }
         }
         avg = sum;
         do_div(avg, num_booting_cpus());
 
-        sum = 0;
         for (i = 0; i < NR_CPUS; i++) {
                 if (!cpu_isset(i, cpu_callout_map))
                         continue;
-                delta = tsc_values[i] - avg;
+                delta = tsc.values[i] - avg;
                 if (delta < 0)
                         delta = -delta;
                 /*
                  * We report bigger than 2 microseconds clock differences.
                  */
                 if (delta > 2*one_usec) {
-                        long realdelta;
+                        long long realdelta;
+
                         if (!buggy) {
                                 buggy = 1;
                                 printk("\n");
                         }
                         realdelta = delta;
                         do_div(realdelta, one_usec);
-                        if (tsc_values[i] < avg)
+                        if (tsc.values[i] < avg)
                                 realdelta = -realdelta;
 
-                        if (realdelta > 0)
-                                printk(KERN_INFO "CPU#%d had %ld usecs TSC "
+                        if (realdelta)
+                                printk(KERN_INFO "CPU#%d had %Ld usecs TSC "
                                         "skew, fixed it up.\n", i, realdelta);
                 }
-
-                sum += delta;
         }
         if (!buggy)
                 printk("passed.\n");
 }
 
-static void __init synchronize_tsc_ap (void)
+static void __init synchronize_tsc_ap(void)
 {
         int i;
 
@@ -327,20 +331,20 @@ static void __init synchronize_tsc_ap (void)
          * this gets called, so we first wait for the BP to
          * finish SMP initialization:
          */
-        while (!atomic_read(&tsc_start_flag))
+        while (!atomic_read(&tsc.start_flag))
                 cpu_relax();
 
         for (i = 0; i < NR_LOOPS; i++) {
-                atomic_inc(&tsc_count_start);
-                while (atomic_read(&tsc_count_start) != num_booting_cpus())
+                atomic_inc(&tsc.count_start);
+                while (atomic_read(&tsc.count_start) != num_booting_cpus())
                         cpu_relax();
 
-                rdtscll(tsc_values[smp_processor_id()]);
+                rdtscll(tsc.values[smp_processor_id()]);
                 if (i == NR_LOOPS-1)
                         write_tsc(0, 0);
 
-                atomic_inc(&tsc_count_stop);
-                while (atomic_read(&tsc_count_stop) != num_booting_cpus())
+                atomic_inc(&tsc.count_stop);
+                while (atomic_read(&tsc.count_stop) != num_booting_cpus())
                         cpu_relax();
         }
 }
diff --git a/arch/i386/kernel/time.c b/arch/i386/kernel/time.c
index 8705c0f05788..edd00f6cee37 100644
--- a/arch/i386/kernel/time.c
+++ b/arch/i386/kernel/time.c
@@ -135,7 +135,7 @@ unsigned long profile_pc(struct pt_regs *regs)
 {
         unsigned long pc = instruction_pointer(regs);
 
-        if (in_lock_functions(pc))
+        if (!user_mode_vm(regs) && in_lock_functions(pc))
                 return *(unsigned long *)(regs->ebp + 4);
 
         return pc;
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 313ac1f7dc5a..0d4005dc06c5 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -187,10 +187,21 @@ static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
                         if (unwind_init_blocked(&info, task) == 0)
                                 unw_ret = show_trace_unwind(&info, log_lvl);
                 }
-                if (unw_ret > 0) {
-                        if (call_trace > 0)
+                if (unw_ret > 0 && !arch_unw_user_mode(&info)) {
+#ifdef CONFIG_STACK_UNWIND
+                        print_symbol("DWARF2 unwinder stuck at %s\n",
+                                     UNW_PC(&info));
+                        if (call_trace == 1) {
+                                printk("Leftover inexact backtrace:\n");
+                                if (UNW_SP(&info))
+                                        stack = (void *)UNW_SP(&info);
+                        } else if (call_trace > 1)
                                 return;
-                        printk("%sLegacy call trace:\n", log_lvl);
+                        else
+                                printk("Full inexact backtrace again:\n");
+#else
+                        printk("Inexact backtrace:\n");
+#endif
                 }
         }
 
@@ -442,11 +453,9 @@ void die(const char * str, struct pt_regs * regs, long err)
         if (in_interrupt())
                 panic("Fatal exception in interrupt");
 
-        if (panic_on_oops) {
-                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
-                ssleep(5);
-                panic("Fatal exception");
-        }
+        if (panic_on_oops)
+                panic("Fatal exception: panic_on_oops");
+
         oops_exit();
         do_exit(SIGSEGV);
 }
@@ -1238,8 +1247,10 @@ static int __init call_trace_setup(char *s)
                 call_trace = -1;
         else if (strcmp(s, "both") == 0)
                 call_trace = 0;
-        else if (strcmp(s, "new") == 0)
+        else if (strcmp(s, "newfallback") == 0)
                 call_trace = 1;
+        else if (strcmp(s, "new") == 2)
+                call_trace = 2;
         return 1;
 }
 __setup("call_trace=", call_trace_setup);
diff --git a/arch/i386/kernel/vsyscall.lds.S b/arch/i386/kernel/vsyscall.lds.S
index e26975fc68b6..f66cd11adb72 100644
--- a/arch/i386/kernel/vsyscall.lds.S
+++ b/arch/i386/kernel/vsyscall.lds.S
@@ -10,6 +10,7 @@ SECTIONS
   . = VDSO_PRELINK + SIZEOF_HEADERS;
 
   .hash           : { *(.hash) }                :text
+  .gnu.hash       : { *(.gnu.hash) }
   .dynsym         : { *(.dynsym) }
   .dynstr         : { *(.dynstr) }
   .gnu.version    : { *(.gnu.version) }
diff --git a/arch/ia64/configs/sn2_defconfig b/arch/ia64/configs/sn2_defconfig
index 9ea35398e10d..0f14a82b856e 100644
--- a/arch/ia64/configs/sn2_defconfig
+++ b/arch/ia64/configs/sn2_defconfig
@@ -363,7 +363,7 @@ CONFIG_BLK_DEV_IDECD=y
 #
 CONFIG_IDE_GENERIC=y
 CONFIG_BLK_DEV_IDEPCI=y
-# CONFIG_IDEPCI_SHARE_IRQ is not set
+CONFIG_IDEPCI_SHARE_IRQ=y
 # CONFIG_BLK_DEV_OFFBOARD is not set
 # CONFIG_BLK_DEV_GENERIC is not set
 # CONFIG_BLK_DEV_OPTI621 is not set
diff --git a/arch/ia64/defconfig b/arch/ia64/defconfig
index 6cba55da572a..9001b3fbaa32 100644
--- a/arch/ia64/defconfig
+++ b/arch/ia64/defconfig
@@ -366,7 +366,7 @@ CONFIG_BLK_DEV_IDESCSI=m
 # CONFIG_IDE_GENERIC is not set
 # CONFIG_BLK_DEV_IDEPNP is not set
 CONFIG_BLK_DEV_IDEPCI=y
-# CONFIG_IDEPCI_SHARE_IRQ is not set
+CONFIG_IDEPCI_SHARE_IRQ=y
 # CONFIG_BLK_DEV_OFFBOARD is not set
 CONFIG_BLK_DEV_GENERIC=y
 # CONFIG_BLK_DEV_OPTI621 is not set
diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile
index 0e4553f320bf..ad8215a3c586 100644
--- a/arch/ia64/kernel/Makefile
+++ b/arch/ia64/kernel/Makefile
@@ -45,7 +45,8 @@ CPPFLAGS_gate.lds := -P -C -U$(ARCH)
 quiet_cmd_gate = GATE $@
       cmd_gate = $(CC) -nostdlib $(GATECFLAGS_$(@F)) -Wl,-T,$(filter-out FORCE,$^) -o $@
 
-GATECFLAGS_gate.so = -shared -s -Wl,-soname=linux-gate.so.1
+GATECFLAGS_gate.so = -shared -s -Wl,-soname=linux-gate.so.1 \
+                     $(call ld-option, -Wl$(comma)--hash-style=sysv)
 $(obj)/gate.so: $(obj)/gate.lds $(obj)/gate.o FORCE
         $(call if_changed,gate)
 
diff --git a/arch/ia64/kernel/gate.lds.S b/arch/ia64/kernel/gate.lds.S
index cc35cddfd4cf..6d198339bf85 100644
--- a/arch/ia64/kernel/gate.lds.S
+++ b/arch/ia64/kernel/gate.lds.S
@@ -12,6 +12,7 @@ SECTIONS
   . = GATE_ADDR + SIZEOF_HEADERS;
 
   .hash                         : { *(.hash) }                          :readable
+  .gnu.hash                     : { *(.gnu.hash) }
   .dynsym                       : { *(.dynsym) }
   .dynstr                       : { *(.dynstr) }
   .gnu.version                  : { *(.gnu.version) }
diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index 00d9c83b8020..781960f80b6f 100644
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -448,11 +448,20 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
         return 0;
 }
 
+void __kprobes flush_insn_slot(struct kprobe *p)
+{
+        unsigned long arm_addr;
+
+        arm_addr = ((unsigned long)&p->opcode.bundle) & ~0xFULL;
+        flush_icache_range(arm_addr, arm_addr + sizeof(bundle_t));
+}
+
 void __kprobes arch_arm_kprobe(struct kprobe *p)
 {
         unsigned long addr = (unsigned long)p->addr;
         unsigned long arm_addr = addr & ~0xFULL;
 
+        flush_insn_slot(p);
         memcpy((char *)arm_addr, &p->ainsn.insn.bundle, sizeof(bundle_t));
         flush_icache_range(arm_addr, arm_addr + sizeof(bundle_t));
 }
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
index 3f5bac59209a..ab5b52413e91 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
@@ -958,9 +958,9 @@ remove_palinfo_proc_entries(unsigned int hcpu)
         }
 }
 
-static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
-                                                                unsigned long action,
-                                                                void *hcpu)
+#ifdef CONFIG_HOTPLUG_CPU
+static int palinfo_cpu_callback(struct notifier_block *nfb,
+                                        unsigned long action, void *hcpu)
 {
         unsigned int hotcpu = (unsigned long)hcpu;
 
@@ -968,20 +968,19 @@ static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
         case CPU_ONLINE:
                 create_palinfo_proc_entries(hotcpu);
                 break;
-#ifdef CONFIG_HOTPLUG_CPU
         case CPU_DEAD:
                 remove_palinfo_proc_entries(hotcpu);
                 break;
-#endif
         }
         return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata palinfo_cpu_notifier =
+static struct notifier_block palinfo_cpu_notifier =
 {
         .notifier_call = palinfo_cpu_callback,
         .priority = 0,
 };
+#endif
 
 static int __init
 palinfo_init(void)
@@ -1020,7 +1019,7 @@ palinfo_exit(void)
         /*
          * Unregister from cpu notifier callbacks
          */
-        unregister_cpu_notifier(&palinfo_cpu_notifier);
+        unregister_hotcpu_notifier(&palinfo_cpu_notifier);
 }
 
 module_init(palinfo_init);
diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
index b146f1cfad31..d24fa393b182 100644
--- a/arch/ia64/kernel/topology.c
+++ b/arch/ia64/kernel/topology.c
@@ -435,7 +435,7 @@ static int __cpuinit cache_sysfs_init(void)
                                 (void *)(long)i);
         }
 
-        register_cpu_notifier(&cache_cpu_notifier);
+        register_hotcpu_notifier(&cache_cpu_notifier);
 
         return 0;
 }
diff --git a/arch/ia64/kernel/traps.c b/arch/ia64/kernel/traps.c
index e7bbb0f40aa2..5a0420464c6c 100644
--- a/arch/ia64/kernel/traps.c
+++ b/arch/ia64/kernel/traps.c
@@ -117,11 +117,8 @@ die (const char *str, struct pt_regs *regs, long err)
         die.lock_owner = -1;
         spin_unlock_irq(&die.lock);
 
-        if (panic_on_oops) {
-                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
-                ssleep(5);
-                panic("Fatal exception");
-        }
+        if (panic_on_oops)
+                panic("Fatal exception: panic_on_oops");
 
         do_exit(SIGSEGV);
 }
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 9989495a51dd..b3677fc8eef5 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -204,6 +204,7 @@ SECTIONS
         *(.dynstr)
         *(.dynamic)
         *(.hash)
+        *(.gnu.hash)
 #endif
         }
 
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 010435095550..fec228cd0163 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -278,7 +278,7 @@ static void unregister_cpu_online(unsigned int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit sysfs_cpu_notify(struct notifier_block *self,
+static int __cpuinit sysfs_cpu_notify(struct notifier_block *self,
                                       unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned int)(long)hcpu;
@@ -296,7 +296,7 @@ static int __devinit sysfs_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata sysfs_cpu_nb = {
+static struct notifier_block __cpuinitdata sysfs_cpu_nb = {
         .notifier_call  = sysfs_cpu_notify,
 };
 
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 3c668078e524..2105767fcc57 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -150,13 +150,9 @@ int die(const char *str, struct pt_regs *regs, long err)
         if (in_interrupt())
                 panic("Fatal exception in interrupt");
 
-        if (panic_on_oops) {
-#ifdef CONFIG_PPC64
-                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
-                ssleep(5);
-#endif
-                panic("Fatal exception");
-        }
+        if (panic_on_oops)
+                panic("Fatal exception: panic_on_oops");
+
         do_exit(err);
 
         return 0;
diff --git a/arch/powerpc/kernel/vdso32/Makefile b/arch/powerpc/kernel/vdso32/Makefile
index 8a3bed5f143a..3726358faae8 100644
--- a/arch/powerpc/kernel/vdso32/Makefile
+++ b/arch/powerpc/kernel/vdso32/Makefile
@@ -14,7 +14,8 @@ obj-vdso32 := $(addprefix $(obj)/, $(obj-vdso32))
 
 
 EXTRA_CFLAGS := -shared -s -fno-common -fno-builtin
-EXTRA_CFLAGS += -nostdlib -Wl,-soname=linux-vdso32.so.1
+EXTRA_CFLAGS += -nostdlib -Wl,-soname=linux-vdso32.so.1 \
+                $(call ld-option, -Wl$(comma)--hash-style=sysv)
 EXTRA_AFLAGS := -D__VDSO32__ -s
 
 obj-y += vdso32_wrapper.o
diff --git a/arch/powerpc/kernel/vdso32/vdso32.lds.S b/arch/powerpc/kernel/vdso32/vdso32.lds.S
index f4bad720cb0a..6187af2d54c3 100644
--- a/arch/powerpc/kernel/vdso32/vdso32.lds.S
+++ b/arch/powerpc/kernel/vdso32/vdso32.lds.S
@@ -14,6 +14,7 @@ SECTIONS
 {
   . = VDSO32_LBASE + SIZEOF_HEADERS;
   .hash           : { *(.hash) }                        :text
+  .gnu.hash       : { *(.gnu.hash) }
   .dynsym         : { *(.dynsym) }
   .dynstr         : { *(.dynstr) }
   .gnu.version    : { *(.gnu.version) }
diff --git a/arch/powerpc/kernel/vdso64/Makefile b/arch/powerpc/kernel/vdso64/Makefile
index ab39988452cc..43af9b2a6f3b 100644
--- a/arch/powerpc/kernel/vdso64/Makefile
+++ b/arch/powerpc/kernel/vdso64/Makefile
@@ -8,7 +8,8 @@ targets := $(obj-vdso64) vdso64.so
 obj-vdso64 := $(addprefix $(obj)/, $(obj-vdso64))
 
 EXTRA_CFLAGS := -shared -s -fno-common -fno-builtin
-EXTRA_CFLAGS +=  -nostdlib -Wl,-soname=linux-vdso64.so.1
+EXTRA_CFLAGS += -nostdlib -Wl,-soname=linux-vdso64.so.1 \
+                $(call ld-option, -Wl$(comma)--hash-style=sysv)
 EXTRA_AFLAGS := -D__VDSO64__ -s
 
 obj-y += vdso64_wrapper.o
diff --git a/arch/powerpc/kernel/vdso64/vdso64.lds.S b/arch/powerpc/kernel/vdso64/vdso64.lds.S
index 4bdf224464ab..4a2b6dc0960c 100644
--- a/arch/powerpc/kernel/vdso64/vdso64.lds.S
+++ b/arch/powerpc/kernel/vdso64/vdso64.lds.S
@@ -12,6 +12,7 @@ SECTIONS
 {
   . = VDSO64_LBASE + SIZEOF_HEADERS;
   .hash           : { *(.hash) }                :text
+  .gnu.hash       : { *(.gnu.hash) }
   .dynsym         : { *(.dynsym) }
   .dynstr         : { *(.dynstr) }
   .gnu.version    : { *(.gnu.version) }
diff --git a/arch/powerpc/platforms/powermac/backlight.c b/arch/powerpc/platforms/powermac/backlight.c
index 74eed6b74cd6..d66415491055 100644
--- a/arch/powerpc/platforms/powermac/backlight.c
+++ b/arch/powerpc/platforms/powermac/backlight.c
@@ -10,19 +10,32 @@
 #include <linux/kernel.h>
 #include <linux/fb.h>
 #include <linux/backlight.h>
+#include <linux/adb.h>
+#include <linux/pmu.h>
+#include <asm/atomic.h>
 #include <asm/prom.h>
 #include <asm/backlight.h>
 
 #define OLD_BACKLIGHT_MAX 15
 
 static void pmac_backlight_key_worker(void *data);
+static void pmac_backlight_set_legacy_worker(void *data);
+
 static DECLARE_WORK(pmac_backlight_key_work, pmac_backlight_key_worker, NULL);
+static DECLARE_WORK(pmac_backlight_set_legacy_work, pmac_backlight_set_legacy_worker, NULL);
 
-/* Although this variable is used in interrupt context, it makes no sense to
- * protect it. No user is able to produce enough key events per second and
+/* Although these variables are used in interrupt context, it makes no sense to
+ * protect them. No user is able to produce enough key events per second and
  * notice the errors that might happen.
  */
 static int pmac_backlight_key_queued;
+static int pmac_backlight_set_legacy_queued;
+
+/* The via-pmu code allows the backlight to be grabbed, in which case the
+ * in-kernel control of the brightness needs to be disabled. This should
+ * only be used by really old PowerBooks.
+ */
+static atomic_t kernel_backlight_disabled = ATOMIC_INIT(0);
 
 /* Protect the pmac_backlight variable */
 DEFINE_MUTEX(pmac_backlight_mutex);
@@ -82,6 +95,9 @@ int pmac_backlight_curve_lookup(struct fb_info *info, int value)
 
 static void pmac_backlight_key_worker(void *data)
 {
+        if (atomic_read(&kernel_backlight_disabled))
+                return;
+
         mutex_lock(&pmac_backlight_mutex);
         if (pmac_backlight) {
                 struct backlight_properties *props;
@@ -107,8 +123,12 @@ static void pmac_backlight_key_worker(void *data)
         mutex_unlock(&pmac_backlight_mutex);
 }
 
+/* This function is called in interrupt context */
 void pmac_backlight_key(int direction)
 {
+        if (atomic_read(&kernel_backlight_disabled))
+                return;
+
         /* we can receive multiple interrupts here, but the scheduled work
          * will run only once, with the last value
          */
@@ -116,7 +136,7 @@ void pmac_backlight_key(int direction)
         schedule_work(&pmac_backlight_key_work);
 }
 
-int pmac_backlight_set_legacy_brightness(int brightness)
+static int __pmac_backlight_set_legacy_brightness(int brightness)
 {
         int error = -ENXIO;
 
@@ -145,6 +165,28 @@ int pmac_backlight_set_legacy_brightness(int brightness)
         return error;
 }
 
+static void pmac_backlight_set_legacy_worker(void *data)
+{
+        if (atomic_read(&kernel_backlight_disabled))
+                return;
+
+        __pmac_backlight_set_legacy_brightness(pmac_backlight_set_legacy_queued);
+}
+
+/* This function is called in interrupt context */
+void pmac_backlight_set_legacy_brightness_pmu(int brightness) {
+        if (atomic_read(&kernel_backlight_disabled))
+                return;
+
+        pmac_backlight_set_legacy_queued = brightness;
+        schedule_work(&pmac_backlight_set_legacy_work);
+}
+
+int pmac_backlight_set_legacy_brightness(int brightness)
+{
+        return __pmac_backlight_set_legacy_brightness(brightness);
+}
+
 int pmac_backlight_get_legacy_brightness()
 {
         int result = -ENXIO;
@@ -167,6 +209,16 @@ int pmac_backlight_get_legacy_brightness()
         return result;
 }
 
+void pmac_backlight_disable()
+{
+        atomic_inc(&kernel_backlight_disabled);
+}
+
+void pmac_backlight_enable()
+{
+        atomic_dec(&kernel_backlight_disabled);
+}
+
 EXPORT_SYMBOL_GPL(pmac_backlight);
 EXPORT_SYMBOL_GPL(pmac_backlight_mutex);
 EXPORT_SYMBOL_GPL(pmac_has_backlight_type);
diff --git a/arch/ppc/kernel/vmlinux.lds.S b/arch/ppc/kernel/vmlinux.lds.S
index 09c6525cfa61..095fd3323323 100644
--- a/arch/ppc/kernel/vmlinux.lds.S
+++ b/arch/ppc/kernel/vmlinux.lds.S
@@ -8,6 +8,7 @@ SECTIONS
   . = + SIZEOF_HEADERS;
   .interp : { *(.interp) }
   .hash          : { *(.hash)           }
+  .gnu.hash      : { *(.gnu.hash)       }
   .dynsym        : { *(.dynsym)         }
   .dynstr        : { *(.dynstr)         }
   .rel.text      : { *(.rel.text)               }
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index d0f82c995af6..6a4b5f9715c9 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -617,7 +617,8 @@ appldata_offline_cpu(int cpu)
         spin_unlock(&appldata_timer_lock);
 }
 
-static int __cpuinit
+#ifdef CONFIG_HOTPLUG_CPU
+static int
 appldata_cpu_notify(struct notifier_block *self,
                     unsigned long action, void *hcpu)
 {
@@ -625,20 +626,19 @@ appldata_cpu_notify(struct notifier_block *self,
         case CPU_ONLINE:
                 appldata_online_cpu((long) hcpu);
                 break;
-#ifdef CONFIG_HOTPLUG_CPU
         case CPU_DEAD:
                 appldata_offline_cpu((long) hcpu);
                 break;
-#endif
         default:
                 break;
         }
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata appldata_nb = {
+static struct notifier_block appldata_nb = {
         .notifier_call = appldata_cpu_notify,
 };
+#endif
 
 /*
  * appldata_init()
@@ -662,7 +662,7 @@ static int __init appldata_init(void)
                 appldata_online_cpu(i);
 
         /* Register cpu hotplug notifier */
-        register_cpu_notifier(&appldata_nb);
+        register_hotcpu_notifier(&appldata_nb);
 
         appldata_sysctl_header = register_sysctl_table(appldata_dir_table, 1);
 #ifdef MODULE
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index f4dfc10026d2..f1d4591eddbb 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,13 +1,16 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.17-rc1
-# Mon Apr  3 14:34:15 2006
+# Linux kernel version: 2.6.18-rc2
+# Thu Jul 27 13:51:07 2006
 #
 CONFIG_MMU=y
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_S390=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
 # Code maturity level options
@@ -25,6 +28,7 @@ CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_TASKSTATS is not set
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 # CONFIG_AUDITSYSCALL is not set
@@ -43,10 +47,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
+CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -94,7 +100,6 @@ CONFIG_HOTPLUG_CPU=y
 CONFIG_DEFAULT_MIGRATION_COST=1000000
 CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
-CONFIG_BINFMT_ELF32=y
 
 #
 # Code generation options
@@ -115,6 +120,7 @@ CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_RESOURCES_64BIT=y
 
 #
 # I/O subsystem configuration
@@ -142,6 +148,7 @@ CONFIG_VIRT_CPU_ACCOUNTING=y
 # CONFIG_APPLDATA_BASE is not set
 CONFIG_NO_IDLE_HZ=y
 CONFIG_NO_IDLE_HZ_INIT=y
+CONFIG_S390_HYPFS_FS=y
 CONFIG_KEXEC=y
 
 #
@@ -174,6 +181,8 @@ CONFIG_IP_FIB_HASH=y
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -186,7 +195,10 @@ CONFIG_IPV6=y
 # CONFIG_INET6_IPCOMP is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
+CONFIG_INET6_XFRM_MODE_TRANSPORT=y
+CONFIG_INET6_XFRM_MODE_TUNNEL=y
 # CONFIG_IPV6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 
 #
@@ -263,6 +275,7 @@ CONFIG_NET_ESTIMATOR=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
+# CONFIG_NET_TCPPROBE is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -276,6 +289,7 @@ CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
+CONFIG_SYS_HYPERVISOR=y
 
 #
 # Connector - unified userspace <-> kernelspace linker
@@ -334,6 +348,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 
@@ -359,9 +374,7 @@ CONFIG_MD_LINEAR=m
 CONFIG_MD_RAID0=m
 CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
-CONFIG_MD_RAID5=m
-# CONFIG_MD_RAID5_RESHAPE is not set
-# CONFIG_MD_RAID6 is not set
+# CONFIG_MD_RAID456 is not set
 CONFIG_MD_MULTIPATH=m
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=y
@@ -419,7 +432,8 @@ CONFIG_S390_TAPE_34XX=m
 #
 # Cryptographic devices
 #
-CONFIG_Z90CRYPT=m
+CONFIG_ZCRYPT=m
+# CONFIG_ZCRYPT_MONOLITHIC is not set
 
 #
 # Network device support
@@ -509,6 +523,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
@@ -614,26 +629,36 @@ CONFIG_MSDOS_PARTITION=y
 # Instrumentation Support
 #
 # CONFIG_PROFILING is not set
-# CONFIG_STATISTICS is not set
+CONFIG_STATISTICS=y
+CONFIG_KPROBES=y
 
 #
 # Kernel hacking
 #
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_MAGIC_SYSRQ=y
+# CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_DETECT_SOFTLOCKUP is not set
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 CONFIG_DEBUG_PREEMPT=y
-CONFIG_DEBUG_MUTEXES=y
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
 CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+# CONFIG_DEBUG_RWSEMS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
 CONFIG_DEBUG_SPINLOCK_SLEEP=y
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FRAME_POINTER is not set
 # CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
@@ -688,3 +713,4 @@ CONFIG_CRYPTO=y
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=m
 # CONFIG_LIBCRC32C is not set
+CONFIG_PLIST=y
diff --git a/arch/sparc/kernel/time.c b/arch/sparc/kernel/time.c
index 04eb1eab6e3e..845081b01267 100644
--- a/arch/sparc/kernel/time.c
+++ b/arch/sparc/kernel/time.c
@@ -225,6 +225,32 @@ static __inline__ int has_low_battery(void)
         return (data1 == data2);        /* Was the write blocked? */
 }
 
+static void __init mostek_set_system_time(void)
+{
+        unsigned int year, mon, day, hour, min, sec;
+        struct mostek48t02 *mregs;
+
+        mregs = (struct mostek48t02 *)mstk48t02_regs;
+        if(!mregs) {
+                prom_printf("Something wrong, clock regs not mapped yet.\n");
+                prom_halt();
+        }               
+        spin_lock_irq(&mostek_lock);
+        mregs->creg |= MSTK_CREG_READ;
+        sec = MSTK_REG_SEC(mregs);
+        min = MSTK_REG_MIN(mregs);
+        hour = MSTK_REG_HOUR(mregs);
+        day = MSTK_REG_DOM(mregs);
+        mon = MSTK_REG_MONTH(mregs);
+        year = MSTK_CVT_YEAR( MSTK_REG_YEAR(mregs) );
+        xtime.tv_sec = mktime(year, mon, day, hour, min, sec);
+        xtime.tv_nsec = (INITIAL_JIFFIES % HZ) * (NSEC_PER_SEC / HZ);
+        set_normalized_timespec(&wall_to_monotonic,
+                                -xtime.tv_sec, -xtime.tv_nsec);
+        mregs->creg &= ~MSTK_CREG_READ;
+        spin_unlock_irq(&mostek_lock);
+}
+
 /* Probe for the real time clock chip on Sun4 */
 static __inline__ void sun4_clock_probe(void)
 {
@@ -273,6 +299,7 @@ static __inline__ void sun4_clock_probe(void)
 #endif
 }
 
+#ifndef CONFIG_SUN4
 static int __devinit clock_probe(struct of_device *op, const struct of_device_id *match)
 {
         struct device_node *dp = op->node;
@@ -307,6 +334,8 @@ static int __devinit clock_probe(struct of_device *op, const struct of_device_id
         if (mostek_read(mstk48t02_regs + MOSTEK_SEC) & MSTK_STOP)
                 kick_start_clock();
 
+        mostek_set_system_time();
+
         return 0;
 }
 
@@ -325,56 +354,37 @@ static struct of_platform_driver clock_driver = {
 
 
 /* Probe for the mostek real time clock chip. */
-static void clock_init(void)
+static int __init clock_init(void)
 {
-        of_register_driver(&clock_driver, &of_bus_type);
+        return of_register_driver(&clock_driver, &of_bus_type);
 }
 
+/* Must be after subsys_initcall() so that busses are probed.  Must
+ * be before device_initcall() because things like the RTC driver
+ * need to see the clock registers.
+ */
+fs_initcall(clock_init);
+#endif /* !CONFIG_SUN4 */
+
 void __init sbus_time_init(void)
 {
-        unsigned int year, mon, day, hour, min, sec;
-        struct mostek48t02 *mregs;
-
-#ifdef CONFIG_SUN4
-        int temp;
-        struct intersil *iregs;
-#endif
 
         BTFIXUPSET_CALL(bus_do_settimeofday, sbus_do_settimeofday, BTFIXUPCALL_NORM);
         btfixup();
 
         if (ARCH_SUN4)
                 sun4_clock_probe();
-        else
-                clock_init();
 
         sparc_init_timers(timer_interrupt);
         
 #ifdef CONFIG_SUN4
         if(idprom->id_machtype == (SM_SUN4 | SM_4_330)) {
-#endif
-        mregs = (struct mostek48t02 *)mstk48t02_regs;
-        if(!mregs) {
-                prom_printf("Something wrong, clock regs not mapped yet.\n");
-                prom_halt();
-        }               
-        spin_lock_irq(&mostek_lock);
-        mregs->creg |= MSTK_CREG_READ;
-        sec = MSTK_REG_SEC(mregs);
-        min = MSTK_REG_MIN(mregs);
-        hour = MSTK_REG_HOUR(mregs);
-        day = MSTK_REG_DOM(mregs);
-        mon = MSTK_REG_MONTH(mregs);
-        year = MSTK_CVT_YEAR( MSTK_REG_YEAR(mregs) );
-        xtime.tv_sec = mktime(year, mon, day, hour, min, sec);
-        xtime.tv_nsec = (INITIAL_JIFFIES % HZ) * (NSEC_PER_SEC / HZ);
-        set_normalized_timespec(&wall_to_monotonic,
-                                -xtime.tv_sec, -xtime.tv_nsec);
-        mregs->creg &= ~MSTK_CREG_READ;
-        spin_unlock_irq(&mostek_lock);
-#ifdef CONFIG_SUN4
+                mostek_set_system_time();
         } else if(idprom->id_machtype == (SM_SUN4 | SM_4_260) ) {
                 /* initialise the intersil on sun4 */
+                unsigned int year, mon, day, hour, min, sec;
+                int temp;
+                struct intersil *iregs;
 
                 iregs=intersil_clock;
                 if(!iregs) {
diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
index 1605967cce91..55ae802dc0ad 100644
--- a/arch/sparc64/mm/fault.c
+++ b/arch/sparc64/mm/fault.c
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/kprobes.h>
+#include <linux/kallsyms.h>
 
 #include <asm/page.h>
 #include <asm/pgtable.h>
@@ -132,6 +133,8 @@ static void bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
 
         printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
                regs->tpc);
+        printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
+        print_symbol("RPC: <%s>\n", regs->u_regs[15]);
         printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
         __asm__("mov %%sp, %0" : "=r" (ksp));
         show_stack(current, ksp);
diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S
index 2517ecb8bf27..68ed24df5c8f 100644
--- a/arch/um/kernel/dyn.lds.S
+++ b/arch/um/kernel/dyn.lds.S
@@ -26,6 +26,7 @@ SECTIONS
 
   /* Read-only sections, merged into text segment: */
   .hash           : { *(.hash) }
+  .gnu.hash       : { *(.gnu.hash) }
   .dynsym         : { *(.dynsym) }
   .dynstr         : { *(.dynstr) }
   .gnu.version    : { *(.gnu.version) }
diff --git a/arch/v850/kernel/setup.c b/arch/v850/kernel/setup.c
index 62bdb8d29fc0..1bf672a25692 100644
--- a/arch/v850/kernel/setup.c
+++ b/arch/v850/kernel/setup.c
@@ -1,8 +1,8 @@
 /*
  * arch/v850/kernel/setup.c -- Arch-dependent initialization functions
  *
- *  Copyright (C) 2001,02,03,05  NEC Electronics Corporation
- *  Copyright (C) 2001,02,03,05  Miles Bader <miles@gnu.org>
+ *  Copyright (C) 2001,02,03,05,06  NEC Electronics Corporation
+ *  Copyright (C) 2001,02,03,05,06  Miles Bader <miles@gnu.org>
  *
  * This file is subject to the terms and conditions of the GNU General
  * Public License.  See the file COPYING in the main directory of this
@@ -190,7 +190,7 @@ void free_initmem (void)
                 for (addr = start; addr < end; addr += PAGE_SIZE) {
                         struct page *page = virt_to_page (addr);
                         ClearPageReserved (page);
-                        set_page_count (page, 1);
+                        init_page_count (page);
                         __free_page (page);
                         total_ram_pages++;
                 }
diff --git a/arch/v850/kernel/v850_ksyms.c b/arch/v850/kernel/v850_ksyms.c
index c03ad6ed61cc..67bc48e57c60 100644
--- a/arch/v850/kernel/v850_ksyms.c
+++ b/arch/v850/kernel/v850_ksyms.c
@@ -21,9 +21,6 @@ EXPORT_SYMBOL (trap_table);
 
 /* platform dependent support */
 EXPORT_SYMBOL (kernel_thread);
-EXPORT_SYMBOL (enable_irq);
-EXPORT_SYMBOL (disable_irq);
-EXPORT_SYMBOL (disable_irq_nosync);
 EXPORT_SYMBOL (__bug);
 
 /* Networking helper routines. */
@@ -33,22 +30,9 @@ EXPORT_SYMBOL (ip_compute_csum);
 EXPORT_SYMBOL (ip_fast_csum);
 
 /* string / mem functions */
-EXPORT_SYMBOL (strcpy);
-EXPORT_SYMBOL (strncpy);
-EXPORT_SYMBOL (strcat);
-EXPORT_SYMBOL (strncat);
-EXPORT_SYMBOL (strcmp);
-EXPORT_SYMBOL (strncmp);
-EXPORT_SYMBOL (strchr);
-EXPORT_SYMBOL (strlen);
-EXPORT_SYMBOL (strnlen);
-EXPORT_SYMBOL (strrchr);
-EXPORT_SYMBOL (strstr);
 EXPORT_SYMBOL (memset);
 EXPORT_SYMBOL (memcpy);
 EXPORT_SYMBOL (memmove);
-EXPORT_SYMBOL (memcmp);
-EXPORT_SYMBOL (memscan);
 
 /* semaphores */
 EXPORT_SYMBOL (__down);
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 83d389b8ebd8..840d5d93d5cc 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.17-git22
-# Tue Jul  4 14:24:40 2006
+# Linux kernel version: 2.6.18-rc2
+# Tue Jul 18 17:13:20 2006
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -37,6 +37,7 @@ CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
+# CONFIG_TASKSTATS is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
@@ -413,6 +414,7 @@ CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -1195,7 +1197,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
-# CONFIG_USB_CY7C63 is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
@@ -1373,7 +1375,6 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
diff --git a/arch/x86_64/ia32/Makefile b/arch/x86_64/ia32/Makefile
index 62bc5f56da9e..cdae36435e21 100644
--- a/arch/x86_64/ia32/Makefile
+++ b/arch/x86_64/ia32/Makefile
@@ -23,6 +23,7 @@ targets := $(foreach F,sysenter syscall,vsyscall-$F.o vsyscall-$F.so)
 # The DSO images are built using a special linker script
 quiet_cmd_syscall = SYSCALL $@
       cmd_syscall = $(CC) -m32 -nostdlib -shared -s \
+                          $(call ld-option, -Wl$(comma)--hash-style=sysv) \
                            -Wl,-soname=linux-gate.so.1 -o $@ \
                            -Wl,-T,$(filter-out FORCE,$^)
 
diff --git a/arch/x86_64/ia32/ia32entry.S b/arch/x86_64/ia32/ia32entry.S
index 9b5bb413a6e9..5d4a7d125ed0 100644
--- a/arch/x86_64/ia32/ia32entry.S
+++ b/arch/x86_64/ia32/ia32entry.S
@@ -103,7 +103,7 @@ ENTRY(ia32_sysenter_target)
         pushq   %rax
         CFI_ADJUST_CFA_OFFSET 8
         cld
-        SAVE_ARGS 0,0,1
+        SAVE_ARGS 0,0,0
         /* no need to do an access_ok check here because rbp has been
            32bit zero extended */ 
 1:      movl    (%rbp),%r9d
diff --git a/arch/x86_64/ia32/vsyscall.lds b/arch/x86_64/ia32/vsyscall.lds
index f2e75ed4c6c7..1dc86ff5bcb9 100644
--- a/arch/x86_64/ia32/vsyscall.lds
+++ b/arch/x86_64/ia32/vsyscall.lds
@@ -11,6 +11,7 @@ SECTIONS
   . = VSYSCALL_BASE + SIZEOF_HEADERS;
 
   .hash           : { *(.hash) }                :text
+  .gnu.hash       : { *(.gnu.hash) }
   .dynsym         : { *(.dynsym) }
   .dynstr         : { *(.dynstr) }
   .gnu.version    : { *(.gnu.version) }
diff --git a/arch/x86_64/kernel/machine_kexec.c b/arch/x86_64/kernel/machine_kexec.c
index 83fb24a02821..106076b370fc 100644
--- a/arch/x86_64/kernel/machine_kexec.c
+++ b/arch/x86_64/kernel/machine_kexec.c
@@ -207,14 +207,11 @@ NORET_TYPE void machine_kexec(struct kimage *image)
         __flush_tlb();
 
 
-        /* The segment registers are funny things, they are
-         * automatically loaded from a table, in memory wherever you
-         * set them to a specific selector, but this table is never
-         * accessed again unless you set the segment to a different selector.
-         *
-         * The more common model are caches where the behide
-         * the scenes work is done, but is also dropped at arbitrary
-         * times.
+        /* The segment registers are funny things, they have both a
+         * visible and an invisible part.  Whenever the visible part is
+         * set to a specific selector, the invisible part is loaded
+         * with from a table in memory.  At no other time is the
+         * descriptor table in memory accessed.
          *
          * I take advantage of this here by force loading the
          * segments, before I zap the gdt with an invalid value.
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 88845674c661..4e017fb30fb3 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -615,7 +615,7 @@ static __cpuinit int mce_create_device(unsigned int cpu)
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-static __cpuinit void mce_remove_device(unsigned int cpu)
+static void mce_remove_device(unsigned int cpu)
 {
         int i;
 
@@ -626,10 +626,9 @@ static __cpuinit void mce_remove_device(unsigned int cpu)
         sysdev_remove_file(&per_cpu(device_mce,cpu), &attr_check_interval);
         sysdev_unregister(&per_cpu(device_mce,cpu));
 }
-#endif
 
 /* Get notified when a cpu comes on/off. Be hotplug friendly. */
-static __cpuinit int
+static int
 mce_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
@@ -638,18 +637,17 @@ mce_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
         case CPU_ONLINE:
                 mce_create_device(cpu);
                 break;
-#ifdef CONFIG_HOTPLUG_CPU
         case CPU_DEAD:
                 mce_remove_device(cpu);
                 break;
-#endif
         }
         return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata mce_cpu_notifier = {
+static struct notifier_block mce_cpu_notifier = {
         .notifier_call = mce_cpu_callback,
 };
+#endif
 
 static __init int mce_init_device(void)
 {
@@ -664,7 +662,7 @@ static __init int mce_init_device(void)
                 mce_create_device(i);
         }
 
-        register_cpu_notifier(&mce_cpu_notifier);
+        register_hotcpu_notifier(&mce_cpu_notifier);
         misc_register(&mce_log_device);
         return err;
 }
diff --git a/arch/x86_64/kernel/mce_amd.c b/arch/x86_64/kernel/mce_amd.c
index db2acbf7ad28..883fe747f64c 100644
--- a/arch/x86_64/kernel/mce_amd.c
+++ b/arch/x86_64/kernel/mce_amd.c
@@ -558,7 +558,7 @@ out:
  *   of shared sysfs dir/files, and rest of the cores will be symlinked to it.
  */
 
-static __cpuinit void deallocate_threshold_block(unsigned int cpu,
+static void deallocate_threshold_block(unsigned int cpu,
                                                  unsigned int bank)
 {
         struct threshold_block *pos = NULL;
@@ -578,7 +578,7 @@ static __cpuinit void deallocate_threshold_block(unsigned int cpu,
         per_cpu(threshold_banks, cpu)[bank]->blocks = NULL;
 }
 
-static __cpuinit void threshold_remove_bank(unsigned int cpu, int bank)
+static void threshold_remove_bank(unsigned int cpu, int bank)
 {
         int i = 0;
         struct threshold_bank *b;
@@ -618,7 +618,7 @@ free_out:
         per_cpu(threshold_banks, cpu)[bank] = NULL;
 }
 
-static __cpuinit void threshold_remove_device(unsigned int cpu)
+static void threshold_remove_device(unsigned int cpu)
 {
         unsigned int bank;
 
@@ -629,14 +629,8 @@ static __cpuinit void threshold_remove_device(unsigned int cpu)
         }
 }
 
-#else /* !CONFIG_HOTPLUG_CPU */
-static void threshold_remove_device(unsigned int cpu)
-{
-}
-#endif
-
 /* get notified when a cpu comes on/off */
-static int __cpuinit threshold_cpu_callback(struct notifier_block *nfb,
+static int threshold_cpu_callback(struct notifier_block *nfb,
                                             unsigned long action, void *hcpu)
 {
         /* cpu was unsigned int to begin with */
@@ -659,9 +653,10 @@ static int __cpuinit threshold_cpu_callback(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static struct notifier_block threshold_cpu_notifier __cpuinitdata = {
+static struct notifier_block threshold_cpu_notifier = {
         .notifier_call = threshold_cpu_callback,
 };
+#endif /* CONFIG_HOTPLUG_CPU */
 
 static __init int threshold_init_device(void)
 {
@@ -673,7 +668,7 @@ static __init int threshold_init_device(void)
                 if (err)
                         return err;
         }
-        register_cpu_notifier(&threshold_cpu_notifier);
+        register_hotcpu_notifier(&threshold_cpu_notifier);
         return 0;
 }
 
diff --git a/arch/x86_64/kernel/pci-calgary.c b/arch/x86_64/kernel/pci-calgary.c
index e71ed53b08fb..146924ba5df5 100644
--- a/arch/x86_64/kernel/pci-calgary.c
+++ b/arch/x86_64/kernel/pci-calgary.c
@@ -85,7 +85,8 @@
 #define CSR_AGENT_MASK          0xffe0ffff
 
 #define MAX_NUM_OF_PHBS         8 /* how many PHBs in total? */
-#define MAX_PHB_BUS_NUM         (MAX_NUM_OF_PHBS * 2) /* max dev->bus->number */
+#define MAX_NUM_CHASSIS         8 /* max number of chassis */
+#define MAX_PHB_BUS_NUM         (MAX_NUM_OF_PHBS * MAX_NUM_CHASSIS * 2) /* max dev->bus->number */
 #define PHBS_PER_CALGARY        4
 
 /* register offsets in Calgary's internal register space */
@@ -110,7 +111,8 @@ static const unsigned long phb_offsets[] = {
         0xB000 /* PHB3 */
 };
 
-void* tce_table_kva[MAX_NUM_OF_PHBS * MAX_NUMNODES];
+static char bus_to_phb[MAX_PHB_BUS_NUM];
+void* tce_table_kva[MAX_PHB_BUS_NUM];
 unsigned int specified_table_size = TCE_TABLE_SIZE_UNSPECIFIED;
 static int translate_empty_slots __read_mostly = 0;
 static int calgary_detected __read_mostly = 0;
@@ -119,7 +121,7 @@ static int calgary_detected __read_mostly = 0;
  * the bitmap of PHBs the user requested that we disable
  * translation on.
  */
-static DECLARE_BITMAP(translation_disabled, MAX_NUMNODES * MAX_PHB_BUS_NUM);
+static DECLARE_BITMAP(translation_disabled, MAX_PHB_BUS_NUM);
 
 static void tce_cache_blast(struct iommu_table *tbl);
 
@@ -452,7 +454,7 @@ static struct dma_mapping_ops calgary_dma_ops = {
 
 static inline int busno_to_phbid(unsigned char num)
 {
-        return bus_to_phb(num) % PHBS_PER_CALGARY;
+        return bus_to_phb[num];
 }
 
 static inline unsigned long split_queue_offset(unsigned char num)
@@ -812,7 +814,7 @@ static int __init calgary_init(void)
         int i, ret = -ENODEV;
         struct pci_dev *dev = NULL;
 
-        for (i = 0; i <= num_online_nodes() * MAX_NUM_OF_PHBS; i++) {
+        for (i = 0; i < MAX_PHB_BUS_NUM; i++) {
                 dev = pci_get_device(PCI_VENDOR_ID_IBM,
                                      PCI_DEVICE_ID_IBM_CALGARY,
                                      dev);
@@ -822,7 +824,7 @@ static int __init calgary_init(void)
                         calgary_init_one_nontraslated(dev);
                         continue;
                 }
-                if (!tce_table_kva[i] && !translate_empty_slots) {
+                if (!tce_table_kva[dev->bus->number] && !translate_empty_slots) {
                         pci_dev_put(dev);
                         continue;
                 }
@@ -842,7 +844,7 @@ error:
                         pci_dev_put(dev);
                         continue;
                 }
-                if (!tce_table_kva[i] && !translate_empty_slots)
+                if (!tce_table_kva[dev->bus->number] && !translate_empty_slots)
                         continue;
                 calgary_disable_translation(dev);
                 calgary_free_tar(dev);
@@ -876,9 +878,10 @@ static inline int __init determine_tce_table_size(u64 ram)
 void __init detect_calgary(void)
 {
         u32 val;
-        int bus, table_idx;
+        int bus;
         void *tbl;
-        int detected = 0;
+        int calgary_found = 0;
+        int phb = -1;
 
         /*
          * if the user specified iommu=off or iommu=soft or we found
@@ -889,38 +892,46 @@ void __init detect_calgary(void)
 
         specified_table_size = determine_tce_table_size(end_pfn * PAGE_SIZE);
 
-        for (bus = 0, table_idx = 0;
-             bus <= num_online_nodes() * MAX_PHB_BUS_NUM;
-             bus++) {
-                BUG_ON(bus > MAX_NUMNODES * MAX_PHB_BUS_NUM);
+        for (bus = 0; bus < MAX_PHB_BUS_NUM; bus++) {
+                int dev;
+
+                tce_table_kva[bus] = NULL;
+                bus_to_phb[bus] = -1;
+
                 if (read_pci_config(bus, 0, 0, 0) != PCI_VENDOR_DEVICE_ID_CALGARY)
                         continue;
+
+                /*
+                 * There are 4 PHBs per Calgary chip.  Set phb to which phb (0-3)
+                 * it is connected to releative to the clagary chip.
+                 */
+                phb = (phb + 1) % PHBS_PER_CALGARY;
+
                 if (test_bit(bus, translation_disabled)) {
                         printk(KERN_INFO "Calgary: translation is disabled for "
                                "PHB 0x%x\n", bus);
                         /* skip this phb, don't allocate a tbl for it */
-                        tce_table_kva[table_idx] = NULL;
-                        table_idx++;
                         continue;
                 }
                 /*
-                 * scan the first slot of the PCI bus to see if there
-                 * are any devices present
+                 * Scan the slots of the PCI bus to see if there is a device present.
+                 * The parent bus will be the zero-ith device, so start at 1.
                  */
-                val = read_pci_config(bus, 1, 0, 0);
-                if (val != 0xffffffff || translate_empty_slots) {
-                        tbl = alloc_tce_table();
-                        if (!tbl)
-                                goto cleanup;
-                        detected = 1;
-                } else
-                        tbl = NULL;
-
-                tce_table_kva[table_idx] = tbl;
-                table_idx++;
+                for (dev = 1; dev < 8; dev++) {
+                        val = read_pci_config(bus, dev, 0, 0);
+                        if (val != 0xffffffff || translate_empty_slots) {
+                                tbl = alloc_tce_table();
+                                if (!tbl)
+                                        goto cleanup;
+                                tce_table_kva[bus] = tbl;
+                                bus_to_phb[bus] = phb;
+                                calgary_found = 1;
+                                break;
+                        }
+                }
         }
 
-        if (detected) {
+        if (calgary_found) {
                 iommu_detected = 1;
                 calgary_detected = 1;
                 printk(KERN_INFO "PCI-DMA: Calgary IOMMU detected. "
@@ -929,9 +940,9 @@ void __init detect_calgary(void)
         return;
 
 cleanup:
-        for (--table_idx; table_idx >= 0; --table_idx)
-                if (tce_table_kva[table_idx])
-                        free_tce_table(tce_table_kva[table_idx]);
+        for (--bus; bus >= 0; --bus)
+                if (tce_table_kva[bus])
+                        free_tce_table(tce_table_kva[bus]);
 }
 
 int __init calgary_iommu_init(void)
@@ -1002,7 +1013,7 @@ static int __init calgary_parse_options(char *p)
                         if (p == endp)
                                 break;
 
-                        if (bridge <= (num_online_nodes() * MAX_PHB_BUS_NUM)) {
+                        if (bridge < MAX_PHB_BUS_NUM) {
                                 printk(KERN_INFO "Calgary: disabling "
                                        "translation for PHB 0x%x\n", bridge);
                                 set_bit(bridge, translation_disabled);
diff --git a/arch/x86_64/kernel/pci-swiotlb.c b/arch/x86_64/kernel/pci-swiotlb.c
index ebdb77fe2057..6a55f87ba97f 100644
--- a/arch/x86_64/kernel/pci-swiotlb.c
+++ b/arch/x86_64/kernel/pci-swiotlb.c
@@ -31,9 +31,10 @@ struct dma_mapping_ops swiotlb_dma_ops = {
 void pci_swiotlb_init(void)
 {
         /* don't initialize swiotlb if iommu=off (no_iommu=1) */
-        if (!iommu_detected && !no_iommu &&
-            (end_pfn > MAX_DMA32_PFN || force_iommu))
+        if (!iommu_detected && !no_iommu && end_pfn > MAX_DMA32_PFN)
                swiotlb = 1;
+        if (swiotlb_force)
+                swiotlb = 1;
         if (swiotlb) {
                 printk(KERN_INFO "PCI-DMA: Using software bounce buffering for IO (SWIOTLB)\n");
                 swiotlb_init();
diff --git a/arch/x86_64/kernel/tce.c b/arch/x86_64/kernel/tce.c
index d3a9e79e954c..5530dda3f27a 100644
--- a/arch/x86_64/kernel/tce.c
+++ b/arch/x86_64/kernel/tce.c
@@ -96,7 +96,6 @@ static inline unsigned int table_size_to_number_of_entries(unsigned char size)
 static int tce_table_setparms(struct pci_dev *dev, struct iommu_table *tbl)
 {
         unsigned int bitmapsz;
-        unsigned int tce_table_index;
         unsigned long bmppages;
         int ret;
 
@@ -105,8 +104,7 @@ static int tce_table_setparms(struct pci_dev *dev, struct iommu_table *tbl)
         /* set the tce table size - measured in entries */
         tbl->it_size = table_size_to_number_of_entries(specified_table_size);
 
-        tce_table_index = bus_to_phb(tbl->it_busno);
-        tbl->it_base = (unsigned long)tce_table_kva[tce_table_index];
+        tbl->it_base = (unsigned long)tce_table_kva[dev->bus->number];
         if (!tbl->it_base) {
                 printk(KERN_ERR "Calgary: iommu_table_setparms: "
                        "no table allocated?!\n");
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index b9ff75992c16..7a9b18224182 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -28,6 +28,7 @@
 #include <linux/acpi.h>
 #ifdef CONFIG_ACPI
 #include <acpi/achware.h>       /* for PM timer frequency */
+#include <acpi/acpi_bus.h>
 #endif
 #include <asm/8253pit.h>
 #include <asm/pgtable.h>
@@ -193,7 +194,7 @@ unsigned long profile_pc(struct pt_regs *regs)
            is just accounted to the spinlock function.
            Better would be to write these functions in assembler again
            and check exactly. */
-        if (in_lock_functions(pc)) {
+        if (!user_mode(regs) && in_lock_functions(pc)) {
                 char *v = *(char **)regs->rsp;
                 if ((v >= _stext && v <= _etext) ||
                         (v >= _sinittext && v <= _einittext) ||
@@ -953,11 +954,18 @@ __cpuinit int unsynchronized_tsc(void)
 #ifdef CONFIG_SMP
         if (apic_is_clustered_box())
                 return 1;
-        /* Intel systems are normally all synchronized. Exceptions
-           are handled in the check above. */
-        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
-                return 0;
 #endif
+        /* Most intel systems have synchronized TSCs except for
+           multi node systems */
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
+#ifdef CONFIG_ACPI
+                /* But TSC doesn't tick in C3 so don't use it there */
+                if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 100)
+                        return 1;
+#endif
+                return 0;
+        }
+
         /* Assume multi socket systems are not synchronized */
         return num_present_cpus() > 1;
 }
diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
index eb39a2775236..4e9938dee060 100644
--- a/arch/x86_64/kernel/traps.c
+++ b/arch/x86_64/kernel/traps.c
@@ -254,7 +254,6 @@ void show_trace(struct task_struct *tsk, struct pt_regs *regs, unsigned long * s
 {
         const unsigned cpu = safe_smp_processor_id();
         unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
-        int i = 11;
         unsigned used = 0;
 
         printk("\nCall Trace:\n");
@@ -275,11 +274,20 @@ void show_trace(struct task_struct *tsk, struct pt_regs *regs, unsigned long * s
                         if (unwind_init_blocked(&info, tsk) == 0)
                                 unw_ret = show_trace_unwind(&info, NULL);
                 }
-                if (unw_ret > 0) {
-                        if (call_trace > 0)
+                if (unw_ret > 0 && !arch_unw_user_mode(&info)) {
+#ifdef CONFIG_STACK_UNWIND
+                        unsigned long rip = info.regs.rip;
+                        print_symbol("DWARF2 unwinder stuck at %s\n", rip);
+                        if (call_trace == 1) {
+                                printk("Leftover inexact backtrace:\n");
+                                stack = (unsigned long *)info.regs.rsp;
+                        } else if (call_trace > 1)
                                 return;
-                        printk("Legacy call trace:");
-                        i = 18;
+                        else
+                                printk("Full inexact backtrace again:\n");
+#else
+                        printk("Inexact backtrace:\n");
+#endif
                 }
         }
 
@@ -521,7 +529,7 @@ void __kprobes oops_end(unsigned long flags)
                 /* Nest count reaches zero, release the lock. */
                 spin_unlock_irqrestore(&die_lock, flags);
         if (panic_on_oops)
-                panic("Oops");
+                panic("Fatal exception: panic_on_oops");
 }
 
 void __kprobes __die(const char * str, struct pt_regs * regs, long err)
@@ -1118,8 +1126,10 @@ static int __init call_trace_setup(char *s)
                 call_trace = -1;
         else if (strcmp(s, "both") == 0)
                 call_trace = 0;
-        else if (strcmp(s, "new") == 0)
+        else if (strcmp(s, "newfallback") == 0)
                 call_trace = 1;
+        else if (strcmp(s, "new") == 0)
+                call_trace = 2;
         return 1;
 }
 __setup("call_trace=", call_trace_setup);
diff --git a/arch/x86_64/pci/k8-bus.c b/arch/x86_64/pci/k8-bus.c
index b50a7c7c47f8..3acf60ded2a0 100644
--- a/arch/x86_64/pci/k8-bus.c
+++ b/arch/x86_64/pci/k8-bus.c
@@ -2,7 +2,6 @@
 #include <linux/pci.h>
 #include <asm/mpspec.h>
 #include <linux/cpumask.h>
-#include <asm/k8.h>
 
 /*
  * This discovers the pcibus <-> node mapping on AMD K8.
@@ -19,6 +18,7 @@
 #define NR_LDT_BUS_NUMBER_REGISTERS 3
 #define SECONDARY_LDT_BUS_NUMBER(dword) ((dword >> 8) & 0xFF)
 #define SUBORDINATE_LDT_BUS_NUMBER(dword) ((dword >> 16) & 0xFF)
+#define PCI_DEVICE_ID_K8HTCONFIG 0x1100
 
 /**
  * fill_mp_bus_to_cpumask()
@@ -28,7 +28,8 @@
 __init static int
 fill_mp_bus_to_cpumask(void)
 {
-        int i, j, k;
+        struct pci_dev *nb_dev = NULL;
+        int i, j;
         u32 ldtbus, nid;
         static int lbnr[3] = {
                 LDT_BUS_NUMBER_REGISTER_0,
@@ -36,9 +37,8 @@ fill_mp_bus_to_cpumask(void)
                 LDT_BUS_NUMBER_REGISTER_2
         };
 
-        cache_k8_northbridges();
-        for (k = 0; k < num_k8_northbridges; k++) {
-                struct pci_dev *nb_dev = k8_northbridges[k];
+        while ((nb_dev = pci_get_device(PCI_VENDOR_ID_AMD,
+                        PCI_DEVICE_ID_K8HTCONFIG, nb_dev))) {
                 pci_read_config_dword(nb_dev, NODE_ID_REGISTER, &nid);
 
                 for (i = 0; i < NR_LDT_BUS_NUMBER_REGISTERS; i++) {
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index 27e409089a7b..9734960a2451 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -487,11 +487,9 @@ void die(const char * str, struct pt_regs * regs, long err)
         if (in_interrupt())
                 panic("Fatal exception in interrupt");
 
-        if (panic_on_oops) {
-                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
-                ssleep(5);
-                panic("Fatal exception");
-        }
+        if (panic_on_oops)
+                panic("Fatal exception: panic_on_oops");
+
         do_exit(err);
 }
 
diff --git a/block/blktrace.c b/block/blktrace.c
index b8c0702777ff..265f7a830619 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -80,7 +80,7 @@ static u32 bio_act[5] __read_mostly = { 0, BLK_TC_ACT(BLK_TC_BARRIER), BLK_TC_AC
 #define trace_sync_bit(rw)      \
         (((rw) & (1 << BIO_RW_SYNC)) >> (BIO_RW_SYNC - 1))
 #define trace_ahead_bit(rw)     \
-        (((rw) & (1 << BIO_RW_AHEAD)) << (BIO_RW_AHEAD - 0))
+        (((rw) & (1 << BIO_RW_AHEAD)) << (2 - BIO_RW_AHEAD))
 
 /*
  * The worker for the various blk_add_trace*() types. Fills out a
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 102ebc2c5c34..aae3123bf3ee 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -936,7 +936,7 @@ static int cfq_arm_slice_timer(struct cfq_data *cfqd, struct cfq_queue *cfqq)
          * seeks. so allow a little bit of time for him to submit a new rq
          */
         if (sample_valid(cic->seek_samples) && CIC_SEEKY(cic))
-                sl = 2;
+                sl = min(sl, msecs_to_jiffies(2));
 
         mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
         return 1;
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index c2d621632383..3ef9d514b916 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -139,7 +139,7 @@ static int __cpuinit topology_sysfs_init(void)
                                 (void *)(long)i);
         }
 
-        register_cpu_notifier(&topology_cpu_notifier);
+        register_hotcpu_notifier(&topology_cpu_notifier);
 
         return 0;
 }
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 1c4df22dfd2a..7b0eca703a67 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1233,6 +1233,50 @@ static inline void complete_buffers(struct bio *bio, int status)
         }
 }
 
+static void cciss_check_queues(ctlr_info_t *h)
+{
+        int start_queue = h->next_to_run;
+        int i;
+
+        /* check to see if we have maxed out the number of commands that can
+         * be placed on the queue.  If so then exit.  We do this check here
+         * in case the interrupt we serviced was from an ioctl and did not
+         * free any new commands.
+         */
+        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
+                return;
+
+        /* We have room on the queue for more commands.  Now we need to queue
+         * them up.  We will also keep track of the next queue to run so
+         * that every queue gets a chance to be started first.
+         */
+        for (i = 0; i < h->highest_lun + 1; i++) {
+                int curr_queue = (start_queue + i) % (h->highest_lun + 1);
+                /* make sure the disk has been added and the drive is real
+                 * because this can be called from the middle of init_one.
+                 */
+                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
+                        continue;
+                blk_start_queue(h->gendisk[curr_queue]->queue);
+
+                /* check to see if we have maxed out the number of commands
+                 * that can be placed on the queue.
+                 */
+                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
+                        if (curr_queue == start_queue) {
+                                h->next_to_run =
+                                    (start_queue + 1) % (h->highest_lun + 1);
+                                break;
+                        } else {
+                                h->next_to_run = curr_queue;
+                                break;
+                        }
+                } else {
+                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
+                }
+        }
+}
+
 static void cciss_softirq_done(struct request *rq)
 {
         CommandList_struct *cmd = rq->completion_data;
@@ -1264,6 +1308,7 @@ static void cciss_softirq_done(struct request *rq)
         spin_lock_irqsave(&h->lock, flags);
         end_that_request_last(rq, rq->errors);
         cmd_free(h, cmd, 1);
+        cciss_check_queues(h);
         spin_unlock_irqrestore(&h->lock, flags);
 }
 
@@ -2528,8 +2573,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
         CommandList_struct *c;
         unsigned long flags;
         __u32 a, a1, a2;
-        int j;
-        int start_queue = h->next_to_run;
 
         if (interrupt_not_for_us(h))
                 return IRQ_NONE;
@@ -2588,45 +2631,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                 }
         }
 
-        /* check to see if we have maxed out the number of commands that can
-         * be placed on the queue.  If so then exit.  We do this check here
-         * in case the interrupt we serviced was from an ioctl and did not
-         * free any new commands.
-         */
-        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
-                goto cleanup;
-
-        /* We have room on the queue for more commands.  Now we need to queue
-         * them up.  We will also keep track of the next queue to run so
-         * that every queue gets a chance to be started first.
-         */
-        for (j = 0; j < h->highest_lun + 1; j++) {
-                int curr_queue = (start_queue + j) % (h->highest_lun + 1);
-                /* make sure the disk has been added and the drive is real
-                 * because this can be called from the middle of init_one.
-                 */
-                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
-                        continue;
-                blk_start_queue(h->gendisk[curr_queue]->queue);
-
-                /* check to see if we have maxed out the number of commands
-                 * that can be placed on the queue.
-                 */
-                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
-                        if (curr_queue == start_queue) {
-                                h->next_to_run =
-                                    (start_queue + 1) % (h->highest_lun + 1);
-                                goto cleanup;
-                        } else {
-                                h->next_to_run = curr_queue;
-                                goto cleanup;
-                        }
-                } else {
-                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
-                }
-        }
-
-      cleanup:
         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
         return IRQ_HANDLED;
 }
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 0a1b1ea36ddc..bdbade9a5cf5 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -300,6 +300,15 @@ static struct request *nbd_read_stat(struct nbd_device *lo)
                                 lo->disk->disk_name, result);
                 goto harderror;
         }
+
+        if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
+                printk(KERN_ERR "%s: Wrong magic (0x%lx)\n",
+                                lo->disk->disk_name,
+                                (unsigned long)ntohl(reply.magic));
+                result = -EPROTO;
+                goto harderror;
+        }
+
         req = nbd_find_request(lo, reply.handle);
         if (unlikely(IS_ERR(req))) {
                 result = PTR_ERR(req);
@@ -312,13 +321,6 @@ static struct request *nbd_read_stat(struct nbd_device *lo)
                 goto harderror;
         }
 
-        if (ntohl(reply.magic) != NBD_REPLY_MAGIC) {
-                printk(KERN_ERR "%s: Wrong magic (0x%lx)\n",
-                                lo->disk->disk_name,
-                                (unsigned long)ntohl(reply.magic));
-                result = -EPROTO;
-                goto harderror;
-        }
         if (ntohl(reply.error)) {
                 printk(KERN_ERR "%s: Other side returned error (%d)\n",
                                 lo->disk->disk_name, ntohl(reply.error));
@@ -339,7 +341,8 @@ static struct request *nbd_read_stat(struct nbd_device *lo)
                                         printk(KERN_ERR "%s: Receive data failed (result %d)\n",
                                                         lo->disk->disk_name,
                                                         result);
-                                        goto harderror;
+                                        req->errors++;
+                                        return req;
                                 }
                                 dprintk(DBG_RX, "%s: request %p: got %d bytes data\n",
                                         lo->disk->disk_name, req, bvec->bv_len);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index bde2c64b6346..451b996bba91 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2577,19 +2577,19 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
         case PKT_CTRL_CMD_SETUP:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                mutex_lock(&ctl_mutex);
+                mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
                 ret = pkt_setup_dev(&ctrl_cmd);
                 mutex_unlock(&ctl_mutex);
                 break;
         case PKT_CTRL_CMD_TEARDOWN:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
-                mutex_lock(&ctl_mutex);
+                mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
                 ret = pkt_remove_dev(&ctrl_cmd);
                 mutex_unlock(&ctl_mutex);
                 break;
         case PKT_CTRL_CMD_STATUS:
-                mutex_lock(&ctl_mutex);
+                mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
                 pkt_get_status(&ctrl_cmd);
                 mutex_unlock(&ctl_mutex);
                 break;
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index be61f22ee7bb..d37ced0d132b 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -107,10 +107,14 @@ found:
         if (err) {
                 printk(KERN_ERR PFX "RNG registering failed (%d)\n",
                        err);
-                goto out;
+                goto err_unmap;
         }
 out:
         return err;
+
+err_unmap:
+        iounmap(mem);
+        goto out;
 }
 
 static void __exit mod_exit(void)
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 6594bd5645f4..ccd7e7102234 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -164,7 +164,7 @@ static int __init mod_init(void)
         if (err) {
                 printk(KERN_ERR PFX "RNG registering failed (%d)\n",
                        err);
-                goto out;
+                goto err_unmap;
         }
 out:
         return err;
diff --git a/drivers/char/pc8736x_gpio.c b/drivers/char/pc8736x_gpio.c
index 645eb81cb5a9..84e5a68635f1 100644
--- a/drivers/char/pc8736x_gpio.c
+++ b/drivers/char/pc8736x_gpio.c
@@ -221,7 +221,6 @@ static struct nsc_gpio_ops pc8736x_gpio_ops = {
         .gpio_change    = pc8736x_gpio_change,
         .gpio_current   = pc8736x_gpio_current
 };
-EXPORT_SYMBOL(pc8736x_gpio_ops);
 
 static int pc8736x_gpio_open(struct inode *inode, struct file *file)
 {
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 498aa37bca22..3ece69231343 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -51,6 +51,7 @@ void proc_fork_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -58,7 +59,8 @@ void proc_fork_connector(struct task_struct *task)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp); /* get high res monotonic timestamp */
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_FORK;
         ev->event_data.fork.parent_pid = task->real_parent->pid;
         ev->event_data.fork.parent_tgid = task->real_parent->tgid;
@@ -76,6 +78,7 @@ void proc_exec_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
+        struct timespec ts;
         __u8 buffer[CN_PROC_MSG_SIZE];
 
         if (atomic_read(&proc_event_num_listeners) < 1)
@@ -84,7 +87,8 @@ void proc_exec_connector(struct task_struct *task)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_EXEC;
         ev->event_data.exec.process_pid = task->pid;
         ev->event_data.exec.process_tgid = task->tgid;
@@ -100,6 +104,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -118,7 +123,8 @@ void proc_id_connector(struct task_struct *task, int which_id)
         } else
                 return;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
@@ -131,6 +137,7 @@ void proc_exit_connector(struct task_struct *task)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -138,7 +145,8 @@ void proc_exit_connector(struct task_struct *task)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         get_seq(&msg->seq, &ev->cpu);
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->what = PROC_EVENT_EXIT;
         ev->event_data.exit.process_pid = task->pid;
         ev->event_data.exit.process_tgid = task->tgid;
@@ -164,6 +172,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         struct cn_msg *msg;
         struct proc_event *ev;
         __u8 buffer[CN_PROC_MSG_SIZE];
+        struct timespec ts;
 
         if (atomic_read(&proc_event_num_listeners) < 1)
                 return;
@@ -171,7 +180,8 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         msg = (struct cn_msg*)buffer;
         ev = (struct proc_event*)msg->data;
         msg->seq = rcvd_seq;
-        ktime_get_ts(&ev->timestamp);
+        ktime_get_ts(&ts); /* get high res monotonic timestamp */
+        ev->timestamp_ns = timespec_to_ns(&ts);
         ev->cpu = -1;
         ev->what = PROC_EVENT_NONE;
         ev->event_data.ack.err = err;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 8d328186f774..bc1088d9b379 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -364,10 +364,12 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
+        lock_cpu_hotplug();                                             \
         mutex_lock(&policy->lock);                                      \
         ret = __cpufreq_set_policy(policy, &new_policy);                \
         policy->user_policy.object = policy->object;                    \
         mutex_unlock(&policy->lock);                                    \
+        unlock_cpu_hotplug();                                           \
                                                                         \
         return ret ? ret : count;                                       \
 }
@@ -1197,20 +1199,18 @@ EXPORT_SYMBOL(cpufreq_unregister_notifier);
  *********************************************************************/
 
 
+/* Must be called with lock_cpu_hotplug held */
 int __cpufreq_driver_target(struct cpufreq_policy *policy,
                             unsigned int target_freq,
                             unsigned int relation)
 {
         int retval = -EINVAL;
 
-        lock_cpu_hotplug();
         dprintk("target for CPU %u: %u kHz, relation %u\n", policy->cpu,
                 target_freq, relation);
         if (cpu_online(policy->cpu) && cpufreq_driver->target)
                 retval = cpufreq_driver->target(policy, target_freq, relation);
 
-        unlock_cpu_hotplug();
-
         return retval;
 }
 EXPORT_SYMBOL_GPL(__cpufreq_driver_target);
@@ -1225,17 +1225,23 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
         if (!policy)
                 return -EINVAL;
 
+        lock_cpu_hotplug();
         mutex_lock(&policy->lock);
 
         ret = __cpufreq_driver_target(policy, target_freq, relation);
 
         mutex_unlock(&policy->lock);
+        unlock_cpu_hotplug();
 
         cpufreq_cpu_put(policy);
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
 
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ * when "event" is CPUFREQ_GOV_LIMITS
+ */
 
 static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 {
@@ -1257,24 +1263,6 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 }
 
 
-int cpufreq_governor(unsigned int cpu, unsigned int event)
-{
-        int ret = 0;
-        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-
-        if (!policy)
-                return -EINVAL;
-
-        mutex_lock(&policy->lock);
-        ret = __cpufreq_governor(policy, event);
-        mutex_unlock(&policy->lock);
-
-        cpufreq_cpu_put(policy);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cpufreq_governor);
-
-
 int cpufreq_register_governor(struct cpufreq_governor *governor)
 {
         struct cpufreq_governor *t;
@@ -1342,6 +1330,9 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_get_policy);
 
 
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ */
 static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_policy *policy)
 {
         int ret = 0;
@@ -1436,6 +1427,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         if (!data)
                 return -EINVAL;
 
+        lock_cpu_hotplug();
+
         /* lock this CPU */
         mutex_lock(&data->lock);
 
@@ -1446,6 +1439,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         data->user_policy.governor = data->governor;
 
         mutex_unlock(&data->lock);
+
+        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
 
         return ret;
@@ -1469,6 +1464,7 @@ int cpufreq_update_policy(unsigned int cpu)
         if (!data)
                 return -ENODEV;
 
+        lock_cpu_hotplug();
         mutex_lock(&data->lock);
 
         dprintk("updating policy for CPU %u\n", cpu);
@@ -1494,7 +1490,7 @@ int cpufreq_update_policy(unsigned int cpu)
         ret = __cpufreq_set_policy(data, &policy);
 
         mutex_unlock(&data->lock);
-
+        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
         return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index b3ebc8f01975..c4c578defabf 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -525,7 +525,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 break;
 
         case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                 mutex_lock(&dbs_mutex);
                 if (policy->max < this_dbs_info->cur_policy->cur)
                         __cpufreq_driver_target(
@@ -536,7 +535,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                         this_dbs_info->cur_policy,
                                         policy->min, CPUFREQ_RELATION_L);
                 mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                 break;
         }
         return 0;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 178f0c547eb7..52cf1f021825 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -309,7 +309,9 @@ static void do_dbs_timer(void *data)
         if (!dbs_info->enable)
                 return;
 
+        lock_cpu_hotplug();
         dbs_check_cpu(dbs_info);
+        unlock_cpu_hotplug();
         queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work,
                         usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
 }
@@ -412,7 +414,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 break;
 
         case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                 mutex_lock(&dbs_mutex);
                 if (policy->max < this_dbs_info->cur_policy->cur)
                         __cpufreq_driver_target(this_dbs_info->cur_policy,
@@ -423,7 +424,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                                 policy->min,
                                                 CPUFREQ_RELATION_L);
                 mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                 break;
         }
         return 0;
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 44ae5e5b94cf..a06c204589cd 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -18,6 +18,7 @@
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/cpufreq.h>
+#include <linux/cpu.h>
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/sysfs.h>
@@ -70,6 +71,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
         dprintk("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
 
+        lock_cpu_hotplug();
         mutex_lock(&userspace_mutex);
         if (!cpu_is_managed[policy->cpu])
                 goto err;
@@ -92,6 +94,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
  err:
         mutex_unlock(&userspace_mutex);
+        unlock_cpu_hotplug();
         return ret;
 }
 
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 53bba41f29bc..b6fb167e20f6 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -682,6 +682,7 @@ config BLK_DEV_SVWKS
 config BLK_DEV_SGIIOC4
         tristate "Silicon Graphics IOC4 chipset ATA/ATAPI support"
         depends on (IA64_SGI_SN2 || IA64_GENERIC) && SGI_IOC4
+        select IDEPCI_SHARE_IRQ
         help
           This driver adds PIO & MultiMode DMA-2 support for the SGI IOC4
           chipset, which has one channel and can support two devices.
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index f712e4cfd9dc..7cf3eb023521 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -776,7 +776,7 @@ static void update_ordered(ide_drive_t *drive)
                  * not available so we don't need to recheck that.
                  */
                 capacity = idedisk_capacity(drive);
-                barrier = ide_id_has_flush_cache(id) &&
+                barrier = ide_id_has_flush_cache(id) && !drive->noflush &&
                         (drive->addressing == 0 || capacity <= (1ULL << 28) ||
                          ide_id_has_flush_cache_ext(id));
 
diff --git a/drivers/ide/ide-dma.c b/drivers/ide/ide-dma.c
index 98918fb6b2ce..7c3a13e1cf64 100644
--- a/drivers/ide/ide-dma.c
+++ b/drivers/ide/ide-dma.c
@@ -750,7 +750,7 @@ void ide_dma_verbose(ide_drive_t *drive)
                         goto bug_dma_off;
                 printk(", DMA");
         } else if (id->field_valid & 1) {
-                printk(", BUG");
+                goto bug_dma_off;
         }
         return;
 bug_dma_off:
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index 657165297dc7..77703acaec17 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -23,6 +23,7 @@
 #include <linux/hdreg.h>
 #include <linux/ide.h>
 #include <linux/bitops.h>
+#include <linux/nmi.h>
 
 #include <asm/byteorder.h>
 #include <asm/irq.h>
@@ -1243,6 +1244,7 @@ int ide_wait_not_busy(ide_hwif_t *hwif, unsigned long timeout)
                 if (stat == 0xff)
                         return -ENODEV;
                 touch_softlockup_watchdog();
+                touch_nmi_watchdog();
         }
         return -EBUSY;
 }
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 05fbd9298db7..defd4b4bd374 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1539,7 +1539,7 @@ static int __init ide_setup(char *s)
                 const char *hd_words[] = {
                         "none", "noprobe", "nowerr", "cdrom", "serialize",
                         "autotune", "noautotune", "minus8", "swapdata", "bswap",
-                        "minus11", "remap", "remap63", "scsi", NULL };
+                        "noflush", "remap", "remap63", "scsi", NULL };
                 unit = s[2] - 'a';
                 hw   = unit / MAX_DRIVES;
                 unit = unit % MAX_DRIVES;
@@ -1578,6 +1578,9 @@ static int __init ide_setup(char *s)
                         case -10: /* "bswap" */
                                 drive->bswap = 1;
                                 goto done;
+                        case -11: /* noflush */
+                                drive->noflush = 1;
+                                goto done;
                         case -12: /* "remap" */
                                 drive->remap_0_to_1 = 1;
                                 goto done;
diff --git a/drivers/ide/pci/it821x.c b/drivers/ide/pci/it821x.c
index 3cb04424d351..e9bad185968a 100644
--- a/drivers/ide/pci/it821x.c
+++ b/drivers/ide/pci/it821x.c
@@ -498,9 +498,14 @@ static int config_chipset_for_dma (ide_drive_t *drive)
 {
         u8 speed        = ide_dma_speed(drive, it821x_ratemask(drive));
 
-        config_it821x_chipset_for_pio(drive, !speed);
-        it821x_tune_chipset(drive, speed);
-        return ide_dma_enable(drive);
+        if (speed) {
+                config_it821x_chipset_for_pio(drive, 0);
+                it821x_tune_chipset(drive, speed);
+
+                return ide_dma_enable(drive);
+        }
+
+        return 0;
 }
 
 /**
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 44708b5e582d..d5d649f5ccdb 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -124,8 +124,6 @@ config PMAC_BACKLIGHT
         bool "Backlight control for LCD screens"
         depends on ADB_PMU && FB = y && (BROKEN || !PPC64)
         select FB_BACKLIGHT
-        select BACKLIGHT_CLASS_DEVICE
-        select BACKLIGHT_LCD_SUPPORT
         help
           Say Y here to enable Macintosh specific extensions of the generic
           backlight code. With this enabled, the brightness keys on older
diff --git a/drivers/macintosh/adbhid.c b/drivers/macintosh/adbhid.c
index 545be1ed6927..c69d23bb255e 100644
--- a/drivers/macintosh/adbhid.c
+++ b/drivers/macintosh/adbhid.c
@@ -45,14 +45,11 @@
 #include <linux/pmu.h>
 
 #include <asm/machdep.h>
+#include <asm/backlight.h>
 #ifdef CONFIG_PPC_PMAC
 #include <asm/pmac_feature.h>
 #endif
 
-#ifdef CONFIG_PMAC_BACKLIGHT
-#include <asm/backlight.h>
-#endif
-
 MODULE_AUTHOR("Franz Sirl <Franz.Sirl-kernel@lauterbach.com>");
 
 #define KEYB_KEYREG     0       /* register # for key up/down data */
@@ -237,11 +234,6 @@ static struct adb_ids keyboard_ids;
 static struct adb_ids mouse_ids;
 static struct adb_ids buttons_ids;
 
-#ifdef CONFIG_PMAC_BACKLIGHT
-/* Exported to via-pmu.c */
-int disable_kernel_backlight = 0;
-#endif /* CONFIG_PMAC_BACKLIGHT */
-
 /* Kind of keyboard, see Apple technote 1152  */
 #define ADB_KEYBOARD_UNKNOWN    0
 #define ADB_KEYBOARD_ANSI       0x0100
@@ -527,7 +519,7 @@ adbhid_buttons_input(unsigned char *data, int nb, struct pt_regs *regs, int auto
 
                 case 0xa:       /* brightness decrease */
 #ifdef CONFIG_PMAC_BACKLIGHT
-                        if (!disable_kernel_backlight && down)
+                        if (down)
                                 pmac_backlight_key_down();
 #endif
                         input_report_key(adbhid[id]->input, KEY_BRIGHTNESSDOWN, down);
@@ -535,7 +527,7 @@ adbhid_buttons_input(unsigned char *data, int nb, struct pt_regs *regs, int auto
 
                 case 0x9:       /* brightness increase */
 #ifdef CONFIG_PMAC_BACKLIGHT
-                        if (!disable_kernel_backlight && down)
+                        if (down)
                                 pmac_backlight_key_up();
 #endif
                         input_report_key(adbhid[id]->input, KEY_BRIGHTNESSUP, down);
diff --git a/drivers/macintosh/via-pmu-backlight.c b/drivers/macintosh/via-pmu-backlight.c
index b42d05f2aaff..d3f8d75bcbb4 100644
--- a/drivers/macintosh/via-pmu-backlight.c
+++ b/drivers/macintosh/via-pmu-backlight.c
@@ -15,8 +15,9 @@
 
 #define MAX_PMU_LEVEL 0xFF
 
-static struct device_node *vias;
 static struct backlight_properties pmu_backlight_data;
+static spinlock_t pmu_backlight_lock;
+static int sleeping;
 
 static int pmu_backlight_get_level_brightness(struct fb_info *info,
                 int level)
@@ -40,23 +41,36 @@ static int pmu_backlight_update_status(struct backlight_device *bd)
 {
         struct fb_info *info = class_get_devdata(&bd->class_dev);
         struct adb_request req;
-        int pmulevel, level = bd->props->brightness;
+        unsigned long flags;
+        int level = bd->props->brightness;
 
-        if (vias == NULL)
-                return -ENODEV;
+        spin_lock_irqsave(&pmu_backlight_lock, flags);
+
+        /* Don't update brightness when sleeping */
+        if (sleeping)
+                goto out;
 
         if (bd->props->power != FB_BLANK_UNBLANK ||
             bd->props->fb_blank != FB_BLANK_UNBLANK)
                 level = 0;
 
-        pmulevel = pmu_backlight_get_level_brightness(info, level);
+        if (level > 0) {
+                int pmulevel = pmu_backlight_get_level_brightness(info, level);
 
-        pmu_request(&req, NULL, 2, PMU_BACKLIGHT_BRIGHT, pmulevel);
-        pmu_wait_complete(&req);
+                pmu_request(&req, NULL, 2, PMU_BACKLIGHT_BRIGHT, pmulevel);
+                pmu_wait_complete(&req);
 
-        pmu_request(&req, NULL, 2, PMU_POWER_CTRL,
-                PMU_POW_BACKLIGHT | (level > 0 ? PMU_POW_ON : PMU_POW_OFF));
-        pmu_wait_complete(&req);
+                pmu_request(&req, NULL, 2, PMU_POWER_CTRL,
+                        PMU_POW_BACKLIGHT | PMU_POW_ON);
+                pmu_wait_complete(&req);
+        } else {
+                pmu_request(&req, NULL, 2, PMU_POWER_CTRL,
+                        PMU_POW_BACKLIGHT | PMU_POW_OFF);
+                pmu_wait_complete(&req);
+        }
+
+out:
+        spin_unlock_irqrestore(&pmu_backlight_lock, flags);
 
         return 0;
 }
@@ -73,15 +87,39 @@ static struct backlight_properties pmu_backlight_data = {
         .max_brightness = (FB_BACKLIGHT_LEVELS - 1),
 };
 
-void __init pmu_backlight_init(struct device_node *in_vias)
+#ifdef CONFIG_PM
+static int pmu_backlight_sleep_call(struct pmu_sleep_notifier *self, int when)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&pmu_backlight_lock, flags);
+
+        switch (when) {
+        case PBOOK_SLEEP_REQUEST:
+                sleeping = 1;
+                break;
+        case PBOOK_WAKE:
+                sleeping = 0;
+                break;
+        }
+
+        spin_unlock_irqrestore(&pmu_backlight_lock, flags);
+
+        return PBOOK_SLEEP_OK;
+}
+
+static struct pmu_sleep_notifier pmu_backlight_sleep_notif = {
+        .notifier_call = pmu_backlight_sleep_call,
+};
+#endif
+
+void __init pmu_backlight_init()
 {
         struct backlight_device *bd;
         struct fb_info *info;
         char name[10];
         int level, autosave;
 
-        vias = in_vias;
-
         /* Special case for the old PowerBook since I can't test on it */
         autosave =
                 machine_is_compatible("AAPL,3400/2400") ||
@@ -141,6 +179,10 @@ void __init pmu_backlight_init(struct device_node *in_vias)
                 pmac_backlight = bd;
         mutex_unlock(&pmac_backlight_mutex);
 
+#ifdef CONFIG_PM
+        pmu_register_sleep_notifier(&pmu_backlight_sleep_notif);
+#endif
+
         printk("pmubl: Backlight initialized (%s)\n", name);
 
         return;
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index 06ca80bfd6b9..ea386801e215 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -16,7 +16,6 @@
  *    a sleep or a freq. switch
  *  - Move sleep code out of here to pmac_pm, merge into new
  *    common PM infrastructure
- *  - Move backlight code out as well
  *  - Save/Restore PCI space properly
  *
  */
@@ -60,9 +59,7 @@
 #include <asm/mmu_context.h>
 #include <asm/cputable.h>
 #include <asm/time.h>
-#ifdef CONFIG_PMAC_BACKLIGHT
 #include <asm/backlight.h>
-#endif
 
 #include "via-pmu-event.h"
 
@@ -177,10 +174,6 @@ static int query_batt_timer = BATTERY_POLLING_COUNT;
 static struct adb_request batt_req;
 static struct proc_dir_entry *proc_pmu_batt[PMU_MAX_BATTERIES];
 
-#if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
-extern int disable_kernel_backlight;
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */
-
 int __fake_sleep;
 int asleep;
 BLOCKING_NOTIFIER_HEAD(sleep_notifier_list);
@@ -466,7 +459,7 @@ static int __init via_pmu_dev_init(void)
 
 #ifdef CONFIG_PMAC_BACKLIGHT
         /* Initialize backlight */
-        pmu_backlight_init(vias);
+        pmu_backlight_init();
 #endif
 
 #ifdef CONFIG_PPC32
@@ -1403,11 +1396,8 @@ next:
         else if ((1 << pirq) & PMU_INT_SNDBRT) {
 #ifdef CONFIG_PMAC_BACKLIGHT
                 if (len == 3)
-#ifdef CONFIG_INPUT_ADBHID
-                        if (!disable_kernel_backlight)
-#endif /* CONFIG_INPUT_ADBHID */
-                                pmac_backlight_set_legacy_brightness(data[1] >> 4);
-#endif /* CONFIG_PMAC_BACKLIGHT */
+                        pmac_backlight_set_legacy_brightness_pmu(data[1] >> 4);
+#endif
         }
         /* Tick interrupt */
         else if ((1 << pirq) & PMU_INT_TICK) {
@@ -2414,7 +2404,7 @@ struct pmu_private {
         spinlock_t lock;
 #if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
         int     backlight_locker;
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */     
+#endif
 };
 
 static LIST_HEAD(all_pmu_pvt);
@@ -2464,7 +2454,7 @@ pmu_open(struct inode *inode, struct file *file)
         spin_lock_irqsave(&all_pvt_lock, flags);
 #if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
         pp->backlight_locker = 0;
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */     
+#endif
         list_add(&pp->list, &all_pmu_pvt);
         spin_unlock_irqrestore(&all_pvt_lock, flags);
         file->private_data = pp;
@@ -2559,13 +2549,12 @@ pmu_release(struct inode *inode, struct file *file)
                 spin_lock_irqsave(&all_pvt_lock, flags);
                 list_del(&pp->list);
                 spin_unlock_irqrestore(&all_pvt_lock, flags);
+
 #if defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT)
-                if (pp->backlight_locker) {
-                        spin_lock_irqsave(&pmu_lock, flags);
-                        disable_kernel_backlight--;
-                        spin_unlock_irqrestore(&pmu_lock, flags);
-                }
-#endif /* defined(CONFIG_INPUT_ADBHID) && defined(CONFIG_PMAC_BACKLIGHT) */
+                if (pp->backlight_locker)
+                        pmac_backlight_enable();
+#endif
+
                 kfree(pp);
         }
         unlock_kernel();
@@ -2642,18 +2631,18 @@ pmu_ioctl(struct inode * inode, struct file *filp,
 #ifdef CONFIG_INPUT_ADBHID
         case PMU_IOC_GRAB_BACKLIGHT: {
                 struct pmu_private *pp = filp->private_data;
-                unsigned long flags;
 
                 if (pp->backlight_locker)
                         return 0;
+
                 pp->backlight_locker = 1;
-                spin_lock_irqsave(&pmu_lock, flags);
-                disable_kernel_backlight++;
-                spin_unlock_irqrestore(&pmu_lock, flags);
+                pmac_backlight_disable();
+
                 return 0;
         }
 #endif /* CONFIG_INPUT_ADBHID */
 #endif /* CONFIG_PMAC_BACKLIGHT_LEGACY */
+
         case PMU_IOC_GET_MODEL:
                 return put_user(pmu_kind, argp);
         case PMU_IOC_HAS_ADB:
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 07ca9480a6fe..c3e52c806b13 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -620,7 +620,7 @@ static int myri10ge_load_firmware(struct myri10ge_priv *mgp)
                 return -ENXIO;
         }
         dev_info(&mgp->pdev->dev, "handoff confirmed\n");
-        myri10ge_dummy_rdma(mgp, mgp->tx.boundary != 4096);
+        myri10ge_dummy_rdma(mgp, 1);
 
         return 0;
 }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 82200bfaa8ed..7de9a07b2ac2 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -516,10 +516,7 @@ static int skge_set_pauseparam(struct net_device *dev,
 /* Chip internal frequency for clock calculations */
 static inline u32 hwkhz(const struct skge_hw *hw)
 {
-        if (hw->chip_id == CHIP_ID_GENESIS)
-                return 53215; /* or:  53.125 MHz */
-        else
-                return 78215; /* or:  78.125 MHz */
+        return (hw->chip_id == CHIP_ID_GENESIS) ? 53125 : 78125;
 }
 
 /* Chip HZ to microseconds */
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 1ef9fd39a79a..0e3fdf7c6dd3 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -1537,7 +1537,7 @@ static int __init sparc_lance_init(void)
 {
         if ((idprom->id_machtype == (SM_SUN4|SM_4_330)) ||
             (idprom->id_machtype == (SM_SUN4|SM_4_470))) {
-                memset(&sun4_sdev, 0, sizeof(sdev));
+                memset(&sun4_sdev, 0, sizeof(struct sbus_dev));
                 sun4_sdev.reg_addrs[0].phys_addr = sun4_eth_physaddr;
                 sun4_sdev.irqs[0] = 6;
                 return sparc_lance_probe_one(&sun4_sdev, NULL, NULL);
@@ -1547,16 +1547,16 @@ static int __init sparc_lance_init(void)
 
 static int __exit sunlance_sun4_remove(void)
 {
-        struct lance_private *lp = dev_get_drvdata(&sun4_sdev->dev);
+        struct lance_private *lp = dev_get_drvdata(&sun4_sdev.ofdev.dev);
         struct net_device *net_dev = lp->dev;
 
         unregister_netdevice(net_dev);
 
-        lance_free_hwresources(root_lance_dev);
+        lance_free_hwresources(lp);
 
         free_netdev(net_dev);
 
-        dev_set_drvdata(&sun4_sdev->dev, NULL);
+        dev_set_drvdata(&sun4_sdev.ofdev.dev, NULL);
 
         return 0;
 }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index ce6f3be86da0..1b8138f641e3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.62"
-#define DRV_MODULE_RELDATE      "June 30, 2006"
+#define DRV_MODULE_VERSION      "3.63"
+#define DRV_MODULE_RELDATE      "July 25, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -3590,6 +3590,28 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
 static int tg3_init_hw(struct tg3 *, int);
 static int tg3_halt(struct tg3 *, int, int);
 
+/* Restart hardware after configuration changes, self-test, etc.
+ * Invoked with tp->lock held.
+ */
+static int tg3_restart_hw(struct tg3 *tp, int reset_phy)
+{
+        int err;
+
+        err = tg3_init_hw(tp, reset_phy);
+        if (err) {
+                printk(KERN_ERR PFX "%s: Failed to re-initialize device, "
+                       "aborting.\n", tp->dev->name);
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+                tg3_full_unlock(tp);
+                del_timer_sync(&tp->timer);
+                tp->irq_sync = 0;
+                netif_poll_enable(tp->dev);
+                dev_close(tp->dev);
+                tg3_full_lock(tp, 0);
+        }
+        return err;
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void tg3_poll_controller(struct net_device *dev)
 {
@@ -3630,13 +3652,15 @@ static void tg3_reset_task(void *_data)
         }
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
-        tg3_init_hw(tp, 1);
+        if (tg3_init_hw(tp, 1))
+                goto out;
 
         tg3_netif_start(tp);
 
         if (restart_timer)
                 mod_timer(&tp->timer, jiffies + 1);
 
+out:
         tp->tg3_flags &= ~TG3_FLAG_IN_RESET_TASK;
 
         tg3_full_unlock(tp);
@@ -4124,6 +4148,7 @@ static inline void tg3_set_mtu(struct net_device *dev, struct tg3 *tp,
 static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct tg3 *tp = netdev_priv(dev);
+        int err;
 
         if (new_mtu < TG3_MIN_MTU || new_mtu > TG3_MAX_MTU(tp))
                 return -EINVAL;
@@ -4144,13 +4169,14 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 
         tg3_set_mtu(dev, tp, new_mtu);
 
-        tg3_init_hw(tp, 0);
+        err = tg3_restart_hw(tp, 0);
 
-        tg3_netif_start(tp);
+        if (!err)
+                tg3_netif_start(tp);
 
         tg3_full_unlock(tp);
 
-        return 0;
+        return err;
 }
 
 /* Free up pending packets in all rx/tx rings.
@@ -4232,7 +4258,7 @@ static void tg3_free_rings(struct tg3 *tp)
  * end up in the driver.  tp->{tx,}lock are held and thus
  * we may not sleep.
  */
-static void tg3_init_rings(struct tg3 *tp)
+static int tg3_init_rings(struct tg3 *tp)
 {
         u32 i;
 
@@ -4281,18 +4307,38 @@ static void tg3_init_rings(struct tg3 *tp)
 
         /* Now allocate fresh SKBs for each rx ring. */
         for (i = 0; i < tp->rx_pending; i++) {
-                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD,
-                                     -1, i) < 0)
+                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD, -1, i) < 0) {
+                        printk(KERN_WARNING PFX
+                               "%s: Using a smaller RX standard ring, "
+                               "only %d out of %d buffers were allocated "
+                               "successfully.\n",
+                               tp->dev->name, i, tp->rx_pending);
+                        if (i == 0)
+                                return -ENOMEM;
+                        tp->rx_pending = i;
                         break;
+                }
         }
 
         if (tp->tg3_flags & TG3_FLAG_JUMBO_RING_ENABLE) {
                 for (i = 0; i < tp->rx_jumbo_pending; i++) {
                         if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_JUMBO,
-                                             -1, i) < 0)
+                                             -1, i) < 0) {
+                                printk(KERN_WARNING PFX
+                                       "%s: Using a smaller RX jumbo ring, "
+                                       "only %d out of %d buffers were "
+                                       "allocated successfully.\n",
+                                       tp->dev->name, i, tp->rx_jumbo_pending);
+                                if (i == 0) {
+                                        tg3_free_rings(tp);
+                                        return -ENOMEM;
+                                }
+                                tp->rx_jumbo_pending = i;
                                 break;
+                        }
                 }
         }
+        return 0;
 }
 
 /*
@@ -5815,6 +5861,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
 {
         struct tg3 *tp = netdev_priv(dev);
         struct sockaddr *addr = p;
+        int err = 0;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EINVAL;
@@ -5832,9 +5879,9 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                 tg3_full_lock(tp, 1);
 
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 0);
-
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 0);
+                if (!err)
+                        tg3_netif_start(tp);
                 tg3_full_unlock(tp);
         } else {
                 spin_lock_bh(&tp->lock);
@@ -5842,7 +5889,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                 spin_unlock_bh(&tp->lock);
         }
 
-        return 0;
+        return err;
 }
 
 /* tp->lock is held. */
@@ -5942,7 +5989,9 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
          * can only do this after the hardware has been
          * successfully reset.
          */
-        tg3_init_rings(tp);
+        err = tg3_init_rings(tp);
+        if (err)
+                return err;
 
         /* This value is determined during the probe time DMA
          * engine test, tg3_test_dma.
@@ -7956,7 +8005,7 @@ static void tg3_get_ringparam(struct net_device *dev, struct ethtool_ringparam *
 static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ering)
 {
         struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
   
         if ((ering->rx_pending > TG3_RX_RING_SIZE - 1) ||
             (ering->rx_jumbo_pending > TG3_RX_JUMBO_RING_SIZE - 1) ||
@@ -7980,13 +8029,14 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 1);
+                if (!err)
+                        tg3_netif_start(tp);
         }
 
         tg3_full_unlock(tp);
   
-        return 0;
+        return err;
 }
   
 static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
@@ -8001,7 +8051,7 @@ static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
 {
         struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
   
         if (netif_running(dev)) {
                 tg3_netif_stop(tp);
@@ -8025,13 +8075,14 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 1);
+                if (!err)
+                        tg3_netif_start(tp);
         }
 
         tg3_full_unlock(tp);
   
-        return 0;
+        return err;
 }
   
 static u32 tg3_get_rx_csum(struct net_device *dev)
@@ -8666,7 +8717,9 @@ static int tg3_test_loopback(struct tg3 *tp)
         if (!netif_running(tp->dev))
                 return TG3_LOOPBACK_FAILED;
 
-        tg3_reset_hw(tp, 1);
+        err = tg3_reset_hw(tp, 1);
+        if (err)
+                return TG3_LOOPBACK_FAILED;
 
         if (tg3_run_loopback(tp, TG3_MAC_LOOPBACK))
                 err |= TG3_MAC_LOOPBACK_FAILED;
@@ -8740,8 +8793,8 @@ static void tg3_self_test(struct net_device *dev, struct ethtool_test *etest,
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 if (netif_running(dev)) {
                         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                        tg3_init_hw(tp, 1);
-                        tg3_netif_start(tp);
+                        if (!tg3_restart_hw(tp, 1))
+                                tg3_netif_start(tp);
                 }
 
                 tg3_full_unlock(tp);
@@ -11699,7 +11752,8 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 tg3_full_lock(tp, 0);
 
                 tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                tg3_init_hw(tp, 1);
+                if (tg3_restart_hw(tp, 1))
+                        goto out;
 
                 tp->timer.expires = jiffies + tp->timer_offset;
                 add_timer(&tp->timer);
@@ -11707,6 +11761,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 netif_device_attach(dev);
                 tg3_netif_start(tp);
 
+out:
                 tg3_full_unlock(tp);
         }
 
@@ -11733,16 +11788,19 @@ static int tg3_resume(struct pci_dev *pdev)
         tg3_full_lock(tp, 0);
 
         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-        tg3_init_hw(tp, 1);
+        err = tg3_restart_hw(tp, 1);
+        if (err)
+                goto out;
 
         tp->timer.expires = jiffies + tp->timer_offset;
         add_timer(&tp->timer);
 
         tg3_netif_start(tp);
 
+out:
         tg3_full_unlock(tp);
 
-        return 0;
+        return err;
 }
 
 static struct pci_driver tg3_driver = {
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index f5b0078eb4ad..aa9cd92f46b2 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -2742,7 +2742,7 @@ static u32 check_connection_type(struct mac_regs __iomem * regs)
 
         if (PHYSR0 & PHYSR0_SPDG)
                 status |= VELOCITY_SPEED_1000;
-        if (PHYSR0 & PHYSR0_SPD10)
+        else if (PHYSR0 & PHYSR0_SPD10)
                 status |= VELOCITY_SPEED_10;
         else
                 status |= VELOCITY_SPEED_100;
@@ -2851,8 +2851,17 @@ static int velocity_get_settings(struct net_device *dev, struct ethtool_cmd *cmd
         u32 status;
         status = check_connection_type(vptr->mac_regs);
 
-        cmd->supported = SUPPORTED_TP | SUPPORTED_Autoneg | SUPPORTED_10baseT_Half | SUPPORTED_10baseT_Full | SUPPORTED_100baseT_Half | SUPPORTED_100baseT_Full | SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full;
-        if (status & VELOCITY_SPEED_100)
+        cmd->supported = SUPPORTED_TP |
+                        SUPPORTED_Autoneg |
+                        SUPPORTED_10baseT_Half |
+                        SUPPORTED_10baseT_Full |
+                        SUPPORTED_100baseT_Half |
+                        SUPPORTED_100baseT_Full |
+                        SUPPORTED_1000baseT_Half |
+                        SUPPORTED_1000baseT_Full;
+        if (status & VELOCITY_SPEED_1000)
+                cmd->speed = SPEED_1000;
+        else if (status & VELOCITY_SPEED_100)
                 cmd->speed = SPEED_100;
         else
                 cmd->speed = SPEED_10;
@@ -2896,7 +2905,7 @@ static u32 velocity_get_link(struct net_device *dev)
 {
         struct velocity_info *vptr = netdev_priv(dev);
         struct mac_regs __iomem * regs = vptr->mac_regs;
-        return BYTE_REG_BITS_IS_ON(PHYSR0_LINKGD, &regs->PHYSR0)  ? 0 : 1;
+        return BYTE_REG_BITS_IS_ON(PHYSR0_LINKGD, &regs->PHYSR0) ? 1 : 0;
 }
 
 static void velocity_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index fa9d2c4edc93..2e8ac995d56f 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -447,6 +447,7 @@ config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
         depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
         select CRYPTO
+        select CRYPTO_AES
         ---help---
           This is the standard Linux driver to support Cisco/Aironet PCMCIA
           802.11 wireless cards.  This driver is the same as the Aironet
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 3889f79e7128..df317c1e12a8 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -3701,7 +3701,7 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
         }
         if (sec->flags & SEC_AUTH_MODE) {
                 secinfo->auth_mode = sec->auth_mode;
-                dprintk(", .auth_mode = %d\n", sec->auth_mode);
+                dprintk(", .auth_mode = %d", sec->auth_mode);
         }
         dprintk("\n");
         if (bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED &&
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index d6ed5781b93a..317ace7f9aae 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -2875,7 +2875,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
         if (orinoco_lock(priv, &flags) != 0)
                 return -EBUSY;
 
-        if (erq->pointer) {
+        if (erq->length > 0) {
                 if ((index < 0) || (index >= ORINOCO_MAX_KEYS))
                         index = priv->tx_key;
 
@@ -2918,7 +2918,7 @@ static int orinoco_ioctl_setiwencode(struct net_device *dev,
         if (erq->flags & IW_ENCODE_RESTRICTED)
                 restricted = 1;
 
-        if (erq->pointer) {
+        if (erq->pointer && erq->length > 0) {
                 priv->keys[index].len = cpu_to_le16(xlen);
                 memset(priv->keys[index].data, 0,
                        sizeof(priv->keys[index].data));
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 662ecc8a33ff..c52e9bcf8d02 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -1820,6 +1820,8 @@ static int zd1201_probe(struct usb_interface *interface,
             zd->dev->name);
 
         usb_set_intfdata(interface, zd);
+        zd1201_enable(zd);      /* zd1201 likes to startup enabled, */
+        zd1201_disable(zd);     /* interfering with all the wifis in range */
         return 0;
 
 err_net:
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index 622b3f8ba820..f8ae2b7db0a7 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -61,7 +61,7 @@ struct pci_bus * __devinit pci_find_bus(int domain, int busnr)
  * @from: Previous PCI bus found, or %NULL for new search.
  *
  * Iterates through the list of known PCI busses.  A new search is
- * initiated by passing %NULL to the @from argument.  Otherwise if
+ * initiated by passing %NULL as the @from argument.  Otherwise if
  * @from is not %NULL, searches continue from next device on the
  * global list.
  */
@@ -148,13 +148,14 @@ struct pci_dev * pci_get_slot(struct pci_bus *bus, unsigned int devfn)
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
  * Iterates through the list of known PCI devices.  If a PCI device is
- * found with a matching @vendor, @device, @ss_vendor and @ss_device, a pointer to its
- * device structure is returned.  Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
- * Otherwise if @from is not %NULL, searches continue from next device on the global list.
+ * found with a matching @vendor, @device, @ss_vendor and @ss_device, a
+ * pointer to its device structure is returned.  Otherwise, %NULL is returned.
+ * A new search is initiated by passing %NULL as the @from argument.
+ * Otherwise if @from is not %NULL, searches continue from next device
+ * on the global list.
  *
- * NOTE: Do not use this function anymore, use pci_get_subsys() instead, as
- * the pci device returned by this function can disappear at any moment in
+ * NOTE: Do not use this function any more; use pci_get_subsys() instead, as
+ * the PCI device returned by this function can disappear at any moment in
  * time.
  */
 static struct pci_dev * pci_find_subsys(unsigned int vendor,
@@ -191,14 +192,15 @@ exit:
  * @device: PCI device id to match, or %PCI_ANY_ID to match all device ids
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
- * Iterates through the list of known PCI devices.  If a PCI device is
- * found with a matching @vendor and @device, a pointer to its device structure is
+ * Iterates through the list of known PCI devices.  If a PCI device is found
+ * with a matching @vendor and @device, a pointer to its device structure is
  * returned.  Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
- * Otherwise if @from is not %NULL, searches continue from next device on the global list.
+ * A new search is initiated by passing %NULL as the @from argument.
+ * Otherwise if @from is not %NULL, searches continue from next device
+ * on the global list.
  * 
- * NOTE: Do not use this function anymore, use pci_get_device() instead, as
- * the pci device returned by this function can disappear at any moment in
+ * NOTE: Do not use this function any more; use pci_get_device() instead, as
+ * the PCI device returned by this function can disappear at any moment in
  * time.
  */
 struct pci_dev *
@@ -215,11 +217,11 @@ pci_find_device(unsigned int vendor, unsigned int device, const struct pci_dev *
  * @ss_device: PCI subsystem device id to match, or %PCI_ANY_ID to match all device ids
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
- * Iterates through the list of known PCI devices.  If a PCI device is
- * found with a matching @vendor, @device, @ss_vendor and @ss_device, a pointer to its
+ * Iterates through the list of known PCI devices.  If a PCI device is found
+ * with a matching @vendor, @device, @ss_vendor and @ss_device, a pointer to its
  * device structure is returned, and the reference count to the device is
  * incremented.  Otherwise, %NULL is returned.  A new search is initiated by
- * passing %NULL to the @from argument.  Otherwise if @from is not %NULL,
+ * passing %NULL as the @from argument.  Otherwise if @from is not %NULL,
  * searches continue from next device on the global list.
  * The reference count for @from is always decremented if it is not %NULL.
  */
@@ -262,7 +264,7 @@ exit:
  * found with a matching @vendor and @device, the reference count to the
  * device is incremented and a pointer to its device structure is returned.
  * Otherwise, %NULL is returned.  A new search is initiated by passing %NULL
- * to the @from argument.  Otherwise if @from is not %NULL, searches continue
+ * as the @from argument.  Otherwise if @from is not %NULL, searches continue
  * from next device on the global list.  The reference count for @from is
  * always decremented if it is not %NULL.
  */
@@ -279,11 +281,13 @@ pci_get_device(unsigned int vendor, unsigned int device, struct pci_dev *from)
  * @device: PCI device id to match, or %PCI_ANY_ID to match all device ids
  * @from: Previous PCI device found in search, or %NULL for new search.
  *
- * Iterates through the list of known PCI devices in the reverse order of pci_find_device().
+ * Iterates through the list of known PCI devices in the reverse order of
+ * pci_find_device().
  * If a PCI device is found with a matching @vendor and @device, a pointer to
  * its device structure is returned.  Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
- * Otherwise if @from is not %NULL, searches continue from previous device on the global list.
+ * A new search is initiated by passing %NULL as the @from argument.
+ * Otherwise if @from is not %NULL, searches continue from previous device
+ * on the global list.
  */
 struct pci_dev *
 pci_find_device_reverse(unsigned int vendor, unsigned int device, const struct pci_dev *from)
@@ -317,7 +321,7 @@ exit:
  * found with a matching @class, the reference count to the device is
  * incremented and a pointer to its device structure is returned.
  * Otherwise, %NULL is returned.
- * A new search is initiated by passing %NULL to the @from argument.
+ * A new search is initiated by passing %NULL as the @from argument.
  * Otherwise if @from is not %NULL, searches continue from next device
  * on the global list.  The reference count for @from is always decremented
  * if it is not %NULL.
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 738b1ef595a3..9ad18e62658d 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -601,12 +601,8 @@ static int ds_ioctl(struct inode * inode, struct file * file,
             ret = CS_BAD_ARGS;
         else {
             struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->config.Function);
-            if (p_dev == NULL)
-                    ret = CS_BAD_ARGS;
-            else {
-                    ret = pccard_get_configuration_info(s, p_dev, &buf->config);
-                    pcmcia_put_dev(p_dev);
-            }
+            ret = pccard_get_configuration_info(s, p_dev, &buf->config);
+            pcmcia_put_dev(p_dev);
         }
         break;
     case DS_GET_FIRST_TUPLE:
@@ -636,12 +632,8 @@ static int ds_ioctl(struct inode * inode, struct file * file,
                     ret = CS_BAD_ARGS;
             else {
                     struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->status.Function);
-                    if (p_dev == NULL)
-                            ret = CS_BAD_ARGS;
-                    else {
-                            ret = pccard_get_status(s, p_dev, &buf->status);
-                            pcmcia_put_dev(p_dev);
-                    }
+                    ret = pccard_get_status(s, p_dev, &buf->status);
+                    pcmcia_put_dev(p_dev);
             }
             break;
     case DS_VALIDATE_CIS:
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 7bf25b88ea31..c8323399e9e4 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -245,10 +245,17 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
                 return CS_SUCCESS;
         }
 
-        /* !!! This is a hack !!! */
-        memcpy(&config->Attributes, &c->Attributes, sizeof(config_t));
-        config->Attributes |= CONF_VALID_CLIENT;
-        config->CardValues = c->CardValues;
+        config->Attributes = c->Attributes | CONF_VALID_CLIENT;
+        config->Vcc = s->socket.Vcc;
+        config->Vpp1 = config->Vpp2 = s->socket.Vpp;
+        config->IntType = c->IntType;
+        config->ConfigBase = c->ConfigBase;
+        config->Status = c->Status;
+        config->Pin = c->Pin;
+        config->Copy = c->Copy;
+        config->Option = c->Option;
+        config->ExtStatus = c->ExtStatus;
+        config->Present = config->CardValues = c->CardValues;
         config->IRQAttributes = c->irq.Attributes;
         config->AssignedIRQ = s->irq.AssignedIRQ;
         config->BasePort1 = c->io.BasePort1;
diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c
index b154b3f52cbe..551f58e29810 100644
--- a/drivers/pnp/pnpbios/core.c
+++ b/drivers/pnp/pnpbios/core.c
@@ -346,7 +346,7 @@ static int insert_device(struct pnp_dev *dev, struct pnp_bios_node * node)
         dev->flags = node->flags;
         if (!(dev->flags & PNPBIOS_NO_CONFIG))
                 dev->capabilities |= PNP_CONFIGURABLE;
-        if (!(dev->flags & PNPBIOS_NO_DISABLE))
+        if (!(dev->flags & PNPBIOS_NO_DISABLE) && pnpbios_is_dynamic(dev))
                 dev->capabilities |= PNP_DISABLE;
         dev->capabilities |= PNP_READ;
         if (pnpbios_is_dynamic(dev))
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index f26a2ee3aad8..3cba6c9fab11 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -152,7 +152,6 @@ ccwgroup_create(struct device *root,
         struct ccwgroup_device *gdev;
         int i;
         int rc;
-        int del_drvdata;
 
         if (argc > 256) /* disallow dumb users */
                 return -EINVAL;
@@ -163,7 +162,6 @@ ccwgroup_create(struct device *root,
 
         atomic_set(&gdev->onoff, 0);
 
-        del_drvdata = 0;
         for (i = 0; i < argc; i++) {
                 gdev->cdev[i] = get_ccwdev_by_busid(cdrv, argv[i]);
 
@@ -180,10 +178,8 @@ ccwgroup_create(struct device *root,
                         rc = -EINVAL;
                         goto free_dev;
                 }
-        }
-        for (i = 0; i < argc; i++)
                 gdev->cdev[i]->dev.driver_data = gdev;
-        del_drvdata = 1;
+        }
 
         gdev->creator_id = creator_id;
         gdev->count = argc;
@@ -226,9 +222,9 @@ error:
 free_dev:
         for (i = 0; i < argc; i++)
                 if (gdev->cdev[i]) {
-                        put_device(&gdev->cdev[i]->dev);
-                        if (del_drvdata)
+                        if (gdev->cdev[i]->dev.driver_data == gdev)
                                 gdev->cdev[i]->dev.driver_data = NULL;
+                        put_device(&gdev->cdev[i]->dev);
                 }
         kfree(gdev);
         return rc;
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index ac6e0c7e43d9..7a39e0b0386c 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -152,7 +152,8 @@ ccw_device_cancel_halt_clear(struct ccw_device *cdev)
                 if (cdev->private->iretry) {
                         cdev->private->iretry--;
                         ret = cio_halt(sch);
-                        return (ret == 0) ? -EBUSY : ret;
+                        if (ret != -EBUSY)
+                                return (ret == 0) ? -EBUSY : ret;
                 }
                 /* halt io unsuccessful. */
                 cdev->private->iretry = 255;    /* 255 clear retries. */
diff --git a/drivers/scsi/NCR53C9x.c b/drivers/scsi/NCR53C9x.c
index 085db4826e0e..bdc6bb262bce 100644
--- a/drivers/scsi/NCR53C9x.c
+++ b/drivers/scsi/NCR53C9x.c
@@ -2152,29 +2152,23 @@ static int esp_do_data_finale(struct NCR_ESP *esp,
  */
 static int esp_should_clear_sync(Scsi_Cmnd *sp)
 {
-        unchar cmd1 = sp->cmnd[0];
-        unchar cmd2 = sp->data_cmnd[0];
+        unchar cmd = sp->cmnd[0];
 
         /* These cases are for spinning up a disk and
          * waiting for that spinup to complete.
          */
-        if(cmd1 == START_STOP ||
-           cmd2 == START_STOP)
+        if(cmd == START_STOP)
                 return 0;
 
-        if(cmd1 == TEST_UNIT_READY ||
-           cmd2 == TEST_UNIT_READY)
+        if(cmd == TEST_UNIT_READY)
                 return 0;
 
         /* One more special case for SCSI tape drives,
          * this is what is used to probe the device for
          * completion of a rewind or tape load operation.
          */
-        if(sp->device->type == TYPE_TAPE) {
-                if(cmd1 == MODE_SENSE ||
-                   cmd2 == MODE_SENSE)
-                        return 0;
-        }
+        if(sp->device->type == TYPE_TAPE && cmd == MODE_SENSE)
+                return 0;
 
         return 1;
 }
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index 3e1053f111dc..4cf7afc31cc7 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2427,7 +2427,7 @@ int fas216_eh_abort(Scsi_Cmnd *SCpnt)
         info->stats.aborts += 1;
 
         printk(KERN_WARNING "scsi%d: abort command ", info->host->host_no);
-        __scsi_print_command(SCpnt->data_cmnd);
+        __scsi_print_command(SCpnt->cmnd);
 
         print_debug_list();
         fas216_dumpstate(info);
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
index eaf64c7e54e7..98bd22714d0d 100644
--- a/drivers/scsi/esp.c
+++ b/drivers/scsi/esp.c
@@ -2754,18 +2754,15 @@ static int esp_do_data_finale(struct esp *esp)
  */
 static int esp_should_clear_sync(struct scsi_cmnd *sp)
 {
-        u8 cmd1 = sp->cmnd[0];
-        u8 cmd2 = sp->data_cmnd[0];
+        u8 cmd = sp->cmnd[0];
 
         /* These cases are for spinning up a disk and
          * waiting for that spinup to complete.
          */
-        if (cmd1 == START_STOP ||
-            cmd2 == START_STOP)
+        if (cmd == START_STOP)
                 return 0;
 
-        if (cmd1 == TEST_UNIT_READY ||
-            cmd2 == TEST_UNIT_READY)
+        if (cmd == TEST_UNIT_READY)
                 return 0;
 
         /* One more special case for SCSI tape drives,
@@ -2773,8 +2770,7 @@ static int esp_should_clear_sync(struct scsi_cmnd *sp)
          * completion of a rewind or tape load operation.
          */
         if (sp->device->type == TYPE_TAPE) {
-                if (cmd1 == MODE_SENSE ||
-                    cmd2 == MODE_SENSE)
+                if (cmd == MODE_SENSE)
                         return 0;
         }
 
diff --git a/drivers/scsi/libata-eh.c b/drivers/scsi/libata-eh.c
index 4b6aa30f4d68..29f59345305d 100644
--- a/drivers/scsi/libata-eh.c
+++ b/drivers/scsi/libata-eh.c
@@ -764,12 +764,27 @@ static void ata_eh_about_to_do(struct ata_port *ap, struct ata_device *dev,
                                unsigned int action)
 {
         unsigned long flags;
+        struct ata_eh_info *ehi = &ap->eh_info;
+        struct ata_eh_context *ehc = &ap->eh_context;
 
         spin_lock_irqsave(ap->lock, flags);
 
-        ata_eh_clear_action(dev, &ap->eh_info, action);
+        /* Reset is represented by combination of actions and EHI
+         * flags.  Suck in all related bits before clearing eh_info to
+         * avoid losing requested action.
+         */
+        if (action & ATA_EH_RESET_MASK) {
+                ehc->i.action |= ehi->action & ATA_EH_RESET_MASK;
+                ehc->i.flags |= ehi->flags & ATA_EHI_RESET_MODIFIER_MASK;
+
+                /* make sure all reset actions are cleared & clear EHI flags */
+                action |= ATA_EH_RESET_MASK;
+                ehi->flags &= ~ATA_EHI_RESET_MODIFIER_MASK;
+        }
+
+        ata_eh_clear_action(dev, ehi, action);
 
-        if (!(ap->eh_context.i.flags & ATA_EHI_QUIET))
+        if (!(ehc->i.flags & ATA_EHI_QUIET))
                 ap->pflags |= ATA_PFLAG_RECOVERED;
 
         spin_unlock_irqrestore(ap->lock, flags);
@@ -790,6 +805,12 @@ static void ata_eh_about_to_do(struct ata_port *ap, struct ata_device *dev,
 static void ata_eh_done(struct ata_port *ap, struct ata_device *dev,
                         unsigned int action)
 {
+        /* if reset is complete, clear all reset actions & reset modifier */
+        if (action & ATA_EH_RESET_MASK) {
+                action |= ATA_EH_RESET_MASK;
+                ap->eh_context.i.flags &= ~ATA_EHI_RESET_MODIFIER_MASK;
+        }
+
         ata_eh_clear_action(dev, &ap->eh_context.i, action);
 }
 
@@ -1276,8 +1297,6 @@ static int ata_eh_speed_down(struct ata_device *dev, int is_io,
 static void ata_eh_autopsy(struct ata_port *ap)
 {
         struct ata_eh_context *ehc = &ap->eh_context;
-        unsigned int action = ehc->i.action;
-        struct ata_device *failed_dev = NULL;
         unsigned int all_err_mask = 0;
         int tag, is_io = 0;
         u32 serror;
@@ -1294,7 +1313,7 @@ static void ata_eh_autopsy(struct ata_port *ap)
                 ehc->i.serror |= serror;
                 ata_eh_analyze_serror(ap);
         } else if (rc != -EOPNOTSUPP)
-                action |= ATA_EH_HARDRESET;
+                ehc->i.action |= ATA_EH_HARDRESET;
 
         /* analyze NCQ failure */
         ata_eh_analyze_ncq_error(ap);
@@ -1315,7 +1334,7 @@ static void ata_eh_autopsy(struct ata_port *ap)
                 qc->err_mask |= ehc->i.err_mask;
 
                 /* analyze TF */
-                action |= ata_eh_analyze_tf(qc, &qc->result_tf);
+                ehc->i.action |= ata_eh_analyze_tf(qc, &qc->result_tf);
 
                 /* DEV errors are probably spurious in case of ATA_BUS error */
                 if (qc->err_mask & AC_ERR_ATA_BUS)
@@ -1329,11 +1348,11 @@ static void ata_eh_autopsy(struct ata_port *ap)
                 /* SENSE_VALID trumps dev/unknown error and revalidation */
                 if (qc->flags & ATA_QCFLAG_SENSE_VALID) {
                         qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
-                        action &= ~ATA_EH_REVALIDATE;
+                        ehc->i.action &= ~ATA_EH_REVALIDATE;
                 }
 
                 /* accumulate error info */
-                failed_dev = qc->dev;
+                ehc->i.dev = qc->dev;
                 all_err_mask |= qc->err_mask;
                 if (qc->flags & ATA_QCFLAG_IO)
                         is_io = 1;
@@ -1342,25 +1361,22 @@ static void ata_eh_autopsy(struct ata_port *ap)
         /* enforce default EH actions */
         if (ap->pflags & ATA_PFLAG_FROZEN ||
             all_err_mask & (AC_ERR_HSM | AC_ERR_TIMEOUT))
-                action |= ATA_EH_SOFTRESET;
+                ehc->i.action |= ATA_EH_SOFTRESET;
         else if (all_err_mask)
-                action |= ATA_EH_REVALIDATE;
+                ehc->i.action |= ATA_EH_REVALIDATE;
 
         /* if we have offending qcs and the associated failed device */
-        if (failed_dev) {
+        if (ehc->i.dev) {
                 /* speed down */
-                action |= ata_eh_speed_down(failed_dev, is_io, all_err_mask);
+                ehc->i.action |= ata_eh_speed_down(ehc->i.dev, is_io,
+                                                   all_err_mask);
 
                 /* perform per-dev EH action only on the offending device */
-                ehc->i.dev_action[failed_dev->devno] |=
-                        action & ATA_EH_PERDEV_MASK;
-                action &= ~ATA_EH_PERDEV_MASK;
+                ehc->i.dev_action[ehc->i.dev->devno] |=
+                        ehc->i.action & ATA_EH_PERDEV_MASK;
+                ehc->i.action &= ~ATA_EH_PERDEV_MASK;
         }
 
-        /* record autopsy result */
-        ehc->i.dev = failed_dev;
-        ehc->i.action |= action;
-
         DPRINTK("EXIT\n");
 }
 
@@ -1483,6 +1499,9 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
         ata_reset_fn_t reset;
         int i, did_followup_srst, rc;
 
+        /* about to reset */
+        ata_eh_about_to_do(ap, NULL, ehc->i.action & ATA_EH_RESET_MASK);
+
         /* Determine which reset to use and record in ehc->i.action.
          * prereset() may examine and modify it.
          */
@@ -1531,8 +1550,7 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
                 ata_port_printk(ap, KERN_INFO, "%s resetting port\n",
                                 reset == softreset ? "soft" : "hard");
 
-        /* reset */
-        ata_eh_about_to_do(ap, NULL, ATA_EH_RESET_MASK);
+        /* mark that this EH session started with reset */
         ehc->i.flags |= ATA_EHI_DID_RESET;
 
         rc = ata_do_reset(ap, reset, classes);
@@ -1595,7 +1613,7 @@ static int ata_eh_reset(struct ata_port *ap, int classify,
                         postreset(ap, classes);
 
                 /* reset successful, schedule revalidation */
-                ata_eh_done(ap, NULL, ATA_EH_RESET_MASK);
+                ata_eh_done(ap, NULL, ehc->i.action & ATA_EH_RESET_MASK);
                 ehc->i.action |= ATA_EH_REVALIDATE;
         }
 
@@ -1848,15 +1866,16 @@ static int ata_eh_skip_recovery(struct ata_port *ap)
         for (i = 0; i < ata_port_max_devices(ap); i++) {
                 struct ata_device *dev = &ap->device[i];
 
-                if (ata_dev_absent(dev) || ata_dev_ready(dev))
+                if (!(dev->flags & ATA_DFLAG_SUSPENDED))
                         break;
         }
 
         if (i == ata_port_max_devices(ap))
                 return 1;
 
-        /* always thaw frozen port and recover failed devices */
-        if (ap->pflags & ATA_PFLAG_FROZEN || ata_port_nr_enabled(ap))
+        /* thaw frozen port, resume link and recover failed devices */
+        if ((ap->pflags & ATA_PFLAG_FROZEN) ||
+            (ehc->i.flags & ATA_EHI_RESUME_LINK) || ata_port_nr_enabled(ap))
                 return 0;
 
         /* skip if class codes for all vacant slots are ATA_DEV_NONE */
diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index 64631bd38952..4776f4e55839 100644
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -269,8 +269,15 @@ static const struct pci_device_id pdc_ata_pci_tbl[] = {
         { PCI_VENDOR_ID_PROMISE, 0x6629, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_20619 },
 
+/* TODO: remove all associated board_20771 code, as it completely
+ * duplicates board_2037x code, unless reason for separation can be
+ * divined.
+ */
+#if 0
         { PCI_VENDOR_ID_PROMISE, 0x3570, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_20771 },
+#endif
+
         { }     /* terminate list */
 };
 
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index a89c4115cfba..32293f451669 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -110,11 +110,8 @@ static int ioctl_internal_command(struct scsi_device *sdev, char *cmd,
                                        sshdr.asc, sshdr.ascq);
                         break;
                 case NOT_READY: /* This happens if there is no disc in drive */
-                        if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) {
-                                printk(KERN_INFO "Device not ready. Make sure"
-                                       " there is a disc in the drive.\n");
+                        if (sdev->removable)
                                 break;
-                        }
                 case UNIT_ATTENTION:
                         if (sdev->removable) {
                                 sdev->changed = 1;
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 6533b0f39231..c40b9b8b1e7e 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -86,9 +86,11 @@ config FB_MACMODES
        default n
 
 config FB_BACKLIGHT
-       bool
-       depends on FB
-       default n
+        bool
+        depends on FB
+        select BACKLIGHT_LCD_SUPPORT
+        select BACKLIGHT_CLASS_DEVICE
+        default n
 
 config FB_MODE_HELPERS
         bool "Enable Video Mode Handling Helpers"
@@ -420,7 +422,7 @@ config FB_OF
 
 config FB_CONTROL
         bool "Apple \"control\" display support"
-        depends on (FB = y) && PPC_PMAC
+        depends on (FB = y) && PPC_PMAC && PPC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -431,7 +433,7 @@ config FB_CONTROL
 
 config FB_PLATINUM
         bool "Apple \"platinum\" display support"
-        depends on (FB = y) && PPC_PMAC
+        depends on (FB = y) && PPC_PMAC && PPC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -442,7 +444,7 @@ config FB_PLATINUM
 
 config FB_VALKYRIE
         bool "Apple \"valkyrie\" display support"
-        depends on (FB = y) && (MAC || PPC_PMAC)
+        depends on (FB = y) && (MAC || (PPC_PMAC && PPC32))
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -453,7 +455,7 @@ config FB_VALKYRIE
 
 config FB_CT65550
         bool "Chips 65550 display support"
-        depends on (FB = y) && PPC
+        depends on (FB = y) && PPC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -721,10 +723,8 @@ config FB_NVIDIA_I2C
 
 config FB_NVIDIA_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_NVIDIA && PPC_PMAC
+        depends on FB_NVIDIA && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -769,10 +769,8 @@ config FB_RIVA_DEBUG
 
 config FB_RIVA_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_RIVA && PPC_PMAC
+        depends on FB_RIVA && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1025,10 +1023,8 @@ config FB_RADEON_I2C
 
 config FB_RADEON_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_RADEON && PPC_PMAC
+        depends on FB_RADEON && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1059,10 +1055,8 @@ config FB_ATY128
 
 config FB_ATY128_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_ATY128 && PPC_PMAC
+        depends on FB_ATY128 && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1111,10 +1105,8 @@ config FB_ATY_GX
 
 config FB_ATY_BACKLIGHT
         bool "Support for backlight control"
-        depends on FB_ATY && PPC_PMAC
+        depends on FB_ATY && PMAC_BACKLIGHT
         select FB_BACKLIGHT
-        select BACKLIGHT_LCD_SUPPORT
-        select BACKLIGHT_CLASS_DEVICE
         default y
         help
           Say Y here if you want to control the backlight of your display.
@@ -1620,7 +1612,7 @@ if FB || SGI_NEWPORT_CONSOLE
         source "drivers/video/logo/Kconfig"
 endif
 
-if FB && SYSFS
+if SYSFS
         source "drivers/video/backlight/Kconfig"
 endif
 
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 95563c9c6b9c..481c6c9695f8 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -4,6 +4,7 @@
 
 # Each configuration option enables a list of files.
 
+obj-y                             += fb_notify.o
 obj-$(CONFIG_FB)                  += fb.o
 fb-y                              := fbmem.o fbmon.o fbcmap.o fbsysfs.o \
                                      modedb.o fbcvt.o
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index c64a717e2d4b..8b08121b390b 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -455,7 +455,10 @@ static void do_wait_for_fifo(u16 entries, struct aty128fb_par *par);
 static void wait_for_fifo(u16 entries, struct aty128fb_par *par);
 static void wait_for_idle(struct aty128fb_par *par);
 static u32 depth_to_dst(u32 depth);
+
+#ifdef CONFIG_FB_ATY128_BACKLIGHT
 static void aty128_bl_set_power(struct fb_info *info, int power);
+#endif
 
 #define BIOS_IN8(v)     (readb(bios + (v)))
 #define BIOS_IN16(v)    (readb(bios + (v)) | \
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index 1507d19f481f..053ff63365b7 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -2812,7 +2812,7 @@ static int atyfb_blank(int blank, struct fb_info *info)
         if (par->lock_blank || par->asleep)
                 return 0;
 
-#ifdef CONFIG_PMAC_BACKLIGHT
+#ifdef CONFIG_FB_ATY_BACKLIGHT
         if (machine_is(powermac) && blank > FB_BLANK_NORMAL)
                 aty_bl_set_power(info, FB_BLANK_POWERDOWN);
 #elif defined(CONFIG_FB_ATY_GENERIC_LCD)
@@ -2844,7 +2844,7 @@ static int atyfb_blank(int blank, struct fb_info *info)
         }
         aty_st_le32(CRTC_GEN_CNTL, gen_cntl, par);
 
-#ifdef CONFIG_PMAC_BACKLIGHT
+#ifdef CONFIG_FB_ATY_BACKLIGHT
         if (machine_is(powermac) && blank <= FB_BLANK_NORMAL)
                 aty_bl_set_power(info, FB_BLANK_UNBLANK);
 #elif defined(CONFIG_FB_ATY_GENERIC_LCD)
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 8d85fc58142e..8e3400d5dd21 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -266,6 +266,8 @@ static int force_measure_pll = 0;
 #ifdef CONFIG_MTRR
 static int nomtrr = 0;
 #endif
+static int force_sleep;
+static int ignore_devlist;
 
 /*
  * prototypes
@@ -2327,9 +2329,9 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
                 /* -2 is special: means  ON on mobility chips and do not
                  * change on others
                  */
-                radeonfb_pm_init(rinfo, rinfo->is_mobility ? 1 : -1);
+                radeonfb_pm_init(rinfo, rinfo->is_mobility ? 1 : -1, ignore_devlist, force_sleep);
         } else
-                radeonfb_pm_init(rinfo, default_dynclk);
+                radeonfb_pm_init(rinfo, default_dynclk, ignore_devlist, force_sleep);
 
         pci_set_drvdata(pdev, info);
 
@@ -2477,6 +2479,12 @@ static int __init radeonfb_setup (char *options)
                         force_measure_pll = 1;
                 } else if (!strncmp(this_opt, "ignore_edid", 11)) {
                         ignore_edid = 1;
+#if defined(CONFIG_PM) && defined(CONFIG_X86)
+                } else if (!strncmp(this_opt, "force_sleep", 11)) {
+                        force_sleep = 1;
+                } else if (!strncmp(this_opt, "ignore_devlist", 14)) {
+                        ignore_devlist = 1;
+#endif
                 } else
                         mode_option = this_opt;
         }
@@ -2532,3 +2540,9 @@ module_param(panel_yres, int, 0);
 MODULE_PARM_DESC(panel_yres, "int: set panel yres");
 module_param(mode_option, charp, 0);
 MODULE_PARM_DESC(mode_option, "Specify resolution as \"<xres>x<yres>[-<bpp>][@<refresh>]\" ");
+#if defined(CONFIG_PM) && defined(CONFIG_X86)
+module_param(force_sleep, bool, 0);
+MODULE_PARM_DESC(force_sleep, "bool: force D2 sleep mode on all hardware");
+module_param(ignore_devlist, bool, 0);
+MODULE_PARM_DESC(ignore_devlist, "bool: ignore workarounds for bugs in specific laptops");
+#endif
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index c7091761cef4..f31e606a2ded 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -27,6 +27,99 @@
 
 #include "ati_ids.h"
 
+static void radeon_reinitialize_M10(struct radeonfb_info *rinfo);
+
+/*
+ * Workarounds for bugs in PC laptops:
+ * - enable D2 sleep in some IBM Thinkpads
+ * - special case for Samsung P35
+ *
+ * Whitelist by subsystem vendor/device because
+ * its the subsystem vendor's fault!
+ */
+
+#if defined(CONFIG_PM) && defined(CONFIG_X86)
+struct radeon_device_id {
+        const char *ident;                     /* (arbitrary) Name */
+        const unsigned short subsystem_vendor; /* Subsystem Vendor ID */
+        const unsigned short subsystem_device; /* Subsystem Device ID */
+        const enum radeon_pm_mode pm_mode_modifier; /* modify pm_mode */
+        const reinit_function_ptr new_reinit_func;   /* changed reinit_func */
+};
+
+#define BUGFIX(model, sv, sd, pm, fn) { \
+        .ident = model, \
+        .subsystem_vendor = sv, \
+        .subsystem_device = sd, \
+        .pm_mode_modifier = pm, \
+        .new_reinit_func  = fn  \
+}
+
+static struct radeon_device_id radeon_workaround_list[] = {
+        BUGFIX("IBM Thinkpad R32",
+               PCI_VENDOR_ID_IBM, 0x1905,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R40",
+               PCI_VENDOR_ID_IBM, 0x0526,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R40",
+               PCI_VENDOR_ID_IBM, 0x0527,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R50/R51/T40/T41",
+               PCI_VENDOR_ID_IBM, 0x0531,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad R51/T40/T41/T42",
+               PCI_VENDOR_ID_IBM, 0x0530,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad T30",
+               PCI_VENDOR_ID_IBM, 0x0517,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad T40p",
+               PCI_VENDOR_ID_IBM, 0x054d,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad T42",
+               PCI_VENDOR_ID_IBM, 0x0550,
+               radeon_pm_d2, NULL),
+        BUGFIX("IBM Thinkpad X31/X32",
+               PCI_VENDOR_ID_IBM, 0x052f,
+               radeon_pm_d2, NULL),
+        BUGFIX("Samsung P35",
+               PCI_VENDOR_ID_SAMSUNG, 0xc00c,
+               radeon_pm_off, radeon_reinitialize_M10),
+        { .ident = NULL }
+};
+
+static int radeon_apply_workarounds(struct radeonfb_info *rinfo)
+{
+        struct radeon_device_id *id;
+
+        for (id = radeon_workaround_list; id->ident != NULL; id++ )
+                if ((id->subsystem_vendor == rinfo->pdev->subsystem_vendor ) &&
+                    (id->subsystem_device == rinfo->pdev->subsystem_device )) {
+
+                        /* we found a device that requires workaround */
+                        printk(KERN_DEBUG "radeonfb: %s detected"
+                               ", enabling workaround\n", id->ident);
+
+                        rinfo->pm_mode |= id->pm_mode_modifier;
+
+                        if (id->new_reinit_func != NULL)
+                                rinfo->reinit_func = id->new_reinit_func;
+
+                        return 1;
+                }
+        return 0;  /* not found */
+}
+
+#else  /* defined(CONFIG_PM) && defined(CONFIG_X86) */
+static inline int radeon_apply_workarounds(struct radeonfb_info *rinfo)
+{
+        return 0;
+}
+#endif /* defined(CONFIG_PM) && defined(CONFIG_X86) */
+
+
+
 static void radeon_pm_disable_dynamic_mode(struct radeonfb_info *rinfo)
 {
         u32 tmp;
@@ -852,18 +945,26 @@ static void radeon_pm_setup_for_suspend(struct radeonfb_info *rinfo)
         /* because both INPLL and OUTPLL take the same lock, that's why. */
         tmp = INPLL( pllMCLK_MISC) | MCLK_MISC__EN_MCLK_TRISTATE_IN_SUSPEND;
         OUTPLL( pllMCLK_MISC, tmp);
-        
-        /* AGP PLL control */
-        if (rinfo->family <= CHIP_FAMILY_RV280) {
-                OUTREG(BUS_CNTL1, INREG(BUS_CNTL1) |  BUS_CNTL1__AGPCLK_VALID);
 
-                OUTREG(BUS_CNTL1,
-                       (INREG(BUS_CNTL1) & ~BUS_CNTL1__MOBILE_PLATFORM_SEL_MASK)
-                       | (2<<BUS_CNTL1__MOBILE_PLATFORM_SEL__SHIFT));   // 440BX
-        } else {
-                OUTREG(BUS_CNTL1, INREG(BUS_CNTL1));
-                OUTREG(BUS_CNTL1, (INREG(BUS_CNTL1) & ~0x4000) | 0x8000);
+        /* BUS_CNTL1__MOBILE_PLATORM_SEL setting is northbridge chipset
+         * and radeon chip dependent. Thus we only enable it on Mac for
+         * now (until we get more info on how to compute the correct
+         * value for various X86 bridges).
+         */
+#ifdef CONFIG_PPC_PMAC
+        if (machine_is(powermac)) {
+                /* AGP PLL control */
+                if (rinfo->family <= CHIP_FAMILY_RV280) {
+                        OUTREG(BUS_CNTL1, INREG(BUS_CNTL1) |  BUS_CNTL1__AGPCLK_VALID);
+                        OUTREG(BUS_CNTL1,
+                               (INREG(BUS_CNTL1) & ~BUS_CNTL1__MOBILE_PLATFORM_SEL_MASK)
+                               | (2<<BUS_CNTL1__MOBILE_PLATFORM_SEL__SHIFT));   // 440BX
+                } else {
+                        OUTREG(BUS_CNTL1, INREG(BUS_CNTL1));
+                        OUTREG(BUS_CNTL1, (INREG(BUS_CNTL1) & ~0x4000) | 0x8000);
+                }
         }
+#endif
 
         OUTREG(CRTC_OFFSET_CNTL, (INREG(CRTC_OFFSET_CNTL)
                                   & ~CRTC_OFFSET_CNTL__CRTC_STEREO_SYNC_OUT_EN));
@@ -2713,7 +2814,7 @@ static void radeonfb_early_resume(void *data)
 
 #endif /* CONFIG_PM */
 
-void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
+void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlist, int force_sleep)
 {
         /* Find PM registers in config space if any*/
         rinfo->pm_reg = pci_find_capability(rinfo->pdev, PCI_CAP_ID_PM);
@@ -2729,22 +2830,13 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
         }
 
 #if defined(CONFIG_PM)
+#if defined(CONFIG_PPC_PMAC)
         /* Check if we can power manage on suspend/resume. We can do
          * D2 on M6, M7 and M9, and we can resume from D3 cold a few other
          * "Mac" cards, but that's all. We need more infos about what the
          * BIOS does tho. Right now, all this PM stuff is pmac-only for that
          * reason. --BenH
          */
-        /* Special case for Samsung P35 laptops
-         */
-        if ((rinfo->pdev->vendor == PCI_VENDOR_ID_ATI) &&
-            (rinfo->pdev->device == PCI_CHIP_RV350_NP) &&
-            (rinfo->pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG) &&
-            (rinfo->pdev->subsystem_device == 0xc00c)) {
-                rinfo->reinit_func = radeon_reinitialize_M10;
-                rinfo->pm_mode |= radeon_pm_off;
-        }
-#if defined(CONFIG_PPC_PMAC)
         if (machine_is(powermac) && rinfo->of_node) {
                 if (rinfo->is_mobility && rinfo->pm_reg &&
                     rinfo->family <= CHIP_FAMILY_RV250)
@@ -2790,6 +2882,18 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
         }
 #endif /* defined(CONFIG_PPC_PMAC) */
 #endif /* defined(CONFIG_PM) */
+
+        if (ignore_devlist)
+                printk(KERN_DEBUG
+                       "radeonfb: skipping test for device workarounds\n");
+        else
+                radeon_apply_workarounds(rinfo);
+
+        if (force_sleep) {
+                printk(KERN_DEBUG
+                       "radeonfb: forcefully enabling D2 sleep mode\n");
+                rinfo->pm_mode |= radeon_pm_d2;
+        }
 }
 
 void radeonfb_pm_exit(struct radeonfb_info *rinfo)
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index 38657b2d10eb..d5ff224a6258 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -273,6 +273,8 @@ enum radeon_pm_mode {
         radeon_pm_off   = 0x00000002,   /* Can resume from D3 cold */
 };
 
+typedef void (*reinit_function_ptr)(struct radeonfb_info *rinfo);
+
 struct radeonfb_info {
         struct fb_info          *info;
 
@@ -338,7 +340,7 @@ struct radeonfb_info {
         int                     dynclk;
         int                     no_schedule;
         enum radeon_pm_mode     pm_mode;
-        void                    (*reinit_func)(struct radeonfb_info *rinfo);
+        reinit_function_ptr     reinit_func;
 
         /* Lock on register access */
         spinlock_t              reg_lock;
@@ -600,7 +602,7 @@ extern int radeon_probe_i2c_connector(struct radeonfb_info *rinfo, int conn, u8
 /* PM Functions */
 extern int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t state);
 extern int radeonfb_pci_resume(struct pci_dev *pdev);
-extern void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk);
+extern void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlist, int force_sleep);
 extern void radeonfb_pm_exit(struct radeonfb_info *rinfo);
 
 /* Monitor probe functions */
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index 022f9d3473f5..02f15297a021 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -10,7 +10,7 @@ menuconfig BACKLIGHT_LCD_SUPPORT
 
 config BACKLIGHT_CLASS_DEVICE
         tristate "Lowlevel Backlight controls"
-        depends on BACKLIGHT_LCD_SUPPORT && FB
+        depends on BACKLIGHT_LCD_SUPPORT
         default m
         help
           This framework adds support for low-level control of the LCD
@@ -26,7 +26,7 @@ config BACKLIGHT_DEVICE
 
 config LCD_CLASS_DEVICE
         tristate "Lowlevel LCD controls"
-        depends on BACKLIGHT_LCD_SUPPORT && FB
+        depends on BACKLIGHT_LCD_SUPPORT
         default m
         help
           This framework adds support for low-level control of LCD.
diff --git a/drivers/video/console/mdacon.c b/drivers/video/console/mdacon.c
index 52ed12b12acc..eb4d03fa5391 100644
--- a/drivers/video/console/mdacon.c
+++ b/drivers/video/console/mdacon.c
@@ -197,7 +197,7 @@ static int __init mdacon_setup(char *str)
 __setup("mdacon=", mdacon_setup);
 #endif
 
-static int __init mda_detect(void)
+static int mda_detect(void)
 {
         int count=0;
         u16 *p, p_save;
@@ -282,7 +282,7 @@ static int __init mda_detect(void)
         return 1;
 }
 
-static void __init mda_initialize(void)
+static void mda_initialize(void)
 {
         write_mda_b(97, 0x00);          /* horizontal total */
         write_mda_b(80, 0x01);          /* horizontal displayed */
diff --git a/drivers/video/fb_notify.c b/drivers/video/fb_notify.c
new file mode 100644
index 000000000000..8c020389e4fa
--- /dev/null
+++ b/drivers/video/fb_notify.c
@@ -0,0 +1,46 @@
+/*
+ *  linux/drivers/video/fb_notify.c
+ *
+ *  Copyright (C) 2006 Antonino Daplas <adaplas@pol.net>
+ *
+ *      2001 - Documented with DocBook
+ *      - Brad Douglas <brad@neruo.com>
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+#include <linux/fb.h>
+#include <linux/notifier.h>
+
+static BLOCKING_NOTIFIER_HEAD(fb_notifier_list);
+
+/**
+ *      fb_register_client - register a client notifier
+ *      @nb: notifier block to callback on events
+ */
+int fb_register_client(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_register(&fb_notifier_list, nb);
+}
+EXPORT_SYMBOL(fb_register_client);
+
+/**
+ *      fb_unregister_client - unregister a client notifier
+ *      @nb: notifier block to callback on events
+ */
+int fb_unregister_client(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_unregister(&fb_notifier_list, nb);
+}
+EXPORT_SYMBOL(fb_unregister_client);
+
+/**
+ * fb_notifier_call_chain - notify clients of fb_events
+ *
+ */
+int fb_notifier_call_chain(unsigned long val, void *v)
+{
+        return blocking_notifier_call_chain(&fb_notifier_list, val, v);
+}
+EXPORT_SYMBOL_GPL(fb_notifier_call_chain);
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 4fc9df426c1a..17961e3ecaa0 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -52,7 +52,6 @@
 
 #define FBPIXMAPSIZE    (1024 * 8)
 
-static BLOCKING_NOTIFIER_HEAD(fb_notifier_list);
 struct fb_info *registered_fb[FB_MAX];
 int num_registered_fb;
 
@@ -791,8 +790,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 
                     event.info = info;
                     event.data = &mode1;
-                    ret = blocking_notifier_call_chain(&fb_notifier_list,
-                                              FB_EVENT_MODE_DELETE, &event);
+                    ret = fb_notifier_call_chain(FB_EVENT_MODE_DELETE, &event);
                 }
 
                 if (!ret)
@@ -837,8 +835,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 
                                 info->flags &= ~FBINFO_MISC_USEREVENT;
                                 event.info = info;
-                                blocking_notifier_call_chain(&fb_notifier_list,
-                                                evnt, &event);
+                                fb_notifier_call_chain(evnt, &event);
                         }
                 }
         }
@@ -861,8 +858,7 @@ fb_blank(struct fb_info *info, int blank)
 
                 event.info = info;
                 event.data = &blank;
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                FB_EVENT_BLANK, &event);
+                fb_notifier_call_chain(FB_EVENT_BLANK, &event);
         }
 
         return ret;
@@ -933,8 +929,7 @@ fb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                 con2fb.framebuffer = -1;
                 event.info = info;
                 event.data = &con2fb;
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                    FB_EVENT_GET_CONSOLE_MAP, &event);
+                fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
                 return copy_to_user(argp, &con2fb,
                                     sizeof(con2fb)) ? -EFAULT : 0;
         case FBIOPUT_CON2FBMAP:
@@ -952,9 +947,8 @@ fb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                     return -EINVAL;
                 event.info = info;
                 event.data = &con2fb;
-                return blocking_notifier_call_chain(&fb_notifier_list,
-                                           FB_EVENT_SET_CONSOLE_MAP,
-                                           &event);
+                return fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
+                                              &event);
         case FBIOBLANK:
                 acquire_console_sem();
                 info->flags |= FBINFO_MISC_USEREVENT;
@@ -1330,8 +1324,7 @@ register_framebuffer(struct fb_info *fb_info)
         registered_fb[i] = fb_info;
 
         event.info = fb_info;
-        blocking_notifier_call_chain(&fb_notifier_list,
-                            FB_EVENT_FB_REGISTERED, &event);
+        fb_notifier_call_chain(FB_EVENT_FB_REGISTERED, &event);
         return 0;
 }
 
@@ -1365,30 +1358,11 @@ unregister_framebuffer(struct fb_info *fb_info)
         fb_cleanup_class_device(fb_info);
         class_device_destroy(fb_class, MKDEV(FB_MAJOR, i));
         event.info = fb_info;
-        blocking_notifier_call_chain(&fb_notifier_list,
-                                     FB_EVENT_FB_UNREGISTERED, &event);
+        fb_notifier_call_chain(FB_EVENT_FB_UNREGISTERED, &event);
         return 0;
 }
 
 /**
- *      fb_register_client - register a client notifier
- *      @nb: notifier block to callback on events
- */
-int fb_register_client(struct notifier_block *nb)
-{
-        return blocking_notifier_chain_register(&fb_notifier_list, nb);
-}
-
-/**
- *      fb_unregister_client - unregister a client notifier
- *      @nb: notifier block to callback on events
- */
-int fb_unregister_client(struct notifier_block *nb)
-{
-        return blocking_notifier_chain_unregister(&fb_notifier_list, nb);
-}
-
-/**
  *      fb_set_suspend - low level driver signals suspend
  *      @info: framebuffer affected
  *      @state: 0 = resuming, !=0 = suspending
@@ -1403,13 +1377,11 @@ void fb_set_suspend(struct fb_info *info, int state)
 
         event.info = info;
         if (state) {
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                FB_EVENT_SUSPEND, &event);
+                fb_notifier_call_chain(FB_EVENT_SUSPEND, &event);
                 info->state = FBINFO_STATE_SUSPENDED;
         } else {
                 info->state = FBINFO_STATE_RUNNING;
-                blocking_notifier_call_chain(&fb_notifier_list,
-                                FB_EVENT_RESUME, &event);
+                fb_notifier_call_chain(FB_EVENT_RESUME, &event);
         }
 }
 
@@ -1480,9 +1452,7 @@ int fb_new_modelist(struct fb_info *info)
 
         if (!list_empty(&info->modelist)) {
                 event.info = info;
-                err = blocking_notifier_call_chain(&fb_notifier_list,
-                                           FB_EVENT_NEW_MODELIST,
-                                           &event);
+                err = fb_notifier_call_chain(FB_EVENT_NEW_MODELIST, &event);
         }
 
         return err;
@@ -1594,8 +1564,6 @@ EXPORT_SYMBOL(fb_blank);
 EXPORT_SYMBOL(fb_pan_display);
 EXPORT_SYMBOL(fb_get_buffer_offset);
 EXPORT_SYMBOL(fb_set_suspend);
-EXPORT_SYMBOL(fb_register_client);
-EXPORT_SYMBOL(fb_unregister_client);
 EXPORT_SYMBOL(fb_get_options);
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index 9f2066f0745a..d4f850117874 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -34,10 +34,6 @@
 #include "nv_proto.h"
 #include "nv_dma.h"
 
-#ifndef CONFIG_PCI              /* sanity check */
-#error This driver requires PCI support.
-#endif
-
 #undef CONFIG_FB_NVIDIA_DEBUG
 #ifdef CONFIG_FB_NVIDIA_DEBUG
 #define NVTRACE          printk
@@ -1303,20 +1299,19 @@ static int __devinit nvidiafb_probe(struct pci_dev *pd,
 
         nvidia_save_vga(par, &par->SavedReg);
 
+        pci_set_drvdata(pd, info);
+        nvidia_bl_init(par);
         if (register_framebuffer(info) < 0) {
                 printk(KERN_ERR PFX "error registering nVidia framebuffer\n");
                 goto err_out_iounmap_fb;
         }
 
-        pci_set_drvdata(pd, info);
 
         printk(KERN_INFO PFX
                "PCI nVidia %s framebuffer (%dMB @ 0x%lX)\n",
                info->fix.id,
                par->FbMapSize / (1024 * 1024), info->fix.smem_start);
 
-        nvidia_bl_init(par);
-
         NVTRACE_LEAVE();
         return 0;
 
diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
index 33dddbae5420..76fc9d355eb7 100644
--- a/drivers/video/riva/fbdev.c
+++ b/drivers/video/riva/fbdev.c
@@ -2132,6 +2132,9 @@ static int __devinit rivafb_probe(struct pci_dev *pd,
 
         fb_destroy_modedb(info->monspecs.modedb);
         info->monspecs.modedb = NULL;
+
+        pci_set_drvdata(pd, info);
+        riva_bl_init(info->par);
         ret = register_framebuffer(info);
         if (ret < 0) {
                 printk(KERN_ERR PFX
@@ -2139,8 +2142,6 @@ static int __devinit rivafb_probe(struct pci_dev *pd,
                 goto err_iounmap_screen_base;
         }
 
-        pci_set_drvdata(pd, info);
-
         printk(KERN_INFO PFX
                 "PCI nVidia %s framebuffer ver %s (%dMB @ 0x%lX)\n",
                 info->fix.id,
@@ -2148,8 +2149,6 @@ static int __devinit rivafb_probe(struct pci_dev *pd,
                 info->fix.smem_len / (1024 * 1024),
                 info->fix.smem_start);
 
-        riva_bl_init(info->par);
-
         NVTRACE_LEAVE();
         return 0;
 
diff --git a/fs/9p/conv.c b/fs/9p/conv.c
index 1e898144eb7c..56d88c1a09c5 100644
--- a/fs/9p/conv.c
+++ b/fs/9p/conv.c
@@ -673,8 +673,10 @@ struct v9fs_fcall *v9fs_create_tcreate(u32 fid, char *name, u32 perm, u8 mode,
         struct cbuf *bufp = &buffer;
 
         size = 4 + 2 + strlen(name) + 4 + 1;    /* fid[4] name[s] perm[4] mode[1] */
-        if (extended && extension!=NULL)
-                size += 2 + strlen(extension);  /* extension[s] */
+        if (extended) {
+                size += 2 +                     /* extension[s] */
+                    (extension == NULL ? 0 : strlen(extension));
+        }
 
         fc = v9fs_create_common(bufp, size, TCREATE);
         if (IS_ERR(fc))
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 2f580a197b8d..eae50c9d6dc4 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -434,11 +434,11 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         result = v9fs_t_remove(v9ses, fid, &fcall);
         if (result < 0) {
                 PRINT_FCALL_ERROR("remove fails", fcall);
-        } else {
-                v9fs_put_idpool(fid, &v9ses->fidpool);
-                v9fs_fid_destroy(v9fid);
         }
 
+        v9fs_put_idpool(fid, &v9ses->fidpool);
+        v9fs_fid_destroy(v9fid);
+
         kfree(fcall);
         return result;
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index 3660dcb97591..71649ef9b658 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -470,13 +470,18 @@ out:
    pass does the actual I/O. */
 void invalidate_bdev(struct block_device *bdev, int destroy_dirty_buffers)
 {
+        struct address_space *mapping = bdev->bd_inode->i_mapping;
+
+        if (mapping->nrpages == 0)
+                return;
+
         invalidate_bh_lrus();
         /*
          * FIXME: what about destroy_dirty_buffers?
          * We really want to use invalidate_inode_pages2() for
          * that, but not until that's cleaned up.
          */
-        invalidate_inode_pages(bdev->bd_inode->i_mapping);
+        invalidate_inode_pages(mapping);
 }
 
 /*
diff --git a/fs/coda/file.c b/fs/coda/file.c
index cc66c681bd11..dbfbcfa5b3c0 100644
--- a/fs/coda/file.c
+++ b/fs/coda/file.c
@@ -136,10 +136,8 @@ int coda_open(struct inode *coda_inode, struct file *coda_file)
         coda_vfs_stat.open++;
 
         cfi = kmalloc(sizeof(struct coda_file_info), GFP_KERNEL);
-        if (!cfi) {
-                unlock_kernel();
+        if (!cfi)
                 return -ENOMEM;
-        }
 
         lock_kernel();
 
diff --git a/fs/efs/symlink.c b/fs/efs/symlink.c
index e249cf733a6b..1d30d2ff440f 100644
--- a/fs/efs/symlink.c
+++ b/fs/efs/symlink.c
@@ -22,7 +22,7 @@ static int efs_symlink_readpage(struct file *file, struct page *page)
   
         err = -ENAMETOOLONG;
         if (size > 2 * EFS_BLOCKSIZE)
-                goto fail;
+                goto fail_notlocked;
   
         lock_kernel();
         /* read first 512 bytes of link target */
@@ -47,6 +47,7 @@ static int efs_symlink_readpage(struct file *file, struct page *page)
         return 0;
 fail:
         unlock_kernel();
+fail_notlocked:
         SetPageError(page);
         kunmap(page);
         unlock_page(page);
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index f804d5e9d60c..c5ee9f0691e3 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1158,7 +1158,7 @@ retry:
                 ret = PTR_ERR(handle);
                 goto out;
         }
-        if (test_opt(inode->i_sb, NOBH))
+        if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode))
                 ret = nobh_prepare_write(page, from, to, ext3_get_block);
         else
                 ret = block_prepare_write(page, from, to, ext3_get_block);
@@ -1244,7 +1244,7 @@ static int ext3_writeback_commit_write(struct file *file, struct page *page,
         if (new_i_size > EXT3_I(inode)->i_disksize)
                 EXT3_I(inode)->i_disksize = new_i_size;
 
-        if (test_opt(inode->i_sb, NOBH))
+        if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode))
                 ret = nobh_commit_write(file, page, from, to);
         else
                 ret = generic_commit_write(file, page, from, to);
@@ -1494,7 +1494,7 @@ static int ext3_writeback_writepage(struct page *page,
                 goto out_fail;
         }
 
-        if (test_opt(inode->i_sb, NOBH))
+        if (test_opt(inode->i_sb, NOBH) && ext3_should_writeback_data(inode))
                 ret = nobh_writepage(page, ext3_get_block, wbc);
         else
                 ret = block_write_full_page(page, ext3_get_block, wbc);
@@ -2402,14 +2402,15 @@ static ext3_fsblk_t ext3_get_inode_block(struct super_block *sb,
         struct buffer_head *bh;
         struct ext3_group_desc * gdp;
 
-
-        if ((ino != EXT3_ROOT_INO && ino != EXT3_JOURNAL_INO &&
-                ino != EXT3_RESIZE_INO && ino < EXT3_FIRST_INO(sb)) ||
-                ino > le32_to_cpu(EXT3_SB(sb)->s_es->s_inodes_count)) {
-                ext3_error(sb, "ext3_get_inode_block",
-                            "bad inode number: %lu", ino);
+        if (!ext3_valid_inum(sb, ino)) {
+                /*
+                 * This error is already checked for in namei.c unless we are
+                 * looking at an NFS filehandle, in which case no error
+                 * report is needed
+                 */
                 return 0;
         }
+
         block_group = (ino - 1) / EXT3_INODES_PER_GROUP(sb);
         if (block_group >= EXT3_SB(sb)->s_groups_count) {
                 ext3_error(sb,"ext3_get_inode_block","group >= groups count");
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index d9176dba3698..2aa7101b27cd 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1000,7 +1000,12 @@ static struct dentry *ext3_lookup(struct inode * dir, struct dentry *dentry, str
         if (bh) {
                 unsigned long ino = le32_to_cpu(de->inode);
                 brelse (bh);
-                inode = iget(dir->i_sb, ino);
+                if (!ext3_valid_inum(dir->i_sb, ino)) {
+                        ext3_error(dir->i_sb, "ext3_lookup",
+                                   "bad inode number: %lu", ino);
+                        inode = NULL;
+                } else
+                        inode = iget(dir->i_sb, ino);
 
                 if (!inode)
                         return ERR_PTR(-EACCES);
@@ -1028,7 +1033,13 @@ struct dentry *ext3_get_parent(struct dentry *child)
                 return ERR_PTR(-ENOENT);
         ino = le32_to_cpu(de->inode);
         brelse(bh);
-        inode = iget(child->d_inode->i_sb, ino);
+
+        if (!ext3_valid_inum(child->d_inode->i_sb, ino)) {
+                ext3_error(child->d_inode->i_sb, "ext3_get_parent",
+                           "bad inode number: %lu", ino);
+                inode = NULL;
+        } else
+                inode = iget(child->d_inode->i_sb, ino);
 
         if (!inode)
                 return ERR_PTR(-EACCES);
diff --git a/fs/freevxfs/vxfs_lookup.c b/fs/freevxfs/vxfs_lookup.c
index 29cce456c7ce..43886fa00a2a 100644
--- a/fs/freevxfs/vxfs_lookup.c
+++ b/fs/freevxfs/vxfs_lookup.c
@@ -246,6 +246,8 @@ vxfs_readdir(struct file *fp, void *retp, filldir_t filler)
         u_long                  page, npages, block, pblocks, nblocks, offset;
         loff_t                  pos;
 
+        lock_kernel();
+
         switch ((long)fp->f_pos) {
         case 0:
                 if (filler(retp, ".", 1, fp->f_pos, ip->i_ino, DT_DIR) < 0)
diff --git a/fs/fuse/control.c b/fs/fuse/control.c
index a3bce3a77253..46fe60b2da23 100644
--- a/fs/fuse/control.c
+++ b/fs/fuse/control.c
@@ -105,7 +105,7 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent,
 
 /*
  * Add a connection to the control filesystem (if it exists).  Caller
- * must host fuse_mutex
+ * must hold fuse_mutex
  */
 int fuse_ctl_add_conn(struct fuse_conn *fc)
 {
@@ -139,7 +139,7 @@ int fuse_ctl_add_conn(struct fuse_conn *fc)
 
 /*
  * Remove a connection from the control filesystem (if it exists).
- * Caller must host fuse_mutex
+ * Caller must hold fuse_mutex
  */
 void fuse_ctl_remove_conn(struct fuse_conn *fc)
 {
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 72a74cde6de8..409ce6a7cca4 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -14,6 +14,33 @@
 #include <linux/sched.h>
 #include <linux/namei.h>
 
+#if BITS_PER_LONG >= 64
+static inline void fuse_dentry_settime(struct dentry *entry, u64 time)
+{
+        entry->d_time = time;
+}
+
+static inline u64 fuse_dentry_time(struct dentry *entry)
+{
+        return entry->d_time;
+}
+#else
+/*
+ * On 32 bit archs store the high 32 bits of time in d_fsdata
+ */
+static void fuse_dentry_settime(struct dentry *entry, u64 time)
+{
+        entry->d_time = time;
+        entry->d_fsdata = (void *) (unsigned long) (time >> 32);
+}
+
+static u64 fuse_dentry_time(struct dentry *entry)
+{
+        return (u64) entry->d_time +
+                ((u64) (unsigned long) entry->d_fsdata << 32);
+}
+#endif
+
 /*
  * FUSE caches dentries and attributes with separate timeout.  The
  * time in jiffies until the dentry/attributes are valid is stored in
@@ -23,10 +50,13 @@
 /*
  * Calculate the time in jiffies until a dentry/attributes are valid
  */
-static unsigned long time_to_jiffies(unsigned long sec, unsigned long nsec)
+static u64 time_to_jiffies(unsigned long sec, unsigned long nsec)
 {
-        struct timespec ts = {sec, nsec};
-        return jiffies + timespec_to_jiffies(&ts);
+        if (sec || nsec) {
+                struct timespec ts = {sec, nsec};
+                return get_jiffies_64() + timespec_to_jiffies(&ts);
+        } else
+                return 0;
 }
 
 /*
@@ -35,7 +65,8 @@ static unsigned long time_to_jiffies(unsigned long sec, unsigned long nsec)
  */
 static void fuse_change_timeout(struct dentry *entry, struct fuse_entry_out *o)
 {
-        entry->d_time = time_to_jiffies(o->entry_valid, o->entry_valid_nsec);
+        fuse_dentry_settime(entry,
+                time_to_jiffies(o->entry_valid, o->entry_valid_nsec));
         if (entry->d_inode)
                 get_fuse_inode(entry->d_inode)->i_time =
                         time_to_jiffies(o->attr_valid, o->attr_valid_nsec);
@@ -47,7 +78,7 @@ static void fuse_change_timeout(struct dentry *entry, struct fuse_entry_out *o)
  */
 void fuse_invalidate_attr(struct inode *inode)
 {
-        get_fuse_inode(inode)->i_time = jiffies - 1;
+        get_fuse_inode(inode)->i_time = 0;
 }
 
 /*
@@ -60,7 +91,7 @@ void fuse_invalidate_attr(struct inode *inode)
  */
 static void fuse_invalidate_entry_cache(struct dentry *entry)
 {
-        entry->d_time = jiffies - 1;
+        fuse_dentry_settime(entry, 0);
 }
 
 /*
@@ -102,7 +133,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
 
         if (inode && is_bad_inode(inode))
                 return 0;
-        else if (time_after(jiffies, entry->d_time)) {
+        else if (fuse_dentry_time(entry) < get_jiffies_64()) {
                 int err;
                 struct fuse_entry_out outarg;
                 struct fuse_conn *fc;
@@ -666,7 +697,7 @@ static int fuse_revalidate(struct dentry *entry)
         if (!fuse_allow_task(fc, current))
                 return -EACCES;
         if (get_node_id(inode) != FUSE_ROOT_ID &&
-            time_before_eq(jiffies, fi->i_time))
+            fi->i_time >= get_jiffies_64())
                 return 0;
 
         return fuse_do_getattr(inode);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 0dbf96621841..69c7750d55b8 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -59,7 +59,7 @@ struct fuse_inode {
         struct fuse_req *forget_req;
 
         /** Time in jiffies until the file attributes are valid */
-        unsigned long i_time;
+        u64 i_time;
 };
 
 /** FUSE specific file data */
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index dcaaabd3b9c4..7d25092262ae 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -51,7 +51,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
                 return NULL;
 
         fi = get_fuse_inode(inode);
-        fi->i_time = jiffies - 1;
+        fi->i_time = 0;
         fi->nodeid = 0;
         fi->nlookup = 0;
         fi->forget_req = fuse_request_alloc();
diff --git a/fs/inotify_user.c b/fs/inotify_user.c
index f2386442adee..017cb0f134d6 100644
--- a/fs/inotify_user.c
+++ b/fs/inotify_user.c
@@ -187,7 +187,7 @@ static struct inotify_kernel_event * kernel_event(s32 wd, u32 mask, u32 cookie,
 {
         struct inotify_kernel_event *kevent;
 
-        kevent = kmem_cache_alloc(event_cachep, GFP_KERNEL);
+        kevent = kmem_cache_alloc(event_cachep, GFP_NOFS);
         if (unlikely(!kevent))
                 return NULL;
 
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index ecc439d2565f..501d83884530 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -187,6 +187,11 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                         goto out;
                 }
 
+                /* Set user creds for this exportpoint */
+                error = nfserrno(nfsd_setuser(rqstp, exp));
+                if (error)
+                        goto out;
+
                 /*
                  * Look up the dentry using the NFS file handle.
                  */
@@ -241,16 +246,17 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
                 dprintk("nfsd: fh_verify - just checking\n");
                 dentry = fhp->fh_dentry;
                 exp = fhp->fh_export;
+                /* Set user creds for this exportpoint; necessary even
+                 * in the "just checking" case because this may be a
+                 * filehandle that was created by fh_compose, and that
+                 * is about to be used in another nfsv4 compound
+                 * operation */
+                error = nfserrno(nfsd_setuser(rqstp, exp));
+                if (error)
+                        goto out;
         }
         cache_get(&exp->h);
 
-        /* Set user creds for this exportpoint; necessary even in the "just
-         * checking" case because this may be a filehandle that was created by
-         * fh_compose, and that is about to be used in another nfsv4 compound
-         * operation */
-        error = nfserrno(nfsd_setuser(rqstp, exp));
-        if (error)
-                goto out;
 
         error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
         if (error)
diff --git a/fs/partitions/Kconfig b/fs/partitions/Kconfig
index c9a478099281..e478f1941831 100644
--- a/fs/partitions/Kconfig
+++ b/fs/partitions/Kconfig
@@ -99,7 +99,7 @@ config IBM_PARTITION
 
 config MAC_PARTITION
         bool "Macintosh partition map support" if PARTITION_ADVANCED
-        default y if MAC
+        default y if (MAC || PPC_PMAC)
         help
           Say Y here if you would like to use hard disks under Linux which
           were partitioned on a Macintosh.
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index abd5f23a426d..d344b411e261 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -129,7 +129,7 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
         struct inode * inode;
 
         if (l > sb->s_blocksize)
-                goto out;
+                goto out_notlocked;
 
         lock_kernel();
         inode = ufs_new_inode(dir, S_IFLNK | S_IRWXUGO);
@@ -155,6 +155,7 @@ static int ufs_symlink (struct inode * dir, struct dentry * dentry,
         err = ufs_add_nondir(dentry, inode);
 out:
         unlock_kernel();
+out_notlocked:
         return err;
 
 out_fail:
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index ceda3a2859d2..7858703ed84c 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -246,8 +246,8 @@ extern void xfs_buf_trace(xfs_buf_t *, char *, void *, void *);
 #define BUF_BUSY                XBF_DONT_BLOCK
 
 #define XFS_BUF_BFLAGS(bp)      ((bp)->b_flags)
-#define XFS_BUF_ZEROFLAGS(bp)   \
-        ((bp)->b_flags &= ~(XBF_READ|XBF_WRITE|XBF_ASYNC|XBF_DELWRI))
+#define XFS_BUF_ZEROFLAGS(bp)   ((bp)->b_flags &= \
+                ~(XBF_READ|XBF_WRITE|XBF_ASYNC|XBF_DELWRI|XBF_ORDERED))
 
 #define XFS_BUF_STALE(bp)       ((bp)->b_flags |= XFS_B_STALE)
 #define XFS_BUF_UNSTALE(bp)     ((bp)->b_flags &= ~XFS_B_STALE)
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 9bdef9d51900..4754f342a5d3 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -314,6 +314,13 @@ xfs_mountfs_check_barriers(xfs_mount_t *mp)
                 return;
         }
 
+        if (xfs_readonly_buftarg(mp->m_ddev_targp)) {
+                xfs_fs_cmn_err(CE_NOTE, mp,
+                  "Disabling barriers, underlying device is readonly");
+                mp->m_flags &= ~XFS_MOUNT_BARRIER;
+                return;
+        }
+
         error = xfs_barrier_test(mp);
         if (error) {
                 xfs_fs_cmn_err(CE_NOTE, mp,
diff --git a/fs/xfs/quota/xfs_qm_bhv.c b/fs/xfs/quota/xfs_qm_bhv.c
index e95e99f7168f..f137856c3261 100644
--- a/fs/xfs/quota/xfs_qm_bhv.c
+++ b/fs/xfs/quota/xfs_qm_bhv.c
@@ -217,17 +217,24 @@ xfs_qm_statvfs(
                 return 0;
         dp = &dqp->q_core;
 
-        limit = dp->d_blk_softlimit ? dp->d_blk_softlimit : dp->d_blk_hardlimit;
+        limit = dp->d_blk_softlimit ?
+                be64_to_cpu(dp->d_blk_softlimit) :
+                be64_to_cpu(dp->d_blk_hardlimit);
         if (limit && statp->f_blocks > limit) {
                 statp->f_blocks = limit;
-                statp->f_bfree = (statp->f_blocks > dp->d_bcount) ?
-                                        (statp->f_blocks - dp->d_bcount) : 0;
+                statp->f_bfree =
+                        (statp->f_blocks > be64_to_cpu(dp->d_bcount)) ?
+                         (statp->f_blocks - be64_to_cpu(dp->d_bcount)) : 0;
         }
-        limit = dp->d_ino_softlimit ? dp->d_ino_softlimit : dp->d_ino_hardlimit;
+
+        limit = dp->d_ino_softlimit ?
+                be64_to_cpu(dp->d_ino_softlimit) :
+                be64_to_cpu(dp->d_ino_hardlimit);
         if (limit && statp->f_files > limit) {
                 statp->f_files = limit;
-                statp->f_ffree = (statp->f_files > dp->d_icount) ?
-                                        (statp->f_ffree - dp->d_icount) : 0;
+                statp->f_ffree =
+                        (statp->f_files > be64_to_cpu(dp->d_icount)) ?
+                         (statp->f_ffree - be64_to_cpu(dp->d_icount)) : 0;
         }
 
         xfs_qm_dqput(dqp);
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 86c1bf0bba9e..1f8ecff8553a 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -334,10 +334,9 @@ xfs_itobp(
 #if !defined(__KERNEL__)
         ni = 0;
 #elif defined(DEBUG)
-        ni = (imap_flags & XFS_IMAP_BULKSTAT) ? 0 :
-                (BBTOB(imap.im_len) >> mp->m_sb.sb_inodelog);
+        ni = BBTOB(imap.im_len) >> mp->m_sb.sb_inodelog;
 #else   /* usual case */
-        ni = (imap_flags & XFS_IMAP_BULKSTAT) ? 0 : 1;
+        ni = 1;
 #endif
 
         for (i = 0; i < ni; i++) {
@@ -348,11 +347,15 @@ xfs_itobp(
                                         (i << mp->m_sb.sb_inodelog));
                 di_ok = INT_GET(dip->di_core.di_magic, ARCH_CONVERT) == XFS_DINODE_MAGIC &&
                             XFS_DINODE_GOOD_VERSION(INT_GET(dip->di_core.di_version, ARCH_CONVERT));
-                if (unlikely(XFS_TEST_ERROR(!di_ok, mp, XFS_ERRTAG_ITOBP_INOTOBP,
-                                 XFS_RANDOM_ITOBP_INOTOBP))) {
+                if (unlikely(XFS_TEST_ERROR(!di_ok, mp,
+                                                XFS_ERRTAG_ITOBP_INOTOBP,
+                                                XFS_RANDOM_ITOBP_INOTOBP))) {
+                        if (imap_flags & XFS_IMAP_BULKSTAT) {
+                                xfs_trans_brelse(tp, bp);
+                                return XFS_ERROR(EINVAL);
+                        }
 #ifdef DEBUG
-                        if (!(imap_flags & XFS_IMAP_BULKSTAT))
-                                cmn_err(CE_ALERT,
+                        cmn_err(CE_ALERT,
                                         "Device %s - bad inode magic/vsn "
                                         "daddr %lld #%d (magic=%x)",
                                 XFS_BUFTARG_NAME(mp->m_ddev_targp),
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index e730328636c3..21ac1a67e3e0 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -1413,7 +1413,7 @@ xlog_sync(xlog_t		*log,
         ops = iclog->ic_header.h_num_logops;
         INT_SET(iclog->ic_header.h_num_logops, ARCH_CONVERT, ops);
 
-        bp          = iclog->ic_bp;
+        bp = iclog->ic_bp;
         ASSERT(XFS_BUF_FSPRIVATE2(bp, unsigned long) == (unsigned long)1);
         XFS_BUF_SET_FSPRIVATE2(bp, (unsigned long)2);
         XFS_BUF_SET_ADDR(bp, BLOCK_LSN(INT_GET(iclog->ic_header.h_lsn, ARCH_CONVERT)));
@@ -1430,15 +1430,14 @@ xlog_sync(xlog_t		*log,
         }
         XFS_BUF_SET_PTR(bp, (xfs_caddr_t) &(iclog->ic_header), count);
         XFS_BUF_SET_FSPRIVATE(bp, iclog);       /* save for later */
+        XFS_BUF_ZEROFLAGS(bp);
         XFS_BUF_BUSY(bp);
         XFS_BUF_ASYNC(bp);
         /*
          * Do an ordered write for the log block.
-         *
-         * It may not be needed to flush the first split block in the log wrap
-         * case, but do it anyways to be safe -AK
+         * Its unnecessary to flush the first split block in the log wrap case.
          */
-        if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
+        if (!split && (log->l_mp->m_flags & XFS_MOUNT_BARRIER))
                 XFS_BUF_ORDERED(bp);
 
         ASSERT(XFS_BUF_ADDR(bp) <= log->l_logBBsize-1);
@@ -1460,7 +1459,7 @@ xlog_sync(xlog_t		*log,
                 return error;
         }
         if (split) {
-                bp              = iclog->ic_log->l_xbuf;
+                bp = iclog->ic_log->l_xbuf;
                 ASSERT(XFS_BUF_FSPRIVATE2(bp, unsigned long) ==
                                                         (unsigned long)1);
                 XFS_BUF_SET_FSPRIVATE2(bp, (unsigned long)2);
@@ -1468,6 +1467,7 @@ xlog_sync(xlog_t		*log,
                 XFS_BUF_SET_PTR(bp, (xfs_caddr_t)((__psint_t)&(iclog->ic_header)+
                                             (__psint_t)count), split);
                 XFS_BUF_SET_FSPRIVATE(bp, iclog);
+                XFS_BUF_ZEROFLAGS(bp);
                 XFS_BUF_BUSY(bp);
                 XFS_BUF_ASYNC(bp);
                 if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index 6c96391f3f1a..b427d220a169 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -515,7 +515,7 @@ xfs_mount(
         if (error)
                 goto error2;
 
-        if ((mp->m_flags & XFS_MOUNT_BARRIER) && !(vfsp->vfs_flag & VFS_RDONLY))
+        if (mp->m_flags & XFS_MOUNT_BARRIER)
                 xfs_mountfs_check_barriers(mp);
 
         error = XFS_IOINIT(vfsp, args, flags);
diff --git a/include/asm-arm/arch-iop3xx/iop331-irqs.h b/include/asm-arm/arch-iop3xx/iop331-irqs.h
index 8ff73d487222..7135ad7e335e 100644
--- a/include/asm-arm/arch-iop3xx/iop331-irqs.h
+++ b/include/asm-arm/arch-iop3xx/iop331-irqs.h
@@ -91,7 +91,6 @@
 #define NR_IRQS                 NR_IOP331_IRQS
 
 
-#if defined(CONFIG_ARCH_IQ80331)
 /*
  * Interrupts available on the IQ80331 board
  */
@@ -111,7 +110,6 @@
 #define IRQ_IQ80331_INTC        IRQ_IOP331_XINT2
 #define IRQ_IQ80331_INTD        IRQ_IOP331_XINT3
 
-#elif defined(CONFIG_MACH_IQ80332)
 /*
  * Interrupts available on the IQ80332 board
  */
@@ -131,6 +129,4 @@
 #define IRQ_IQ80332_INTC        IRQ_IOP331_XINT2
 #define IRQ_IQ80332_INTD        IRQ_IOP331_XINT3
 
-#endif
-
 #endif // _IOP331_IRQ_H_
diff --git a/include/asm-i386/kprobes.h b/include/asm-i386/kprobes.h
index 0730a20f6db8..8774d06689da 100644
--- a/include/asm-i386/kprobes.h
+++ b/include/asm-i386/kprobes.h
@@ -45,6 +45,7 @@ typedef u8 kprobe_opcode_t;
 #define JPROBE_ENTRY(pentry)    (kprobe_opcode_t *)pentry
 #define ARCH_SUPPORTS_KRETPROBES
 #define  ARCH_INACTIVE_KPROBE_COUNT 0
+#define flush_insn_slot(p)      do { } while (0)
 
 void arch_remove_kprobe(struct kprobe *p);
 void kretprobe_trampoline(void);
diff --git a/include/asm-ia64/kprobes.h b/include/asm-ia64/kprobes.h
index 2418a787c405..938904910115 100644
--- a/include/asm-ia64/kprobes.h
+++ b/include/asm-ia64/kprobes.h
@@ -125,5 +125,6 @@ static inline void jprobe_return(void)
 }
 extern void invalidate_stacked_regs(void);
 extern void flush_register_stack(void);
+extern void flush_insn_slot(struct kprobe *p);
 
 #endif                          /* _ASM_KPROBES_H */
diff --git a/include/asm-powerpc/backlight.h b/include/asm-powerpc/backlight.h
index 58d4b6f8d827..8cf5c37c3817 100644
--- a/include/asm-powerpc/backlight.h
+++ b/include/asm-powerpc/backlight.h
@@ -30,8 +30,12 @@ static inline void pmac_backlight_key_down(void)
         pmac_backlight_key(1);
 }
 
+extern void pmac_backlight_set_legacy_brightness_pmu(int brightness);
 extern int pmac_backlight_set_legacy_brightness(int brightness);
 extern int pmac_backlight_get_legacy_brightness(void);
 
+extern void pmac_backlight_enable(void);
+extern void pmac_backlight_disable(void);
+
 #endif /* __KERNEL__ */
 #endif
diff --git a/include/asm-powerpc/kprobes.h b/include/asm-powerpc/kprobes.h
index 2d0af52c823d..34e1f89a5fa0 100644
--- a/include/asm-powerpc/kprobes.h
+++ b/include/asm-powerpc/kprobes.h
@@ -51,6 +51,7 @@ typedef unsigned int kprobe_opcode_t;
 
 #define ARCH_SUPPORTS_KRETPROBES
 #define  ARCH_INACTIVE_KPROBE_COUNT 1
+#define flush_insn_slot(p)      do { } while (0)
 
 void kretprobe_trampoline(void);
 extern void arch_remove_kprobe(struct kprobe *p);
diff --git a/include/asm-sparc/signal.h b/include/asm-sparc/signal.h
index 0ae5084c427b..d03a21c97abb 100644
--- a/include/asm-sparc/signal.h
+++ b/include/asm-sparc/signal.h
@@ -168,7 +168,7 @@ struct sigstack {
  * statically allocated data.. which is NOT GOOD.
  *
  */
-#define SA_STATIC_ALLOC         0x80
+#define SA_STATIC_ALLOC         0x8000
 #endif
 
 #include <asm-generic/signal.h>
diff --git a/include/asm-sparc64/kprobes.h b/include/asm-sparc64/kprobes.h
index 15065af566c2..c9f5c34d318c 100644
--- a/include/asm-sparc64/kprobes.h
+++ b/include/asm-sparc64/kprobes.h
@@ -13,6 +13,7 @@ typedef u32 kprobe_opcode_t;
 #define JPROBE_ENTRY(pentry)    (kprobe_opcode_t *)pentry
 #define arch_remove_kprobe(p)   do {} while (0)
 #define  ARCH_INACTIVE_KPROBE_COUNT 0
+#define flush_insn_slot(p)      do { } while (0)
 
 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
diff --git a/include/asm-sparc64/pgtable.h b/include/asm-sparc64/pgtable.h
index 03f5bc9b6bec..1ba19eb34ce3 100644
--- a/include/asm-sparc64/pgtable.h
+++ b/include/asm-sparc64/pgtable.h
@@ -339,7 +339,7 @@ static inline pgprot_t pgprot_noncached(pgprot_t prot)
         "       .section        .sun4v_2insn_patch, \"ax\"\n"
         "       .word           661b\n"
         "       andn            %0, %4, %0\n"
-        "       or              %0, %3, %0\n"
+        "       or              %0, %5, %0\n"
         "       .previous\n"
         : "=r" (val)
         : "0" (val), "i" (_PAGE_CP_4U | _PAGE_CV_4U), "i" (_PAGE_E_4U),
diff --git a/include/asm-sparc64/sfp-machine.h b/include/asm-sparc64/sfp-machine.h
index 5015bb8d6c32..89d42431efb5 100644
--- a/include/asm-sparc64/sfp-machine.h
+++ b/include/asm-sparc64/sfp-machine.h
@@ -34,7 +34,7 @@
 #define _FP_MUL_MEAT_D(R,X,Y)                                   \
   _FP_MUL_MEAT_1_wide(_FP_WFRACBITS_D,R,X,Y,umul_ppmm)
 #define _FP_MUL_MEAT_Q(R,X,Y)                                   \
-  _FP_MUL_MEAT_2_wide_3mul(_FP_WFRACBITS_Q,R,X,Y,umul_ppmm)
+  _FP_MUL_MEAT_2_wide(_FP_WFRACBITS_Q,R,X,Y,umul_ppmm)
 
 #define _FP_DIV_MEAT_S(R,X,Y)   _FP_DIV_MEAT_1_imm(S,R,X,Y,_FP_DIV_HELP_imm)
 #define _FP_DIV_MEAT_D(R,X,Y)   _FP_DIV_MEAT_1_udiv_norm(D,R,X,Y)
diff --git a/include/asm-x86_64/calgary.h b/include/asm-x86_64/calgary.h
index fbfb50136edb..4e3919524240 100644
--- a/include/asm-x86_64/calgary.h
+++ b/include/asm-x86_64/calgary.h
@@ -60,9 +60,4 @@ static inline int calgary_iommu_init(void) { return 1; }
 static inline void detect_calgary(void) { return; }
 #endif
 
-static inline unsigned int bus_to_phb(unsigned char busno)
-{
-        return ((busno % 15 == 0) ? 0 : busno / 2 + 1);
-}
-
 #endif /* _ASM_X86_64_CALGARY_H */
diff --git a/include/asm-x86_64/kprobes.h b/include/asm-x86_64/kprobes.h
index d36febd9bb18..cf5317898fb0 100644
--- a/include/asm-x86_64/kprobes.h
+++ b/include/asm-x86_64/kprobes.h
@@ -47,6 +47,7 @@ typedef u8 kprobe_opcode_t;
 
 void kretprobe_trampoline(void);
 extern void arch_remove_kprobe(struct kprobe *p);
+#define flush_insn_slot(p)      do { } while (0)
 
 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
diff --git a/include/asm-x86_64/page.h b/include/asm-x86_64/page.h
index f7bf875aae40..10f346165cab 100644
--- a/include/asm-x86_64/page.h
+++ b/include/asm-x86_64/page.h
@@ -19,7 +19,7 @@
 #define EXCEPTION_STACK_ORDER 0
 #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
 
-#define DEBUG_STACK_ORDER EXCEPTION_STACK_ORDER
+#define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
 #define DEBUG_STKSZ (PAGE_SIZE << DEBUG_STACK_ORDER)
 
 #define IRQSTACK_ORDER 2
diff --git a/include/asm-x86_64/swiotlb.h b/include/asm-x86_64/swiotlb.h
index 5f9a01805821..ba94ab3d2673 100644
--- a/include/asm-x86_64/swiotlb.h
+++ b/include/asm-x86_64/swiotlb.h
@@ -42,6 +42,8 @@ extern void swiotlb_free_coherent (struct device *hwdev, size_t size,
 extern int swiotlb_dma_supported(struct device *hwdev, u64 mask);
 extern void swiotlb_init(void);
 
+extern int swiotlb_force;
+
 #ifdef CONFIG_SWIOTLB
 extern int swiotlb;
 #else
diff --git a/include/linux/cn_proc.h b/include/linux/cn_proc.h
index dbb7769009be..1c86d65bc4b9 100644
--- a/include/linux/cn_proc.h
+++ b/include/linux/cn_proc.h
@@ -57,7 +57,8 @@ struct proc_event {
                 PROC_EVENT_EXIT = 0x80000000
         } what;
         __u32 cpu;
-        struct timespec timestamp;
+        __u64 __attribute__((aligned(8))) timestamp_ns;
+                /* Number of nano seconds since system boot */
         union { /* must be last field of proc_event struct */
                 struct {
                         __u32 err;
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 35e137636b0b..4ea39fee99c7 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -172,9 +172,6 @@ extern int __cpufreq_driver_target(struct cpufreq_policy *policy,
                                    unsigned int relation);
 
 
-/* pass an event to the cpufreq governor */
-int cpufreq_governor(unsigned int cpu, unsigned int event);
-
 int cpufreq_register_governor(struct cpufreq_governor *governor);
 void cpufreq_unregister_governor(struct cpufreq_governor *governor);
 
diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h
index 7e8b6011b8f3..11487b6e7127 100644
--- a/include/linux/delayacct.h
+++ b/include/linux/delayacct.h
@@ -55,7 +55,7 @@ static inline void delayacct_tsk_init(struct task_struct *tsk)
 {
         /* reinitialize in case parent's non-null pointer was dup'ed*/
         tsk->delays = NULL;
-        if (unlikely(delayacct_on))
+        if (delayacct_on)
                 __delayacct_tsk_init(tsk);
 }
 
@@ -80,9 +80,7 @@ static inline void delayacct_blkio_end(void)
 static inline int delayacct_add_tsk(struct taskstats *d,
                                         struct task_struct *tsk)
 {
-        if (likely(!delayacct_on))
-                return -EINVAL;
-        if (!tsk->delays)
+        if (!delayacct_on || !tsk->delays)
                 return 0;
         return __delayacct_add_tsk(d, tsk);
 }
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index 5607e6457a65..9f9cce7bd86d 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -492,6 +492,15 @@ static inline struct ext3_inode_info *EXT3_I(struct inode *inode)
 {
         return container_of(inode, struct ext3_inode_info, vfs_inode);
 }
+
+static inline int ext3_valid_inum(struct super_block *sb, unsigned long ino)
+{
+        return ino == EXT3_ROOT_INO ||
+                ino == EXT3_JOURNAL_INO ||
+                ino == EXT3_RESIZE_INO ||
+                (ino >= EXT3_FIRST_INO(sb) &&
+                 ino <= le32_to_cpu(EXT3_SB(sb)->s_es->s_inodes_count));
+}
 #else
 /* Assume that user mode programs are passing in an ext3fs superblock, not
  * a kernel struct super_block.  This will allow us to call the feature-test
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 405f44e44e5d..4ad0673b1995 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -524,7 +524,7 @@ struct fb_event {
 
 extern int fb_register_client(struct notifier_block *nb);
 extern int fb_unregister_client(struct notifier_block *nb);
-
+extern int fb_notifier_call_chain(unsigned long val, void *v);
 /*
  * Pixmap structure definition
  *
diff --git a/include/linux/futex.h b/include/linux/futex.h
index 34c3a215f2cd..d097b5b72bc6 100644
--- a/include/linux/futex.h
+++ b/include/linux/futex.h
@@ -96,7 +96,8 @@ struct robust_list_head {
 long do_futex(u32 __user *uaddr, int op, u32 val, unsigned long timeout,
               u32 __user *uaddr2, u32 val2, u32 val3);
 
-extern int handle_futex_death(u32 __user *uaddr, struct task_struct *curr);
+extern int
+handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi);
 
 #ifdef CONFIG_FUTEX
 extern void exit_robust_list(struct task_struct *curr);
diff --git a/include/linux/ide.h b/include/linux/ide.h
index dc7abef10965..99620451d958 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -571,6 +571,7 @@ typedef struct ide_drive_s {
         u8      waiting_for_dma;        /* dma currently in progress */
         u8      unmask;                 /* okay to unmask other irqs */
         u8      bswap;                  /* byte swap data */
+        u8      noflush;                /* don't attempt flushes */
         u8      dsc_overlap;            /* DSC overlap */
         u8      nice1;                  /* give potential excess bandwidth */
 
diff --git a/include/linux/irq.h b/include/linux/irq.h
index b48eae32dc61..fbf6d901e9c2 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -47,8 +47,8 @@
 #define IRQ_WAITING             0x00200000      /* IRQ not yet seen - for autodetection */
 #define IRQ_LEVEL               0x00400000      /* IRQ level triggered */
 #define IRQ_MASKED              0x00800000      /* IRQ masked - shouldn't be seen again */
+#define IRQ_PER_CPU             0x01000000      /* IRQ is per CPU */
 #ifdef CONFIG_IRQ_PER_CPU
-# define IRQ_PER_CPU            0x01000000      /* IRQ is per CPU */
 # define CHECK_IRQ_PER_CPU(var) ((var) & IRQ_PER_CPU)
 #else
 # define CHECK_IRQ_PER_CPU(var) 0
@@ -58,6 +58,7 @@
 #define IRQ_NOREQUEST           0x04000000      /* IRQ cannot be requested */
 #define IRQ_NOAUTOEN            0x08000000      /* IRQ will not be enabled on request irq */
 #define IRQ_DELAYED_DISABLE     0x10000000      /* IRQ disable (masking) happens delayed. */
+#define IRQ_WAKEUP              0x20000000      /* IRQ triggers system wakeup */
 
 struct proc_dir_entry;
 
@@ -124,6 +125,7 @@ struct irq_chip {
  * @action:             the irq action chain
  * @status:             status information
  * @depth:              disable-depth, for nested irq_disable() calls
+ * @wake_depth:         enable depth, for multiple set_irq_wake() callers
  * @irq_count:          stats field to detect stalled irqs
  * @irqs_unhandled:     stats field for spurious unhandled interrupts
  * @lock:               locking for SMP
@@ -147,6 +149,7 @@ struct irq_desc {
         unsigned int            status;         /* IRQ status */
 
         unsigned int            depth;          /* nested irq disables */
+        unsigned int            wake_depth;     /* nested wake enables */
         unsigned int            irq_count;      /* For detecting broken IRQs */
         unsigned int            irqs_unhandled;
         spinlock_t              lock;
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 043376920f51..329ebcffa106 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -47,8 +47,8 @@
  *   - (NOM / DEN) fits in (32 - LSH) bits.
  *   - (NOM % DEN) fits in (32 - LSH) bits.
  */
-#define SH_DIV(NOM,DEN,LSH) (   ((NOM / DEN) << LSH)                    \
-                             + (((NOM % DEN) << LSH) + DEN / 2) / DEN)
+#define SH_DIV(NOM,DEN,LSH) (   (((NOM) / (DEN)) << (LSH))              \
+                             + ((((NOM) % (DEN)) << (LSH)) + (DEN) / 2) / (DEN))
 
 /* HZ is the requested value. ACTHZ is actual HZ ("<< 8" is for accuracy) */
 #define ACTHZ (SH_DIV (CLOCK_TICK_RATE, LATCH, 8))
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 6cc497a2b6da..66c3100c2b94 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -265,12 +265,14 @@ enum {
 
         /* ata_eh_info->flags */
         ATA_EHI_HOTPLUGGED      = (1 << 0),  /* could have been hotplugged */
-        ATA_EHI_RESUME_LINK     = (1 << 1),  /* need to resume link */
+        ATA_EHI_RESUME_LINK     = (1 << 1),  /* resume link (reset modifier) */
         ATA_EHI_NO_AUTOPSY      = (1 << 2),  /* no autopsy */
         ATA_EHI_QUIET           = (1 << 3),  /* be quiet */
 
         ATA_EHI_DID_RESET       = (1 << 16), /* already reset this port */
 
+        ATA_EHI_RESET_MODIFIER_MASK = ATA_EHI_RESUME_LINK,
+
         /* max repeat if error condition is still set after ->error_handler */
         ATA_EH_MAX_REPEAT       = 5,
 
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 87764022cc67..31f02ba036ce 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -79,6 +79,8 @@ struct bridge_skb_cb {
                 __u32 ipv4;
         } daddr;
 };
+
+extern int brnf_deferred_hooks;
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/pmu.h b/include/linux/pmu.h
index 2ed807ddc08c..783177387ac6 100644
--- a/include/linux/pmu.h
+++ b/include/linux/pmu.h
@@ -231,7 +231,6 @@ extern struct pmu_battery_info pmu_batteries[PMU_MAX_BATTERIES];
 extern unsigned int pmu_power_flags;
 
 /* Backlight */
-extern int disable_kernel_backlight;
-extern void pmu_backlight_init(struct device_node*);
+extern void pmu_backlight_init(void);
 
 #endif  /* __KERNEL__ */
diff --git a/ipc/msg.c b/ipc/msg.c
index cd92d342953e..2b4fccf8ea55 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -1,6 +1,6 @@
 /*
  * linux/ipc/msg.c
- * Copyright (C) 1992 Krishna Balasubramanian 
+ * Copyright (C) 1992 Krishna Balasubramanian
  *
  * Removed all the remaining kerneld mess
  * Catch the -EFAULT stuff properly
@@ -41,22 +41,24 @@ int msg_ctlmax = MSGMAX;
 int msg_ctlmnb = MSGMNB;
 int msg_ctlmni = MSGMNI;
 
-/* one msg_receiver structure for each sleeping receiver */
+/*
+ * one msg_receiver structure for each sleeping receiver:
+ */
 struct msg_receiver {
-        struct list_head r_list;
-        struct task_struct* r_tsk;
+        struct list_head        r_list;
+        struct task_struct      *r_tsk;
 
-        int r_mode;
-        long r_msgtype;
-        long r_maxsize;
+        int                     r_mode;
+        long                    r_msgtype;
+        long                    r_maxsize;
 
-        struct msg_msg* volatile r_msg;
+        volatile struct msg_msg *r_msg;
 };
 
 /* one msg_sender for each sleeping sender */
 struct msg_sender {
-        struct list_head list;
-        struct task_struct* tsk;
+        struct list_head        list;
+        struct task_struct      *tsk;
 };
 
 #define SEARCH_ANY              1
@@ -64,45 +66,42 @@ struct msg_sender {
 #define SEARCH_NOTEQUAL         3
 #define SEARCH_LESSEQUAL        4
 
-static atomic_t msg_bytes = ATOMIC_INIT(0);
-static atomic_t msg_hdrs = ATOMIC_INIT(0);
+static atomic_t msg_bytes =     ATOMIC_INIT(0);
+static atomic_t msg_hdrs =      ATOMIC_INIT(0);
 
 static struct ipc_ids msg_ids;
 
-#define msg_lock(id)    ((struct msg_queue*)ipc_lock(&msg_ids,id))
-#define msg_unlock(msq) ipc_unlock(&(msq)->q_perm)
-#define msg_rmid(id)    ((struct msg_queue*)ipc_rmid(&msg_ids,id))
-#define msg_checkid(msq, msgid) \
-        ipc_checkid(&msg_ids,&msq->q_perm,msgid)
-#define msg_buildid(id, seq) \
-        ipc_buildid(&msg_ids, id, seq)
+#define msg_lock(id)            ((struct msg_queue *)ipc_lock(&msg_ids, id))
+#define msg_unlock(msq)         ipc_unlock(&(msq)->q_perm)
+#define msg_rmid(id)            ((struct msg_queue *)ipc_rmid(&msg_ids, id))
+#define msg_checkid(msq, msgid) ipc_checkid(&msg_ids, &msq->q_perm, msgid)
+#define msg_buildid(id, seq)    ipc_buildid(&msg_ids, id, seq)
 
-static void freeque (struct msg_queue *msq, int id);
-static int newque (key_t key, int msgflg);
+static void freeque(struct msg_queue *msq, int id);
+static int newque(key_t key, int msgflg);
 #ifdef CONFIG_PROC_FS
 static int sysvipc_msg_proc_show(struct seq_file *s, void *it);
 #endif
 
-void __init msg_init (void)
+void __init msg_init(void)
 {
-        ipc_init_ids(&msg_ids,msg_ctlmni);
+        ipc_init_ids(&msg_ids, msg_ctlmni);
         ipc_init_proc_interface("sysvipc/msg",
                                 "       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n",
                                 &msg_ids,
                                 sysvipc_msg_proc_show);
 }
 
-static int newque (key_t key, int msgflg)
+static int newque(key_t key, int msgflg)
 {
-        int id;
-        int retval;
         struct msg_queue *msq;
+        int id, retval;
 
-        msq  = ipc_rcu_alloc(sizeof(*msq));
-        if (!msq) 
+        msq = ipc_rcu_alloc(sizeof(*msq));
+        if (!msq)
                 return -ENOMEM;
 
-        msq->q_perm.mode = (msgflg & S_IRWXUGO);
+        msq->q_perm.mode = msgflg & S_IRWXUGO;
         msq->q_perm.key = key;
 
         msq->q_perm.security = NULL;
@@ -113,13 +112,13 @@ static int newque (key_t key, int msgflg)
         }
 
         id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
-        if(id == -1) {
+        if (id == -1) {
                 security_msg_queue_free(msq);
                 ipc_rcu_putref(msq);
                 return -ENOSPC;
         }
 
-        msq->q_id = msg_buildid(id,msq->q_perm.seq);
+        msq->q_id = msg_buildid(id, msq->q_perm.seq);
         msq->q_stime = msq->q_rtime = 0;
         msq->q_ctime = get_seconds();
         msq->q_cbytes = msq->q_qnum = 0;
@@ -133,44 +132,44 @@ static int newque (key_t key, int msgflg)
         return msq->q_id;
 }
 
-static inline void ss_add(struct msg_queue* msq, struct msg_sender* mss)
+static inline void ss_add(struct msg_queue *msq, struct msg_sender *mss)
 {
-        mss->tsk=current;
-        current->state=TASK_INTERRUPTIBLE;
-        list_add_tail(&mss->list,&msq->q_senders);
+        mss->tsk = current;
+        current->state = TASK_INTERRUPTIBLE;
+        list_add_tail(&mss->list, &msq->q_senders);
 }
 
-static inline void ss_del(struct msg_sender* mss)
+static inline void ss_del(struct msg_sender *mss)
 {
-        if(mss->list.next != NULL)
+        if (mss->list.next != NULL)
                 list_del(&mss->list);
 }
 
-static void ss_wakeup(struct list_head* h, int kill)
+static void ss_wakeup(struct list_head *h, int kill)
 {
         struct list_head *tmp;
 
         tmp = h->next;
         while (tmp != h) {
-                struct msg_sender* mss;
-                
-                mss = list_entry(tmp,struct msg_sender,list);
+                struct msg_sender *mss;
+
+                mss = list_entry(tmp, struct msg_sender, list);
                 tmp = tmp->next;
-                if(kill)
-                        mss->list.next=NULL;
+                if (kill)
+                        mss->list.next = NULL;
                 wake_up_process(mss->tsk);
         }
 }
 
-static void expunge_all(struct msg_queue* msq, int res)
+static void expunge_all(struct msg_queue *msq, int res)
 {
         struct list_head *tmp;
 
         tmp = msq->q_receivers.next;
         while (tmp != &msq->q_receivers) {
-                struct msg_receiver* msr;
-                
-                msr = list_entry(tmp,struct msg_receiver,r_list);
+                struct msg_receiver *msr;
+
+                msr = list_entry(tmp, struct msg_receiver, r_list);
                 tmp = tmp->next;
                 msr->r_msg = NULL;
                 wake_up_process(msr->r_tsk);
@@ -178,26 +177,28 @@ static void expunge_all(struct msg_queue* msq, int res)
                 msr->r_msg = ERR_PTR(res);
         }
 }
-/* 
- * freeque() wakes up waiters on the sender and receiver waiting queue, 
- * removes the message queue from message queue ID 
+
+/*
+ * freeque() wakes up waiters on the sender and receiver waiting queue,
+ * removes the message queue from message queue ID
  * array, and cleans up all the messages associated with this queue.
  *
  * msg_ids.mutex and the spinlock for this message queue is hold
  * before freeque() is called. msg_ids.mutex remains locked on exit.
  */
-static void freeque (struct msg_queue *msq, int id)
+static void freeque(struct msg_queue *msq, int id)
 {
         struct list_head *tmp;
 
-        expunge_all(msq,-EIDRM);
-        ss_wakeup(&msq->q_senders,1);
+        expunge_all(msq, -EIDRM);
+        ss_wakeup(&msq->q_senders, 1);
         msq = msg_rmid(id);
         msg_unlock(msq);
-                
+
         tmp = msq->q_messages.next;
-        while(tmp != &msq->q_messages) {
-                struct msg_msg* msg = list_entry(tmp,struct msg_msg,m_list);
+        while (tmp != &msq->q_messages) {
+                struct msg_msg *msg = list_entry(tmp, struct msg_msg, m_list);
+
                 tmp = tmp->next;
                 atomic_dec(&msg_hdrs);
                 free_msg(msg);
@@ -207,10 +208,10 @@ static void freeque (struct msg_queue *msq, int id)
         ipc_rcu_putref(msq);
 }
 
-asmlinkage long sys_msgget (key_t key, int msgflg)
+asmlinkage long sys_msgget(key_t key, int msgflg)
 {
-        int id, ret = -EPERM;
         struct msg_queue *msq;
+        int id, ret = -EPERM;
         
         mutex_lock(&msg_ids.mutex);
         if (key == IPC_PRIVATE) 
@@ -224,31 +225,34 @@ asmlinkage long sys_msgget (key_t key, int msgflg)
                 ret = -EEXIST;
         } else {
                 msq = msg_lock(id);
-                BUG_ON(msq==NULL);
+                BUG_ON(msq == NULL);
                 if (ipcperms(&msq->q_perm, msgflg))
                         ret = -EACCES;
                 else {
                         int qid = msg_buildid(id, msq->q_perm.seq);
-                        ret = security_msg_queue_associate(msq, msgflg);
+
+                        ret = security_msg_queue_associate(msq, msgflg);
                         if (!ret)
                                 ret = qid;
                 }
                 msg_unlock(msq);
         }
         mutex_unlock(&msg_ids.mutex);
+
         return ret;
 }
 
-static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
+static inline unsigned long
+copy_msqid_to_user(void __user *buf, struct msqid64_ds *in, int version)
 {
         switch(version) {
         case IPC_64:
-                return copy_to_user (buf, in, sizeof(*in));
+                return copy_to_user(buf, in, sizeof(*in));
         case IPC_OLD:
-            {
+        {
                 struct msqid_ds out;
 
-                memset(&out,0,sizeof(out));
+                memset(&out, 0, sizeof(out));
 
                 ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
 
@@ -256,18 +260,18 @@ static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_
                 out.msg_rtime           = in->msg_rtime;
                 out.msg_ctime           = in->msg_ctime;
 
-                if(in->msg_cbytes > USHRT_MAX)
+                if (in->msg_cbytes > USHRT_MAX)
                         out.msg_cbytes  = USHRT_MAX;
                 else
                         out.msg_cbytes  = in->msg_cbytes;
                 out.msg_lcbytes         = in->msg_cbytes;
 
-                if(in->msg_qnum > USHRT_MAX)
+                if (in->msg_qnum > USHRT_MAX)
                         out.msg_qnum    = USHRT_MAX;
                 else
                         out.msg_qnum    = in->msg_qnum;
 
-                if(in->msg_qbytes > USHRT_MAX)
+                if (in->msg_qbytes > USHRT_MAX)
                         out.msg_qbytes  = USHRT_MAX;
                 else
                         out.msg_qbytes  = in->msg_qbytes;
@@ -276,8 +280,8 @@ static inline unsigned long copy_msqid_to_user(void __user *buf, struct msqid64_
                 out.msg_lspid           = in->msg_lspid;
                 out.msg_lrpid           = in->msg_lrpid;
 
-                return copy_to_user (buf, &out, sizeof(out));
-            }
+                return copy_to_user(buf, &out, sizeof(out));
+        }
         default:
                 return -EINVAL;
         }
@@ -290,14 +294,15 @@ struct msq_setbuf {
         mode_t          mode;
 };
 
-static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
+static inline unsigned long
+copy_msqid_from_user(struct msq_setbuf *out, void __user *buf, int version)
 {
         switch(version) {
         case IPC_64:
-            {
+        {
                 struct msqid64_ds tbuf;
 
-                if (copy_from_user (&tbuf, buf, sizeof (tbuf)))
+                if (copy_from_user(&tbuf, buf, sizeof(tbuf)))
                         return -EFAULT;
 
                 out->qbytes             = tbuf.msg_qbytes;
@@ -306,60 +311,61 @@ static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void __
                 out->mode               = tbuf.msg_perm.mode;
 
                 return 0;
-            }
+        }
         case IPC_OLD:
-            {
+        {
                 struct msqid_ds tbuf_old;
 
-                if (copy_from_user (&tbuf_old, buf, sizeof (tbuf_old)))
+                if (copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
                         return -EFAULT;
 
                 out->uid                = tbuf_old.msg_perm.uid;
                 out->gid                = tbuf_old.msg_perm.gid;
                 out->mode               = tbuf_old.msg_perm.mode;
 
-                if(tbuf_old.msg_qbytes == 0)
+                if (tbuf_old.msg_qbytes == 0)
                         out->qbytes     = tbuf_old.msg_lqbytes;
                 else
                         out->qbytes     = tbuf_old.msg_qbytes;
 
                 return 0;
-            }
+        }
         default:
                 return -EINVAL;
         }
 }
 
-asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
+asmlinkage long sys_msgctl(int msqid, int cmd, struct msqid_ds __user *buf)
 {
-        int err, version;
-        struct msg_queue *msq;
-        struct msq_setbuf setbuf;
         struct kern_ipc_perm *ipcp;
-        
+        struct msq_setbuf setbuf;
+        struct msg_queue *msq;
+        int err, version;
+
         if (msqid < 0 || cmd < 0)
                 return -EINVAL;
 
         version = ipc_parse_version(&cmd);
 
         switch (cmd) {
-        case IPC_INFO: 
-        case MSG_INFO: 
-        { 
+        case IPC_INFO:
+        case MSG_INFO:
+        {
                 struct msginfo msginfo;
                 int max_id;
+
                 if (!buf)
                         return -EFAULT;
-                /* We must not return kernel stack data.
+                /*
+                 * We must not return kernel stack data.
                  * due to padding, it's not enough
                  * to set all member fields.
                  */
-
                 err = security_msg_queue_msgctl(NULL, cmd);
                 if (err)
                         return err;
 
-                memset(&msginfo,0,sizeof(msginfo));     
+                memset(&msginfo, 0, sizeof(msginfo));
                 msginfo.msgmni = msg_ctlmni;
                 msginfo.msgmax = msg_ctlmax;
                 msginfo.msgmnb = msg_ctlmnb;
@@ -377,36 +383,37 @@ asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
                 }
                 max_id = msg_ids.max_id;
                 mutex_unlock(&msg_ids.mutex);
-                if (copy_to_user (buf, &msginfo, sizeof(struct msginfo)))
+                if (copy_to_user(buf, &msginfo, sizeof(struct msginfo)))
                         return -EFAULT;
-                return (max_id < 0) ? 0: max_id;
+                return (max_id < 0) ? 0 : max_id;
         }
         case MSG_STAT:
         case IPC_STAT:
         {
                 struct msqid64_ds tbuf;
                 int success_return;
+
                 if (!buf)
                         return -EFAULT;
-                if(cmd == MSG_STAT && msqid >= msg_ids.entries->size)
+                if (cmd == MSG_STAT && msqid >= msg_ids.entries->size)
                         return -EINVAL;
 
-                memset(&tbuf,0,sizeof(tbuf));
+                memset(&tbuf, 0, sizeof(tbuf));
 
                 msq = msg_lock(msqid);
                 if (msq == NULL)
                         return -EINVAL;
 
-                if(cmd == MSG_STAT) {
+                if (cmd == MSG_STAT) {
                         success_return = msg_buildid(msqid, msq->q_perm.seq);
                 } else {
                         err = -EIDRM;
-                        if (msg_checkid(msq,msqid))
+                        if (msg_checkid(msq, msqid))
                                 goto out_unlock;
                         success_return = 0;
                 }
                 err = -EACCES;
-                if (ipcperms (&msq->q_perm, S_IRUGO))
+                if (ipcperms(&msq->q_perm, S_IRUGO))
                         goto out_unlock;
 
                 err = security_msg_queue_msgctl(msq, cmd);
@@ -430,7 +437,7 @@ asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
         case IPC_SET:
                 if (!buf)
                         return -EFAULT;
-                if (copy_msqid_from_user (&setbuf, buf, version))
+                if (copy_msqid_from_user(&setbuf, buf, version))
                         return -EFAULT;
                 break;
         case IPC_RMID:
@@ -441,12 +448,12 @@ asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
 
         mutex_lock(&msg_ids.mutex);
         msq = msg_lock(msqid);
-        err=-EINVAL;
+        err = -EINVAL;
         if (msq == NULL)
                 goto out_up;
 
         err = -EIDRM;
-        if (msg_checkid(msq,msqid))
+        if (msg_checkid(msq, msqid))
                 goto out_unlock_up;
         ipcp = &msq->q_perm;
 
@@ -454,15 +461,16 @@ asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
         if (err)
                 goto out_unlock_up;
         if (cmd==IPC_SET) {
-                err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid, setbuf.mode);
+                err = audit_ipc_set_perm(setbuf.qbytes, setbuf.uid, setbuf.gid,
+                                         setbuf.mode);
                 if (err)
                         goto out_unlock_up;
         }
 
         err = -EPERM;
-        if (current->euid != ipcp->cuid && 
+        if (current->euid != ipcp->cuid &&
             current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN))
-            /* We _could_ check for CAP_CHOWN above, but we don't */
+                /* We _could_ check for CAP_CHOWN above, but we don't */
                 goto out_unlock_up;
 
         err = security_msg_queue_msgctl(msq, cmd);
@@ -480,22 +488,22 @@ asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
 
                 ipcp->uid = setbuf.uid;
                 ipcp->gid = setbuf.gid;
-                ipcp->mode = (ipcp->mode & ~S_IRWXUGO) | 
-                        (S_IRWXUGO & setbuf.mode);
+                ipcp->mode = (ipcp->mode & ~S_IRWXUGO) |
+                             (S_IRWXUGO & setbuf.mode);
                 msq->q_ctime = get_seconds();
                 /* sleeping receivers might be excluded by
                  * stricter permissions.
                  */
-                expunge_all(msq,-EAGAIN);
+                expunge_all(msq, -EAGAIN);
                 /* sleeping senders might be able to send
                  * due to a larger queue size.
                  */
-                ss_wakeup(&msq->q_senders,0);
+                ss_wakeup(&msq->q_senders, 0);
                 msg_unlock(msq);
                 break;
         }
         case IPC_RMID:
-                freeque (msq, msqid); 
+                freeque(msq, msqid);
                 break;
         }
         err = 0;
@@ -510,41 +518,44 @@ out_unlock:
         return err;
 }
 
-static int testmsg(struct msg_msg* msg,long type,int mode)
+static int testmsg(struct msg_msg *msg, long type, int mode)
 {
         switch(mode)
         {
                 case SEARCH_ANY:
                         return 1;
                 case SEARCH_LESSEQUAL:
-                        if(msg->m_type <=type)
+                        if (msg->m_type <=type)
                                 return 1;
                         break;
                 case SEARCH_EQUAL:
-                        if(msg->m_type == type)
+                        if (msg->m_type == type)
                                 return 1;
                         break;
                 case SEARCH_NOTEQUAL:
-                        if(msg->m_type != type)
+                        if (msg->m_type != type)
                                 return 1;
                         break;
         }
         return 0;
 }
 
-static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
+static inline int pipelined_send(struct msg_queue *msq, struct msg_msg *msg)
 {
-        struct list_head* tmp;
+        struct list_head *tmp;
 
         tmp = msq->q_receivers.next;
         while (tmp != &msq->q_receivers) {
-                struct msg_receiver* msr;
-                msr = list_entry(tmp,struct msg_receiver,r_list);
+                struct msg_receiver *msr;
+
+                msr = list_entry(tmp, struct msg_receiver, r_list);
                 tmp = tmp->next;
-                if(testmsg(msg,msr->r_msgtype,msr->r_mode) &&
-                   !security_msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) {
+                if (testmsg(msg, msr->r_msgtype, msr->r_mode) &&
+                    !security_msg_queue_msgrcv(msq, msg, msr->r_tsk,
+                                               msr->r_msgtype, msr->r_mode)) {
+
                         list_del(&msr->r_list);
-                        if(msr->r_maxsize < msg->m_ts) {
+                        if (msr->r_maxsize < msg->m_ts) {
                                 msr->r_msg = NULL;
                                 wake_up_process(msr->r_tsk);
                                 smp_mb();
@@ -556,6 +567,7 @@ static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
                                 wake_up_process(msr->r_tsk);
                                 smp_mb();
                                 msr->r_msg = msg;
+
                                 return 1;
                         }
                 }
@@ -563,40 +575,41 @@ static inline int pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
         return 0;
 }
 
-asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
+asmlinkage long
+sys_msgsnd(int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg)
 {
         struct msg_queue *msq;
         struct msg_msg *msg;
         long mtype;
         int err;
-        
+
         if (msgsz > msg_ctlmax || (long) msgsz < 0 || msqid < 0)
                 return -EINVAL;
         if (get_user(mtype, &msgp->mtype))
-                return -EFAULT; 
+                return -EFAULT;
         if (mtype < 1)
                 return -EINVAL;
 
         msg = load_msg(msgp->mtext, msgsz);
-        if(IS_ERR(msg))
+        if (IS_ERR(msg))
                 return PTR_ERR(msg);
 
         msg->m_type = mtype;
         msg->m_ts = msgsz;
 
         msq = msg_lock(msqid);
-        err=-EINVAL;
-        if(msq==NULL)
+        err = -EINVAL;
+        if (msq == NULL)
                 goto out_free;
 
         err= -EIDRM;
-        if (msg_checkid(msq,msqid))
+        if (msg_checkid(msq, msqid))
                 goto out_unlock_free;
 
         for (;;) {
                 struct msg_sender s;
 
-                err=-EACCES;
+                err = -EACCES;
                 if (ipcperms(&msq->q_perm, S_IWUGO))
                         goto out_unlock_free;
 
@@ -604,14 +617,14 @@ asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                 if (err)
                         goto out_unlock_free;
 
-                if(msgsz + msq->q_cbytes <= msq->q_qbytes &&
+                if (msgsz + msq->q_cbytes <= msq->q_qbytes &&
                                 1 + msq->q_qnum <= msq->q_qbytes) {
                         break;
                 }
 
                 /* queue full, wait: */
-                if(msgflg&IPC_NOWAIT) {
-                        err=-EAGAIN;
+                if (msgflg & IPC_NOWAIT) {
+                        err = -EAGAIN;
                         goto out_unlock_free;
                 }
                 ss_add(msq, &s);
@@ -626,9 +639,9 @@ asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                         goto out_unlock_free;
                 }
                 ss_del(&s);
-                
+
                 if (signal_pending(current)) {
-                        err=-ERESTARTNOHAND;
+                        err = -ERESTARTNOHAND;
                         goto out_unlock_free;
                 }
         }
@@ -636,47 +649,47 @@ asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz,
         msq->q_lspid = current->tgid;
         msq->q_stime = get_seconds();
 
-        if(!pipelined_send(msq,msg)) {
+        if (!pipelined_send(msq, msg)) {
                 /* noone is waiting for this message, enqueue it */
-                list_add_tail(&msg->m_list,&msq->q_messages);
+                list_add_tail(&msg->m_list, &msq->q_messages);
                 msq->q_cbytes += msgsz;
                 msq->q_qnum++;
-                atomic_add(msgsz,&msg_bytes);
+                atomic_add(msgsz, &msg_bytes);
                 atomic_inc(&msg_hdrs);
         }
-        
+
         err = 0;
         msg = NULL;
 
 out_unlock_free:
         msg_unlock(msq);
 out_free:
-        if(msg!=NULL)
+        if (msg != NULL)
                 free_msg(msg);
         return err;
 }
 
-static inline int convert_mode(long* msgtyp, int msgflg)
+static inline int convert_mode(long *msgtyp, int msgflg)
 {
-        /* 
+        /*
          *  find message of correct type.
          *  msgtyp = 0 => get first.
          *  msgtyp > 0 => get first message of matching type.
-         *  msgtyp < 0 => get message with least type must be < abs(msgtype).  
+         *  msgtyp < 0 => get message with least type must be < abs(msgtype).
          */
-        if(*msgtyp==0)
+        if (*msgtyp == 0)
                 return SEARCH_ANY;
-        if(*msgtyp<0) {
-                *msgtyp=-(*msgtyp);
+        if (*msgtyp < 0) {
+                *msgtyp = -*msgtyp;
                 return SEARCH_LESSEQUAL;
         }
-        if(msgflg & MSG_EXCEPT)
+        if (msgflg & MSG_EXCEPT)
                 return SEARCH_NOTEQUAL;
         return SEARCH_EQUAL;
 }
 
-asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
-                            long msgtyp, int msgflg)
+asmlinkage long sys_msgrcv(int msqid, struct msgbuf __user *msgp, size_t msgsz,
+                           long msgtyp, int msgflg)
 {
         struct msg_queue *msq;
         struct msg_msg *msg;
@@ -684,44 +697,51 @@ asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
 
         if (msqid < 0 || (long) msgsz < 0)
                 return -EINVAL;
-        mode = convert_mode(&msgtyp,msgflg);
+        mode = convert_mode(&msgtyp, msgflg);
 
         msq = msg_lock(msqid);
-        if(msq==NULL)
+        if (msq == NULL)
                 return -EINVAL;
 
         msg = ERR_PTR(-EIDRM);
-        if (msg_checkid(msq,msqid))
+        if (msg_checkid(msq, msqid))
                 goto out_unlock;
 
         for (;;) {
                 struct msg_receiver msr_d;
-                struct list_head* tmp;
+                struct list_head *tmp;
 
                 msg = ERR_PTR(-EACCES);
-                if (ipcperms (&msq->q_perm, S_IRUGO))
+                if (ipcperms(&msq->q_perm, S_IRUGO))
                         goto out_unlock;
 
                 msg = ERR_PTR(-EAGAIN);
                 tmp = msq->q_messages.next;
                 while (tmp != &msq->q_messages) {
                         struct msg_msg *walk_msg;
-                        walk_msg = list_entry(tmp,struct msg_msg,m_list);
-                        if(testmsg(walk_msg,msgtyp,mode) &&
-                           !security_msg_queue_msgrcv(msq, walk_msg, current, msgtyp, mode)) {
+
+                        walk_msg = list_entry(tmp, struct msg_msg, m_list);
+                        if (testmsg(walk_msg, msgtyp, mode) &&
+                            !security_msg_queue_msgrcv(msq, walk_msg, current,
+                                                       msgtyp, mode)) {
+
                                 msg = walk_msg;
-                                if(mode == SEARCH_LESSEQUAL && walk_msg->m_type != 1) {
-                                        msg=walk_msg;
-                                        msgtyp=walk_msg->m_type-1;
+                                if (mode == SEARCH_LESSEQUAL &&
+                                                walk_msg->m_type != 1) {
+                                        msg = walk_msg;
+                                        msgtyp = walk_msg->m_type - 1;
                                 } else {
-                                        msg=walk_msg;
+                                        msg = walk_msg;
                                         break;
                                 }
                         }
                         tmp = tmp->next;
                 }
-                if(!IS_ERR(msg)) {
-                        /* Found a suitable message. Unlink it from the queue. */
+                if (!IS_ERR(msg)) {
+                        /*
+                         * Found a suitable message.
+                         * Unlink it from the queue.
+                         */
                         if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
                                 msg = ERR_PTR(-E2BIG);
                                 goto out_unlock;
@@ -731,9 +751,9 @@ asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                         msq->q_rtime = get_seconds();
                         msq->q_lrpid = current->tgid;
                         msq->q_cbytes -= msg->m_ts;
-                        atomic_sub(msg->m_ts,&msg_bytes);
+                        atomic_sub(msg->m_ts, &msg_bytes);
                         atomic_dec(&msg_hdrs);
-                        ss_wakeup(&msq->q_senders,0);
+                        ss_wakeup(&msq->q_senders, 0);
                         msg_unlock(msq);
                         break;
                 }
@@ -742,13 +762,13 @@ asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                         msg = ERR_PTR(-ENOMSG);
                         goto out_unlock;
                 }
-                list_add_tail(&msr_d.r_list,&msq->q_receivers);
+                list_add_tail(&msr_d.r_list, &msq->q_receivers);
                 msr_d.r_tsk = current;
                 msr_d.r_msgtype = msgtyp;
                 msr_d.r_mode = mode;
-                if(msgflg & MSG_NOERROR)
+                if (msgflg & MSG_NOERROR)
                         msr_d.r_maxsize = INT_MAX;
-                 else
+                else
                         msr_d.r_maxsize = msgsz;
                 msr_d.r_msg = ERR_PTR(-EAGAIN);
                 current->state = TASK_INTERRUPTIBLE;
@@ -773,17 +793,17 @@ asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                  * wake_up_process(). There is a race with exit(), see
                  * ipc/mqueue.c for the details.
                  */
-                msg = (struct msg_msg*) msr_d.r_msg;
+                msg = (struct msg_msg*)msr_d.r_msg;
                 while (msg == NULL) {
                         cpu_relax();
-                        msg = (struct msg_msg*) msr_d.r_msg;
+                        msg = (struct msg_msg *)msr_d.r_msg;
                 }
 
                 /* Lockless receive, part 3:
                  * If there is a message or an error then accept it without
                  * locking.
                  */
-                if(msg != ERR_PTR(-EAGAIN)) {
+                if (msg != ERR_PTR(-EAGAIN)) {
                         rcu_read_unlock();
                         break;
                 }
@@ -798,7 +818,7 @@ asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz,
                  * Repeat test after acquiring the spinlock.
                  */
                 msg = (struct msg_msg*)msr_d.r_msg;
-                if(msg != ERR_PTR(-EAGAIN))
+                if (msg != ERR_PTR(-EAGAIN))
                         goto out_unlock;
 
                 list_del(&msr_d.r_list);
@@ -810,14 +830,15 @@ out_unlock:
                 }
         }
         if (IS_ERR(msg))
-                return PTR_ERR(msg);
+                return PTR_ERR(msg);
 
         msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
         if (put_user (msg->m_type, &msgp->mtype) ||
             store_msg(msgp->mtext, msg, msgsz)) {
-                    msgsz = -EFAULT;
+                msgsz = -EFAULT;
         }
         free_msg(msg);
+
         return msgsz;
 }
 
@@ -827,20 +848,20 @@ static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
         struct msg_queue *msq = it;
 
         return seq_printf(s,
-                          "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
-                          msq->q_perm.key,
-                          msq->q_id,
-                          msq->q_perm.mode,
-                          msq->q_cbytes,
-                          msq->q_qnum,
-                          msq->q_lspid,
-                          msq->q_lrpid,
-                          msq->q_perm.uid,
-                          msq->q_perm.gid,
-                          msq->q_perm.cuid,
-                          msq->q_perm.cgid,
-                          msq->q_stime,
-                          msq->q_rtime,
-                          msq->q_ctime);
+                        "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
+                        msq->q_perm.key,
+                        msq->q_id,
+                        msq->q_perm.mode,
+                        msq->q_cbytes,
+                        msq->q_qnum,
+                        msq->q_lspid,
+                        msq->q_lrpid,
+                        msq->q_perm.uid,
+                        msq->q_perm.gid,
+                        msq->q_perm.cuid,
+                        msq->q_perm.cgid,
+                        msq->q_stime,
+                        msq->q_rtime,
+                        msq->q_ctime);
 }
 #endif
diff --git a/kernel/delayacct.c b/kernel/delayacct.c
index f05392d64267..57ca3730205d 100644
--- a/kernel/delayacct.c
+++ b/kernel/delayacct.c
@@ -19,15 +19,15 @@
 #include <linux/sysctl.h>
 #include <linux/delayacct.h>
 
-int delayacct_on __read_mostly; /* Delay accounting turned on/off */
+int delayacct_on __read_mostly = 1;     /* Delay accounting turned on/off */
 kmem_cache_t *delayacct_cache;
 
-static int __init delayacct_setup_enable(char *str)
+static int __init delayacct_setup_disable(char *str)
 {
-        delayacct_on = 1;
+        delayacct_on = 0;
         return 1;
 }
-__setup("delayacct", delayacct_setup_enable);
+__setup("nodelayacct", delayacct_setup_disable);
 
 void delayacct_init(void)
 {
diff --git a/kernel/futex.c b/kernel/futex.c
index cf0c8e21d1ab..dda2049692a2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -415,15 +415,15 @@ out_unlock:
  */
 void exit_pi_state_list(struct task_struct *curr)
 {
-        struct futex_hash_bucket *hb;
         struct list_head *next, *head = &curr->pi_state_list;
         struct futex_pi_state *pi_state;
+        struct futex_hash_bucket *hb;
         union futex_key key;
 
         /*
          * We are a ZOMBIE and nobody can enqueue itself on
          * pi_state_list anymore, but we have to be careful
-         * versus waiters unqueueing themselfs
+         * versus waiters unqueueing themselves:
          */
         spin_lock_irq(&curr->pi_lock);
         while (!list_empty(head)) {
@@ -431,21 +431,24 @@ void exit_pi_state_list(struct task_struct *curr)
                 next = head->next;
                 pi_state = list_entry(next, struct futex_pi_state, list);
                 key = pi_state->key;
+                hb = hash_futex(&key);
                 spin_unlock_irq(&curr->pi_lock);
 
-                hb = hash_futex(&key);
                 spin_lock(&hb->lock);
 
                 spin_lock_irq(&curr->pi_lock);
+                /*
+                 * We dropped the pi-lock, so re-check whether this
+                 * task still owns the PI-state:
+                 */
                 if (head->next != next) {
                         spin_unlock(&hb->lock);
                         continue;
                 }
 
-                list_del_init(&pi_state->list);
-
                 WARN_ON(pi_state->owner != curr);
-
+                WARN_ON(list_empty(&pi_state->list));
+                list_del_init(&pi_state->list);
                 pi_state->owner = NULL;
                 spin_unlock_irq(&curr->pi_lock);
 
@@ -470,7 +473,7 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
         head = &hb->chain;
 
         list_for_each_entry_safe(this, next, head, list) {
-                if (match_futex (&this->key, &me->key)) {
+                if (match_futex(&this->key, &me->key)) {
                         /*
                          * Another waiter already exists - bump up
                          * the refcount and return its pi_state:
@@ -482,6 +485,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
                         if (unlikely(!pi_state))
                                 return -EINVAL;
 
+                        WARN_ON(!atomic_read(&pi_state->refcount));
+
                         atomic_inc(&pi_state->refcount);
                         me->pi_state = pi_state;
 
@@ -490,10 +495,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
         }
 
         /*
-         * We are the first waiter - try to look up the real owner and
-         * attach the new pi_state to it:
+         * We are the first waiter - try to look up the real owner and attach
+         * the new pi_state to it, but bail out when the owner died bit is set
+         * and TID = 0:
          */
         pid = uval & FUTEX_TID_MASK;
+        if (!pid && (uval & FUTEX_OWNER_DIED))
+                return -ESRCH;
         p = futex_find_get_task(pid);
         if (!p)
                 return -ESRCH;
@@ -510,6 +518,7 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
         pi_state->key = me->key;
 
         spin_lock_irq(&p->pi_lock);
+        WARN_ON(!list_empty(&pi_state->list));
         list_add(&pi_state->list, &p->pi_state_list);
         pi_state->owner = p;
         spin_unlock_irq(&p->pi_lock);
@@ -573,20 +582,29 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
          * kept enabled while there is PI state around. We must also
          * preserve the owner died bit.)
          */
-        newval = (uval & FUTEX_OWNER_DIED) | FUTEX_WAITERS | new_owner->pid;
+        if (!(uval & FUTEX_OWNER_DIED)) {
+                newval = FUTEX_WAITERS | new_owner->pid;
 
-        inc_preempt_count();
-        curval = futex_atomic_cmpxchg_inatomic(uaddr, uval, newval);
-        dec_preempt_count();
+                inc_preempt_count();
+                curval = futex_atomic_cmpxchg_inatomic(uaddr, uval, newval);
+                dec_preempt_count();
+                if (curval == -EFAULT)
+                        return -EFAULT;
+                if (curval != uval)
+                        return -EINVAL;
+        }
 
-        if (curval == -EFAULT)
-                return -EFAULT;
-        if (curval != uval)
-                return -EINVAL;
+        spin_lock_irq(&pi_state->owner->pi_lock);
+        WARN_ON(list_empty(&pi_state->list));
+        list_del_init(&pi_state->list);
+        spin_unlock_irq(&pi_state->owner->pi_lock);
 
-        list_del_init(&pi_state->owner->pi_state_list);
+        spin_lock_irq(&new_owner->pi_lock);
+        WARN_ON(!list_empty(&pi_state->list));
         list_add(&pi_state->list, &new_owner->pi_state_list);
         pi_state->owner = new_owner;
+        spin_unlock_irq(&new_owner->pi_lock);
+
         rt_mutex_unlock(&pi_state->pi_mutex);
 
         return 0;
@@ -1236,6 +1254,7 @@ static int do_futex_lock_pi(u32 __user *uaddr, int detect, int trylock,
                 /* Owner died? */
                 if (q.pi_state->owner != NULL) {
                         spin_lock_irq(&q.pi_state->owner->pi_lock);
+                        WARN_ON(list_empty(&q.pi_state->list));
                         list_del_init(&q.pi_state->list);
                         spin_unlock_irq(&q.pi_state->owner->pi_lock);
                 } else
@@ -1244,6 +1263,7 @@ static int do_futex_lock_pi(u32 __user *uaddr, int detect, int trylock,
                 q.pi_state->owner = current;
 
                 spin_lock_irq(&current->pi_lock);
+                WARN_ON(!list_empty(&q.pi_state->list));
                 list_add(&q.pi_state->list, &current->pi_state_list);
                 spin_unlock_irq(&current->pi_lock);
 
@@ -1427,9 +1447,11 @@ retry_locked:
          * again. If it succeeds then we can return without waking
          * anyone else up:
          */
-        inc_preempt_count();
-        uval = futex_atomic_cmpxchg_inatomic(uaddr, current->pid, 0);
-        dec_preempt_count();
+        if (!(uval & FUTEX_OWNER_DIED)) {
+                inc_preempt_count();
+                uval = futex_atomic_cmpxchg_inatomic(uaddr, current->pid, 0);
+                dec_preempt_count();
+        }
 
         if (unlikely(uval == -EFAULT))
                 goto pi_faulted;
@@ -1462,9 +1484,11 @@ retry_locked:
         /*
          * No waiters - kernel unlocks the futex:
          */
-        ret = unlock_futex_pi(uaddr, uval);
-        if (ret == -EFAULT)
-                goto pi_faulted;
+        if (!(uval & FUTEX_OWNER_DIED)) {
+                ret = unlock_futex_pi(uaddr, uval);
+                if (ret == -EFAULT)
+                        goto pi_faulted;
+        }
 
 out_unlock:
         spin_unlock(&hb->lock);
@@ -1683,9 +1707,9 @@ err_unlock:
  * Process a futex-list entry, check whether it's owned by the
  * dying task, and do notification if so:
  */
-int handle_futex_death(u32 __user *uaddr, struct task_struct *curr)
+int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi)
 {
-        u32 uval, nval;
+        u32 uval, nval, mval;
 
 retry:
         if (get_user(uval, uaddr))
@@ -1702,21 +1726,45 @@ retry:
                  * thread-death.) The rest of the cleanup is done in
                  * userspace.
                  */
-                nval = futex_atomic_cmpxchg_inatomic(uaddr, uval,
-                                                     uval | FUTEX_OWNER_DIED);
+                mval = (uval & FUTEX_WAITERS) | FUTEX_OWNER_DIED;
+                nval = futex_atomic_cmpxchg_inatomic(uaddr, uval, mval);
+
                 if (nval == -EFAULT)
                         return -1;
 
                 if (nval != uval)
                         goto retry;
 
-                if (uval & FUTEX_WAITERS)
-                        futex_wake(uaddr, 1);
+                /*
+                 * Wake robust non-PI futexes here. The wakeup of
+                 * PI futexes happens in exit_pi_state():
+                 */
+                if (!pi) {
+                        if (uval & FUTEX_WAITERS)
+                                futex_wake(uaddr, 1);
+                }
         }
         return 0;
 }
 
 /*
+ * Fetch a robust-list pointer. Bit 0 signals PI futexes:
+ */
+static inline int fetch_robust_entry(struct robust_list __user **entry,
+                                     struct robust_list __user **head, int *pi)
+{
+        unsigned long uentry;
+
+        if (get_user(uentry, (unsigned long *)head))
+                return -EFAULT;
+
+        *entry = (void *)(uentry & ~1UL);
+        *pi = uentry & 1;
+
+        return 0;
+}
+
+/*
  * Walk curr->robust_list (very carefully, it's a userspace list!)
  * and mark any locks found there dead, and notify any waiters.
  *
@@ -1726,14 +1774,14 @@ void exit_robust_list(struct task_struct *curr)
 {
         struct robust_list_head __user *head = curr->robust_list;
         struct robust_list __user *entry, *pending;
-        unsigned int limit = ROBUST_LIST_LIMIT;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
         unsigned long futex_offset;
 
         /*
          * Fetch the list head (which was registered earlier, via
          * sys_set_robust_list()):
          */
-        if (get_user(entry, &head->list.next))
+        if (fetch_robust_entry(&entry, &head->list.next, &pi))
                 return;
         /*
          * Fetch the relative futex offset:
@@ -1744,10 +1792,11 @@ void exit_robust_list(struct task_struct *curr)
          * Fetch any possibly pending lock-add first, and handle it
          * if it exists:
          */
-        if (get_user(pending, &head->list_op_pending))
+        if (fetch_robust_entry(&pending, &head->list_op_pending, &pip))
                 return;
+
         if (pending)
-                handle_futex_death((void *)pending + futex_offset, curr);
+                handle_futex_death((void *)pending + futex_offset, curr, pip);
 
         while (entry != &head->list) {
                 /*
@@ -1756,12 +1805,12 @@ void exit_robust_list(struct task_struct *curr)
                  */
                 if (entry != pending)
                         if (handle_futex_death((void *)entry + futex_offset,
-                                                curr))
+                                                curr, pi))
                                 return;
                 /*
                  * Fetch the next entry in the list:
                  */
-                if (get_user(entry, &entry->next))
+                if (fetch_robust_entry(&entry, &entry->next, &pi))
                         return;
                 /*
                  * Avoid excessively long or circular lists:
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d1d92b441fb7..d1aab1a452cc 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -12,6 +12,23 @@
 
 #include <asm/uaccess.h>
 
+
+/*
+ * Fetch a robust-list pointer. Bit 0 signals PI futexes:
+ */
+static inline int
+fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
+                   compat_uptr_t *head, int *pi)
+{
+        if (get_user(*uentry, head))
+                return -EFAULT;
+
+        *entry = compat_ptr((*uentry) & ~1);
+        *pi = (unsigned int)(*uentry) & 1;
+
+        return 0;
+}
+
 /*
  * Walk curr->robust_list (very carefully, it's a userspace list!)
  * and mark any locks found there dead, and notify any waiters.
@@ -22,17 +39,16 @@ void compat_exit_robust_list(struct task_struct *curr)
 {
         struct compat_robust_list_head __user *head = curr->compat_robust_list;
         struct robust_list __user *entry, *pending;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi;
         compat_uptr_t uentry, upending;
-        unsigned int limit = ROBUST_LIST_LIMIT;
         compat_long_t futex_offset;
 
         /*
          * Fetch the list head (which was registered earlier, via
          * sys_set_robust_list()):
          */
-        if (get_user(uentry, &head->list.next))
+        if (fetch_robust_entry(&uentry, &entry, &head->list.next, &pi))
                 return;
-        entry = compat_ptr(uentry);
         /*
          * Fetch the relative futex offset:
          */
@@ -42,11 +58,11 @@ void compat_exit_robust_list(struct task_struct *curr)
          * Fetch any possibly pending lock-add first, and handle it
          * if it exists:
          */
-        if (get_user(upending, &head->list_op_pending))
+        if (fetch_robust_entry(&upending, &pending,
+                               &head->list_op_pending, &pi))
                 return;
-        pending = compat_ptr(upending);
         if (upending)
-                handle_futex_death((void *)pending + futex_offset, curr);
+                handle_futex_death((void *)pending + futex_offset, curr, pi);
 
         while (compat_ptr(uentry) != &head->list) {
                 /*
@@ -55,15 +71,15 @@ void compat_exit_robust_list(struct task_struct *curr)
                  */
                 if (entry != pending)
                         if (handle_futex_death((void *)entry + futex_offset,
-                                                curr))
+                                                curr, pi))
                                 return;
 
                 /*
                  * Fetch the next entry in the list:
                  */
-                if (get_user(uentry, (compat_uptr_t *)&entry->next))
+                if (fetch_robust_entry(&uentry, &entry,
+                                       (compat_uptr_t *)&entry->next, &pi))
                         return;
-                entry = compat_ptr(uentry);
                 /*
                  * Avoid excessively long or circular lists:
                  */
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index d17766d40dab..be989efc7856 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -835,7 +835,7 @@ static void migrate_hrtimers(int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit hrtimer_cpu_notify(struct notifier_block *self,
+static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
                                         unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -859,7 +859,7 @@ static int __devinit hrtimer_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata hrtimers_nb = {
+static struct notifier_block __cpuinitdata hrtimers_nb = {
         .notifier_call = hrtimer_cpu_notify,
 };
 
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 4e461438e48b..92be519eff26 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -137,16 +137,40 @@ EXPORT_SYMBOL(enable_irq);
  *      @irq:   interrupt to control
  *      @on:    enable/disable power management wakeup
  *
- *      Enable/disable power management wakeup mode
+ *      Enable/disable power management wakeup mode, which is
+ *      disabled by default.  Enables and disables must match,
+ *      just as they match for non-wakeup mode support.
+ *
+ *      Wakeup mode lets this IRQ wake the system from sleep
+ *      states like "suspend to RAM".
  */
 int set_irq_wake(unsigned int irq, unsigned int on)
 {
         struct irq_desc *desc = irq_desc + irq;
         unsigned long flags;
         int ret = -ENXIO;
+        int (*set_wake)(unsigned, unsigned) = desc->chip->set_wake;
 
+        /* wakeup-capable irqs can be shared between drivers that
+         * don't need to have the same sleep mode behaviors.
+         */
         spin_lock_irqsave(&desc->lock, flags);
-        if (desc->chip->set_wake)
+        if (on) {
+                if (desc->wake_depth++ == 0)
+                        desc->status |= IRQ_WAKEUP;
+                else
+                        set_wake = NULL;
+        } else {
+                if (desc->wake_depth == 0) {
+                        printk(KERN_WARNING "Unbalanced IRQ %d "
+                                        "wake disable\n", irq);
+                        WARN_ON(1);
+                } else if (--desc->wake_depth == 0)
+                        desc->status &= ~IRQ_WAKEUP;
+                else
+                        set_wake = NULL;
+        }
+        if (set_wake)
                 ret = desc->chip->set_wake(irq, on);
         spin_unlock_irqrestore(&desc->lock, flags);
         return ret;
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 64aab081153b..3f57dfdc8f92 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -393,6 +393,7 @@ static int __kprobes add_new_kprobe(struct kprobe *old_p, struct kprobe *p)
 static inline void add_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
 {
         copy_kprobe(p, ap);
+        flush_insn_slot(ap);
         ap->addr = p->addr;
         ap->pre_handler = aggr_pre_handler;
         ap->fault_handler = aggr_fault_handler;
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 759805c9859a..436ab35f6fa7 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -548,7 +548,7 @@ static void __devinit rcu_online_cpu(int cpu)
         tasklet_init(&per_cpu(rcu_tasklet, cpu), rcu_process_callbacks, 0UL);
 }
 
-static int __devinit rcu_cpu_notify(struct notifier_block *self,
+static int __cpuinit rcu_cpu_notify(struct notifier_block *self,
                                 unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -565,7 +565,7 @@ static int __devinit rcu_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata rcu_nb = {
+static struct notifier_block __cpuinitdata rcu_nb = {
         .notifier_call  = rcu_cpu_notify,
 };
 
diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
index d2ef13b485e7..3e13a1e5856f 100644
--- a/kernel/rtmutex.c
+++ b/kernel/rtmutex.c
@@ -7,6 +7,8 @@
  *  Copyright (C) 2005-2006 Timesys Corp., Thomas Gleixner <tglx@timesys.com>
  *  Copyright (C) 2005 Kihon Technologies Inc., Steven Rostedt
  *  Copyright (C) 2006 Esben Nielsen
+ *
+ *  See Documentation/rt-mutex-design.txt for details.
  */
 #include <linux/spinlock.h>
 #include <linux/module.h>
diff --git a/kernel/sched.c b/kernel/sched.c
index b44b9a43b0fc..a2be2d055299 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4456,9 +4456,9 @@ asmlinkage long sys_sched_yield(void)
         return 0;
 }
 
-static inline int __resched_legal(void)
+static inline int __resched_legal(int expected_preempt_count)
 {
-        if (unlikely(preempt_count()))
+        if (unlikely(preempt_count() != expected_preempt_count))
                 return 0;
         if (unlikely(system_state != SYSTEM_RUNNING))
                 return 0;
@@ -4484,7 +4484,7 @@ static void __cond_resched(void)
 
 int __sched cond_resched(void)
 {
-        if (need_resched() && __resched_legal()) {
+        if (need_resched() && __resched_legal(0)) {
                 __cond_resched();
                 return 1;
         }
@@ -4510,7 +4510,7 @@ int cond_resched_lock(spinlock_t *lock)
                 ret = 1;
                 spin_lock(lock);
         }
-        if (need_resched() && __resched_legal()) {
+        if (need_resched() && __resched_legal(1)) {
                 spin_release(&lock->dep_map, 1, _THIS_IP_);
                 _raw_spin_unlock(lock);
                 preempt_enable_no_resched();
@@ -4526,7 +4526,7 @@ int __sched cond_resched_softirq(void)
 {
         BUG_ON(!in_softirq());
 
-        if (need_resched() && __resched_legal()) {
+        if (need_resched() && __resched_legal(0)) {
                 raw_local_irq_disable();
                 _local_bh_enable();
                 raw_local_irq_enable();
@@ -6494,7 +6494,12 @@ static int build_sched_domains(const cpumask_t *cpu_map)
         for (i = 0; i < MAX_NUMNODES; i++)
                 init_numa_sched_groups_power(sched_group_nodes[i]);
 
-        init_numa_sched_groups_power(sched_group_allnodes);
+        if (sched_group_allnodes) {
+                int group = cpu_to_allnodes_group(first_cpu(*cpu_map));
+                struct sched_group *sg = &sched_group_allnodes[group];
+
+                init_numa_sched_groups_power(sg);
+        }
 #endif
 
         /* Attach the domains */
@@ -6761,6 +6766,11 @@ void __init sched_init(void)
         }
 
         set_load_weight(&init_task);
+
+#ifdef CONFIG_RT_MUTEXES
+        plist_head_init(&init_task.pi_waiters, &init_task.pi_lock);
+#endif
+
         /*
          * The boot idle thread does lazy MMU switching as well:
          */
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 0f08a84ae307..3789ca98197c 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -65,6 +65,7 @@ static inline void wakeup_softirqd(void)
  * This one is for softirq.c-internal use,
  * where hardirqs are disabled legitimately:
  */
+#ifdef CONFIG_TRACE_IRQFLAGS
 static void __local_bh_disable(unsigned long ip)
 {
         unsigned long flags;
@@ -80,6 +81,13 @@ static void __local_bh_disable(unsigned long ip)
                 trace_softirqs_off(ip);
         raw_local_irq_restore(flags);
 }
+#else /* !CONFIG_TRACE_IRQFLAGS */
+static inline void __local_bh_disable(unsigned long ip)
+{
+        add_preempt_count(SOFTIRQ_OFFSET);
+        barrier();
+}
+#endif /* CONFIG_TRACE_IRQFLAGS */
 
 void local_bh_disable(void)
 {
@@ -121,12 +129,16 @@ EXPORT_SYMBOL(_local_bh_enable);
 
 void local_bh_enable(void)
 {
+#ifdef CONFIG_TRACE_IRQFLAGS
         unsigned long flags;
 
         WARN_ON_ONCE(in_irq());
+#endif
         WARN_ON_ONCE(irqs_disabled());
 
+#ifdef CONFIG_TRACE_IRQFLAGS
         local_irq_save(flags);
+#endif
         /*
          * Are softirqs going to be turned on now:
          */
@@ -142,18 +154,22 @@ void local_bh_enable(void)
                 do_softirq();
 
         dec_preempt_count();
+#ifdef CONFIG_TRACE_IRQFLAGS
         local_irq_restore(flags);
+#endif
         preempt_check_resched();
 }
 EXPORT_SYMBOL(local_bh_enable);
 
 void local_bh_enable_ip(unsigned long ip)
 {
+#ifdef CONFIG_TRACE_IRQFLAGS
         unsigned long flags;
 
         WARN_ON_ONCE(in_irq());
 
         local_irq_save(flags);
+#endif
         /*
          * Are softirqs going to be turned on now:
          */
@@ -169,7 +185,9 @@ void local_bh_enable_ip(unsigned long ip)
                 do_softirq();
 
         dec_preempt_count();
+#ifdef CONFIG_TRACE_IRQFLAGS
         local_irq_restore(flags);
+#endif
         preempt_check_resched();
 }
 EXPORT_SYMBOL(local_bh_enable_ip);
@@ -547,7 +565,7 @@ static void takeover_tasklets(unsigned int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit cpu_callback(struct notifier_block *nfb,
+static int __cpuinit cpu_callback(struct notifier_block *nfb,
                                   unsigned long action,
                                   void *hcpu)
 {
@@ -587,7 +605,7 @@ static int __devinit cpu_callback(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata cpu_nfb = {
+static struct notifier_block __cpuinitdata cpu_nfb = {
         .notifier_call = cpu_callback
 };
 
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 6b76caa22981..03e6a2b0b787 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -104,7 +104,7 @@ static int watchdog(void * __bind_cpu)
 /*
  * Create/destroy watchdog threads as CPUs come and go:
  */
-static int __devinit
+static int __cpuinit
 cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
         int hotcpu = (unsigned long)hcpu;
@@ -142,7 +142,7 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata cpu_nfb = {
+static struct notifier_block __cpuinitdata cpu_nfb = {
         .notifier_call = cpu_callback
 };
 
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index f45179ce028e..e78187657330 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -121,46 +121,45 @@ static int send_reply(struct sk_buff *skb, pid_t pid)
 /*
  * Send taskstats data in @skb to listeners registered for @cpu's exit data
  */
-static int send_cpu_listeners(struct sk_buff *skb, unsigned int cpu)
+static void send_cpu_listeners(struct sk_buff *skb, unsigned int cpu)
 {
         struct genlmsghdr *genlhdr = nlmsg_data((struct nlmsghdr *)skb->data);
         struct listener_list *listeners;
         struct listener *s, *tmp;
         struct sk_buff *skb_next, *skb_cur = skb;
         void *reply = genlmsg_data(genlhdr);
-        int rc, ret, delcount = 0;
+        int rc, delcount = 0;
 
         rc = genlmsg_end(skb, reply);
         if (rc < 0) {
                 nlmsg_free(skb);
-                return rc;
+                return;
         }
 
         rc = 0;
         listeners = &per_cpu(listener_array, cpu);
         down_read(&listeners->sem);
-        list_for_each_entry_safe(s, tmp, &listeners->list, list) {
+        list_for_each_entry(s, &listeners->list, list) {
                 skb_next = NULL;
                 if (!list_is_last(&s->list, &listeners->list)) {
                         skb_next = skb_clone(skb_cur, GFP_KERNEL);
-                        if (!skb_next) {
-                                nlmsg_free(skb_cur);
-                                rc = -ENOMEM;
+                        if (!skb_next)
                                 break;
-                        }
                 }
-                ret = genlmsg_unicast(skb_cur, s->pid);
-                if (ret == -ECONNREFUSED) {
+                rc = genlmsg_unicast(skb_cur, s->pid);
+                if (rc == -ECONNREFUSED) {
                         s->valid = 0;
                         delcount++;
-                        rc = ret;
                 }
                 skb_cur = skb_next;
         }
         up_read(&listeners->sem);
 
+        if (skb_cur)
+                nlmsg_free(skb_cur);
+
         if (!delcount)
-                return rc;
+                return;
 
         /* Delete invalidated entries */
         down_write(&listeners->sem);
@@ -171,13 +170,12 @@ static int send_cpu_listeners(struct sk_buff *skb, unsigned int cpu)
                 }
         }
         up_write(&listeners->sem);
-        return rc;
 }
 
 static int fill_pid(pid_t pid, struct task_struct *pidtsk,
                 struct taskstats *stats)
 {
-        int rc;
+        int rc = 0;
         struct task_struct *tsk = pidtsk;
 
         if (!pidtsk) {
@@ -196,12 +194,10 @@ static int fill_pid(pid_t pid, struct task_struct *pidtsk,
          * Each accounting subsystem adds calls to its functions to
          * fill in relevant parts of struct taskstsats as follows
          *
-         *      rc = per-task-foo(stats, tsk);
-         *      if (rc)
-         *              goto err;
+         *      per-task-foo(stats, tsk);
          */
 
-        rc = delayacct_add_tsk(stats, tsk);
+        delayacct_add_tsk(stats, tsk);
         stats->version = TASKSTATS_VERSION;
 
         /* Define err: label here if needed */
diff --git a/kernel/timer.c b/kernel/timer.c
index 05809c2e2fd6..b650f04888ed 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -84,7 +84,7 @@ typedef struct tvec_t_base_s tvec_base_t;
 
 tvec_base_t boot_tvec_bases;
 EXPORT_SYMBOL(boot_tvec_bases);
-static DEFINE_PER_CPU(tvec_base_t *, tvec_bases) = { &boot_tvec_bases };
+static DEFINE_PER_CPU(tvec_base_t *, tvec_bases) = &boot_tvec_bases;
 
 static inline void set_running_timer(tvec_base_t *base,
                                         struct timer_list *timer)
@@ -408,7 +408,7 @@ static int cascade(tvec_base_t *base, tvec_t *tv, int index)
  * This function cascades all vectors and executes all expired timer
  * vectors.
  */
-#define INDEX(N) (base->timer_jiffies >> (TVR_BITS + N * TVN_BITS)) & TVN_MASK
+#define INDEX(N) ((base->timer_jiffies >> (TVR_BITS + (N) * TVN_BITS)) & TVN_MASK)
 
 static inline void __run_timers(tvec_base_t *base)
 {
@@ -1688,7 +1688,7 @@ static void __devinit migrate_timers(int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit timer_cpu_notify(struct notifier_block *self,
+static int __cpuinit timer_cpu_notify(struct notifier_block *self,
                                 unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -1708,7 +1708,7 @@ static int __devinit timer_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata timers_nb = {
+static struct notifier_block __cpuinitdata timers_nb = {
         .notifier_call  = timer_cpu_notify,
 };
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index eebb1d839235..448e8f7b342d 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -93,9 +93,12 @@ static void __queue_work(struct cpu_workqueue_struct *cwq,
         spin_unlock_irqrestore(&cwq->lock, flags);
 }
 
-/*
- * Queue work on a workqueue. Return non-zero if it was successfully
- * added.
+/**
+ * queue_work - queue work on a workqueue
+ * @wq: workqueue to use
+ * @work: work to queue
+ *
+ * Returns non-zero if it was successfully added.
  *
  * We queue the work to the CPU it was submitted, but there is no
  * guarantee that it will be processed by that CPU.
@@ -128,6 +131,14 @@ static void delayed_work_timer_fn(unsigned long __data)
         __queue_work(per_cpu_ptr(wq->cpu_wq, cpu), work);
 }
 
+/**
+ * queue_delayed_work - queue work on a workqueue after delay
+ * @wq: workqueue to use
+ * @work: work to queue
+ * @delay: number of jiffies to wait before queueing
+ *
+ * Returns non-zero if it was successfully added.
+ */
 int fastcall queue_delayed_work(struct workqueue_struct *wq,
                         struct work_struct *work, unsigned long delay)
 {
@@ -150,6 +161,15 @@ int fastcall queue_delayed_work(struct workqueue_struct *wq,
 }
 EXPORT_SYMBOL_GPL(queue_delayed_work);
 
+/**
+ * queue_delayed_work_on - queue work on specific CPU after delay
+ * @cpu: CPU number to execute work on
+ * @wq: workqueue to use
+ * @work: work to queue
+ * @delay: number of jiffies to wait before queueing
+ *
+ * Returns non-zero if it was successfully added.
+ */
 int queue_delayed_work_on(int cpu, struct workqueue_struct *wq,
                         struct work_struct *work, unsigned long delay)
 {
@@ -275,8 +295,9 @@ static void flush_cpu_workqueue(struct cpu_workqueue_struct *cwq)
         }
 }
 
-/*
+/**
  * flush_workqueue - ensure that any scheduled work has run to completion.
+ * @wq: workqueue to flush
  *
  * Forces execution of the workqueue and blocks until its completion.
  * This is typically used in driver shutdown handlers.
@@ -400,6 +421,12 @@ static void cleanup_workqueue_thread(struct workqueue_struct *wq, int cpu)
                 kthread_stop(p);
 }
 
+/**
+ * destroy_workqueue - safely terminate a workqueue
+ * @wq: target workqueue
+ *
+ * Safely destroy a workqueue. All work currently pending will be done first.
+ */
 void destroy_workqueue(struct workqueue_struct *wq)
 {
         int cpu;
@@ -425,18 +452,41 @@ EXPORT_SYMBOL_GPL(destroy_workqueue);
 
 static struct workqueue_struct *keventd_wq;
 
+/**
+ * schedule_work - put work task in global workqueue
+ * @work: job to be done
+ *
+ * This puts a job in the kernel-global workqueue.
+ */
 int fastcall schedule_work(struct work_struct *work)
 {
         return queue_work(keventd_wq, work);
 }
 EXPORT_SYMBOL(schedule_work);
 
+/**
+ * schedule_delayed_work - put work task in global workqueue after delay
+ * @work: job to be done
+ * @delay: number of jiffies to wait
+ *
+ * After waiting for a given time this puts a job in the kernel-global
+ * workqueue.
+ */
 int fastcall schedule_delayed_work(struct work_struct *work, unsigned long delay)
 {
         return queue_delayed_work(keventd_wq, work, delay);
 }
 EXPORT_SYMBOL(schedule_delayed_work);
 
+/**
+ * schedule_delayed_work_on - queue work in global workqueue on CPU after delay
+ * @cpu: cpu to use
+ * @work: job to be done
+ * @delay: number of jiffies to wait
+ *
+ * After waiting for a given time this puts a job in the kernel-global
+ * workqueue on the specified CPU.
+ */
 int schedule_delayed_work_on(int cpu,
                         struct work_struct *work, unsigned long delay)
 {
diff --git a/lib/zlib_inflate/inflate.c b/lib/zlib_inflate/inflate.c
index 7f922dccf1a5..fceb97c3aff7 100644
--- a/lib/zlib_inflate/inflate.c
+++ b/lib/zlib_inflate/inflate.c
@@ -347,7 +347,10 @@ int zlib_inflate(z_streamp strm, int flush)
     static const unsigned short order[19] = /* permutation of code lengths */
         {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
 
-    if (strm == NULL || strm->state == NULL || strm->next_out == NULL ||
+    /* Do not check for strm->next_out == NULL here as ppc zImage
+       inflates to strm->next_out = 0 */
+
+    if (strm == NULL || strm->state == NULL ||
         (strm->next_in == NULL && strm->avail_in != 0))
         return Z_STREAM_ERROR;
 
diff --git a/mm/filemap.c b/mm/filemap.c
index d087fc3d3281..b9a60c43b61a 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -849,8 +849,6 @@ static void shrink_readahead_size_eio(struct file *filp,
                 return;
 
         ra->ra_pages /= 4;
-        printk(KERN_WARNING "Reducing readahead size to %luK\n",
-                        ra->ra_pages << (PAGE_CACHE_SHIFT - 10));
 }
 
 /**
diff --git a/mm/slab.c b/mm/slab.c
index 0f20843beffd..21ba06035700 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1106,7 +1106,7 @@ static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
 
 #endif
 
-static int __devinit cpuup_callback(struct notifier_block *nfb,
+static int __cpuinit cpuup_callback(struct notifier_block *nfb,
                                     unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -3224,7 +3224,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
 EXPORT_SYMBOL(kmem_cache_alloc);
 
 /**
- * kmem_cache_alloc - Allocate an object. The memory is set to zero.
+ * kmem_cache_zalloc - Allocate an object. The memory is set to zero.
  * @cache: The cache to allocate from.
  * @flags: See kmalloc().
  *
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index cbc8a389a0a8..05b3de888243 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -61,6 +61,9 @@ static int brnf_filter_vlan_tagged = 1;
 #define brnf_filter_vlan_tagged 1
 #endif
 
+int brnf_deferred_hooks;
+EXPORT_SYMBOL_GPL(brnf_deferred_hooks);
+
 static __be16 inline vlan_proto(const struct sk_buff *skb)
 {
         return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
@@ -890,6 +893,8 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
                                 return NF_ACCEPT;
                         else if (ip->version == 6 && !brnf_call_ip6tables)
                                 return NF_ACCEPT;
+                        else if (!brnf_deferred_hooks)
+                                return NF_ACCEPT;
 #endif
                         if (hook == NF_IP_POST_ROUTING)
                                 return NF_ACCEPT;
diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index dbb08528ddf5..f7e84e9d13ad 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -58,6 +58,7 @@ config IEEE80211_CRYPT_TKIP
         depends on IEEE80211 && NET_RADIO
         select CRYPTO
         select CRYPTO_MICHAEL_MIC
+        select CRC32
         ---help---
         Include software based cipher suites in support of IEEE 802.11i
         (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index ebc33ca6e692..4cef39e171d0 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -116,6 +116,16 @@ ieee80211softmac_auth_queue(void *data)
         kfree(auth);
 }
 
+/* Sends a response to an auth challenge (for shared key auth). */
+static void
+ieee80211softmac_auth_challenge_response(void *_aq)
+{
+        struct ieee80211softmac_auth_queue_item *aq = _aq;
+
+        /* Send our response */
+        ieee80211softmac_send_mgt_frame(aq->mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
+}
+
 /* Handle the auth response from the AP
  * This should be registered with ieee80211 as handle_auth 
  */
@@ -197,24 +207,30 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                 case IEEE80211SOFTMAC_AUTH_SHARED_CHALLENGE:
                         /* Check to make sure we have a challenge IE */
                         data = (u8 *)auth->info_element;
-                        if(*data++ != MFIE_TYPE_CHALLENGE){
+                        if (*data++ != MFIE_TYPE_CHALLENGE) {
                                 printkl(KERN_NOTICE PFX "Shared Key Authentication failed due to a missing challenge.\n");
                                 break;  
                         }
                         /* Save the challenge */
                         spin_lock_irqsave(&mac->lock, flags);
                         net->challenge_len = *data++;   
-                        if(net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
+                        if (net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
                                 net->challenge_len = WLAN_AUTH_CHALLENGE_LEN;
-                        if(net->challenge != NULL)
+                        if (net->challenge != NULL)
                                 kfree(net->challenge);
                         net->challenge = kmalloc(net->challenge_len, GFP_ATOMIC);
                         memcpy(net->challenge, data, net->challenge_len);
                         aq->state = IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE; 
-                        spin_unlock_irqrestore(&mac->lock, flags);
 
-                        /* Send our response */
-                        ieee80211softmac_send_mgt_frame(mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
+                        /* We reuse the work struct from the auth request here.
+                         * It is safe to do so as each one is per-request, and
+                         * at this point (dealing with authentication response)
+                         * we have obviously already sent the initial auth
+                         * request. */
+                        cancel_delayed_work(&aq->work);
+                        INIT_WORK(&aq->work, &ieee80211softmac_auth_challenge_response, (void *)aq);
+                        schedule_work(&aq->work);
+                        spin_unlock_irqrestore(&mac->lock, flags);
                         return 0;
                 case IEEE80211SOFTMAC_AUTH_SHARED_PASS:
                         kfree(net->challenge);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 184c78ca79e6..212734ca238f 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -429,7 +429,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         }
 
         /* Remove any debris in the socket control block */
-        memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
+        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 
         return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL,
                        ip_rcv_finish);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9ccacf57f08b..85893eef6b16 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1578,6 +1578,7 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
         cache = ipmr_cache_find(rt->rt_src, rt->rt_dst);
 
         if (cache==NULL) {
+                struct sk_buff *skb2;
                 struct net_device *dev;
                 int vif;
 
@@ -1591,12 +1592,18 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
                         read_unlock(&mrt_lock);
                         return -ENODEV;
                 }
-                skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
-                skb->nh.iph->ihl = sizeof(struct iphdr)>>2;
-                skb->nh.iph->saddr = rt->rt_src;
-                skb->nh.iph->daddr = rt->rt_dst;
-                skb->nh.iph->version = 0;
-                err = ipmr_cache_unresolved(vif, skb);
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (!skb2) {
+                        read_unlock(&mrt_lock);
+                        return -ENOMEM;
+                }
+
+                skb2->nh.raw = skb_push(skb2, sizeof(struct iphdr));
+                skb2->nh.iph->ihl = sizeof(struct iphdr)>>2;
+                skb2->nh.iph->saddr = rt->rt_src;
+                skb2->nh.iph->daddr = rt->rt_dst;
+                skb2->nh.iph->version = 0;
+                err = ipmr_cache_unresolved(vif, skb2);
                 read_unlock(&mrt_lock);
                 return err;
         }
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index af35235672d5..9a39e2969712 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1200,7 +1200,7 @@ static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
         tuple.dst.protonum = IPPROTO_TCP;
 
         exp = __ip_conntrack_expect_find(&tuple);
-        if (exp->master == ct)
+        if (exp && exp->master == ct)
                 return exp;
         return NULL;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 7bd3c22003a2..7a9fa04a467a 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -534,6 +534,8 @@ static struct nf_hook_ops ip_conntrack_ops[] = {
 
 /* Sysctl support */
 
+int ip_conntrack_checksum = 1;
+
 #ifdef CONFIG_SYSCTL
 
 /* From ip_conntrack_core.c */
@@ -568,8 +570,6 @@ extern unsigned int ip_ct_generic_timeout;
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
-int ip_conntrack_checksum = 1;
-
 static struct ctl_table_header *ip_ct_sysctl_header;
 
 static ctl_table ip_ct_sysctl_table[] = {
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index 0b1b416759cc..18b7fbdccb61 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1255,9 +1255,9 @@ static int help(struct sk_buff **pskb,
         struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl);
 
         /* SNMP replies and originating SNMP traps get mangled */
-        if (udph->source == ntohs(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
+        if (udph->source == htons(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
                 return NF_ACCEPT;
-        if (udph->dest == ntohs(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
+        if (udph->dest == htons(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
                 return NF_ACCEPT;
 
         /* No NAT? */
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bd221ec3f81e..62b2762a2420 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -609,6 +609,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (sin) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = skb->nh.iph->saddr;
+                sin->sin_port = 0;
                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
         }
         if (inet->cmsg_flags)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index df8f051c0fce..25c2a9e03895 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -71,6 +71,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 goto out;
         }
 
+        memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
+
         /*
          * Store incoming device index. When the packet will
          * be queued, we cannot refer to skb->dev anymore.
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index fa1ce0ae123e..d57e61ce4a7d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -411,6 +411,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         /* Copy the address. */
         if (sin6) {
                 sin6->sin6_family = AF_INET6;
+                sin6->sin6_port = 0;
                 ipv6_addr_copy(&sin6->sin6_addr, &skb->nh.ipv6h->saddr);
                 sin6->sin6_flowinfo = 0;
                 sin6->sin6_scope_id = 0;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 42a178aa30f9..a9894ddfd72a 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -386,8 +386,8 @@ config NETFILTER_XT_MATCH_REALM
           <file:Documentation/modules.txt>.  If unsure, say `N'.
 
 config NETFILTER_XT_MATCH_SCTP
-        tristate  '"sctp" protocol match support'
-        depends on NETFILTER_XTABLES
+        tristate  '"sctp" protocol match support (EXPERIMENTAL)'
+        depends on NETFILTER_XTABLES && EXPERIMENTAL
         help
           With this option enabled, you will be able to use the 
           `sctp' match in order to match on SCTP source/destination ports
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 5fcab2ef231f..4ef836699962 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -428,6 +428,8 @@ static struct file_operations ct_cpu_seq_fops = {
 
 /* Sysctl support */
 
+int nf_conntrack_checksum = 1;
+
 #ifdef CONFIG_SYSCTL
 
 /* From nf_conntrack_core.c */
@@ -459,8 +461,6 @@ extern unsigned int nf_ct_generic_timeout;
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
-int nf_conntrack_checksum = 1;
-
 static struct ctl_table_header *nf_ct_sysctl_header;
 
 static ctl_table nf_ct_sysctl_table[] = {
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index bb6fcee452ca..662a869593bf 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -219,21 +219,20 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 
         switch (verdict & NF_VERDICT_MASK) {
         case NF_ACCEPT:
+        case NF_STOP:
                 info->okfn(skb);
+        case NF_STOLEN:
                 break;
-
         case NF_QUEUE:
                 if (!nf_queue(&skb, elem, info->pf, info->hook, 
                               info->indev, info->outdev, info->okfn,
                               verdict >> NF_VERDICT_BITS))
                         goto next_hook;
                 break;
+        default:
+                kfree_skb(skb);
         }
         rcu_read_unlock();
-
-        if (verdict == NF_DROP)
-                kfree_skb(skb);
-
         kfree(info);
         return;
 }
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 5fe4c9df17f5..a9f4f6f3c628 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -113,6 +113,21 @@ checkentry(const char *tablename,
         if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
             info->bitmask & ~XT_PHYSDEV_OP_MASK)
                 return 0;
+        if (brnf_deferred_hooks == 0 &&
+            info->bitmask & XT_PHYSDEV_OP_OUT &&
+            (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
+             info->invert & XT_PHYSDEV_OP_BRIDGED) &&
+            hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
+                         (1 << NF_IP_POST_ROUTING))) {
+                printk(KERN_WARNING "physdev match: using --physdev-out in the "
+                       "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
+                       "traffic is deprecated and breaks other things, it will "
+                       "be removed in January 2007. See Documentation/"
+                       "feature-removal-schedule.txt for details. This doesn't "
+                       "affect you in case you're using it for purely bridged "
+                       "traffic.\n");
+                brnf_deferred_hooks = 1;
+        }
         return 1;
 }
 
diff --git a/net/netfilter/xt_pkttype.c b/net/netfilter/xt_pkttype.c
index 3ac703b5cb8f..d2f5320a80bf 100644
--- a/net/netfilter/xt_pkttype.c
+++ b/net/netfilter/xt_pkttype.c
@@ -9,6 +9,8 @@
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
+#include <linux/in.h>
+#include <linux/ip.h>
 
 #include <linux/netfilter/xt_pkttype.h>
 #include <linux/netfilter/x_tables.h>
@@ -28,9 +30,17 @@ static int match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
+        u_int8_t type;
         const struct xt_pkttype_info *info = matchinfo;
 
-        return (skb->pkt_type == info->pkttype) ^ info->invert;
+        if (skb->pkt_type == PACKET_LOOPBACK)
+                type = (MULTICAST(skb->nh.iph->daddr)
+                        ? PACKET_MULTICAST
+                        : PACKET_BROADCAST);
+        else
+                type = skb->pkt_type;
+
+        return (type == info->pkttype) ^ info->invert;
 }
 
 static struct xt_match pkttype_match = {
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 2180c88cfe89..f01132263535 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -85,6 +85,13 @@ cc-version = $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh \
 cc-ifversion = $(shell if [ $(call cc-version, $(CC)) $(1) $(2) ]; then \
                        echo $(3); fi;)
 
+# ld-option
+# Usage: ldflags += $(call ld-option, -Wl$(comma)--hash-style=both)
+ld-option = $(shell if $(CC) $(1) \
+                             -nostdlib -o ldtest$$$$.out -xc /dev/null \
+             > /dev/null 2>&1; then echo "$(1)"; else echo "$(2)"; fi; \
+             rm -f ldtest$$$$.out)
+
 ###
 # Shorthand for $(Q)$(MAKE) -f scripts/Makefile.build obj=
 # Usage:
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index f9460a6218de..c9ca0c23bd91 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1518,6 +1518,7 @@ sub dump_function($$) {
     $prototype =~ s/^asmlinkage +//;
     $prototype =~ s/^inline +//;
     $prototype =~ s/^__inline__ +//;
+    $prototype =~ s/__devinit +//;
     $prototype =~ s/^#define +//; #ak added
     $prototype =~ s/__attribute__ \(\([a-z,]*\)\)//;
 
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 0111990ba837..f03960e697ce 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -644,10 +644,18 @@ void policydb_destroy(struct policydb *p)
         kfree(lra);
 
         for (rt = p->range_tr; rt; rt = rt -> next) {
-                kfree(lrt);
+                if (lrt) {
+                        ebitmap_destroy(&lrt->range.level[0].cat);
+                        ebitmap_destroy(&lrt->range.level[1].cat);
+                        kfree(lrt);
+                }
                 lrt = rt;
         }
-        kfree(lrt);
+        if (lrt) {
+                ebitmap_destroy(&lrt->range.level[0].cat);
+                ebitmap_destroy(&lrt->range.level[1].cat);
+                kfree(lrt);
+        }
 
         if (p->type_attr_map) {
                 for (i = 0; i < p->p_types.nprim; i++)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index d2e80e62ff0c..85e429884393 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -833,6 +833,8 @@ static int security_compute_sid(u32 ssid,
                 goto out;
         }
 
+        context_init(&newcontext);
+
         POLICY_RDLOCK;
 
         scontext = sidtab_search(&sidtab, ssid);
@@ -850,8 +852,6 @@ static int security_compute_sid(u32 ssid,
                 goto out_unlock;
         }
 
-        context_init(&newcontext);
-
         /* Set the user identity. */
         switch (specified) {
         case AVTAB_TRANSITION: