183 files changed, 5679 insertions, 1693 deletions
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index af0e9393bf68..309c47b91598 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -282,6 +282,13 @@ Why:	Not used in-tree. The current out-of-tree users used it to
        out-of-tree driver.
 Who:    Thomas Gleixner <tglx@linutronix.de>
+----------------------------
+What:   usedac i386 kernel parameter
+When:   2.6.27
+Why:    replaced by allowdac and no dac combination
+Who:    Glauber Costa <gcosta@redhat.com>
 ---------------------------
 What:   /sys/o2cb symlink
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 4b0f1ae31a4c..f4839606988b 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1280,8 +1280,16 @@ and is between 256 and 4096 characters. It is defined in the file
        noexec          [IA-64]
        noexec          [X86-32,X86-64]
+                        On X86-32 available only on PAE configured kernels.
                        noexec=on: enable non-executable mappings (default)
-                        noexec=off: disable nn-executable mappings
+                        noexec=off: disable non-executable mappings
+        noexec32        [X86-64]
+                        This affects only 32-bit executables.
+                        noexec32=on: enable non-executable mappings (default)
+                                read doesn't imply executable mappings
+                        noexec32=off: disable non-executable mappings
+                                read implies executable mappings
        nofxsr          [BUGS=X86-32] Disables x86 floating point extended
                        register save and restore. The kernel will only save
diff --git a/Documentation/prctl/disable-tsc-ctxt-sw-stress-test.c b/Documentation/prctl/disable-tsc-ctxt-sw-stress-test.c
new file mode 100644
index 000000000000..f8e8e95e81fd
--- /dev/null
+++ b/Documentation/prctl/disable-tsc-ctxt-sw-stress-test.c
@@ -0,0 +1,96 @@
+/*
+ * Tests for prctl(PR_GET_TSC, ...) / prctl(PR_SET_TSC, ...)
+ *
+ * Tests if the control register is updated correctly
+ * at context switches
+ *
+ * Warning: this test will cause a very high load for a few seconds
+ *
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <inttypes.h>
+#include <wait.h>
+#include <sys/prctl.h>
+#include <linux/prctl.h>
+/* Get/set the process' ability to use the timestamp counter instruction */
+#ifndef PR_GET_TSC
+#define PR_GET_TSC 25
+#define PR_SET_TSC 26
+# define PR_TSC_ENABLE          1   /* allow the use of the timestamp counter */
+# define PR_TSC_SIGSEGV         2   /* throw a SIGSEGV instead of reading the TSC */
+#endif
+uint64_t rdtsc() {
+uint32_t lo, hi;
+/* We cannot use "=A", since this would use %rax on x86_64 */
+__asm__ __volatile__ ("rdtsc" : "=a" (lo), "=d" (hi));
+return (uint64_t)hi << 32 | lo;
+}
+void sigsegv_expect(int sig)
+{
+        /* */
+}
+void segvtask(void)
+{
+        if (prctl(PR_SET_TSC, PR_TSC_SIGSEGV) < 0)
+        {
+                perror("prctl");
+                exit(0);
+        }
+        signal(SIGSEGV, sigsegv_expect);
+        alarm(10);
+        rdtsc();
+        fprintf(stderr, "FATAL ERROR, rdtsc() succeeded while disabled\n");
+        exit(0);
+}
+void sigsegv_fail(int sig)
+{
+        fprintf(stderr, "FATAL ERROR, rdtsc() failed while enabled\n");
+        exit(0);
+}
+void rdtsctask(void)
+{
+        if (prctl(PR_SET_TSC, PR_TSC_ENABLE) < 0)
+        {
+                perror("prctl");
+                exit(0);
+        }
+        signal(SIGSEGV, sigsegv_fail);
+        alarm(10);
+        for(;;) rdtsc();
+}
+int main(int argc, char **argv)
+{
+        int n_tasks = 100, i;
+        fprintf(stderr, "[No further output means we're allright]\n");
+        for (i=0; i<n_tasks; i++)
+                if (fork() == 0)
+                {
+                        if (i & 1)
+                                segvtask();
+                        else
+                                rdtsctask();
+                }
+        for (i=0; i<n_tasks; i++)
+                wait(NULL);
+        exit(0);
+}
diff --git a/Documentation/prctl/disable-tsc-on-off-stress-test.c b/Documentation/prctl/disable-tsc-on-off-stress-test.c
new file mode 100644
index 000000000000..1fcd91445375
--- /dev/null
+++ b/Documentation/prctl/disable-tsc-on-off-stress-test.c
@@ -0,0 +1,95 @@
+/*
+ * Tests for prctl(PR_GET_TSC, ...) / prctl(PR_SET_TSC, ...)
+ *
+ * Tests if the control register is updated correctly
+ * when set with prctl()
+ *
+ * Warning: this test will cause a very high load for a few seconds
+ *
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <inttypes.h>
+#include <wait.h>
+#include <sys/prctl.h>
+#include <linux/prctl.h>
+/* Get/set the process' ability to use the timestamp counter instruction */
+#ifndef PR_GET_TSC
+#define PR_GET_TSC 25
+#define PR_SET_TSC 26
+# define PR_TSC_ENABLE          1   /* allow the use of the timestamp counter */
+# define PR_TSC_SIGSEGV         2   /* throw a SIGSEGV instead of reading the TSC */
+#endif
+/* snippet from wikipedia :-) */
+uint64_t rdtsc() {
+uint32_t lo, hi;
+/* We cannot use "=A", since this would use %rax on x86_64 */
+__asm__ __volatile__ ("rdtsc" : "=a" (lo), "=d" (hi));
+return (uint64_t)hi << 32 | lo;
+}
+int should_segv = 0;
+void sigsegv_cb(int sig)
+{
+        if (!should_segv)
+        {
+                fprintf(stderr, "FATAL ERROR, rdtsc() failed while enabled\n");
+                exit(0);
+        }
+        if (prctl(PR_SET_TSC, PR_TSC_ENABLE) < 0)
+        {
+                perror("prctl");
+                exit(0);
+        }
+        should_segv = 0;
+        rdtsc();
+}
+void task(void)
+{
+        signal(SIGSEGV, sigsegv_cb);
+        alarm(10);
+        for(;;)
+        {
+                rdtsc();
+                if (should_segv)
+                {
+                        fprintf(stderr, "FATAL ERROR, rdtsc() succeeded while disabled\n");
+                        exit(0);
+                }
+                if (prctl(PR_SET_TSC, PR_TSC_SIGSEGV) < 0)
+                {
+                        perror("prctl");
+                        exit(0);
+                }
+                should_segv = 1;
+        }
+}
+int main(int argc, char **argv)
+{
+        int n_tasks = 100, i;
+        fprintf(stderr, "[No further output means we're allright]\n");
+        for (i=0; i<n_tasks; i++)
+                if (fork() == 0)
+                        task();
+        for (i=0; i<n_tasks; i++)
+                wait(NULL);
+        exit(0);
+}
diff --git a/Documentation/prctl/disable-tsc-test.c b/Documentation/prctl/disable-tsc-test.c
new file mode 100644
index 000000000000..843c81eac235
--- /dev/null
+++ b/Documentation/prctl/disable-tsc-test.c
@@ -0,0 +1,94 @@
+/*
+ * Tests for prctl(PR_GET_TSC, ...) / prctl(PR_SET_TSC, ...)
+ *
+ * Basic test to test behaviour of PR_GET_TSC and PR_SET_TSC
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <inttypes.h>
+#include <sys/prctl.h>
+#include <linux/prctl.h>
+/* Get/set the process' ability to use the timestamp counter instruction */
+#ifndef PR_GET_TSC
+#define PR_GET_TSC 25
+#define PR_SET_TSC 26
+# define PR_TSC_ENABLE          1   /* allow the use of the timestamp counter */
+# define PR_TSC_SIGSEGV         2   /* throw a SIGSEGV instead of reading the TSC */
+#endif
+const char *tsc_names[] =
+{
+        [0] = "[not set]",
+        [PR_TSC_ENABLE] = "PR_TSC_ENABLE",
+        [PR_TSC_SIGSEGV] = "PR_TSC_SIGSEGV",
+};
+uint64_t rdtsc() {
+uint32_t lo, hi;
+/* We cannot use "=A", since this would use %rax on x86_64 */
+__asm__ __volatile__ ("rdtsc" : "=a" (lo), "=d" (hi));
+return (uint64_t)hi << 32 | lo;
+}
+void sigsegv_cb(int sig)
+{
+        int tsc_val = 0;
+        printf("[ SIG_SEGV ]\n");
+        printf("prctl(PR_GET_TSC, &tsc_val); ");
+        fflush(stdout);
+        if ( prctl(PR_GET_TSC, &tsc_val) == -1)
+                perror("prctl");
+        printf("tsc_val == %s\n", tsc_names[tsc_val]);
+        printf("prctl(PR_SET_TSC, PR_TSC_ENABLE)\n");
+        fflush(stdout);
+        if ( prctl(PR_SET_TSC, PR_TSC_ENABLE) == -1)
+                perror("prctl");
+        printf("rdtsc() == ");
+}
+int main(int argc, char **argv)
+{
+        int tsc_val = 0;
+        signal(SIGSEGV, sigsegv_cb);
+        printf("rdtsc() == %llu\n", (unsigned long long)rdtsc());
+        printf("prctl(PR_GET_TSC, &tsc_val); ");
+        fflush(stdout);
+        if ( prctl(PR_GET_TSC, &tsc_val) == -1)
+                perror("prctl");
+        printf("tsc_val == %s\n", tsc_names[tsc_val]);
+        printf("rdtsc() == %llu\n", (unsigned long long)rdtsc());
+        printf("prctl(PR_SET_TSC, PR_TSC_ENABLE)\n");
+        fflush(stdout);
+        if ( prctl(PR_SET_TSC, PR_TSC_ENABLE) == -1)
+                perror("prctl");
+        printf("rdtsc() == %llu\n", (unsigned long long)rdtsc());
+        printf("prctl(PR_SET_TSC, PR_TSC_SIGSEGV)\n");
+        fflush(stdout);
+        if ( prctl(PR_SET_TSC, PR_TSC_SIGSEGV) == -1)
+                perror("prctl");
+        printf("rdtsc() == ");
+        fflush(stdout);
+        printf("%llu\n", (unsigned long long)rdtsc());
+        fflush(stdout);
+        exit(EXIT_SUCCESS);
+}
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 8d2cd1de5726..6a679c3e15e8 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -167,6 +167,12 @@ config CPU_SUBTYPE_SH7263
        select CPU_SH2A
        select CPU_HAS_FPU
+config CPU_SUBTYPE_MXG
+        bool "Support MX-G processor"
+        select CPU_SH2A
+        help
+          Select MX-G if running on an R8A03022BG part.
 # SH-3 Processor Support
 config CPU_SUBTYPE_SH7705
@@ -270,6 +276,15 @@ config CPU_SUBTYPE_SH4_202
 # SH-4A Processor Support
+config CPU_SUBTYPE_SH7723
+        bool "Support SH7723 processor"
+        select CPU_SH4A
+        select CPU_SHX2
+        select ARCH_SPARSEMEM_ENABLE
+        select SYS_SUPPORTS_NUMA
+        help
+          Select SH7723 if you have an SH-MobileR2 CPU.
 config CPU_SUBTYPE_SH7763
        bool "Support SH7763 processor"
        select CPU_SH4A
@@ -366,6 +381,14 @@ config SH_7619_SOLUTION_ENGINE
          Select 7619 SolutionEngine if configuring for a Hitachi SH7619
          evaluation board.
        
+config SH_7721_SOLUTION_ENGINE
+        bool "SolutionEngine7721"
+        select SOLUTION_ENGINE
+        depends on CPU_SUBTYPE_SH7721
+        help
+          Select 7721 SolutionEngine if configuring for a Hitachi SH7721
+          evaluation board.
 config SH_7722_SOLUTION_ENGINE
        bool "SolutionEngine7722"
        select SOLUTION_ENGINE
@@ -560,7 +583,7 @@ config SH_TMU
 config SH_CMT
        def_bool y
        prompt "CMT timer support"
-        depends on CPU_SH2
+        depends on CPU_SH2 && !CPU_SUBTYPE_MXG
        help
          This enables the use of the CMT as the system timer.
@@ -578,6 +601,7 @@ config SH_TIMER_IRQ
        default "86" if CPU_SUBTYPE_SH7619
        default "140" if CPU_SUBTYPE_SH7206
        default "142" if CPU_SUBTYPE_SH7203
+        default "238" if CPU_SUBTYPE_MXG
        default "16"
 config SH_PCLK_FREQ
@@ -585,10 +609,10 @@ config SH_PCLK_FREQ
        default "27000000" if CPU_SUBTYPE_SH7343
        default "31250000" if CPU_SUBTYPE_SH7619
        default "32000000" if CPU_SUBTYPE_SH7722
-        default "33333333" if CPU_SUBTYPE_SH7770 || \
+        default "33333333" if CPU_SUBTYPE_SH7770 || CPU_SUBTYPE_SH7723 || \
                              CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7705 || \
                              CPU_SUBTYPE_SH7203 || CPU_SUBTYPE_SH7206 || \
-                              CPU_SUBTYPE_SH7263
+                              CPU_SUBTYPE_SH7263 || CPU_SUBTYPE_MXG
        default "60000000" if CPU_SUBTYPE_SH7751 || CPU_SUBTYPE_SH7751R
        default "66000000" if CPU_SUBTYPE_SH4_202
        default "50000000"
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 5dcb74b947a9..d9d28f9dd0db 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -29,16 +29,17 @@ config EARLY_SCIF_CONSOLE
 config EARLY_SCIF_CONSOLE_PORT
        hex
        depends on EARLY_SCIF_CONSOLE
-        default "0xffe00000" if CPU_SUBTYPE_SH7780 || CPU_SUBTYPE_SH7763
-        default "0xffe00000" if CPU_SUBTYPE_SH7722 || CPU_SUBTYPE_SH7366
-        default "0xffea0000" if CPU_SUBTYPE_SH7785
-        default "0xfffe8000" if CPU_SUBTYPE_SH7203
-        default "0xfffe9800" if CPU_SUBTYPE_SH7206 || CPU_SUBTYPE_SH7263
-        default "0xf8420000" if CPU_SUBTYPE_SH7619
        default "0xa4400000" if CPU_SUBTYPE_SH7712 || CPU_SUBTYPE_SH7705
        default "0xa4430000" if CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721
+        default "0xf8420000" if CPU_SUBTYPE_SH7619
+        default "0xff804000" if CPU_SUBTYPE_MXG
        default "0xffc30000" if CPU_SUBTYPE_SHX3
+        default "0xffe00000" if CPU_SUBTYPE_SH7780 || CPU_SUBTYPE_SH7763 || \
+                                CPU_SUBTYPE_SH7722 || CPU_SUBTYPE_SH7366
        default "0xffe80000" if CPU_SH4
+        default "0xffea0000" if CPU_SUBTYPE_SH7785
+        default "0xfffe8000" if CPU_SUBTYPE_SH7203
+        default "0xfffe9800" if CPU_SUBTYPE_SH7206 || CPU_SUBTYPE_SH7263
        default "0x00000000"
 config EARLY_PRINTK
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index cffc92b1bf2e..bb06f83e6239 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -107,6 +107,7 @@ machdir-$(CONFIG_SH_7722_SOLUTION_ENGINE)	+= se/7722
 machdir-$(CONFIG_SH_7751_SOLUTION_ENGINE)       += se/7751
 machdir-$(CONFIG_SH_7780_SOLUTION_ENGINE)       += se/7780
 machdir-$(CONFIG_SH_7343_SOLUTION_ENGINE)       += se/7343
+machdir-$(CONFIG_SH_7721_SOLUTION_ENGINE)       += se/7721
 machdir-$(CONFIG_SH_HP6XX)                      += hp6xx
 machdir-$(CONFIG_SH_DREAMCAST)                  += dreamcast
 machdir-$(CONFIG_SH_MPC1211)                    += mpc1211
diff --git a/arch/sh/boards/renesas/migor/setup.c b/arch/sh/boards/renesas/migor/setup.c
index 21ab8c8fb590..00d52a20d8a5 100644
--- a/arch/sh/boards/renesas/migor/setup.c
+++ b/arch/sh/boards/renesas/migor/setup.c
@@ -10,8 +10,14 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
+#include <linux/input.h>
+#include <linux/mtd/physmap.h>
+#include <linux/mtd/nand.h>
+#include <linux/i2c.h>
 #include <asm/machvec.h>
 #include <asm/io.h>
+#include <asm/sh_keysc.h>
+#include <asm/migor.h>
 /* Address     IRQ  Size  Bus  Description
 * 0x00000000       64MB  16   NOR Flash (SP29PL256N)
@@ -23,9 +29,9 @@
 static struct resource smc91x_eth_resources[] = {
        [0] = {
-                .name   = "smc91x-regs" ,
+                .name   = "SMC91C111" ,
-                .start  = P2SEGADDR(0x10000300),
+                .start  = 0x10000300,
-                .end    = P2SEGADDR(0x1000030f),
+                .end    = 0x1000030f,
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
@@ -40,19 +46,202 @@ static struct platform_device smc91x_eth_device = {
        .resource       = smc91x_eth_resources,
 };
+static struct sh_keysc_info sh_keysc_info = {
+        .mode = SH_KEYSC_MODE_2, /* KEYOUT0->4, KEYIN1->5 */
+        .scan_timing = 3,
+        .delay = 5,
+        .keycodes = {
+                0, KEY_UP, KEY_DOWN, KEY_LEFT, KEY_RIGHT, KEY_ENTER,
+                0, KEY_F, KEY_C, KEY_D, KEY_H, KEY_1,
+                0, KEY_2, KEY_3, KEY_4, KEY_5, KEY_6,
+                0, KEY_7, KEY_8, KEY_9, KEY_S, KEY_0,
+                0, KEY_P, KEY_STOP, KEY_REWIND, KEY_PLAY, KEY_FASTFORWARD,
+        },
+};
+static struct resource sh_keysc_resources[] = {
+        [0] = {
+                .start  = 0x044b0000,
+                .end    = 0x044b000f,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 79,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device sh_keysc_device = {
+        .name           = "sh_keysc",
+        .num_resources  = ARRAY_SIZE(sh_keysc_resources),
+        .resource       = sh_keysc_resources,
+        .dev    = {
+                .platform_data  = &sh_keysc_info,
+        },
+};
+static struct mtd_partition migor_nor_flash_partitions[] =
+{
+        {
+                .name = "uboot",
+                .offset = 0,
+                .size = (1 * 1024 * 1024),
+                .mask_flags = MTD_WRITEABLE,    /* Read-only */
+        },
+        {
+                .name = "rootfs",
+                .offset = MTDPART_OFS_APPEND,
+                .size = (15 * 1024 * 1024),
+        },
+        {
+                .name = "other",
+                .offset = MTDPART_OFS_APPEND,
+                .size = MTDPART_SIZ_FULL,
+        },
+};
+static struct physmap_flash_data migor_nor_flash_data = {
+        .width          = 2,
+        .parts          = migor_nor_flash_partitions,
+        .nr_parts       = ARRAY_SIZE(migor_nor_flash_partitions),
+};
+static struct resource migor_nor_flash_resources[] = {
+        [0] = {
+                .name           = "NOR Flash",
+                .start          = 0x00000000,
+                .end            = 0x03ffffff,
+                .flags          = IORESOURCE_MEM,
+        }
+};
+static struct platform_device migor_nor_flash_device = {
+        .name           = "physmap-flash",
+        .resource       = migor_nor_flash_resources,
+        .num_resources  = ARRAY_SIZE(migor_nor_flash_resources),
+        .dev            = {
+                .platform_data = &migor_nor_flash_data,
+        },
+};
+static struct mtd_partition migor_nand_flash_partitions[] = {
+        {
+                .name           = "nanddata1",
+                .offset         = 0x0,
+                .size           = 512 * 1024 * 1024,
+        },
+        {
+                .name           = "nanddata2",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 512 * 1024 * 1024,
+        },
+};
+static void migor_nand_flash_cmd_ctl(struct mtd_info *mtd, int cmd,
+                                     unsigned int ctrl)
+{
+        struct nand_chip *chip = mtd->priv;
+        if (cmd == NAND_CMD_NONE)
+                return;
+        if (ctrl & NAND_CLE)
+                writeb(cmd, chip->IO_ADDR_W + 0x00400000);
+        else if (ctrl & NAND_ALE)
+                writeb(cmd, chip->IO_ADDR_W + 0x00800000);
+        else
+                writeb(cmd, chip->IO_ADDR_W);
+}
+static int migor_nand_flash_ready(struct mtd_info *mtd)
+{
+        return ctrl_inb(PORT_PADR) & 0x02; /* PTA1 */
+}
+struct platform_nand_data migor_nand_flash_data = {
+        .chip = {
+                .nr_chips = 1,
+                .partitions = migor_nand_flash_partitions,
+                .nr_partitions = ARRAY_SIZE(migor_nand_flash_partitions),
+                .chip_delay = 20,
+                .part_probe_types = (const char *[]) { "cmdlinepart", NULL },
+        },
+        .ctrl = {
+                .dev_ready = migor_nand_flash_ready,
+                .cmd_ctrl = migor_nand_flash_cmd_ctl,
+        },
+};
+static struct resource migor_nand_flash_resources[] = {
+        [0] = {
+                .name           = "NAND Flash",
+                .start          = 0x18000000,
+                .end            = 0x18ffffff,
+                .flags          = IORESOURCE_MEM,
+        },
+};
+static struct platform_device migor_nand_flash_device = {
+        .name           = "gen_nand",
+        .resource       = migor_nand_flash_resources,
+        .num_resources  = ARRAY_SIZE(migor_nand_flash_resources),
+        .dev            = {
+                .platform_data = &migor_nand_flash_data,
+        }
+};
 static struct platform_device *migor_devices[] __initdata = {
        &smc91x_eth_device,
+        &sh_keysc_device,
+        &migor_nor_flash_device,
+        &migor_nand_flash_device,
+};
+static struct i2c_board_info __initdata migor_i2c_devices[] = {
+        {
+                I2C_BOARD_INFO("rtc-rs5c372", 0x32),
+                .type   = "rs5c372b",
+        },
+        {
+                I2C_BOARD_INFO("migor_ts", 0x51),
+                .irq = 38, /* IRQ6 */
+        },
 };
 static int __init migor_devices_setup(void)
 {
+        i2c_register_board_info(0, migor_i2c_devices,
+                                ARRAY_SIZE(migor_i2c_devices));
+ 
        return platform_add_devices(migor_devices, ARRAY_SIZE(migor_devices));
 }
 __initcall(migor_devices_setup);
 static void __init migor_setup(char **cmdline_p)
 {
-        ctrl_outw(0x1000, 0xa4050110); /* Enable IRQ0 in PJCR */
+        /* SMC91C111 - Enable IRQ0 */
+        ctrl_outw(ctrl_inw(PORT_PJCR) & ~0x0003, PORT_PJCR);
+        /* KEYSC */
+        ctrl_outw(ctrl_inw(PORT_PYCR) & ~0x0fff, PORT_PYCR);
+        ctrl_outw(ctrl_inw(PORT_PZCR) & ~0x0ff0, PORT_PZCR);
+        ctrl_outw(ctrl_inw(PORT_PSELA) & ~0x4100, PORT_PSELA);
+        ctrl_outw(ctrl_inw(PORT_HIZCRA) & ~0x4000, PORT_HIZCRA);
+        ctrl_outw(ctrl_inw(PORT_HIZCRC) & ~0xc000, PORT_HIZCRC);
+        ctrl_outl(ctrl_inl(MSTPCR2) & ~0x00004000, MSTPCR2);
+        /* NAND Flash */
+        ctrl_outw(ctrl_inw(PORT_PXCR) & 0x0fff, PORT_PXCR);
+        ctrl_outl((ctrl_inl(BSC_CS6ABCR) & ~0x00000600) | 0x00000200,
+                  BSC_CS6ABCR);
+        /* I2C */
+        ctrl_outl(ctrl_inl(MSTPCR1) & ~0x00000200, MSTPCR1);
+        /* Touch Panel - Enable IRQ6 */
+        ctrl_outw(ctrl_inw(PORT_PZCR) & ~0xc, PORT_PZCR);
+        ctrl_outw((ctrl_inw(PORT_PSELA) | 0x8000), PORT_PSELA);
+        ctrl_outw((ctrl_inw(PORT_HIZCRC) & ~0x4000), PORT_HIZCRC);
 }
 static struct sh_machine_vector mv_migor __initmv = {
diff --git a/arch/sh/boards/renesas/r7780rp/irq-r7780mp.c b/arch/sh/boards/renesas/r7780rp/irq-r7780mp.c
index 1f8f073f27be..68f0ad1b637d 100644
--- a/arch/sh/boards/renesas/r7780rp/irq-r7780mp.c
+++ b/arch/sh/boards/renesas/r7780rp/irq-r7780mp.c
@@ -18,31 +18,44 @@ enum {
        UNUSED = 0,
        /* board specific interrupt sources */
-        AX88796,          /* Ethernet controller */
+        CF,             /* Compact Flash */
-        CF,               /* Compact Flash */
+        TP,             /* Touch panel */
-        PSW,              /* Push Switch */
+        SCIF1,          /* FPGA SCIF1 */
-        EXT1,             /* EXT1n IRQ */
+        SCIF0,          /* FPGA SCIF0 */
-        EXT4,             /* EXT4n IRQ */
+        SMBUS,          /* SMBUS */
+        RTC,            /* RTC Alarm */
+        AX88796,        /* Ethernet controller */
+        PSW,            /* Push Switch */
+        /* external bus connector */
+        EXT1, EXT2, EXT4, EXT5, EXT6,
 };
 static struct intc_vect vectors[] __initdata = {
        INTC_IRQ(CF, IRQ_CF),
-        INTC_IRQ(PSW, IRQ_PSW),
+        INTC_IRQ(TP, IRQ_TP),
+        INTC_IRQ(SCIF1, IRQ_SCIF1),
+        INTC_IRQ(SCIF0, IRQ_SCIF0),
+        INTC_IRQ(SMBUS, IRQ_SMBUS),
+        INTC_IRQ(RTC, IRQ_RTC),
        INTC_IRQ(AX88796, IRQ_AX88796),
-        INTC_IRQ(EXT1, IRQ_EXT1),
+        INTC_IRQ(PSW, IRQ_PSW),
-        INTC_IRQ(EXT4, IRQ_EXT4),
+        INTC_IRQ(EXT1, IRQ_EXT1), INTC_IRQ(EXT2, IRQ_EXT2),
+        INTC_IRQ(EXT4, IRQ_EXT4), INTC_IRQ(EXT5, IRQ_EXT5),
+        INTC_IRQ(EXT6, IRQ_EXT6),
 };
 static struct intc_mask_reg mask_registers[] __initdata = {
        { 0xa4000000, 0, 16, /* IRLMSK */
-          { 0, 0, 0, 0, CF, 0, 0, 0,
+          { SCIF0, SCIF1, RTC, 0, CF, 0, TP, SMBUS,
-            0, 0, 0, EXT4, 0, EXT1, PSW, AX88796 } },
+            0, EXT6, EXT5, EXT4, EXT2, EXT1, PSW, AX88796 } },
 };
 static unsigned char irl2irq[HL_NR_IRL] __initdata = {
-        0, IRQ_CF, 0, 0,
+        0, IRQ_CF, IRQ_TP, IRQ_SCIF1,
-        0, 0, 0, 0,
+        IRQ_SCIF0, IRQ_SMBUS, IRQ_RTC, IRQ_EXT6,
-        0, IRQ_EXT4, 0, IRQ_EXT1,
+        IRQ_EXT5, IRQ_EXT4, IRQ_EXT2, IRQ_EXT1,
        0, IRQ_AX88796, IRQ_PSW,
 };
diff --git a/arch/sh/boards/renesas/r7780rp/setup.c b/arch/sh/boards/renesas/r7780rp/setup.c
index 2f68bea7890c..a5c5e9236501 100644
--- a/arch/sh/boards/renesas/r7780rp/setup.c
+++ b/arch/sh/boards/renesas/r7780rp/setup.c
@@ -4,7 +4,7 @@
 * Renesas Solutions Highlander Support.
 *
 * Copyright (C) 2002 Atom Create Engineering Co., Ltd.
- * Copyright (C) 2005 - 2007 Paul Mundt
+ * Copyright (C) 2005 - 2008 Paul Mundt
 *
 * This contains support for the R7780RP-1, R7780MP, and R7785RP
 * Highlander modules.
@@ -17,6 +17,7 @@
 #include <linux/platform_device.h>
 #include <linux/ata_platform.h>
 #include <linux/types.h>
+#include <linux/i2c.h>
 #include <net/ax88796.h>
 #include <asm/machvec.h>
 #include <asm/r7780rp.h>
@@ -176,11 +177,38 @@ static struct platform_device ax88796_device = {
        .resource       = ax88796_resources,
 };
+static struct resource smbus_resources[] = {
+        [0] = {
+                .start  = PA_SMCR,
+                .end    = PA_SMCR + 0x100 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = IRQ_SMBUS,
+                .end    = IRQ_SMBUS,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device smbus_device = {
+        .name           = "i2c-highlander",
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(smbus_resources),
+        .resource       = smbus_resources,
+};
+static struct i2c_board_info __initdata highlander_i2c_devices[] = {
+        {
+                I2C_BOARD_INFO("rtc-rs5c372", 0x32),
+                .type   = "r2025sd",
+        },
+};
 static struct platform_device *r7780rp_devices[] __initdata = {
        &r8a66597_usb_host_device,
        &m66592_usb_peripheral_device,
        &heartbeat_device,
+        &smbus_device,
 #ifndef CONFIG_SH_R7780RP
        &ax88796_device,
 #endif
@@ -199,12 +227,20 @@ static struct trapped_io cf_trapped_io = {
 static int __init r7780rp_devices_setup(void)
 {
+        int ret = 0;
 #ifndef CONFIG_SH_R7780RP
        if (register_trapped_io(&cf_trapped_io) == 0)
-                platform_device_register(&cf_ide_device);
+                ret |= platform_device_register(&cf_ide_device);
 #endif
-        return platform_add_devices(r7780rp_devices,
+        ret |= platform_add_devices(r7780rp_devices,
                                    ARRAY_SIZE(r7780rp_devices));
+        ret |= i2c_register_board_info(0, highlander_i2c_devices,
+                                       ARRAY_SIZE(highlander_i2c_devices));
+        return ret;
 }
 device_initcall(r7780rp_devices_setup);
diff --git a/arch/sh/boards/se/7721/Makefile b/arch/sh/boards/se/7721/Makefile
new file mode 100644
index 000000000000..7f09030980b3
--- /dev/null
+++ b/arch/sh/boards/se/7721/Makefile
@@ -0,0 +1 @@
+obj-y    := setup.o irq.o
diff --git a/arch/sh/boards/se/7721/irq.c b/arch/sh/boards/se/7721/irq.c
new file mode 100644
index 000000000000..c4fdd622bf8b
--- /dev/null
+++ b/arch/sh/boards/se/7721/irq.c
@@ -0,0 +1,45 @@
+/*
+ * linux/arch/sh/boards/se/7721/irq.c
+ *
+ * Copyright (C) 2008  Renesas Solutions Corp.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/init.h>
+#include <linux/irq.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <asm/se7721.h>
+enum {
+        UNUSED = 0,
+        /* board specific interrupt sources */
+        MRSHPC,
+};
+static struct intc_vect vectors[] __initdata = {
+        INTC_IRQ(MRSHPC, MRSHPC_IRQ0),
+};
+static struct intc_prio_reg prio_registers[] __initdata = {
+        { FPGA_ILSR6, 0, 8, 4, /* IRLMSK */
+          { 0, MRSHPC } },
+};
+static DECLARE_INTC_DESC(intc_desc, "SE7721", vectors,
+                         NULL, NULL, prio_registers, NULL);
+/*
+ * Initialize IRQ setting
+ */
+void __init init_se7721_IRQ(void)
+{
+        /* PPCR */
+        ctrl_outw(ctrl_inw(0xa4050118) & ~0x00ff, 0xa4050118);
+        register_intc_controller(&intc_desc);
+        intc_set_priority(MRSHPC_IRQ0, 0xf - MRSHPC_IRQ0);
+}
diff --git a/arch/sh/boards/se/7721/setup.c b/arch/sh/boards/se/7721/setup.c
new file mode 100644
index 000000000000..1be3e92752f7
--- /dev/null
+++ b/arch/sh/boards/se/7721/setup.c
@@ -0,0 +1,99 @@
+/*
+ * linux/arch/sh/boards/se/7721/setup.c
+ *
+ * Copyright (C) 2008 Renesas Solutions Corp.
+ *
+ * Hitachi UL SolutionEngine 7721 Support.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ */
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <asm/machvec.h>
+#include <asm/se7721.h>
+#include <asm/io.h>
+#include <asm/heartbeat.h>
+static unsigned char heartbeat_bit_pos[] = { 8, 9, 10, 11, 12, 13, 14, 15 };
+static struct heartbeat_data heartbeat_data = {
+        .bit_pos        = heartbeat_bit_pos,
+        .nr_bits        = ARRAY_SIZE(heartbeat_bit_pos),
+        .regsize        = 16,
+};
+static struct resource heartbeat_resources[] = {
+        [0] = {
+                .start  = PA_LED,
+                .end    = PA_LED,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+static struct platform_device heartbeat_device = {
+        .name           = "heartbeat",
+        .id             = -1,
+        .dev    = {
+                .platform_data  = &heartbeat_data,
+        },
+        .num_resources  = ARRAY_SIZE(heartbeat_resources),
+        .resource       = heartbeat_resources,
+};
+static struct resource cf_ide_resources[] = {
+        [0] = {
+                .start  = PA_MRSHPC_IO + 0x1f0,
+                .end    = PA_MRSHPC_IO + 0x1f0 + 8 ,
+                .flags  = IORESOURCE_IO,
+        },
+        [1] = {
+                .start  = PA_MRSHPC_IO + 0x1f0 + 0x206,
+                .end    = PA_MRSHPC_IO + 0x1f0 + 8 + 0x206 + 8,
+                .flags  = IORESOURCE_IO,
+        },
+        [2] = {
+                .start  = MRSHPC_IRQ0,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device cf_ide_device = {
+        .name           = "pata_platform",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(cf_ide_resources),
+        .resource       = cf_ide_resources,
+};
+static struct platform_device *se7721_devices[] __initdata = {
+        &cf_ide_device,
+        &heartbeat_device
+};
+static int __init se7721_devices_setup(void)
+{
+        return platform_add_devices(se7721_devices,
+                ARRAY_SIZE(se7721_devices));
+}
+device_initcall(se7721_devices_setup);
+static void __init se7721_setup(char **cmdline_p)
+{
+        /* for USB */
+        ctrl_outw(0x0000, 0xA405010C);  /* PGCR */
+        ctrl_outw(0x0000, 0xA405010E);  /* PHCR */
+        ctrl_outw(0x00AA, 0xA4050118);  /* PPCR */
+        ctrl_outw(0x0000, 0xA4050124);  /* PSELA */
+}
+/*
+ * The Machine Vector
+ */
+struct sh_machine_vector mv_se7721 __initmv = {
+        .mv_name                = "Solution Engine 7721",
+        .mv_setup               = se7721_setup,
+        .mv_nr_irqs             = 109,
+        .mv_init_irq            = init_se7721_IRQ,
+};
diff --git a/arch/sh/boards/se/7722/setup.c b/arch/sh/boards/se/7722/setup.c
index b1a3d9d0172f..33f6ee71f848 100644
--- a/arch/sh/boards/se/7722/setup.c
+++ b/arch/sh/boards/se/7722/setup.c
@@ -13,10 +13,12 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/ata_platform.h>
+#include <linux/input.h>
 #include <asm/machvec.h>
 #include <asm/se7722.h>
 #include <asm/io.h>
 #include <asm/heartbeat.h>
+#include <asm/sh_keysc.h>
 /* Heartbeat */
 static struct heartbeat_data heartbeat_data = {
@@ -92,10 +94,47 @@ static struct platform_device cf_ide_device  = {
        .resource       = cf_ide_resources,
 };
+static struct sh_keysc_info sh_keysc_info = {
+        .mode = SH_KEYSC_MODE_1, /* KEYOUT0->5, KEYIN0->4 */
+        .scan_timing = 3,
+        .delay = 5,
+        .keycodes = { /* SW1 -> SW30 */
+                KEY_A, KEY_B, KEY_C, KEY_D, KEY_E,
+                KEY_F, KEY_G, KEY_H, KEY_I, KEY_J,
+                KEY_K, KEY_L, KEY_M, KEY_N, KEY_O,
+                KEY_P, KEY_Q, KEY_R, KEY_S, KEY_T,
+                KEY_U, KEY_V, KEY_W, KEY_X, KEY_Y,
+                KEY_Z,
+                KEY_HOME, KEY_SLEEP, KEY_WAKEUP, KEY_COFFEE, /* life */
+        },
+};
+static struct resource sh_keysc_resources[] = {
+        [0] = {
+                .start  = 0x044b0000,
+                .end    = 0x044b000f,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 79,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device sh_keysc_device = {
+        .name           = "sh_keysc",
+        .num_resources  = ARRAY_SIZE(sh_keysc_resources),
+        .resource       = sh_keysc_resources,
+        .dev    = {
+                .platform_data  = &sh_keysc_info,
+        },
+};
 static struct platform_device *se7722_devices[] __initdata = {
        &heartbeat_device,
        &smc91x_eth_device,
        &cf_ide_device,
+        &sh_keysc_device,
 };
 static int __init se7722_devices_setup(void)
@@ -136,6 +175,8 @@ static void __init se7722_setup(char **cmdline_p)
        ctrl_outw(0x0A10, PORT_PSELA); /* BS,SHHID2 */
        ctrl_outw(0x0000, PORT_PYCR);
        ctrl_outw(0x0000, PORT_PZCR);
+        ctrl_outw(ctrl_inw(PORT_HIZCRA) & ~0x4000, PORT_HIZCRA);
+        ctrl_outw(ctrl_inw(PORT_HIZCRC) & ~0xc000, PORT_HIZCRC);
 }
 /*
diff --git a/arch/sh/configs/se7721_defconfig b/arch/sh/configs/se7721_defconfig
new file mode 100644
index 000000000000..f3d4ca0caa46
--- /dev/null
+++ b/arch/sh/configs/se7721_defconfig
@@ -0,0 +1,1085 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.25-rc5
+# Fri Mar 21 12:05:31 2008
+#
+CONFIG_SUPERH=y
+CONFIG_SUPERH32=y
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_LOCKDEP_SUPPORT=y
+# CONFIG_ARCH_HAS_ILOG2_U32 is not set
+# CONFIG_ARCH_HAS_ILOG2_U64 is not set
+CONFIG_ARCH_NO_VIRT_TO_BUS=y
+CONFIG_ARCH_SUPPORTS_AOUT=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+#
+# General setup
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_SWAP is not set
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_BSD_PROCESS_ACCT=y
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
+# CONFIG_TASKSTATS is not set
+# CONFIG_AUDIT is not set
+# CONFIG_IKCONFIG is not set
+CONFIG_LOG_BUF_SHIFT=14
+# CONFIG_CGROUPS is not set
+CONFIG_GROUP_SCHED=y
+CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_RT_GROUP_SCHED is not set
+CONFIG_USER_SCHED=y
+# CONFIG_CGROUP_SCHED is not set
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
+# CONFIG_BLK_DEV_INITRD is not set
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
+CONFIG_EMBEDDED=y
+CONFIG_UID16=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+# CONFIG_BUG is not set
+CONFIG_ELF_CORE=y
+CONFIG_COMPAT_BRK=y
+# CONFIG_BASE_FULL is not set
+CONFIG_FUTEX=y
+CONFIG_ANON_INODES=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+# CONFIG_SHMEM is not set
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
+# CONFIG_SLOB is not set
+# CONFIG_PROFILING is not set
+# CONFIG_MARKERS is not set
+CONFIG_HAVE_OPROFILE=y
+# CONFIG_HAVE_KPROBES is not set
+# CONFIG_HAVE_KRETPROBES is not set
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_SLABINFO=y
+CONFIG_RT_MUTEXES=y
+CONFIG_TINY_SHMEM=y
+CONFIG_BASE_SMALL=1
+CONFIG_MODULES=y
+# CONFIG_MODULE_UNLOAD is not set
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+# CONFIG_KMOD is not set
+CONFIG_BLOCK=y
+# CONFIG_LBD is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_LSF is not set
+# CONFIG_BLK_DEV_BSG is not set
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+# CONFIG_IOSCHED_AS is not set
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+# CONFIG_DEFAULT_AS is not set
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+CONFIG_DEFAULT_NOOP=y
+CONFIG_DEFAULT_IOSCHED="noop"
+CONFIG_CLASSIC_RCU=y
+#
+# System type
+#
+CONFIG_CPU_SH3=y
+# CONFIG_CPU_SUBTYPE_SH7619 is not set
+# CONFIG_CPU_SUBTYPE_SH7203 is not set
+# CONFIG_CPU_SUBTYPE_SH7206 is not set
+# CONFIG_CPU_SUBTYPE_SH7263 is not set
+# CONFIG_CPU_SUBTYPE_MXG is not set
+# CONFIG_CPU_SUBTYPE_SH7705 is not set
+# CONFIG_CPU_SUBTYPE_SH7706 is not set
+# CONFIG_CPU_SUBTYPE_SH7707 is not set
+# CONFIG_CPU_SUBTYPE_SH7708 is not set
+# CONFIG_CPU_SUBTYPE_SH7709 is not set
+# CONFIG_CPU_SUBTYPE_SH7710 is not set
+# CONFIG_CPU_SUBTYPE_SH7712 is not set
+# CONFIG_CPU_SUBTYPE_SH7720 is not set
+CONFIG_CPU_SUBTYPE_SH7721=y
+# CONFIG_CPU_SUBTYPE_SH7750 is not set
+# CONFIG_CPU_SUBTYPE_SH7091 is not set
+# CONFIG_CPU_SUBTYPE_SH7750R is not set
+# CONFIG_CPU_SUBTYPE_SH7750S is not set
+# CONFIG_CPU_SUBTYPE_SH7751 is not set
+# CONFIG_CPU_SUBTYPE_SH7751R is not set
+# CONFIG_CPU_SUBTYPE_SH7760 is not set
+# CONFIG_CPU_SUBTYPE_SH4_202 is not set
+# CONFIG_CPU_SUBTYPE_SH7763 is not set
+# CONFIG_CPU_SUBTYPE_SH7770 is not set
+# CONFIG_CPU_SUBTYPE_SH7780 is not set
+# CONFIG_CPU_SUBTYPE_SH7785 is not set
+# CONFIG_CPU_SUBTYPE_SHX3 is not set
+# CONFIG_CPU_SUBTYPE_SH7343 is not set
+# CONFIG_CPU_SUBTYPE_SH7722 is not set
+# CONFIG_CPU_SUBTYPE_SH7366 is not set
+# CONFIG_CPU_SUBTYPE_SH5_101 is not set
+# CONFIG_CPU_SUBTYPE_SH5_103 is not set
+#
+# Memory management options
+#
+CONFIG_QUICKLIST=y
+CONFIG_MMU=y
+CONFIG_PAGE_OFFSET=0x80000000
+CONFIG_MEMORY_START=0x0c000000
+CONFIG_MEMORY_SIZE=0x02000000
+CONFIG_29BIT=y
+CONFIG_VSYSCALL=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_MAX_ACTIVE_REGIONS=1
+CONFIG_ARCH_POPULATES_NODE_MAP=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_PAGE_SIZE_4KB=y
+# CONFIG_PAGE_SIZE_8KB is not set
+# CONFIG_PAGE_SIZE_64KB is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+CONFIG_SPARSEMEM_STATIC=y
+# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_RESOURCES_64BIT is not set
+CONFIG_ZONE_DMA_FLAG=0
+CONFIG_NR_QUICK=2
+#
+# Cache configuration
+#
+# CONFIG_SH_DIRECT_MAPPED is not set
+CONFIG_CACHE_WRITEBACK=y
+# CONFIG_CACHE_WRITETHROUGH is not set
+# CONFIG_CACHE_OFF is not set
+#
+# Processor features
+#
+CONFIG_CPU_LITTLE_ENDIAN=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+# CONFIG_SH_FPU_EMU is not set
+# CONFIG_SH_DSP is not set
+# CONFIG_SH_ADC is not set
+CONFIG_CPU_HAS_INTEVT=y
+CONFIG_CPU_HAS_SR_RB=y
+CONFIG_CPU_HAS_DSP=y
+#
+# Board support
+#
+CONFIG_SOLUTION_ENGINE=y
+CONFIG_SH_7721_SOLUTION_ENGINE=y
+#
+# Timer and clock configuration
+#
+CONFIG_SH_TMU=y
+CONFIG_SH_TIMER_IRQ=16
+CONFIG_SH_PCLK_FREQ=33333333
+# CONFIG_TICK_ONESHOT is not set
+# CONFIG_NO_HZ is not set
+# CONFIG_HIGH_RES_TIMERS is not set
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+#
+# CPU Frequency scaling
+#
+# CONFIG_CPU_FREQ is not set
+#
+# DMA support
+#
+# CONFIG_SH_DMA is not set
+#
+# Companion Chips
+#
+#
+# Additional SuperH Device Drivers
+#
+CONFIG_HEARTBEAT=y
+# CONFIG_PUSH_SWITCH is not set
+#
+# Kernel features
+#
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+# CONFIG_SCHED_HRTICK is not set
+# CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_PREEMPT is not set
+CONFIG_GUSA=y
+# CONFIG_GUSA_RB is not set
+#
+# Boot options
+#
+CONFIG_ZERO_PAGE_OFFSET=0x00001000
+CONFIG_BOOT_LINK_OFFSET=0x00800000
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CMDLINE="console=ttySC0,115200 root=/dev/sda2"
+#
+# Bus options
+#
+CONFIG_CF_ENABLER=y
+# CONFIG_CF_AREA5 is not set
+CONFIG_CF_AREA6=y
+CONFIG_CF_BASE_ADDR=0xb8000000
+# CONFIG_ARCH_SUPPORTS_MSI is not set
+# CONFIG_PCCARD is not set
+#
+# Executable file formats
+#
+CONFIG_BINFMT_ELF=y
+# CONFIG_BINFMT_MISC is not set
+#
+# Networking
+#
+CONFIG_NET=y
+#
+# Networking options
+#
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+CONFIG_NET_KEY=y
+# CONFIG_NET_KEY_MIGRATE is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_ASK_IP_FIB_HASH=y
+# CONFIG_IP_FIB_TRIE is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+# CONFIG_IP_PNP_BOOTP is not set
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+CONFIG_IP_MROUTE=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+CONFIG_INET_AH=y
+CONFIG_INET_ESP=y
+CONFIG_INET_IPCOMP=y
+CONFIG_INET_XFRM_TUNNEL=y
+CONFIG_INET_TUNNEL=y
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
+# CONFIG_INET_LRO is not set
+# CONFIG_INET_DIAG is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+# CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETFILTER is not set
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+CONFIG_NET_SCHED=y
+#
+# Queueing/Scheduling
+#
+CONFIG_NET_SCH_CBQ=y
+CONFIG_NET_SCH_HTB=y
+CONFIG_NET_SCH_HFSC=y
+CONFIG_NET_SCH_PRIO=y
+# CONFIG_NET_SCH_RR is not set
+CONFIG_NET_SCH_RED=y
+CONFIG_NET_SCH_SFQ=y
+CONFIG_NET_SCH_TEQL=y
+CONFIG_NET_SCH_TBF=y
+CONFIG_NET_SCH_GRED=y
+CONFIG_NET_SCH_DSMARK=y
+CONFIG_NET_SCH_NETEM=y
+#
+# Classification
+#
+CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_BASIC is not set
+CONFIG_NET_CLS_TCINDEX=y
+CONFIG_NET_CLS_ROUTE4=y
+CONFIG_NET_CLS_ROUTE=y
+CONFIG_NET_CLS_FW=y
+# CONFIG_NET_CLS_U32 is not set
+# CONFIG_NET_CLS_RSVP is not set
+# CONFIG_NET_CLS_RSVP6 is not set
+# CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_EMATCH is not set
+# CONFIG_NET_CLS_ACT is not set
+CONFIG_NET_CLS_IND=y
+CONFIG_NET_SCH_FIFO=y
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_AF_RXRPC is not set
+CONFIG_FIB_RULES=y
+#
+# Wireless
+#
+# CONFIG_CFG80211 is not set
+# CONFIG_WIRELESS_EXT is not set
+# CONFIG_MAC80211 is not set
+# CONFIG_IEEE80211 is not set
+# CONFIG_RFKILL is not set
+# CONFIG_NET_9P is not set
+#
+# Device Drivers
+#
+#
+# Generic Driver Options
+#
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_FW_LOADER=y
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_CONNECTOR is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+CONFIG_MTD_CONCAT=y
+CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_REDBOOT_PARTS is not set
+# CONFIG_MTD_CMDLINE_PARTS is not set
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLKDEVS=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+# CONFIG_MTD_OOPS is not set
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=y
+# CONFIG_MTD_JEDECPROBE is not set
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+# CONFIG_MTD_PHYSMAP is not set
+# CONFIG_MTD_PLATRAM is not set
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_MTD_ONENAND is not set
+#
+# UBI - Unsorted block images
+#
+# CONFIG_MTD_UBI is not set
+# CONFIG_PARPORT is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_COW_COMMON is not set
+# CONFIG_BLK_DEV_LOOP is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_UB is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+CONFIG_MISC_DEVICES=y
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+CONFIG_HAVE_IDE=y
+# CONFIG_IDE is not set
+#
+# SCSI device support
+#
+# CONFIG_RAID_ATTRS is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_DMA=y
+# CONFIG_SCSI_TGT is not set
+# CONFIG_SCSI_NETLINK is not set
+CONFIG_SCSI_PROC_FS=y
+#
+# SCSI support type (disk, tape, CD-ROM)
+#
+CONFIG_BLK_DEV_SD=y
+# CONFIG_CHR_DEV_ST is not set
+# CONFIG_CHR_DEV_OSST is not set
+# CONFIG_BLK_DEV_SR is not set
+# CONFIG_CHR_DEV_SG is not set
+# CONFIG_CHR_DEV_SCH is not set
+#
+# Some SCSI devices (e.g. CD jukebox) support multiple LUNs
+#
+CONFIG_SCSI_MULTI_LUN=y
+# CONFIG_SCSI_CONSTANTS is not set
+# CONFIG_SCSI_LOGGING is not set
+# CONFIG_SCSI_SCAN_ASYNC is not set
+CONFIG_SCSI_WAIT_SCAN=m
+#
+# SCSI Transports
+#
+# CONFIG_SCSI_SPI_ATTRS is not set
+# CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
+# CONFIG_SCSI_SRP_ATTRS is not set
+# CONFIG_SCSI_LOWLEVEL is not set
+CONFIG_ATA=y
+# CONFIG_ATA_NONSTANDARD is not set
+# CONFIG_SATA_MV is not set
+CONFIG_PATA_PLATFORM=y
+# CONFIG_MD is not set
+CONFIG_NETDEVICES=y
+# CONFIG_NETDEVICES_MULTIQUEUE is not set
+# CONFIG_DUMMY is not set
+# CONFIG_BONDING is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_TUN is not set
+# CONFIG_VETH is not set
+# CONFIG_NET_ETHERNET is not set
+CONFIG_NETDEV_1000=y
+# CONFIG_E1000E_ENABLED is not set
+CONFIG_NETDEV_10000=y
+#
+# Wireless LAN
+#
+# CONFIG_WLAN_PRE80211 is not set
+# CONFIG_WLAN_80211 is not set
+#
+# USB Network Adapters
+#
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_USBNET is not set
+# CONFIG_WAN is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_ISDN is not set
+# CONFIG_PHONE is not set
+#
+# Input device support
+#
+CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
+# CONFIG_INPUT_POLLDEV is not set
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_EVBUG is not set
+#
+# Input Device Drivers
+#
+CONFIG_INPUT_KEYBOARD=y
+# CONFIG_KEYBOARD_ATKBD is not set
+# CONFIG_KEYBOARD_SUNKBD is not set
+# CONFIG_KEYBOARD_LKKBD is not set
+# CONFIG_KEYBOARD_XTKBD is not set
+# CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
+# CONFIG_KEYBOARD_SH_KEYSC is not set
+CONFIG_INPUT_MOUSE=y
+# CONFIG_MOUSE_PS2 is not set
+# CONFIG_MOUSE_SERIAL is not set
+# CONFIG_MOUSE_APPLETOUCH is not set
+# CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+#
+# Hardware I/O ports
+#
+# CONFIG_SERIO is not set
+# CONFIG_GAMEPORT is not set
+#
+# Character devices
+#
+# CONFIG_VT is not set
+# CONFIG_SERIAL_NONSTANDARD is not set
+#
+# Serial drivers
+#
+# CONFIG_SERIAL_8250 is not set
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_SH_SCI=y
+CONFIG_SERIAL_SH_SCI_NR_UARTS=2
+CONFIG_SERIAL_SH_SCI_CONSOLE=y
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_UNIX98_PTYS=y
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_IPMI_HANDLER is not set
+# CONFIG_HW_RANDOM is not set
+# CONFIG_R3964 is not set
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_I2C is not set
+#
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+# CONFIG_W1 is not set
+# CONFIG_POWER_SUPPLY is not set
+# CONFIG_HWMON is not set
+CONFIG_THERMAL=y
+# CONFIG_WATCHDOG is not set
+#
+# Sonics Silicon Backplane
+#
+CONFIG_SSB_POSSIBLE=y
+# CONFIG_SSB is not set
+#
+# Multifunction device drivers
+#
+# CONFIG_MFD_SM501 is not set
+#
+# Multimedia devices
+#
+# CONFIG_VIDEO_DEV is not set
+# CONFIG_DVB_CORE is not set
+# CONFIG_DAB is not set
+#
+# Graphics support
+#
+# CONFIG_VGASTATE is not set
+# CONFIG_VIDEO_OUTPUT_CONTROL is not set
+# CONFIG_FB is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
+#
+# Display device support
+#
+# CONFIG_DISPLAY_SUPPORT is not set
+#
+# Sound
+#
+# CONFIG_SOUND is not set
+CONFIG_HID_SUPPORT=y
+CONFIG_HID=y
+# CONFIG_HID_DEBUG is not set
+# CONFIG_HIDRAW is not set
+#
+# USB Input Devices
+#
+CONFIG_USB_HID=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
+# CONFIG_HID_FF is not set
+# CONFIG_USB_HIDDEV is not set
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+# CONFIG_USB_ARCH_HAS_EHCI is not set
+CONFIG_USB=y
+# CONFIG_USB_DEBUG is not set
+# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set
+#
+# Miscellaneous USB options
+#
+# CONFIG_USB_DEVICEFS is not set
+CONFIG_USB_DEVICE_CLASS=y
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_OTG is not set
+#
+# USB Host Controller Drivers
+#
+# CONFIG_USB_ISP116X_HCD is not set
+CONFIG_USB_OHCI_HCD=y
+# CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
+# CONFIG_USB_OHCI_BIG_ENDIAN_MMIO is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_SL811_HCD is not set
+# CONFIG_USB_R8A66597_HCD is not set
+#
+# USB Device Class drivers
+#
+# CONFIG_USB_ACM is not set
+# CONFIG_USB_PRINTER is not set
+#
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+#
+# may also be needed; see USB_STORAGE Help for more information
+#
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_DPCM is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_LIBUSUAL is not set
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+CONFIG_USB_MON=y
+#
+# USB port drivers
+#
+# CONFIG_USB_SERIAL is not set
+#
+# USB Miscellaneous drivers
+#
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_AUERSWALD is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_BERRY_CHARGE is not set
+# CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+# CONFIG_USB_PHIDGET is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_GADGET is not set
+# CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+#
+# LED drivers
+#
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_TIMER is not set
+# CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_RTC_CLASS is not set
+#
+# Userspace I/O
+#
+# CONFIG_UIO is not set
+#
+# File systems
+#
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_XATTR=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+# CONFIG_EXT2_FS_XIP is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_EXT3_FS_POSIX_ACL is not set
+# CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
+CONFIG_JBD=y
+CONFIG_FS_MBCACHE=y
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+CONFIG_FS_POSIX_ACL=y
+# CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_DNOTIFY is not set
+# CONFIG_INOTIFY is not set
+# CONFIG_QUOTA is not set
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
+#
+# CD-ROM/DVD Filesystems
+#
+# CONFIG_ISO9660_FS is not set
+# CONFIG_UDF_FS is not set
+#
+# DOS/FAT/NT Filesystems
+#
+CONFIG_FAT_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_NTFS_FS is not set
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+# CONFIG_PROC_KCORE is not set
+CONFIG_PROC_SYSCTL=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
+# CONFIG_HUGETLBFS is not set
+# CONFIG_HUGETLB_PAGE is not set
+# CONFIG_CONFIGFS_FS is not set
+#
+# Miscellaneous filesystems
+#
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_FS_DEBUG=0
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+# CONFIG_JFFS2_SUMMARY is not set
+# CONFIG_JFFS2_FS_XATTR is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+CONFIG_JFFS2_ZLIB=y
+# CONFIG_JFFS2_LZO is not set
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
+CONFIG_CRAMFS=y
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+# CONFIG_NETWORK_FILESYSTEMS is not set
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+CONFIG_NLS_CODEPAGE_437=y
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+CONFIG_NLS_CODEPAGE_932=y
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+CONFIG_NLS_ISO8859_1=y
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_UTF8 is not set
+# CONFIG_DLM is not set
+#
+# Kernel hacking
+#
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
+CONFIG_ENABLE_MUST_CHECK=y
+# CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_DETECT_SOFTLOCKUP is not set
+CONFIG_SCHED_DEBUG=y
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
+# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_SG is not set
+CONFIG_FRAME_POINTER=y
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_SAMPLES is not set
+# CONFIG_SH_STANDARD_BIOS is not set
+# CONFIG_EARLY_SCIF_CONSOLE is not set
+# CONFIG_DEBUG_BOOTMEM is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_4KSTACKS is not set
+# CONFIG_IRQSTACKS is not set
+# CONFIG_SH_KGDB is not set
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY is not set
+# CONFIG_SECURITY_FILE_CAPABILITIES is not set
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_BLKCIPHER=y
+# CONFIG_CRYPTO_SEQIV is not set
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_MD4 is not set
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_SHA1=y
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_ECB is not set
+CONFIG_CRYPTO_CBC=y
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_XTS is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+CONFIG_CRYPTO_DES=y
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+CONFIG_CRYPTO_DEFLATE=y
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_TEST is not set
+CONFIG_CRYPTO_AUTHENC=y
+# CONFIG_CRYPTO_LZO is not set
+CONFIG_CRYPTO_HW=y
+#
+# Library routines
+#
+CONFIG_BITREVERSE=y
+CONFIG_CRC_CCITT=y
+# CONFIG_CRC16 is not set
+# CONFIG_CRC_ITU_T is not set
+CONFIG_CRC32=y
+# CONFIG_CRC7 is not set
+# CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_PLIST=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_DMA=y
diff --git a/arch/sh/kernel/cf-enabler.c b/arch/sh/kernel/cf-enabler.c
index 1c3b99642e1c..01ff4d05aab0 100644
--- a/arch/sh/kernel/cf-enabler.c
+++ b/arch/sh/kernel/cf-enabler.c
@@ -83,6 +83,8 @@ static int __init cf_init_default(void)
 #include <asm/se.h>
 #elif defined(CONFIG_SH_7722_SOLUTION_ENGINE)
 #include <asm/se7722.h>
+#elif defined(CONFIG_SH_7721_SOLUTION_ENGINE)
+#include <asm/se7721.h>
 #endif
 /*
@@ -99,7 +101,9 @@ static int __init cf_init_default(void)
 * 0xB0600000 : I/O
 */
-#if defined(CONFIG_SH_SOLUTION_ENGINE) || defined(CONFIG_SH_7722_SOLUTION_ENGINE) 
+#if defined(CONFIG_SH_SOLUTION_ENGINE) || \
+    defined(CONFIG_SH_7722_SOLUTION_ENGINE) || \
+    defined(CONFIG_SH_7721_SOLUTION_ENGINE)
 static int __init cf_init_se(void)
 {
        if ((ctrl_inw(MRSHPC_CSR) & 0x000c) != 0)
@@ -112,7 +116,7 @@ static int __init cf_init_se(void)
        }
        /*
-         *  PC-Card window open 
+         *  PC-Card window open
         *  flag == COMMON/ATTRIBUTE/IO
         */
        /* common window open */
@@ -122,7 +126,7 @@ static int __init cf_init_se(void)
                ctrl_outw(0x0b00, MRSHPC_MW0CR2);
        else
                /* common mode & bus width 16bit SWAP = 0*/
-                ctrl_outw(0x0300, MRSHPC_MW0CR2); 
+                ctrl_outw(0x0300, MRSHPC_MW0CR2);
        /* attribute window open */
        ctrl_outw(0x8a85, MRSHPC_MW1CR1);
@@ -155,10 +159,9 @@ static int __init cf_init_se(void)
 int __init cf_init(void)
 {
-        if( mach_is_se() || mach_is_7722se() ){
+        if (mach_is_se() || mach_is_7722se() || mach_is_7721se())
                return cf_init_se();
-        }
-        
        return cf_init_default();
 }
diff --git a/arch/sh/kernel/cpu/sh2a/Makefile b/arch/sh/kernel/cpu/sh2a/Makefile
index b279cdc3a233..7e2b90cfa7bf 100644
--- a/arch/sh/kernel/cpu/sh2a/Makefile
+++ b/arch/sh/kernel/cpu/sh2a/Makefile
@@ -8,6 +8,7 @@ common-y	+= $(addprefix ../sh2/, ex.o entry.o)
 obj-$(CONFIG_SH_FPU)    += fpu.o
-obj-$(CONFIG_CPU_SUBTYPE_SH7206) += setup-sh7206.o clock-sh7206.o
+obj-$(CONFIG_CPU_SUBTYPE_SH7206)        += setup-sh7206.o clock-sh7206.o
-obj-$(CONFIG_CPU_SUBTYPE_SH7203) += setup-sh7203.o clock-sh7203.o
+obj-$(CONFIG_CPU_SUBTYPE_SH7203)        += setup-sh7203.o clock-sh7203.o
-obj-$(CONFIG_CPU_SUBTYPE_SH7263) += setup-sh7203.o clock-sh7203.o
+obj-$(CONFIG_CPU_SUBTYPE_SH7263)        += setup-sh7203.o clock-sh7203.o
+obj-$(CONFIG_CPU_SUBTYPE_MXG)           += setup-mxg.o clock-sh7206.o
diff --git a/arch/sh/kernel/cpu/sh2a/probe.c b/arch/sh/kernel/cpu/sh2a/probe.c
index 6910e2664468..6e79132f6f30 100644
--- a/arch/sh/kernel/cpu/sh2a/probe.c
+++ b/arch/sh/kernel/cpu/sh2a/probe.c
@@ -29,6 +29,9 @@ int __init detect_cpu_and_cache_system(void)
        boot_cpu_data.type                      = CPU_SH7206;
        /* While SH7206 has a DSP.. */
        boot_cpu_data.flags                     |= CPU_HAS_DSP;
+#elif defined(CONFIG_CPU_SUBTYPE_MXG)
+        boot_cpu_data.type                      = CPU_MXG;
+        boot_cpu_data.flags                     |= CPU_HAS_DSP;
 #endif
        boot_cpu_data.dcache.ways               = 4;
diff --git a/arch/sh/kernel/cpu/sh2a/setup-mxg.c b/arch/sh/kernel/cpu/sh2a/setup-mxg.c
new file mode 100644
index 000000000000..e611d79fac4c
--- /dev/null
+++ b/arch/sh/kernel/cpu/sh2a/setup-mxg.c
@@ -0,0 +1,168 @@
+/*
+ * Renesas MX-G (R8A03022BG) Setup
+ *
+ *  Copyright (C) 2008  Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/platform_device.h>
+#include <linux/init.h>
+#include <linux/serial.h>
+#include <linux/serial_sci.h>
+enum {
+        UNUSED = 0,
+        /* interrupt sources */
+        IRQ0, IRQ1, IRQ2, IRQ3, IRQ4, IRQ5, IRQ6, IRQ7,
+        IRQ8, IRQ9, IRQ10, IRQ11, IRQ12, IRQ13, IRQ14, IRQ15,
+        PINT0, PINT1, PINT2, PINT3, PINT4, PINT5, PINT6, PINT7,
+        SINT8, SINT7, SINT6, SINT5, SINT4, SINT3, SINT2, SINT1,
+        SCIF0_BRI, SCIF0_ERI, SCIF0_RXI, SCIF0_TXI,
+        SCIF1_BRI, SCIF1_ERI, SCIF1_RXI, SCIF1_TXI,
+        MTU2_TGI0A, MTU2_TGI0B, MTU2_TGI0C, MTU2_TGI0D,
+        MTU2_TCI0V, MTU2_TGI0E, MTU2_TGI0F,
+        MTU2_TGI1A, MTU2_TGI1B, MTU2_TCI1V, MTU2_TCI1U,
+        MTU2_TGI2A, MTU2_TGI2B, MTU2_TCI2V, MTU2_TCI2U,
+        MTU2_TGI3A, MTU2_TGI3B, MTU2_TGI3C, MTU2_TGI3D, MTU2_TCI3V,
+        MTU2_TGI4A, MTU2_TGI4B, MTU2_TGI4C, MTU2_TGI4D, MTU2_TCI4V,
+        MTU2_TGI5U, MTU2_TGI5V, MTU2_TGI5W,
+        /* interrupt groups */
+        PINT, SCIF0, SCIF1,
+        MTU2_GROUP1, MTU2_GROUP2, MTU2_GROUP3, MTU2_GROUP4, MTU2_GROUP5
+};
+static struct intc_vect vectors[] __initdata = {
+        INTC_IRQ(IRQ0, 64), INTC_IRQ(IRQ1, 65),
+        INTC_IRQ(IRQ2, 66), INTC_IRQ(IRQ3, 67),
+        INTC_IRQ(IRQ4, 68), INTC_IRQ(IRQ5, 69),
+        INTC_IRQ(IRQ6, 70), INTC_IRQ(IRQ7, 71),
+        INTC_IRQ(IRQ8, 72), INTC_IRQ(IRQ9, 73),
+        INTC_IRQ(IRQ10, 74), INTC_IRQ(IRQ11, 75),
+        INTC_IRQ(IRQ12, 76), INTC_IRQ(IRQ13, 77),
+        INTC_IRQ(IRQ14, 78), INTC_IRQ(IRQ15, 79),
+        INTC_IRQ(PINT0, 80), INTC_IRQ(PINT1, 81),
+        INTC_IRQ(PINT2, 82), INTC_IRQ(PINT3, 83),
+        INTC_IRQ(PINT4, 84), INTC_IRQ(PINT5, 85),
+        INTC_IRQ(PINT6, 86), INTC_IRQ(PINT7, 87),
+        INTC_IRQ(SINT8, 94), INTC_IRQ(SINT7, 95),
+        INTC_IRQ(SINT6, 96), INTC_IRQ(SINT5, 97),
+        INTC_IRQ(SINT4, 98), INTC_IRQ(SINT3, 99),
+        INTC_IRQ(SINT2, 100), INTC_IRQ(SINT1, 101),
+        INTC_IRQ(SCIF0_RXI, 220), INTC_IRQ(SCIF0_TXI, 221),
+        INTC_IRQ(SCIF0_BRI, 222), INTC_IRQ(SCIF0_ERI, 223),
+        INTC_IRQ(SCIF1_RXI, 224), INTC_IRQ(SCIF1_TXI, 225),
+        INTC_IRQ(SCIF1_BRI, 226), INTC_IRQ(SCIF1_ERI, 227),
+        INTC_IRQ(MTU2_TGI0A, 228), INTC_IRQ(MTU2_TGI0B, 229),
+        INTC_IRQ(MTU2_TGI0C, 230), INTC_IRQ(MTU2_TGI0D, 231),
+        INTC_IRQ(MTU2_TCI0V, 232), INTC_IRQ(MTU2_TGI0E, 233),
+        INTC_IRQ(MTU2_TGI0F, 234), INTC_IRQ(MTU2_TGI1A, 235),
+        INTC_IRQ(MTU2_TGI1B, 236), INTC_IRQ(MTU2_TCI1V, 237),
+        INTC_IRQ(MTU2_TCI1U, 238), INTC_IRQ(MTU2_TGI2A, 239),
+        INTC_IRQ(MTU2_TGI2B, 240), INTC_IRQ(MTU2_TCI2V, 241),
+        INTC_IRQ(MTU2_TCI2U, 242), INTC_IRQ(MTU2_TGI3A, 243),
+        INTC_IRQ(MTU2_TGI3B, 244),
+        INTC_IRQ(MTU2_TGI3C, 245),
+        INTC_IRQ(MTU2_TGI3D, 246), INTC_IRQ(MTU2_TCI3V, 247),
+        INTC_IRQ(MTU2_TGI4A, 248), INTC_IRQ(MTU2_TGI4B, 249),
+        INTC_IRQ(MTU2_TGI4C, 250), INTC_IRQ(MTU2_TGI4D, 251),
+        INTC_IRQ(MTU2_TCI4V, 252), INTC_IRQ(MTU2_TGI5U, 253),
+        INTC_IRQ(MTU2_TGI5V, 254), INTC_IRQ(MTU2_TGI5W, 255),
+};
+static struct intc_group groups[] __initdata = {
+        INTC_GROUP(PINT, PINT0, PINT1, PINT2, PINT3,
+                   PINT4, PINT5, PINT6, PINT7),
+        INTC_GROUP(MTU2_GROUP1, MTU2_TGI0A, MTU2_TGI0B, MTU2_TGI0C, MTU2_TGI0D,
+                   MTU2_TCI0V, MTU2_TGI0E),
+        INTC_GROUP(MTU2_GROUP2, MTU2_TGI0F, MTU2_TGI1A, MTU2_TGI1B,
+                   MTU2_TCI1V, MTU2_TCI1U, MTU2_TGI2A),
+        INTC_GROUP(MTU2_GROUP3, MTU2_TGI2B, MTU2_TCI2V, MTU2_TCI2U,
+                   MTU2_TGI3A),
+        INTC_GROUP(MTU2_GROUP4, MTU2_TGI3D, MTU2_TCI3V, MTU2_TGI4A,
+                   MTU2_TGI4B, MTU2_TGI4C, MTU2_TGI4D),
+        INTC_GROUP(MTU2_GROUP5, MTU2_TCI4V, MTU2_TGI5U, MTU2_TGI5V, MTU2_TGI5W),
+        INTC_GROUP(SCIF0, SCIF0_BRI, SCIF0_ERI, SCIF0_RXI, SCIF0_TXI),
+        INTC_GROUP(SCIF1, SCIF1_BRI, SCIF1_ERI, SCIF1_RXI, SCIF1_TXI),
+};
+static struct intc_prio_reg prio_registers[] __initdata = {
+        { 0xfffd9418, 0, 16, 4, /* IPR01 */ { IRQ0, IRQ1, IRQ2, IRQ3 } },
+        { 0xfffd941a, 0, 16, 4, /* IPR02 */ { IRQ4, IRQ5, IRQ6, IRQ7 } },
+        { 0xfffd941c, 0, 16, 4, /* IPR03 */ { IRQ8, IRQ9, IRQ10, IRQ11 } },
+        { 0xfffd941e, 0, 16, 4, /* IPR04 */ { IRQ12, IRQ13, IRQ14, IRQ15 } },
+        { 0xfffd9420, 0, 16, 4, /* IPR05 */ { PINT, 0, 0, 0 } },
+        { 0xfffd9800, 0, 16, 4, /* IPR06 */ { } },
+        { 0xfffd9802, 0, 16, 4, /* IPR07 */ { } },
+        { 0xfffd9804, 0, 16, 4, /* IPR08 */ { } },
+        { 0xfffd9806, 0, 16, 4, /* IPR09 */ { } },
+        { 0xfffd9808, 0, 16, 4, /* IPR10 */ { } },
+        { 0xfffd980a, 0, 16, 4, /* IPR11 */ { } },
+        { 0xfffd980c, 0, 16, 4, /* IPR12 */ { } },
+        { 0xfffd980e, 0, 16, 4, /* IPR13 */ { } },
+        { 0xfffd9810, 0, 16, 4, /* IPR14 */ { 0, 0, 0, SCIF0 } },
+        { 0xfffd9812, 0, 16, 4, /* IPR15 */
+                { SCIF1, MTU2_GROUP1, MTU2_GROUP2, MTU2_GROUP3 } },
+        { 0xfffd9814, 0, 16, 4, /* IPR16 */
+                { MTU2_TGI3B, MTU2_TGI3C, MTU2_GROUP4, MTU2_GROUP5 } },
+};
+static struct intc_mask_reg mask_registers[] __initdata = {
+        { 0xfffd9408, 0, 16, /* PINTER */
+          { 0, 0, 0, 0, 0, 0, 0, 0,
+            PINT7, PINT6, PINT5, PINT4, PINT3, PINT2, PINT1, PINT0 } },
+};
+static DECLARE_INTC_DESC(intc_desc, "mxg", vectors, groups,
+                         mask_registers, prio_registers, NULL);
+static struct plat_sci_port sci_platform_data[] = {
+        {
+                .mapbase        = 0xff804000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 223, 220, 221, 222 },
+        }, {
+                .flags = 0,
+        }
+};
+static struct platform_device sci_device = {
+        .name           = "sh-sci",
+        .id             = -1,
+        .dev            = {
+                .platform_data  = sci_platform_data,
+        },
+};
+static struct platform_device *mxg_devices[] __initdata = {
+        &sci_device,
+};
+static int __init mxg_devices_setup(void)
+{
+        return platform_add_devices(mxg_devices,
+                                    ARRAY_SIZE(mxg_devices));
+}
+__initcall(mxg_devices_setup);
+void __init plat_irq_setup(void)
+{
+        register_intc_controller(&intc_desc);
+}
diff --git a/arch/sh/kernel/cpu/sh4/probe.c b/arch/sh/kernel/cpu/sh4/probe.c
index 9e89984c4f1d..ebceb0dadff5 100644
--- a/arch/sh/kernel/cpu/sh4/probe.c
+++ b/arch/sh/kernel/cpu/sh4/probe.c
@@ -53,7 +53,7 @@ int __init detect_cpu_and_cache_system(void)
        /*
         * Setup some generic flags we can probe on SH-4A parts
         */
-        if (((pvr >> 16) & 0xff) == 0x10) {
+        if (((pvr >> 24) & 0xff) == 0x10) {
                if ((cvr & 0x10000000) == 0)
                        boot_cpu_data.flags |= CPU_HAS_DSP;
@@ -126,17 +126,22 @@ int __init detect_cpu_and_cache_system(void)
                                          CPU_HAS_LLSC;
                break;
        case 0x3008:
-                if (prr == 0xa0 || prr == 0xa1) {
+                boot_cpu_data.icache.ways = 4;
-                        boot_cpu_data.type = CPU_SH7722;
+                boot_cpu_data.dcache.ways = 4;
-                        boot_cpu_data.icache.ways = 4;
+                boot_cpu_data.flags |= CPU_HAS_LLSC;
-                        boot_cpu_data.dcache.ways = 4;
-                        boot_cpu_data.flags |= CPU_HAS_LLSC;
+                switch (prr) {
-                }
+                case 0x50:
-                else if (prr == 0x70) {
+                        boot_cpu_data.type = CPU_SH7723;
+                        boot_cpu_data.flags |= CPU_HAS_FPU | CPU_HAS_L2_CACHE;
+                        break;
+                case 0x70:
                        boot_cpu_data.type = CPU_SH7366;
-                        boot_cpu_data.icache.ways = 4;
+                        break;
-                        boot_cpu_data.dcache.ways = 4;
+                case 0xa0:
-                        boot_cpu_data.flags |= CPU_HAS_LLSC;
+                case 0xa1:
+                        boot_cpu_data.type = CPU_SH7722;
+                        break;
                }
                break;
        case 0x4000:    /* 1st cut */
@@ -215,6 +220,12 @@ int __init detect_cpu_and_cache_system(void)
         * SH-4A's have an optional PIPT L2.
         */
        if (boot_cpu_data.flags & CPU_HAS_L2_CACHE) {
+                /* Bug if we can't decode the L2 info */
+                BUG_ON(!(cvr & 0xf));
+                /* Silicon and specifications have clearly never met.. */
+                cvr ^= 0xf;
                /*
                 * Size calculation is much more sensible
                 * than it is for the L1.
diff --git a/arch/sh/kernel/cpu/sh4a/Makefile b/arch/sh/kernel/cpu/sh4a/Makefile
index 5d890ac8e793..a880e7968750 100644
--- a/arch/sh/kernel/cpu/sh4a/Makefile
+++ b/arch/sh/kernel/cpu/sh4a/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_CPU_SUBTYPE_SH7780)	+= setup-sh7780.o
 obj-$(CONFIG_CPU_SUBTYPE_SH7785)        += setup-sh7785.o
 obj-$(CONFIG_CPU_SUBTYPE_SH7343)        += setup-sh7343.o
 obj-$(CONFIG_CPU_SUBTYPE_SH7722)        += setup-sh7722.o
+obj-$(CONFIG_CPU_SUBTYPE_SH7723)        += setup-sh7723.o
 obj-$(CONFIG_CPU_SUBTYPE_SH7366)        += setup-sh7366.o
 obj-$(CONFIG_CPU_SUBTYPE_SHX3)          += setup-shx3.o
@@ -22,6 +23,7 @@ clock-$(CONFIG_CPU_SUBTYPE_SH7780)	:= clock-sh7780.o
 clock-$(CONFIG_CPU_SUBTYPE_SH7785)      := clock-sh7785.o
 clock-$(CONFIG_CPU_SUBTYPE_SH7343)      := clock-sh7343.o
 clock-$(CONFIG_CPU_SUBTYPE_SH7722)      := clock-sh7722.o
+clock-$(CONFIG_CPU_SUBTYPE_SH7723)      := clock-sh7722.o
 clock-$(CONFIG_CPU_SUBTYPE_SH7366)      := clock-sh7722.o
 clock-$(CONFIG_CPU_SUBTYPE_SHX3)        := clock-shx3.o
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
index b98b4bc93ec9..069314037049 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
@@ -16,13 +16,12 @@
 static struct resource usbf_resources[] = {
        [0] = {
-                .name   = "m66592_udc",
+                .name   = "USBF",
-                .start  = 0xA4480000,
+                .start  = 0x04480000,
-                .end    = 0xA44800FF,
+                .end    = 0x044800FF,
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .name   = "m66592_udc",
                .start  = 65,
                .end    = 65,
                .flags  = IORESOURCE_IRQ,
@@ -40,6 +39,26 @@ static struct platform_device usbf_device = {
        .resource       = usbf_resources,
 };
+static struct resource iic_resources[] = {
+        [0] = {
+                .name   = "IIC",
+                .start  = 0x04470000,
+                .end    = 0x04470017,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 96,
+                .end    = 99,
+                .flags  = IORESOURCE_IRQ,
+       },
+};
+static struct platform_device iic_device = {
+        .name           = "i2c-sh_mobile",
+        .num_resources  = ARRAY_SIZE(iic_resources),
+        .resource       = iic_resources,
+};
 static struct plat_sci_port sci_platform_data[] = {
        {
                .mapbase        = 0xffe00000,
@@ -74,6 +93,7 @@ static struct platform_device sci_device = {
 static struct platform_device *sh7722_devices[] __initdata = {
        &usbf_device,
+        &iic_device,
        &sci_device,
 };
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
new file mode 100644
index 000000000000..16925cf28db8
--- /dev/null
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
@@ -0,0 +1,300 @@
+/*
+ * SH7723 Setup
+ *
+ *  Copyright (C) 2008  Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/platform_device.h>
+#include <linux/init.h>
+#include <linux/serial.h>
+#include <linux/mm.h>
+#include <linux/serial_sci.h>
+#include <asm/mmzone.h>
+static struct plat_sci_port sci_platform_data[] = {
+        {
+                .mapbase        = 0xa4e30000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCI,
+                .irqs           = { 56, 56, 56, 56 },
+        },{
+                .mapbase        = 0xa4e40000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCI,
+                .irqs           = { 88, 88, 88, 88 },
+        },{
+                .mapbase        = 0xa4e50000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCI,
+                .irqs           = { 109, 109, 109, 109 },
+        }, {
+                .flags = 0,
+        }
+};
+static struct platform_device sci_device = {
+        .name           = "sh-sci",
+        .id             = -1,
+        .dev            = {
+                .platform_data  = sci_platform_data,
+        },
+};
+static struct resource rtc_resources[] = {
+        [0] = {
+                .start  = 0xa465fec0,
+                .end    = 0xa465fec0 + 0x58 - 1,
+                .flags  = IORESOURCE_IO,
+        },
+        [1] = {
+                /* Period IRQ */
+                .start  = 69,
+                .flags  = IORESOURCE_IRQ,
+        },
+        [2] = {
+                /* Carry IRQ */
+                .start  = 70,
+                .flags  = IORESOURCE_IRQ,
+        },
+        [3] = {
+                /* Alarm IRQ */
+                .start  = 68,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device rtc_device = {
+        .name           = "sh-rtc",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(rtc_resources),
+        .resource       = rtc_resources,
+};
+static struct platform_device *sh7723_devices[] __initdata = {
+        &sci_device,
+        &rtc_device,
+};
+static int __init sh7723_devices_setup(void)
+{
+        return platform_add_devices(sh7723_devices,
+                                    ARRAY_SIZE(sh7723_devices));
+}
+__initcall(sh7723_devices_setup);
+enum {
+        UNUSED=0,
+        /* interrupt sources */
+        IRQ0, IRQ1, IRQ2, IRQ3, IRQ4, IRQ5, IRQ6, IRQ7,
+        HUDI,
+        DMAC1A_DEI0,DMAC1A_DEI1,DMAC1A_DEI2,DMAC1A_DEI3,
+        _2DG_TRI,_2DG_INI,_2DG_CEI,
+        DMAC0A_DEI0,DMAC0A_DEI1,DMAC0A_DEI2,DMAC0A_DEI3,
+        VIO_CEUI,VIO_BEUI,VIO_VEU2HI,VIO_VOUI,
+        SCIFA_SCIFA0,
+        VPU_VPUI,
+        TPU_TPUI,
+        ADC_ADI,
+        USB_USI0,
+        RTC_ATI,RTC_PRI,RTC_CUI,
+        DMAC1B_DEI4,DMAC1B_DEI5,DMAC1B_DADERR,
+        DMAC0B_DEI4,DMAC0B_DEI5,DMAC0B_DADERR,
+        KEYSC_KEYI,
+        SCIF_SCIF0,SCIF_SCIF1,SCIF_SCIF2,
+        MSIOF_MSIOFI0,MSIOF_MSIOFI1,
+        SCIFA_SCIFA1,
+        FLCTL_FLSTEI,FLCTL_FLTENDI,FLCTL_FLTREQ0I,FLCTL_FLTREQ1I,
+        I2C_ALI,I2C_TACKI,I2C_WAITI,I2C_DTEI,
+        SDHI0_SDHII0,SDHI0_SDHII1,SDHI0_SDHII2,
+        CMT_CMTI,
+        TSIF_TSIFI,
+        SIU_SIUI,
+        SCIFA_SCIFA2,
+        TMU0_TUNI0, TMU0_TUNI1, TMU0_TUNI2,
+        IRDA_IRDAI,
+        ATAPI_ATAPII,
+        SDHI1_SDHII0,SDHI1_SDHII1,SDHI1_SDHII2,
+        VEU2H1_VEU2HI,
+        LCDC_LCDCI,
+        TMU1_TUNI0,TMU1_TUNI1,TMU1_TUNI2,
+        /* interrupt groups */
+        DMAC1A, DMAC0A, VIO, DMAC0B, FLCTL, I2C, _2DG,
+        SDHI1, RTC, DMAC1B, SDHI0,
+};
+static struct intc_vect vectors[] __initdata = {
+        INTC_VECT(IRQ0, 0x600), INTC_VECT(IRQ1, 0x620),
+        INTC_VECT(IRQ2, 0x640), INTC_VECT(IRQ3, 0x660),
+        INTC_VECT(IRQ4, 0x680), INTC_VECT(IRQ5, 0x6a0),
+        INTC_VECT(IRQ6, 0x6c0), INTC_VECT(IRQ7, 0x6e0),
+        INTC_VECT(DMAC1A_DEI0,0x700),
+        INTC_VECT(DMAC1A_DEI1,0x720),
+        INTC_VECT(DMAC1A_DEI2,0x740),
+        INTC_VECT(DMAC1A_DEI3,0x760),
+        INTC_VECT(_2DG_TRI, 0x780),
+        INTC_VECT(_2DG_INI, 0x7A0),
+        INTC_VECT(_2DG_CEI, 0x7C0),
+        INTC_VECT(DMAC0A_DEI0,0x800),
+        INTC_VECT(DMAC0A_DEI1,0x820),
+        INTC_VECT(DMAC0A_DEI2,0x840),
+        INTC_VECT(DMAC0A_DEI3,0x860),
+        INTC_VECT(VIO_CEUI,0x880),
+        INTC_VECT(VIO_BEUI,0x8A0),
+        INTC_VECT(VIO_VEU2HI,0x8C0),
+        INTC_VECT(VIO_VOUI,0x8E0),
+        INTC_VECT(SCIFA_SCIFA0,0x900),
+        INTC_VECT(VPU_VPUI,0x920),
+        INTC_VECT(TPU_TPUI,0x9A0),
+        INTC_VECT(ADC_ADI,0x9E0),
+        INTC_VECT(USB_USI0,0xA20),
+        INTC_VECT(RTC_ATI,0xA80),
+        INTC_VECT(RTC_PRI,0xAA0),
+        INTC_VECT(RTC_CUI,0xAC0),
+        INTC_VECT(DMAC1B_DEI4,0xB00),
+        INTC_VECT(DMAC1B_DEI5,0xB20),
+        INTC_VECT(DMAC1B_DADERR,0xB40),
+        INTC_VECT(DMAC0B_DEI4,0xB80),
+        INTC_VECT(DMAC0B_DEI5,0xBA0),
+        INTC_VECT(DMAC0B_DADERR,0xBC0),
+        INTC_VECT(KEYSC_KEYI,0xBE0),
+        INTC_VECT(SCIF_SCIF0,0xC00),
+        INTC_VECT(SCIF_SCIF1,0xC20),
+        INTC_VECT(SCIF_SCIF2,0xC40),
+        INTC_VECT(MSIOF_MSIOFI0,0xC80),
+        INTC_VECT(MSIOF_MSIOFI1,0xCA0),
+        INTC_VECT(SCIFA_SCIFA1,0xD00),
+        INTC_VECT(FLCTL_FLSTEI,0xD80),
+        INTC_VECT(FLCTL_FLTENDI,0xDA0),
+        INTC_VECT(FLCTL_FLTREQ0I,0xDC0),
+        INTC_VECT(FLCTL_FLTREQ1I,0xDE0),
+        INTC_VECT(I2C_ALI,0xE00),
+        INTC_VECT(I2C_TACKI,0xE20),
+        INTC_VECT(I2C_WAITI,0xE40),
+        INTC_VECT(I2C_DTEI,0xE60),
+        INTC_VECT(SDHI0_SDHII0,0xE80),
+        INTC_VECT(SDHI0_SDHII1,0xEA0),
+        INTC_VECT(SDHI0_SDHII2,0xEC0),
+        INTC_VECT(CMT_CMTI,0xF00),
+        INTC_VECT(TSIF_TSIFI,0xF20),
+        INTC_VECT(SIU_SIUI,0xF80),
+        INTC_VECT(SCIFA_SCIFA2,0xFA0),
+        INTC_VECT(TMU0_TUNI0,0x400),
+        INTC_VECT(TMU0_TUNI1,0x420),
+        INTC_VECT(TMU0_TUNI2,0x440),
+        INTC_VECT(IRDA_IRDAI,0x480),
+        INTC_VECT(ATAPI_ATAPII,0x4A0),
+        INTC_VECT(SDHI1_SDHII0,0x4E0),
+        INTC_VECT(SDHI1_SDHII1,0x500),
+        INTC_VECT(SDHI1_SDHII2,0x520),
+        INTC_VECT(VEU2H1_VEU2HI,0x560),
+        INTC_VECT(LCDC_LCDCI,0x580),
+        INTC_VECT(TMU1_TUNI0,0x920),
+        INTC_VECT(TMU1_TUNI1,0x940),
+        INTC_VECT(TMU1_TUNI2,0x960),
+};
+static struct intc_group groups[] __initdata = {
+        INTC_GROUP(DMAC1A,DMAC1A_DEI0,DMAC1A_DEI1,DMAC1A_DEI2,DMAC1A_DEI3),
+        INTC_GROUP(DMAC0A,DMAC0A_DEI0,DMAC0A_DEI1,DMAC0A_DEI2,DMAC0A_DEI3),
+        INTC_GROUP(VIO, VIO_CEUI,VIO_BEUI,VIO_VEU2HI,VIO_VOUI),
+        INTC_GROUP(DMAC0B, DMAC0B_DEI4,DMAC0B_DEI5,DMAC0B_DADERR),
+        INTC_GROUP(FLCTL,FLCTL_FLSTEI,FLCTL_FLTENDI,FLCTL_FLTREQ0I,FLCTL_FLTREQ1I),
+        INTC_GROUP(I2C,I2C_ALI,I2C_TACKI,I2C_WAITI,I2C_DTEI),
+        INTC_GROUP(_2DG, _2DG_TRI,_2DG_INI,_2DG_CEI),
+        INTC_GROUP(SDHI1, SDHI1_SDHII0,SDHI1_SDHII1,SDHI1_SDHII2),
+        INTC_GROUP(RTC, RTC_ATI,RTC_PRI,RTC_CUI),
+        INTC_GROUP(DMAC1B, DMAC1B_DEI4,DMAC1B_DEI5,DMAC1B_DADERR),
+        INTC_GROUP(SDHI0,SDHI0_SDHII0,SDHI0_SDHII1,SDHI0_SDHII2),
+};
+static struct intc_mask_reg mask_registers[] __initdata = {
+        { 0xa4080080, 0xa40800c0, 8, /* IMR0 / IMCR0 */
+          { 0,  TMU1_TUNI2,TMU1_TUNI1,TMU1_TUNI0,0,SDHI1_SDHII2,SDHI1_SDHII1,SDHI1_SDHII0} },
+        { 0xa4080084, 0xa40800c4, 8, /* IMR1 / IMCR1 */
+          { VIO_VOUI, VIO_VEU2HI,VIO_BEUI,VIO_CEUI,DMAC0A_DEI3,DMAC0A_DEI2,DMAC0A_DEI1,DMAC0A_DEI0 } },
+        { 0xa4080088, 0xa40800c8, 8, /* IMR2 / IMCR2 */
+          { 0, 0, 0, VPU_VPUI,0,0,0,SCIFA_SCIFA0 } },
+        { 0xa408008c, 0xa40800cc, 8, /* IMR3 / IMCR3 */
+          { DMAC1A_DEI3,DMAC1A_DEI2,DMAC1A_DEI1,DMAC1A_DEI0,0,0,0,IRDA_IRDAI } },
+        { 0xa4080090, 0xa40800d0, 8, /* IMR4 / IMCR4 */
+          { 0,TMU0_TUNI2,TMU0_TUNI1,TMU0_TUNI0,VEU2H1_VEU2HI,0,0,LCDC_LCDCI } },
+        { 0xa4080094, 0xa40800d4, 8, /* IMR5 / IMCR5 */
+          { KEYSC_KEYI,DMAC0B_DADERR,DMAC0B_DEI5,DMAC0B_DEI4,0,SCIF_SCIF2,SCIF_SCIF1,SCIF_SCIF0 } },
+        { 0xa4080098, 0xa40800d8, 8, /* IMR6 / IMCR6 */
+          { 0,0,0,SCIFA_SCIFA1,ADC_ADI,0,MSIOF_MSIOFI1,MSIOF_MSIOFI0 } },
+        { 0xa408009c, 0xa40800dc, 8, /* IMR7 / IMCR7 */
+          { I2C_DTEI, I2C_WAITI, I2C_TACKI, I2C_ALI,
+            FLCTL_FLTREQ1I, FLCTL_FLTREQ0I, FLCTL_FLTENDI, FLCTL_FLSTEI } },
+        { 0xa40800a0, 0xa40800e0, 8, /* IMR8 / IMCR8 */
+          { 0,SDHI0_SDHII2,SDHI0_SDHII1,SDHI0_SDHII0,0,0,SCIFA_SCIFA2,SIU_SIUI } },
+        { 0xa40800a4, 0xa40800e4, 8, /* IMR9 / IMCR9 */
+          { 0, 0, 0, CMT_CMTI, 0, 0, USB_USI0,0 } },
+        { 0xa40800a8, 0xa40800e8, 8, /* IMR10 / IMCR10 */
+          { 0, DMAC1B_DADERR,DMAC1B_DEI5,DMAC1B_DEI4,0,RTC_ATI,RTC_PRI,RTC_CUI } },
+        { 0xa40800ac, 0xa40800ec, 8, /* IMR11 / IMCR11 */
+          { 0,_2DG_CEI,_2DG_INI,_2DG_TRI,0,TPU_TPUI,0,TSIF_TSIFI } },
+        { 0xa40800b0, 0xa40800f0, 8, /* IMR12 / IMCR12 */
+          { 0,0,0,0,0,0,0,ATAPI_ATAPII } },
+        { 0xa4140044, 0xa4140064, 8, /* INTMSK00 / INTMSKCLR00 */
+          { IRQ0, IRQ1, IRQ2, IRQ3, IRQ4, IRQ5, IRQ6, IRQ7 } },
+};
+static struct intc_prio_reg prio_registers[] __initdata = {
+        { 0xa4080000, 0, 16, 4, /* IPRA */ { TMU0_TUNI0, TMU0_TUNI1, TMU0_TUNI2, IRDA_IRDAI } },
+        { 0xa4080004, 0, 16, 4, /* IPRB */ { VEU2H1_VEU2HI, LCDC_LCDCI, DMAC1A, 0} },
+        { 0xa4080008, 0, 16, 4, /* IPRC */ { TMU1_TUNI0, TMU1_TUNI1, TMU1_TUNI2, 0} },
+        { 0xa408000c, 0, 16, 4, /* IPRD */ { } },
+        { 0xa4080010, 0, 16, 4, /* IPRE */ { DMAC0A, VIO, SCIFA_SCIFA0, VPU_VPUI } },
+        { 0xa4080014, 0, 16, 4, /* IPRF */ { KEYSC_KEYI, DMAC0B, USB_USI0, CMT_CMTI } },
+        { 0xa4080018, 0, 16, 4, /* IPRG */ { SCIF_SCIF0, SCIF_SCIF1, SCIF_SCIF2,0 } },
+        { 0xa408001c, 0, 16, 4, /* IPRH */ { MSIOF_MSIOFI0,MSIOF_MSIOFI1, FLCTL, I2C } },
+        { 0xa4080020, 0, 16, 4, /* IPRI */ { SCIFA_SCIFA1,0,TSIF_TSIFI,_2DG } },
+        { 0xa4080024, 0, 16, 4, /* IPRJ */ { ADC_ADI,0,SIU_SIUI,SDHI1 } },
+        { 0xa4080028, 0, 16, 4, /* IPRK */ { RTC,DMAC1B,0,SDHI0 } },
+        { 0xa408002c, 0, 16, 4, /* IPRL */ { SCIFA_SCIFA2,0,TPU_TPUI,ATAPI_ATAPII } },
+        { 0xa4140010, 0, 32, 4, /* INTPRI00 */
+          { IRQ0, IRQ1, IRQ2, IRQ3, IRQ4, IRQ5, IRQ6, IRQ7 } },
+};
+static struct intc_sense_reg sense_registers[] __initdata = {
+        { 0xa414001c, 16, 2, /* ICR1 */
+          { IRQ0, IRQ1, IRQ2, IRQ3, IRQ4, IRQ5, IRQ6, IRQ7 } },
+};
+static DECLARE_INTC_DESC(intc_desc, "sh7723", vectors, groups,
+                         mask_registers, prio_registers, sense_registers);
+void __init plat_irq_setup(void)
+{
+        register_intc_controller(&intc_desc);
+}
+void __init plat_mem_setup(void)
+{
+        /* Register the URAM space as Node 1 */
+        setup_bootmem_node(1, 0x055f0000, 0x05610000);
+}
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
index 07c988dc9de6..ae2b22219f02 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
@@ -231,12 +231,6 @@ static struct intc_group groups[] __initdata = {
        INTC_GROUP(GPIO, GPIO_CH0, GPIO_CH1, GPIO_CH2, GPIO_CH3),
 };
-static struct intc_prio priorities[] __initdata = {
-        INTC_PRIO(SCIF0, 3),
-        INTC_PRIO(SCIF1, 3),
-        INTC_PRIO(SCIF2, 3),
-};
 static struct intc_mask_reg mask_registers[] __initdata = {
        { 0xffd40038, 0xffd4003c, 32, /* INT2MSKR / INT2MSKCR */
          { 0, 0, 0, 0, 0, 0, GPIO, 0,
@@ -270,11 +264,10 @@ static struct intc_prio_reg prio_registers[] __initdata = {
        { 0xffd400b4, 0, 32, 8, /* INT2PRI13 */ { 0, 0, STIF1, STIF0 } },
 };
-static DECLARE_INTC_DESC(intc_desc, "sh7763", vectors, groups, priorities,
+static DECLARE_INTC_DESC(intc_desc, "sh7763", vectors, groups,
                         mask_registers, prio_registers, NULL);
 /* Support for external interrupt pins in IRQ mode */
 static struct intc_vect irq_vectors[] __initdata = {
        INTC_VECT(IRQ0, 0x240), INTC_VECT(IRQ1, 0x280),
        INTC_VECT(IRQ2, 0x2c0), INTC_VECT(IRQ3, 0x300),
@@ -302,7 +295,6 @@ static DECLARE_INTC_DESC(intc_irq_desc, "sh7763-irq", irq_vectors,
                         irq_sense_registers);
 /* External interrupt pins in IRL mode */
 static struct intc_vect irl_vectors[] __initdata = {
        INTC_VECT(IRL_LLLL, 0x200), INTC_VECT(IRL_LLLH, 0x220),
        INTC_VECT(IRL_LLHL, 0x240), INTC_VECT(IRL_LLHH, 0x260),
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7770.c b/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
index b9cec48b1808..b73578ee295d 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
@@ -1,7 +1,7 @@
 /*
 * SH7770 Setup
 *
- *  Copyright (C) 2006  Paul Mundt
+ *  Copyright (C) 2006 - 2008  Paul Mundt
 *
 * This file is subject to the terms and conditions of the GNU General Public
 * License.  See the file "COPYING" in the main directory of this archive
@@ -29,6 +29,41 @@ static struct plat_sci_port sci_platform_data[] = {
                .type           = PORT_SCIF,
                .irqs           = { 63, 63, 63, 63 },
        }, {
+                .mapbase        = 0xff926000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 64, 64, 64, 64 },
+        }, {
+                .mapbase        = 0xff927000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 65, 65, 65, 65 },
+        }, {
+                .mapbase        = 0xff928000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 66, 66, 66, 66 },
+        }, {
+                .mapbase        = 0xff929000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 67, 67, 67, 67 },
+        }, {
+                .mapbase        = 0xff92a000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 68, 68, 68, 68 },
+        }, {
+                .mapbase        = 0xff92b000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 69, 69, 69, 69 },
+        }, {
+                .mapbase        = 0xff92c000,
+                .flags          = UPF_BOOT_AUTOCONF,
+                .type           = PORT_SCIF,
+                .irqs           = { 70, 70, 70, 70 },
+        }, {
                .flags = 0,
        }
 };
diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
index ff4f54a47c07..284f66f1ebbe 100644
--- a/arch/sh/kernel/setup.c
+++ b/arch/sh/kernel/setup.c
@@ -23,6 +23,8 @@
 #include <linux/kexec.h>
 #include <linux/module.h>
 #include <linux/smp.h>
+#include <linux/err.h>
+#include <linux/debugfs.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/page.h>
@@ -333,6 +335,7 @@ static const char *cpu_name[] = {
        [CPU_SH7343]    = "SH7343",     [CPU_SH7785]    = "SH7785",
        [CPU_SH7722]    = "SH7722",     [CPU_SHX3]      = "SH-X3",
        [CPU_SH5_101]   = "SH5-101",    [CPU_SH5_103]   = "SH5-103",
+        [CPU_MXG]       = "MX-G",       [CPU_SH7723]    = "SH7723",
        [CPU_SH7366]    = "SH7366",     [CPU_SH_NONE]   = "Unknown"
 };
@@ -443,3 +446,15 @@ const struct seq_operations cpuinfo_op = {
        .show   = show_cpuinfo,
 };
 #endif /* CONFIG_PROC_FS */
+struct dentry *sh_debugfs_root;
+static int __init sh_debugfs_init(void)
+{
+        sh_debugfs_root = debugfs_create_dir("sh", NULL);
+        if (IS_ERR(sh_debugfs_root))
+                return PTR_ERR(sh_debugfs_root);
+        return 0;
+}
+arch_initcall(sh_debugfs_init);
diff --git a/arch/sh/lib/clear_page.S b/arch/sh/lib/clear_page.S
index 3539123fe517..8342bfbde64c 100644
--- a/arch/sh/lib/clear_page.S
+++ b/arch/sh/lib/clear_page.S
@@ -27,11 +27,11 @@ ENTRY(clear_page)
        mov     #0,r0
        !
 1:
-#if defined(CONFIG_CPU_SH3)
+#if defined(CONFIG_CPU_SH4)
-        mov.l   r0,@r4
-#elif defined(CONFIG_CPU_SH4)
        movca.l r0,@r4
        mov     r4,r1
+#else
+        mov.l   r0,@r4
 #endif
        add     #32,r4
        mov.l   r0,@-r4
diff --git a/arch/sh/lib/copy_page.S b/arch/sh/lib/copy_page.S
index e002b91c8752..5d12e657be34 100644
--- a/arch/sh/lib/copy_page.S
+++ b/arch/sh/lib/copy_page.S
@@ -41,11 +41,11 @@ ENTRY(copy_page)
        mov.l   @r11+,r5
        mov.l   @r11+,r6
        mov.l   @r11+,r7
-#if defined(CONFIG_CPU_SH3)
+#if defined(CONFIG_CPU_SH4)
-        mov.l   r0,@r10
-#elif defined(CONFIG_CPU_SH4)
        movca.l r0,@r10
        mov     r10,r0
+#else
+        mov.l   r0,@r10
 #endif
        add     #32,r10
        mov.l   r7,@-r10
diff --git a/arch/sh/mm/cache-debugfs.c b/arch/sh/mm/cache-debugfs.c
index db6d950b6f5e..c5b56d52b7d2 100644
--- a/arch/sh/mm/cache-debugfs.c
+++ b/arch/sh/mm/cache-debugfs.c
@@ -127,13 +127,13 @@ static int __init cache_debugfs_init(void)
 {
        struct dentry *dcache_dentry, *icache_dentry;
-        dcache_dentry = debugfs_create_file("dcache", S_IRUSR, NULL,
+        dcache_dentry = debugfs_create_file("dcache", S_IRUSR, sh_debugfs_root,
                                            (unsigned int *)CACHE_TYPE_DCACHE,
                                            &cache_debugfs_fops);
        if (IS_ERR(dcache_dentry))
                return PTR_ERR(dcache_dentry);
-        icache_dentry = debugfs_create_file("icache", S_IRUSR, NULL,
+        icache_dentry = debugfs_create_file("icache", S_IRUSR, sh_debugfs_root,
                                            (unsigned int *)CACHE_TYPE_ICACHE,
                                            &cache_debugfs_fops);
        if (IS_ERR(icache_dentry)) {
diff --git a/arch/sh/mm/pmb.c b/arch/sh/mm/pmb.c
index ab81c602295f..0b0ec6e04753 100644
--- a/arch/sh/mm/pmb.c
+++ b/arch/sh/mm/pmb.c
@@ -393,7 +393,7 @@ static int __init pmb_debugfs_init(void)
        struct dentry *dentry;
        dentry = debugfs_create_file("pmb", S_IFREG | S_IRUGO,
-                                     NULL, NULL, &pmb_debugfs_fops);
+                                     sh_debugfs_root, NULL, &pmb_debugfs_fops);
        if (IS_ERR(dentry))
                return PTR_ERR(dentry);
diff --git a/arch/sh/tools/mach-types b/arch/sh/tools/mach-types
index d63b93da952d..987c6682bf99 100644
--- a/arch/sh/tools/mach-types
+++ b/arch/sh/tools/mach-types
@@ -21,8 +21,9 @@ HD64465			HD64465
 7206SE                  SH_7206_SOLUTION_ENGINE
 7343SE                  SH_7343_SOLUTION_ENGINE
 7619SE                  SH_7619_SOLUTION_ENGINE
-7722SE                  SH_7722_SOLUTION_ENGINE         
+7721SE                  SH_7721_SOLUTION_ENGINE
-7751SE                  SH_7751_SOLUTION_ENGINE         
+7722SE                  SH_7722_SOLUTION_ENGINE
+7751SE                  SH_7751_SOLUTION_ENGINE
 7780SE                  SH_7780_SOLUTION_ENGINE
 7751SYSTEMH             SH_7751_SYSTEMH
 HP6XX                   SH_HP6XX
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 7f30b754bfc3..87a693cf2bb7 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -906,6 +906,15 @@ config X86_64_ACPI_NUMA
        help
          Enable ACPI SRAT based node topology detection.
+# Some NUMA nodes have memory ranges that span
+# other nodes.  Even though a pfn is valid and
+# between a node's start and end pfns, it may not
+# reside on that node.  See memmap_init_zone()
+# for details.
+config NODES_SPAN_OTHER_NODES
+        def_bool y
+        depends on X86_64_ACPI_NUMA
 config NUMA_EMU
        bool "NUMA emulation"
        depends on X86_64 && NUMA
diff --git a/arch/x86/boot/a20.c b/arch/x86/boot/a20.c
index 31348d054fca..90943f83e84d 100644
--- a/arch/x86/boot/a20.c
+++ b/arch/x86/boot/a20.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/a20.c
- *
 * Enable A20 gate (return -1 on failure)
 */
diff --git a/arch/x86/boot/apm.c b/arch/x86/boot/apm.c
index c117c7fb859c..7aa6033001f9 100644
--- a/arch/x86/boot/apm.c
+++ b/arch/x86/boot/apm.c
@@ -12,8 +12,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/apm.c
- *
 * Get APM BIOS information
 */
diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
index 8dcc8dc7db88..878e4b9940d9 100644
--- a/arch/x86/boot/bitops.h
+++ b/arch/x86/boot/bitops.h
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/bitops.h
- *
 * Very simple bitops for the boot code.
 */
diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
index 09578070bfba..a34b9982c7cb 100644
--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/boot.h
- *
 * Header file for the real-mode kernel code
 */
diff --git a/arch/x86/boot/cmdline.c b/arch/x86/boot/cmdline.c
index 680408a0f463..a1d35634bce0 100644
--- a/arch/x86/boot/cmdline.c
+++ b/arch/x86/boot/cmdline.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/cmdline.c
- *
 * Simple command-line parser for early boot.
 */
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index 036e635f18a3..ba7736cf2ec7 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -130,7 +130,7 @@ relocated:
 /*
 * Setup the stack for the decompressor
 */
-        leal stack_end(%ebx), %esp
+        leal boot_stack_end(%ebx), %esp
 /*
 * Do the decompression, and jump to the new kernel..
@@ -142,8 +142,8 @@ relocated:
        pushl %eax      # input_len
        leal input_data(%ebx), %eax
        pushl %eax      # input_data
-        leal _end(%ebx), %eax
+        leal boot_heap(%ebx), %eax
-        pushl %eax      # end of the image as third argument
+        pushl %eax      # heap area as third argument
        pushl %esi      # real mode pointer as second arg
        call decompress_kernel
        addl $20, %esp
@@ -181,7 +181,10 @@ relocated:
        jmp *%ebp
 .bss
+/* Stack and heap for uncompression */
 .balign 4
-stack:
+boot_heap:
-        .fill 4096, 1, 0
+        .fill BOOT_HEAP_SIZE, 1, 0
-stack_end:
+boot_stack:
+        .fill BOOT_STACK_SIZE, 1, 0
+boot_stack_end:
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index e8657b98c902..d8819efac81d 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -28,6 +28,7 @@
 #include <asm/segment.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
+#include <asm/boot.h>
 #include <asm/msr.h>
 #include <asm/asm-offsets.h>
@@ -62,7 +63,7 @@ startup_32:
        subl    $1b, %ebp
 /* setup a stack and make sure cpu supports long mode. */
-        movl    $user_stack_end, %eax
+        movl    $boot_stack_end, %eax
        addl    %ebp, %eax
        movl    %eax, %esp
@@ -243,9 +244,9 @@ ENTRY(startup_64)
 /* Copy the compressed kernel to the end of our buffer
 * where decompression in place becomes safe.
 */
-        leaq    _end(%rip), %r8
+        leaq    _end_before_pgt(%rip), %r8
-        leaq    _end(%rbx), %r9
+        leaq    _end_before_pgt(%rbx), %r9
-        movq    $_end /* - $startup_32 */, %rcx
+        movq    $_end_before_pgt /* - $startup_32 */, %rcx
 1:      subq    $8, %r8
        subq    $8, %r9
        movq    0(%r8), %rax
@@ -267,14 +268,14 @@ relocated:
 */
        xorq    %rax, %rax
        leaq    _edata(%rbx), %rdi
-        leaq    _end(%rbx), %rcx
+        leaq    _end_before_pgt(%rbx), %rcx
        subq    %rdi, %rcx
        cld
        rep
        stosb
        /* Setup the stack */
-        leaq    user_stack_end(%rip), %rsp
+        leaq    boot_stack_end(%rip), %rsp
        /* zero EFLAGS after setting rsp */
        pushq   $0
@@ -285,7 +286,7 @@ relocated:
 */
        pushq   %rsi                    # Save the real mode argument
        movq    %rsi, %rdi              # real mode address
-        leaq    _heap(%rip), %rsi       # _heap
+        leaq    boot_heap(%rip), %rsi   # malloc area for uncompression
        leaq    input_data(%rip), %rdx  # input_data
        movl    input_len(%rip), %eax
        movq    %rax, %rcx              # input_len
@@ -310,9 +311,12 @@ gdt:
        .quad   0x0080890000000000      /* TS descriptor */
        .quad   0x0000000000000000      /* TS continued */
 gdt_end:
-        .bss
-/* Stack for uncompression */
+.bss
-        .balign 4
+/* Stack and heap for uncompression */
-user_stack:
+.balign 4
-        .fill 4096,4,0
+boot_heap:
-user_stack_end:
+        .fill BOOT_HEAP_SIZE, 1, 0
+boot_stack:
+        .fill BOOT_STACK_SIZE, 1, 0
+boot_stack_end:
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index dad4e699f5a3..90456cee47c3 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -217,12 +217,6 @@ static void putstr(const char *);
 static memptr free_mem_ptr;
 static memptr free_mem_end_ptr;
-#ifdef CONFIG_X86_64
-#define HEAP_SIZE             0x7000
-#else
-#define HEAP_SIZE             0x4000
-#endif
 static char *vidmem;
 static int vidport;
 static int lines, cols;
@@ -449,7 +443,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
        window = output;                /* Output buffer (Normally at 1M) */
        free_mem_ptr     = heap;        /* Heap */
-        free_mem_end_ptr = heap + HEAP_SIZE;
+        free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
        inbuf  = input_data;            /* Input buffer */
        insize = input_len;
        inptr  = 0;
diff --git a/arch/x86/boot/compressed/vmlinux_64.lds b/arch/x86/boot/compressed/vmlinux_64.lds
index 7e5c7209f6cc..bef1ac891bce 100644
--- a/arch/x86/boot/compressed/vmlinux_64.lds
+++ b/arch/x86/boot/compressed/vmlinux_64.lds
@@ -39,10 +39,10 @@ SECTIONS
                *(.bss.*)
                *(COMMON)
                . = ALIGN(8);
-                _end = . ;
+                _end_before_pgt = . ;
                . = ALIGN(4096);
                pgtable = . ;
                . = . + 4096 * 6;
-                _heap = .;
+                _ebss = .;
        }
 }
diff --git a/arch/x86/boot/copy.S b/arch/x86/boot/copy.S
index ef127e56a3cf..ef50c84e8b4b 100644
--- a/arch/x86/boot/copy.S
+++ b/arch/x86/boot/copy.S
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/copy.S
- *
 * Memory copy routines
 */
diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
index 2462c88689ed..7804389ee005 100644
--- a/arch/x86/boot/cpucheck.c
+++ b/arch/x86/boot/cpucheck.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/cpucheck.c
- *
 * Check for obligatory CPU features and abort if the features are not
 * present.  This code should be compilable as 16-, 32- or 64-bit
 * code, so be very careful with types and inline assembly.
diff --git a/arch/x86/boot/edd.c b/arch/x86/boot/edd.c
index 8721dc46a0b6..d84a48ece785 100644
--- a/arch/x86/boot/edd.c
+++ b/arch/x86/boot/edd.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/edd.c
- *
 * Get EDD BIOS disk information
 */
diff --git a/arch/x86/boot/install.sh b/arch/x86/boot/install.sh
index 88d77761d01b..8d60ee15dfd9 100644
--- a/arch/x86/boot/install.sh
+++ b/arch/x86/boot/install.sh
@@ -1,7 +1,5 @@
 #!/bin/sh
 #
-# arch/i386/boot/install.sh
-#
 # This file is subject to the terms and conditions of the GNU General Public
 # License.  See the file "COPYING" in the main directory of this archive
 # for more details.
diff --git a/arch/x86/boot/main.c b/arch/x86/boot/main.c
index 7828da5cfd07..77569a4a3be1 100644
--- a/arch/x86/boot/main.c
+++ b/arch/x86/boot/main.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/main.c
- *
 * Main module for the real-mode kernel code
 */
diff --git a/arch/x86/boot/mca.c b/arch/x86/boot/mca.c
index 68222f2d4b67..911eaae5d696 100644
--- a/arch/x86/boot/mca.c
+++ b/arch/x86/boot/mca.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/mca.c
- *
 * Get the MCA system description table
 */
diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
index e77d89f9e8aa..acad32eb4290 100644
--- a/arch/x86/boot/memory.c
+++ b/arch/x86/boot/memory.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/memory.c
- *
 * Memory detection code
 */
diff --git a/arch/x86/boot/pm.c b/arch/x86/boot/pm.c
index a93cb8bded4d..328956fdb59e 100644
--- a/arch/x86/boot/pm.c
+++ b/arch/x86/boot/pm.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/pm.c
- *
 * Prepare the machine for transition to protected mode.
 */
diff --git a/arch/x86/boot/pmjump.S b/arch/x86/boot/pmjump.S
index f5402d51f7c3..ab049d40a884 100644
--- a/arch/x86/boot/pmjump.S
+++ b/arch/x86/boot/pmjump.S
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/pmjump.S
- *
 * The actual transition into protected mode
 */
diff --git a/arch/x86/boot/printf.c b/arch/x86/boot/printf.c
index 7e7e890699be..c1d00c0274c4 100644
--- a/arch/x86/boot/printf.c
+++ b/arch/x86/boot/printf.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/printf.c
- *
 * Oh, it's a waste of space, but oh-so-yummy for debugging.  This
 * version of printf() does not include 64-bit support.  "Live with
 * it."
diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
index 481a22097781..f94b7a0c2abf 100644
--- a/arch/x86/boot/string.c
+++ b/arch/x86/boot/string.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/string.c
- *
 * Very basic string functions
 */
diff --git a/arch/x86/boot/tty.c b/arch/x86/boot/tty.c
index f3f14bd26371..0be77b39328a 100644
--- a/arch/x86/boot/tty.c
+++ b/arch/x86/boot/tty.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/tty.c
- *
 * Very simple screen I/O
 * XXX: Probably should add very simple serial I/O?
 */
diff --git a/arch/x86/boot/version.c b/arch/x86/boot/version.c
index c61462f7d9a7..2723d9b5ce43 100644
--- a/arch/x86/boot/version.c
+++ b/arch/x86/boot/version.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/version.c
- *
 * Kernel version string
 */
diff --git a/arch/x86/boot/video-bios.c b/arch/x86/boot/video-bios.c
index 39e247e96172..49f26aaaebc8 100644
--- a/arch/x86/boot/video-bios.c
+++ b/arch/x86/boot/video-bios.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/video-bios.c
- *
 * Standard video BIOS modes
 *
 * We have two options for this; silent and scanned.
diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
index 5d5a3f6e8b5c..401ad998ad08 100644
--- a/arch/x86/boot/video-vesa.c
+++ b/arch/x86/boot/video-vesa.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/video-vesa.c
- *
 * VESA text modes
 */
diff --git a/arch/x86/boot/video-vga.c b/arch/x86/boot/video-vga.c
index 330d6589a2ad..40ecb8d7688c 100644
--- a/arch/x86/boot/video-vga.c
+++ b/arch/x86/boot/video-vga.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/video-vga.c
- *
 * Common all-VGA modes
 */
diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
index c1c47ba069ef..83598b23093a 100644
--- a/arch/x86/boot/video.c
+++ b/arch/x86/boot/video.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/video.c
- *
 * Select video mode
 */
diff --git a/arch/x86/boot/video.h b/arch/x86/boot/video.h
index d69347f79e8e..ee63f5d14461 100644
--- a/arch/x86/boot/video.h
+++ b/arch/x86/boot/video.h
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/video.h
- *
 * Header file for the real-mode video probing code
 */
diff --git a/arch/x86/boot/voyager.c b/arch/x86/boot/voyager.c
index 6499e3239b41..433909d61e5c 100644
--- a/arch/x86/boot/voyager.c
+++ b/arch/x86/boot/voyager.c
@@ -9,8 +9,6 @@
 * ----------------------------------------------------------------------- */
 /*
- * arch/i386/boot/voyager.c
- *
 * Get the Voyager config information
 */
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index c3920ea8ac56..90e092d0af0c 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -22,13 +22,14 @@ obj-y			+= setup_$(BITS).o i8259_$(BITS).o setup.o
 obj-$(CONFIG_X86_32)    += sys_i386_32.o i386_ksyms_32.o
 obj-$(CONFIG_X86_64)    += sys_x86_64.o x8664_ksyms_64.o
 obj-$(CONFIG_X86_64)    += syscall_64.o vsyscall_64.o setup64.o
-obj-y                   += pci-dma_$(BITS).o  bootflag.o e820_$(BITS).o
+obj-y                   += bootflag.o e820_$(BITS).o
-obj-y                   += quirks.o i8237.o topology.o kdebugfs.o
+obj-y                   += pci-dma.o quirks.o i8237.o topology.o kdebugfs.o
-obj-y                   += alternative.o i8253.o
+obj-y                   += alternative.o i8253.o pci-nommu.o
-obj-$(CONFIG_X86_64)    += pci-nommu_64.o bugs_64.o
+obj-$(CONFIG_X86_64)    += bugs_64.o
 obj-y                   += tsc_$(BITS).o io_delay.o rtc.o
 obj-$(CONFIG_X86_TRAMPOLINE)    += trampoline.o
+obj-y                           += process.o
 obj-y                           += i387.o
 obj-y                           += ptrace.o
 obj-y                           += ds.o
diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
index c6dc05af8827..c2502eb9aa83 100644
--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -1,6 +1,4 @@
 /*
- * arch/i386/kernel/acpi/cstate.c
- *
 * Copyright (C) 2005 Intel Corporation
 *      Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
 *      - Added _PDC for SMP C-states on Intel CPUs
diff --git a/arch/x86/kernel/acpi/processor.c b/arch/x86/kernel/acpi/processor.c
index 324eb0cab19c..de2d2e4ebad9 100644
--- a/arch/x86/kernel/acpi/processor.c
+++ b/arch/x86/kernel/acpi/processor.c
@@ -1,6 +1,4 @@
 /*
- * arch/i386/kernel/acpi/processor.c
- *
 * Copyright (C) 2005 Intel Corporation
 *      Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
 *      - Added _PDC for platforms with Intel CPUs
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index 14791ec55cfd..199e4e05e5dc 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -289,8 +289,8 @@ static int __init cpufreq_p4_init(void)
        if (c->x86_vendor != X86_VENDOR_INTEL)
                return -ENODEV;
-        if (!test_bit(X86_FEATURE_ACPI, c->x86_capability) ||
+        if (!test_cpu_cap(c, X86_FEATURE_ACPI) ||
-                !test_bit(X86_FEATURE_ACC, c->x86_capability))
+                                !test_cpu_cap(c, X86_FEATURE_ACC))
                return -ENODEV;
        ret = cpufreq_register_driver(&p4clockmod_driver);
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index 9b7e01daa1ca..1f4cc48c14c6 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -1,5 +1,4 @@
 /*
- * linux/arch/i386/kernel/cpu/mcheck/therm_throt.c
 *
 * Thermal throttle event support code (such as syslog messaging and rate
 * limiting) that was factored out from x86_64 (mce_intel.c) and i386 (p4.c).
diff --git a/arch/x86/kernel/e820_32.c b/arch/x86/kernel/e820_32.c
index 0240cd778365..ed733e7cf4e6 100644
--- a/arch/x86/kernel/e820_32.c
+++ b/arch/x86/kernel/e820_32.c
@@ -475,7 +475,7 @@ int __init copy_e820_map(struct e820entry *biosmap, int nr_map)
 /*
 * Find the highest page frame number we have available
 */
-void __init find_max_pfn(void)
+void __init propagate_e820_map(void)
 {
        int i;
@@ -704,7 +704,7 @@ static int __init parse_memmap(char *arg)
                 * size before original memory map is
                 * reset.
                 */
-                find_max_pfn();
+                propagate_e820_map();
                saved_max_pfn = max_pfn;
 #endif
                e820.nr_map = 0;
diff --git a/arch/x86/kernel/e820_64.c b/arch/x86/kernel/e820_64.c
index 7f6c0c85c8f6..cbd42e51cb08 100644
--- a/arch/x86/kernel/e820_64.c
+++ b/arch/x86/kernel/e820_64.c
@@ -96,7 +96,7 @@ void __init early_res_to_bootmem(void)
 }
 /* Check for already reserved areas */
-static inline int
+static inline int __init
 bad_addr(unsigned long *addrp, unsigned long size, unsigned long align)
 {
        int i;
@@ -116,7 +116,7 @@ again:
 }
 /* Check for already reserved areas */
-static inline int
+static inline int __init
 bad_addr_size(unsigned long *addrp, unsigned long *sizep, unsigned long align)
 {
        int i;
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 759e02bec070..77d424cf68b3 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -383,6 +383,7 @@ static void __init runtime_code_page_mkexec(void)
 {
        efi_memory_desc_t *md;
        void *p;
+        u64 addr, npages;
        /* Make EFI runtime service code area executable */
        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
@@ -391,7 +392,10 @@ static void __init runtime_code_page_mkexec(void)
                if (md->type != EFI_RUNTIME_SERVICES_CODE)
                        continue;
-                set_memory_x(md->virt_addr, md->num_pages);
+                addr = md->virt_addr;
+                npages = md->num_pages;
+                memrange_efi_to_native(&addr, &npages);
+                set_memory_x(addr, npages);
        }
 }
@@ -408,7 +412,7 @@ void __init efi_enter_virtual_mode(void)
        efi_memory_desc_t *md;
        efi_status_t status;
        unsigned long size;
-        u64 end, systab;
+        u64 end, systab, addr, npages;
        void *p, *va;
        efi.systab = NULL;
@@ -420,7 +424,7 @@ void __init efi_enter_virtual_mode(void)
                size = md->num_pages << EFI_PAGE_SHIFT;
                end = md->phys_addr + size;
-                if ((end >> PAGE_SHIFT) <= max_pfn_mapped)
+                if (PFN_UP(end) <= max_pfn_mapped)
                        va = __va(md->phys_addr);
                else
                        va = efi_ioremap(md->phys_addr, size);
@@ -433,8 +437,12 @@ void __init efi_enter_virtual_mode(void)
                        continue;
                }
-                if (!(md->attribute & EFI_MEMORY_WB))
+                if (!(md->attribute & EFI_MEMORY_WB)) {
-                        set_memory_uc(md->virt_addr, md->num_pages);
+                        addr = md->virt_addr;
+                        npages = md->num_pages;
+                        memrange_efi_to_native(&addr, &npages);
+                        set_memory_uc(addr, npages);
+                }
                systab = (u64) (unsigned long) efi_phys.systab;
                if (md->phys_addr <= systab && systab < end) {
diff --git a/arch/x86/kernel/efi_64.c b/arch/x86/kernel/efi_64.c
index d143a1e76b30..d0060fdcccac 100644
--- a/arch/x86/kernel/efi_64.c
+++ b/arch/x86/kernel/efi_64.c
@@ -105,14 +105,14 @@ void __init efi_reserve_bootmem(void)
 void __iomem * __init efi_ioremap(unsigned long phys_addr, unsigned long size)
 {
-        static unsigned pages_mapped;
+        static unsigned pages_mapped __initdata;
        unsigned i, pages;
+        unsigned long offset;
-        /* phys_addr and size must be page aligned */
+        pages = PFN_UP(phys_addr + size) - PFN_DOWN(phys_addr);
-        if ((phys_addr & ~PAGE_MASK) || (size & ~PAGE_MASK))
+        offset = phys_addr & ~PAGE_MASK;
-                return NULL;
+        phys_addr &= PAGE_MASK;
-        pages = size >> PAGE_SHIFT;
        if (pages_mapped + pages > MAX_EFI_IO_PAGES)
                return NULL;
@@ -124,5 +124,5 @@ void __iomem * __init efi_ioremap(unsigned long phys_addr, unsigned long size)
        }
        return (void __iomem *)__fix_to_virt(FIX_EFI_IO_MAP_FIRST_PAGE - \
-                                             (pages_mapped - pages));
+                                             (pages_mapped - pages)) + offset;
 }
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 9ba49a26dff8..f0f8934fc303 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -1,5 +1,4 @@
 /*
- *  linux/arch/i386/entry.S
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 */
diff --git a/arch/x86/kernel/genx2apic_uv_x.c b/arch/x86/kernel/genx2apic_uv_x.c
index 5d77c9cd8e15..ebf13908a743 100644
--- a/arch/x86/kernel/genx2apic_uv_x.c
+++ b/arch/x86/kernel/genx2apic_uv_x.c
@@ -61,26 +61,31 @@ int uv_wakeup_secondary(int phys_apicid, unsigned int start_rip)
        val = (1UL << UVH_IPI_INT_SEND_SHFT) |
            (phys_apicid << UVH_IPI_INT_APIC_ID_SHFT) |
            (((long)start_rip << UVH_IPI_INT_VECTOR_SHFT) >> 12) |
-            (6 << UVH_IPI_INT_DELIVERY_MODE_SHFT);
+            APIC_DM_INIT;
+        uv_write_global_mmr64(nasid, UVH_IPI_INT, val);
+        mdelay(10);
+        val = (1UL << UVH_IPI_INT_SEND_SHFT) |
+            (phys_apicid << UVH_IPI_INT_APIC_ID_SHFT) |
+            (((long)start_rip << UVH_IPI_INT_VECTOR_SHFT) >> 12) |
+            APIC_DM_STARTUP;
        uv_write_global_mmr64(nasid, UVH_IPI_INT, val);
        return 0;
 }
 static void uv_send_IPI_one(int cpu, int vector)
 {
-        unsigned long val, apicid;
+        unsigned long val, apicid, lapicid;
        int nasid;
        apicid = per_cpu(x86_cpu_to_apicid, cpu); /* ZZZ - cache node-local ? */
+        lapicid = apicid & 0x3f;                /* ZZZ macro needed */
        nasid = uv_apicid_to_nasid(apicid);
        val =
-            (1UL << UVH_IPI_INT_SEND_SHFT) | (apicid <<
+            (1UL << UVH_IPI_INT_SEND_SHFT) | (lapicid <<
                                              UVH_IPI_INT_APIC_ID_SHFT) |
            (vector << UVH_IPI_INT_VECTOR_SHFT);
        uv_write_global_mmr64(nasid, UVH_IPI_INT, val);
-        printk(KERN_DEBUG
-             "UV: IPI to cpu %d, apicid 0x%lx, vec %d, nasid%d, val 0x%lx\n",
-             cpu, apicid, vector, nasid, val);
 }
 static void uv_send_IPI_mask(cpumask_t mask, int vector)
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index d6d54faa84df..993c76773256 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -146,6 +146,7 @@ void __init x86_64_start_kernel(char * real_mode_data)
        reserve_early(__pa_symbol(&_text), __pa_symbol(&_end), "TEXT DATA BSS");
+#ifdef CONFIG_BLK_DEV_INITRD
        /* Reserve INITRD */
        if (boot_params.hdr.type_of_loader && boot_params.hdr.ramdisk_image) {
                unsigned long ramdisk_image = boot_params.hdr.ramdisk_image;
@@ -153,6 +154,7 @@ void __init x86_64_start_kernel(char * real_mode_data)
                unsigned long ramdisk_end   = ramdisk_image + ramdisk_size;
                reserve_early(ramdisk_image, ramdisk_end, "RAMDISK");
        }
+#endif
        reserve_ebda_region();
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 826988a6e964..90f038af3adc 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -1,5 +1,4 @@
 /*
- *  linux/arch/i386/kernel/head.S -- the 32-bit startup code.
 *
 *  Copyright (C) 1991, 1992  Linus Torvalds
 *
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index 8f8102d967b3..db6839b53195 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -35,17 +35,18 @@
 #endif
 static unsigned int             mxcsr_feature_mask __read_mostly = 0xffffffffu;
+unsigned int xstate_size;
+static struct i387_fxsave_struct fx_scratch __cpuinitdata;
-void mxcsr_feature_mask_init(void)
+void __cpuinit mxcsr_feature_mask_init(void)
 {
        unsigned long mask = 0;
        clts();
        if (cpu_has_fxsr) {
-                memset(&current->thread.i387.fxsave, 0,
+                memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
-                       sizeof(struct i387_fxsave_struct));
+                asm volatile("fxsave %0" : : "m" (fx_scratch));
-                asm volatile("fxsave %0" : : "m" (current->thread.i387.fxsave));
+                mask = fx_scratch.mxcsr_mask;
-                mask = current->thread.i387.fxsave.mxcsr_mask;
                if (mask == 0)
                        mask = 0x0000ffbf;
        }
@@ -53,6 +54,16 @@ void mxcsr_feature_mask_init(void)
        stts();
 }
+void __init init_thread_xstate(void)
+{
+        if (cpu_has_fxsr)
+                xstate_size = sizeof(struct i387_fxsave_struct);
+#ifdef CONFIG_X86_32
+        else
+                xstate_size = sizeof(struct i387_fsave_struct);
+#endif
+}
 #ifdef CONFIG_X86_64
 /*
 * Called at bootup to set up the initial FPU state that is later cloned
@@ -61,10 +72,6 @@ void mxcsr_feature_mask_init(void)
 void __cpuinit fpu_init(void)
 {
        unsigned long oldcr0 = read_cr0();
-        extern void __bad_fxsave_alignment(void);
-        if (offsetof(struct task_struct, thread.i387.fxsave) & 15)
-                __bad_fxsave_alignment();
        set_in_cr4(X86_CR4_OSFXSR);
        set_in_cr4(X86_CR4_OSXMMEXCPT);
@@ -84,32 +91,44 @@ void __cpuinit fpu_init(void)
 * value at reset if we support XMM instructions and then
 * remeber the current task has used the FPU.
 */
-void init_fpu(struct task_struct *tsk)
+int init_fpu(struct task_struct *tsk)
 {
        if (tsk_used_math(tsk)) {
                if (tsk == current)
                        unlazy_fpu(tsk);
-                return;
+                return 0;
+        }
+        /*
+         * Memory allocation at the first usage of the FPU and other state.
+         */
+        if (!tsk->thread.xstate) {
+                tsk->thread.xstate = kmem_cache_alloc(task_xstate_cachep,
+                                                      GFP_KERNEL);
+                if (!tsk->thread.xstate)
+                        return -ENOMEM;
        }
        if (cpu_has_fxsr) {
-                memset(&tsk->thread.i387.fxsave, 0,
+                struct i387_fxsave_struct *fx = &tsk->thread.xstate->fxsave;
-                       sizeof(struct i387_fxsave_struct));
-                tsk->thread.i387.fxsave.cwd = 0x37f;
+                memset(fx, 0, xstate_size);
+                fx->cwd = 0x37f;
                if (cpu_has_xmm)
-                        tsk->thread.i387.fxsave.mxcsr = MXCSR_DEFAULT;
+                        fx->mxcsr = MXCSR_DEFAULT;
        } else {
-                memset(&tsk->thread.i387.fsave, 0,
+                struct i387_fsave_struct *fp = &tsk->thread.xstate->fsave;
-                       sizeof(struct i387_fsave_struct));
+                memset(fp, 0, xstate_size);
-                tsk->thread.i387.fsave.cwd = 0xffff037fu;
+                fp->cwd = 0xffff037fu;
-                tsk->thread.i387.fsave.swd = 0xffff0000u;
+                fp->swd = 0xffff0000u;
-                tsk->thread.i387.fsave.twd = 0xffffffffu;
+                fp->twd = 0xffffffffu;
-                tsk->thread.i387.fsave.fos = 0xffff0000u;
+                fp->fos = 0xffff0000u;
        }
        /*
         * Only the device not available exception or ptrace can call init_fpu.
         */
        set_stopped_child_used_math(tsk);
+        return 0;
 }
 int fpregs_active(struct task_struct *target, const struct user_regset *regset)
@@ -126,13 +145,17 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
                unsigned int pos, unsigned int count,
                void *kbuf, void __user *ubuf)
 {
+        int ret;
        if (!cpu_has_fxsr)
                return -ENODEV;
-        init_fpu(target);
+        ret = init_fpu(target);
+        if (ret)
+                return ret;
        return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
-                                   &target->thread.i387.fxsave, 0, -1);
+                                   &target->thread.xstate->fxsave, 0, -1);
 }
 int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
@@ -144,16 +167,19 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
        if (!cpu_has_fxsr)
                return -ENODEV;
-        init_fpu(target);
+        ret = init_fpu(target);
+        if (ret)
+                return ret;
        set_stopped_child_used_math(target);
        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &target->thread.i387.fxsave, 0, -1);
+                                 &target->thread.xstate->fxsave, 0, -1);
        /*
         * mxcsr reserved bits must be masked to zero for security reasons.
         */
-        target->thread.i387.fxsave.mxcsr &= mxcsr_feature_mask;
+        target->thread.xstate->fxsave.mxcsr &= mxcsr_feature_mask;
        return ret;
 }
@@ -233,7 +259,7 @@ static inline u32 twd_fxsr_to_i387(struct i387_fxsave_struct *fxsave)
 static void
 convert_from_fxsr(struct user_i387_ia32_struct *env, struct task_struct *tsk)
 {
-        struct i387_fxsave_struct *fxsave = &tsk->thread.i387.fxsave;
+        struct i387_fxsave_struct *fxsave = &tsk->thread.xstate->fxsave;
        struct _fpreg *to = (struct _fpreg *) &env->st_space[0];
        struct _fpxreg *from = (struct _fpxreg *) &fxsave->st_space[0];
        int i;
@@ -273,7 +299,7 @@ static void convert_to_fxsr(struct task_struct *tsk,
                            const struct user_i387_ia32_struct *env)
 {
-        struct i387_fxsave_struct *fxsave = &tsk->thread.i387.fxsave;
+        struct i387_fxsave_struct *fxsave = &tsk->thread.xstate->fxsave;
        struct _fpreg *from = (struct _fpreg *) &env->st_space[0];
        struct _fpxreg *to = (struct _fpxreg *) &fxsave->st_space[0];
        int i;
@@ -302,15 +328,19 @@ int fpregs_get(struct task_struct *target, const struct user_regset *regset,
               void *kbuf, void __user *ubuf)
 {
        struct user_i387_ia32_struct env;
+        int ret;
        if (!HAVE_HWFP)
                return fpregs_soft_get(target, regset, pos, count, kbuf, ubuf);
-        init_fpu(target);
+        ret = init_fpu(target);
+        if (ret)
+                return ret;
        if (!cpu_has_fxsr) {
                return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
-                                           &target->thread.i387.fsave, 0, -1);
+                                           &target->thread.xstate->fsave, 0,
+                                           -1);
        }
        if (kbuf && pos == 0 && count == sizeof(env)) {
@@ -333,12 +363,15 @@ int fpregs_set(struct task_struct *target, const struct user_regset *regset,
        if (!HAVE_HWFP)
                return fpregs_soft_set(target, regset, pos, count, kbuf, ubuf);
-        init_fpu(target);
+        ret = init_fpu(target);
+        if (ret)
+                return ret;
        set_stopped_child_used_math(target);
        if (!cpu_has_fxsr) {
                return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                          &target->thread.i387.fsave, 0, -1);
+                                          &target->thread.xstate->fsave, 0, -1);
        }
        if (pos > 0 || count < sizeof(env))
@@ -358,11 +391,11 @@ int fpregs_set(struct task_struct *target, const struct user_regset *regset,
 static inline int save_i387_fsave(struct _fpstate_ia32 __user *buf)
 {
        struct task_struct *tsk = current;
+        struct i387_fsave_struct *fp = &tsk->thread.xstate->fsave;
        unlazy_fpu(tsk);
-        tsk->thread.i387.fsave.status = tsk->thread.i387.fsave.swd;
+        fp->status = fp->swd;
-        if (__copy_to_user(buf, &tsk->thread.i387.fsave,
+        if (__copy_to_user(buf, fp, sizeof(struct i387_fsave_struct)))
-                           sizeof(struct i387_fsave_struct)))
                return -1;
        return 1;
 }
@@ -370,6 +403,7 @@ static inline int save_i387_fsave(struct _fpstate_ia32 __user *buf)
 static int save_i387_fxsave(struct _fpstate_ia32 __user *buf)
 {
        struct task_struct *tsk = current;
+        struct i387_fxsave_struct *fx = &tsk->thread.xstate->fxsave;
        struct user_i387_ia32_struct env;
        int err = 0;
@@ -379,12 +413,12 @@ static int save_i387_fxsave(struct _fpstate_ia32 __user *buf)
        if (__copy_to_user(buf, &env, sizeof(env)))
                return -1;
-        err |= __put_user(tsk->thread.i387.fxsave.swd, &buf->status);
+        err |= __put_user(fx->swd, &buf->status);
        err |= __put_user(X86_FXSR_MAGIC, &buf->magic);
        if (err)
                return -1;
-        if (__copy_to_user(&buf->_fxsr_env[0], &tsk->thread.i387.fxsave,
+        if (__copy_to_user(&buf->_fxsr_env[0], fx,
                           sizeof(struct i387_fxsave_struct)))
                return -1;
        return 1;
@@ -417,7 +451,7 @@ static inline int restore_i387_fsave(struct _fpstate_ia32 __user *buf)
        struct task_struct *tsk = current;
        clear_fpu(tsk);
-        return __copy_from_user(&tsk->thread.i387.fsave, buf,
+        return __copy_from_user(&tsk->thread.xstate->fsave, buf,
                                sizeof(struct i387_fsave_struct));
 }
@@ -428,10 +462,10 @@ static int restore_i387_fxsave(struct _fpstate_ia32 __user *buf)
        int err;
        clear_fpu(tsk);
-        err = __copy_from_user(&tsk->thread.i387.fxsave, &buf->_fxsr_env[0],
+        err = __copy_from_user(&tsk->thread.xstate->fxsave, &buf->_fxsr_env[0],
                               sizeof(struct i387_fxsave_struct));
        /* mxcsr reserved bits must be masked to zero for security reasons */
-        tsk->thread.i387.fxsave.mxcsr &= mxcsr_feature_mask;
+        tsk->thread.xstate->fxsave.mxcsr &= mxcsr_feature_mask;
        if (err || __copy_from_user(&env, buf, sizeof(env)))
                return 1;
        convert_to_fxsr(tsk, &env);
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 24362ecf5f9a..f47f0eb886b8 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -46,11 +46,7 @@
 #include <asm/apicdef.h>
 #include <asm/system.h>
-#ifdef CONFIG_X86_32
+#include <mach_ipi.h>
-# include <mach_ipi.h>
-#else
-# include <asm/mach_apic.h>
-#endif
 /*
 * Put the error code here just in case the user cares:
diff --git a/arch/x86/kernel/nmi_32.c b/arch/x86/kernel/nmi_32.c
index 8421d0ac6f22..11b14bbaa61e 100644
--- a/arch/x86/kernel/nmi_32.c
+++ b/arch/x86/kernel/nmi_32.c
@@ -321,7 +321,8 @@ EXPORT_SYMBOL(touch_nmi_watchdog);
 extern void die_nmi(struct pt_regs *, const char *msg);
-__kprobes int nmi_watchdog_tick(struct pt_regs * regs, unsigned reason)
+notrace __kprobes int
+nmi_watchdog_tick(struct pt_regs *regs, unsigned reason)
 {
        /*
diff --git a/arch/x86/kernel/nmi_64.c b/arch/x86/kernel/nmi_64.c
index 11f9130ac513..5a29ded994fa 100644
--- a/arch/x86/kernel/nmi_64.c
+++ b/arch/x86/kernel/nmi_64.c
@@ -313,7 +313,8 @@ void touch_nmi_watchdog(void)
 }
 EXPORT_SYMBOL(touch_nmi_watchdog);
-int __kprobes nmi_watchdog_tick(struct pt_regs * regs, unsigned reason)
+notrace __kprobes int
+nmi_watchdog_tick(struct pt_regs *regs, unsigned reason)
 {
        int sum;
        int touched = 0;
@@ -384,7 +385,8 @@ int __kprobes nmi_watchdog_tick(struct pt_regs * regs, unsigned reason)
 static unsigned ignore_nmis;
-asmlinkage __kprobes void do_nmi(struct pt_regs * regs, long error_code)
+asmlinkage notrace __kprobes void
+do_nmi(struct pt_regs *regs, long error_code)
 {
        nmi_enter();
        add_pda(__nmi_count,1);
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index 1b5464c2434f..adb91e4b62da 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -470,10 +470,11 @@ error:
        return 0;
 }
-static dma_addr_t calgary_map_single(struct device *dev, void *vaddr,
+static dma_addr_t calgary_map_single(struct device *dev, phys_addr_t paddr,
        size_t size, int direction)
 {
        dma_addr_t dma_handle = bad_dma_address;
+        void *vaddr = phys_to_virt(paddr);
        unsigned long uaddr;
        unsigned int npages;
        struct iommu_table *tbl = find_iommu_table(dev);
diff --git a/arch/x86/kernel/pci-dma_64.c b/arch/x86/kernel/pci-dma.c
index ada5a0604992..388b113a7d88 100644
--- a/arch/x86/kernel/pci-dma_64.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -1,61 +1,370 @@
-/*
+#include <linux/dma-mapping.h>
- * Dynamic DMA mapping support.
- */
-#include <linux/types.h>
-#include <linux/mm.h>
-#include <linux/string.h>
-#include <linux/pci.h>
-#include <linux/module.h>
 #include <linux/dmar.h>
-#include <asm/io.h>
+#include <linux/bootmem.h>
+#include <linux/pci.h>
+#include <asm/proto.h>
+#include <asm/dma.h>
 #include <asm/gart.h>
 #include <asm/calgary.h>
-int iommu_merge __read_mostly = 0;
+int forbid_dac __read_mostly;
+EXPORT_SYMBOL(forbid_dac);
-dma_addr_t bad_dma_address __read_mostly;
-EXPORT_SYMBOL(bad_dma_address);
-/* This tells the BIO block layer to assume merging. Default to off
+const struct dma_mapping_ops *dma_ops;
-   because we cannot guarantee merging later. */
+EXPORT_SYMBOL(dma_ops);
-int iommu_bio_merge __read_mostly = 0;
-EXPORT_SYMBOL(iommu_bio_merge);
-static int iommu_sac_force __read_mostly = 0;
+int iommu_sac_force __read_mostly = 0;
-int no_iommu __read_mostly;
 #ifdef CONFIG_IOMMU_DEBUG
 int panic_on_overflow __read_mostly = 1;
 int force_iommu __read_mostly = 1;
 #else
 int panic_on_overflow __read_mostly = 0;
-int force_iommu __read_mostly= 0;
+int force_iommu __read_mostly = 0;
 #endif
+int iommu_merge __read_mostly = 0;
+int no_iommu __read_mostly;
 /* Set this to 1 if there is a HW IOMMU in the system */
 int iommu_detected __read_mostly = 0;
+/* This tells the BIO block layer to assume merging. Default to off
+   because we cannot guarantee merging later. */
+int iommu_bio_merge __read_mostly = 0;
+EXPORT_SYMBOL(iommu_bio_merge);
+dma_addr_t bad_dma_address __read_mostly = 0;
+EXPORT_SYMBOL(bad_dma_address);
 /* Dummy device used for NULL arguments (normally ISA). Better would
   be probably a smaller DMA mask, but this is bug-to-bug compatible
-   to i386. */
+   to older i386. */
 struct device fallback_dev = {
        .bus_id = "fallback device",
        .coherent_dma_mask = DMA_32BIT_MASK,
        .dma_mask = &fallback_dev.coherent_dma_mask,
 };
+int dma_set_mask(struct device *dev, u64 mask)
+{
+        if (!dev->dma_mask || !dma_supported(dev, mask))
+                return -EIO;
+        *dev->dma_mask = mask;
+        return 0;
+}
+EXPORT_SYMBOL(dma_set_mask);
+#ifdef CONFIG_X86_64
+static __initdata void *dma32_bootmem_ptr;
+static unsigned long dma32_bootmem_size __initdata = (128ULL<<20);
+static int __init parse_dma32_size_opt(char *p)
+{
+        if (!p)
+                return -EINVAL;
+        dma32_bootmem_size = memparse(p, &p);
+        return 0;
+}
+early_param("dma32_size", parse_dma32_size_opt);
+void __init dma32_reserve_bootmem(void)
+{
+        unsigned long size, align;
+        if (end_pfn <= MAX_DMA32_PFN)
+                return;
+        align = 64ULL<<20;
+        size = round_up(dma32_bootmem_size, align);
+        dma32_bootmem_ptr = __alloc_bootmem_nopanic(size, align,
+                                 __pa(MAX_DMA_ADDRESS));
+        if (dma32_bootmem_ptr)
+                dma32_bootmem_size = size;
+        else
+                dma32_bootmem_size = 0;
+}
+static void __init dma32_free_bootmem(void)
+{
+        int node;
+        if (end_pfn <= MAX_DMA32_PFN)
+                return;
+        if (!dma32_bootmem_ptr)
+                return;
+        for_each_online_node(node)
+                free_bootmem_node(NODE_DATA(node), __pa(dma32_bootmem_ptr),
+                                  dma32_bootmem_size);
+        dma32_bootmem_ptr = NULL;
+        dma32_bootmem_size = 0;
+}
+void __init pci_iommu_alloc(void)
+{
+        /* free the range so iommu could get some range less than 4G */
+        dma32_free_bootmem();
+        /*
+         * The order of these functions is important for
+         * fall-back/fail-over reasons
+         */
+#ifdef CONFIG_GART_IOMMU
+        gart_iommu_hole_init();
+#endif
+#ifdef CONFIG_CALGARY_IOMMU
+        detect_calgary();
+#endif
+        detect_intel_iommu();
+#ifdef CONFIG_SWIOTLB
+        pci_swiotlb_init();
+#endif
+}
+#endif
+/*
+ * See <Documentation/x86_64/boot-options.txt> for the iommu kernel parameter
+ * documentation.
+ */
+static __init int iommu_setup(char *p)
+{
+        iommu_merge = 1;
+        if (!p)
+                return -EINVAL;
+        while (*p) {
+                if (!strncmp(p, "off", 3))
+                        no_iommu = 1;
+                /* gart_parse_options has more force support */
+                if (!strncmp(p, "force", 5))
+                        force_iommu = 1;
+                if (!strncmp(p, "noforce", 7)) {
+                        iommu_merge = 0;
+                        force_iommu = 0;
+                }
+                if (!strncmp(p, "biomerge", 8)) {
+                        iommu_bio_merge = 4096;
+                        iommu_merge = 1;
+                        force_iommu = 1;
+                }
+                if (!strncmp(p, "panic", 5))
+                        panic_on_overflow = 1;
+                if (!strncmp(p, "nopanic", 7))
+                        panic_on_overflow = 0;
+                if (!strncmp(p, "merge", 5)) {
+                        iommu_merge = 1;
+                        force_iommu = 1;
+                }
+                if (!strncmp(p, "nomerge", 7))
+                        iommu_merge = 0;
+                if (!strncmp(p, "forcesac", 8))
+                        iommu_sac_force = 1;
+                if (!strncmp(p, "allowdac", 8))
+                        forbid_dac = 0;
+                if (!strncmp(p, "nodac", 5))
+                        forbid_dac = -1;
+                if (!strncmp(p, "usedac", 6)) {
+                        forbid_dac = -1;
+                        return 1;
+                }
+#ifdef CONFIG_SWIOTLB
+                if (!strncmp(p, "soft", 4))
+                        swiotlb = 1;
+#endif
+#ifdef CONFIG_GART_IOMMU
+                gart_parse_options(p);
+#endif
+#ifdef CONFIG_CALGARY_IOMMU
+                if (!strncmp(p, "calgary", 7))
+                        use_calgary = 1;
+#endif /* CONFIG_CALGARY_IOMMU */
+                p += strcspn(p, ",");
+                if (*p == ',')
+                        ++p;
+        }
+        return 0;
+}
+early_param("iommu", iommu_setup);
+#ifdef CONFIG_X86_32
+int dma_declare_coherent_memory(struct device *dev, dma_addr_t bus_addr,
+                                dma_addr_t device_addr, size_t size, int flags)
+{
+        void __iomem *mem_base = NULL;
+        int pages = size >> PAGE_SHIFT;
+        int bitmap_size = BITS_TO_LONGS(pages) * sizeof(long);
+        if ((flags & (DMA_MEMORY_MAP | DMA_MEMORY_IO)) == 0)
+                goto out;
+        if (!size)
+                goto out;
+        if (dev->dma_mem)
+                goto out;
+        /* FIXME: this routine just ignores DMA_MEMORY_INCLUDES_CHILDREN */
+        mem_base = ioremap(bus_addr, size);
+        if (!mem_base)
+                goto out;
+        dev->dma_mem = kzalloc(sizeof(struct dma_coherent_mem), GFP_KERNEL);
+        if (!dev->dma_mem)
+                goto out;
+        dev->dma_mem->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
+        if (!dev->dma_mem->bitmap)
+                goto free1_out;
+        dev->dma_mem->virt_base = mem_base;
+        dev->dma_mem->device_base = device_addr;
+        dev->dma_mem->size = pages;
+        dev->dma_mem->flags = flags;
+        if (flags & DMA_MEMORY_MAP)
+                return DMA_MEMORY_MAP;
+        return DMA_MEMORY_IO;
+ free1_out:
+        kfree(dev->dma_mem);
+ out:
+        if (mem_base)
+                iounmap(mem_base);
+        return 0;
+}
+EXPORT_SYMBOL(dma_declare_coherent_memory);
+void dma_release_declared_memory(struct device *dev)
+{
+        struct dma_coherent_mem *mem = dev->dma_mem;
+        if (!mem)
+                return;
+        dev->dma_mem = NULL;
+        iounmap(mem->virt_base);
+        kfree(mem->bitmap);
+        kfree(mem);
+}
+EXPORT_SYMBOL(dma_release_declared_memory);
+void *dma_mark_declared_memory_occupied(struct device *dev,
+                                        dma_addr_t device_addr, size_t size)
+{
+        struct dma_coherent_mem *mem = dev->dma_mem;
+        int pos, err;
+        int pages = (size + (device_addr & ~PAGE_MASK) + PAGE_SIZE - 1);
+        pages >>= PAGE_SHIFT;
+        if (!mem)
+                return ERR_PTR(-EINVAL);
+        pos = (device_addr - mem->device_base) >> PAGE_SHIFT;
+        err = bitmap_allocate_region(mem->bitmap, pos, get_order(pages));
+        if (err != 0)
+                return ERR_PTR(err);
+        return mem->virt_base + (pos << PAGE_SHIFT);
+}
+EXPORT_SYMBOL(dma_mark_declared_memory_occupied);
+static int dma_alloc_from_coherent_mem(struct device *dev, ssize_t size,
+                                       dma_addr_t *dma_handle, void **ret)
+{
+        struct dma_coherent_mem *mem = dev ? dev->dma_mem : NULL;
+        int order = get_order(size);
+        if (mem) {
+                int page = bitmap_find_free_region(mem->bitmap, mem->size,
+                                                     order);
+                if (page >= 0) {
+                        *dma_handle = mem->device_base + (page << PAGE_SHIFT);
+                        *ret = mem->virt_base + (page << PAGE_SHIFT);
+                        memset(*ret, 0, size);
+                }
+                if (mem->flags & DMA_MEMORY_EXCLUSIVE)
+                        *ret = NULL;
+        }
+        return (mem != NULL);
+}
+static int dma_release_coherent(struct device *dev, int order, void *vaddr)
+{
+        struct dma_coherent_mem *mem = dev ? dev->dma_mem : NULL;
+        if (mem && vaddr >= mem->virt_base && vaddr <
+                   (mem->virt_base + (mem->size << PAGE_SHIFT))) {
+                int page = (vaddr - mem->virt_base) >> PAGE_SHIFT;
+                bitmap_release_region(mem->bitmap, page, order);
+                return 1;
+        }
+        return 0;
+}
+#else
+#define dma_alloc_from_coherent_mem(dev, size, handle, ret) (0)
+#define dma_release_coherent(dev, order, vaddr) (0)
+#endif /* CONFIG_X86_32 */
+int dma_supported(struct device *dev, u64 mask)
+{
+#ifdef CONFIG_PCI
+        if (mask > 0xffffffff && forbid_dac > 0) {
+                printk(KERN_INFO "PCI: Disallowing DAC for device %s\n",
+                                 dev->bus_id);
+                return 0;
+        }
+#endif
+        if (dma_ops->dma_supported)
+                return dma_ops->dma_supported(dev, mask);
+        /* Copied from i386. Doesn't make much sense, because it will
+           only work for pci_alloc_coherent.
+           The caller just has to use GFP_DMA in this case. */
+        if (mask < DMA_24BIT_MASK)
+                return 0;
+        /* Tell the device to use SAC when IOMMU force is on.  This
+           allows the driver to use cheaper accesses in some cases.
+           Problem with this is that if we overflow the IOMMU area and
+           return DAC as fallback address the device may not handle it
+           correctly.
+           As a special case some controllers have a 39bit address
+           mode that is as efficient as 32bit (aic79xx). Don't force
+           SAC for these.  Assume all masks <= 40 bits are of this
+           type. Normally this doesn't make any difference, but gives
+           more gentle handling of IOMMU overflow. */
+        if (iommu_sac_force && (mask >= DMA_40BIT_MASK)) {
+                printk(KERN_INFO "%s: Force SAC with mask %Lx\n",
+                                 dev->bus_id, mask);
+                return 0;
+        }
+        return 1;
+}
+EXPORT_SYMBOL(dma_supported);
 /* Allocate DMA memory on node near device */
-noinline static void *
+noinline struct page *
 dma_alloc_pages(struct device *dev, gfp_t gfp, unsigned order)
 {
-        struct page *page;
        int node;
        node = dev_to_node(dev);
-        page = alloc_pages_node(node, gfp, order);
+        return alloc_pages_node(node, gfp, order);
-        return page ? page_address(page) : NULL;
 }
 /*
@@ -65,9 +374,16 @@ void *
 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
                   gfp_t gfp)
 {
-        void *memory;
+        void *memory = NULL;
+        struct page *page;
        unsigned long dma_mask = 0;
-        u64 bus;
+        dma_addr_t bus;
+        /* ignore region specifiers */
+        gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+        if (dma_alloc_from_coherent_mem(dev, size, dma_handle, &memory))
+                return memory;
        if (!dev)
                dev = &fallback_dev;
@@ -82,26 +398,25 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
        /* Don't invoke OOM killer */
        gfp |= __GFP_NORETRY;
-        /* Kludge to make it bug-to-bug compatible with i386. i386
+#ifdef CONFIG_X86_64
-           uses the normal dma_mask for alloc_coherent. */
-        dma_mask &= *dev->dma_mask;
        /* Why <=? Even when the mask is smaller than 4GB it is often
           larger than 16MB and in this case we have a chance of
           finding fitting memory in the next higher zone first. If
           not retry with true GFP_DMA. -AK */
        if (dma_mask <= DMA_32BIT_MASK)
                gfp |= GFP_DMA32;
+#endif
 again:
-        memory = dma_alloc_pages(dev, gfp, get_order(size));
+        page = dma_alloc_pages(dev, gfp, get_order(size));
-        if (memory == NULL)
+        if (page == NULL)
                return NULL;
        {
                int high, mmu;
-                bus = virt_to_bus(memory);
+                bus = page_to_phys(page);
-                high = (bus + size) >= dma_mask;
+                memory = page_address(page);
+                high = (bus + size) >= dma_mask;
                mmu = high;
                if (force_iommu && !(gfp & GFP_DMA))
                        mmu = 1;
@@ -127,7 +442,7 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
                memset(memory, 0, size);
                if (!mmu) {
-                        *dma_handle = virt_to_bus(memory);
+                        *dma_handle = bus;
                        return memory;
                }
        }
@@ -139,7 +454,7 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
        }
        if (dma_ops->map_simple) {
-                *dma_handle = dma_ops->map_simple(dev, memory,
+                *dma_handle = dma_ops->map_simple(dev, virt_to_phys(memory),
                                              size,
                                              PCI_DMA_BIDIRECTIONAL);
                if (*dma_handle != bad_dma_address)
@@ -147,7 +462,8 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
        }
        if (panic_on_overflow)
-                panic("dma_alloc_coherent: IOMMU overflow by %lu bytes\n",size);
+                panic("dma_alloc_coherent: IOMMU overflow by %lu bytes\n",
+                      (unsigned long)size);
        free_pages((unsigned long)memory, get_order(size));
        return NULL;
 }
@@ -160,153 +476,16 @@ EXPORT_SYMBOL(dma_alloc_coherent);
 void dma_free_coherent(struct device *dev, size_t size,
                         void *vaddr, dma_addr_t bus)
 {
+        int order = get_order(size);
        WARN_ON(irqs_disabled());       /* for portability */
+        if (dma_release_coherent(dev, order, vaddr))
+                return;
        if (dma_ops->unmap_single)
                dma_ops->unmap_single(dev, bus, size, 0);
-        free_pages((unsigned long)vaddr, get_order(size));
+        free_pages((unsigned long)vaddr, order);
 }
 EXPORT_SYMBOL(dma_free_coherent);
-static int forbid_dac __read_mostly;
-int dma_supported(struct device *dev, u64 mask)
-{
-#ifdef CONFIG_PCI
-        if (mask > 0xffffffff && forbid_dac > 0) {
-                printk(KERN_INFO "PCI: Disallowing DAC for device %s\n", dev->bus_id);
-                return 0;
-        }
-#endif
-        if (dma_ops->dma_supported)
-                return dma_ops->dma_supported(dev, mask);
-        /* Copied from i386. Doesn't make much sense, because it will
-           only work for pci_alloc_coherent.
-           The caller just has to use GFP_DMA in this case. */
-        if (mask < DMA_24BIT_MASK)
-                return 0;
-        /* Tell the device to use SAC when IOMMU force is on.  This
-           allows the driver to use cheaper accesses in some cases.
-           Problem with this is that if we overflow the IOMMU area and
-           return DAC as fallback address the device may not handle it
-           correctly.
-           As a special case some controllers have a 39bit address
-           mode that is as efficient as 32bit (aic79xx). Don't force
-           SAC for these.  Assume all masks <= 40 bits are of this
-           type. Normally this doesn't make any difference, but gives
-           more gentle handling of IOMMU overflow. */
-        if (iommu_sac_force && (mask >= DMA_40BIT_MASK)) {
-                printk(KERN_INFO "%s: Force SAC with mask %Lx\n", dev->bus_id,mask);
-                return 0;
-        }
-        return 1;
-}
-EXPORT_SYMBOL(dma_supported);
-int dma_set_mask(struct device *dev, u64 mask)
-{
-        if (!dev->dma_mask || !dma_supported(dev, mask))
-                return -EIO;
-        *dev->dma_mask = mask;
-        return 0;
-}
-EXPORT_SYMBOL(dma_set_mask);
-/*
- * See <Documentation/x86_64/boot-options.txt> for the iommu kernel parameter
- * documentation.
- */
-static __init int iommu_setup(char *p)
-{
-        iommu_merge = 1;
-        if (!p)
-                return -EINVAL;
-        while (*p) {
-                if (!strncmp(p, "off", 3))
-                        no_iommu = 1;
-                /* gart_parse_options has more force support */
-                if (!strncmp(p, "force", 5))
-                        force_iommu = 1;
-                if (!strncmp(p, "noforce", 7)) {
-                        iommu_merge = 0;
-                        force_iommu = 0;
-                }
-                if (!strncmp(p, "biomerge", 8)) {
-                        iommu_bio_merge = 4096;
-                        iommu_merge = 1;
-                        force_iommu = 1;
-                }
-                if (!strncmp(p, "panic", 5))
-                        panic_on_overflow = 1;
-                if (!strncmp(p, "nopanic", 7))
-                        panic_on_overflow = 0;
-                if (!strncmp(p, "merge", 5)) {
-                        iommu_merge = 1;
-                        force_iommu = 1;
-                }
-                if (!strncmp(p, "nomerge", 7))
-                        iommu_merge = 0;
-                if (!strncmp(p, "forcesac", 8))
-                        iommu_sac_force = 1;
-                if (!strncmp(p, "allowdac", 8))
-                        forbid_dac = 0;
-                if (!strncmp(p, "nodac", 5))
-                        forbid_dac = -1;
-#ifdef CONFIG_SWIOTLB
-                if (!strncmp(p, "soft", 4))
-                        swiotlb = 1;
-#endif
-#ifdef CONFIG_GART_IOMMU
-                gart_parse_options(p);
-#endif
-#ifdef CONFIG_CALGARY_IOMMU
-                if (!strncmp(p, "calgary", 7))
-                        use_calgary = 1;
-#endif /* CONFIG_CALGARY_IOMMU */
-                p += strcspn(p, ",");
-                if (*p == ',')
-                        ++p;
-        }
-        return 0;
-}
-early_param("iommu", iommu_setup);
-void __init pci_iommu_alloc(void)
-{
-        /*
-         * The order of these functions is important for
-         * fall-back/fail-over reasons
-         */
-#ifdef CONFIG_GART_IOMMU
-        gart_iommu_hole_init();
-#endif
-#ifdef CONFIG_CALGARY_IOMMU
-        detect_calgary();
-#endif
-        detect_intel_iommu();
-#ifdef CONFIG_SWIOTLB
-        pci_swiotlb_init();
-#endif
-}
 static int __init pci_iommu_init(void)
 {
 #ifdef CONFIG_CALGARY_IOMMU
@@ -327,6 +506,8 @@ void pci_iommu_shutdown(void)
 {
        gart_iommu_shutdown();
 }
+/* Must execute after PCI subsystem */
+fs_initcall(pci_iommu_init);
 #ifdef CONFIG_PCI
 /* Many VIA bridges seem to corrupt data for DAC. Disable it here */
@@ -334,11 +515,10 @@ void pci_iommu_shutdown(void)
 static __devinit void via_no_dac(struct pci_dev *dev)
 {
        if ((dev->class >> 8) == PCI_CLASS_BRIDGE_PCI && forbid_dac == 0) {
-                printk(KERN_INFO "PCI: VIA PCI bridge detected. Disabling DAC.\n");
+                printk(KERN_INFO "PCI: VIA PCI bridge detected."
+                                 "Disabling DAC.\n");
                forbid_dac = 1;
        }
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_ANY_ID, via_no_dac);
 #endif
-/* Must execute after PCI subsystem */
-fs_initcall(pci_iommu_init);
diff --git a/arch/x86/kernel/pci-dma_32.c b/arch/x86/kernel/pci-dma_32.c
deleted file mode 100644
index 51330321a5d3..000000000000
--- a/arch/x86/kernel/pci-dma_32.c
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Dynamic DMA mapping support.
- *
- * On i386 there is no hardware dynamic DMA address translation,
- * so consistent alloc/free are merely page allocation/freeing.
- * The rest of the dynamic DMA mapping interface is implemented
- * in asm/pci.h.
- */
-#include <linux/types.h>
-#include <linux/mm.h>
-#include <linux/string.h>
-#include <linux/pci.h>
-#include <linux/module.h>
-#include <asm/io.h>
-struct dma_coherent_mem {
-        void            *virt_base;
-        u32             device_base;
-        int             size;
-        int             flags;
-        unsigned long   *bitmap;
-};
-void *dma_alloc_coherent(struct device *dev, size_t size,
-                           dma_addr_t *dma_handle, gfp_t gfp)
-{
-        void *ret;
-        struct dma_coherent_mem *mem = dev ? dev->dma_mem : NULL;
-        int order = get_order(size);
-        /* ignore region specifiers */
-        gfp &= ~(__GFP_DMA | __GFP_HIGHMEM);
-        if (mem) {
-                int page = bitmap_find_free_region(mem->bitmap, mem->size,
-                                                     order);
-                if (page >= 0) {
-                        *dma_handle = mem->device_base + (page << PAGE_SHIFT);
-                        ret = mem->virt_base + (page << PAGE_SHIFT);
-                        memset(ret, 0, size);
-                        return ret;
-                }
-                if (mem->flags & DMA_MEMORY_EXCLUSIVE)
-                        return NULL;
-        }
-        if (dev == NULL || (dev->coherent_dma_mask < 0xffffffff))
-                gfp |= GFP_DMA;
-        ret = (void *)__get_free_pages(gfp, order);
-        if (ret != NULL) {
-                memset(ret, 0, size);
-                *dma_handle = virt_to_phys(ret);
-        }
-        return ret;
-}
-EXPORT_SYMBOL(dma_alloc_coherent);
-void dma_free_coherent(struct device *dev, size_t size,
-                         void *vaddr, dma_addr_t dma_handle)
-{
-        struct dma_coherent_mem *mem = dev ? dev->dma_mem : NULL;
-        int order = get_order(size);
-        WARN_ON(irqs_disabled());       /* for portability */
-        if (mem && vaddr >= mem->virt_base && vaddr < (mem->virt_base + (mem->size << PAGE_SHIFT))) {
-                int page = (vaddr - mem->virt_base) >> PAGE_SHIFT;
-                bitmap_release_region(mem->bitmap, page, order);
-        } else
-                free_pages((unsigned long)vaddr, order);
-}
-EXPORT_SYMBOL(dma_free_coherent);
-int dma_declare_coherent_memory(struct device *dev, dma_addr_t bus_addr,
-                                dma_addr_t device_addr, size_t size, int flags)
-{
-        void __iomem *mem_base = NULL;
-        int pages = size >> PAGE_SHIFT;
-        int bitmap_size = BITS_TO_LONGS(pages) * sizeof(long);
-        if ((flags & (DMA_MEMORY_MAP | DMA_MEMORY_IO)) == 0)
-                goto out;
-        if (!size)
-                goto out;
-        if (dev->dma_mem)
-                goto out;
-        /* FIXME: this routine just ignores DMA_MEMORY_INCLUDES_CHILDREN */
-        mem_base = ioremap(bus_addr, size);
-        if (!mem_base)
-                goto out;
-        dev->dma_mem = kzalloc(sizeof(struct dma_coherent_mem), GFP_KERNEL);
-        if (!dev->dma_mem)
-                goto out;
-        dev->dma_mem->bitmap = kzalloc(bitmap_size, GFP_KERNEL);
-        if (!dev->dma_mem->bitmap)
-                goto free1_out;
-        dev->dma_mem->virt_base = mem_base;
-        dev->dma_mem->device_base = device_addr;
-        dev->dma_mem->size = pages;
-        dev->dma_mem->flags = flags;
-        if (flags & DMA_MEMORY_MAP)
-                return DMA_MEMORY_MAP;
-        return DMA_MEMORY_IO;
- free1_out:
-        kfree(dev->dma_mem);
- out:
-        if (mem_base)
-                iounmap(mem_base);
-        return 0;
-}
-EXPORT_SYMBOL(dma_declare_coherent_memory);
-void dma_release_declared_memory(struct device *dev)
-{
-        struct dma_coherent_mem *mem = dev->dma_mem;
-        
-        if(!mem)
-                return;
-        dev->dma_mem = NULL;
-        iounmap(mem->virt_base);
-        kfree(mem->bitmap);
-        kfree(mem);
-}
-EXPORT_SYMBOL(dma_release_declared_memory);
-void *dma_mark_declared_memory_occupied(struct device *dev,
-                                        dma_addr_t device_addr, size_t size)
-{
-        struct dma_coherent_mem *mem = dev->dma_mem;
-        int pages = (size + (device_addr & ~PAGE_MASK) + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        int pos, err;
-        if (!mem)
-                return ERR_PTR(-EINVAL);
-        pos = (device_addr - mem->device_base) >> PAGE_SHIFT;
-        err = bitmap_allocate_region(mem->bitmap, pos, get_order(pages));
-        if (err != 0)
-                return ERR_PTR(err);
-        return mem->virt_base + (pos << PAGE_SHIFT);
-}
-EXPORT_SYMBOL(dma_mark_declared_memory_occupied);
-#ifdef CONFIG_PCI
-/* Many VIA bridges seem to corrupt data for DAC. Disable it here */
-int forbid_dac;
-EXPORT_SYMBOL(forbid_dac);
-static __devinit void via_no_dac(struct pci_dev *dev)
-{
-        if ((dev->class >> 8) == PCI_CLASS_BRIDGE_PCI && forbid_dac == 0) {
-                printk(KERN_INFO "PCI: VIA PCI bridge detected. Disabling DAC.\n");
-                forbid_dac = 1;
-        }
-}
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_ANY_ID, via_no_dac);
-static int check_iommu(char *s)
-{
-        if (!strcmp(s, "usedac")) {
-                forbid_dac = -1;
-                return 1;
-        }
-        return 0;
-}
-__setup("iommu=", check_iommu);
-#endif
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index 700e4647dd30..c07455d1695f 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -264,9 +264,9 @@ static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
 }
 static dma_addr_t
-gart_map_simple(struct device *dev, char *buf, size_t size, int dir)
+gart_map_simple(struct device *dev, phys_addr_t paddr, size_t size, int dir)
 {
-        dma_addr_t map = dma_map_area(dev, virt_to_bus(buf), size, dir);
+        dma_addr_t map = dma_map_area(dev, paddr, size, dir);
        flush_gart();
@@ -275,18 +275,17 @@ gart_map_simple(struct device *dev, char *buf, size_t size, int dir)
 /* Map a single area into the IOMMU */
 static dma_addr_t
-gart_map_single(struct device *dev, void *addr, size_t size, int dir)
+gart_map_single(struct device *dev, phys_addr_t paddr, size_t size, int dir)
 {
-        unsigned long phys_mem, bus;
+        unsigned long bus;
        if (!dev)
                dev = &fallback_dev;
-        phys_mem = virt_to_phys(addr);
+        if (!need_iommu(dev, paddr, size))
-        if (!need_iommu(dev, phys_mem, size))
+                return paddr;
-                return phys_mem;
-        bus = gart_map_simple(dev, addr, size, dir);
+        bus = gart_map_simple(dev, paddr, size, dir);
        return bus;
 }
diff --git a/arch/x86/kernel/pci-nommu_64.c b/arch/x86/kernel/pci-nommu.c
index ab08e1832228..aec43d56f49c 100644
--- a/arch/x86/kernel/pci-nommu_64.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -14,7 +14,7 @@
 static int
 check_addr(char *name, struct device *hwdev, dma_addr_t bus, size_t size)
 {
-        if (hwdev && bus + size > *hwdev->dma_mask) {
+        if (hwdev && bus + size > *hwdev->dma_mask) {
                if (*hwdev->dma_mask >= DMA_32BIT_MASK)
                        printk(KERN_ERR
                            "nommu_%s: overflow %Lx+%zu of device mask %Lx\n",
@@ -26,19 +26,17 @@ check_addr(char *name, struct device *hwdev, dma_addr_t bus, size_t size)
 }
 static dma_addr_t
-nommu_map_single(struct device *hwdev, void *ptr, size_t size,
+nommu_map_single(struct device *hwdev, phys_addr_t paddr, size_t size,
               int direction)
 {
-        dma_addr_t bus = virt_to_bus(ptr);
+        dma_addr_t bus = paddr;
+        WARN_ON(size == 0);
        if (!check_addr("map_single", hwdev, bus, size))
                                return bad_dma_address;
+        flush_write_buffers();
        return bus;
 }
-static void nommu_unmap_single(struct device *dev, dma_addr_t addr,size_t size,
-                        int direction)
-{
-}
 /* Map a set of buffers described by scatterlist in streaming
 * mode for DMA.  This is the scatter-gather version of the
@@ -61,30 +59,34 @@ static int nommu_map_sg(struct device *hwdev, struct scatterlist *sg,
        struct scatterlist *s;
        int i;
+        WARN_ON(nents == 0 || sg[0].length == 0);
        for_each_sg(sg, s, nents, i) {
                BUG_ON(!sg_page(s));
-                s->dma_address = virt_to_bus(sg_virt(s));
+                s->dma_address = sg_phys(s);
                if (!check_addr("map_sg", hwdev, s->dma_address, s->length))
                        return 0;
                s->dma_length = s->length;
        }
+        flush_write_buffers();
        return nents;
 }
-/* Unmap a set of streaming mode DMA translations.
+/* Make sure we keep the same behaviour */
- * Again, cpu read rules concerning calls here are the same as for
+static int nommu_mapping_error(dma_addr_t dma_addr)
- * pci_unmap_single() above.
- */
-static void nommu_unmap_sg(struct device *dev, struct scatterlist *sg,
-                  int nents, int dir)
 {
+#ifdef CONFIG_X86_32
+        return 0;
+#else
+        return (dma_addr == bad_dma_address);
+#endif
 }
 const struct dma_mapping_ops nommu_dma_ops = {
        .map_single = nommu_map_single,
-        .unmap_single = nommu_unmap_single,
        .map_sg = nommu_map_sg,
-        .unmap_sg = nommu_unmap_sg,
+        .mapping_error = nommu_mapping_error,
        .is_phys = 1,
 };
diff --git a/arch/x86/kernel/pci-swiotlb_64.c b/arch/x86/kernel/pci-swiotlb_64.c
index 82a0a674a003..490da7f4b8d0 100644
--- a/arch/x86/kernel/pci-swiotlb_64.c
+++ b/arch/x86/kernel/pci-swiotlb_64.c
@@ -11,11 +11,18 @@
 int swiotlb __read_mostly;
+static dma_addr_t
+swiotlb_map_single_phys(struct device *hwdev, phys_addr_t paddr, size_t size,
+                        int direction)
+{
+        return swiotlb_map_single(hwdev, phys_to_virt(paddr), size, direction);
+}
 const struct dma_mapping_ops swiotlb_dma_ops = {
        .mapping_error = swiotlb_dma_mapping_error,
        .alloc_coherent = swiotlb_alloc_coherent,
        .free_coherent = swiotlb_free_coherent,
-        .map_single = swiotlb_map_single,
+        .map_single = swiotlb_map_single_phys,
        .unmap_single = swiotlb_unmap_single,
        .sync_single_for_cpu = swiotlb_sync_single_for_cpu,
        .sync_single_for_device = swiotlb_sync_single_for_device,
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
new file mode 100644
index 000000000000..3004d716539d
--- /dev/null
+++ b/arch/x86/kernel/process.c
@@ -0,0 +1,44 @@
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+struct kmem_cache *task_xstate_cachep;
+int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+{
+        *dst = *src;
+        if (src->thread.xstate) {
+                dst->thread.xstate = kmem_cache_alloc(task_xstate_cachep,
+                                                      GFP_KERNEL);
+                if (!dst->thread.xstate)
+                        return -ENOMEM;
+                WARN_ON((unsigned long)dst->thread.xstate & 15);
+                memcpy(dst->thread.xstate, src->thread.xstate, xstate_size);
+        }
+        return 0;
+}
+void free_thread_xstate(struct task_struct *tsk)
+{
+        if (tsk->thread.xstate) {
+                kmem_cache_free(task_xstate_cachep, tsk->thread.xstate);
+                tsk->thread.xstate = NULL;
+        }
+}
+void free_thread_info(struct thread_info *ti)
+{
+        free_thread_xstate(ti->task);
+        free_pages((unsigned long)ti, get_order(THREAD_SIZE));
+}
+void arch_task_cache_init(void)
+{
+        task_xstate_cachep =
+                kmem_cache_create("task_xstate", xstate_size,
+                                  __alignof__(union thread_xstate),
+                                  SLAB_PANIC, NULL);
+}
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 3903a8f2eb97..7adad088e373 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -36,6 +36,7 @@
 #include <linux/personality.h>
 #include <linux/tick.h>
 #include <linux/percpu.h>
+#include <linux/prctl.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -45,7 +46,6 @@
 #include <asm/processor.h>
 #include <asm/i387.h>
 #include <asm/desc.h>
-#include <asm/vm86.h>
 #ifdef CONFIG_MATH_EMULATION
 #include <asm/math_emu.h>
 #endif
@@ -521,14 +521,18 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
        regs->cs                = __USER_CS;
        regs->ip                = new_ip;
        regs->sp                = new_sp;
+        /*
+         * Free the old FP and other extended state
+         */
+        free_thread_xstate(current);
 }
 EXPORT_SYMBOL_GPL(start_thread);
-#ifdef CONFIG_SECCOMP
 static void hard_disable_TSC(void)
 {
        write_cr4(read_cr4() | X86_CR4_TSD);
 }
 void disable_TSC(void)
 {
        preempt_disable();
@@ -540,11 +544,47 @@ void disable_TSC(void)
                hard_disable_TSC();
        preempt_enable();
 }
 static void hard_enable_TSC(void)
 {
        write_cr4(read_cr4() & ~X86_CR4_TSD);
 }
-#endif /* CONFIG_SECCOMP */
+void enable_TSC(void)
+{
+        preempt_disable();
+        if (test_and_clear_thread_flag(TIF_NOTSC))
+                /*
+                 * Must flip the CPU state synchronously with
+                 * TIF_NOTSC in the current running context.
+                 */
+                hard_enable_TSC();
+        preempt_enable();
+}
+int get_tsc_mode(unsigned long adr)
+{
+        unsigned int val;
+        if (test_thread_flag(TIF_NOTSC))
+                val = PR_TSC_SIGSEGV;
+        else
+                val = PR_TSC_ENABLE;
+        return put_user(val, (unsigned int __user *)adr);
+}
+int set_tsc_mode(unsigned int val)
+{
+        if (val == PR_TSC_SIGSEGV)
+                disable_TSC();
+        else if (val == PR_TSC_ENABLE)
+                enable_TSC();
+        else
+                return -EINVAL;
+        return 0;
+}
 static noinline void
 __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
@@ -578,7 +618,6 @@ __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
                set_debugreg(next->debugreg7, 7);
        }
-#ifdef CONFIG_SECCOMP
        if (test_tsk_thread_flag(prev_p, TIF_NOTSC) ^
            test_tsk_thread_flag(next_p, TIF_NOTSC)) {
                /* prev and next are different */
@@ -587,7 +626,6 @@ __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
                else
                        hard_enable_TSC();
        }
-#endif
 #ifdef X86_BTS
        if (test_tsk_thread_flag(prev_p, TIF_BTS_TRACE_TS))
@@ -669,7 +707,7 @@ struct task_struct * __switch_to(struct task_struct *prev_p, struct task_struct
        /* we're going to use this soon, after a few expensive things */
        if (next_p->fpu_counter > 5)
-                prefetch(&next->i387.fxsave);
+                prefetch(next->xstate);
        /*
         * Reload esp0.
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index e75ccc8a2b87..891af1a1b48a 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -36,6 +36,7 @@
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 #include <linux/tick.h>
+#include <linux/prctl.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -532,9 +533,71 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
        regs->ss                = __USER_DS;
        regs->flags             = 0x200;
        set_fs(USER_DS);
+        /*
+         * Free the old FP and other extended state
+         */
+        free_thread_xstate(current);
 }
 EXPORT_SYMBOL_GPL(start_thread);
+static void hard_disable_TSC(void)
+{
+        write_cr4(read_cr4() | X86_CR4_TSD);
+}
+void disable_TSC(void)
+{
+        preempt_disable();
+        if (!test_and_set_thread_flag(TIF_NOTSC))
+                /*
+                 * Must flip the CPU state synchronously with
+                 * TIF_NOTSC in the current running context.
+                 */
+                hard_disable_TSC();
+        preempt_enable();
+}
+static void hard_enable_TSC(void)
+{
+        write_cr4(read_cr4() & ~X86_CR4_TSD);
+}
+void enable_TSC(void)
+{
+        preempt_disable();
+        if (test_and_clear_thread_flag(TIF_NOTSC))
+                /*
+                 * Must flip the CPU state synchronously with
+                 * TIF_NOTSC in the current running context.
+                 */
+                hard_enable_TSC();
+        preempt_enable();
+}
+int get_tsc_mode(unsigned long adr)
+{
+        unsigned int val;
+        if (test_thread_flag(TIF_NOTSC))
+                val = PR_TSC_SIGSEGV;
+        else
+                val = PR_TSC_ENABLE;
+        return put_user(val, (unsigned int __user *)adr);
+}
+int set_tsc_mode(unsigned int val)
+{
+        if (val == PR_TSC_SIGSEGV)
+                disable_TSC();
+        else if (val == PR_TSC_ENABLE)
+                enable_TSC();
+        else
+                return -EINVAL;
+        return 0;
+}
 /*
 * This special macro can be used to load a debugging register
 */
@@ -572,6 +635,15 @@ static inline void __switch_to_xtra(struct task_struct *prev_p,
                loaddebug(next, 7);
        }
+        if (test_tsk_thread_flag(prev_p, TIF_NOTSC) ^
+            test_tsk_thread_flag(next_p, TIF_NOTSC)) {
+                /* prev and next are different */
+                if (test_tsk_thread_flag(next_p, TIF_NOTSC))
+                        hard_disable_TSC();
+                else
+                        hard_enable_TSC();
+        }
        if (test_tsk_thread_flag(next_p, TIF_IO_BITMAP)) {
                /*
                 * Copy the relevant range of the IO bitmap.
@@ -614,7 +686,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        /* we're going to use this soon, after a few expensive things */
        if (next_p->fpu_counter>5)
-                prefetch(&next->i387.fxsave);
+                prefetch(next->xstate);
        /*
         * Reload esp0, LDT and the page table pointer:
diff --git a/arch/x86/kernel/setup64.c b/arch/x86/kernel/setup64.c
index 9042fb0e36f5..aee0e8200777 100644
--- a/arch/x86/kernel/setup64.c
+++ b/arch/x86/kernel/setup64.c
@@ -74,8 +74,8 @@ int force_personality32 = 0;
 Control non executable heap for 32bit processes.
 To control the stack too use noexec=off
-on      PROT_READ does not imply PROT_EXEC for 32bit processes
+on      PROT_READ does not imply PROT_EXEC for 32bit processes (default)
-off     PROT_READ implies PROT_EXEC (default)
+off     PROT_READ implies PROT_EXEC
 */
 static int __init nonx32_setup(char *str)
 {
diff --git a/arch/x86/kernel/setup_32.c b/arch/x86/kernel/setup_32.c
index 5b0bffb7fcc9..1c4799e68718 100644
--- a/arch/x86/kernel/setup_32.c
+++ b/arch/x86/kernel/setup_32.c
@@ -812,10 +812,10 @@ void __init setup_arch(char **cmdline_p)
                efi_init();
        /* update e820 for memory not covered by WB MTRRs */
-        find_max_pfn();
+        propagate_e820_map();
        mtrr_bp_init();
        if (mtrr_trim_uncached_memory(max_pfn))
-                find_max_pfn();
+                propagate_e820_map();
        max_low_pfn = setup_memory();
diff --git a/arch/x86/kernel/setup_64.c b/arch/x86/kernel/setup_64.c
index 674ef3510cdf..6b8e11f0c15d 100644
--- a/arch/x86/kernel/setup_64.c
+++ b/arch/x86/kernel/setup_64.c
@@ -398,6 +398,8 @@ void __init setup_arch(char **cmdline_p)
        early_res_to_bootmem();
+        dma32_reserve_bootmem();
 #ifdef CONFIG_ACPI_SLEEP
        /*
         * Reserve low memory region for sleep support.
@@ -420,11 +422,14 @@ void __init setup_arch(char **cmdline_p)
                unsigned long end_of_mem    = end_pfn << PAGE_SHIFT;
                if (ramdisk_end <= end_of_mem) {
-                        reserve_bootmem_generic(ramdisk_image, ramdisk_size);
+                        /*
+                         * don't need to reserve again, already reserved early
+                         * in x86_64_start_kernel, and early_res_to_bootmem
+                         * convert that to reserved in bootmem
+                         */
                        initrd_start = ramdisk_image + PAGE_OFFSET;
                        initrd_end = initrd_start+ramdisk_size;
                } else {
-                        /* Assumes everything on node 0 */
                        free_bootmem(ramdisk_image, ramdisk_size);
                        printk(KERN_ERR "initrd extends beyond end of memory "
                               "(0x%08lx > 0x%08lx)\ndisabling initrd\n",
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index e6abe8a49b1f..6a925394bc7e 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -61,6 +61,7 @@
 #include <asm/mtrr.h>
 #include <asm/nmi.h>
 #include <asm/vmi.h>
+#include <asm/genapic.h>
 #include <linux/mc146818rtc.h>
 #include <mach_apic.h>
@@ -677,6 +678,12 @@ wakeup_secondary_cpu(int phys_apicid, unsigned long start_eip)
        unsigned long send_status, accept_status = 0;
        int maxlvt, num_starts, j;
+        if (get_uv_system_type() == UV_NON_UNIQUE_APIC) {
+                send_status = uv_wakeup_secondary(phys_apicid, start_eip);
+                atomic_set(&init_deasserted, 1);
+                return send_status;
+        }
        /*
         * Be paranoid about clearing APIC errors.
         */
@@ -918,16 +925,19 @@ do_rest:
        atomic_set(&init_deasserted, 0);
-        Dprintk("Setting warm reset code and vector.\n");
+        if (get_uv_system_type() != UV_NON_UNIQUE_APIC) {
-        store_NMI_vector(&nmi_high, &nmi_low);
+                Dprintk("Setting warm reset code and vector.\n");
-        smpboot_setup_warm_reset_vector(start_ip);
+                store_NMI_vector(&nmi_high, &nmi_low);
-        /*
-         * Be paranoid about clearing APIC errors.
+                smpboot_setup_warm_reset_vector(start_ip);
-         */
+                /*
-        apic_write(APIC_ESR, 0);
+                 * Be paranoid about clearing APIC errors.
-        apic_read(APIC_ESR);
+                */
+                apic_write(APIC_ESR, 0);
+                apic_read(APIC_ESR);
+        }
        /*
         * Starting actual IPI sequence...
@@ -966,7 +976,8 @@ do_rest:
                        else
                                /* trampoline code not run */
                                printk(KERN_ERR "Not responding.\n");
-                        inquire_remote_apic(apicid);
+                        if (get_uv_system_type() != UV_NON_UNIQUE_APIC)
+                                inquire_remote_apic(apicid);
                }
        }
diff --git a/arch/x86/kernel/traps_32.c b/arch/x86/kernel/traps_32.c
index 65791ca2824a..471e694d6713 100644
--- a/arch/x86/kernel/traps_32.c
+++ b/arch/x86/kernel/traps_32.c
@@ -681,7 +681,7 @@ gp_in_kernel:
        }
 }
-static __kprobes void
+static notrace __kprobes void
 mem_parity_error(unsigned char reason, struct pt_regs *regs)
 {
        printk(KERN_EMERG
@@ -707,7 +707,7 @@ mem_parity_error(unsigned char reason, struct pt_regs *regs)
        clear_mem_error(reason);
 }
-static __kprobes void
+static notrace __kprobes void
 io_check_error(unsigned char reason, struct pt_regs *regs)
 {
        unsigned long i;
@@ -727,7 +727,7 @@ io_check_error(unsigned char reason, struct pt_regs *regs)
        outb(reason, 0x61);
 }
-static __kprobes void
+static notrace __kprobes void
 unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
 {
        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) == NOTIFY_STOP)
@@ -755,7 +755,7 @@ unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
 static DEFINE_SPINLOCK(nmi_print_lock);
-void __kprobes die_nmi(struct pt_regs *regs, const char *msg)
+void notrace __kprobes die_nmi(struct pt_regs *regs, const char *msg)
 {
        if (notify_die(DIE_NMIWATCHDOG, msg, regs, 0, 2, SIGINT) == NOTIFY_STOP)
                return;
@@ -786,7 +786,7 @@ void __kprobes die_nmi(struct pt_regs *regs, const char *msg)
        do_exit(SIGSEGV);
 }
-static __kprobes void default_do_nmi(struct pt_regs *regs)
+static notrace __kprobes void default_do_nmi(struct pt_regs *regs)
 {
        unsigned char reason = 0;
@@ -828,7 +828,7 @@ static __kprobes void default_do_nmi(struct pt_regs *regs)
 static int ignore_nmis;
-__kprobes void do_nmi(struct pt_regs *regs, long error_code)
+notrace __kprobes void do_nmi(struct pt_regs *regs, long error_code)
 {
        int cpu;
@@ -1148,9 +1148,22 @@ asmlinkage void math_state_restore(void)
        struct thread_info *thread = current_thread_info();
        struct task_struct *tsk = thread->task;
+        if (!tsk_used_math(tsk)) {
+                local_irq_enable();
+                /*
+                 * does a slab alloc which can sleep
+                 */
+                if (init_fpu(tsk)) {
+                        /*
+                         * ran out of memory!
+                         */
+                        do_group_exit(SIGKILL);
+                        return;
+                }
+                local_irq_disable();
+        }
        clts();                         /* Allow maths ops (or we recurse) */
-        if (!tsk_used_math(tsk))
-                init_fpu(tsk);
        restore_fpu(tsk);
        thread->status |= TS_USEDFPU;   /* So we fnsave on switch_to() */
        tsk->fpu_counter++;
@@ -1208,11 +1221,6 @@ void __init trap_init(void)
 #endif
        set_trap_gate(19, &simd_coprocessor_error);
-        /*
-         * Verify that the FXSAVE/FXRSTOR data will be 16-byte aligned.
-         * Generate a build-time error if the alignment is wrong.
-         */
-        BUILD_BUG_ON(offsetof(struct task_struct, thread.i387.fxsave) & 15);
        if (cpu_has_fxsr) {
                printk(KERN_INFO "Enabling fast FPU save and restore... ");
                set_in_cr4(X86_CR4_OSFXSR);
@@ -1233,6 +1241,7 @@ void __init trap_init(void)
        set_bit(SYSCALL_VECTOR, used_vectors);
+        init_thread_xstate();
        /*
         * Should be a barrier for any external CPU state:
         */
diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
index 79aa6fc0815c..adff76ea97c4 100644
--- a/arch/x86/kernel/traps_64.c
+++ b/arch/x86/kernel/traps_64.c
@@ -600,7 +600,8 @@ void die(const char * str, struct pt_regs * regs, long err)
        oops_end(flags, regs, SIGSEGV);
 }
-void __kprobes die_nmi(char *str, struct pt_regs *regs, int do_panic)
+notrace __kprobes void
+die_nmi(char *str, struct pt_regs *regs, int do_panic)
 {
        unsigned long flags;
@@ -772,7 +773,7 @@ asmlinkage void __kprobes do_general_protection(struct pt_regs * regs,
        die("general protection fault", regs, error_code);
 }
-static __kprobes void
+static notrace __kprobes void
 mem_parity_error(unsigned char reason, struct pt_regs * regs)
 {
        printk(KERN_EMERG "Uhhuh. NMI received for unknown reason %02x.\n",
@@ -796,7 +797,7 @@ mem_parity_error(unsigned char reason, struct pt_regs * regs)
        outb(reason, 0x61);
 }
-static __kprobes void
+static notrace __kprobes void
 io_check_error(unsigned char reason, struct pt_regs * regs)
 {
        printk("NMI: IOCK error (debug interrupt?)\n");
@@ -810,7 +811,7 @@ io_check_error(unsigned char reason, struct pt_regs * regs)
        outb(reason, 0x61);
 }
-static __kprobes void
+static notrace __kprobes void
 unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
 {
        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) == NOTIFY_STOP)
@@ -827,7 +828,7 @@ unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
 /* Runs on IST stack. This code must keep interrupts off all the time.
   Nested NMIs are prevented by the CPU. */
-asmlinkage __kprobes void default_do_nmi(struct pt_regs *regs)
+asmlinkage notrace  __kprobes void default_do_nmi(struct pt_regs *regs)
 {
        unsigned char reason = 0;
        int cpu;
@@ -1123,11 +1124,24 @@ asmlinkage void __attribute__((weak)) mce_threshold_interrupt(void)
 asmlinkage void math_state_restore(void)
 {
        struct task_struct *me = current;
-        clts();                 /* Allow maths ops (or we recurse) */
-        if (!used_math())
+        if (!used_math()) {
-                init_fpu(me);
+                local_irq_enable();
-        restore_fpu_checking(&me->thread.i387.fxsave);
+                /*
+                 * does a slab alloc which can sleep
+                 */
+                if (init_fpu(me)) {
+                        /*
+                         * ran out of memory!
+                         */
+                        do_group_exit(SIGKILL);
+                        return;
+                }
+                local_irq_disable();
+        }
+        clts();                 /* Allow maths ops (or we recurse) */
+        restore_fpu_checking(&me->thread.xstate->fxsave);
        task_thread_info(me)->status |= TS_USEDFPU;
        me->fpu_counter++;
 }
@@ -1163,6 +1177,10 @@ void __init trap_init(void)
 #endif
       
        /*
+         * initialize the per thread extended state:
+         */
+        init_thread_xstate();
+        /*
         * Should be a barrier for any external CPU state.
         */
        cpu_init();
diff --git a/arch/x86/kernel/tsc_32.c b/arch/x86/kernel/tsc_32.c
index 3d7e6e9fa6c2..e4790728b224 100644
--- a/arch/x86/kernel/tsc_32.c
+++ b/arch/x86/kernel/tsc_32.c
@@ -221,9 +221,9 @@ EXPORT_SYMBOL(recalibrate_cpu_khz);
 * if the CPU frequency is scaled, TSC-based delays will need a different
 * loops_per_jiffy value to function properly.
 */
-static unsigned int ref_freq = 0;
+static unsigned int ref_freq;
-static unsigned long loops_per_jiffy_ref = 0;
+static unsigned long loops_per_jiffy_ref;
-static unsigned long cpu_khz_ref = 0;
+static unsigned long cpu_khz_ref;
 static int
 time_cpufreq_notifier(struct notifier_block *nb, unsigned long val, void *data)
@@ -283,15 +283,28 @@ core_initcall(cpufreq_tsc);
 /* clock source code */
-static unsigned long current_tsc_khz = 0;
+static unsigned long current_tsc_khz;
+static struct clocksource clocksource_tsc;
+/*
+ * We compare the TSC to the cycle_last value in the clocksource
+ * structure to avoid a nasty time-warp issue. This can be observed in
+ * a very small window right after one CPU updated cycle_last under
+ * xtime lock and the other CPU reads a TSC value which is smaller
+ * than the cycle_last reference value due to a TSC which is slighty
+ * behind. This delta is nowhere else observable, but in that case it
+ * results in a forward time jump in the range of hours due to the
+ * unsigned delta calculation of the time keeping core code, which is
+ * necessary to support wrapping clocksources like pm timer.
+ */
 static cycle_t read_tsc(void)
 {
        cycle_t ret;
        rdtscll(ret);
-        return ret;
+        return ret >= clocksource_tsc.cycle_last ?
+                ret : clocksource_tsc.cycle_last;
 }
 static struct clocksource clocksource_tsc = {
diff --git a/arch/x86/kernel/tsc_64.c b/arch/x86/kernel/tsc_64.c
index ceeba01e7f47..fcc16e58609e 100644
--- a/arch/x86/kernel/tsc_64.c
+++ b/arch/x86/kernel/tsc_64.c
@@ -11,6 +11,7 @@
 #include <asm/hpet.h>
 #include <asm/timex.h>
 #include <asm/timer.h>
+#include <asm/vgtod.h>
 static int notsc __initdata = 0;
@@ -287,18 +288,34 @@ int __init notsc_setup(char *s)
 __setup("notsc", notsc_setup);
+static struct clocksource clocksource_tsc;
-/* clock source code: */
+/*
+ * We compare the TSC to the cycle_last value in the clocksource
+ * structure to avoid a nasty time-warp. This can be observed in a
+ * very small window right after one CPU updated cycle_last under
+ * xtime/vsyscall_gtod lock and the other CPU reads a TSC value which
+ * is smaller than the cycle_last reference value due to a TSC which
+ * is slighty behind. This delta is nowhere else observable, but in
+ * that case it results in a forward time jump in the range of hours
+ * due to the unsigned delta calculation of the time keeping core
+ * code, which is necessary to support wrapping clocksources like pm
+ * timer.
+ */
 static cycle_t read_tsc(void)
 {
        cycle_t ret = (cycle_t)get_cycles();
-        return ret;
+        return ret >= clocksource_tsc.cycle_last ?
+                ret : clocksource_tsc.cycle_last;
 }
 static cycle_t __vsyscall_fn vread_tsc(void)
 {
        cycle_t ret = (cycle_t)vget_cycles();
-        return ret;
+        return ret >= __vsyscall_gtod_data.clock.cycle_last ?
+                ret : __vsyscall_gtod_data.clock.cycle_last;
 }
 static struct clocksource clocksource_tsc = {
diff --git a/arch/x86/mach-visws/visws_apic.c b/arch/x86/mach-visws/visws_apic.c
index 710faf71a650..cef9cb1d15ac 100644
--- a/arch/x86/mach-visws/visws_apic.c
+++ b/arch/x86/mach-visws/visws_apic.c
@@ -1,6 +1,4 @@
 /*
- *      linux/arch/i386/mach-visws/visws_apic.c
- *
 *      Copyright (C) 1999 Bent Hagemark, Ingo Molnar
 *
 *  SGI Visual Workstation interrupt controller
diff --git a/arch/x86/mach-voyager/voyager_basic.c b/arch/x86/mach-voyager/voyager_basic.c
index 6a949e4edde8..46d6f8067690 100644
--- a/arch/x86/mach-voyager/voyager_basic.c
+++ b/arch/x86/mach-voyager/voyager_basic.c
@@ -2,8 +2,6 @@
 *
 * Author: J.E.J.Bottomley@HansenPartnership.com
 *
- * linux/arch/i386/kernel/voyager.c
- *
 * This file contains all the voyager specific routines for getting
 * initialisation of the architecture to function.  For additional
 * features see:
diff --git a/arch/x86/mach-voyager/voyager_cat.c b/arch/x86/mach-voyager/voyager_cat.c
index 17a7904f75b1..ecab9fff0fd1 100644
--- a/arch/x86/mach-voyager/voyager_cat.c
+++ b/arch/x86/mach-voyager/voyager_cat.c
@@ -4,8 +4,6 @@
 *
 * Author: J.E.J.Bottomley@HansenPartnership.com
 *
- * linux/arch/i386/kernel/voyager_cat.c
- *
 * This file contains all the logic for manipulating the CAT bus
 * in a level 5 machine.
 *
diff --git a/arch/x86/mach-voyager/voyager_smp.c b/arch/x86/mach-voyager/voyager_smp.c
index be7235bf105d..96f60c7cd124 100644
--- a/arch/x86/mach-voyager/voyager_smp.c
+++ b/arch/x86/mach-voyager/voyager_smp.c
@@ -4,8 +4,6 @@
 *
 * Author: J.E.J.Bottomley@HansenPartnership.com
 *
- * linux/arch/i386/kernel/voyager_smp.c
- *
 * This file provides all the same external entries as smp.c but uses
 * the voyager hal to provide the functionality
 */
diff --git a/arch/x86/mach-voyager/voyager_thread.c b/arch/x86/mach-voyager/voyager_thread.c
index c69c931818ed..15464a20fb38 100644
--- a/arch/x86/mach-voyager/voyager_thread.c
+++ b/arch/x86/mach-voyager/voyager_thread.c
@@ -4,8 +4,6 @@
 *
 * Author: J.E.J.Bottomley@HansenPartnership.com
 *
- * linux/arch/i386/kernel/voyager_thread.c
- *
 * This module provides the machine status monitor thread for the
 * voyager architecture.  This allows us to monitor the machine
 * environment (temp, voltage, fan function) and the front panel and
diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
index 4bab3b145392..6e38d877ea77 100644
--- a/arch/x86/math-emu/fpu_entry.c
+++ b/arch/x86/math-emu/fpu_entry.c
@@ -678,7 +678,7 @@ int fpregs_soft_set(struct task_struct *target,
                    unsigned int pos, unsigned int count,
                    const void *kbuf, const void __user *ubuf)
 {
-        struct i387_soft_struct *s387 = &target->thread.i387.soft;
+        struct i387_soft_struct *s387 = &target->thread.xstate->soft;
        void *space = s387->st_space;
        int ret;
        int offset, other, i, tags, regnr, tag, newtop;
@@ -730,7 +730,7 @@ int fpregs_soft_get(struct task_struct *target,
                    unsigned int pos, unsigned int count,
                    void *kbuf, void __user *ubuf)
 {
-        struct i387_soft_struct *s387 = &target->thread.i387.soft;
+        struct i387_soft_struct *s387 = &target->thread.xstate->soft;
        const void *space = s387->st_space;
        int ret;
        int offset = (S387->ftop & 7) * 10, other = 80 - offset;
diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h
index a3ae28c49ddd..13488fa153e0 100644
--- a/arch/x86/math-emu/fpu_system.h
+++ b/arch/x86/math-emu/fpu_system.h
@@ -35,8 +35,8 @@
 #define SEG_EXPAND_DOWN(s)      (((s).b & ((1 << 11) | (1 << 10))) \
                                 == (1 << 10))
-#define I387                    (current->thread.i387)
+#define I387                    (current->thread.xstate)
-#define FPU_info                (I387.soft.info)
+#define FPU_info                (I387->soft.info)
 #define FPU_CS                  (*(unsigned short *) &(FPU_info->___cs))
 #define FPU_SS                  (*(unsigned short *) &(FPU_info->___ss))
@@ -46,25 +46,25 @@
 #define FPU_EIP                 (FPU_info->___eip)
 #define FPU_ORIG_EIP            (FPU_info->___orig_eip)
-#define FPU_lookahead           (I387.soft.lookahead)
+#define FPU_lookahead           (I387->soft.lookahead)
 /* nz if ip_offset and cs_selector are not to be set for the current
   instruction. */
-#define no_ip_update            (*(u_char *)&(I387.soft.no_update))
+#define no_ip_update            (*(u_char *)&(I387->soft.no_update))
-#define FPU_rm                  (*(u_char *)&(I387.soft.rm))
+#define FPU_rm                  (*(u_char *)&(I387->soft.rm))
 /* Number of bytes of data which can be legally accessed by the current
   instruction. This only needs to hold a number <= 108, so a byte will do. */
-#define access_limit            (*(u_char *)&(I387.soft.alimit))
+#define access_limit            (*(u_char *)&(I387->soft.alimit))
-#define partial_status          (I387.soft.swd)
+#define partial_status          (I387->soft.swd)
-#define control_word            (I387.soft.cwd)
+#define control_word            (I387->soft.cwd)
-#define fpu_tag_word            (I387.soft.twd)
+#define fpu_tag_word            (I387->soft.twd)
-#define registers               (I387.soft.st_space)
+#define registers               (I387->soft.st_space)
-#define top                     (I387.soft.ftop)
+#define top                     (I387->soft.ftop)
-#define instruction_address     (*(struct address *)&I387.soft.fip)
+#define instruction_address     (*(struct address *)&I387->soft.fip)
-#define operand_address         (*(struct address *)&I387.soft.foo)
+#define operand_address         (*(struct address *)&I387->soft.foo)
 #define FPU_access_ok(x,y,z)    if ( !access_ok(x,y,z) ) \
                                math_abort(FPU_info,SIGSEGV)
diff --git a/arch/x86/math-emu/reg_ld_str.c b/arch/x86/math-emu/reg_ld_str.c
index 02af772a24db..d597fe7423c9 100644
--- a/arch/x86/math-emu/reg_ld_str.c
+++ b/arch/x86/math-emu/reg_ld_str.c
@@ -1180,8 +1180,8 @@ u_char __user *fstenv(fpu_addr_modes addr_modes, u_char __user *d)
                control_word |= 0xffff0040;
                partial_status = status_word() | 0xffff0000;
                fpu_tag_word |= 0xffff0000;
-                I387.soft.fcs &= ~0xf8000000;
+                I387->soft.fcs &= ~0xf8000000;
-                I387.soft.fos |= 0xffff0000;
+                I387->soft.fos |= 0xffff0000;
 #endif /* PECULIAR_486 */
                if (__copy_to_user(d, &control_word, 7 * 4))
                        FPU_abort;
diff --git a/arch/x86/mm/discontig_32.c b/arch/x86/mm/discontig_32.c
index eba0bbede7a6..18378850e25a 100644
--- a/arch/x86/mm/discontig_32.c
+++ b/arch/x86/mm/discontig_32.c
@@ -120,7 +120,7 @@ int __init get_memcfg_numa_flat(void)
        printk("NUMA - single node, flat memory mode\n");
        /* Run the memory configuration and find the top of memory. */
-        find_max_pfn();
+        propagate_e820_map();
        node_start_pfn[0] = 0;
        node_end_pfn[0] = max_pfn;
        memory_present(0, 0, max_pfn);
@@ -134,7 +134,7 @@ int __init get_memcfg_numa_flat(void)
 /*
 * Find the highest page frame number we have available for the node
 */
-static void __init find_max_pfn_node(int nid)
+static void __init propagate_e820_map_node(int nid)
 {
        if (node_end_pfn[nid] > max_pfn)
                node_end_pfn[nid] = max_pfn;
@@ -379,7 +379,7 @@ unsigned long __init setup_memory(void)
        printk("High memory starts at vaddr %08lx\n",
                        (ulong) pfn_to_kaddr(highstart_pfn));
        for_each_online_node(nid)
-                find_max_pfn_node(nid);
+                propagate_e820_map_node(nid);
        memset(NODE_DATA(0), 0, sizeof(struct pglist_data));
        NODE_DATA(0)->bdata = &node0_bdata;
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 1500dc8d63e4..9ec62da85fd7 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -1,5 +1,4 @@
 /*
- *  linux/arch/i386/mm/init.c
 *
 *  Copyright (C) 1995  Linus Torvalds
 *
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 1076097dcab2..1ff7906a9a4d 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -47,9 +47,6 @@
 #include <asm/numa.h>
 #include <asm/cacheflush.h>
-const struct dma_mapping_ops *dma_ops;
-EXPORT_SYMBOL(dma_ops);
 static unsigned long dma_reserve __initdata;
 DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index c590fd200e29..3a4baf95e24d 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -134,7 +134,7 @@ static void __iomem *__ioremap(resource_size_t phys_addr, unsigned long size,
        if (!phys_addr_valid(phys_addr)) {
                printk(KERN_WARNING "ioremap: invalid physical address %llx\n",
-                       phys_addr);
+                       (unsigned long long)phys_addr);
                WARN_ON_ONCE(1);
                return NULL;
        }
@@ -187,7 +187,8 @@ static void __iomem *__ioremap(resource_size_t phys_addr, unsigned long size,
                     new_prot_val == _PAGE_CACHE_WB)) {
                        pr_debug(
                "ioremap error for 0x%llx-0x%llx, requested 0x%lx, got 0x%lx\n",
-                                phys_addr, phys_addr + size,
+                                (unsigned long long)phys_addr,
+                                (unsigned long long)(phys_addr + size),
                                prot_val, new_prot_val);
                        free_memtype(phys_addr, phys_addr + size);
                        return NULL;
diff --git a/arch/x86/mm/k8topology_64.c b/arch/x86/mm/k8topology_64.c
index 7a2ebce87df5..86808e666f9c 100644
--- a/arch/x86/mm/k8topology_64.c
+++ b/arch/x86/mm/k8topology_64.c
@@ -164,7 +164,7 @@ int __init k8_scan_nodes(unsigned long start, unsigned long end)
        if (!found)
                return -1;
-        memnode_shift = compute_hash_shift(nodes, 8);
+        memnode_shift = compute_hash_shift(nodes, 8, NULL);
        if (memnode_shift < 0) {
                printk(KERN_ERR "No NUMA node hash function found. Contact maintainer\n");
                return -1;
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index 3f6c53c0e003..9a6892200b27 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -60,7 +60,7 @@ unsigned long __initdata nodemap_size;
 * -1 if node overlap or lost ram (shift too big)
 */
 static int __init populate_memnodemap(const struct bootnode *nodes,
-                                      int numnodes, int shift)
+                                      int numnodes, int shift, int *nodeids)
 {
        unsigned long addr, end;
        int i, res = -1;
@@ -76,7 +76,12 @@ static int __init populate_memnodemap(const struct bootnode *nodes,
                do {
                        if (memnodemap[addr >> shift] != NUMA_NO_NODE)
                                return -1;
-                        memnodemap[addr >> shift] = i;
+                        if (!nodeids)
+                                memnodemap[addr >> shift] = i;
+                        else
+                                memnodemap[addr >> shift] = nodeids[i];
                        addr += (1UL << shift);
                } while (addr < end);
                res = 1;
@@ -139,7 +144,8 @@ static int __init extract_lsb_from_nodes(const struct bootnode *nodes,
        return i;
 }
-int __init compute_hash_shift(struct bootnode *nodes, int numnodes)
+int __init compute_hash_shift(struct bootnode *nodes, int numnodes,
+                              int *nodeids)
 {
        int shift;
@@ -149,7 +155,7 @@ int __init compute_hash_shift(struct bootnode *nodes, int numnodes)
        printk(KERN_DEBUG "NUMA: Using %d for the hash shift.\n",
                shift);
-        if (populate_memnodemap(nodes, numnodes, shift) != 1) {
+        if (populate_memnodemap(nodes, numnodes, shift, nodeids) != 1) {
                printk(KERN_INFO "Your memory is not aligned you need to "
                       "rebuild your kernel with a bigger NODEMAPSIZE "
                       "shift=%d\n", shift);
@@ -463,7 +469,7 @@ done:
                }
        }
 out:
-        memnode_shift = compute_hash_shift(nodes, num_nodes);
+        memnode_shift = compute_hash_shift(nodes, num_nodes, NULL);
        if (memnode_shift < 0) {
                memnode_shift = 0;
                printk(KERN_ERR "No NUMA hash function found.  NUMA emulation "
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index 3165ec0672bd..6fb9e7c6893f 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -1,7 +1,3 @@
-/*
- *  linux/arch/i386/mm/pgtable.c
- */
 #include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 1bae9c855ceb..fb43d89f46f3 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -32,6 +32,10 @@ static struct bootnode nodes_add[MAX_NUMNODES];
 static int found_add_area __initdata;
 int hotadd_percent __initdata = 0;
+static int num_node_memblks __initdata;
+static struct bootnode node_memblk_range[NR_NODE_MEMBLKS] __initdata;
+static int memblk_nodeid[NR_NODE_MEMBLKS] __initdata;
 /* Too small nodes confuse the VM badly. Usually they result
   from BIOS bugs. */
 #define NODE_MIN_SIZE (4*1024*1024)
@@ -41,17 +45,17 @@ static __init int setup_node(int pxm)
        return acpi_map_pxm_to_node(pxm);
 }
-static __init int conflicting_nodes(unsigned long start, unsigned long end)
+static __init int conflicting_memblks(unsigned long start, unsigned long end)
 {
        int i;
-        for_each_node_mask(i, nodes_parsed) {
+        for (i = 0; i < num_node_memblks; i++) {
-                struct bootnode *nd = &nodes[i];
+                struct bootnode *nd = &node_memblk_range[i];
                if (nd->start == nd->end)
                        continue;
                if (nd->end > start && nd->start < end)
-                        return i;
+                        return memblk_nodeid[i];
                if (nd->end == end && nd->start == start)
-                        return i;
+                        return memblk_nodeid[i];
        }
        return -1;
 }
@@ -258,7 +262,7 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                bad_srat();
                return;
        }
-        i = conflicting_nodes(start, end);
+        i = conflicting_memblks(start, end);
        if (i == node) {
                printk(KERN_WARNING
                "SRAT: Warning: PXM %d (%lx-%lx) overlaps with itself (%Lx-%Lx)\n",
@@ -283,10 +287,10 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                        nd->end = end;
        }
-        printk(KERN_INFO "SRAT: Node %u PXM %u %Lx-%Lx\n", node, pxm,
+        printk(KERN_INFO "SRAT: Node %u PXM %u %lx-%lx\n", node, pxm,
-               nd->start, nd->end);
+               start, end);
-        e820_register_active_regions(node, nd->start >> PAGE_SHIFT,
+        e820_register_active_regions(node, start >> PAGE_SHIFT,
-                                                nd->end >> PAGE_SHIFT);
+                                     end >> PAGE_SHIFT);
        push_node_boundaries(node, nd->start >> PAGE_SHIFT,
                                                nd->end >> PAGE_SHIFT);
@@ -298,6 +302,11 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                if ((nd->start | nd->end) == 0)
                        node_clear(node, nodes_parsed);
        }
+        node_memblk_range[num_node_memblks].start = start;
+        node_memblk_range[num_node_memblks].end = end;
+        memblk_nodeid[num_node_memblks] = node;
+        num_node_memblks++;
 }
 /* Sanity check to catch more bad SRATs (they are amazingly common).
@@ -368,7 +377,8 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
                return -1;
        }
-        memnode_shift = compute_hash_shift(nodes, MAX_NUMNODES);
+        memnode_shift = compute_hash_shift(node_memblk_range, num_node_memblks,
+                                           memblk_nodeid);
        if (memnode_shift < 0) {
                printk(KERN_ERR
                     "SRAT: No NUMA node hash function found. Contact maintainer\n");
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 17a6b057856b..b7ad9f89d21f 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -37,7 +37,8 @@ $(obj)/%.so: OBJCOPYFLAGS := -S
 $(obj)/%.so: $(obj)/%.so.dbg FORCE
        $(call if_changed,objcopy)
-CFL := $(PROFILING) -mcmodel=small -fPIC -g0 -O2 -fasynchronous-unwind-tables -m64
+CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \
+       $(filter -g%,$(KBUILD_CFLAGS))
 $(vobjs): KBUILD_CFLAGS += $(CFL)
diff --git a/arch/x86/video/fbdev.c b/arch/x86/video/fbdev.c
index 48fb38d7d2c0..4db42bff8c60 100644
--- a/arch/x86/video/fbdev.c
+++ b/arch/x86/video/fbdev.c
@@ -1,5 +1,4 @@
 /*
- * arch/i386/video/fbdev.c - i386 Framebuffer
 *
 * Copyright (C) 2007 Antonino Daplas <adaplas@gmail.com>
 *
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 8ea709be3306..efd70a974591 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -314,4 +314,13 @@ config KEYBOARD_BFIN
          To compile this driver as a module, choose M here: the
          module will be called bf54x-keys.
+config KEYBOARD_SH_KEYSC
+        tristate "SuperH KEYSC keypad support"
+        depends on SUPERH
+        help
+          Say Y here if you want to use a keypad attached to the KEYSC block
+          on SuperH processors such as sh7722 and sh7343.
+          To compile this driver as a module, choose M here: the
+          module will be called sh_keysc.
 endif
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index e741f4031012..0edc8f285d1c 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -26,3 +26,4 @@ obj-$(CONFIG_KEYBOARD_HP6XX)		+= jornada680_kbd.o
 obj-$(CONFIG_KEYBOARD_HP7XX)            += jornada720_kbd.o
 obj-$(CONFIG_KEYBOARD_MAPLE)            += maple_keyb.o
 obj-$(CONFIG_KEYBOARD_BFIN)             += bf54x-keys.o
+obj-$(CONFIG_KEYBOARD_SH_KEYSC)         += sh_keysc.o
diff --git a/drivers/input/keyboard/sh_keysc.c b/drivers/input/keyboard/sh_keysc.c
new file mode 100644
index 000000000000..8486abc457ed
--- /dev/null
+++ b/drivers/input/keyboard/sh_keysc.c
@@ -0,0 +1,280 @@
+/*
+ * SuperH KEYSC Keypad Driver
+ *
+ * Copyright (C) 2008 Magnus Damm
+ *
+ * Based on gpio_keys.c, Copyright 2005 Phil Blundell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/input.h>
+#include <linux/io.h>
+#include <asm/sh_keysc.h>
+#define KYCR1_OFFS   0x00
+#define KYCR2_OFFS   0x04
+#define KYINDR_OFFS  0x08
+#define KYOUTDR_OFFS 0x0c
+#define KYCR2_IRQ_LEVEL    0x10
+#define KYCR2_IRQ_DISABLED 0x00
+static const struct {
+        unsigned char kymd, keyout, keyin;
+} sh_keysc_mode[] = {
+        [SH_KEYSC_MODE_1] = { 0, 6, 5 },
+        [SH_KEYSC_MODE_2] = { 1, 5, 6 },
+        [SH_KEYSC_MODE_3] = { 2, 4, 7 },
+};
+struct sh_keysc_priv {
+        void __iomem *iomem_base;
+        unsigned long last_keys;
+        struct input_dev *input;
+        struct sh_keysc_info pdata;
+};
+static irqreturn_t sh_keysc_isr(int irq, void *dev_id)
+{
+        struct platform_device *pdev = dev_id;
+        struct sh_keysc_priv *priv = platform_get_drvdata(pdev);
+        struct sh_keysc_info *pdata = &priv->pdata;
+        unsigned long keys, keys1, keys0, mask;
+        unsigned char keyin_set, tmp;
+        int i, k;
+        dev_dbg(&pdev->dev, "isr!\n");
+        keys1 = ~0;
+        keys0 = 0;
+        do {
+                keys = 0;
+                keyin_set = 0;
+                iowrite16(KYCR2_IRQ_DISABLED, priv->iomem_base + KYCR2_OFFS);
+                for (i = 0; i < sh_keysc_mode[pdata->mode].keyout; i++) {
+                        iowrite16(0xfff ^ (3 << (i * 2)),
+                                  priv->iomem_base + KYOUTDR_OFFS);
+                        udelay(pdata->delay);
+                        tmp = ioread16(priv->iomem_base + KYINDR_OFFS);
+                        keys |= tmp << (sh_keysc_mode[pdata->mode].keyin * i);
+                        tmp ^= (1 << sh_keysc_mode[pdata->mode].keyin) - 1;
+                        keyin_set |= tmp;
+                }
+                iowrite16(0, priv->iomem_base + KYOUTDR_OFFS);
+                iowrite16(KYCR2_IRQ_LEVEL | (keyin_set << 8),
+                          priv->iomem_base + KYCR2_OFFS);
+                keys ^= ~0;
+                keys &= (1 << (sh_keysc_mode[pdata->mode].keyin *
+                               sh_keysc_mode[pdata->mode].keyout)) - 1;
+                keys1 &= keys;
+                keys0 |= keys;
+                dev_dbg(&pdev->dev, "keys 0x%08lx\n", keys);
+        } while (ioread16(priv->iomem_base + KYCR2_OFFS) & 0x01);
+        dev_dbg(&pdev->dev, "last_keys 0x%08lx keys0 0x%08lx keys1 0x%08lx\n",
+                priv->last_keys, keys0, keys1);
+        for (i = 0; i < SH_KEYSC_MAXKEYS; i++) {
+                k = pdata->keycodes[i];
+                if (!k)
+                        continue;
+                mask = 1 << i;
+                if (!((priv->last_keys ^ keys0) & mask))
+                        continue;
+                if ((keys1 | keys0) & mask) {
+                        input_event(priv->input, EV_KEY, k, 1);
+                        priv->last_keys |= mask;
+                }
+                if (!(keys1 & mask)) {
+                        input_event(priv->input, EV_KEY, k, 0);
+                        priv->last_keys &= ~mask;
+                }
+        }
+        input_sync(priv->input);
+        return IRQ_HANDLED;
+}
+#define res_size(res) ((res)->end - (res)->start + 1)
+static int __devinit sh_keysc_probe(struct platform_device *pdev)
+{
+        struct sh_keysc_priv *priv;
+        struct sh_keysc_info *pdata;
+        struct resource *res;
+        struct input_dev *input;
+        int i, k;
+        int irq, error;
+        if (!pdev->dev.platform_data) {
+                dev_err(&pdev->dev, "no platform data defined\n");
+                error = -EINVAL;
+                goto err0;
+        }
+        error = -ENXIO;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
+                goto err0;
+        }
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "failed to get irq\n");
+                goto err0;
+        }
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (priv == NULL) {
+                dev_err(&pdev->dev, "failed to allocate driver data\n");
+                error = -ENOMEM;
+                goto err0;
+        }
+        platform_set_drvdata(pdev, priv);
+        memcpy(&priv->pdata, pdev->dev.platform_data, sizeof(priv->pdata));
+        pdata = &priv->pdata;
+        res = request_mem_region(res->start, res_size(res), pdev->name);
+        if (res == NULL) {
+                dev_err(&pdev->dev, "failed to request I/O memory\n");
+                error = -EBUSY;
+                goto err1;
+        }
+        priv->iomem_base = ioremap_nocache(res->start, res_size(res));
+        if (priv->iomem_base == NULL) {
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
+                error = -ENXIO;
+                goto err2;
+        }
+        priv->input = input_allocate_device();
+        if (!priv->input) {
+                dev_err(&pdev->dev, "failed to allocate input device\n");
+                error = -ENOMEM;
+                goto err3;
+        }
+        input = priv->input;
+        input->evbit[0] = BIT_MASK(EV_KEY);
+        input->name = pdev->name;
+        input->phys = "sh-keysc-keys/input0";
+        input->dev.parent = &pdev->dev;
+        input->id.bustype = BUS_HOST;
+        input->id.vendor = 0x0001;
+        input->id.product = 0x0001;
+        input->id.version = 0x0100;
+        error = request_irq(irq, sh_keysc_isr, 0, pdev->name, pdev);
+        if (error) {
+                dev_err(&pdev->dev, "failed to request IRQ\n");
+                goto err4;
+        }
+        for (i = 0; i < SH_KEYSC_MAXKEYS; i++) {
+                k = pdata->keycodes[i];
+                if (k)
+                        input_set_capability(input, EV_KEY, k);
+        }
+        error = input_register_device(input);
+        if (error) {
+                dev_err(&pdev->dev, "failed to register input device\n");
+                goto err5;
+        }
+        iowrite16((sh_keysc_mode[pdata->mode].kymd << 8) |
+                  pdata->scan_timing, priv->iomem_base + KYCR1_OFFS);
+        iowrite16(0, priv->iomem_base + KYOUTDR_OFFS);
+        iowrite16(KYCR2_IRQ_LEVEL, priv->iomem_base + KYCR2_OFFS);
+        return 0;
+ err5:
+        free_irq(irq, pdev);
+ err4:
+        input_free_device(input);
+ err3:
+        iounmap(priv->iomem_base);
+ err2:
+        release_mem_region(res->start, res_size(res));
+ err1:
+        platform_set_drvdata(pdev, NULL);
+        kfree(priv);
+ err0:
+        return error;
+}
+static int __devexit sh_keysc_remove(struct platform_device *pdev)
+{
+        struct sh_keysc_priv *priv = platform_get_drvdata(pdev);
+        struct resource *res;
+        iowrite16(KYCR2_IRQ_DISABLED, priv->iomem_base + KYCR2_OFFS);
+        input_unregister_device(priv->input);
+        free_irq(platform_get_irq(pdev, 0), pdev);
+        iounmap(priv->iomem_base);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        release_mem_region(res->start, res_size(res));
+        platform_set_drvdata(pdev, NULL);
+        kfree(priv);
+        return 0;
+}
+#define sh_keysc_suspend NULL
+#define sh_keysc_resume NULL
+struct platform_driver sh_keysc_device_driver = {
+        .probe          = sh_keysc_probe,
+        .remove         = __devexit_p(sh_keysc_remove),
+        .suspend        = sh_keysc_suspend,
+        .resume         = sh_keysc_resume,
+        .driver         = {
+                .name   = "sh_keysc",
+        }
+};
+static int __init sh_keysc_init(void)
+{
+        return platform_driver_register(&sh_keysc_device_driver);
+}
+static void __exit sh_keysc_exit(void)
+{
+        platform_driver_unregister(&sh_keysc_device_driver);
+}
+module_init(sh_keysc_init);
+module_exit(sh_keysc_exit);
+MODULE_AUTHOR("Magnus Damm");
+MODULE_DESCRIPTION("SuperH KEYSC Keypad Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 9e9caa5d7f5f..c594b34c6767 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -1,8 +1,9 @@
 /*
 * SuperH On-Chip RTC Support
 *
- * Copyright (C) 2006, 2007  Paul Mundt
+ * Copyright (C) 2006, 2007, 2008  Paul Mundt
 * Copyright (C) 2006  Jamie Lenehan
+ * Copyright (C) 2008  Angelo Castello
 *
 * Based on the old arch/sh/kernel/cpu/rtc.c by:
 *
@@ -26,7 +27,7 @@
 #include <asm/rtc.h>
 #define DRV_NAME        "sh-rtc"
-#define DRV_VERSION     "0.1.6"
+#define DRV_VERSION     "0.2.0"
 #define RTC_REG(r)      ((r) * rtc_reg_size)
@@ -63,6 +64,13 @@
 /* ALARM Bits - or with BCD encoded value */
 #define AR_ENB          0x80    /* Enable for alarm cmp   */
+/* Period Bits */
+#define PF_HP           0x100   /* Enable Half Period to support 8,32,128Hz */
+#define PF_COUNT        0x200   /* Half periodic counter */
+#define PF_OXS          0x400   /* Periodic One x Second */
+#define PF_KOU          0x800   /* Kernel or User periodic request 1=kernel */
+#define PF_MASK         0xf00
 /* RCR1 Bits */
 #define RCR1_CF         0x80    /* Carry Flag             */
 #define RCR1_CIE        0x10    /* Carry Interrupt Enable */
@@ -84,33 +92,24 @@ struct sh_rtc {
        unsigned int alarm_irq, periodic_irq, carry_irq;
        struct rtc_device *rtc_dev;
        spinlock_t lock;
-        int rearm_aie;
        unsigned long capabilities;     /* See asm-sh/rtc.h for cap bits */
+        unsigned short periodic_freq;
 };
 static irqreturn_t sh_rtc_interrupt(int irq, void *dev_id)
 {
-        struct platform_device *pdev = to_platform_device(dev_id);
+        struct sh_rtc *rtc = dev_id;
-        struct sh_rtc *rtc = platform_get_drvdata(pdev);
+        unsigned int tmp;
-        unsigned int tmp, events = 0;
        spin_lock(&rtc->lock);
        tmp = readb(rtc->regbase + RCR1);
        tmp &= ~RCR1_CF;
-        if (rtc->rearm_aie) {
-                if (tmp & RCR1_AF)
-                        tmp &= ~RCR1_AF;        /* try to clear AF again */
-                else {
-                        tmp |= RCR1_AIE;        /* AF has cleared, rearm IRQ */
-                        rtc->rearm_aie = 0;
-                }
-        }
        writeb(tmp, rtc->regbase + RCR1);
-        rtc_update_irq(rtc->rtc_dev, 1, events);
+        /* Users have requested One x Second IRQ */
+        if (rtc->periodic_freq & PF_OXS)
+                rtc_update_irq(rtc->rtc_dev, 1, RTC_UF | RTC_IRQF);
        spin_unlock(&rtc->lock);
@@ -119,47 +118,48 @@ static irqreturn_t sh_rtc_interrupt(int irq, void *dev_id)
 static irqreturn_t sh_rtc_alarm(int irq, void *dev_id)
 {
-        struct platform_device *pdev = to_platform_device(dev_id);
+        struct sh_rtc *rtc = dev_id;
-        struct sh_rtc *rtc = platform_get_drvdata(pdev);
+        unsigned int tmp;
-        unsigned int tmp, events = 0;
        spin_lock(&rtc->lock);
        tmp = readb(rtc->regbase + RCR1);
+        tmp &= ~(RCR1_AF | RCR1_AIE);
-        /*
-         * If AF is set then the alarm has triggered. If we clear AF while
-         * the alarm time still matches the RTC time then AF will
-         * immediately be set again, and if AIE is enabled then the alarm
-         * interrupt will immediately be retrigger. So we clear AIE here
-         * and use rtc->rearm_aie so that the carry interrupt will keep
-         * trying to clear AF and once it stays cleared it'll re-enable
-         * AIE.
-         */
-        if (tmp & RCR1_AF) {
-                events |= RTC_AF | RTC_IRQF;
-                tmp &= ~(RCR1_AF|RCR1_AIE);
                writeb(tmp, rtc->regbase + RCR1);
-                rtc->rearm_aie = 1;
+        rtc_update_irq(rtc->rtc_dev, 1, RTC_AF | RTC_IRQF);
-                rtc_update_irq(rtc->rtc_dev, 1, events);
-        }
        spin_unlock(&rtc->lock);
        return IRQ_HANDLED;
 }
 static irqreturn_t sh_rtc_periodic(int irq, void *dev_id)
 {
-        struct platform_device *pdev = to_platform_device(dev_id);
+        struct sh_rtc *rtc = dev_id;
-        struct sh_rtc *rtc = platform_get_drvdata(pdev);
+        struct rtc_device *rtc_dev = rtc->rtc_dev;
+        unsigned int tmp;
        spin_lock(&rtc->lock);
-        rtc_update_irq(rtc->rtc_dev, 1, RTC_PF | RTC_IRQF);
+        tmp = readb(rtc->regbase + RCR2);
+        tmp &= ~RCR2_PEF;
+        writeb(tmp, rtc->regbase + RCR2);
+        /* Half period enabled than one skipped and the next notified */
+        if ((rtc->periodic_freq & PF_HP) && (rtc->periodic_freq & PF_COUNT))
+                rtc->periodic_freq &= ~PF_COUNT;
+        else {
+                if (rtc->periodic_freq & PF_HP)
+                        rtc->periodic_freq |= PF_COUNT;
+                if (rtc->periodic_freq & PF_KOU) {
+                        spin_lock(&rtc_dev->irq_task_lock);
+                        if (rtc_dev->irq_task)
+                                rtc_dev->irq_task->func(rtc_dev->irq_task->private_data);
+                        spin_unlock(&rtc_dev->irq_task_lock);
+                } else
+                        rtc_update_irq(rtc->rtc_dev, 1, RTC_PF | RTC_IRQF);
+        }
        spin_unlock(&rtc->lock);
@@ -176,8 +176,8 @@ static inline void sh_rtc_setpie(struct device *dev, unsigned int enable)
        tmp = readb(rtc->regbase + RCR2);
        if (enable) {
-                tmp &= ~RCR2_PESMASK;
+                tmp &= ~RCR2_PEF;       /* Clear PES bit */
-                tmp |= RCR2_PEF | (2 << 4);
+                tmp |= (rtc->periodic_freq & ~PF_HP);   /* Set PES2-0 */
        } else
                tmp &= ~(RCR2_PESMASK | RCR2_PEF);
@@ -186,82 +186,81 @@ static inline void sh_rtc_setpie(struct device *dev, unsigned int enable)
        spin_unlock_irq(&rtc->lock);
 }
-static inline void sh_rtc_setaie(struct device *dev, unsigned int enable)
+static inline int sh_rtc_setfreq(struct device *dev, unsigned int freq)
 {
        struct sh_rtc *rtc = dev_get_drvdata(dev);
-        unsigned int tmp;
+        int tmp, ret = 0;
        spin_lock_irq(&rtc->lock);
+        tmp = rtc->periodic_freq & PF_MASK;
-        tmp = readb(rtc->regbase + RCR1);
+        switch (freq) {
+        case 0:
-        if (!enable) {
+                rtc->periodic_freq = 0x00;
-                tmp &= ~RCR1_AIE;
+                break;
-                rtc->rearm_aie = 0;
+        case 1:
-        } else if (rtc->rearm_aie == 0)
+                rtc->periodic_freq = 0x60;
-                tmp |= RCR1_AIE;
+                break;
+        case 2:
+                rtc->periodic_freq = 0x50;
+                break;
+        case 4:
+                rtc->periodic_freq = 0x40;
+                break;
+        case 8:
+                rtc->periodic_freq = 0x30 | PF_HP;
+                break;
+        case 16:
+                rtc->periodic_freq = 0x30;
+                break;
+        case 32:
+                rtc->periodic_freq = 0x20 | PF_HP;
+                break;
+        case 64:
+                rtc->periodic_freq = 0x20;
+                break;
+        case 128:
+                rtc->periodic_freq = 0x10 | PF_HP;
+                break;
+        case 256:
+                rtc->periodic_freq = 0x10;
+                break;
+        default:
+                ret = -ENOTSUPP;
+        }
-        writeb(tmp, rtc->regbase + RCR1);
+        if (ret == 0) {
+                rtc->periodic_freq |= tmp;
+                rtc->rtc_dev->irq_freq = freq;
+        }
        spin_unlock_irq(&rtc->lock);
+        return ret;
 }
-static int sh_rtc_open(struct device *dev)
+static inline void sh_rtc_setaie(struct device *dev, unsigned int enable)
 {
        struct sh_rtc *rtc = dev_get_drvdata(dev);
        unsigned int tmp;
-        int ret;
-        tmp = readb(rtc->regbase + RCR1);
-        tmp &= ~RCR1_CF;
-        tmp |= RCR1_CIE;
-        writeb(tmp, rtc->regbase + RCR1);
-        ret = request_irq(rtc->periodic_irq, sh_rtc_periodic, IRQF_DISABLED,
+        spin_lock_irq(&rtc->lock);
-                          "sh-rtc period", dev);
-        if (unlikely(ret)) {
-                dev_err(dev, "request period IRQ failed with %d, IRQ %d\n",
-                        ret, rtc->periodic_irq);
-                return ret;
-        }
-        ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, IRQF_DISABLED,
-                          "sh-rtc carry", dev);
-        if (unlikely(ret)) {
-                dev_err(dev, "request carry IRQ failed with %d, IRQ %d\n",
-                        ret, rtc->carry_irq);
-                free_irq(rtc->periodic_irq, dev);
-                goto err_bad_carry;
-        }
-        ret = request_irq(rtc->alarm_irq, sh_rtc_alarm, IRQF_DISABLED,
+        tmp = readb(rtc->regbase + RCR1);
-                          "sh-rtc alarm", dev);
-        if (unlikely(ret)) {
-                dev_err(dev, "request alarm IRQ failed with %d, IRQ %d\n",
-                        ret, rtc->alarm_irq);
-                goto err_bad_alarm;
-        }
-        return 0;
+        if (!enable)
+                tmp &= ~RCR1_AIE;
+        else
+                tmp |= RCR1_AIE;
-err_bad_alarm:
+        writeb(tmp, rtc->regbase + RCR1);
-        free_irq(rtc->carry_irq, dev);
-err_bad_carry:
-        free_irq(rtc->periodic_irq, dev);
-        return ret;
+        spin_unlock_irq(&rtc->lock);
 }
 static void sh_rtc_release(struct device *dev)
 {
-        struct sh_rtc *rtc = dev_get_drvdata(dev);
        sh_rtc_setpie(dev, 0);
        sh_rtc_setaie(dev, 0);
-        free_irq(rtc->periodic_irq, dev);
-        free_irq(rtc->carry_irq, dev);
-        free_irq(rtc->alarm_irq, dev);
 }
 static int sh_rtc_proc(struct device *dev, struct seq_file *seq)
@@ -270,31 +269,44 @@ static int sh_rtc_proc(struct device *dev, struct seq_file *seq)
        unsigned int tmp;
        tmp = readb(rtc->regbase + RCR1);
-        seq_printf(seq, "carry_IRQ\t: %s\n",
+        seq_printf(seq, "carry_IRQ\t: %s\n", (tmp & RCR1_CIE) ? "yes" : "no");
-                   (tmp & RCR1_CIE) ? "yes" : "no");
        tmp = readb(rtc->regbase + RCR2);
        seq_printf(seq, "periodic_IRQ\t: %s\n",
-                   (tmp & RCR2_PEF) ? "yes" : "no");
+                   (tmp & RCR2_PESMASK) ? "yes" : "no");
        return 0;
 }
 static int sh_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
 {
-        unsigned int ret = -ENOIOCTLCMD;
+        struct sh_rtc *rtc = dev_get_drvdata(dev);
+        unsigned int ret = 0;
        switch (cmd) {
        case RTC_PIE_OFF:
        case RTC_PIE_ON:
                sh_rtc_setpie(dev, cmd == RTC_PIE_ON);
-                ret = 0;
                break;
        case RTC_AIE_OFF:
        case RTC_AIE_ON:
                sh_rtc_setaie(dev, cmd == RTC_AIE_ON);
-                ret = 0;
                break;
+        case RTC_UIE_OFF:
+                rtc->periodic_freq &= ~PF_OXS;
+                break;
+        case RTC_UIE_ON:
+                rtc->periodic_freq |= PF_OXS;
+                break;
+        case RTC_IRQP_READ:
+                ret = put_user(rtc->rtc_dev->irq_freq,
+                               (unsigned long __user *)arg);
+                break;
+        case RTC_IRQP_SET:
+                ret = sh_rtc_setfreq(dev, arg);
+                break;
+        default:
+                ret = -ENOIOCTLCMD;
        }
        return ret;
@@ -421,7 +433,7 @@ static int sh_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct sh_rtc *rtc = platform_get_drvdata(pdev);
-        struct rtc_time* tm = &wkalrm->time;
+        struct rtc_time *tm = &wkalrm->time;
        spin_lock_irq(&rtc->lock);
@@ -452,7 +464,7 @@ static inline void sh_rtc_write_alarm_value(struct sh_rtc *rtc,
                writeb(BIN2BCD(value) | AR_ENB,  rtc->regbase + reg_off);
 }
-static int sh_rtc_check_alarm(struct rtc_time* tm)
+static int sh_rtc_check_alarm(struct rtc_time *tm)
 {
        /*
         * The original rtc says anything > 0xc0 is "don't care" or "match
@@ -503,11 +515,9 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
        /* disable alarm interrupt and clear the alarm flag */
        rcr1 = readb(rtc->regbase + RCR1);
-        rcr1 &= ~(RCR1_AF|RCR1_AIE);
+        rcr1 &= ~(RCR1_AF | RCR1_AIE);
        writeb(rcr1, rtc->regbase + RCR1);
-        rtc->rearm_aie = 0;
        /* set alarm time */
        sh_rtc_write_alarm_value(rtc, tm->tm_sec,  RSECAR);
        sh_rtc_write_alarm_value(rtc, tm->tm_min,  RMINAR);
@@ -529,14 +539,34 @@ static int sh_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
        return 0;
 }
+static int sh_rtc_irq_set_state(struct device *dev, int enabled)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_rtc *rtc = platform_get_drvdata(pdev);
+        if (enabled) {
+                rtc->periodic_freq |= PF_KOU;
+                return sh_rtc_ioctl(dev, RTC_PIE_ON, 0);
+        } else {
+                rtc->periodic_freq &= ~PF_KOU;
+                return sh_rtc_ioctl(dev, RTC_PIE_OFF, 0);
+        }
+}
+static int sh_rtc_irq_set_freq(struct device *dev, int freq)
+{
+        return sh_rtc_ioctl(dev, RTC_IRQP_SET, freq);
+}
 static struct rtc_class_ops sh_rtc_ops = {
-        .open           = sh_rtc_open,
        .release        = sh_rtc_release,
        .ioctl          = sh_rtc_ioctl,
        .read_time      = sh_rtc_read_time,
        .set_time       = sh_rtc_set_time,
        .read_alarm     = sh_rtc_read_alarm,
        .set_alarm      = sh_rtc_set_alarm,
+        .irq_set_state  = sh_rtc_irq_set_state,
+        .irq_set_freq   = sh_rtc_irq_set_freq,
        .proc           = sh_rtc_proc,
 };
@@ -544,6 +574,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
 {
        struct sh_rtc *rtc;
        struct resource *res;
+        unsigned int tmp;
        int ret = -ENOENT;
        rtc = kzalloc(sizeof(struct sh_rtc), GFP_KERNEL);
@@ -552,6 +583,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
        spin_lock_init(&rtc->lock);
+        /* get periodic/carry/alarm irqs */
        rtc->periodic_irq = platform_get_irq(pdev, 0);
        if (unlikely(rtc->periodic_irq < 0)) {
                dev_err(&pdev->dev, "No IRQ for period\n");
@@ -608,8 +640,48 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
                rtc->capabilities |= pinfo->capabilities;
        }
+        rtc->rtc_dev->max_user_freq = 256;
+        rtc->rtc_dev->irq_freq = 1;
+        rtc->periodic_freq = 0x60;
        platform_set_drvdata(pdev, rtc);
+        /* register periodic/carry/alarm irqs */
+        ret = request_irq(rtc->periodic_irq, sh_rtc_periodic, IRQF_DISABLED,
+                          "sh-rtc period", rtc);
+        if (unlikely(ret)) {
+                dev_err(&pdev->dev,
+                        "request period IRQ failed with %d, IRQ %d\n", ret,
+                        rtc->periodic_irq);
+                goto err_badmap;
+        }
+        ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, IRQF_DISABLED,
+                          "sh-rtc carry", rtc);
+        if (unlikely(ret)) {
+                dev_err(&pdev->dev,
+                        "request carry IRQ failed with %d, IRQ %d\n", ret,
+                        rtc->carry_irq);
+                free_irq(rtc->periodic_irq, rtc);
+                goto err_badmap;
+        }
+        ret = request_irq(rtc->alarm_irq, sh_rtc_alarm, IRQF_DISABLED,
+                          "sh-rtc alarm", rtc);
+        if (unlikely(ret)) {
+                dev_err(&pdev->dev,
+                        "request alarm IRQ failed with %d, IRQ %d\n", ret,
+                        rtc->alarm_irq);
+                free_irq(rtc->carry_irq, rtc);
+                free_irq(rtc->periodic_irq, rtc);
+                goto err_badmap;
+        }
+        tmp = readb(rtc->regbase + RCR1);
+        tmp &= ~RCR1_CF;
+        tmp |= RCR1_CIE;
+        writeb(tmp, rtc->regbase + RCR1);
        return 0;
 err_badmap:
@@ -630,6 +702,10 @@ static int __devexit sh_rtc_remove(struct platform_device *pdev)
        sh_rtc_setpie(&pdev->dev, 0);
        sh_rtc_setaie(&pdev->dev, 0);
+        free_irq(rtc->carry_irq, rtc);
+        free_irq(rtc->periodic_irq, rtc);
+        free_irq(rtc->alarm_irq, rtc);
        release_resource(rtc->res);
        platform_set_drvdata(pdev, NULL);
@@ -662,6 +738,8 @@ module_exit(sh_rtc_exit);
 MODULE_DESCRIPTION("SuperH on-chip RTC driver");
 MODULE_VERSION(DRV_VERSION);
-MODULE_AUTHOR("Paul Mundt <lethal@linux-sh.org>, Jamie Lenehan <lenehan@twibble.org>");
+MODULE_AUTHOR("Paul Mundt <lethal@linux-sh.org>, "
+              "Jamie Lenehan <lenehan@twibble.org>, "
+              "Angelo Castello <angelo.castello@st.com>");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index eff593080d4f..c2ea5d4df44a 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -333,7 +333,6 @@ static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
        }
        sci_out(port, SCFCR, fcr_val);
 }
 #elif defined(CONFIG_CPU_SH3)
 /* For SH7705, SH7706, SH7707, SH7709, SH7709A, SH7729 */
 static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
@@ -384,6 +383,12 @@ static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
        sci_out(port, SCFCR, fcr_val);
 }
+#elif defined(CONFIG_CPU_SUBTYPE_SH7723)
+static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
+{
+        /* Nothing to do here.. */
+        sci_out(port, SCFCR, 0);
+}
 #else
 /* For SH7750 */
 static void sci_init_pins_scif(struct uart_port *port, unsigned int cflag)
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index 01a9dd715f5d..fa8700a968fc 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -1,20 +1,5 @@
-/* $Id: sh-sci.h,v 1.4 2004/02/19 16:43:56 lethal Exp $
- *
- *  linux/drivers/serial/sh-sci.h
- *
- *  SuperH on-chip serial module support.  (SCI with no FIFO / with FIFO)
- *  Copyright (C) 1999, 2000  Niibe Yutaka
- *  Copyright (C) 2000  Greg Banks
- *  Copyright (C) 2002, 2003  Paul Mundt
- *  Modified to support multiple serial ports. Stuart Menefy (May 2000).
- *  Modified to support SH7300(SH-Mobile) SCIF. Takashi Kusuda (Jun 2003).
- *  Modified to support H8/300 Series Yoshinori Sato (Feb 2004).
- *  Removed SH7300 support (Jul 2007).
- *  Modified to support SH7720 SCIF. Markus Brunner, Mark Jonas (Aug 2007).
- */
 #include <linux/serial_core.h>
 #include <asm/io.h>
 #include <asm/gpio.h>
 #if defined(CONFIG_H83007) || defined(CONFIG_H83068)
@@ -102,6 +87,15 @@
 # define SCSPTR0                SCPDR0
 # define SCIF_ORER              0x0001  /* overrun error bit */
 # define SCSCR_INIT(port)       0x0038  /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
+#elif defined(CONFIG_CPU_SUBTYPE_SH7723)
+# define SCSPTR0                0xa4050160
+# define SCSPTR1                0xa405013e
+# define SCSPTR2                0xa4050160
+# define SCSPTR3                0xa405013e
+# define SCSPTR4                0xa4050128
+# define SCSPTR5                0xa4050128
+# define SCIF_ORER              0x0001  /* overrun error bit */
+# define SCSCR_INIT(port)       0x0038  /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
 # define SCIF_ONLY
 #elif defined(CONFIG_CPU_SUBTYPE_SH4_202)
 # define SCSPTR2 0xffe80020 /* 16 bit SCIF */
@@ -395,6 +389,11 @@
                 h8_sci_offset, h8_sci_size) \
  CPU_SCI_FNS(name, h8_sci_offset, h8_sci_size)
 #define SCIF_FNS(name, sh3_scif_offset, sh3_scif_size, sh4_scif_offset, sh4_scif_size)
+#elif defined(CONFIG_CPU_SUBTYPE_SH7723)
+        #define SCIx_FNS(name, sh4_scifa_offset, sh4_scifa_size, sh4_scif_offset, sh4_scif_size) \
+                CPU_SCIx_FNS(name, sh4_scifa_offset, sh4_scifa_size, sh4_scif_offset, sh4_scif_size)
+        #define SCIF_FNS(name, sh4_scif_offset, sh4_scif_size) \
+                CPU_SCIF_FNS(name, sh4_scif_offset, sh4_scif_size)
 #else
 #define SCIx_FNS(name, sh3_sci_offset, sh3_sci_size, sh4_sci_offset, sh4_sci_size, \
                 sh3_scif_offset, sh3_scif_size, sh4_scif_offset, sh4_scif_size, \
@@ -419,6 +418,18 @@ SCIF_FNS(SCFDR,  0x1c, 16)
 SCIF_FNS(SCxTDR, 0x20,  8)
 SCIF_FNS(SCxRDR, 0x24,  8)
 SCIF_FNS(SCLSR,  0x24, 16)
+#elif defined(CONFIG_CPU_SUBTYPE_SH7723)
+SCIx_FNS(SCSMR,  0x00, 16, 0x00, 16)
+SCIx_FNS(SCBRR,  0x04,  8, 0x04,  8)
+SCIx_FNS(SCSCR,  0x08, 16, 0x08, 16)
+SCIx_FNS(SCxTDR, 0x20,  8, 0x0c,  8)
+SCIx_FNS(SCxSR,  0x14, 16, 0x10, 16)
+SCIx_FNS(SCxRDR, 0x24,  8, 0x14,  8)
+SCIF_FNS(SCTDSR, 0x0c,  8)
+SCIF_FNS(SCFER,  0x10, 16)
+SCIF_FNS(SCFCR,  0x18, 16)
+SCIF_FNS(SCFDR,  0x1c, 16)
+SCIF_FNS(SCLSR,  0x24, 16)
 #else
 /*      reg      SCI/SH3   SCI/SH4  SCIF/SH3   SCIF/SH4  SCI/H8*/
 /*      name     off  sz   off  sz   off  sz   off  sz   off  sz*/
@@ -589,6 +600,23 @@ static inline int sci_rxd_in(struct uart_port *port)
                return ctrl_inb(SCPDR0) & 0x0001 ? 1 : 0; /* SCIF0 */
        return 1;
 }
+#elif defined(CONFIG_CPU_SUBTYPE_SH7723)
+static inline int sci_rxd_in(struct uart_port *port)
+{
+        if (port->mapbase == 0xffe00000)
+                return ctrl_inb(SCSPTR0) & 0x0008 ? 1 : 0; /* SCIF0 */
+        if (port->mapbase == 0xffe10000)
+                return ctrl_inb(SCSPTR1) & 0x0020 ? 1 : 0; /* SCIF1 */
+        if (port->mapbase == 0xffe20000)
+                return ctrl_inb(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF2 */
+        if (port->mapbase == 0xa4e30000)
+                return ctrl_inb(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF3 */
+        if (port->mapbase == 0xa4e40000)
+                return ctrl_inb(SCSPTR4) & 0x0001 ? 1 : 0; /* SCIF4 */
+        if (port->mapbase == 0xa4e50000)
+                return ctrl_inb(SCSPTR5) & 0x0008 ? 1 : 0; /* SCIF5 */
+        return 1;
+}
 #elif defined(CONFIG_CPU_SUBTYPE_SH5_101) || defined(CONFIG_CPU_SUBTYPE_SH5_103)
 static inline int sci_rxd_in(struct uart_port *port)
 {
@@ -727,6 +755,8 @@ static inline int sci_rxd_in(struct uart_port *port)
      defined(CONFIG_CPU_SUBTYPE_SH7720) || \
      defined(CONFIG_CPU_SUBTYPE_SH7721)
 #define SCBRR_VALUE(bps, clk) (((clk*2)+16*bps)/(32*bps)-1)
+#elif defined(CONFIG_CPU_SUBTYPE_SH7723)
+#define SCBRR_VALUE(bps, clk) (((clk*2)+16*bps)/(16*bps)-1)
 #elif defined(__H8300H__) || defined(__H8300S__)
 #define SCBRR_VALUE(bps) (((CONFIG_CPU_CLOCK*1000/32)/bps)-1)
 #elif defined(CONFIG_SUPERH64)
diff --git a/fs/ext2/ioctl.c b/fs/ext2/ioctl.c
index b8ea11fee5c6..de876fa793e1 100644
--- a/fs/ext2/ioctl.c
+++ b/fs/ext2/ioctl.c
@@ -12,6 +12,7 @@
 #include <linux/time.h>
 #include <linux/sched.h>
 #include <linux/compat.h>
+#include <linux/mount.h>
 #include <linux/smp_lock.h>
 #include <asm/current.h>
 #include <asm/uaccess.h>
@@ -23,6 +24,7 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        struct ext2_inode_info *ei = EXT2_I(inode);
        unsigned int flags;
        unsigned short rsv_window_size;
+        int ret;
        ext2_debug ("cmd = %u, arg = %lu\n", cmd, arg);
@@ -34,14 +36,19 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        case EXT2_IOC_SETFLAGS: {
                unsigned int oldflags;
-                if (IS_RDONLY(inode))
+                ret = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (ret)
+                        return ret;
-                if (!is_owner_or_cap(inode))
+                if (!is_owner_or_cap(inode)) {
-                        return -EACCES;
+                        ret = -EACCES;
+                        goto setflags_out;
+                }
-                if (get_user(flags, (int __user *) arg))
+                if (get_user(flags, (int __user *) arg)) {
-                        return -EFAULT;
+                        ret = -EFAULT;
+                        goto setflags_out;
+                }
                if (!S_ISDIR(inode->i_mode))
                        flags &= ~EXT2_DIRSYNC_FL;
@@ -50,7 +57,8 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                /* Is it quota file? Do not allow user to mess with it */
                if (IS_NOQUOTA(inode)) {
                        mutex_unlock(&inode->i_mutex);
-                        return -EPERM;
+                        ret = -EPERM;
+                        goto setflags_out;
                }
                oldflags = ei->i_flags;
@@ -63,7 +71,8 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if ((flags ^ oldflags) & (EXT2_APPEND_FL | EXT2_IMMUTABLE_FL)) {
                        if (!capable(CAP_LINUX_IMMUTABLE)) {
                                mutex_unlock(&inode->i_mutex);
-                                return -EPERM;
+                                ret = -EPERM;
+                                goto setflags_out;
                        }
                }
@@ -75,20 +84,26 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                ext2_set_inode_flags(inode);
                inode->i_ctime = CURRENT_TIME_SEC;
                mark_inode_dirty(inode);
-                return 0;
+setflags_out:
+                mnt_drop_write(filp->f_path.mnt);
+                return ret;
        }
        case EXT2_IOC_GETVERSION:
                return put_user(inode->i_generation, (int __user *) arg);
        case EXT2_IOC_SETVERSION:
                if (!is_owner_or_cap(inode))
                        return -EPERM;
-                if (IS_RDONLY(inode))
+                ret = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (ret)
-                if (get_user(inode->i_generation, (int __user *) arg))
+                        return ret;
-                        return -EFAULT; 
+                if (get_user(inode->i_generation, (int __user *) arg)) {
-                inode->i_ctime = CURRENT_TIME_SEC;
+                        ret = -EFAULT;
-                mark_inode_dirty(inode);
+                } else {
-                return 0;
+                        inode->i_ctime = CURRENT_TIME_SEC;
+                        mark_inode_dirty(inode);
+                }
+                mnt_drop_write(filp->f_path.mnt);
+                return ret;
        case EXT2_IOC_GETRSVSZ:
                if (test_opt(inode->i_sb, RESERVATION)
                        && S_ISREG(inode->i_mode)
@@ -102,15 +117,16 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))
                        return -ENOTTY;
-                if (IS_RDONLY(inode))
+                if (!is_owner_or_cap(inode))
-                        return -EROFS;
-                if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
                        return -EACCES;
                if (get_user(rsv_window_size, (int __user *)arg))
                        return -EFAULT;
+                ret = mnt_want_write(filp->f_path.mnt);
+                if (ret)
+                        return ret;
                if (rsv_window_size > EXT2_MAX_RESERVE_BLOCKS)
                        rsv_window_size = EXT2_MAX_RESERVE_BLOCKS;
@@ -131,6 +147,7 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                        rsv->rsv_goal_size = rsv_window_size;
                }
                mutex_unlock(&ei->truncate_mutex);
+                mnt_drop_write(filp->f_path.mnt);
                return 0;
        }
        default:
diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
index 023a070f55f1..0d0c70151642 100644
--- a/fs/ext3/ioctl.c
+++ b/fs/ext3/ioctl.c
@@ -12,6 +12,7 @@
 #include <linux/capability.h>
 #include <linux/ext3_fs.h>
 #include <linux/ext3_jbd.h>
+#include <linux/mount.h>
 #include <linux/time.h>
 #include <linux/compat.h>
 #include <linux/smp_lock.h>
@@ -38,14 +39,19 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                unsigned int oldflags;
                unsigned int jflag;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
+                        return err;
-                if (!is_owner_or_cap(inode))
+                if (!is_owner_or_cap(inode)) {
-                        return -EACCES;
+                        err = -EACCES;
+                        goto flags_out;
+                }
-                if (get_user(flags, (int __user *) arg))
+                if (get_user(flags, (int __user *) arg)) {
-                        return -EFAULT;
+                        err = -EFAULT;
+                        goto flags_out;
+                }
                if (!S_ISDIR(inode->i_mode))
                        flags &= ~EXT3_DIRSYNC_FL;
@@ -54,7 +60,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                /* Is it quota file? Do not allow user to mess with it */
                if (IS_NOQUOTA(inode)) {
                        mutex_unlock(&inode->i_mutex);
-                        return -EPERM;
+                        err = -EPERM;
+                        goto flags_out;
                }
                oldflags = ei->i_flags;
@@ -70,7 +77,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FL)) {
                        if (!capable(CAP_LINUX_IMMUTABLE)) {
                                mutex_unlock(&inode->i_mutex);
-                                return -EPERM;
+                                err = -EPERM;
+                                goto flags_out;
                        }
                }
@@ -81,7 +89,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL)) {
                        if (!capable(CAP_SYS_RESOURCE)) {
                                mutex_unlock(&inode->i_mutex);
-                                return -EPERM;
+                                err = -EPERM;
+                                goto flags_out;
                        }
                }
@@ -89,7 +98,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                handle = ext3_journal_start(inode, 1);
                if (IS_ERR(handle)) {
                        mutex_unlock(&inode->i_mutex);
-                        return PTR_ERR(handle);
+                        err = PTR_ERR(handle);
+                        goto flags_out;
                }
                if (IS_SYNC(inode))
                        handle->h_sync = 1;
@@ -115,6 +125,8 @@ flags_err:
                if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL))
                        err = ext3_change_inode_journal_flag(inode, jflag);
                mutex_unlock(&inode->i_mutex);
+flags_out:
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
        case EXT3_IOC_GETVERSION:
@@ -129,14 +141,18 @@ flags_err:
                if (!is_owner_or_cap(inode))
                        return -EPERM;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
-                if (get_user(generation, (int __user *) arg))
+                        return err;
-                        return -EFAULT;
+                if (get_user(generation, (int __user *) arg)) {
+                        err = -EFAULT;
+                        goto setversion_out;
+                }
                handle = ext3_journal_start(inode, 1);
-                if (IS_ERR(handle))
+                if (IS_ERR(handle)) {
-                        return PTR_ERR(handle);
+                        err = PTR_ERR(handle);
+                        goto setversion_out;
+                }
                err = ext3_reserve_inode_write(handle, inode, &iloc);
                if (err == 0) {
                        inode->i_ctime = CURRENT_TIME_SEC;
@@ -144,6 +160,8 @@ flags_err:
                        err = ext3_mark_iloc_dirty(handle, inode, &iloc);
                }
                ext3_journal_stop(handle);
+setversion_out:
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
 #ifdef CONFIG_JBD_DEBUG
@@ -179,18 +197,24 @@ flags_err:
                }
                return -ENOTTY;
        case EXT3_IOC_SETRSVSZ: {
+                int err;
                if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))
                        return -ENOTTY;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
+                        return err;
-                if (!is_owner_or_cap(inode))
+                if (!is_owner_or_cap(inode)) {
-                        return -EACCES;
+                        err = -EACCES;
+                        goto setrsvsz_out;
+                }
-                if (get_user(rsv_window_size, (int __user *)arg))
+                if (get_user(rsv_window_size, (int __user *)arg)) {
-                        return -EFAULT;
+                        err = -EFAULT;
+                        goto setrsvsz_out;
+                }
                if (rsv_window_size > EXT3_MAX_RESERVE_BLOCKS)
                        rsv_window_size = EXT3_MAX_RESERVE_BLOCKS;
@@ -208,7 +232,9 @@ flags_err:
                        rsv->rsv_goal_size = rsv_window_size;
                }
                mutex_unlock(&ei->truncate_mutex);
-                return 0;
+setrsvsz_out:
+                mnt_drop_write(filp->f_path.mnt);
+                return err;
        }
        case EXT3_IOC_GROUP_EXTEND: {
                ext3_fsblk_t n_blocks_count;
@@ -218,17 +244,20 @@ flags_err:
                if (!capable(CAP_SYS_RESOURCE))
                        return -EPERM;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
+                        return err;
-                if (get_user(n_blocks_count, (__u32 __user *)arg))
-                        return -EFAULT;
+                if (get_user(n_blocks_count, (__u32 __user *)arg)) {
+                        err = -EFAULT;
+                        goto group_extend_out;
+                }
                err = ext3_group_extend(sb, EXT3_SB(sb)->s_es, n_blocks_count);
                journal_lock_updates(EXT3_SB(sb)->s_journal);
                journal_flush(EXT3_SB(sb)->s_journal);
                journal_unlock_updates(EXT3_SB(sb)->s_journal);
+group_extend_out:
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
        case EXT3_IOC_GROUP_ADD: {
@@ -239,18 +268,22 @@ flags_err:
                if (!capable(CAP_SYS_RESOURCE))
                        return -EPERM;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
+                        return err;
                if (copy_from_user(&input, (struct ext3_new_group_input __user *)arg,
-                                sizeof(input)))
+                                sizeof(input))) {
-                        return -EFAULT;
+                        err = -EFAULT;
+                        goto group_add_out;
+                }
                err = ext3_group_add(sb, &input);
                journal_lock_updates(EXT3_SB(sb)->s_journal);
                journal_flush(EXT3_SB(sb)->s_journal);
                journal_unlock_updates(EXT3_SB(sb)->s_journal);
+group_add_out:
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 2ed7c37f897e..25b13ede8086 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -15,6 +15,7 @@
 #include <linux/time.h>
 #include <linux/compat.h>
 #include <linux/smp_lock.h>
+#include <linux/mount.h>
 #include <asm/uaccess.h>
 int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
@@ -38,24 +39,25 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                unsigned int oldflags;
                unsigned int jflag;
-                if (IS_RDONLY(inode))
-                        return -EROFS;
                if (!is_owner_or_cap(inode))
                        return -EACCES;
                if (get_user(flags, (int __user *) arg))
                        return -EFAULT;
+                err = mnt_want_write(filp->f_path.mnt);
+                if (err)
+                        return err;
                if (!S_ISDIR(inode->i_mode))
                        flags &= ~EXT4_DIRSYNC_FL;
+                err = -EPERM;
                mutex_lock(&inode->i_mutex);
                /* Is it quota file? Do not allow user to mess with it */
-                if (IS_NOQUOTA(inode)) {
+                if (IS_NOQUOTA(inode))
-                        mutex_unlock(&inode->i_mutex);
+                        goto flags_out;
-                        return -EPERM;
-                }
                oldflags = ei->i_flags;
                /* The JOURNAL_DATA flag is modifiable only by root */
@@ -68,10 +70,8 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 * This test looks nicer. Thanks to Pauline Middelink
                 */
                if ((flags ^ oldflags) & (EXT4_APPEND_FL | EXT4_IMMUTABLE_FL)) {
-                        if (!capable(CAP_LINUX_IMMUTABLE)) {
+                        if (!capable(CAP_LINUX_IMMUTABLE))
-                                mutex_unlock(&inode->i_mutex);
+                                goto flags_out;
-                                return -EPERM;
-                        }
                }
                /*
@@ -79,17 +79,14 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 * the relevant capability.
                 */
                if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
-                        if (!capable(CAP_SYS_RESOURCE)) {
+                        if (!capable(CAP_SYS_RESOURCE))
-                                mutex_unlock(&inode->i_mutex);
+                                goto flags_out;
-                                return -EPERM;
-                        }
                }
                handle = ext4_journal_start(inode, 1);
                if (IS_ERR(handle)) {
-                        mutex_unlock(&inode->i_mutex);
+                        err = PTR_ERR(handle);
-                        return PTR_ERR(handle);
+                        goto flags_out;
                }
                if (IS_SYNC(inode))
                        handle->h_sync = 1;
@@ -107,14 +104,14 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                err = ext4_mark_iloc_dirty(handle, inode, &iloc);
 flags_err:
                ext4_journal_stop(handle);
-                if (err) {
+                if (err)
-                        mutex_unlock(&inode->i_mutex);
+                        goto flags_out;
-                        return err;
-                }
                if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL))
                        err = ext4_change_inode_journal_flag(inode, jflag);
+flags_out:
                mutex_unlock(&inode->i_mutex);
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
        case EXT4_IOC_GETVERSION:
@@ -129,14 +126,20 @@ flags_err:
                if (!is_owner_or_cap(inode))
                        return -EPERM;
-                if (IS_RDONLY(inode))
-                        return -EROFS;
+                err = mnt_want_write(filp->f_path.mnt);
-                if (get_user(generation, (int __user *) arg))
+                if (err)
-                        return -EFAULT;
+                        return err;
+                if (get_user(generation, (int __user *) arg)) {
+                        err = -EFAULT;
+                        goto setversion_out;
+                }
                handle = ext4_journal_start(inode, 1);
-                if (IS_ERR(handle))
+                if (IS_ERR(handle)) {
-                        return PTR_ERR(handle);
+                        err = PTR_ERR(handle);
+                        goto setversion_out;
+                }
                err = ext4_reserve_inode_write(handle, inode, &iloc);
                if (err == 0) {
                        inode->i_ctime = ext4_current_time(inode);
@@ -144,6 +147,8 @@ flags_err:
                        err = ext4_mark_iloc_dirty(handle, inode, &iloc);
                }
                ext4_journal_stop(handle);
+setversion_out:
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
 #ifdef CONFIG_JBD2_DEBUG
@@ -179,19 +184,21 @@ flags_err:
                }
                return -ENOTTY;
        case EXT4_IOC_SETRSVSZ: {
+                int err;
                if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))
                        return -ENOTTY;
-                if (IS_RDONLY(inode))
-                        return -EROFS;
                if (!is_owner_or_cap(inode))
                        return -EACCES;
                if (get_user(rsv_window_size, (int __user *)arg))
                        return -EFAULT;
+                err = mnt_want_write(filp->f_path.mnt);
+                if (err)
+                        return err;
                if (rsv_window_size > EXT4_MAX_RESERVE_BLOCKS)
                        rsv_window_size = EXT4_MAX_RESERVE_BLOCKS;
@@ -208,6 +215,7 @@ flags_err:
                        rsv->rsv_goal_size = rsv_window_size;
                }
                up_write(&ei->i_data_sem);
+                mnt_drop_write(filp->f_path.mnt);
                return 0;
        }
        case EXT4_IOC_GROUP_EXTEND: {
@@ -218,16 +226,18 @@ flags_err:
                if (!capable(CAP_SYS_RESOURCE))
                        return -EPERM;
-                if (IS_RDONLY(inode))
-                        return -EROFS;
                if (get_user(n_blocks_count, (__u32 __user *)arg))
                        return -EFAULT;
+                err = mnt_want_write(filp->f_path.mnt);
+                if (err)
+                        return err;
                err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
@@ -239,17 +249,19 @@ flags_err:
                if (!capable(CAP_SYS_RESOURCE))
                        return -EPERM;
-                if (IS_RDONLY(inode))
-                        return -EROFS;
                if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,
                                sizeof(input)))
                        return -EFAULT;
+                err = mnt_want_write(filp->f_path.mnt);
+                if (err)
+                        return err;
                err = ext4_group_add(sb, &input);
                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+                mnt_drop_write(filp->f_path.mnt);
                return err;
        }
diff --git a/fs/fat/file.c b/fs/fat/file.c
index c614175876e0..2a3bed967041 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -8,6 +8,7 @@
 #include <linux/capability.h>
 #include <linux/module.h>
+#include <linux/mount.h>
 #include <linux/time.h>
 #include <linux/msdos_fs.h>
 #include <linux/smp_lock.h>
@@ -46,10 +47,9 @@ int fat_generic_ioctl(struct inode *inode, struct file *filp,
                mutex_lock(&inode->i_mutex);
-                if (IS_RDONLY(inode)) {
+                err = mnt_want_write(filp->f_path.mnt);
-                        err = -EROFS;
+                if (err)
-                        goto up;
+                        goto up_no_drop_write;
-                }
                /*
                 * ATTR_VOLUME and ATTR_DIR cannot be changed; this also
@@ -105,7 +105,9 @@ int fat_generic_ioctl(struct inode *inode, struct file *filp,
                MSDOS_I(inode)->i_attrs = attr & ATTR_UNUSED;
                mark_inode_dirty(inode);
-        up:
+up:
+                mnt_drop_write(filp->f_path.mnt);
+up_no_drop_write:
                mutex_unlock(&inode->i_mutex);
                return err;
        }
diff --git a/fs/file_table.c b/fs/file_table.c
index 986ff4ed0a7c..7a0a9b872251 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -42,6 +42,7 @@ static inline void file_free_rcu(struct rcu_head *head)
 static inline void file_free(struct file *f)
 {
        percpu_counter_dec(&nr_files);
+        file_check_state(f);
        call_rcu(&f->f_u.fu_rcuhead, file_free_rcu);
 }
@@ -199,6 +200,18 @@ int init_file(struct file *file, struct vfsmount *mnt, struct dentry *dentry,
        file->f_mapping = dentry->d_inode->i_mapping;
        file->f_mode = mode;
        file->f_op = fop;
+        /*
+         * These mounts don't really matter in practice
+         * for r/o bind mounts.  They aren't userspace-
+         * visible.  We do this for consistency, and so
+         * that we can do debugging checks at __fput()
+         */
+        if ((mode & FMODE_WRITE) && !special_file(dentry->d_inode->i_mode)) {
+                file_take_write(file);
+                error = mnt_want_write(mnt);
+                WARN_ON(error);
+        }
        return error;
 }
 EXPORT_SYMBOL(init_file);
@@ -211,6 +224,31 @@ void fput(struct file *file)
 EXPORT_SYMBOL(fput);
+/**
+ * drop_file_write_access - give up ability to write to a file
+ * @file: the file to which we will stop writing
+ *
+ * This is a central place which will give up the ability
+ * to write to @file, along with access to write through
+ * its vfsmount.
+ */
+void drop_file_write_access(struct file *file)
+{
+        struct vfsmount *mnt = file->f_path.mnt;
+        struct dentry *dentry = file->f_path.dentry;
+        struct inode *inode = dentry->d_inode;
+        put_write_access(inode);
+        if (special_file(inode->i_mode))
+                return;
+        if (file_check_writeable(file) != 0)
+                return;
+        mnt_drop_write(mnt);
+        file_release_write(file);
+}
+EXPORT_SYMBOL_GPL(drop_file_write_access);
 /* __fput is called from task context when aio completion releases the last
 * last use of a struct file *.  Do not use otherwise.
 */
@@ -236,10 +274,10 @@ void __fput(struct file *file)
        if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
                cdev_put(inode->i_cdev);
        fops_put(file->f_op);
-        if (file->f_mode & FMODE_WRITE)
-                put_write_access(inode);
        put_pid(file->f_owner.pid);
        file_kill(file);
+        if (file->f_mode & FMODE_WRITE)
+                drop_file_write_access(file);
        file->f_path.dentry = NULL;
        file->f_path.mnt = NULL;
        file_free(file);
diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c
index b60c0affbec5..f457d2ca51ab 100644
--- a/fs/hfsplus/ioctl.c
+++ b/fs/hfsplus/ioctl.c
@@ -14,6 +14,7 @@
 #include <linux/capability.h>
 #include <linux/fs.h>
+#include <linux/mount.h>
 #include <linux/sched.h>
 #include <linux/xattr.h>
 #include <asm/uaccess.h>
@@ -35,25 +36,32 @@ int hfsplus_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                        flags |= FS_NODUMP_FL; /* EXT2_NODUMP_FL */
                return put_user(flags, (int __user *)arg);
        case HFSPLUS_IOC_EXT2_SETFLAGS: {
-                if (IS_RDONLY(inode))
+                int err = 0;
-                        return -EROFS;
+                err = mnt_want_write(filp->f_path.mnt);
+                if (err)
-                if (!is_owner_or_cap(inode))
+                        return err;
-                        return -EACCES;
+                if (!is_owner_or_cap(inode)) {
-                if (get_user(flags, (int __user *)arg))
+                        err = -EACCES;
-                        return -EFAULT;
+                        goto setflags_out;
+                }
+                if (get_user(flags, (int __user *)arg)) {
+                        err = -EFAULT;
+                        goto setflags_out;
+                }
                if (flags & (FS_IMMUTABLE_FL|FS_APPEND_FL) ||
                    HFSPLUS_I(inode).rootflags & (HFSPLUS_FLG_IMMUTABLE|HFSPLUS_FLG_APPEND)) {
-                        if (!capable(CAP_LINUX_IMMUTABLE))
+                        if (!capable(CAP_LINUX_IMMUTABLE)) {
-                                return -EPERM;
+                                err = -EPERM;
+                                goto setflags_out;
+                        }
                }
                /* don't silently ignore unsupported ext2 flags */
-                if (flags & ~(FS_IMMUTABLE_FL|FS_APPEND_FL|FS_NODUMP_FL))
+                if (flags & ~(FS_IMMUTABLE_FL|FS_APPEND_FL|FS_NODUMP_FL)) {
-                        return -EOPNOTSUPP;
+                        err = -EOPNOTSUPP;
+                        goto setflags_out;
+                }
                if (flags & FS_IMMUTABLE_FL) { /* EXT2_IMMUTABLE_FL */
                        inode->i_flags |= S_IMMUTABLE;
                        HFSPLUS_I(inode).rootflags |= HFSPLUS_FLG_IMMUTABLE;
@@ -75,7 +83,9 @@ int hfsplus_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                inode->i_ctime = CURRENT_TIME_SEC;
                mark_inode_dirty(inode);
-                return 0;
+setflags_out:
+                mnt_drop_write(filp->f_path.mnt);
+                return err;
        }
        default:
                return -ENOTTY;
diff --git a/fs/inode.c b/fs/inode.c
index 53245ffcf93d..27ee1af50d02 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1199,42 +1199,37 @@ void touch_atime(struct vfsmount *mnt, struct dentry *dentry)
        struct inode *inode = dentry->d_inode;
        struct timespec now;
-        if (inode->i_flags & S_NOATIME)
+        if (mnt_want_write(mnt))
                return;
+        if (inode->i_flags & S_NOATIME)
+                goto out;
        if (IS_NOATIME(inode))
-                return;
+                goto out;
        if ((inode->i_sb->s_flags & MS_NODIRATIME) && S_ISDIR(inode->i_mode))
-                return;
+                goto out;
-        /*
+        if (mnt->mnt_flags & MNT_NOATIME)
-         * We may have a NULL vfsmount when coming from NFSD
+                goto out;
-         */
+        if ((mnt->mnt_flags & MNT_NODIRATIME) && S_ISDIR(inode->i_mode))
-        if (mnt) {
+                goto out;
-                if (mnt->mnt_flags & MNT_NOATIME)
+        if (mnt->mnt_flags & MNT_RELATIME) {
-                        return;
+                /*
-                if ((mnt->mnt_flags & MNT_NODIRATIME) && S_ISDIR(inode->i_mode))
+                 * With relative atime, only update atime if the previous
-                        return;
+                 * atime is earlier than either the ctime or mtime.
+                 */
-                if (mnt->mnt_flags & MNT_RELATIME) {
+                if (timespec_compare(&inode->i_mtime, &inode->i_atime) < 0 &&
-                        /*
+                    timespec_compare(&inode->i_ctime, &inode->i_atime) < 0)
-                         * With relative atime, only update atime if the
+                        goto out;
-                         * previous atime is earlier than either the ctime or
-                         * mtime.
-                         */
-                        if (timespec_compare(&inode->i_mtime,
-                                                &inode->i_atime) < 0 &&
-                            timespec_compare(&inode->i_ctime,
-                                                &inode->i_atime) < 0)
-                                return;
-                }
        }
        now = current_fs_time(inode->i_sb);
        if (timespec_equal(&inode->i_atime, &now))
-                return;
+                goto out;
        inode->i_atime = now;
        mark_inode_dirty_sync(inode);
+out:
+        mnt_drop_write(mnt);
 }
 EXPORT_SYMBOL(touch_atime);
@@ -1255,10 +1250,13 @@ void file_update_time(struct file *file)
        struct inode *inode = file->f_path.dentry->d_inode;
        struct timespec now;
        int sync_it = 0;
+        int err;
        if (IS_NOCMTIME(inode))
                return;
-        if (IS_RDONLY(inode))
+        err = mnt_want_write(file->f_path.mnt);
+        if (err)
                return;
        now = current_fs_time(inode->i_sb);
@@ -1279,6 +1277,7 @@ void file_update_time(struct file *file)
        if (sync_it)
                mark_inode_dirty_sync(inode);
+        mnt_drop_write(file->f_path.mnt);
 }
 EXPORT_SYMBOL(file_update_time);
diff --git a/fs/jfs/ioctl.c b/fs/jfs/ioctl.c
index a1f8e375ad21..afe222bf300f 100644
--- a/fs/jfs/ioctl.c
+++ b/fs/jfs/ioctl.c
@@ -8,6 +8,7 @@
 #include <linux/fs.h>
 #include <linux/ctype.h>
 #include <linux/capability.h>
+#include <linux/mount.h>
 #include <linux/time.h>
 #include <linux/sched.h>
 #include <asm/current.h>
@@ -65,23 +66,30 @@ long jfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                return put_user(flags, (int __user *) arg);
        case JFS_IOC_SETFLAGS: {
                unsigned int oldflags;
+                int err;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
+                        return err;
-                if (!is_owner_or_cap(inode))
+                if (!is_owner_or_cap(inode)) {
-                        return -EACCES;
+                        err = -EACCES;
+                        goto setflags_out;
-                if (get_user(flags, (int __user *) arg))
+                }
-                        return -EFAULT;
+                if (get_user(flags, (int __user *) arg)) {
+                        err = -EFAULT;
+                        goto setflags_out;
+                }
                flags = jfs_map_ext2(flags, 1);
                if (!S_ISDIR(inode->i_mode))
                        flags &= ~JFS_DIRSYNC_FL;
                /* Is it quota file? Do not allow user to mess with it */
-                if (IS_NOQUOTA(inode))
+                if (IS_NOQUOTA(inode)) {
-                        return -EPERM;
+                        err = -EPERM;
+                        goto setflags_out;
+                }
                /* Lock against other parallel changes of flags */
                mutex_lock(&inode->i_mutex);
@@ -98,7 +106,8 @@ long jfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                        (JFS_APPEND_FL | JFS_IMMUTABLE_FL))) {
                        if (!capable(CAP_LINUX_IMMUTABLE)) {
                                mutex_unlock(&inode->i_mutex);
-                                return -EPERM;
+                                err = -EPERM;
+                                goto setflags_out;
                        }
                }
@@ -110,7 +119,9 @@ long jfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                mutex_unlock(&inode->i_mutex);
                inode->i_ctime = CURRENT_TIME_SEC;
                mark_inode_dirty(inode);
-                return 0;
+setflags_out:
+                mnt_drop_write(filp->f_path.mnt);
+                return err;
        }
        default:
                return -ENOTTY;
diff --git a/fs/namei.c b/fs/namei.c
index 8cf9bb9c2fc0..e179f71bfcb0 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1623,8 +1623,7 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
                        return -EACCES;
                flag &= ~O_TRUNC;
-        } else if (IS_RDONLY(inode) && (acc_mode & MAY_WRITE))
+        }
-                return -EROFS;
        error = vfs_permission(nd, acc_mode);
        if (error)
@@ -1677,7 +1676,12 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
        return 0;
 }
-static int open_namei_create(struct nameidata *nd, struct path *path,
+/*
+ * Be careful about ever adding any more callers of this
+ * function.  Its flags must be in the namei format, not
+ * what get passed to sys_open().
+ */
+static int __open_namei_create(struct nameidata *nd, struct path *path,
                                int flag, int mode)
 {
        int error;
@@ -1696,26 +1700,56 @@ static int open_namei_create(struct nameidata *nd, struct path *path,
 }
 /*
- *      open_namei()
+ * Note that while the flag value (low two bits) for sys_open means:
+ *      00 - read-only
+ *      01 - write-only
+ *      10 - read-write
+ *      11 - special
+ * it is changed into
+ *      00 - no permissions needed
+ *      01 - read-permission
+ *      10 - write-permission
+ *      11 - read-write
+ * for the internal routines (ie open_namei()/follow_link() etc)
+ * This is more logical, and also allows the 00 "no perm needed"
+ * to be used for symlinks (where the permissions are checked
+ * later).
 *
- * namei for open - this is in fact almost the whole open-routine.
+*/
- *
+static inline int open_to_namei_flags(int flag)
- * Note that the low bits of "flag" aren't the same as in the open
+{
- * system call - they are 00 - no permissions needed
+        if ((flag+1) & O_ACCMODE)
- *                        01 - read permission needed
+                flag++;
- *                        10 - write permission needed
+        return flag;
- *                        11 - read/write permissions needed
+}
- * which is a lot more logical, and also allows the "no perm" needed
- * for symlinks (where the permissions are checked later).
+static int open_will_write_to_fs(int flag, struct inode *inode)
- * SMP-safe
+{
+        /*
+         * We'll never write to the fs underlying
+         * a device file.
+         */
+        if (special_file(inode->i_mode))
+                return 0;
+        return (flag & O_TRUNC);
+}
+/*
+ * Note that the low bits of the passed in "open_flag"
+ * are not the same as in the local variable "flag". See
+ * open_to_namei_flags() for more details.
 */
-int open_namei(int dfd, const char *pathname, int flag,
+struct file *do_filp_open(int dfd, const char *pathname,
-                int mode, struct nameidata *nd)
+                int open_flag, int mode)
 {
+        struct file *filp;
+        struct nameidata nd;
        int acc_mode, error;
        struct path path;
        struct dentry *dir;
        int count = 0;
+        int will_write;
+        int flag = open_to_namei_flags(open_flag);
        acc_mode = ACC_MODE(flag);
@@ -1733,18 +1767,19 @@ int open_namei(int dfd, const char *pathname, int flag,
         */
        if (!(flag & O_CREAT)) {
                error = path_lookup_open(dfd, pathname, lookup_flags(flag),
-                                         nd, flag);
+                                         &nd, flag);
                if (error)
-                        return error;
+                        return ERR_PTR(error);
                goto ok;
        }
        /*
         * Create - we need to know the parent.
         */
-        error = path_lookup_create(dfd,pathname,LOOKUP_PARENT,nd,flag,mode);
+        error = path_lookup_create(dfd, pathname, LOOKUP_PARENT,
+                                   &nd, flag, mode);
        if (error)
-                return error;
+                return ERR_PTR(error);
        /*
         * We have the parent and last component. First of all, check
@@ -1752,14 +1787,14 @@ int open_namei(int dfd, const char *pathname, int flag,
         * will not do.
         */
        error = -EISDIR;
-        if (nd->last_type != LAST_NORM || nd->last.name[nd->last.len])
+        if (nd.last_type != LAST_NORM || nd.last.name[nd.last.len])
                goto exit;
-        dir = nd->path.dentry;
+        dir = nd.path.dentry;
-        nd->flags &= ~LOOKUP_PARENT;
+        nd.flags &= ~LOOKUP_PARENT;
        mutex_lock(&dir->d_inode->i_mutex);
-        path.dentry = lookup_hash(nd);
+        path.dentry = lookup_hash(&nd);
-        path.mnt = nd->path.mnt;
+        path.mnt = nd.path.mnt;
 do_last:
        error = PTR_ERR(path.dentry);
@@ -1768,18 +1803,31 @@ do_last:
                goto exit;
        }
-        if (IS_ERR(nd->intent.open.file)) {
+        if (IS_ERR(nd.intent.open.file)) {
-                mutex_unlock(&dir->d_inode->i_mutex);
+                error = PTR_ERR(nd.intent.open.file);
-                error = PTR_ERR(nd->intent.open.file);
+                goto exit_mutex_unlock;
-                goto exit_dput;
        }
        /* Negative dentry, just create the file */
        if (!path.dentry->d_inode) {
-                error = open_namei_create(nd, &path, flag, mode);
+                /*
+                 * This write is needed to ensure that a
+                 * ro->rw transition does not occur between
+                 * the time when the file is created and when
+                 * a permanent write count is taken through
+                 * the 'struct file' in nameidata_to_filp().
+                 */
+                error = mnt_want_write(nd.path.mnt);
                if (error)
+                        goto exit_mutex_unlock;
+                error = __open_namei_create(&nd, &path, flag, mode);
+                if (error) {
+                        mnt_drop_write(nd.path.mnt);
                        goto exit;
-                return 0;
+                }
+                filp = nameidata_to_filp(&nd, open_flag);
+                mnt_drop_write(nd.path.mnt);
+                return filp;
        }
        /*
@@ -1804,23 +1852,52 @@ do_last:
        if (path.dentry->d_inode->i_op && path.dentry->d_inode->i_op->follow_link)
                goto do_link;
-        path_to_nameidata(&path, nd);
+        path_to_nameidata(&path, &nd);
        error = -EISDIR;
        if (path.dentry->d_inode && S_ISDIR(path.dentry->d_inode->i_mode))
                goto exit;
 ok:
-        error = may_open(nd, acc_mode, flag);
+        /*
-        if (error)
+         * Consider:
+         * 1. may_open() truncates a file
+         * 2. a rw->ro mount transition occurs
+         * 3. nameidata_to_filp() fails due to
+         *    the ro mount.
+         * That would be inconsistent, and should
+         * be avoided. Taking this mnt write here
+         * ensures that (2) can not occur.
+         */
+        will_write = open_will_write_to_fs(flag, nd.path.dentry->d_inode);
+        if (will_write) {
+                error = mnt_want_write(nd.path.mnt);
+                if (error)
+                        goto exit;
+        }
+        error = may_open(&nd, acc_mode, flag);
+        if (error) {
+                if (will_write)
+                        mnt_drop_write(nd.path.mnt);
                goto exit;
-        return 0;
+        }
+        filp = nameidata_to_filp(&nd, open_flag);
+        /*
+         * It is now safe to drop the mnt write
+         * because the filp has had a write taken
+         * on its behalf.
+         */
+        if (will_write)
+                mnt_drop_write(nd.path.mnt);
+        return filp;
+exit_mutex_unlock:
+        mutex_unlock(&dir->d_inode->i_mutex);
 exit_dput:
-        path_put_conditional(&path, nd);
+        path_put_conditional(&path, &nd);
 exit:
-        if (!IS_ERR(nd->intent.open.file))
+        if (!IS_ERR(nd.intent.open.file))
-                release_open_intent(nd);
+                release_open_intent(&nd);
-        path_put(&nd->path);
+        path_put(&nd.path);
-        return error;
+        return ERR_PTR(error);
 do_link:
        error = -ELOOP;
@@ -1836,43 +1913,60 @@ do_link:
         * stored in nd->last.name and we will have to putname() it when we
         * are done. Procfs-like symlinks just set LAST_BIND.
         */
-        nd->flags |= LOOKUP_PARENT;
+        nd.flags |= LOOKUP_PARENT;
-        error = security_inode_follow_link(path.dentry, nd);
+        error = security_inode_follow_link(path.dentry, &nd);
        if (error)
                goto exit_dput;
-        error = __do_follow_link(&path, nd);
+        error = __do_follow_link(&path, &nd);
        if (error) {
                /* Does someone understand code flow here? Or it is only
                 * me so stupid? Anathema to whoever designed this non-sense
                 * with "intent.open".
                 */
-                release_open_intent(nd);
+                release_open_intent(&nd);
-                return error;
+                return ERR_PTR(error);
        }
-        nd->flags &= ~LOOKUP_PARENT;
+        nd.flags &= ~LOOKUP_PARENT;
-        if (nd->last_type == LAST_BIND)
+        if (nd.last_type == LAST_BIND)
                goto ok;
        error = -EISDIR;
-        if (nd->last_type != LAST_NORM)
+        if (nd.last_type != LAST_NORM)
                goto exit;
-        if (nd->last.name[nd->last.len]) {
+        if (nd.last.name[nd.last.len]) {
-                __putname(nd->last.name);
+                __putname(nd.last.name);
                goto exit;
        }
        error = -ELOOP;
        if (count++==32) {
-                __putname(nd->last.name);
+                __putname(nd.last.name);
                goto exit;
        }
-        dir = nd->path.dentry;
+        dir = nd.path.dentry;
        mutex_lock(&dir->d_inode->i_mutex);
-        path.dentry = lookup_hash(nd);
+        path.dentry = lookup_hash(&nd);
-        path.mnt = nd->path.mnt;
+        path.mnt = nd.path.mnt;
-        __putname(nd->last.name);
+        __putname(nd.last.name);
        goto do_last;
 }
 /**
+ * filp_open - open file and return file pointer
+ *
+ * @filename:   path to open
+ * @flags:      open flags as per the open(2) second argument
+ * @mode:       mode for the new file if O_CREAT is set, else ignored
+ *
+ * This is the helper to open a file from kernelspace if you really
+ * have to.  But in generally you should not do this, so please move
+ * along, nothing to see here..
+ */
+struct file *filp_open(const char *filename, int flags, int mode)
+{
+        return do_filp_open(AT_FDCWD, filename, flags, mode);
+}
+EXPORT_SYMBOL(filp_open);
+/**
 * lookup_create - lookup a dentry, creating it if it doesn't exist
 * @nd: nameidata info
 * @is_dir: directory flag
@@ -1945,6 +2039,23 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
        return error;
 }
+static int may_mknod(mode_t mode)
+{
+        switch (mode & S_IFMT) {
+        case S_IFREG:
+        case S_IFCHR:
+        case S_IFBLK:
+        case S_IFIFO:
+        case S_IFSOCK:
+        case 0: /* zero mode translates to S_IFREG */
+                return 0;
+        case S_IFDIR:
+                return -EPERM;
+        default:
+                return -EINVAL;
+        }
+}
 asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
                                unsigned dev)
 {
@@ -1963,12 +2074,19 @@ asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
        if (error)
                goto out;
        dentry = lookup_create(&nd, 0);
-        error = PTR_ERR(dentry);
+        if (IS_ERR(dentry)) {
+                error = PTR_ERR(dentry);
+                goto out_unlock;
+        }
        if (!IS_POSIXACL(nd.path.dentry->d_inode))
                mode &= ~current->fs->umask;
-        if (!IS_ERR(dentry)) {
+        error = may_mknod(mode);
-                switch (mode & S_IFMT) {
+        if (error)
+                goto out_dput;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_dput;
+        switch (mode & S_IFMT) {
                case 0: case S_IFREG:
                        error = vfs_create(nd.path.dentry->d_inode,dentry,mode,&nd);
                        break;
@@ -1979,14 +2097,11 @@ asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
                case S_IFIFO: case S_IFSOCK:
                        error = vfs_mknod(nd.path.dentry->d_inode,dentry,mode,0);
                        break;
-                case S_IFDIR:
-                        error = -EPERM;
-                        break;
-                default:
-                        error = -EINVAL;
-                }
-                dput(dentry);
        }
+        mnt_drop_write(nd.path.mnt);
+out_dput:
+        dput(dentry);
+out_unlock:
        mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
        path_put(&nd.path);
 out:
@@ -2044,7 +2159,12 @@ asmlinkage long sys_mkdirat(int dfd, const char __user *pathname, int mode)
        if (!IS_POSIXACL(nd.path.dentry->d_inode))
                mode &= ~current->fs->umask;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_dput;
        error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
+        mnt_drop_write(nd.path.mnt);
+out_dput:
        dput(dentry);
 out_unlock:
        mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
@@ -2151,7 +2271,12 @@ static long do_rmdir(int dfd, const char __user *pathname)
        error = PTR_ERR(dentry);
        if (IS_ERR(dentry))
                goto exit2;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto exit3;
        error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
+        mnt_drop_write(nd.path.mnt);
+exit3:
        dput(dentry);
 exit2:
        mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
@@ -2232,7 +2357,11 @@ static long do_unlinkat(int dfd, const char __user *pathname)
                inode = dentry->d_inode;
                if (inode)
                        atomic_inc(&inode->i_count);
+                error = mnt_want_write(nd.path.mnt);
+                if (error)
+                        goto exit2;
                error = vfs_unlink(nd.path.dentry->d_inode, dentry);
+                mnt_drop_write(nd.path.mnt);
        exit2:
                dput(dentry);
        }
@@ -2313,7 +2442,12 @@ asmlinkage long sys_symlinkat(const char __user *oldname,
        if (IS_ERR(dentry))
                goto out_unlock;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_dput;
        error = vfs_symlink(nd.path.dentry->d_inode, dentry, from, S_IALLUGO);
+        mnt_drop_write(nd.path.mnt);
+out_dput:
        dput(dentry);
 out_unlock:
        mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
@@ -2408,7 +2542,12 @@ asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
        error = PTR_ERR(new_dentry);
        if (IS_ERR(new_dentry))
                goto out_unlock;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_dput;
        error = vfs_link(old_nd.path.dentry, nd.path.dentry->d_inode, new_dentry);
+        mnt_drop_write(nd.path.mnt);
+out_dput:
        dput(new_dentry);
 out_unlock:
        mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
@@ -2634,8 +2773,12 @@ static int do_rename(int olddfd, const char *oldname,
        if (new_dentry == trap)
                goto exit5;
+        error = mnt_want_write(oldnd.path.mnt);
+        if (error)
+                goto exit5;
        error = vfs_rename(old_dir->d_inode, old_dentry,
                                   new_dir->d_inode, new_dentry);
+        mnt_drop_write(oldnd.path.mnt);
 exit5:
        dput(new_dentry);
 exit4:
diff --git a/fs/namespace.c b/fs/namespace.c
index 94f026ec990a..678f7ce060f2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -17,6 +17,7 @@
 #include <linux/quotaops.h>
 #include <linux/acct.h>
 #include <linux/capability.h>
+#include <linux/cpumask.h>
 #include <linux/module.h>
 #include <linux/sysfs.h>
 #include <linux/seq_file.h>
@@ -55,6 +56,8 @@ static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
        return tmp & (HASH_SIZE - 1);
 }
+#define MNT_WRITER_UNDERFLOW_LIMIT -(1<<16)
 struct vfsmount *alloc_vfsmnt(const char *name)
 {
        struct vfsmount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
@@ -68,6 +71,7 @@ struct vfsmount *alloc_vfsmnt(const char *name)
                INIT_LIST_HEAD(&mnt->mnt_share);
                INIT_LIST_HEAD(&mnt->mnt_slave_list);
                INIT_LIST_HEAD(&mnt->mnt_slave);
+                atomic_set(&mnt->__mnt_writers, 0);
                if (name) {
                        int size = strlen(name) + 1;
                        char *newname = kmalloc(size, GFP_KERNEL);
@@ -80,6 +84,263 @@ struct vfsmount *alloc_vfsmnt(const char *name)
        return mnt;
 }
+/*
+ * Most r/o checks on a fs are for operations that take
+ * discrete amounts of time, like a write() or unlink().
+ * We must keep track of when those operations start
+ * (for permission checks) and when they end, so that
+ * we can determine when writes are able to occur to
+ * a filesystem.
+ */
+/*
+ * __mnt_is_readonly: check whether a mount is read-only
+ * @mnt: the mount to check for its write status
+ *
+ * This shouldn't be used directly ouside of the VFS.
+ * It does not guarantee that the filesystem will stay
+ * r/w, just that it is right *now*.  This can not and
+ * should not be used in place of IS_RDONLY(inode).
+ * mnt_want/drop_write() will _keep_ the filesystem
+ * r/w.
+ */
+int __mnt_is_readonly(struct vfsmount *mnt)
+{
+        if (mnt->mnt_flags & MNT_READONLY)
+                return 1;
+        if (mnt->mnt_sb->s_flags & MS_RDONLY)
+                return 1;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(__mnt_is_readonly);
+struct mnt_writer {
+        /*
+         * If holding multiple instances of this lock, they
+         * must be ordered by cpu number.
+         */
+        spinlock_t lock;
+        struct lock_class_key lock_class; /* compiles out with !lockdep */
+        unsigned long count;
+        struct vfsmount *mnt;
+} ____cacheline_aligned_in_smp;
+static DEFINE_PER_CPU(struct mnt_writer, mnt_writers);
+static int __init init_mnt_writers(void)
+{
+        int cpu;
+        for_each_possible_cpu(cpu) {
+                struct mnt_writer *writer = &per_cpu(mnt_writers, cpu);
+                spin_lock_init(&writer->lock);
+                lockdep_set_class(&writer->lock, &writer->lock_class);
+                writer->count = 0;
+        }
+        return 0;
+}
+fs_initcall(init_mnt_writers);
+static void unlock_mnt_writers(void)
+{
+        int cpu;
+        struct mnt_writer *cpu_writer;
+        for_each_possible_cpu(cpu) {
+                cpu_writer = &per_cpu(mnt_writers, cpu);
+                spin_unlock(&cpu_writer->lock);
+        }
+}
+static inline void __clear_mnt_count(struct mnt_writer *cpu_writer)
+{
+        if (!cpu_writer->mnt)
+                return;
+        /*
+         * This is in case anyone ever leaves an invalid,
+         * old ->mnt and a count of 0.
+         */
+        if (!cpu_writer->count)
+                return;
+        atomic_add(cpu_writer->count, &cpu_writer->mnt->__mnt_writers);
+        cpu_writer->count = 0;
+}
+ /*
+ * must hold cpu_writer->lock
+ */
+static inline void use_cpu_writer_for_mount(struct mnt_writer *cpu_writer,
+                                          struct vfsmount *mnt)
+{
+        if (cpu_writer->mnt == mnt)
+                return;
+        __clear_mnt_count(cpu_writer);
+        cpu_writer->mnt = mnt;
+}
+/*
+ * Most r/o checks on a fs are for operations that take
+ * discrete amounts of time, like a write() or unlink().
+ * We must keep track of when those operations start
+ * (for permission checks) and when they end, so that
+ * we can determine when writes are able to occur to
+ * a filesystem.
+ */
+/**
+ * mnt_want_write - get write access to a mount
+ * @mnt: the mount on which to take a write
+ *
+ * This tells the low-level filesystem that a write is
+ * about to be performed to it, and makes sure that
+ * writes are allowed before returning success.  When
+ * the write operation is finished, mnt_drop_write()
+ * must be called.  This is effectively a refcount.
+ */
+int mnt_want_write(struct vfsmount *mnt)
+{
+        int ret = 0;
+        struct mnt_writer *cpu_writer;
+        cpu_writer = &get_cpu_var(mnt_writers);
+        spin_lock(&cpu_writer->lock);
+        if (__mnt_is_readonly(mnt)) {
+                ret = -EROFS;
+                goto out;
+        }
+        use_cpu_writer_for_mount(cpu_writer, mnt);
+        cpu_writer->count++;
+out:
+        spin_unlock(&cpu_writer->lock);
+        put_cpu_var(mnt_writers);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(mnt_want_write);
+static void lock_mnt_writers(void)
+{
+        int cpu;
+        struct mnt_writer *cpu_writer;
+        for_each_possible_cpu(cpu) {
+                cpu_writer = &per_cpu(mnt_writers, cpu);
+                spin_lock(&cpu_writer->lock);
+                __clear_mnt_count(cpu_writer);
+                cpu_writer->mnt = NULL;
+        }
+}
+/*
+ * These per-cpu write counts are not guaranteed to have
+ * matched increments and decrements on any given cpu.
+ * A file open()ed for write on one cpu and close()d on
+ * another cpu will imbalance this count.  Make sure it
+ * does not get too far out of whack.
+ */
+static void handle_write_count_underflow(struct vfsmount *mnt)
+{
+        if (atomic_read(&mnt->__mnt_writers) >=
+            MNT_WRITER_UNDERFLOW_LIMIT)
+                return;
+        /*
+         * It isn't necessary to hold all of the locks
+         * at the same time, but doing it this way makes
+         * us share a lot more code.
+         */
+        lock_mnt_writers();
+        /*
+         * vfsmount_lock is for mnt_flags.
+         */
+        spin_lock(&vfsmount_lock);
+        /*
+         * If coalescing the per-cpu writer counts did not
+         * get us back to a positive writer count, we have
+         * a bug.
+         */
+        if ((atomic_read(&mnt->__mnt_writers) < 0) &&
+            !(mnt->mnt_flags & MNT_IMBALANCED_WRITE_COUNT)) {
+                printk(KERN_DEBUG "leak detected on mount(%p) writers "
+                                "count: %d\n",
+                        mnt, atomic_read(&mnt->__mnt_writers));
+                WARN_ON(1);
+                /* use the flag to keep the dmesg spam down */
+                mnt->mnt_flags |= MNT_IMBALANCED_WRITE_COUNT;
+        }
+        spin_unlock(&vfsmount_lock);
+        unlock_mnt_writers();
+}
+/**
+ * mnt_drop_write - give up write access to a mount
+ * @mnt: the mount on which to give up write access
+ *
+ * Tells the low-level filesystem that we are done
+ * performing writes to it.  Must be matched with
+ * mnt_want_write() call above.
+ */
+void mnt_drop_write(struct vfsmount *mnt)
+{
+        int must_check_underflow = 0;
+        struct mnt_writer *cpu_writer;
+        cpu_writer = &get_cpu_var(mnt_writers);
+        spin_lock(&cpu_writer->lock);
+        use_cpu_writer_for_mount(cpu_writer, mnt);
+        if (cpu_writer->count > 0) {
+                cpu_writer->count--;
+        } else {
+                must_check_underflow = 1;
+                atomic_dec(&mnt->__mnt_writers);
+        }
+        spin_unlock(&cpu_writer->lock);
+        /*
+         * Logically, we could call this each time,
+         * but the __mnt_writers cacheline tends to
+         * be cold, and makes this expensive.
+         */
+        if (must_check_underflow)
+                handle_write_count_underflow(mnt);
+        /*
+         * This could be done right after the spinlock
+         * is taken because the spinlock keeps us on
+         * the cpu, and disables preemption.  However,
+         * putting it here bounds the amount that
+         * __mnt_writers can underflow.  Without it,
+         * we could theoretically wrap __mnt_writers.
+         */
+        put_cpu_var(mnt_writers);
+}
+EXPORT_SYMBOL_GPL(mnt_drop_write);
+static int mnt_make_readonly(struct vfsmount *mnt)
+{
+        int ret = 0;
+        lock_mnt_writers();
+        /*
+         * With all the locks held, this value is stable
+         */
+        if (atomic_read(&mnt->__mnt_writers) > 0) {
+                ret = -EBUSY;
+                goto out;
+        }
+        /*
+         * nobody can do a successful mnt_want_write() with all
+         * of the counts in MNT_DENIED_WRITE and the locks held.
+         */
+        spin_lock(&vfsmount_lock);
+        if (!ret)
+                mnt->mnt_flags |= MNT_READONLY;
+        spin_unlock(&vfsmount_lock);
+out:
+        unlock_mnt_writers();
+        return ret;
+}
+static void __mnt_unmake_readonly(struct vfsmount *mnt)
+{
+        spin_lock(&vfsmount_lock);
+        mnt->mnt_flags &= ~MNT_READONLY;
+        spin_unlock(&vfsmount_lock);
+}
 int simple_set_mnt(struct vfsmount *mnt, struct super_block *sb)
 {
        mnt->mnt_sb = sb;
@@ -271,7 +532,36 @@ static struct vfsmount *clone_mnt(struct vfsmount *old, struct dentry *root,
 static inline void __mntput(struct vfsmount *mnt)
 {
+        int cpu;
        struct super_block *sb = mnt->mnt_sb;
+        /*
+         * We don't have to hold all of the locks at the
+         * same time here because we know that we're the
+         * last reference to mnt and that no new writers
+         * can come in.
+         */
+        for_each_possible_cpu(cpu) {
+                struct mnt_writer *cpu_writer = &per_cpu(mnt_writers, cpu);
+                if (cpu_writer->mnt != mnt)
+                        continue;
+                spin_lock(&cpu_writer->lock);
+                atomic_add(cpu_writer->count, &mnt->__mnt_writers);
+                cpu_writer->count = 0;
+                /*
+                 * Might as well do this so that no one
+                 * ever sees the pointer and expects
+                 * it to be valid.
+                 */
+                cpu_writer->mnt = NULL;
+                spin_unlock(&cpu_writer->lock);
+        }
+        /*
+         * This probably indicates that somebody messed
+         * up a mnt_want/drop_write() pair.  If this
+         * happens, the filesystem was probably unable
+         * to make r/w->r/o transitions.
+         */
+        WARN_ON(atomic_read(&mnt->__mnt_writers));
        dput(mnt->mnt_root);
        free_vfsmnt(mnt);
        deactivate_super(sb);
@@ -417,7 +707,7 @@ static int show_vfsmnt(struct seq_file *m, void *v)
                seq_putc(m, '.');
                mangle(m, mnt->mnt_sb->s_subtype);
        }
-        seq_puts(m, mnt->mnt_sb->s_flags & MS_RDONLY ? " ro" : " rw");
+        seq_puts(m, __mnt_is_readonly(mnt) ? " ro" : " rw");
        for (fs_infop = fs_info; fs_infop->flag; fs_infop++) {
                if (mnt->mnt_sb->s_flags & fs_infop->flag)
                        seq_puts(m, fs_infop->str);
@@ -1019,6 +1309,23 @@ out:
        return err;
 }
+static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
+{
+        int error = 0;
+        int readonly_request = 0;
+        if (ms_flags & MS_RDONLY)
+                readonly_request = 1;
+        if (readonly_request == __mnt_is_readonly(mnt))
+                return 0;
+        if (readonly_request)
+                error = mnt_make_readonly(mnt);
+        else
+                __mnt_unmake_readonly(mnt);
+        return error;
+}
 /*
 * change filesystem flags. dir should be a physical root of filesystem.
 * If you've mounted a non-root directory somewhere and want to do remount
@@ -1041,7 +1348,10 @@ static noinline int do_remount(struct nameidata *nd, int flags, int mnt_flags,
                return -EINVAL;
        down_write(&sb->s_umount);
-        err = do_remount_sb(sb, flags, data, 0);
+        if (flags & MS_BIND)
+                err = change_mount_flags(nd->path.mnt, flags);
+        else
+                err = do_remount_sb(sb, flags, data, 0);
        if (!err)
                nd->path.mnt->mnt_flags = mnt_flags;
        up_write(&sb->s_umount);
@@ -1425,6 +1735,8 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
                mnt_flags |= MNT_NODIRATIME;
        if (flags & MS_RELATIME)
                mnt_flags |= MNT_RELATIME;
+        if (flags & MS_RDONLY)
+                mnt_flags |= MNT_READONLY;
        flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
                   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT);
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
index c67b4bdcf719..ad8f167e54bc 100644
--- a/fs/ncpfs/ioctl.c
+++ b/fs/ncpfs/ioctl.c
@@ -14,6 +14,7 @@
 #include <linux/ioctl.h>
 #include <linux/time.h>
 #include <linux/mm.h>
+#include <linux/mount.h>
 #include <linux/highuid.h>
 #include <linux/smp_lock.h>
 #include <linux/vmalloc.h>
@@ -261,7 +262,7 @@ ncp_get_charsets(struct ncp_server* server, struct ncp_nls_ioctl __user *arg)
 }
 #endif /* CONFIG_NCPFS_NLS */
-int ncp_ioctl(struct inode *inode, struct file *filp,
+static int __ncp_ioctl(struct inode *inode, struct file *filp,
              unsigned int cmd, unsigned long arg)
 {
        struct ncp_server *server = NCP_SERVER(inode);
@@ -822,6 +823,57 @@ outrel:
        return -EINVAL;
 }
+static int ncp_ioctl_need_write(unsigned int cmd)
+{
+        switch (cmd) {
+        case NCP_IOC_GET_FS_INFO:
+        case NCP_IOC_GET_FS_INFO_V2:
+        case NCP_IOC_NCPREQUEST:
+        case NCP_IOC_SETDENTRYTTL:
+        case NCP_IOC_SIGN_INIT:
+        case NCP_IOC_LOCKUNLOCK:
+        case NCP_IOC_SET_SIGN_WANTED:
+                return 1;
+        case NCP_IOC_GETOBJECTNAME:
+        case NCP_IOC_SETOBJECTNAME:
+        case NCP_IOC_GETPRIVATEDATA:
+        case NCP_IOC_SETPRIVATEDATA:
+        case NCP_IOC_SETCHARSETS:
+        case NCP_IOC_GETCHARSETS:
+        case NCP_IOC_CONN_LOGGED_IN:
+        case NCP_IOC_GETDENTRYTTL:
+        case NCP_IOC_GETMOUNTUID2:
+        case NCP_IOC_SIGN_WANTED:
+        case NCP_IOC_GETROOT:
+        case NCP_IOC_SETROOT:
+                return 0;
+        default:
+                /* unkown IOCTL command, assume write */
+                return 1;
+        }
+}
+int ncp_ioctl(struct inode *inode, struct file *filp,
+              unsigned int cmd, unsigned long arg)
+{
+        int ret;
+        if (ncp_ioctl_need_write(cmd)) {
+                /*
+                 * inside the ioctl(), any failures which
+                 * are because of file_permission() are
+                 * -EACCESS, so it seems consistent to keep
+                 *  that here.
+                 */
+                if (mnt_want_write(filp->f_path.mnt))
+                        return -EACCES;
+        }
+        ret = __ncp_ioctl(inode, filp, cmd, arg);
+        if (ncp_ioctl_need_write(cmd))
+                mnt_drop_write(filp->f_path.mnt);
+        return ret;
+}
 #ifdef CONFIG_COMPAT
 long ncp_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 6cea7479c5b4..d9e30ac2798d 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -967,7 +967,8 @@ static int is_atomic_open(struct inode *dir, struct nameidata *nd)
        if (nd->flags & LOOKUP_DIRECTORY)
                return 0;
        /* Are we trying to write to a read only partition? */
-        if (IS_RDONLY(dir) && (nd->intent.open.flags & (O_CREAT|O_TRUNC|FMODE_WRITE)))
+        if (__mnt_is_readonly(nd->path.mnt) &&
+            (nd->intent.open.flags & (O_CREAT|O_TRUNC|FMODE_WRITE)))
                return 0;
        return 1;
 }
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index c593db047d8b..c309c881bd4e 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -658,14 +658,19 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                        return status;
                }
        }
+        status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+        if (status)
+                return status;
        status = nfs_ok;
        if (setattr->sa_acl != NULL)
                status = nfsd4_set_nfs4_acl(rqstp, &cstate->current_fh,
                                            setattr->sa_acl);
        if (status)
-                return status;
+                goto out;
        status = nfsd_setattr(rqstp, &cstate->current_fh, &setattr->sa_iattr,
                                0, (time_t)0);
+out:
+        mnt_drop_write(cstate->current_fh.fh_export->ex_path.mnt);
        return status;
 }
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 1ff90625860f..145b3c877a27 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -46,6 +46,7 @@
 #include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/sched.h>
+#include <linux/mount.h>
 #define NFSDDBG_FACILITY                NFSDDBG_PROC
@@ -154,7 +155,11 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
                dprintk("NFSD: nfsd4_create_clid_dir: DIRECTORY EXISTS\n");
                goto out_put;
        }
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out_put;
        status = vfs_mkdir(rec_dir.path.dentry->d_inode, dentry, S_IRWXU);
+        mnt_drop_write(rec_dir.path.mnt);
 out_put:
        dput(dentry);
 out_unlock:
@@ -313,12 +318,17 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
        if (!rec_dir_init || !clp->cl_firststate)
                return;
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out;
        clp->cl_firststate = 0;
        nfs4_save_user(&uid, &gid);
        status = nfsd4_unlink_clid_dir(clp->cl_recdir, HEXDIR_LEN-1);
        nfs4_reset_user(uid, gid);
        if (status == 0)
                nfsd4_sync_rec_dir();
+        mnt_drop_write(rec_dir.path.mnt);
+out:
        if (status)
                printk("NFSD: Failed to remove expired client state directory"
                                " %.*s\n", HEXDIR_LEN, clp->cl_recdir);
@@ -347,13 +357,17 @@ nfsd4_recdir_purge_old(void) {
        if (!rec_dir_init)
                return;
+        status = mnt_want_write(rec_dir.path.mnt);
+        if (status)
+                goto out;
        status = nfsd4_list_rec_dir(rec_dir.path.dentry, purge_old);
        if (status == 0)
                nfsd4_sync_rec_dir();
+        mnt_drop_write(rec_dir.path.mnt);
+out:
        if (status)
                printk("nfsd4: failed to purge old clients from recovery"
                        " directory %s\n", rec_dir.path.dentry->d_name.name);
-        return;
 }
 static int
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index bcb97d8e8b8b..81a75f3081f4 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -41,6 +41,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/cache.h>
+#include <linux/file.h>
 #include <linux/mount.h>
 #include <linux/workqueue.h>
 #include <linux/smp_lock.h>
@@ -1239,7 +1240,7 @@ static inline void
 nfs4_file_downgrade(struct file *filp, unsigned int share_access)
 {
        if (share_access & NFS4_SHARE_ACCESS_WRITE) {
-                put_write_access(filp->f_path.dentry->d_inode);
+                drop_file_write_access(filp);
                filp->f_mode = (filp->f_mode | FMODE_READ) & ~FMODE_WRITE;
        }
 }
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 46f59d5365a0..304bf5f643c9 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1255,23 +1255,35 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
        err = 0;
        switch (type) {
        case S_IFREG:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
                break;
        case S_IFDIR:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
                break;
        case S_IFCHR:
        case S_IFBLK:
        case S_IFIFO:
        case S_IFSOCK:
+                host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+                if (host_err)
+                        goto out_nfserr;
                host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
                break;
        default:
                printk("nfsd: bad file type %o in nfsd_create\n", type);
                host_err = -EINVAL;
+                goto out_nfserr;
        }
-        if (host_err < 0)
+        if (host_err < 0) {
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                goto out_nfserr;
+        }
        if (EX_ISSYNC(fhp->fh_export)) {
                err = nfserrno(nfsd_sync_dir(dentry));
@@ -1282,6 +1294,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
        err2 = nfsd_create_setattr(rqstp, resfhp, iap);
        if (err2)
                err = err2;
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
        /*
         * Update the file handle to get the new inode info.
         */
@@ -1359,6 +1372,9 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                v_atime = verifier[1]&0x7fffffff;
        }
        
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
        if (dchild->d_inode) {
                err = 0;
@@ -1390,12 +1406,15 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                case NFS3_CREATE_GUARDED:
                        err = nfserr_exist;
                }
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                goto out;
        }
        host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
-        if (host_err < 0)
+        if (host_err < 0) {
+                mnt_drop_write(fhp->fh_export->ex_path.mnt);
                goto out_nfserr;
+        }
        if (created)
                *created = 1;
@@ -1420,6 +1439,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
        if (err2)
                err = err2;
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
        /*
         * Update the filehandle to get the new inode info.
         */
@@ -1522,6 +1542,10 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
        if (iap && (iap->ia_valid & ATTR_MODE))
                mode = iap->ia_mode & S_IALLUGO;
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
        if (unlikely(path[plen] != 0)) {
                char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
                if (path_alloced == NULL)
@@ -1542,6 +1566,8 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
        err = nfserrno(host_err);
        fh_unlock(fhp);
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
        cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
        dput(dnew);
        if (err==0) err = cerr;
@@ -1592,6 +1618,11 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
        dold = tfhp->fh_dentry;
        dest = dold->d_inode;
+        host_err = mnt_want_write(tfhp->fh_export->ex_path.mnt);
+        if (host_err) {
+                err = nfserrno(host_err);
+                goto out_dput;
+        }
        host_err = vfs_link(dold, dirp, dnew);
        if (!host_err) {
                if (EX_ISSYNC(ffhp->fh_export)) {
@@ -1605,7 +1636,8 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
                else
                        err = nfserrno(host_err);
        }
+        mnt_drop_write(tfhp->fh_export->ex_path.mnt);
+out_dput:
        dput(dnew);
 out_unlock:
        fh_unlock(ffhp);
@@ -1678,13 +1710,20 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
        if (ndentry == trap)
                goto out_dput_new;
-#ifdef MSNFS
+        if (svc_msnfs(ffhp) &&
-        if ((ffhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
                ((atomic_read(&odentry->d_count) > 1)
                 || (atomic_read(&ndentry->d_count) > 1))) {
                        host_err = -EPERM;
-        } else
+                        goto out_dput_new;
-#endif
+        }
+        host_err = -EXDEV;
+        if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
+                goto out_dput_new;
+        host_err = mnt_want_write(ffhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_dput_new;
        host_err = vfs_rename(fdir, odentry, tdir, ndentry);
        if (!host_err && EX_ISSYNC(tfhp->fh_export)) {
                host_err = nfsd_sync_dir(tdentry);
@@ -1692,6 +1731,8 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
                        host_err = nfsd_sync_dir(fdentry);
        }
+        mnt_drop_write(ffhp->fh_export->ex_path.mnt);
 out_dput_new:
        dput(ndentry);
 out_dput_old:
@@ -1750,6 +1791,10 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
        if (!type)
                type = rdentry->d_inode->i_mode & S_IFMT;
+        host_err = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (host_err)
+                goto out_nfserr;
        if (type != S_IFDIR) { /* It's UNLINK */
 #ifdef MSNFS
                if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
@@ -1765,10 +1810,12 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
        dput(rdentry);
        if (host_err)
-                goto out_nfserr;
+                goto out_drop;
        if (EX_ISSYNC(fhp->fh_export))
                host_err = nfsd_sync_dir(dentry);
+out_drop:
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
 out_nfserr:
        err = nfserrno(host_err);
 out:
@@ -1865,7 +1912,7 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
                inode->i_mode,
                IS_IMMUTABLE(inode)?    " immut" : "",
                IS_APPEND(inode)?       " append" : "",
-                IS_RDONLY(inode)?       " ro" : "");
+                __mnt_is_readonly(exp->ex_path.mnt)?    " ro" : "");
        dprintk("      owner %d/%d user %d/%d\n",
                inode->i_uid, inode->i_gid, current->fsuid, current->fsgid);
 #endif
@@ -1876,7 +1923,8 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
         */
        if (!(acc & MAY_LOCAL_ACCESS))
                if (acc & (MAY_WRITE | MAY_SATTR | MAY_TRUNC)) {
-                        if (exp_rdonly(rqstp, exp) || IS_RDONLY(inode))
+                        if (exp_rdonly(rqstp, exp) ||
+                            __mnt_is_readonly(exp->ex_path.mnt))
                                return nfserr_rofs;
                        if (/* (acc & MAY_WRITE) && */ IS_IMMUTABLE(inode))
                                return nfserr_perm;
@@ -2039,6 +2087,9 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
        } else
                size = 0;
+        error = mnt_want_write(fhp->fh_export->ex_path.mnt);
+        if (error)
+                goto getout;
        if (size)
                error = vfs_setxattr(fhp->fh_dentry, name, value, size, 0);
        else {
@@ -2050,6 +2101,7 @@ nfsd_set_posix_acl(struct svc_fh *fhp, int type, struct posix_acl *acl)
                                error = 0;
                }
        }
+        mnt_drop_write(fhp->fh_export->ex_path.mnt);
 getout:
        kfree(value);
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index b413166dd163..7b142f0ce995 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -60,10 +60,6 @@ static int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
                goto bail;
        }
-        status = -EROFS;
-        if (IS_RDONLY(inode))
-                goto bail_unlock;
        status = -EACCES;
        if (!is_owner_or_cap(inode))
                goto bail_unlock;
@@ -134,8 +130,13 @@ long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                if (get_user(flags, (int __user *) arg))
                        return -EFAULT;
-                return ocfs2_set_inode_attr(inode, flags,
+                status = mnt_want_write(filp->f_path.mnt);
+                if (status)
+                        return status;
+                status = ocfs2_set_inode_attr(inode, flags,
                        OCFS2_FL_MODIFIABLE);
+                mnt_drop_write(filp->f_path.mnt);
+                return status;
        case OCFS2_IOC_RESVSP:
        case OCFS2_IOC_RESVSP64:
        case OCFS2_IOC_UNRESVSP:
diff --git a/fs/open.c b/fs/open.c
index 3fa4e4ffce4c..b70e7666bb2c 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -244,21 +244,21 @@ static long do_sys_truncate(const char __user * path, loff_t length)
        if (!S_ISREG(inode->i_mode))
                goto dput_and_out;
-        error = vfs_permission(&nd, MAY_WRITE);
+        error = mnt_want_write(nd.path.mnt);
        if (error)
                goto dput_and_out;
-        error = -EROFS;
+        error = vfs_permission(&nd, MAY_WRITE);
-        if (IS_RDONLY(inode))
+        if (error)
-                goto dput_and_out;
+                goto mnt_drop_write_and_out;
        error = -EPERM;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-                goto dput_and_out;
+                goto mnt_drop_write_and_out;
        error = get_write_access(inode);
        if (error)
-                goto dput_and_out;
+                goto mnt_drop_write_and_out;
        /*
         * Make sure that there are no leases.  get_write_access() protects
@@ -276,6 +276,8 @@ static long do_sys_truncate(const char __user * path, loff_t length)
 put_write_and_out:
        put_write_access(inode);
+mnt_drop_write_and_out:
+        mnt_drop_write(nd.path.mnt);
 dput_and_out:
        path_put(&nd.path);
 out:
@@ -457,8 +459,17 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
        if(res || !(mode & S_IWOTH) ||
           special_file(nd.path.dentry->d_inode->i_mode))
                goto out_path_release;
+        /*
-        if(IS_RDONLY(nd.path.dentry->d_inode))
+         * This is a rare case where using __mnt_is_readonly()
+         * is OK without a mnt_want/drop_write() pair.  Since
+         * no actual write to the fs is performed here, we do
+         * not need to telegraph to that to anyone.
+         *
+         * By doing this, we accept that this access is
+         * inherently racy and know that the fs may change
+         * state before we even see this result.
+         */
+        if (__mnt_is_readonly(nd.path.mnt))
                res = -EROFS;
 out_path_release:
@@ -567,12 +578,12 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
        audit_inode(NULL, dentry);
-        err = -EROFS;
+        err = mnt_want_write(file->f_path.mnt);
-        if (IS_RDONLY(inode))
+        if (err)
                goto out_putf;
        err = -EPERM;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-                goto out_putf;
+                goto out_drop_write;
        mutex_lock(&inode->i_mutex);
        if (mode == (mode_t) -1)
                mode = inode->i_mode;
@@ -581,6 +592,8 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
        err = notify_change(dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+out_drop_write:
+        mnt_drop_write(file->f_path.mnt);
 out_putf:
        fput(file);
 out:
@@ -600,13 +613,13 @@ asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
                goto out;
        inode = nd.path.dentry->d_inode;
-        error = -EROFS;
+        error = mnt_want_write(nd.path.mnt);
-        if (IS_RDONLY(inode))
+        if (error)
                goto dput_and_out;
        error = -EPERM;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-                goto dput_and_out;
+                goto out_drop_write;
        mutex_lock(&inode->i_mutex);
        if (mode == (mode_t) -1)
@@ -616,6 +629,8 @@ asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
        error = notify_change(nd.path.dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+out_drop_write:
+        mnt_drop_write(nd.path.mnt);
 dput_and_out:
        path_put(&nd.path);
 out:
@@ -638,9 +653,6 @@ static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
                printk(KERN_ERR "chown_common: NULL inode\n");
                goto out;
        }
-        error = -EROFS;
-        if (IS_RDONLY(inode))
-                goto out;
        error = -EPERM;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
                goto out;
@@ -671,7 +683,12 @@ asmlinkage long sys_chown(const char __user * filename, uid_t user, gid_t group)
        error = user_path_walk(filename, &nd);
        if (error)
                goto out;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_release;
        error = chown_common(nd.path.dentry, user, group);
+        mnt_drop_write(nd.path.mnt);
+out_release:
        path_put(&nd.path);
 out:
        return error;
@@ -691,7 +708,12 @@ asmlinkage long sys_fchownat(int dfd, const char __user *filename, uid_t user,
        error = __user_walk_fd(dfd, filename, follow, &nd);
        if (error)
                goto out;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_release;
        error = chown_common(nd.path.dentry, user, group);
+        mnt_drop_write(nd.path.mnt);
+out_release:
        path_put(&nd.path);
 out:
        return error;
@@ -705,7 +727,12 @@ asmlinkage long sys_lchown(const char __user * filename, uid_t user, gid_t group
        error = user_path_walk_link(filename, &nd);
        if (error)
                goto out;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_release;
        error = chown_common(nd.path.dentry, user, group);
+        mnt_drop_write(nd.path.mnt);
+out_release:
        path_put(&nd.path);
 out:
        return error;
@@ -722,14 +749,48 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
        if (!file)
                goto out;
+        error = mnt_want_write(file->f_path.mnt);
+        if (error)
+                goto out_fput;
        dentry = file->f_path.dentry;
        audit_inode(NULL, dentry);
        error = chown_common(dentry, user, group);
+        mnt_drop_write(file->f_path.mnt);
+out_fput:
        fput(file);
 out:
        return error;
 }
+/*
+ * You have to be very careful that these write
+ * counts get cleaned up in error cases and
+ * upon __fput().  This should probably never
+ * be called outside of __dentry_open().
+ */
+static inline int __get_file_write_access(struct inode *inode,
+                                          struct vfsmount *mnt)
+{
+        int error;
+        error = get_write_access(inode);
+        if (error)
+                return error;
+        /*
+         * Do not take mount writer counts on
+         * special files since no writes to
+         * the mount itself will occur.
+         */
+        if (!special_file(inode->i_mode)) {
+                /*
+                 * Balanced in __fput()
+                 */
+                error = mnt_want_write(mnt);
+                if (error)
+                        put_write_access(inode);
+        }
+        return error;
+}
 static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
                                        int flags, struct file *f,
                                        int (*open)(struct inode *, struct file *))
@@ -742,9 +803,11 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
                                FMODE_PREAD | FMODE_PWRITE;
        inode = dentry->d_inode;
        if (f->f_mode & FMODE_WRITE) {
-                error = get_write_access(inode);
+                error = __get_file_write_access(inode, mnt);
                if (error)
                        goto cleanup_file;
+                if (!special_file(inode->i_mode))
+                        file_take_write(f);
        }
        f->f_mapping = inode->i_mapping;
@@ -784,8 +847,19 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
 cleanup_all:
        fops_put(f->f_op);
-        if (f->f_mode & FMODE_WRITE)
+        if (f->f_mode & FMODE_WRITE) {
                put_write_access(inode);
+                if (!special_file(inode->i_mode)) {
+                        /*
+                         * We don't consider this a real
+                         * mnt_want/drop_write() pair
+                         * because it all happenend right
+                         * here, so just reset the state.
+                         */
+                        file_reset_write(f);
+                        mnt_drop_write(mnt);
+                }
+        }
        file_kill(f);
        f->f_path.dentry = NULL;
        f->f_path.mnt = NULL;
@@ -796,43 +870,6 @@ cleanup_file:
        return ERR_PTR(error);
 }
-/*
- * Note that while the flag value (low two bits) for sys_open means:
- *      00 - read-only
- *      01 - write-only
- *      10 - read-write
- *      11 - special
- * it is changed into
- *      00 - no permissions needed
- *      01 - read-permission
- *      10 - write-permission
- *      11 - read-write
- * for the internal routines (ie open_namei()/follow_link() etc). 00 is
- * used by symlinks.
- */
-static struct file *do_filp_open(int dfd, const char *filename, int flags,
-                                 int mode)
-{
-        int namei_flags, error;
-        struct nameidata nd;
-        namei_flags = flags;
-        if ((namei_flags+1) & O_ACCMODE)
-                namei_flags++;
-        error = open_namei(dfd, filename, namei_flags, mode, &nd);
-        if (!error)
-                return nameidata_to_filp(&nd, flags);
-        return ERR_PTR(error);
-}
-struct file *filp_open(const char *filename, int flags, int mode)
-{
-        return do_filp_open(AT_FDCWD, filename, flags, mode);
-}
-EXPORT_SYMBOL(filp_open);
 /**
 * lookup_instantiate_filp - instantiates the open intent filp
 * @nd: pointer to nameidata
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index e0f0f098a523..74363a7aacbc 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -4,6 +4,7 @@
 #include <linux/capability.h>
 #include <linux/fs.h>
+#include <linux/mount.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/time.h>
 #include <asm/uaccess.h>
@@ -25,6 +26,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                   unsigned long arg)
 {
        unsigned int flags;
+        int err = 0;
        switch (cmd) {
        case REISERFS_IOC_UNPACK:
@@ -48,50 +50,67 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                        if (!reiserfs_attrs(inode->i_sb))
                                return -ENOTTY;
-                        if (IS_RDONLY(inode))
+                        err = mnt_want_write(filp->f_path.mnt);
-                                return -EROFS;
+                        if (err)
+                                return err;
-                        if (!is_owner_or_cap(inode))
+                        if (!is_owner_or_cap(inode)) {
-                                return -EPERM;
+                                err = -EPERM;
+                                goto setflags_out;
-                        if (get_user(flags, (int __user *)arg))
+                        }
-                                return -EFAULT;
+                        if (get_user(flags, (int __user *)arg)) {
+                                err = -EFAULT;
-                        /* Is it quota file? Do not allow user to mess with it. */
+                                goto setflags_out;
-                        if (IS_NOQUOTA(inode))
+                        }
-                                return -EPERM;
+                        /*
+                         * Is it quota file? Do not allow user to mess with it
+                         */
+                        if (IS_NOQUOTA(inode)) {
+                                err = -EPERM;
+                                goto setflags_out;
+                        }
                        if (((flags ^ REISERFS_I(inode)->
                              i_attrs) & (REISERFS_IMMUTABLE_FL |
                                          REISERFS_APPEND_FL))
-                            && !capable(CAP_LINUX_IMMUTABLE))
+                            && !capable(CAP_LINUX_IMMUTABLE)) {
-                                return -EPERM;
+                                err = -EPERM;
+                                goto setflags_out;
+                        }
                        if ((flags & REISERFS_NOTAIL_FL) &&
                            S_ISREG(inode->i_mode)) {
                                int result;
                                result = reiserfs_unpack(inode, filp);
-                                if (result)
+                                if (result) {
-                                        return result;
+                                        err = result;
+                                        goto setflags_out;
+                                }
                        }
                        sd_attrs_to_i_attrs(flags, inode);
                        REISERFS_I(inode)->i_attrs = flags;
                        inode->i_ctime = CURRENT_TIME_SEC;
                        mark_inode_dirty(inode);
-                        return 0;
+setflags_out:
+                        mnt_drop_write(filp->f_path.mnt);
+                        return err;
                }
        case REISERFS_IOC_GETVERSION:
                return put_user(inode->i_generation, (int __user *)arg);
        case REISERFS_IOC_SETVERSION:
                if (!is_owner_or_cap(inode))
                        return -EPERM;
-                if (IS_RDONLY(inode))
+                err = mnt_want_write(filp->f_path.mnt);
-                        return -EROFS;
+                if (err)
-                if (get_user(inode->i_generation, (int __user *)arg))
+                        return err;
-                        return -EFAULT;
+                if (get_user(inode->i_generation, (int __user *)arg)) {
+                        err = -EFAULT;
+                        goto setversion_out;
+                }
                inode->i_ctime = CURRENT_TIME_SEC;
                mark_inode_dirty(inode);
-                return 0;
+setversion_out:
+                mnt_drop_write(filp->f_path.mnt);
+                return err;
        default:
                return -ENOTTY;
        }
diff --git a/fs/super.c b/fs/super.c
index 09008dbd264e..1f8f05ede437 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -37,6 +37,7 @@
 #include <linux/idr.h>
 #include <linux/kobject.h>
 #include <linux/mutex.h>
+#include <linux/file.h>
 #include <asm/uaccess.h>
@@ -567,10 +568,29 @@ static void mark_files_ro(struct super_block *sb)
 {
        struct file *f;
+retry:
        file_list_lock();
        list_for_each_entry(f, &sb->s_files, f_u.fu_list) {
-                if (S_ISREG(f->f_path.dentry->d_inode->i_mode) && file_count(f))
+                struct vfsmount *mnt;
-                        f->f_mode &= ~FMODE_WRITE;
+                if (!S_ISREG(f->f_path.dentry->d_inode->i_mode))
+                       continue;
+                if (!file_count(f))
+                        continue;
+                if (!(f->f_mode & FMODE_WRITE))
+                        continue;
+                f->f_mode &= ~FMODE_WRITE;
+                if (file_check_writeable(f) != 0)
+                        continue;
+                file_release_write(f);
+                mnt = mntget(f->f_path.mnt);
+                file_list_unlock();
+                /*
+                 * This can sleep, so we can't hold
+                 * the file_list_lock() spinlock.
+                 */
+                mnt_drop_write(mnt);
+                mntput(mnt);
+                goto retry;
        }
        file_list_unlock();
 }
diff --git a/fs/utimes.c b/fs/utimes.c
index b18da9c0b97f..a2bef77dc9c9 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -2,6 +2,7 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/linkage.h>
+#include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/sched.h>
 #include <linux/stat.h>
@@ -59,6 +60,7 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        struct inode *inode;
        struct iattr newattrs;
        struct file *f = NULL;
+        struct vfsmount *mnt;
        error = -EINVAL;
        if (times && (!nsec_valid(times[0].tv_nsec) ||
@@ -79,18 +81,20 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                if (!f)
                        goto out;
                dentry = f->f_path.dentry;
+                mnt = f->f_path.mnt;
        } else {
                error = __user_walk_fd(dfd, filename, (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW, &nd);
                if (error)
                        goto out;
                dentry = nd.path.dentry;
+                mnt = nd.path.mnt;
        }
        inode = dentry->d_inode;
-        error = -EROFS;
+        error = mnt_want_write(mnt);
-        if (IS_RDONLY(inode))
+        if (error)
                goto dput_and_out;
        /* Don't worry, the checks are done in inode_change_ok() */
@@ -98,7 +102,7 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        if (times) {
                error = -EPERM;
                if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                        goto dput_and_out;
+                        goto mnt_drop_write_and_out;
                if (times[0].tv_nsec == UTIME_OMIT)
                        newattrs.ia_valid &= ~ATTR_ATIME;
@@ -118,22 +122,24 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        } else {
                error = -EACCES;
                if (IS_IMMUTABLE(inode))
-                        goto dput_and_out;
+                        goto mnt_drop_write_and_out;
                if (!is_owner_or_cap(inode)) {
                        if (f) {
                                if (!(f->f_mode & FMODE_WRITE))
-                                        goto dput_and_out;
+                                        goto mnt_drop_write_and_out;
                        } else {
                                error = vfs_permission(&nd, MAY_WRITE);
                                if (error)
-                                        goto dput_and_out;
+                                        goto mnt_drop_write_and_out;
                        }
                }
        }
        mutex_lock(&inode->i_mutex);
        error = notify_change(dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+mnt_drop_write_and_out:
+        mnt_drop_write(mnt);
 dput_and_out:
        if (f)
                fput(f);
diff --git a/fs/xattr.c b/fs/xattr.c
index 3acab1615460..f7062da505d4 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -11,6 +11,7 @@
 #include <linux/slab.h>
 #include <linux/file.h>
 #include <linux/xattr.h>
+#include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
@@ -32,8 +33,6 @@ xattr_permission(struct inode *inode, const char *name, int mask)
         * filesystem  or on an immutable / append-only inode.
         */
        if (mask & MAY_WRITE) {
-                if (IS_RDONLY(inode))
-                        return -EROFS;
                if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
                        return -EPERM;
        }
@@ -262,7 +261,11 @@ sys_setxattr(char __user *path, char __user *name, void __user *value,
        error = user_path_walk(path, &nd);
        if (error)
                return error;
-        error = setxattr(nd.path.dentry, name, value, size, flags);
+        error = mnt_want_write(nd.path.mnt);
+        if (!error) {
+                error = setxattr(nd.path.dentry, name, value, size, flags);
+                mnt_drop_write(nd.path.mnt);
+        }
        path_put(&nd.path);
        return error;
 }
@@ -277,7 +280,11 @@ sys_lsetxattr(char __user *path, char __user *name, void __user *value,
        error = user_path_walk_link(path, &nd);
        if (error)
                return error;
-        error = setxattr(nd.path.dentry, name, value, size, flags);
+        error = mnt_want_write(nd.path.mnt);
+        if (!error) {
+                error = setxattr(nd.path.dentry, name, value, size, flags);
+                mnt_drop_write(nd.path.mnt);
+        }
        path_put(&nd.path);
        return error;
 }
@@ -295,7 +302,12 @@ sys_fsetxattr(int fd, char __user *name, void __user *value,
                return error;
        dentry = f->f_path.dentry;
        audit_inode(NULL, dentry);
-        error = setxattr(dentry, name, value, size, flags);
+        error = mnt_want_write(f->f_path.mnt);
+        if (!error) {
+                error = setxattr(dentry, name, value, size, flags);
+                mnt_drop_write(f->f_path.mnt);
+        }
+out_fput:
        fput(f);
        return error;
 }
@@ -482,7 +494,11 @@ sys_removexattr(char __user *path, char __user *name)
        error = user_path_walk(path, &nd);
        if (error)
                return error;
-        error = removexattr(nd.path.dentry, name);
+        error = mnt_want_write(nd.path.mnt);
+        if (!error) {
+                error = removexattr(nd.path.dentry, name);
+                mnt_drop_write(nd.path.mnt);
+        }
        path_put(&nd.path);
        return error;
 }
@@ -496,7 +512,11 @@ sys_lremovexattr(char __user *path, char __user *name)
        error = user_path_walk_link(path, &nd);
        if (error)
                return error;
-        error = removexattr(nd.path.dentry, name);
+        error = mnt_want_write(nd.path.mnt);
+        if (!error) {
+                error = removexattr(nd.path.dentry, name);
+                mnt_drop_write(nd.path.mnt);
+        }
        path_put(&nd.path);
        return error;
 }
@@ -513,7 +533,11 @@ sys_fremovexattr(int fd, char __user *name)
                return error;
        dentry = f->f_path.dentry;
        audit_inode(NULL, dentry);
-        error = removexattr(dentry, name);
+        error = mnt_want_write(f->f_path.mnt);
+        if (!error) {
+                error = removexattr(dentry, name);
+                mnt_drop_write(f->f_path.mnt);
+        }
        fput(f);
        return error;
 }
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index bf7759793856..4ddb86b73c6b 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -535,8 +535,6 @@ xfs_attrmulti_attr_set(
        char                    *kbuf;
        int                     error = EFAULT;
-        if (IS_RDONLY(inode))
-                return -EROFS;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
                return EPERM;
        if (len > XATTR_SIZE_MAX)
@@ -562,8 +560,6 @@ xfs_attrmulti_attr_remove(
        char                    *name,
        __uint32_t              flags)
 {
-        if (IS_RDONLY(inode))
-                return -EROFS;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
                return EPERM;
        return xfs_attr_remove(XFS_I(inode), name, flags);
@@ -573,6 +569,7 @@ STATIC int
 xfs_attrmulti_by_handle(
        xfs_mount_t             *mp,
        void                    __user *arg,
+        struct file             *parfilp,
        struct inode            *parinode)
 {
        int                     error;
@@ -626,13 +623,21 @@ xfs_attrmulti_by_handle(
                                        &ops[i].am_length, ops[i].am_flags);
                        break;
                case ATTR_OP_SET:
+                        ops[i].am_error = mnt_want_write(parfilp->f_path.mnt);
+                        if (ops[i].am_error)
+                                break;
                        ops[i].am_error = xfs_attrmulti_attr_set(inode,
                                        attr_name, ops[i].am_attrvalue,
                                        ops[i].am_length, ops[i].am_flags);
+                        mnt_drop_write(parfilp->f_path.mnt);
                        break;
                case ATTR_OP_REMOVE:
+                        ops[i].am_error = mnt_want_write(parfilp->f_path.mnt);
+                        if (ops[i].am_error)
+                                break;
                        ops[i].am_error = xfs_attrmulti_attr_remove(inode,
                                        attr_name, ops[i].am_flags);
+                        mnt_drop_write(parfilp->f_path.mnt);
                        break;
                default:
                        ops[i].am_error = EINVAL;
@@ -1133,7 +1138,7 @@ xfs_ioctl(
                return xfs_attrlist_by_handle(mp, arg, inode);
        case XFS_IOC_ATTRMULTI_BY_HANDLE:
-                return xfs_attrmulti_by_handle(mp, arg, inode);
+                return xfs_attrmulti_by_handle(mp, arg, filp, inode);
        case XFS_IOC_SWAPEXT: {
                error = xfs_swapext((struct xfs_swapext __user *)arg);
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index 0c958cf77758..a1237dad6430 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -155,13 +155,6 @@ xfs_ichgtime_fast(
         */
        ASSERT((flags & XFS_ICHGTIME_ACC) == 0);
-        /*
-         * We're not supposed to change timestamps in readonly-mounted
-         * filesystems.  Throw it away if anyone asks us.
-         */
-        if (unlikely(IS_RDONLY(inode)))
-                return;
        if (flags & XFS_ICHGTIME_MOD) {
                tvp = &inode->i_mtime;
                ip->i_d.di_mtime.t_sec = (__int32_t)tvp->tv_sec;
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 21c0dbc74093..1ebd8004469c 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -51,6 +51,7 @@
 #include "xfs_vnodeops.h"
 #include <linux/capability.h>
+#include <linux/mount.h>
 #include <linux/writeback.h>
@@ -670,10 +671,16 @@ start:
        if (new_size > xip->i_size)
                xip->i_new_size = new_size;
-        if (likely(!(ioflags & IO_INVIS))) {
+        /*
+         * We're not supposed to change timestamps in readonly-mounted
+         * filesystems.  Throw it away if anyone asks us.
+         */
+        if (likely(!(ioflags & IO_INVIS) &&
+                   !mnt_want_write(file->f_path.mnt))) {
                file_update_time(file);
                xfs_ichgtime_fast(xip, inode,
                                  XFS_ICHGTIME_MOD | XFS_ICHGTIME_CHG);
+                mnt_drop_write(file->f_path.mnt);
        }
        /*
diff --git a/include/asm-sh/bugs.h b/include/asm-sh/bugs.h
index cfda7d5bf026..121b2ecddfc3 100644
--- a/include/asm-sh/bugs.h
+++ b/include/asm-sh/bugs.h
@@ -25,7 +25,7 @@ static void __init check_bugs(void)
        case CPU_SH7619:
                *p++ = '2';
                break;
-        case CPU_SH7203 ... CPU_SH7263:
+        case CPU_SH7203 ... CPU_MXG:
                *p++ = '2';
                *p++ = 'a';
                break;
diff --git a/include/asm-sh/cpu-sh4/freq.h b/include/asm-sh/cpu-sh4/freq.h
index ec028c649215..da46e67ae26d 100644
--- a/include/asm-sh/cpu-sh4/freq.h
+++ b/include/asm-sh/cpu-sh4/freq.h
@@ -10,14 +10,14 @@
 #ifndef __ASM_CPU_SH4_FREQ_H
 #define __ASM_CPU_SH4_FREQ_H
-#if defined(CONFIG_CPU_SUBTYPE_SH7722) || defined(CONFIG_CPU_SUBTYPE_SH7366)
+#if defined(CONFIG_CPU_SUBTYPE_SH7722) || \
+    defined(CONFIG_CPU_SUBTYPE_SH7723) || \
+    defined(CONFIG_CPU_SUBTYPE_SH7366)
 #define FRQCR                   0xa4150000
 #define VCLKCR                  0xa4150004
 #define SCLKACR                 0xa4150008
 #define SCLKBCR                 0xa415000c
-#if defined(CONFIG_CPU_SUBTYPE_SH7722)
 #define IrDACLKCR               0xa4150010
-#endif
 #elif defined(CONFIG_CPU_SUBTYPE_SH7763) || \
      defined(CONFIG_CPU_SUBTYPE_SH7780)
 #define FRQCR                   0xffc80000
diff --git a/include/asm-sh/cpu-sh4/rtc.h b/include/asm-sh/cpu-sh4/rtc.h
index f3d0f53275e4..25b1e6adfe8c 100644
--- a/include/asm-sh/cpu-sh4/rtc.h
+++ b/include/asm-sh/cpu-sh4/rtc.h
@@ -1,7 +1,12 @@
 #ifndef __ASM_SH_CPU_SH4_RTC_H
 #define __ASM_SH_CPU_SH4_RTC_H
+#ifdef CONFIG_CPU_SUBTYPE_SH7723
+#define rtc_reg_size            sizeof(u16)
+#else
 #define rtc_reg_size            sizeof(u32)
+#endif
 #define RTC_BIT_INVERTED        0x40    /* bug on SH7750, SH7750S */
 #define RTC_DEF_CAPABILITIES    RTC_CAP_4_DIGIT_YEAR
diff --git a/include/asm-sh/migor.h b/include/asm-sh/migor.h
new file mode 100644
index 000000000000..2329363afdc3
--- /dev/null
+++ b/include/asm-sh/migor.h
@@ -0,0 +1,58 @@
+#ifndef __ASM_SH_MIGOR_H
+#define __ASM_SH_MIGOR_H
+/*
+ * linux/include/asm-sh/migor.h
+ *
+ * Copyright (C) 2008 Renesas Solutions
+ *
+ * Portions Copyright (C) 2007 Nobuhiro Iwamatsu
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License. See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ */
+#include <asm/addrspace.h>
+/* GPIO */
+#define MSTPCR0 0xa4150030
+#define MSTPCR1 0xa4150034
+#define MSTPCR2 0xa4150038
+#define PORT_PACR 0xa4050100
+#define PORT_PDCR 0xa4050106
+#define PORT_PECR 0xa4050108
+#define PORT_PHCR 0xa405010e
+#define PORT_PJCR 0xa4050110
+#define PORT_PKCR 0xa4050112
+#define PORT_PLCR 0xa4050114
+#define PORT_PMCR 0xa4050116
+#define PORT_PRCR 0xa405011c
+#define PORT_PWCR 0xa4050146
+#define PORT_PXCR 0xa4050148
+#define PORT_PYCR 0xa405014a
+#define PORT_PZCR 0xa405014c
+#define PORT_PADR 0xa4050120
+#define PORT_PWDR 0xa4050166
+#define PORT_HIZCRA 0xa4050158
+#define PORT_HIZCRC 0xa405015c
+#define PORT_MSELCRB 0xa4050182
+#define MSTPCR1 0xa4150034
+#define MSTPCR2 0xa4150038
+#define PORT_PSELA 0xa405014e
+#define PORT_PSELB 0xa4050150
+#define PORT_PSELC 0xa4050152
+#define PORT_PSELD 0xa4050154
+#define PORT_HIZCRA 0xa4050158
+#define PORT_HIZCRB 0xa405015a
+#define PORT_HIZCRC 0xa405015c
+#define BSC_CS6ABCR 0xfec1001c
+#endif /* __ASM_SH_MIGOR_H */
diff --git a/include/asm-sh/processor.h b/include/asm-sh/processor.h
index ec707b98e5b9..b7c7ce80f03e 100644
--- a/include/asm-sh/processor.h
+++ b/include/asm-sh/processor.h
@@ -16,7 +16,7 @@ enum cpu_type {
        CPU_SH7619,
        /* SH-2A types */
-        CPU_SH7203, CPU_SH7206, CPU_SH7263,
+        CPU_SH7203, CPU_SH7206, CPU_SH7263, CPU_MXG,
        /* SH-3 types */
        CPU_SH7705, CPU_SH7706, CPU_SH7707,
@@ -29,7 +29,8 @@ enum cpu_type {
        CPU_SH7760, CPU_SH4_202, CPU_SH4_501,
        /* SH-4A types */
-        CPU_SH7763, CPU_SH7770, CPU_SH7780, CPU_SH7781, CPU_SH7785, CPU_SHX3,
+        CPU_SH7763, CPU_SH7770, CPU_SH7780, CPU_SH7781, CPU_SH7785,
+        CPU_SH7723, CPU_SHX3,
        /* SH4AL-DSP types */
        CPU_SH7343, CPU_SH7722, CPU_SH7366,
diff --git a/include/asm-sh/r7780rp.h b/include/asm-sh/r7780rp.h
index 1770460a4616..a33838f23a6d 100644
--- a/include/asm-sh/r7780rp.h
+++ b/include/asm-sh/r7780rp.h
@@ -55,11 +55,11 @@
 #define PA_SCSPTR1      (PA_BCR+0x0524) /* SCIF1 Serial Port control */
 #define PA_SCLSR1       (PA_BCR+0x0528) /* SCIF1 Line Status control */
 #define PA_SCRER1       (PA_BCR+0x052c) /* SCIF1 Serial Error control */
-#define PA_ICCR         (PA_BCR+0x0600) /* Serial control */
+#define PA_SMCR         (PA_BCR+0x0600) /* 2-wire Serial control */
-#define PA_SAR          (PA_BCR+0x0602) /* Serial Slave control */
+#define PA_SMSMADR      (PA_BCR+0x0602) /* 2-wire Serial Slave control */
-#define PA_MDR          (PA_BCR+0x0604) /* Serial Mode control */
+#define PA_SMMR         (PA_BCR+0x0604) /* 2-wire Serial Mode control */
-#define PA_ADR1         (PA_BCR+0x0606) /* Serial Address1 control */
+#define PA_SMSADR1      (PA_BCR+0x0606) /* 2-wire Serial Address1 control */
-#define PA_DAR1         (PA_BCR+0x0646) /* Serial Data1 control */
+#define PA_SMTRDR1      (PA_BCR+0x0646) /* 2-wire Serial Data1 control */
 #define PA_VERREG       (PA_BCR+0x0700) /* FPGA Version Register */
 #define PA_POFF         (PA_BCR+0x0800) /* System Power Off control */
 #define PA_PMR          (PA_BCR+0x0900) /*  */
@@ -107,11 +107,11 @@
 #define PA_SCFCR        (PA_BCR+0x040c) /* SCIF FIFO control */
 #define PA_SCFDR        (PA_BCR+0x040e) /* SCIF FIFO data control */
 #define PA_SCLSR        (PA_BCR+0x0412) /* SCIF Line Status control */
-#define PA_ICCR         (PA_BCR+0x0500) /* Serial control */
+#define PA_SMCR         (PA_BCR+0x0500) /* 2-wire Serial control */
-#define PA_SAR          (PA_BCR+0x0502) /* Serial Slave control */
+#define PA_SMSMADR      (PA_BCR+0x0502) /* 2-wire Serial Slave control */
-#define PA_MDR          (PA_BCR+0x0504) /* Serial Mode control */
+#define PA_SMMR         (PA_BCR+0x0504) /* 2-wire Serial Mode control */
-#define PA_ADR1         (PA_BCR+0x0506) /* Serial Address1 control */
+#define PA_SMSADR1      (PA_BCR+0x0506) /* 2-wire Serial Address1 control */
-#define PA_DAR1         (PA_BCR+0x0546) /* Serial Data1 control */
+#define PA_SMTRDR1      (PA_BCR+0x0546) /* 2-wire Serial Data1 control */
 #define PA_VERREG       (PA_BCR+0x0600) /* FPGA Version Register */
 #define PA_AX88796L     0xa5800400      /* AX88796L Area */
@@ -190,6 +190,8 @@
 #define IRQ_TP                  (HL_FPGA_IRQ_BASE + 12)
 #define IRQ_RTC                 (HL_FPGA_IRQ_BASE + 13)
 #define IRQ_TH_ALERT            (HL_FPGA_IRQ_BASE + 14)
+#define IRQ_SCIF0               (HL_FPGA_IRQ_BASE + 15)
+#define IRQ_SCIF1               (HL_FPGA_IRQ_BASE + 16)
 unsigned char *highlander_init_irq_r7780mp(void);
 unsigned char *highlander_init_irq_r7780rp(void);
diff --git a/include/asm-sh/se7721.h b/include/asm-sh/se7721.h
new file mode 100644
index 000000000000..b957f6041193
--- /dev/null
+++ b/include/asm-sh/se7721.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2008 Renesas Solutions Corp.
+ *
+ * Hitachi UL SolutionEngine 7721 Support.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ */
+#ifndef __ASM_SH_SE7721_H
+#define __ASM_SH_SE7721_H
+#include <asm/addrspace.h>
+/* Box specific addresses. */
+#define SE_AREA0_WIDTH  2               /* Area0: 32bit */
+#define PA_ROM          0xa0000000      /* EPROM */
+#define PA_ROM_SIZE     0x00200000      /* EPROM size 2M byte */
+#define PA_FROM         0xa1000000      /* Flash-ROM */
+#define PA_FROM_SIZE    0x01000000      /* Flash-ROM size 16M byte */
+#define PA_EXT1         0xa4000000
+#define PA_EXT1_SIZE    0x04000000
+#define PA_SDRAM        0xaC000000      /* SDRAM(Area3) 64MB */
+#define PA_SDRAM_SIZE   0x04000000
+#define PA_EXT4         0xb0000000
+#define PA_EXT4_SIZE    0x04000000
+#define PA_PERIPHERAL   0xB8000000
+#define PA_PCIC         PA_PERIPHERAL
+#define PA_MRSHPC       (PA_PERIPHERAL + 0x003fffe0)
+#define PA_MRSHPC_MW1   (PA_PERIPHERAL + 0x00400000)
+#define PA_MRSHPC_MW2   (PA_PERIPHERAL + 0x00500000)
+#define PA_MRSHPC_IO    (PA_PERIPHERAL + 0x00600000)
+#define MRSHPC_OPTION   (PA_MRSHPC + 6)
+#define MRSHPC_CSR      (PA_MRSHPC + 8)
+#define MRSHPC_ISR      (PA_MRSHPC + 10)
+#define MRSHPC_ICR      (PA_MRSHPC + 12)
+#define MRSHPC_CPWCR    (PA_MRSHPC + 14)
+#define MRSHPC_MW0CR1   (PA_MRSHPC + 16)
+#define MRSHPC_MW1CR1   (PA_MRSHPC + 18)
+#define MRSHPC_IOWCR1   (PA_MRSHPC + 20)
+#define MRSHPC_MW0CR2   (PA_MRSHPC + 22)
+#define MRSHPC_MW1CR2   (PA_MRSHPC + 24)
+#define MRSHPC_IOWCR2   (PA_MRSHPC + 26)
+#define MRSHPC_CDCR     (PA_MRSHPC + 28)
+#define MRSHPC_PCIC_INFO        (PA_MRSHPC + 30)
+#define PA_LED          0xB6800000      /* 8bit LED */
+#define PA_FPGA         0xB7000000      /* FPGA base address */
+#define MRSHPC_IRQ0     10
+#define FPGA_ILSR1      (PA_FPGA + 0x02)
+#define FPGA_ILSR2      (PA_FPGA + 0x03)
+#define FPGA_ILSR3      (PA_FPGA + 0x04)
+#define FPGA_ILSR4      (PA_FPGA + 0x05)
+#define FPGA_ILSR5      (PA_FPGA + 0x06)
+#define FPGA_ILSR6      (PA_FPGA + 0x07)
+#define FPGA_ILSR7      (PA_FPGA + 0x08)
+#define FPGA_ILSR8      (PA_FPGA + 0x09)
+void init_se7721_IRQ(void);
+#define __IO_PREFIX             se7721
+#include <asm/io_generic.h>
+#endif  /* __ASM_SH_SE7721_H */
diff --git a/include/asm-sh/se7722.h b/include/asm-sh/se7722.h
index e0e89fcb8388..3690fe5857a4 100644
--- a/include/asm-sh/se7722.h
+++ b/include/asm-sh/se7722.h
@@ -77,6 +77,8 @@
 #define PORT_PSELA      0xA405014EUL
 #define PORT_PYCR       0xA405014AUL
 #define PORT_PZCR       0xA405014CUL
+#define PORT_HIZCRA     0xA4050158UL
+#define PORT_HIZCRC     0xA405015CUL
 /* IRQ */
 #define IRQ0_IRQ        32
diff --git a/include/asm-sh/sh_keysc.h b/include/asm-sh/sh_keysc.h
new file mode 100644
index 000000000000..b5a4dd5a9729
--- /dev/null
+++ b/include/asm-sh/sh_keysc.h
@@ -0,0 +1,13 @@
+#ifndef __ASM_KEYSC_H__
+#define __ASM_KEYSC_H__
+#define SH_KEYSC_MAXKEYS 30
+struct sh_keysc_info {
+        enum { SH_KEYSC_MODE_1, SH_KEYSC_MODE_2, SH_KEYSC_MODE_3 } mode;
+        int scan_timing; /* 0 -> 7, see KYCR1, SCN[2:0] */
+        int delay;
+        int keycodes[SH_KEYSC_MAXKEYS];
+};
+#endif /* __ASM_KEYSC_H__ */
diff --git a/include/asm-sh/system.h b/include/asm-sh/system.h
index 5145aa2a0ce9..e65b6b822cb3 100644
--- a/include/asm-sh/system.h
+++ b/include/asm-sh/system.h
@@ -146,6 +146,8 @@ extern unsigned int instruction_size(unsigned int insn);
 extern unsigned long cached_to_uncached;
+extern struct dentry *sh_debugfs_root;
 /* XXX
 * disable hlt during certain critical i/o operations
 */
diff --git a/include/asm-sh/uaccess_32.h b/include/asm-sh/uaccess_32.h
index c0318b608893..1e41fda74bd3 100644
--- a/include/asm-sh/uaccess_32.h
+++ b/include/asm-sh/uaccess_32.h
@@ -55,13 +55,10 @@ static inline void set_fs(mm_segment_t s)
 * If we don't have an MMU (or if its disabled) the only thing we really have
 * to look out for is if the address resides somewhere outside of what
 * available RAM we have.
- *
- * TODO: This check could probably also stand to be restricted somewhat more..
- * though it still does the Right Thing(tm) for the time being.
 */
 static inline int __access_ok(unsigned long addr, unsigned long size)
 {
-        return ((addr >= memory_start) && ((addr + size) < memory_end));
+        return 1;
 }
 #else /* CONFIG_MMU */
 #define __addr_ok(addr) \
diff --git a/include/asm-x86/boot.h b/include/asm-x86/boot.h
index ed8affbf96cb..2faed7ecb092 100644
--- a/include/asm-x86/boot.h
+++ b/include/asm-x86/boot.h
@@ -17,4 +17,12 @@
                                + (CONFIG_PHYSICAL_ALIGN - 1)) \
                                & ~(CONFIG_PHYSICAL_ALIGN - 1))
+#ifdef CONFIG_X86_64
+#define BOOT_HEAP_SIZE  0x7000
+#define BOOT_STACK_SIZE 0x4000
+#else
+#define BOOT_HEAP_SIZE  0x4000
+#define BOOT_STACK_SIZE 0x1000
+#endif
 #endif /* _ASM_BOOT_H */
diff --git a/include/asm-x86/dma-mapping.h b/include/asm-x86/dma-mapping.h
index 58f790f4df52..a1a4dc7fe6ec 100644
--- a/include/asm-x86/dma-mapping.h
+++ b/include/asm-x86/dma-mapping.h
@@ -1,5 +1,237 @@
+#ifndef _ASM_DMA_MAPPING_H_
+#define _ASM_DMA_MAPPING_H_
+/*
+ * IOMMU interface. See Documentation/DMA-mapping.txt and DMA-API.txt for
+ * documentation.
+ */
+#include <linux/scatterlist.h>
+#include <asm/io.h>
+#include <asm/swiotlb.h>
+extern dma_addr_t bad_dma_address;
+extern int iommu_merge;
+extern struct device fallback_dev;
+extern int panic_on_overflow;
+extern int forbid_dac;
+extern int force_iommu;
+struct dma_mapping_ops {
+        int             (*mapping_error)(dma_addr_t dma_addr);
+        void*           (*alloc_coherent)(struct device *dev, size_t size,
+                                dma_addr_t *dma_handle, gfp_t gfp);
+        void            (*free_coherent)(struct device *dev, size_t size,
+                                void *vaddr, dma_addr_t dma_handle);
+        dma_addr_t      (*map_single)(struct device *hwdev, phys_addr_t ptr,
+                                size_t size, int direction);
+        /* like map_single, but doesn't check the device mask */
+        dma_addr_t      (*map_simple)(struct device *hwdev, phys_addr_t ptr,
+                                size_t size, int direction);
+        void            (*unmap_single)(struct device *dev, dma_addr_t addr,
+                                size_t size, int direction);
+        void            (*sync_single_for_cpu)(struct device *hwdev,
+                                dma_addr_t dma_handle, size_t size,
+                                int direction);
+        void            (*sync_single_for_device)(struct device *hwdev,
+                                dma_addr_t dma_handle, size_t size,
+                                int direction);
+        void            (*sync_single_range_for_cpu)(struct device *hwdev,
+                                dma_addr_t dma_handle, unsigned long offset,
+                                size_t size, int direction);
+        void            (*sync_single_range_for_device)(struct device *hwdev,
+                                dma_addr_t dma_handle, unsigned long offset,
+                                size_t size, int direction);
+        void            (*sync_sg_for_cpu)(struct device *hwdev,
+                                struct scatterlist *sg, int nelems,
+                                int direction);
+        void            (*sync_sg_for_device)(struct device *hwdev,
+                                struct scatterlist *sg, int nelems,
+                                int direction);
+        int             (*map_sg)(struct device *hwdev, struct scatterlist *sg,
+                                int nents, int direction);
+        void            (*unmap_sg)(struct device *hwdev,
+                                struct scatterlist *sg, int nents,
+                                int direction);
+        int             (*dma_supported)(struct device *hwdev, u64 mask);
+        int             is_phys;
+};
+extern const struct dma_mapping_ops *dma_ops;
+static inline int dma_mapping_error(dma_addr_t dma_addr)
+{
+        if (dma_ops->mapping_error)
+                return dma_ops->mapping_error(dma_addr);
+        return (dma_addr == bad_dma_address);
+}
+#define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
+#define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
+void *dma_alloc_coherent(struct device *dev, size_t size,
+                           dma_addr_t *dma_handle, gfp_t flag);
+void dma_free_coherent(struct device *dev, size_t size,
+                         void *vaddr, dma_addr_t dma_handle);
+extern int dma_supported(struct device *hwdev, u64 mask);
+extern int dma_set_mask(struct device *dev, u64 mask);
+static inline dma_addr_t
+dma_map_single(struct device *hwdev, void *ptr, size_t size,
+               int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        return dma_ops->map_single(hwdev, virt_to_phys(ptr), size, direction);
+}
+static inline void
+dma_unmap_single(struct device *dev, dma_addr_t addr, size_t size,
+                 int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->unmap_single)
+                dma_ops->unmap_single(dev, addr, size, direction);
+}
+static inline int
+dma_map_sg(struct device *hwdev, struct scatterlist *sg,
+           int nents, int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        return dma_ops->map_sg(hwdev, sg, nents, direction);
+}
+static inline void
+dma_unmap_sg(struct device *hwdev, struct scatterlist *sg, int nents,
+             int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->unmap_sg)
+                dma_ops->unmap_sg(hwdev, sg, nents, direction);
+}
+static inline void
+dma_sync_single_for_cpu(struct device *hwdev, dma_addr_t dma_handle,
+                        size_t size, int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->sync_single_for_cpu)
+                dma_ops->sync_single_for_cpu(hwdev, dma_handle, size,
+                                             direction);
+        flush_write_buffers();
+}
+static inline void
+dma_sync_single_for_device(struct device *hwdev, dma_addr_t dma_handle,
+                           size_t size, int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->sync_single_for_device)
+                dma_ops->sync_single_for_device(hwdev, dma_handle, size,
+                                                direction);
+        flush_write_buffers();
+}
+static inline void
+dma_sync_single_range_for_cpu(struct device *hwdev, dma_addr_t dma_handle,
+                              unsigned long offset, size_t size, int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->sync_single_range_for_cpu)
+                dma_ops->sync_single_range_for_cpu(hwdev, dma_handle, offset,
+                                                   size, direction);
+        flush_write_buffers();
+}
+static inline void
+dma_sync_single_range_for_device(struct device *hwdev, dma_addr_t dma_handle,
+                                 unsigned long offset, size_t size,
+                                 int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->sync_single_range_for_device)
+                dma_ops->sync_single_range_for_device(hwdev, dma_handle,
+                                                      offset, size, direction);
+        flush_write_buffers();
+}
+static inline void
+dma_sync_sg_for_cpu(struct device *hwdev, struct scatterlist *sg,
+                    int nelems, int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->sync_sg_for_cpu)
+                dma_ops->sync_sg_for_cpu(hwdev, sg, nelems, direction);
+        flush_write_buffers();
+}
+static inline void
+dma_sync_sg_for_device(struct device *hwdev, struct scatterlist *sg,
+                       int nelems, int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        if (dma_ops->sync_sg_for_device)
+                dma_ops->sync_sg_for_device(hwdev, sg, nelems, direction);
+        flush_write_buffers();
+}
+static inline dma_addr_t dma_map_page(struct device *dev, struct page *page,
+                                      size_t offset, size_t size,
+                                      int direction)
+{
+        BUG_ON(!valid_dma_direction(direction));
+        return dma_ops->map_single(dev, page_to_phys(page)+offset,
+                                   size, direction);
+}
+static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
+                                  size_t size, int direction)
+{
+        dma_unmap_single(dev, addr, size, direction);
+}
+static inline void
+dma_cache_sync(struct device *dev, void *vaddr, size_t size,
+        enum dma_data_direction dir)
+{
+        flush_write_buffers();
+}
+static inline int dma_get_cache_alignment(void)
+{
+        /* no easy way to get cache size on all x86, so return the
+         * maximum possible, to be safe */
+        return boot_cpu_data.x86_clflush_size;
+}
+#define dma_is_consistent(d, h) (1)
 #ifdef CONFIG_X86_32
-# include "dma-mapping_32.h"
+#  define ARCH_HAS_DMA_DECLARE_COHERENT_MEMORY
-#else
+struct dma_coherent_mem {
-# include "dma-mapping_64.h"
+        void            *virt_base;
+        u32             device_base;
+        int             size;
+        int             flags;
+        unsigned long   *bitmap;
+};
+extern int
+dma_declare_coherent_memory(struct device *dev, dma_addr_t bus_addr,
+                            dma_addr_t device_addr, size_t size, int flags);
+extern void
+dma_release_declared_memory(struct device *dev);
+extern void *
+dma_mark_declared_memory_occupied(struct device *dev,
+                                  dma_addr_t device_addr, size_t size);
+#endif /* CONFIG_X86_32 */
 #endif
diff --git a/include/asm-x86/dma-mapping_32.h b/include/asm-x86/dma-mapping_32.h
deleted file mode 100644
index 55f01bd9e556..000000000000
--- a/include/asm-x86/dma-mapping_32.h
+++ /dev/null
@@ -1,187 +0,0 @@
-#ifndef _ASM_I386_DMA_MAPPING_H
-#define _ASM_I386_DMA_MAPPING_H
-#include <linux/mm.h>
-#include <linux/scatterlist.h>
-#include <asm/cache.h>
-#include <asm/io.h>
-#include <asm/bug.h>
-#define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
-#define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
-void *dma_alloc_coherent(struct device *dev, size_t size,
-                           dma_addr_t *dma_handle, gfp_t flag);
-void dma_free_coherent(struct device *dev, size_t size,
-                         void *vaddr, dma_addr_t dma_handle);
-static inline dma_addr_t
-dma_map_single(struct device *dev, void *ptr, size_t size,
-               enum dma_data_direction direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        WARN_ON(size == 0);
-        flush_write_buffers();
-        return virt_to_phys(ptr);
-}
-static inline void
-dma_unmap_single(struct device *dev, dma_addr_t dma_addr, size_t size,
-                 enum dma_data_direction direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-}
-static inline int
-dma_map_sg(struct device *dev, struct scatterlist *sglist, int nents,
-           enum dma_data_direction direction)
-{
-        struct scatterlist *sg;
-        int i;
-        BUG_ON(!valid_dma_direction(direction));
-        WARN_ON(nents == 0 || sglist[0].length == 0);
-        for_each_sg(sglist, sg, nents, i) {
-                BUG_ON(!sg_page(sg));
-                sg->dma_address = sg_phys(sg);
-        }
-        flush_write_buffers();
-        return nents;
-}
-static inline dma_addr_t
-dma_map_page(struct device *dev, struct page *page, unsigned long offset,
-             size_t size, enum dma_data_direction direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        return page_to_phys(page) + offset;
-}
-static inline void
-dma_unmap_page(struct device *dev, dma_addr_t dma_address, size_t size,
-               enum dma_data_direction direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-}
-static inline void
-dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nhwentries,
-             enum dma_data_direction direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-}
-static inline void
-dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle, size_t size,
-                        enum dma_data_direction direction)
-{
-}
-static inline void
-dma_sync_single_for_device(struct device *dev, dma_addr_t dma_handle, size_t size,
-                        enum dma_data_direction direction)
-{
-        flush_write_buffers();
-}
-static inline void
-dma_sync_single_range_for_cpu(struct device *dev, dma_addr_t dma_handle,
-                              unsigned long offset, size_t size,
-                              enum dma_data_direction direction)
-{
-}
-static inline void
-dma_sync_single_range_for_device(struct device *dev, dma_addr_t dma_handle,
-                                 unsigned long offset, size_t size,
-                                 enum dma_data_direction direction)
-{
-        flush_write_buffers();
-}
-static inline void
-dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg, int nelems,
-                    enum dma_data_direction direction)
-{
-}
-static inline void
-dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg, int nelems,
-                    enum dma_data_direction direction)
-{
-        flush_write_buffers();
-}
-static inline int
-dma_mapping_error(dma_addr_t dma_addr)
-{
-        return 0;
-}
-extern int forbid_dac;
-static inline int
-dma_supported(struct device *dev, u64 mask)
-{
-        /*
-         * we fall back to GFP_DMA when the mask isn't all 1s,
-         * so we can't guarantee allocations that must be
-         * within a tighter range than GFP_DMA..
-         */
-        if(mask < 0x00ffffff)
-                return 0;
-        /* Work around chipset bugs */
-        if (forbid_dac > 0 && mask > 0xffffffffULL)
-                return 0;
-        return 1;
-}
-static inline int
-dma_set_mask(struct device *dev, u64 mask)
-{
-        if(!dev->dma_mask || !dma_supported(dev, mask))
-                return -EIO;
-        *dev->dma_mask = mask;
-        return 0;
-}
-static inline int
-dma_get_cache_alignment(void)
-{
-        /* no easy way to get cache size on all x86, so return the
-         * maximum possible, to be safe */
-        return (1 << INTERNODE_CACHE_SHIFT);
-}
-#define dma_is_consistent(d, h) (1)
-static inline void
-dma_cache_sync(struct device *dev, void *vaddr, size_t size,
-               enum dma_data_direction direction)
-{
-        flush_write_buffers();
-}
-#define ARCH_HAS_DMA_DECLARE_COHERENT_MEMORY
-extern int
-dma_declare_coherent_memory(struct device *dev, dma_addr_t bus_addr,
-                            dma_addr_t device_addr, size_t size, int flags);
-extern void
-dma_release_declared_memory(struct device *dev);
-extern void *
-dma_mark_declared_memory_occupied(struct device *dev,
-                                  dma_addr_t device_addr, size_t size);
-#endif
diff --git a/include/asm-x86/dma-mapping_64.h b/include/asm-x86/dma-mapping_64.h
deleted file mode 100644
index ecd0f6125ba3..000000000000
--- a/include/asm-x86/dma-mapping_64.h
+++ /dev/null
@@ -1,202 +0,0 @@
-#ifndef _X8664_DMA_MAPPING_H
-#define _X8664_DMA_MAPPING_H 1
-/*
- * IOMMU interface. See Documentation/DMA-mapping.txt and DMA-API.txt for
- * documentation.
- */
-#include <linux/scatterlist.h>
-#include <asm/io.h>
-#include <asm/swiotlb.h>
-struct dma_mapping_ops {
-        int             (*mapping_error)(dma_addr_t dma_addr);
-        void*           (*alloc_coherent)(struct device *dev, size_t size,
-                                dma_addr_t *dma_handle, gfp_t gfp);
-        void            (*free_coherent)(struct device *dev, size_t size,
-                                void *vaddr, dma_addr_t dma_handle);
-        dma_addr_t      (*map_single)(struct device *hwdev, void *ptr,
-                                size_t size, int direction);
-        /* like map_single, but doesn't check the device mask */
-        dma_addr_t      (*map_simple)(struct device *hwdev, char *ptr,
-                                size_t size, int direction);
-        void            (*unmap_single)(struct device *dev, dma_addr_t addr,
-                                size_t size, int direction);
-        void            (*sync_single_for_cpu)(struct device *hwdev,
-                                dma_addr_t dma_handle, size_t size,
-                                int direction);
-        void            (*sync_single_for_device)(struct device *hwdev,
-                                dma_addr_t dma_handle, size_t size,
-                                int direction);
-        void            (*sync_single_range_for_cpu)(struct device *hwdev,
-                                dma_addr_t dma_handle, unsigned long offset,
-                                size_t size, int direction);
-        void            (*sync_single_range_for_device)(struct device *hwdev,
-                                dma_addr_t dma_handle, unsigned long offset,
-                                size_t size, int direction);
-        void            (*sync_sg_for_cpu)(struct device *hwdev,
-                                struct scatterlist *sg, int nelems,
-                                int direction);
-        void            (*sync_sg_for_device)(struct device *hwdev,
-                                struct scatterlist *sg, int nelems,
-                                int direction);
-        int             (*map_sg)(struct device *hwdev, struct scatterlist *sg,
-                                int nents, int direction);
-        void            (*unmap_sg)(struct device *hwdev,
-                                struct scatterlist *sg, int nents,
-                                int direction);
-        int             (*dma_supported)(struct device *hwdev, u64 mask);
-        int             is_phys;
-};
-extern dma_addr_t bad_dma_address;
-extern const struct dma_mapping_ops* dma_ops;
-extern int iommu_merge;
-static inline int dma_mapping_error(dma_addr_t dma_addr)
-{
-        if (dma_ops->mapping_error)
-                return dma_ops->mapping_error(dma_addr);
-        return (dma_addr == bad_dma_address);
-}
-#define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
-#define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
-#define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
-#define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
-extern void *dma_alloc_coherent(struct device *dev, size_t size,
-                                dma_addr_t *dma_handle, gfp_t gfp);
-extern void dma_free_coherent(struct device *dev, size_t size, void *vaddr,
-                              dma_addr_t dma_handle);
-static inline dma_addr_t
-dma_map_single(struct device *hwdev, void *ptr, size_t size,
-               int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        return dma_ops->map_single(hwdev, ptr, size, direction);
-}
-static inline void
-dma_unmap_single(struct device *dev, dma_addr_t addr,size_t size,
-                 int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        dma_ops->unmap_single(dev, addr, size, direction);
-}
-#define dma_map_page(dev,page,offset,size,dir) \
-        dma_map_single((dev), page_address(page)+(offset), (size), (dir))
-#define dma_unmap_page dma_unmap_single
-static inline void
-dma_sync_single_for_cpu(struct device *hwdev, dma_addr_t dma_handle,
-                        size_t size, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        if (dma_ops->sync_single_for_cpu)
-                dma_ops->sync_single_for_cpu(hwdev, dma_handle, size,
-                                             direction);
-        flush_write_buffers();
-}
-static inline void
-dma_sync_single_for_device(struct device *hwdev, dma_addr_t dma_handle,
-                           size_t size, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        if (dma_ops->sync_single_for_device)
-                dma_ops->sync_single_for_device(hwdev, dma_handle, size,
-                                                direction);
-        flush_write_buffers();
-}
-static inline void
-dma_sync_single_range_for_cpu(struct device *hwdev, dma_addr_t dma_handle,
-                              unsigned long offset, size_t size, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        if (dma_ops->sync_single_range_for_cpu) {
-                dma_ops->sync_single_range_for_cpu(hwdev, dma_handle, offset, size, direction);
-        }
-        flush_write_buffers();
-}
-static inline void
-dma_sync_single_range_for_device(struct device *hwdev, dma_addr_t dma_handle,
-                                 unsigned long offset, size_t size, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        if (dma_ops->sync_single_range_for_device)
-                dma_ops->sync_single_range_for_device(hwdev, dma_handle,
-                                                      offset, size, direction);
-        flush_write_buffers();
-}
-static inline void
-dma_sync_sg_for_cpu(struct device *hwdev, struct scatterlist *sg,
-                    int nelems, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        if (dma_ops->sync_sg_for_cpu)
-                dma_ops->sync_sg_for_cpu(hwdev, sg, nelems, direction);
-        flush_write_buffers();
-}
-static inline void
-dma_sync_sg_for_device(struct device *hwdev, struct scatterlist *sg,
-                       int nelems, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        if (dma_ops->sync_sg_for_device) {
-                dma_ops->sync_sg_for_device(hwdev, sg, nelems, direction);
-        }
-        flush_write_buffers();
-}
-static inline int
-dma_map_sg(struct device *hwdev, struct scatterlist *sg, int nents, int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        return dma_ops->map_sg(hwdev, sg, nents, direction);
-}
-static inline void
-dma_unmap_sg(struct device *hwdev, struct scatterlist *sg, int nents,
-             int direction)
-{
-        BUG_ON(!valid_dma_direction(direction));
-        dma_ops->unmap_sg(hwdev, sg, nents, direction);
-}
-extern int dma_supported(struct device *hwdev, u64 mask);
-/* same for gart, swiotlb, and nommu */
-static inline int dma_get_cache_alignment(void)
-{
-        return boot_cpu_data.x86_clflush_size;
-}
-#define dma_is_consistent(d, h) 1
-extern int dma_set_mask(struct device *dev, u64 mask);
-static inline void
-dma_cache_sync(struct device *dev, void *vaddr, size_t size,
-        enum dma_data_direction dir)
-{
-        flush_write_buffers();
-}
-extern struct device fallback_dev;
-extern int panic_on_overflow;
-#endif /* _X8664_DMA_MAPPING_H */
diff --git a/include/asm-x86/e820_32.h b/include/asm-x86/e820_32.h
index 43b1a8bd4b34..a9f7c6ec32bf 100644
--- a/include/asm-x86/e820_32.h
+++ b/include/asm-x86/e820_32.h
@@ -24,7 +24,7 @@ extern void update_e820(void);
 extern int e820_all_mapped(unsigned long start, unsigned long end,
                           unsigned type);
 extern int e820_any_mapped(u64 start, u64 end, unsigned type);
-extern void find_max_pfn(void);
+extern void propagate_e820_map(void);
 extern void register_bootmem_low_pages(unsigned long max_low_pfn);
 extern void add_memory_region(unsigned long long start,
                              unsigned long long size, int type);
diff --git a/include/asm-x86/genapic_32.h b/include/asm-x86/genapic_32.h
index f1b96932746b..b02ea6e17de8 100644
--- a/include/asm-x86/genapic_32.h
+++ b/include/asm-x86/genapic_32.h
@@ -117,6 +117,7 @@ extern struct genapic *genapic;
 enum uv_system_type {UV_NONE, UV_LEGACY_APIC, UV_X2APIC, UV_NON_UNIQUE_APIC};
 #define get_uv_system_type()            UV_NONE
 #define is_uv_system()                  0
+#define uv_wakeup_secondary(a, b)       1
 #endif
diff --git a/include/asm-x86/i387.h b/include/asm-x86/i387.h
index 54522b814f1c..da2adb45f6e3 100644
--- a/include/asm-x86/i387.h
+++ b/include/asm-x86/i387.h
@@ -21,8 +21,9 @@
 extern void fpu_init(void);
 extern void mxcsr_feature_mask_init(void);
-extern void init_fpu(struct task_struct *child);
+extern int init_fpu(struct task_struct *child);
 extern asmlinkage void math_state_restore(void);
+extern void init_thread_xstate(void);
 extern user_regset_active_fn fpregs_active, xfpregs_active;
 extern user_regset_get_fn fpregs_get, xfpregs_get, fpregs_soft_get;
@@ -117,24 +118,22 @@ static inline void __save_init_fpu(struct task_struct *tsk)
        /* Using "fxsaveq %0" would be the ideal choice, but is only supported
           starting with gas 2.16. */
        __asm__ __volatile__("fxsaveq %0"
-                             : "=m" (tsk->thread.i387.fxsave));
+                             : "=m" (tsk->thread.xstate->fxsave));
 #elif 0
        /* Using, as a workaround, the properly prefixed form below isn't
           accepted by any binutils version so far released, complaining that
           the same type of prefix is used twice if an extended register is
           needed for addressing (fix submitted to mainline 2005-11-21). */
        __asm__ __volatile__("rex64/fxsave %0"
-                             : "=m" (tsk->thread.i387.fxsave));
+                             : "=m" (tsk->thread.xstate->fxsave));
 #else
        /* This, however, we can work around by forcing the compiler to select
           an addressing mode that doesn't require extended registers. */
-        __asm__ __volatile__("rex64/fxsave %P2(%1)"
+        __asm__ __volatile__("rex64/fxsave (%1)"
-                             : "=m" (tsk->thread.i387.fxsave)
+                             : "=m" (tsk->thread.xstate->fxsave)
-                             : "cdaSDb" (tsk),
+                             : "cdaSDb" (&tsk->thread.xstate->fxsave));
-                                "i" (offsetof(__typeof__(*tsk),
-                                              thread.i387.fxsave)));
 #endif
-        clear_fpu_state(&tsk->thread.i387.fxsave);
+        clear_fpu_state(&tsk->thread.xstate->fxsave);
        task_thread_info(tsk)->status &= ~TS_USEDFPU;
 }
@@ -148,7 +147,7 @@ static inline int save_i387(struct _fpstate __user *buf)
        int err = 0;
        BUILD_BUG_ON(sizeof(struct user_i387_struct) !=
-                        sizeof(tsk->thread.i387.fxsave));
+                        sizeof(tsk->thread.xstate->fxsave));
        if ((unsigned long)buf % 16)
                printk("save_i387: bad fpstate %p\n", buf);
@@ -164,7 +163,7 @@ static inline int save_i387(struct _fpstate __user *buf)
                task_thread_info(tsk)->status &= ~TS_USEDFPU;
                stts();
        } else {
-                if (__copy_to_user(buf, &tsk->thread.i387.fxsave,
+                if (__copy_to_user(buf, &tsk->thread.xstate->fxsave,
                                   sizeof(struct i387_fxsave_struct)))
                        return -1;
        }
@@ -201,7 +200,7 @@ static inline void restore_fpu(struct task_struct *tsk)
                "nop ; frstor %1",
                "fxrstor %1",
                X86_FEATURE_FXSR,
-                "m" ((tsk)->thread.i387.fxsave));
+                "m" (tsk->thread.xstate->fxsave));
 }
 /* We need a safe address that is cheap to find and that is already
@@ -225,8 +224,8 @@ static inline void __save_init_fpu(struct task_struct *tsk)
                "fxsave %[fx]\n"
                "bt $7,%[fsw] ; jnc 1f ; fnclex\n1:",
                X86_FEATURE_FXSR,
-                [fx] "m" (tsk->thread.i387.fxsave),
+                [fx] "m" (tsk->thread.xstate->fxsave),
-                [fsw] "m" (tsk->thread.i387.fxsave.swd) : "memory");
+                [fsw] "m" (tsk->thread.xstate->fxsave.swd) : "memory");
        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
           is pending.  Clear the x87 state here by setting it to fixed
           values. safe_address is a random variable that should be in L1 */
@@ -327,25 +326,25 @@ static inline void clear_fpu(struct task_struct *tsk)
 static inline unsigned short get_fpu_cwd(struct task_struct *tsk)
 {
        if (cpu_has_fxsr) {
-                return tsk->thread.i387.fxsave.cwd;
+                return tsk->thread.xstate->fxsave.cwd;
        } else {
-                return (unsigned short)tsk->thread.i387.fsave.cwd;
+                return (unsigned short)tsk->thread.xstate->fsave.cwd;
        }
 }
 static inline unsigned short get_fpu_swd(struct task_struct *tsk)
 {
        if (cpu_has_fxsr) {
-                return tsk->thread.i387.fxsave.swd;
+                return tsk->thread.xstate->fxsave.swd;
        } else {
-                return (unsigned short)tsk->thread.i387.fsave.swd;
+                return (unsigned short)tsk->thread.xstate->fsave.swd;
        }
 }
 static inline unsigned short get_fpu_mxcsr(struct task_struct *tsk)
 {
        if (cpu_has_xmm) {
-                return tsk->thread.i387.fxsave.mxcsr;
+                return tsk->thread.xstate->fxsave.mxcsr;
        } else {
                return MXCSR_DEFAULT;
        }
diff --git a/include/asm-x86/numa_64.h b/include/asm-x86/numa_64.h
index 32c22ae0709f..22e87c9f6a80 100644
--- a/include/asm-x86/numa_64.h
+++ b/include/asm-x86/numa_64.h
@@ -9,7 +9,8 @@ struct bootnode {
        u64 end;
 };
-extern int compute_hash_shift(struct bootnode *nodes, int numnodes);
+extern int compute_hash_shift(struct bootnode *nodes, int numblks,
+                              int *nodeids);
 #define ZONE_ALIGN (1UL << (MAX_ORDER+PAGE_SHIFT))
diff --git a/include/asm-x86/pci_64.h b/include/asm-x86/pci_64.h
index df867e5d80b1..f330234ffa5c 100644
--- a/include/asm-x86/pci_64.h
+++ b/include/asm-x86/pci_64.h
@@ -22,6 +22,7 @@ extern int (*pci_config_read)(int seg, int bus, int dev, int fn,
 extern int (*pci_config_write)(int seg, int bus, int dev, int fn,
                               int reg, int len, u32 value);
+extern void dma32_reserve_bootmem(void);
 extern void pci_iommu_alloc(void);
 /* The PCI address space does equal the physical memory
diff --git a/include/asm-x86/processor.h b/include/asm-x86/processor.h
index 6e26c7c717a2..e6bf92ddeb21 100644
--- a/include/asm-x86/processor.h
+++ b/include/asm-x86/processor.h
@@ -354,7 +354,7 @@ struct i387_soft_struct {
        u32                     entry_eip;
 };
-union i387_union {
+union thread_xstate {
        struct i387_fsave_struct        fsave;
        struct i387_fxsave_struct       fxsave;
        struct i387_soft_struct         soft;
@@ -365,6 +365,9 @@ DECLARE_PER_CPU(struct orig_ist, orig_ist);
 #endif
 extern void print_cpu_info(struct cpuinfo_x86 *);
+extern unsigned int xstate_size;
+extern void free_thread_xstate(struct task_struct *);
+extern struct kmem_cache *task_xstate_cachep;
 extern void init_scattered_cpuid_features(struct cpuinfo_x86 *c);
 extern unsigned int init_intel_cacheinfo(struct cpuinfo_x86 *c);
 extern unsigned short num_cache_leaves;
@@ -397,8 +400,8 @@ struct thread_struct {
        unsigned long           cr2;
        unsigned long           trap_no;
        unsigned long           error_code;
-        /* Floating point info: */
+        /* floating point and extended processor state */
-        union i387_union        i387 __attribute__((aligned(16)));;
+        union thread_xstate     *xstate;
 #ifdef CONFIG_X86_32
        /* Virtual 86 mode info */
        struct vm86_struct __user *vm86_info;
@@ -918,4 +921,11 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
 #define KSTK_EIP(task)          (task_pt_regs(task)->ip)
+/* Get/set a process' ability to use the timestamp counter instruction */
+#define GET_TSC_CTL(adr)        get_tsc_mode((adr))
+#define SET_TSC_CTL(val)        set_tsc_mode((val))
+extern int get_tsc_mode(unsigned long adr);
+extern int set_tsc_mode(unsigned int val);
 #endif
diff --git a/include/asm-x86/scatterlist.h b/include/asm-x86/scatterlist.h
index d13c197866d6..c0432061f81a 100644
--- a/include/asm-x86/scatterlist.h
+++ b/include/asm-x86/scatterlist.h
@@ -11,9 +11,7 @@ struct scatterlist {
        unsigned int    offset;
        unsigned int    length;
        dma_addr_t      dma_address;
-#ifdef CONFIG_X86_64
        unsigned int    dma_length;
-#endif
 };
 #define ARCH_HAS_SG_CHAIN
diff --git a/include/asm-x86/thread_info.h b/include/asm-x86/thread_info.h
index d5fd12f2abdb..77244f17993f 100644
--- a/include/asm-x86/thread_info.h
+++ b/include/asm-x86/thread_info.h
@@ -1,5 +1,14 @@
+#ifndef _ASM_X86_THREAD_INFO_H
 #ifdef CONFIG_X86_32
 # include "thread_info_32.h"
 #else
 # include "thread_info_64.h"
 #endif
+#ifndef __ASSEMBLY__
+extern void arch_task_cache_init(void);
+extern void free_thread_info(struct thread_info *ti);
+extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
+#define arch_task_cache_init arch_task_cache_init
+#endif
+#endif /* _ASM_X86_THREAD_INFO_H */
diff --git a/include/asm-x86/thread_info_32.h b/include/asm-x86/thread_info_32.h
index 4e053fa561a9..531859962096 100644
--- a/include/asm-x86/thread_info_32.h
+++ b/include/asm-x86/thread_info_32.h
@@ -102,8 +102,6 @@ static inline struct thread_info *current_thread_info(void)
        __get_free_pages(GFP_KERNEL, get_order(THREAD_SIZE)))
 #endif
-#define free_thread_info(info)  free_pages((unsigned long)(info), get_order(THREAD_SIZE))
 #else /* !__ASSEMBLY__ */
 /* how to get the thread information struct from ASM */
diff --git a/include/asm-x86/thread_info_64.h b/include/asm-x86/thread_info_64.h
index 1e5c6f6152cd..ed664e874dec 100644
--- a/include/asm-x86/thread_info_64.h
+++ b/include/asm-x86/thread_info_64.h
@@ -85,8 +85,6 @@ static inline struct thread_info *stack_thread_info(void)
 #define alloc_thread_info(tsk)                                          \
        ((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
-#define free_thread_info(ti) free_pages((unsigned long) (ti), THREAD_ORDER)
 #else /* !__ASSEMBLY__ */
 /* how to get the thread information struct from ASM */
@@ -126,6 +124,7 @@ static inline struct thread_info *stack_thread_info(void)
 #define TIF_DEBUGCTLMSR         25      /* uses thread_struct.debugctlmsr */
 #define TIF_DS_AREA_MSR         26      /* uses thread_struct.ds_area_msr */
 #define TIF_BTS_TRACE_TS        27      /* record scheduling event timestamps */
+#define TIF_NOTSC               28      /* TSC is not accessible in userland */
 #define _TIF_SYSCALL_TRACE      (1 << TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING         (1 << TIF_SIGPENDING)
@@ -147,6 +146,7 @@ static inline struct thread_info *stack_thread_info(void)
 #define _TIF_DEBUGCTLMSR        (1 << TIF_DEBUGCTLMSR)
 #define _TIF_DS_AREA_MSR        (1 << TIF_DS_AREA_MSR)
 #define _TIF_BTS_TRACE_TS       (1 << TIF_BTS_TRACE_TS)
+#define _TIF_NOTSC              (1 << TIF_NOTSC)
 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK                                                  \
@@ -160,7 +160,7 @@ static inline struct thread_info *stack_thread_info(void)
 /* flags to check in __switch_to() */
 #define _TIF_WORK_CTXSW                                                 \
-        (_TIF_IO_BITMAP|_TIF_DEBUGCTLMSR|_TIF_DS_AREA_MSR|_TIF_BTS_TRACE_TS)
+        (_TIF_IO_BITMAP|_TIF_DEBUGCTLMSR|_TIF_DS_AREA_MSR|_TIF_BTS_TRACE_TS|_TIF_NOTSC)
 #define _TIF_WORK_CTXSW_PREV _TIF_WORK_CTXSW
 #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW|_TIF_DEBUG)
diff --git a/include/asm-x86/tsc.h b/include/asm-x86/tsc.h
index d2d8eb5b55f5..0434bd8349a7 100644
--- a/include/asm-x86/tsc.h
+++ b/include/asm-x86/tsc.h
@@ -18,6 +18,7 @@ extern unsigned int cpu_khz;
 extern unsigned int tsc_khz;
 extern void disable_TSC(void);
+extern void enable_TSC(void);
 static inline cycles_t get_cycles(void)
 {
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 14813b595802..a5f359a7ad0e 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -18,6 +18,7 @@
 #include <linux/proc_fs.h>
 #include <linux/rtc.h>
 #include <linux/ioport.h>
+#include <linux/pfn.h>
 #include <asm/page.h>
 #include <asm/system.h>
@@ -394,4 +395,10 @@ struct efi_generic_dev_path {
        u16 length;
 } __attribute ((packed));
+static inline void memrange_efi_to_native(u64 *addr, u64 *npages)
+{
+        *npages = PFN_UP(*addr + (*npages<<EFI_PAGE_SHIFT)) - PFN_DOWN(*addr);
+        *addr &= PAGE_MASK;
+}
 #endif /* _LINUX_EFI_H */
diff --git a/include/linux/file.h b/include/linux/file.h
index 7239baac81a9..653477021e4c 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -61,6 +61,7 @@ extern struct kmem_cache *filp_cachep;
 extern void __fput(struct file *);
 extern void fput(struct file *);
+extern void drop_file_write_access(struct file *file);
 struct file_operations;
 struct vfsmount;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index b84b848431f2..d1eeea669d2c 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -776,6 +776,9 @@ static inline int ra_has_index(struct file_ra_state *ra, pgoff_t index)
                index <  ra->start + ra->size);
 }
+#define FILE_MNT_WRITE_TAKEN    1
+#define FILE_MNT_WRITE_RELEASED 2
 struct file {
        /*
         * fu_list becomes invalid after file_free is called and queued via
@@ -810,6 +813,9 @@ struct file {
        spinlock_t              f_ep_lock;
 #endif /* #ifdef CONFIG_EPOLL */
        struct address_space    *f_mapping;
+#ifdef CONFIG_DEBUG_WRITECOUNT
+        unsigned long f_mnt_write_state;
+#endif
 };
 extern spinlock_t files_lock;
 #define file_list_lock() spin_lock(&files_lock);
@@ -818,6 +824,49 @@ extern spinlock_t files_lock;
 #define get_file(x)     atomic_inc(&(x)->f_count)
 #define file_count(x)   atomic_read(&(x)->f_count)
+#ifdef CONFIG_DEBUG_WRITECOUNT
+static inline void file_take_write(struct file *f)
+{
+        WARN_ON(f->f_mnt_write_state != 0);
+        f->f_mnt_write_state = FILE_MNT_WRITE_TAKEN;
+}
+static inline void file_release_write(struct file *f)
+{
+        f->f_mnt_write_state |= FILE_MNT_WRITE_RELEASED;
+}
+static inline void file_reset_write(struct file *f)
+{
+        f->f_mnt_write_state = 0;
+}
+static inline void file_check_state(struct file *f)
+{
+        /*
+         * At this point, either both or neither of these bits
+         * should be set.
+         */
+        WARN_ON(f->f_mnt_write_state == FILE_MNT_WRITE_TAKEN);
+        WARN_ON(f->f_mnt_write_state == FILE_MNT_WRITE_RELEASED);
+}
+static inline int file_check_writeable(struct file *f)
+{
+        if (f->f_mnt_write_state == FILE_MNT_WRITE_TAKEN)
+                return 0;
+        printk(KERN_WARNING "writeable file with no "
+                            "mnt_want_write()\n");
+        WARN_ON(1);
+        return -EINVAL;
+}
+#else /* !CONFIG_DEBUG_WRITECOUNT */
+static inline void file_take_write(struct file *filp) {}
+static inline void file_release_write(struct file *filp) {}
+static inline void file_reset_write(struct file *filp) {}
+static inline void file_check_state(struct file *filp) {}
+static inline int file_check_writeable(struct file *filp)
+{
+        return 0;
+}
+#endif /* CONFIG_DEBUG_WRITECOUNT */
 #define MAX_NON_LFS     ((1UL<<31) - 1)
 /* Page cache limit. The filesystems should put that into their s_maxbytes 
@@ -1735,7 +1784,8 @@ extern struct file *create_read_pipe(struct file *f);
 extern struct file *create_write_pipe(void);
 extern void free_write_pipe(struct file *);
-extern int open_namei(int dfd, const char *, int, int, struct nameidata *);
+extern struct file *do_filp_open(int dfd, const char *pathname,
+                int open_flag, int mode);
 extern int may_open(struct nameidata *, int, int);
 extern int kernel_read(struct file *, unsigned long, char *, unsigned long);
diff --git a/include/linux/irqflags.h b/include/linux/irqflags.h
index 412e025bc5c7..e600c4e9b8c5 100644
--- a/include/linux/irqflags.h
+++ b/include/linux/irqflags.h
@@ -84,10 +84,10 @@
 #define irqs_disabled()                                         \
 ({                                                              \
-        unsigned long flags;                                    \
+        unsigned long _flags;                                   \
                                                                \
-        raw_local_save_flags(flags);                            \
+        raw_local_save_flags(_flags);                           \
-        raw_irqs_disabled_flags(flags);                         \
+        raw_irqs_disabled_flags(_flags);                        \
 })
 #define irqs_disabled_flags(flags)      raw_irqs_disabled_flags(flags)
diff --git a/include/linux/list.h b/include/linux/list.h
index 75ce2cb4ff6e..dac16f99c701 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -631,31 +631,14 @@ static inline void list_splice_init_rcu(struct list_head *list,
 * as long as the traversal is guarded by rcu_read_lock().
 */
 #define list_for_each_rcu(pos, head) \
-        for (pos = (head)->next; \
+        for (pos = rcu_dereference((head)->next); \
-                prefetch(rcu_dereference(pos)->next), pos != (head); \
+                prefetch(pos->next), pos != (head); \
-                pos = pos->next)
+                pos = rcu_dereference(pos->next))
 #define __list_for_each_rcu(pos, head) \
-        for (pos = (head)->next; \
+        for (pos = rcu_dereference((head)->next); \
-                rcu_dereference(pos) != (head); \
+                pos != (head); \
-                pos = pos->next)
+                pos = rcu_dereference(pos->next))
-/**
- * list_for_each_safe_rcu
- * @pos:        the &struct list_head to use as a loop cursor.
- * @n:          another &struct list_head to use as temporary storage
- * @head:       the head for your list.
- *
- * Iterate over an rcu-protected list, safe against removal of list entry.
- *
- * This list-traversal primitive may safely run concurrently with
- * the _rcu list-mutation primitives such as list_add_rcu()
- * as long as the traversal is guarded by rcu_read_lock().
- */
-#define list_for_each_safe_rcu(pos, n, head) \
-        for (pos = (head)->next; \
-                n = rcu_dereference(pos)->next, pos != (head); \
-                pos = n)
 /**
 * list_for_each_entry_rcu      -       iterate over rcu list of given type
@@ -668,10 +651,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
 * as long as the traversal is guarded by rcu_read_lock().
 */
 #define list_for_each_entry_rcu(pos, head, member) \
-        for (pos = list_entry((head)->next, typeof(*pos), member); \
+        for (pos = list_entry(rcu_dereference((head)->next), typeof(*pos), member); \
-                prefetch(rcu_dereference(pos)->member.next), \
+                prefetch(pos->member.next), &pos->member != (head); \
-                        &pos->member != (head); \
+                pos = list_entry(rcu_dereference(pos->member.next), typeof(*pos), member))
-                pos = list_entry(pos->member.next, typeof(*pos), member))
 /**
@@ -686,9 +668,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
 * as long as the traversal is guarded by rcu_read_lock().
 */
 #define list_for_each_continue_rcu(pos, head) \
-        for ((pos) = (pos)->next; \
+        for ((pos) = rcu_dereference((pos)->next); \
-                prefetch(rcu_dereference((pos))->next), (pos) != (head); \
+                prefetch((pos)->next), (pos) != (head); \
-                (pos) = (pos)->next)
+                (pos) = rcu_dereference((pos)->next))
 /*
 * Double linked lists with a single pointer list head.
@@ -986,10 +968,10 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
 * as long as the traversal is guarded by rcu_read_lock().
 */
 #define hlist_for_each_entry_rcu(tpos, pos, head, member)                \
-        for (pos = (head)->first;                                        \
+        for (pos = rcu_dereference((head)->first);                       \
-             rcu_dereference(pos) && ({ prefetch(pos->next); 1;}) &&     \
+                pos && ({ prefetch(pos->next); 1;}) &&                   \
                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
-             pos = pos->next)
+             pos = rcu_dereference(pos->next))
 #else
 #warning "don't include kernel headers in userspace"
diff --git a/include/linux/mount.h b/include/linux/mount.h
index 5ee2df217cdf..d6600e3f7e45 100644
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/list.h>
+#include <linux/nodemask.h>
 #include <linux/spinlock.h>
 #include <asm/atomic.h>
@@ -28,8 +29,10 @@ struct mnt_namespace;
 #define MNT_NOATIME     0x08
 #define MNT_NODIRATIME  0x10
 #define MNT_RELATIME    0x20
+#define MNT_READONLY    0x40    /* does the user want this to be r/o? */
 #define MNT_SHRINKABLE  0x100
+#define MNT_IMBALANCED_WRITE_COUNT      0x200 /* just for debugging */
 #define MNT_SHARED      0x1000  /* if the vfsmount is a shared mount */
 #define MNT_UNBINDABLE  0x2000  /* if the vfsmount is a unbindable mount */
@@ -62,6 +65,11 @@ struct vfsmount {
        int mnt_expiry_mark;            /* true if marked for expiry */
        int mnt_pinned;
        int mnt_ghosts;
+        /*
+         * This value is not stable unless all of the mnt_writers[] spinlocks
+         * are held, and all mnt_writer[]s on this mount have 0 as their ->count
+         */
+        atomic_t __mnt_writers;
 };
 static inline struct vfsmount *mntget(struct vfsmount *mnt)
@@ -71,9 +79,12 @@ static inline struct vfsmount *mntget(struct vfsmount *mnt)
        return mnt;
 }
+extern int mnt_want_write(struct vfsmount *mnt);
+extern void mnt_drop_write(struct vfsmount *mnt);
 extern void mntput_no_expire(struct vfsmount *mnt);
 extern void mnt_pin(struct vfsmount *mnt);
 extern void mnt_unpin(struct vfsmount *mnt);
+extern int __mnt_is_readonly(struct vfsmount *mnt);
 static inline void mntput(struct vfsmount *mnt)
 {
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 3800639775ae..5c80b1939636 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -67,4 +67,10 @@
 #define PR_CAPBSET_READ 23
 #define PR_CAPBSET_DROP 24
+/* Get/set the process' ability to use the timestamp counter instruction */
+#define PR_GET_TSC 25
+#define PR_SET_TSC 26
+# define PR_TSC_ENABLE          1       /* allow the use of the timestamp counter */
+# define PR_TSC_SIGSEGV         2       /* throw a SIGSEGV instead of reading the TSC */
 #endif /* _LINUX_PRCTL_H */
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 60f7a27f7a9e..94fd3b08fb77 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -598,6 +598,7 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
                        int oflag, mode_t mode, struct mq_attr __user *u_attr)
 {
        struct mq_attr attr;
+        struct file *result;
        int ret;
        if (u_attr) {
@@ -612,13 +613,24 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
        }
        mode &= ~current->fs->umask;
+        ret = mnt_want_write(mqueue_mnt);
+        if (ret)
+                goto out;
        ret = vfs_create(dir->d_inode, dentry, mode, NULL);
        dentry->d_fsdata = NULL;
        if (ret)
-                goto out;
+                goto out_drop_write;
-        return dentry_open(dentry, mqueue_mnt, oflag);
+        result = dentry_open(dentry, mqueue_mnt, oflag);
+        /*
+         * dentry_open() took a persistent mnt_want_write(),
+         * so we can now drop this one.
+         */
+        mnt_drop_write(mqueue_mnt);
+        return result;
+out_drop_write:
+        mnt_drop_write(mqueue_mnt);
 out:
        dput(dentry);
        mntput(mqueue_mnt);
@@ -742,8 +754,11 @@ asmlinkage long sys_mq_unlink(const char __user *u_name)
        inode = dentry->d_inode;
        if (inode)
                atomic_inc(&inode->i_count);
+        err = mnt_want_write(mqueue_mnt);
+        if (err)
+                goto out_err;
        err = vfs_unlink(dentry->d_parent->d_inode, dentry);
+        mnt_drop_write(mqueue_mnt);
 out_err:
        dput(dentry);
diff --git a/kernel/fork.c b/kernel/fork.c
index 9c042f901570..89fe414645e9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -132,6 +132,14 @@ void __put_task_struct(struct task_struct *tsk)
                free_task(tsk);
 }
+/*
+ * macro override instead of weak attribute alias, to workaround
+ * gcc 4.1.0 and 4.1.1 bugs with weak attribute and empty functions.
+ */
+#ifndef arch_task_cache_init
+#define arch_task_cache_init()
+#endif
 void __init fork_init(unsigned long mempages)
 {
 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
@@ -144,6 +152,9 @@ void __init fork_init(unsigned long mempages)
                        ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL);
 #endif
+        /* do the arch specific task caches init */
+        arch_task_cache_init();
        /*
         * The default maximum number of threads is set to a safe
         * value: the thread structures can take up at most half
@@ -163,6 +174,13 @@ void __init fork_init(unsigned long mempages)
                init_task.signal->rlim[RLIMIT_NPROC];
 }
+int __attribute__((weak)) arch_dup_task_struct(struct task_struct *dst,
+                                               struct task_struct *src)
+{
+        *dst = *src;
+        return 0;
+}
 static struct task_struct *dup_task_struct(struct task_struct *orig)
 {
        struct task_struct *tsk;
@@ -181,15 +199,15 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
                return NULL;
        }
-        *tsk = *orig;
+        err = arch_dup_task_struct(tsk, orig);
+        if (err)
+                goto out;
        tsk->stack = ti;
        err = prop_local_init_single(&tsk->dirties);
-        if (err) {
+        if (err)
-                free_thread_info(ti);
+                goto out;
-                free_task_struct(tsk);
-                return NULL;
-        }
        setup_thread_stack(tsk, orig);
@@ -205,6 +223,11 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
 #endif
        tsk->splice_pipe = NULL;
        return tsk;
+out:
+        free_thread_info(ti);
+        free_task_struct(tsk);
+        return NULL;
 }
 #ifdef CONFIG_MMU
diff --git a/kernel/sys.c b/kernel/sys.c
index a626116af5db..6a0cc71ee88d 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -67,6 +67,12 @@
 #ifndef SET_ENDIAN
 # define SET_ENDIAN(a,b)        (-EINVAL)
 #endif
+#ifndef GET_TSC_CTL
+# define GET_TSC_CTL(a)         (-EINVAL)
+#endif
+#ifndef SET_TSC_CTL
+# define SET_TSC_CTL(a)         (-EINVAL)
+#endif
 /*
 * this is where the system-wide overflow UID and GID are defined, for
@@ -1737,7 +1743,12 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
 #else
                        return -EINVAL;
 #endif
+                case PR_GET_TSC:
+                        error = GET_TSC_CTL(arg2);
+                        break;
+                case PR_SET_TSC:
+                        error = SET_TSC_CTL(arg2);
+                        break;
                default:
                        error = -EINVAL;
                        break;
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index a3fa587c350c..2d6087c7cf98 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -178,6 +178,7 @@ static void change_clocksource(void)
        if (clock == new)
                return;
+        new->cycle_last = 0;
        now = clocksource_read(new);
        nsec =  __get_nsec_offset();
        timespec_add_ns(&xtime, nsec);
@@ -295,6 +296,7 @@ static int timekeeping_resume(struct sys_device *dev)
        timespec_add_ns(&xtime, timekeeping_suspend_nsecs);
        update_xtime_cache(0);
        /* re-base the last cycle value */
+        clock->cycle_last = 0;
        clock->cycle_last = clocksource_read(clock);
        clock->error = 0;
        timekeeping_suspended = 0;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 95de3102bc87..623ef24c2381 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -427,6 +427,16 @@ config DEBUG_VM
          If unsure, say N.
+config DEBUG_WRITECOUNT
+        bool "Debug filesystem writers count"
+        depends on DEBUG_KERNEL
+        help
+          Enable this to catch wrong use of the writers count in struct
+          vfsmount.  This will increase the size of each file struct by
+          32 bits.
+          If unsure, say N.
 config DEBUG_LIST
        bool "Debug linked list manipulation"
        depends on DEBUG_KERNEL
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 2851d0d15048..1454afcc06c4 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -819,7 +819,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 */
                mode = S_IFSOCK |
                       (SOCK_INODE(sock)->i_mode & ~current->fs->umask);
+                err = mnt_want_write(nd.path.mnt);
+                if (err)
+                        goto out_mknod_dput;
                err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
+                mnt_drop_write(nd.path.mnt);
                if (err)
                        goto out_mknod_dput;
                mutex_unlock(&nd.path.dentry->d_inode->i_mutex);