11 files changed, 283 insertions, 190 deletions

diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 5bd90a7eb763..f0b5ff17d860 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -419,7 +419,7 @@ static void xics_set_affinity(unsigned int virq, cpumask_t cpumask)
          * For the moment only implement delivery to all cpus or one cpu.
          * Get current irq_server for the given irq
          */
-        irq_server = get_irq_server(irq, 1);
+        irq_server = get_irq_server(virq, 1);
         if (irq_server == -1) {
                 char cpulist[128];
                 cpumask_scnprintf(cpulist, sizeof(cpulist), cpumask);
diff --git a/arch/sparc/kernel/ebus.c b/arch/sparc/kernel/ebus.c
index e2d02fd13f35..d850785b2080 100644
--- a/arch/sparc/kernel/ebus.c
+++ b/arch/sparc/kernel/ebus.c
@@ -156,6 +156,8 @@ void __init fill_ebus_device(struct device_node *dp, struct linux_ebus_device *d
         dev->prom_node = dp;
 
         regs = of_get_property(dp, "reg", &len);
+        if (!regs)
+                len = 0;
         if (len % sizeof(struct linux_prom_registers)) {
                 prom_printf("UGH: proplen for %s was %d, need multiple of %d\n",
                             dev->prom_node->name, len,
diff --git a/arch/sparc64/kernel/binfmt_aout32.c b/arch/sparc64/kernel/binfmt_aout32.c
index f205fc7cbcd0..d208cc7804f2 100644
--- a/arch/sparc64/kernel/binfmt_aout32.c
+++ b/arch/sparc64/kernel/binfmt_aout32.c
@@ -177,7 +177,7 @@ static u32 __user *create_aout32_tables(char __user *p, struct linux_binprm *bpr
                         get_user(c,p++);
                 } while (c);
         }
-        put_user(NULL,argv);
+        put_user(0,argv);
         current->mm->arg_end = current->mm->env_start = (unsigned long) p;
         while (envc-->0) {
                 char c;
@@ -186,7 +186,7 @@ static u32 __user *create_aout32_tables(char __user *p, struct linux_binprm *bpr
                         get_user(c,p++);
                 } while (c);
         }
-        put_user(NULL,envp);
+        put_user(0,envp);
         current->mm->env_end = (unsigned long) p;
         return sp;
 }
diff --git a/arch/sparc64/kernel/ebus.c b/arch/sparc64/kernel/ebus.c
index bc9ae36f7a43..04ab81cb4f48 100644
--- a/arch/sparc64/kernel/ebus.c
+++ b/arch/sparc64/kernel/ebus.c
@@ -375,7 +375,10 @@ static void __init fill_ebus_device(struct device_node *dp, struct linux_ebus_de
                 dev->num_addrs = 0;
                 dev->num_irqs = 0;
         } else {
-                (void) of_get_property(dp, "reg", &len);
+                const int *regs = of_get_property(dp, "reg", &len);
+
+                if (!regs)
+                        len = 0;
                 dev->num_addrs = len / sizeof(struct linux_prom_registers);
 
                 for (i = 0; i < dev->num_addrs; i++)
diff --git a/arch/sparc64/lib/NGcopy_from_user.S b/arch/sparc64/lib/NGcopy_from_user.S
index 2d93456f76dd..e7f433f71b42 100644
--- a/arch/sparc64/lib/NGcopy_from_user.S
+++ b/arch/sparc64/lib/NGcopy_from_user.S
@@ -1,6 +1,6 @@
 /* NGcopy_from_user.S: Niagara optimized copy from userspace.
  *
- * Copyright (C) 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
 #define EX_LD(x)                \
@@ -8,8 +8,8 @@
         .section .fixup;        \
         .align 4;               \
 99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
+        ret;                    \
+         restore %g0, 1, %o0;   \
         .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
@@ -24,7 +24,7 @@
 #define LOAD(type,addr,dest)    type##a [addr] ASI_AIUS, dest
 #define LOAD_TWIN(addr_reg,dest0,dest1) \
         ldda [addr_reg] ASI_BLK_INIT_QUAD_LDD_AIUS, dest0
-#define EX_RETVAL(x)            0
+#define EX_RETVAL(x)            %g0
 
 #ifdef __KERNEL__
 #define PREAMBLE                                        \
diff --git a/arch/sparc64/lib/NGcopy_to_user.S b/arch/sparc64/lib/NGcopy_to_user.S
index 34112d5054ef..6ea01c5532a0 100644
--- a/arch/sparc64/lib/NGcopy_to_user.S
+++ b/arch/sparc64/lib/NGcopy_to_user.S
@@ -1,6 +1,6 @@
 /* NGcopy_to_user.S: Niagara optimized copy to userspace.
  *
- * Copyright (C) 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
 #define EX_ST(x)                \
@@ -8,8 +8,8 @@
         .section .fixup;        \
         .align 4;               \
 99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
+        ret;                    \
+         restore %g0, 1, %o0;   \
         .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
@@ -23,7 +23,7 @@
 #define FUNC_NAME               NGcopy_to_user
 #define STORE(type,src,addr)    type##a src, [addr] ASI_AIUS
 #define STORE_ASI               ASI_BLK_INIT_QUAD_LDD_AIUS
-#define EX_RETVAL(x)            0
+#define EX_RETVAL(x)            %g0
 
 #ifdef __KERNEL__
         /* Writing to %asi is _expensive_ so we hardcode it.
diff --git a/arch/sparc64/lib/NGmemcpy.S b/arch/sparc64/lib/NGmemcpy.S
index 66063a9a66b8..605cb3f09900 100644
--- a/arch/sparc64/lib/NGmemcpy.S
+++ b/arch/sparc64/lib/NGmemcpy.S
@@ -1,6 +1,6 @@
 /* NGmemcpy.S: Niagara optimized memcpy.
  *
- * Copyright (C) 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
 #ifdef __KERNEL__
@@ -16,6 +16,12 @@
         wr      %g0, ASI_PNF, %asi
 #endif
 
+#ifdef __sparc_v9__
+#define SAVE_AMOUNT     128
+#else
+#define SAVE_AMOUNT     64
+#endif
+
 #ifndef STORE_ASI
 #define STORE_ASI       ASI_BLK_INIT_QUAD_LDD_P
 #endif
@@ -50,7 +56,11 @@
 #endif
 
 #ifndef STORE_INIT
+#ifndef SIMULATE_NIAGARA_ON_NON_NIAGARA
 #define STORE_INIT(src,addr)    stxa src, [addr] %asi
+#else
+#define STORE_INIT(src,addr)    stx src, [addr + 0x00]
+#endif
 #endif
 
 #ifndef FUNC_NAME
@@ -73,18 +83,19 @@
 
         .globl  FUNC_NAME
         .type   FUNC_NAME,#function
-FUNC_NAME:      /* %o0=dst, %o1=src, %o2=len */
-        srlx            %o2, 31, %g2
+FUNC_NAME:      /* %i0=dst, %i1=src, %i2=len */
+        PREAMBLE
+        save            %sp, -SAVE_AMOUNT, %sp
+        srlx            %i2, 31, %g2
         cmp             %g2, 0
         tne             %xcc, 5
-        PREAMBLE
-        mov             %o0, GLOBAL_SPARE
-        cmp             %o2, 0
+        mov             %i0, %o0
+        cmp             %i2, 0
         be,pn           %XCC, 85f
-         or             %o0, %o1, %o3
-        cmp             %o2, 16
+         or             %o0, %i1, %i3
+        cmp             %i2, 16
         blu,a,pn        %XCC, 80f
-         or             %o3, %o2, %o3
+         or             %i3, %i2, %i3
 
         /* 2 blocks (128 bytes) is the minimum we can do the block
          * copy with.  We need to ensure that we'll iterate at least
@@ -93,31 +104,31 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          * to (64 - 1) bytes from the length before we perform the
          * block copy loop.
          */
-        cmp             %o2, (2 * 64)
+        cmp             %i2, (2 * 64)
         blu,pt          %XCC, 70f
-         andcc          %o3, 0x7, %g0
+         andcc          %i3, 0x7, %g0
 
         /* %o0: dst
-         * %o1: src
-         * %o2: len  (known to be >= 128)
+         * %i1: src
+         * %i2: len  (known to be >= 128)
          *
-         * The block copy loops will use %o4/%o5,%g2/%g3 as
+         * The block copy loops will use %i4/%i5,%g2/%g3 as
          * temporaries while copying the data.
          */
 
-        LOAD(prefetch, %o1, #one_read)
+        LOAD(prefetch, %i1, #one_read)
         wr              %g0, STORE_ASI, %asi
 
         /* Align destination on 64-byte boundary.  */
-        andcc           %o0, (64 - 1), %o4
+        andcc           %o0, (64 - 1), %i4
         be,pt           %XCC, 2f
-         sub            %o4, 64, %o4
-        sub             %g0, %o4, %o4   ! bytes to align dst
-        sub             %o2, %o4, %o2
-1:      subcc           %o4, 1, %o4
-        EX_LD(LOAD(ldub, %o1, %g1))
+         sub            %i4, 64, %i4
+        sub             %g0, %i4, %i4   ! bytes to align dst
+        sub             %i2, %i4, %i2
+1:      subcc           %i4, 1, %i4
+        EX_LD(LOAD(ldub, %i1, %g1))
         EX_ST(STORE(stb, %g1, %o0))
-        add             %o1, 1, %o1
+        add             %i1, 1, %i1
         bne,pt          %XCC, 1b
         add             %o0, 1, %o0
 
@@ -136,111 +147,155 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
          * aligned store data at a time, this is easy to ensure.
          */
 2:
-        andcc           %o1, (16 - 1), %o4
-        andn            %o2, (64 - 1), %g1      ! block copy loop iterator
-        sub             %o2, %g1, %o2           ! final sub-block copy bytes
+        andcc           %i1, (16 - 1), %i4
+        andn            %i2, (64 - 1), %g1      ! block copy loop iterator
         be,pt           %XCC, 50f
-         cmp            %o4, 8
-        be,a,pt         %XCC, 10f
-         sub            %o1, 0x8, %o1
+         sub            %i2, %g1, %i2           ! final sub-block copy bytes
+
+        cmp             %i4, 8
+        be,pt           %XCC, 10f
+         sub            %i1, %i4, %i1
 
         /* Neither 8-byte nor 16-byte aligned, shift and mask.  */
-        mov             %g1, %o4
-        and             %o1, 0x7, %g1
-        sll             %g1, 3, %g1
-        mov             64, %o3
-        andn            %o1, 0x7, %o1
-        EX_LD(LOAD(ldx, %o1, %g2))
-        sub             %o3, %g1, %o3
-        sllx            %g2, %g1, %g2
+        and             %i4, 0x7, GLOBAL_SPARE
+        sll             GLOBAL_SPARE, 3, GLOBAL_SPARE
+        mov             64, %i5
+        EX_LD(LOAD_TWIN(%i1, %g2, %g3))
+        sub             %i5, GLOBAL_SPARE, %i5
+        mov             16, %o4
+        mov             32, %o5
+        mov             48, %o7
+        mov             64, %i3
+
+        bg,pn           %XCC, 9f
+         nop
 
-#define SWIVEL_ONE_DWORD(SRC, TMP1, TMP2, PRE_VAL, PRE_SHIFT, POST_SHIFT, DST)\
-        EX_LD(LOAD(ldx, SRC, TMP1)); \
-        srlx            TMP1, PRE_SHIFT, TMP2; \
-        or              TMP2, PRE_VAL, TMP2; \
-        EX_ST(STORE_INIT(TMP2, DST)); \
-        sllx            TMP1, POST_SHIFT, PRE_VAL;
-
-1:      add             %o1, 0x8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x00)
-        add             %o1, 0x8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x08)
-        add             %o1, 0x8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x10)
-        add             %o1, 0x8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x18)
-        add             %o1, 32, %o1
-        LOAD(prefetch, %o1, #one_read)
-        sub             %o1, 32 - 8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x20)
-        add             %o1, 8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x28)
-        add             %o1, 8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x30)
-        add             %o1, 8, %o1
-        SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x38)
-        subcc           %o4, 64, %o4
-        bne,pt          %XCC, 1b
+#define MIX_THREE_WORDS(WORD1, WORD2, WORD3, PRE_SHIFT, POST_SHIFT, TMP) \
+        sllx            WORD1, POST_SHIFT, WORD1; \
+        srlx            WORD2, PRE_SHIFT, TMP; \
+        sllx            WORD2, POST_SHIFT, WORD2; \
+        or              WORD1, TMP, WORD1; \
+        srlx            WORD3, PRE_SHIFT, TMP; \
+        or              WORD2, TMP, WORD2;
+
+8:      EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3))
+        MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1)
+        LOAD(prefetch, %i1 + %i3, #one_read)
+
+        EX_ST(STORE_INIT(%g2, %o0 + 0x00))
+        EX_ST(STORE_INIT(%g3, %o0 + 0x08))
+
+        EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3))
+        MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1)
+
+        EX_ST(STORE_INIT(%o2, %o0 + 0x10))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x18))
+
+        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+        MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1)
+
+        EX_ST(STORE_INIT(%g2, %o0 + 0x20))
+        EX_ST(STORE_INIT(%g3, %o0 + 0x28))
+
+        EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3))
+        add             %i1, 64, %i1
+        MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1)
+
+        EX_ST(STORE_INIT(%o2, %o0 + 0x30))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x38))
+
+        subcc           %g1, 64, %g1
+        bne,pt          %XCC, 8b
          add            %o0, 64, %o0
 
-#undef SWIVEL_ONE_DWORD
+        ba,pt           %XCC, 60f
+         add            %i1, %i4, %i1
+
+9:      EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3))
+        MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1)
+        LOAD(prefetch, %i1 + %i3, #one_read)
+
+        EX_ST(STORE_INIT(%g3, %o0 + 0x00))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x08))
+
+        EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3))
+        MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1)
+
+        EX_ST(STORE_INIT(%o3, %o0 + 0x10))
+        EX_ST(STORE_INIT(%g2, %o0 + 0x18))
+
+        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+        MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1)
+
+        EX_ST(STORE_INIT(%g3, %o0 + 0x20))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x28))
+
+        EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3))
+        add             %i1, 64, %i1
+        MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1)
+
+        EX_ST(STORE_INIT(%o3, %o0 + 0x30))
+        EX_ST(STORE_INIT(%g2, %o0 + 0x38))
+
+        subcc           %g1, 64, %g1
+        bne,pt          %XCC, 9b
+         add            %o0, 64, %o0
 
-        srl             %g1, 3, %g1
         ba,pt           %XCC, 60f
-         add            %o1, %g1, %o1
+         add            %i1, %i4, %i1
 
 10:     /* Destination is 64-byte aligned, source was only 8-byte
          * aligned but it has been subtracted by 8 and we perform
          * one twin load ahead, then add 8 back into source when
          * we finish the loop.
          */
-        EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-1:      add             %o1, 16, %o1
-        EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-        add             %o1, 16 + 32, %o1
-        LOAD(prefetch, %o1, #one_read)
-        sub             %o1, 32, %o1
+        EX_LD(LOAD_TWIN(%i1, %o4, %o5))
+        mov     16, %o7
+        mov     32, %g2
+        mov     48, %g3
+        mov     64, %o1
+1:      EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+        LOAD(prefetch, %i1 + %o1, #one_read)
         EX_ST(STORE_INIT(%o5, %o0 + 0x00))      ! initializes cache line
-        EX_ST(STORE_INIT(%g2, %o0 + 0x08))
-        EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-        add             %o1, 16, %o1
-        EX_ST(STORE_INIT(%g3, %o0 + 0x10))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x08))
+        EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x10))
         EX_ST(STORE_INIT(%o4, %o0 + 0x18))
-        EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-        add             %o1, 16, %o1
+        EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3))
         EX_ST(STORE_INIT(%o5, %o0 + 0x20))
-        EX_ST(STORE_INIT(%g2, %o0 + 0x28))
-        EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-        EX_ST(STORE_INIT(%g3, %o0 + 0x30))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x28))
+        EX_LD(LOAD_TWIN(%i1 + %o1, %o4, %o5))
+        add             %i1, 64, %i1
+        EX_ST(STORE_INIT(%o3, %o0 + 0x30))
         EX_ST(STORE_INIT(%o4, %o0 + 0x38))
         subcc           %g1, 64, %g1
         bne,pt          %XCC, 1b
          add            %o0, 64, %o0
 
         ba,pt           %XCC, 60f
-         add            %o1, 0x8, %o1
+         add            %i1, 0x8, %i1
 
 50:     /* Destination is 64-byte aligned, and source is 16-byte
          * aligned.
          */
-1:      EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-        add     %o1, 16, %o1
-        EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-        add     %o1, 16 + 32, %o1
-        LOAD(prefetch, %o1, #one_read)
-        sub     %o1, 32, %o1
+        mov     16, %o7
+        mov     32, %g2
+        mov     48, %g3
+        mov     64, %o1
+1:      EX_LD(LOAD_TWIN(%i1 + %g0, %o4, %o5))
+        EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+        LOAD(prefetch, %i1 + %o1, #one_read)
         EX_ST(STORE_INIT(%o4, %o0 + 0x00))      ! initializes cache line
         EX_ST(STORE_INIT(%o5, %o0 + 0x08))
-        EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-        add     %o1, 16, %o1
-        EX_ST(STORE_INIT(%g2, %o0 + 0x10))
-        EX_ST(STORE_INIT(%g3, %o0 + 0x18))
-        EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-        add     %o1, 16, %o1
+        EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x10))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x18))
+        EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3))
+        add     %i1, 64, %i1
         EX_ST(STORE_INIT(%o4, %o0 + 0x20))
         EX_ST(STORE_INIT(%o5, %o0 + 0x28))
-        EX_ST(STORE_INIT(%g2, %o0 + 0x30))
-        EX_ST(STORE_INIT(%g3, %o0 + 0x38))
+        EX_ST(STORE_INIT(%o2, %o0 + 0x30))
+        EX_ST(STORE_INIT(%o3, %o0 + 0x38))
         subcc   %g1, 64, %g1
         bne,pt  %XCC, 1b
          add    %o0, 64, %o0
@@ -249,47 +304,47 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 60:     
         membar          #Sync
 
-        /* %o2 contains any final bytes still needed to be copied
+        /* %i2 contains any final bytes still needed to be copied
          * over. If anything is left, we copy it one byte at a time.
          */
-        RESTORE_ASI(%o3)
-        brz,pt          %o2, 85f
-         sub            %o0, %o1, %o3
+        RESTORE_ASI(%i3)
+        brz,pt          %i2, 85f
+         sub            %o0, %i1, %i3
         ba,a,pt         %XCC, 90f
 
         .align          64
 70: /* 16 < len <= 64 */
         bne,pn          %XCC, 75f
-         sub            %o0, %o1, %o3
+         sub            %o0, %i1, %i3
 
 72:
-        andn            %o2, 0xf, %o4
-        and             %o2, 0xf, %o2
-1:      subcc           %o4, 0x10, %o4
-        EX_LD(LOAD(ldx, %o1, %o5))
-        add             %o1, 0x08, %o1
-        EX_LD(LOAD(ldx, %o1, %g1))
-        sub             %o1, 0x08, %o1
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
-        add             %o1, 0x8, %o1
-        EX_ST(STORE(stx, %g1, %o1 + %o3))
+        andn            %i2, 0xf, %i4
+        and             %i2, 0xf, %i2
+1:      subcc           %i4, 0x10, %i4
+        EX_LD(LOAD(ldx, %i1, %i5))
+        add             %i1, 0x08, %i1
+        EX_LD(LOAD(ldx, %i1, %g1))
+        sub             %i1, 0x08, %i1
+        EX_ST(STORE(stx, %i5, %i1 + %i3))
+        add             %i1, 0x8, %i1
+        EX_ST(STORE(stx, %g1, %i1 + %i3))
         bgu,pt          %XCC, 1b
-         add            %o1, 0x8, %o1
-73:     andcc           %o2, 0x8, %g0
+         add            %i1, 0x8, %i1
+73:     andcc           %i2, 0x8, %g0
         be,pt           %XCC, 1f
          nop
-        sub             %o2, 0x8, %o2
-        EX_LD(LOAD(ldx, %o1, %o5))
-        EX_ST(STORE(stx, %o5, %o1 + %o3))
-        add             %o1, 0x8, %o1
-1:      andcc           %o2, 0x4, %g0
+        sub             %i2, 0x8, %i2
+        EX_LD(LOAD(ldx, %i1, %i5))
+        EX_ST(STORE(stx, %i5, %i1 + %i3))
+        add             %i1, 0x8, %i1
+1:      andcc           %i2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
-        sub             %o2, 0x4, %o2
-        EX_LD(LOAD(lduw, %o1, %o5))
-        EX_ST(STORE(stw, %o5, %o1 + %o3))
-        add             %o1, 0x4, %o1
-1:      cmp             %o2, 0
+        sub             %i2, 0x4, %i2
+        EX_LD(LOAD(lduw, %i1, %i5))
+        EX_ST(STORE(stw, %i5, %i1 + %i3))
+        add             %i1, 0x4, %i1
+1:      cmp             %i2, 0
         be,pt           %XCC, 85f
          nop
         ba,pt           %xcc, 90f
@@ -300,71 +355,71 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         sub             %g1, 0x8, %g1
         be,pn           %icc, 2f
          sub            %g0, %g1, %g1
-        sub             %o2, %g1, %o2
+        sub             %i2, %g1, %i2
 
 1:      subcc           %g1, 1, %g1
-        EX_LD(LOAD(ldub, %o1, %o5))
-        EX_ST(STORE(stb, %o5, %o1 + %o3))
+        EX_LD(LOAD(ldub, %i1, %i5))
+        EX_ST(STORE(stb, %i5, %i1 + %i3))
         bgu,pt          %icc, 1b
-         add            %o1, 1, %o1
+         add            %i1, 1, %i1
 
-2:      add             %o1, %o3, %o0
-        andcc           %o1, 0x7, %g1
+2:      add             %i1, %i3, %o0
+        andcc           %i1, 0x7, %g1
         bne,pt          %icc, 8f
          sll            %g1, 3, %g1
 
-        cmp             %o2, 16
+        cmp             %i2, 16
         bgeu,pt         %icc, 72b
          nop
         ba,a,pt         %xcc, 73b
 
-8:      mov             64, %o3
-        andn            %o1, 0x7, %o1
-        EX_LD(LOAD(ldx, %o1, %g2))
-        sub             %o3, %g1, %o3
-        andn            %o2, 0x7, %o4
+8:      mov             64, %i3
+        andn            %i1, 0x7, %i1
+        EX_LD(LOAD(ldx, %i1, %g2))
+        sub             %i3, %g1, %i3
+        andn            %i2, 0x7, %i4
         sllx            %g2, %g1, %g2
-1:      add             %o1, 0x8, %o1
-        EX_LD(LOAD(ldx, %o1, %g3))
-        subcc           %o4, 0x8, %o4
-        srlx            %g3, %o3, %o5
-        or              %o5, %g2, %o5
-        EX_ST(STORE(stx, %o5, %o0))
+1:      add             %i1, 0x8, %i1
+        EX_LD(LOAD(ldx, %i1, %g3))
+        subcc           %i4, 0x8, %i4
+        srlx            %g3, %i3, %i5
+        or              %i5, %g2, %i5
+        EX_ST(STORE(stx, %i5, %o0))
         add             %o0, 0x8, %o0
         bgu,pt          %icc, 1b
          sllx           %g3, %g1, %g2
 
         srl             %g1, 3, %g1
-        andcc           %o2, 0x7, %o2
+        andcc           %i2, 0x7, %i2
         be,pn           %icc, 85f
-         add            %o1, %g1, %o1
+         add            %i1, %g1, %i1
         ba,pt           %xcc, 90f
-         sub            %o0, %o1, %o3
+         sub            %o0, %i1, %i3
 
         .align          64
 80: /* 0 < len <= 16 */
-        andcc           %o3, 0x3, %g0
+        andcc           %i3, 0x3, %g0
         bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         sub            %o0, %i1, %i3
 
 1:
-        subcc           %o2, 4, %o2
-        EX_LD(LOAD(lduw, %o1, %g1))
-        EX_ST(STORE(stw, %g1, %o1 + %o3))
+        subcc           %i2, 4, %i2
+        EX_LD(LOAD(lduw, %i1, %g1))
+        EX_ST(STORE(stw, %g1, %i1 + %i3))
         bgu,pt          %XCC, 1b
-         add            %o1, 4, %o1
+         add            %i1, 4, %i1
 
-85:     retl
-         mov            EX_RETVAL(GLOBAL_SPARE), %o0
+85:     ret
+         restore        EX_RETVAL(%i0), %g0, %o0
 
         .align          32
 90:
-        subcc           %o2, 1, %o2
-        EX_LD(LOAD(ldub, %o1, %g1))
-        EX_ST(STORE(stb, %g1, %o1 + %o3))
+        subcc           %i2, 1, %i2
+        EX_LD(LOAD(ldub, %i1, %g1))
+        EX_ST(STORE(stb, %g1, %i1 + %i3))
         bgu,pt          %XCC, 90b
-         add            %o1, 1, %o1
-        retl
-         mov            EX_RETVAL(GLOBAL_SPARE), %o0
+         add            %i1, 1, %i1
+        ret
+         restore        EX_RETVAL(%i0), %g0, %o0
 
         .size           FUNC_NAME, .-FUNC_NAME
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 397c714cf2ba..af274e5a25ee 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1550,11 +1550,13 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
          *      As close as possible to RFC 793, which
          *      suggests using a 250 kHz clock.
          *      Further reading shows this assumes 2 Mb/s networks.
-         *      For 10 Gb/s Ethernet, a 1 GHz clock is appropriate.
-         *      That's funny, Linux has one built in!  Use it!
-         *      (Networks are faster now - should this be increased?)
+         *      For 10 Mb/s Ethernet, a 1 MHz clock is appropriate.
+         *      For 10 Gb/s Ethernet, a 1 GHz clock should be ok, but
+         *      we also need to limit the resolution so that the u32 seq
+         *      overlaps less than one time per MSL (2 minutes).
+         *      Choosing a clock of 64 ns period is OK. (period of 274 s)
          */
-        seq += ktime_get_real().tv64;
+        seq += ktime_get_real().tv64 >> 6;
 #if 0
         printk("init_seq(%lx, %lx, %d, %d) = %d\n",
                saddr, daddr, sport, dport, seq);
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index c9fbe8e73a45..67c67a87146e 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -639,6 +639,16 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
 
                 se->block_start = 0;
                 se->sum_sleep_runtime += delta;
+
+                /*
+                 * Blocking time is in units of nanosecs, so shift by 20 to
+                 * get a milliseconds-range estimation of the amount of
+                 * time that the task spent sleeping:
+                 */
+                if (unlikely(prof_on == SLEEP_PROFILING)) {
+                        profile_hits(SLEEP_PROFILING, (void *)get_wchan(tsk),
+                                     delta >> 20);
+                }
         }
 #endif
 }
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index f2de2e48b021..6284c99b456e 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -366,6 +366,12 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
         frag = WLAN_GET_SEQ_FRAG(sc);
         hdrlen = ieee80211_get_hdrlen(fc);
 
+        if (skb->len < hdrlen) {
+                printk(KERN_INFO "%s: invalid SKB length %d\n",
+                        dev->name, skb->len);
+                goto rx_dropped;
+        }
+
         /* Put this code here so that we avoid duplicating it in all
          * Rx paths. - Jean II */
 #ifdef CONFIG_WIRELESS_EXT
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 3a23e30bc79e..b542c875e154 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/ipv6.h>
 #include <linux/skbuff.h>
+#include <linux/jhash.h>
 #include <net/ip.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
@@ -95,7 +96,7 @@ struct sfq_sched_data
 
 /* Variables */
         struct timer_list perturb_timer;
-        int             perturbation;
+        u32             perturbation;
         sfq_index       tail;           /* Index of current slot in round */
         sfq_index       max_depth;      /* Maximal depth */
 
@@ -109,12 +110,7 @@ struct sfq_sched_data
 
 static __inline__ unsigned sfq_fold_hash(struct sfq_sched_data *q, u32 h, u32 h1)
 {
-        int pert = q->perturbation;
-
-        /* Have we any rotation primitives? If not, WHY? */
-        h ^= (h1<<pert) ^ (h1>>(0x1F - pert));
-        h ^= h>>10;
-        return h & 0x3FF;
+        return jhash_2words(h, h1, q->perturbation) & (SFQ_HASH_DIVISOR - 1);
 }
 
 static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
@@ -256,6 +252,13 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 q->ht[hash] = x = q->dep[SFQ_DEPTH].next;
                 q->hash[x] = hash;
         }
+        /* If selected queue has length q->limit, this means that
+         * all another queues are empty and that we do simple tail drop,
+         * i.e. drop _this_ packet.
+         */
+        if (q->qs[x].qlen >= q->limit)
+                return qdisc_drop(skb, sch);
+
         sch->qstats.backlog += skb->len;
         __skb_queue_tail(&q->qs[x], skb);
         sfq_inc(q, x);
@@ -294,6 +297,19 @@ sfq_requeue(struct sk_buff *skb, struct Qdisc* sch)
         }
         sch->qstats.backlog += skb->len;
         __skb_queue_head(&q->qs[x], skb);
+        /* If selected queue has length q->limit+1, this means that
+         * all another queues are empty and we do simple tail drop.
+         * This packet is still requeued at head of queue, tail packet
+         * is dropped.
+         */
+        if (q->qs[x].qlen > q->limit) {
+                skb = q->qs[x].prev;
+                __skb_unlink(skb, &q->qs[x]);
+                sch->qstats.drops++;
+                sch->qstats.backlog -= skb->len;
+                kfree_skb(skb);
+                return NET_XMIT_CN;
+        }
         sfq_inc(q, x);
         if (q->qs[x].qlen == 1) {               /* The flow is new */
                 if (q->tail == SFQ_DEPTH) {     /* It is the first flow */
@@ -370,12 +386,10 @@ static void sfq_perturbation(unsigned long arg)
         struct Qdisc *sch = (struct Qdisc*)arg;
         struct sfq_sched_data *q = qdisc_priv(sch);
 
-        q->perturbation = net_random()&0x1F;
+        get_random_bytes(&q->perturbation, 4);
 
-        if (q->perturb_period) {
-                q->perturb_timer.expires = jiffies + q->perturb_period;
-                add_timer(&q->perturb_timer);
-        }
+        if (q->perturb_period)
+                mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
 }
 
 static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
@@ -391,7 +405,7 @@ static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
         q->quantum = ctl->quantum ? : psched_mtu(sch->dev);
         q->perturb_period = ctl->perturb_period*HZ;
         if (ctl->limit)
-                q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 2);
+                q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 1);
 
         qlen = sch->q.qlen;
         while (sch->q.qlen > q->limit)
@@ -400,8 +414,8 @@ static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
 
         del_timer(&q->perturb_timer);
         if (q->perturb_period) {
-                q->perturb_timer.expires = jiffies + q->perturb_period;
-                add_timer(&q->perturb_timer);
+                mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
+                get_random_bytes(&q->perturbation, 4);
         }
         sch_tree_unlock(sch);
         return 0;
@@ -423,12 +437,13 @@ static int sfq_init(struct Qdisc *sch, struct rtattr *opt)
                 q->dep[i+SFQ_DEPTH].next = i+SFQ_DEPTH;
                 q->dep[i+SFQ_DEPTH].prev = i+SFQ_DEPTH;
         }
-        q->limit = SFQ_DEPTH - 2;
+        q->limit = SFQ_DEPTH - 1;
         q->max_depth = 0;
         q->tail = SFQ_DEPTH;
         if (opt == NULL) {
                 q->quantum = psched_mtu(sch->dev);
                 q->perturb_period = 0;
+                get_random_bytes(&q->perturbation, 4);
         } else {
                 int err = sfq_change(sch, opt);
                 if (err)