144 files changed, 1111 insertions, 606 deletions

diff --git a/CREDITS b/CREDITS
index 6957ef4efab3..64511e2abc8e 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3643,11 +3643,9 @@ S: Cambridge. CB1 7EG
 S: England
 
 N: Chris Wright
-E: chrisw@osdl.org
+E: chrisw@sous-sol.org
 D: hacking on LSM framework and security modules.
-S: c/o OSDL
-S: 12725 SW Millikan Way, Suite 400
-S: Beaverton, OR 97005
+S: Portland, OR
 S: USA
 
 N: Michal Wronski
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index 990998ee10b6..30c41459953c 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -4,8 +4,9 @@
 Copyright (C) 2004 BULL SA.
 Written by Simon.Derr@bull.net
 
-Portions Copyright (c) 2004 Silicon Graphics, Inc.
+Portions Copyright (c) 2004-2006 Silicon Graphics, Inc.
 Modified by Paul Jackson <pj@sgi.com>
+Modified by Christoph Lameter <clameter@sgi.com>
 
 CONTENTS:
 =========
@@ -90,7 +91,8 @@ This can be especially valuable on:
 
 These subsets, or "soft partitions" must be able to be dynamically
 adjusted, as the job mix changes, without impacting other concurrently
-executing jobs.
+executing jobs. The location of the running jobs pages may also be moved
+when the memory locations are changed.
 
 The kernel cpuset patch provides the minimum essential kernel
 mechanisms required to efficiently implement such subsets.  It
@@ -102,8 +104,8 @@ memory allocator code.
 1.3 How are cpusets implemented ?
 ---------------------------------
 
-Cpusets provide a Linux kernel (2.6.7 and above) mechanism to constrain
-which CPUs and Memory Nodes are used by a process or set of processes.
+Cpusets provide a Linux kernel mechanism to constrain which CPUs and
+Memory Nodes are used by a process or set of processes.
 
 The Linux kernel already has a pair of mechanisms to specify on which
 CPUs a task may be scheduled (sched_setaffinity) and on which Memory
@@ -371,22 +373,17 @@ cpusets memory placement policy 'mems' subsequently changes.
 If the cpuset flag file 'memory_migrate' is set true, then when
 tasks are attached to that cpuset, any pages that task had
 allocated to it on nodes in its previous cpuset are migrated
-to the tasks new cpuset.  Depending on the implementation,
-this migration may either be done by swapping the page out,
-so that the next time the page is referenced, it will be paged
-into the tasks new cpuset, usually on the node where it was
-referenced, or this migration may be done by directly copying
-the pages from the tasks previous cpuset to the new cpuset,
-where possible to the same node, relative to the new cpuset,
-as the node that held the page, relative to the old cpuset.
+to the tasks new cpuset. The relative placement of the page within
+the cpuset is preserved during these migration operations if possible.
+For example if the page was on the second valid node of the prior cpuset
+then the page will be placed on the second valid node of the new cpuset.
+
 Also if 'memory_migrate' is set true, then if that cpusets
 'mems' file is modified, pages allocated to tasks in that
 cpuset, that were on nodes in the previous setting of 'mems',
-will be moved to nodes in the new setting of 'mems.'  Again,
-depending on the implementation, this might be done by swapping,
-or by direct copying.  In either case, pages that were not in
-the tasks prior cpuset, or in the cpusets prior 'mems' setting,
-will not be moved.
+will be moved to nodes in the new setting of 'mems.'
+Pages that were not in the tasks prior cpuset, or in the cpusets
+prior 'mems' setting, will not be moved.
 
 There is an exception to the above.  If hotplug functionality is used
 to remove all the CPUs that are currently assigned to a cpuset,
@@ -434,16 +431,6 @@ and then start a subshell 'sh' in that cpuset:
   # The next line should display '/Charlie'
   cat /proc/self/cpuset
 
-In the case that a change of cpuset includes wanting to move already
-allocated memory pages, consider further the work of IWAMOTO
-Toshihiro <iwamoto@valinux.co.jp> for page remapping and memory
-hotremoval, which can be found at:
-
-  http://people.valinux.co.jp/~iwamoto/mh.html
-
-The integration of cpusets with such memory migration is not yet
-available.
-
 In the future, a C library interface to cpusets will likely be
 available.  For now, the only way to query or modify cpusets is
 via the cpuset file system, using the various cd, mkdir, echo, cat,
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index be5ae600f533..81bc51369f59 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -180,3 +180,12 @@ Why:	These events are not correct, and do not properly let userspace know
         when a file system has been mounted or unmounted.  Userspace should
         poll the /proc/mounts file instead to detect this properly.
 Who:    Greg Kroah-Hartman <gregkh@suse.de>
+
+---------------------------
+
+What:   Support for NEC DDB5074 and DDB5476 evaluation boards.
+When:   June 2006
+Why:    Board specific code doesn't build anymore since ~2.6.0 and no
+        users have complained indicating there is no more need for these
+        boards.  This should really be considered a last call.
+Who:    Ralf Baechle <ralf@linux-mips.org>
diff --git a/Documentation/vm/page_migration b/Documentation/vm/page_migration
index c52820fcf500..0dd4ef30c361 100644
--- a/Documentation/vm/page_migration
+++ b/Documentation/vm/page_migration
@@ -12,12 +12,18 @@ is running.
 
 Page migration allows a process to manually relocate the node on which its
 pages are located through the MF_MOVE and MF_MOVE_ALL options while setting
-a new memory policy. The pages of process can also be relocated
+a new memory policy via mbind(). The pages of process can also be relocated
 from another process using the sys_migrate_pages() function call. The
 migrate_pages function call takes two sets of nodes and moves pages of a
 process that are located on the from nodes to the destination nodes.
-
-Manual migration is very useful if for example the scheduler has relocated
+Page migration functions are provided by the numactl package by Andi Kleen
+(a version later than 0.9.3 is required. Get it from
+ftp://ftp.suse.com/pub/people/ak). numactl provided libnuma which
+provides an interface similar to other numa functionality for page migration.
+cat /proc/<pid>/numa_maps allows an easy review of where the pages of
+a process are located. See also the numa_maps manpage in the numactl package.
+
+Manual migration is useful if for example the scheduler has relocated
 a process to a processor on a distant node. A batch scheduler or an
 administrator may detect the situation and move the pages of the process
 nearer to the new processor. At some point in the future we may have
@@ -25,10 +31,12 @@ some mechanism in the scheduler that will automatically move the pages.
 
 Larger installations usually partition the system using cpusets into
 sections of nodes. Paul Jackson has equipped cpusets with the ability to
-move pages when a task is moved to another cpuset. This allows automatic
-control over locality of a process. If a task is moved to a new cpuset
-then also all its pages are moved with it so that the performance of the
-process does not sink dramatically (as is the case today).
+move pages when a task is moved to another cpuset (See ../cpusets.txt).
+Cpusets allows the automation of process locality. If a task is moved to
+a new cpuset then also all its pages are moved with it so that the
+performance of the process does not sink dramatically. Also the pages
+of processes in a cpuset are moved if the allowed memory nodes of a
+cpuset are changed.
 
 Page migration allows the preservation of the relative location of pages
 within a group of nodes for all migration techniques which will preserve a
@@ -37,22 +45,26 @@ process. This is necessary in order to preserve the memory latencies.
 Processes will run with similar performance after migration.
 
 Page migration occurs in several steps. First a high level
-description for those trying to use migrate_pages() and then
-a low level description of how the low level details work.
+description for those trying to use migrate_pages() from the kernel
+(for userspace usage see the Andi Kleen's numactl package mentioned above)
+and then a low level description of how the low level details work.
 
-A. Use of migrate_pages()
--------------------------
+A. In kernel use of migrate_pages()
+-----------------------------------
 
 1. Remove pages from the LRU.
 
    Lists of pages to be migrated are generated by scanning over
    pages and moving them into lists. This is done by
-   calling isolate_lru_page() or __isolate_lru_page().
+   calling isolate_lru_page().
    Calling isolate_lru_page increases the references to the page
-   so that it cannot vanish under us.
+   so that it cannot vanish while the page migration occurs.
+   It also prevents the swapper or other scans to encounter
+   the page.
 
-2. Generate a list of newly allocates page to move the contents
-   of the first list to.
+2. Generate a list of newly allocates page. These pages will contain the
+   contents of the pages from the first list after page migration is
+   complete.
 
 3. The migrate_pages() function is called which attempts
    to do the migration. It returns the moved pages in the
@@ -63,13 +75,17 @@ A. Use of migrate_pages()
 4. The leftover pages of various types are returned
    to the LRU using putback_to_lru_pages() or otherwise
    disposed of. The pages will still have the refcount as
-   increased by isolate_lru_pages()!
+   increased by isolate_lru_pages() if putback_to_lru_pages() is not
+   used! The kernel may want to handle the various cases of failures in
+   different ways.
 
-B. Operation of migrate_pages()
---------------------------------
+B. How migrate_pages() works
+----------------------------
 
-migrate_pages does several passes over its list of pages. A page is moved
-if all references to a page are removable at the time.
+migrate_pages() does several passes over its list of pages. A page is moved
+if all references to a page are removable at the time. The page has
+already been removed from the LRU via isolate_lru_page() and the refcount
+is increased so that the page cannot be freed while page migration occurs.
 
 Steps:
 
@@ -79,36 +95,40 @@ Steps:
 
 3. Make sure that the page has assigned swap cache entry if
    it is an anonyous page. The swap cache reference is necessary
-   to preserve the information contain in the page table maps.
+   to preserve the information contain in the page table maps while
+   page migration occurs.
 
 4. Prep the new page that we want to move to. It is locked
    and set to not being uptodate so that all accesses to the new
-   page immediately lock while we are moving references.
+   page immediately lock while the move is in progress.
 
-5. All the page table references to the page are either dropped (file backed)
-   or converted to swap references (anonymous pages). This should decrease the
-   reference count.
+5. All the page table references to the page are either dropped (file
+   backed pages) or converted to swap references (anonymous pages).
+   This should decrease the reference count.
 
-6. The radix tree lock is taken
+6. The radix tree lock is taken. This will cause all processes trying
+   to reestablish a pte to block on the radix tree spinlock.
 
 7. The refcount of the page is examined and we back out if references remain
    otherwise we know that we are the only one referencing this page.
 
 8. The radix tree is checked and if it does not contain the pointer to this
-   page then we back out.
+   page then we back out because someone else modified the mapping first.
 
 9. The mapping is checked. If the mapping is gone then a truncate action may
    be in progress and we back out.
 
-10. The new page is prepped with some settings from the old page so that accesses
-   to the new page will be discovered to have the correct settings.
+10. The new page is prepped with some settings from the old page so that
+   accesses to the new page will be discovered to have the correct settings.
 
 11. The radix tree is changed to point to the new page.
 
-12. The reference count of the old page is dropped because the reference has now
-    been removed.
+12. The reference count of the old page is dropped because the radix tree
+    reference is gone.
 
-13. The radix tree lock is dropped.
+13. The radix tree lock is dropped. With that lookups become possible again
+    and other processes will move from spinning on the tree lock to sleeping on
+    the locked new page.
 
 14. The page contents are copied to the new page.
 
@@ -119,11 +139,37 @@ Steps:
 
 17. Queued up writeback on the new page is triggered.
 
-18. If swap pte's were generated for the page then remove them again.
+18. If swap pte's were generated for the page then replace them with real
+    ptes. This will reenable access for processes not blocked by the page lock.
+
+19. The page locks are dropped from the old and new page.
+    Processes waiting on the page lock can continue.
+
+20. The new page is moved to the LRU and can be scanned by the swapper
+    etc again.
+
+TODO list
+---------
+
+- Page migration requires the use of swap handles to preserve the
+  information of the anonymous page table entries. This means that swap
+  space is reserved but never used. The maximum number of swap handles used
+  is determined by CHUNK_SIZE (see mm/mempolicy.c) per ongoing migration.
+  Reservation of pages could be avoided by having a special type of swap
+  handle that does not require swap space and that would only track the page
+  references. Something like that was proposed by Marcelo Tosatti in the
+  past (search for migration cache on lkml or linux-mm@kvack.org).
 
-19. The locks are dropped from the old and new page.
+- Page migration unmaps ptes for file backed pages and requires page
+  faults to reestablish these ptes. This could be optimized by somehow
+  recording the references before migration and then reestablish them later.
+  However, there are several locking challenges that have to be overcome
+  before this is possible.
 
-20. The new page is moved to the LRU.
+- Page migration generates read ptes for anonymous pages. Dirty page
+  faults are required to make the pages writable again. It may be possible
+  to generate a pte marked dirty if it is known that the page is dirty and
+  that this process has the only reference to that page.
 
-Christoph Lameter, December 19, 2005.
+Christoph Lameter, March 8, 2006.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index c39fb20f8589..3d7d30dc5439 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1631,8 +1631,8 @@ S:	Supported
 
 LINUX SECURITY MODULE (LSM) FRAMEWORK
 P:      Chris Wright
-M:      chrisw@osdl.org
-L:      linux-security-module@wirex.com
+M:      chrisw@sous-sol.org
+L:      linux-security-module@vger.kernel.org
 W:      http://lsm.immunix.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/chrisw/lsm-2.6.git
 S:      Supported
diff --git a/Makefile b/Makefile
index 46eea76bc570..ac54c03c1b1a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION =-rc5
+EXTRAVERSION =-rc6
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
@@ -905,7 +905,7 @@ define filechk_version.h
         )
 endef
 
-include/linux/version.h: $(srctree)/Makefile .config FORCE
+include/linux/version.h: $(srctree)/Makefile .config .kernelrelease FORCE
         $(call filechk,version.h)
 
 # ---------------------------------------------------------------------------
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 9006063e7369..da677f829f76 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -151,8 +151,13 @@ handle_irq(int irq, struct pt_regs * regs)
         }
 
         irq_enter();
+        /*
+         * __do_IRQ() must be called with IPL_MAX. Note that we do not
+         * explicitly enable interrupts afterwards - some MILO PALcode
+         * (namely LX164 one) seems to have severe problems with RTI
+         * at IPL 0.
+         */
         local_irq_disable();
         __do_IRQ(irq, regs);
-        local_irq_enable();
         irq_exit();
 }
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f80fa502f8f..32ba00bd0a2f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -799,6 +799,8 @@ source "drivers/i2c/Kconfig"
 
 source "drivers/spi/Kconfig"
 
+source "drivers/w1/Kconfig"
+
 source "drivers/hwmon/Kconfig"
 
 #source "drivers/l3/Kconfig"
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 159ad7ed7a40..d31b1cb7eea0 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -629,6 +629,22 @@ static int locomo_resume(struct platform_device *dev)
 }
 #endif
 
+
+#define LCM_ALC_EN      0x8000
+
+void frontlight_set(struct locomo *lchip, int duty, int vr, int bpwf)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&lchip->lock, flags);
+        locomo_writel(bpwf, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALS);
+        udelay(100);
+        locomo_writel(duty, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALD);
+        locomo_writel(bpwf | LCM_ALC_EN, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALS);
+        spin_unlock_irqrestore(&lchip->lock, flags);
+}
+
+
 /**
  *      locomo_probe - probe for a single LoCoMo chip.
  *      @phys_addr: physical address of device.
@@ -688,6 +704,11 @@ __locomo_probe(struct device *me, struct resource *mem, int irq)
         /* FrontLight */
         locomo_writel(0, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALS);
         locomo_writel(0, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALD);
+
+        /* Same constants can be used for collie and poodle
+           (depending on CONFIG options in original sharp code)? */
+        frontlight_set(lchip, 163, 0, 148);
+
         /* Longtime timer */
         locomo_writel(0, lchip->base + LOCOMO_LTINT);
         /* SPI */
diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
index 0abbce8c70bc..b324dcac1c56 100644
--- a/arch/arm/kernel/asm-offsets.c
+++ b/arch/arm/kernel/asm-offsets.c
@@ -57,7 +57,9 @@ int main(void)
   DEFINE(TI_TP_VALUE,           offsetof(struct thread_info, tp_value));
   DEFINE(TI_FPSTATE,            offsetof(struct thread_info, fpstate));
   DEFINE(TI_VFPSTATE,           offsetof(struct thread_info, vfpstate));
-  DEFINE(TI_IWMMXT_STATE,       (offsetof(struct thread_info, fpstate)+4)&~7);
+#ifdef CONFIG_IWMMXT
+  DEFINE(TI_IWMMXT_STATE,       offsetof(struct thread_info, fpstate.iwmmxt));
+#endif
   BLANK();
   DEFINE(S_R0,                  offsetof(struct pt_regs, ARM_r0));
   DEFINE(S_R1,                  offsetof(struct pt_regs, ARM_r1));
diff --git a/arch/arm/kernel/compat.c b/arch/arm/kernel/compat.c
index 7195add42e74..60cfa7f3226c 100644
--- a/arch/arm/kernel/compat.c
+++ b/arch/arm/kernel/compat.c
@@ -27,6 +27,8 @@
 
 #include <asm/mach/arch.h>
 
+#include "compat.h"
+
 /*
  * Usage:
  *  - do not go blindly adding fields, add them at the end
diff --git a/arch/arm/kernel/compat.h b/arch/arm/kernel/compat.h
new file mode 100644
index 000000000000..27e61a68bd1c
--- /dev/null
+++ b/arch/arm/kernel/compat.h
@@ -0,0 +1,13 @@
+/*
+ *  linux/arch/arm/kernel/compat.h
+ *
+ *  Copyright (C) 2001 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+extern void convert_to_tag_list(struct tag *tags);
+
+extern void squash_mem_tags(struct tag *tag);
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 4b4e4cf79c80..489c069e5c3e 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -27,6 +27,7 @@
 #include <linux/kallsyms.h>
 #include <linux/init.h>
 #include <linux/cpu.h>
+#include <linux/elfcore.h>
 
 #include <asm/leds.h>
 #include <asm/processor.h>
@@ -83,7 +84,7 @@ EXPORT_SYMBOL(pm_power_off);
  * This is our default idle handler.  We need to disable
  * interrupts here to ensure we don't miss a wakeup call.
  */
-void default_idle(void)
+static void default_idle(void)
 {
         if (hlt_counter)
                 cpu_relax();
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 7b6256bb590e..a1d1b2906e8d 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -610,15 +610,12 @@ static int ptrace_setfpregs(struct task_struct *tsk, void __user *ufp)
 static int ptrace_getwmmxregs(struct task_struct *tsk, void __user *ufp)
 {
         struct thread_info *thread = task_thread_info(tsk);
-        void *ptr = &thread->fpstate;
 
         if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
                 return -ENODATA;
         iwmmxt_task_disable(thread);  /* force it to ram */
-        /* The iWMMXt state is stored doubleword-aligned.  */
-        if (((long) ptr) & 4)
-                ptr += 4;
-        return copy_to_user(ufp, ptr, 0x98) ? -EFAULT : 0;
+        return copy_to_user(ufp, &thread->fpstate.iwmmxt, IWMMXT_SIZE)
+                ? -EFAULT : 0;
 }
 
 /*
@@ -627,15 +624,12 @@ static int ptrace_getwmmxregs(struct task_struct *tsk, void __user *ufp)
 static int ptrace_setwmmxregs(struct task_struct *tsk, void __user *ufp)
 {
         struct thread_info *thread = task_thread_info(tsk);
-        void *ptr = &thread->fpstate;
 
         if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
                 return -EACCES;
         iwmmxt_task_release(thread);  /* force a reload */
-        /* The iWMMXt state is stored doubleword-aligned.  */
-        if (((long) ptr) & 4)
-                ptr += 4;
-        return copy_from_user(ptr, ufp, 0x98) ? -EFAULT : 0;
+        return copy_from_user(&thread->fpstate.iwmmxt, ufp, IWMMXT_SIZE)
+                ? -EFAULT : 0;
 }
 
 #endif
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 68273b4dc882..08974cbe9824 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -37,6 +37,8 @@
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 
+#include "compat.h"
+
 #ifndef MEM_SIZE
 #define MEM_SIZE        (16*1024*1024)
 #endif
@@ -53,10 +55,7 @@ static int __init fpe_setup(char *line)
 __setup("fpe=", fpe_setup);
 #endif
 
-extern unsigned int mem_fclk_21285;
 extern void paging_init(struct meminfo *, struct machine_desc *desc);
-extern void convert_to_tag_list(struct tag *tags);
-extern void squash_mem_tags(struct tag *tag);
 extern void reboot_setup(char *str);
 extern int root_mountflags;
 extern void _stext, _text, _etext, __data_start, _edata, _end;
diff --git a/arch/arm/lib/muldi3.S b/arch/arm/lib/muldi3.S
index 72d594184b8a..d89c60615794 100644
--- a/arch/arm/lib/muldi3.S
+++ b/arch/arm/lib/muldi3.S
@@ -29,8 +29,8 @@ ENTRY(__aeabi_lmul)
 
         mul     xh, yl, xh
         mla     xh, xl, yh, xh
-        mov     ip, xl, asr #16
-        mov     yh, yl, asr #16
+        mov     ip, xl, lsr #16
+        mov     yh, yl, lsr #16
         bic     xl, xl, ip, lsl #16
         bic     yl, yl, yh, lsl #16
         mla     xh, yh, ip, xh
diff --git a/arch/arm/mach-ixp4xx/Kconfig b/arch/arm/mach-ixp4xx/Kconfig
index daadc78e271b..5bf50a2a737d 100644
--- a/arch/arm/mach-ixp4xx/Kconfig
+++ b/arch/arm/mach-ixp4xx/Kconfig
@@ -8,11 +8,9 @@ menu "Intel IXP4xx Implementation Options"
 
 comment "IXP4xx Platforms"
 
-# This entry is placed on top because otherwise it would have
-# been shown as a submenu.
 config MACH_NSLU2
         bool
-        prompt "NSLU2" if !(MACH_IXDP465 || MACH_IXDPG425 || ARCH_IXDP425 || ARCH_ADI_COYOTE || ARCH_AVILA || ARCH_IXCDP1100 || ARCH_PRPMC1100 || MACH_GTWX5715)
+        prompt "Linksys NSLU2"
         help
           Say 'Y' here if you want your kernel to support Linksys's
           NSLU2 NAS device. For more information on this platform,
diff --git a/arch/arm/mach-ixp4xx/nas100d-setup.c b/arch/arm/mach-ixp4xx/nas100d-setup.c
index 856d56f3b2ae..a3b4c6ac5708 100644
--- a/arch/arm/mach-ixp4xx/nas100d-setup.c
+++ b/arch/arm/mach-ixp4xx/nas100d-setup.c
@@ -113,6 +113,9 @@ static void __init nas100d_init(void)
 {
         ixp4xx_sys_init();
 
+        /* gpio 14 and 15 are _not_ clocks */
+        *IXP4XX_GPIO_GPCLKR = 0;
+
         nas100d_flash_resource.start = IXP4XX_EXP_BUS_BASE(0);
         nas100d_flash_resource.end =
                 IXP4XX_EXP_BUS_BASE(0) + ixp4xx_exp_bus_size - 1;
diff --git a/arch/arm/mach-s3c2410/devs.c b/arch/arm/mach-s3c2410/devs.c
index 0a47d38789a5..ca09ba516e4c 100644
--- a/arch/arm/mach-s3c2410/devs.c
+++ b/arch/arm/mach-s3c2410/devs.c
@@ -334,11 +334,17 @@ static struct resource s3c_spi0_resource[] = {
 
 };
 
+static u64 s3c_device_spi0_dmamask = 0xffffffffUL;
+
 struct platform_device s3c_device_spi0 = {
         .name             = "s3c2410-spi",
         .id               = 0,
         .num_resources    = ARRAY_SIZE(s3c_spi0_resource),
         .resource         = s3c_spi0_resource,
+        .dev              = {
+                .dma_mask = &s3c_device_spi0_dmamask,
+                .coherent_dma_mask = 0xffffffffUL
+        }
 };
 
 EXPORT_SYMBOL(s3c_device_spi0);
@@ -359,11 +365,17 @@ static struct resource s3c_spi1_resource[] = {
 
 };
 
+static u64 s3c_device_spi1_dmamask = 0xffffffffUL;
+
 struct platform_device s3c_device_spi1 = {
         .name             = "s3c2410-spi",
         .id               = 1,
         .num_resources    = ARRAY_SIZE(s3c_spi1_resource),
         .resource         = s3c_spi1_resource,
+        .dev              = {
+                .dma_mask = &s3c_device_spi1_dmamask,
+                .coherent_dma_mask = 0xffffffffUL
+        }
 };
 
 EXPORT_SYMBOL(s3c_device_spi1);
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index d921c1024ae0..2c6c2a7c05a0 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -96,15 +96,16 @@ ENTRY(v6_coherent_user_range)
 #ifdef HARVARD_CACHE
         bic     r0, r0, #CACHE_LINE_SIZE - 1
 1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D line
-        mcr     p15, 0, r0, c7, c5, 1           @ invalidate I line
         add     r0, r0, #CACHE_LINE_SIZE
         cmp     r0, r1
         blo     1b
 #endif
-        mcr     p15, 0, r0, c7, c5, 6           @ invalidate BTB
-#ifdef HARVARD_CACHE
         mov     r0, #0
+#ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
+        mcr     p15, 0, r0, c7, c5, 0           @ I+BTB cache invalidate
+#else
+        mcr     p15, 0, r0, c7, c5, 6           @ invalidate BTB
 #endif
         mov     pc, lr
 
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 330695b6b19d..b103e56806bd 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -24,14 +24,16 @@
 static void flush_pfn_alias(unsigned long pfn, unsigned long vaddr)
 {
         unsigned long to = ALIAS_FLUSH_START + (CACHE_COLOUR(vaddr) << PAGE_SHIFT);
+        const int zero = 0;
 
         set_pte(TOP_PTE(to), pfn_pte(pfn, PAGE_KERNEL));
         flush_tlb_kernel_page(to);
 
         asm(    "mcrr   p15, 0, %1, %0, c14\n"
-        "       mcrr    p15, 0, %1, %0, c5\n"
+        "       mcr     p15, 0, %2, c7, c10, 4\n"
+        "       mcr     p15, 0, %2, c7, c5, 0\n"
             :
-            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES)
+            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES), "r" (zero)
             : "cc");
 }
 
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index f39e09ef64ec..776c90989e06 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -570,16 +570,18 @@ void __devinit setup_local_APIC(void)
  */
 void lapic_shutdown(void)
 {
+        unsigned long flags;
+
         if (!cpu_has_apic)
                 return;
 
-        local_irq_disable();
+        local_irq_save(flags);
         clear_local_APIC();
 
         if (enabled_via_apicbase)
                 disable_local_APIC();
 
-        local_irq_enable();
+        local_irq_restore(flags);
 }
 
 #ifdef CONFIG_PM
diff --git a/arch/ia64/kernel/ivt.S b/arch/ia64/kernel/ivt.S
index 9f80569a32b0..dcd906fe5749 100644
--- a/arch/ia64/kernel/ivt.S
+++ b/arch/ia64/kernel/ivt.S
@@ -561,11 +561,12 @@ ENTRY(dirty_bit)
         ;;                                      // avoid RAW on r18
         mov ar.ccv=r18                          // set compare value for cmpxchg
         or r25=_PAGE_D|_PAGE_A,r18              // set the dirty and accessed bits
+        tbit.z p7,p6 = r18,_PAGE_P_BIT          // Check present bit
         ;;
-        cmpxchg8.acq r26=[r17],r25,ar.ccv
+(p6)    cmpxchg8.acq r26=[r17],r25,ar.ccv       // Only update if page is present
         mov r24=PAGE_SHIFT<<2
         ;;
-        cmp.eq p6,p7=r26,r18
+(p6)    cmp.eq p6,p7=r26,r18                    // Only compare if page is present
         ;;
 (p6)    itc.d r25                               // install updated PTE
         ;;
@@ -626,11 +627,12 @@ ENTRY(iaccess_bit)
         ;;
         mov ar.ccv=r18                          // set compare value for cmpxchg
         or r25=_PAGE_A,r18                      // set the accessed bit
+        tbit.z p7,p6 = r18,_PAGE_P_BIT          // Check present bit
         ;;
-        cmpxchg8.acq r26=[r17],r25,ar.ccv
+(p6)    cmpxchg8.acq r26=[r17],r25,ar.ccv       // Only if page present
         mov r24=PAGE_SHIFT<<2
         ;;
-        cmp.eq p6,p7=r26,r18
+(p6)    cmp.eq p6,p7=r26,r18                    // Only if page present
         ;;
 (p6)    itc.i r25                               // install updated PTE
         ;;
@@ -680,11 +682,12 @@ ENTRY(daccess_bit)
         ;;                                      // avoid RAW on r18
         mov ar.ccv=r18                          // set compare value for cmpxchg
         or r25=_PAGE_A,r18                      // set the dirty bit
+        tbit.z p7,p6 = r18,_PAGE_P_BIT          // Check present bit
         ;;
-        cmpxchg8.acq r26=[r17],r25,ar.ccv
+(p6)    cmpxchg8.acq r26=[r17],r25,ar.ccv       // Only if page is present
         mov r24=PAGE_SHIFT<<2
         ;;
-        cmp.eq p6,p7=r26,r18
+(p6)    cmp.eq p6,p7=r26,r18                    // Only if page is present
         ;;
 (p6)    itc.d r25                               // install updated PTE
         /*
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 767de847b4ab..3a0f89d2c8dc 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1053,6 +1053,7 @@ config CPU_MIPS32_R1
         depends on SYS_HAS_CPU_MIPS32_R1
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 1 or later of the
           MIPS32 architecture.  Most modern embedded systems with a 32-bit
@@ -1069,6 +1070,7 @@ config CPU_MIPS32_R2
         depends on SYS_HAS_CPU_MIPS32_R2
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 2 or later of the
           MIPS32 architecture.  Most modern embedded systems with a 32-bit
@@ -1082,6 +1084,7 @@ config CPU_MIPS64_R1
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
         select CPU_SUPPORTS_64BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 1 or later of the
           MIPS64 architecture.  Many modern embedded systems with a 64-bit
@@ -1099,6 +1102,7 @@ config CPU_MIPS64_R2
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
         select CPU_SUPPORTS_64BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 2 or later of the
           MIPS64 architecture.  Many modern embedded systems with a 64-bit
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 38c0f3360d51..fe9da16f3a40 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -95,6 +95,7 @@ endif
 # crossformat linking we rely on the elf2ecoff tool for format conversion.
 #
 cflags-y                        += -G 0 -mno-abicalls -fno-pic -pipe
+cflags-y                        += -msoft-float
 LDFLAGS_vmlinux                 += -G 0 -static -n -nostdlib
 MODFLAGS                        += -mlong-calls
 
diff --git a/arch/mips/arc/arc_con.c b/arch/mips/arc/arc_con.c
index 51785a6a7328..bc32fe64f42a 100644
--- a/arch/mips/arc/arc_con.c
+++ b/arch/mips/arc/arc_con.c
@@ -24,7 +24,7 @@ static void prom_console_write(struct console *co, const char *s,
         }
 }
 
-static int __init prom_console_setup(struct console *co, char *options)
+static int prom_console_setup(struct console *co, char *options)
 {
         return !(prom_flags & PROM_FLAG_USE_AS_CONSOLE);
 }
diff --git a/arch/mips/kernel/irq-mv6434x.c b/arch/mips/kernel/irq-mv6434x.c
index 0ac067f45cf5..0613f1f36b1b 100644
--- a/arch/mips/kernel/irq-mv6434x.c
+++ b/arch/mips/kernel/irq-mv6434x.c
@@ -11,12 +11,14 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
-#include <asm/ptrace.h>
-#include <linux/sched.h>
 #include <linux/kernel_stat.h>
+#include <linux/mv643xx.h>
+#include <linux/sched.h>
+
+#include <asm/ptrace.h>
 #include <asm/io.h>
 #include <asm/irq.h>
-#include <linux/mv643xx.h>
+#include <asm/marvell.h>
 
 static unsigned int irq_base;
 
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index ff699dbb99f7..2ad0cedf29fe 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -106,6 +106,9 @@ SECTIONS
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
   SECURITY_INIT
+    /* .exit.text is discarded at runtime, not link time, to deal with
+     references from .rodata */
+  .exit.text : { *(.exit.text) }
   . = ALIGN(_PAGE_SIZE);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
@@ -133,7 +136,6 @@ SECTIONS
 
   /* Sections to be discarded */
   /DISCARD/ : {
-        *(.exit.text)
         *(.exit.data)
         *(.exitcall.exit)
 
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 0f9485806bac..ac4f4bfaae50 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -280,69 +280,69 @@ static void __init build_insn(u32 **buf, enum opcode opc, ...)
 }
 
 #define I_u1u2u3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, unsigned int c)                 \
         {                                                       \
                 build_insn(buf, insn##op, a, b, c);             \
         }
 
 #define I_u2u1u3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, unsigned int c)                 \
         {                                                       \
                 build_insn(buf, insn##op, b, a, c);             \
         }
 
 #define I_u3u1u2(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, unsigned int c)                 \
         {                                                       \
                 build_insn(buf, insn##op, b, c, a);             \
         }
 
 #define I_u1u2s3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, signed int c)                   \
         {                                                       \
                 build_insn(buf, insn##op, a, b, c);             \
         }
 
 #define I_u2s3u1(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 signed int b, unsigned int c)                   \
         {                                                       \
                 build_insn(buf, insn##op, c, a, b);             \
         }
 
 #define I_u2u1s3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, signed int c)                   \
         {                                                       \
                 build_insn(buf, insn##op, b, a, c);             \
         }
 
 #define I_u1u2(op)                                              \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b)                                 \
         {                                                       \
                 build_insn(buf, insn##op, a, b);                \
         }
 
 #define I_u1s2(op)                                              \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 signed int b)                                   \
         {                                                       \
                 build_insn(buf, insn##op, a, b);                \
         }
 
 #define I_u1(op)                                                \
-        static inline void i##op(u32 **buf, unsigned int a)     \
+        static inline void __init i##op(u32 **buf, unsigned int a)      \
         {                                                       \
                 build_insn(buf, insn##op, a);                   \
         }
 
 #define I_0(op)                                                 \
-        static inline void i##op(u32 **buf)                     \
+        static inline void __init i##op(u32 **buf)              \
         {                                                       \
                 build_insn(buf, insn##op);                      \
         }
@@ -623,42 +623,42 @@ static __init int __attribute__((unused)) insn_has_bdelay(struct reloc *rel,
 }
 
 /* convenience functions for labeled branches */
-static void __attribute__((unused)) il_bltz(u32 **p, struct reloc **r,
-                                            unsigned int reg, enum label_id l)
+static void __init __attribute__((unused))
+        il_bltz(u32 **p, struct reloc **r, unsigned int reg, enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_bltz(p, reg, 0);
 }
 
-static void __attribute__((unused)) il_b(u32 **p, struct reloc **r,
+static void __init __attribute__((unused)) il_b(u32 **p, struct reloc **r,
                                          enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_b(p, 0);
 }
 
-static void il_beqz(u32 **p, struct reloc **r, unsigned int reg,
+static void __init il_beqz(u32 **p, struct reloc **r, unsigned int reg,
                     enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_beqz(p, reg, 0);
 }
 
-static void __attribute__((unused))
+static void __init __attribute__((unused))
 il_beqzl(u32 **p, struct reloc **r, unsigned int reg, enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_beqzl(p, reg, 0);
 }
 
-static void il_bnez(u32 **p, struct reloc **r, unsigned int reg,
+static void __init il_bnez(u32 **p, struct reloc **r, unsigned int reg,
                     enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_bnez(p, reg, 0);
 }
 
-static void il_bgezl(u32 **p, struct reloc **r, unsigned int reg,
+static void __init il_bgezl(u32 **p, struct reloc **r, unsigned int reg,
                      enum label_id l)
 {
         r_mips_pc16(r, *p, l);
diff --git a/arch/mips/momentum/jaguar_atx/prom.c b/arch/mips/momentum/jaguar_atx/prom.c
index aae7a802767a..1cadaa92946a 100644
--- a/arch/mips/momentum/jaguar_atx/prom.c
+++ b/arch/mips/momentum/jaguar_atx/prom.c
@@ -21,10 +21,10 @@
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/bootmem.h>
+#include <linux/mv643xx.h>
 
 #include <asm/addrspace.h>
 #include <asm/bootinfo.h>
-#include <asm/mv64340.h>
 #include <asm/pmon.h>
 
 #include "jaguar_atx_fpga.h"
diff --git a/arch/mips/momentum/jaguar_atx/setup.c b/arch/mips/momentum/jaguar_atx/setup.c
index 301d67226d72..2699917b640a 100644
--- a/arch/mips/momentum/jaguar_atx/setup.c
+++ b/arch/mips/momentum/jaguar_atx/setup.c
@@ -2,7 +2,7 @@
  * BRIEF MODULE DESCRIPTION
  * Momentum Computer Jaguar-ATX board dependent boot routines
  *
- * Copyright (C) 1996, 1997, 2001, 2004  Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 1996, 1997, 2001, 04, 06  Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2000 RidgeRun, Inc.
  * Copyright (C) 2001 Red Hat, Inc.
  * Copyright (C) 2002 Momentum Computer
@@ -55,6 +55,8 @@
 #include <linux/interrupt.h>
 #include <linux/timex.h>
 #include <linux/vmalloc.h>
+#include <linux/mv643xx.h>
+
 #include <asm/time.h>
 #include <asm/bootinfo.h>
 #include <asm/page.h>
@@ -64,7 +66,6 @@
 #include <asm/ptrace.h>
 #include <asm/reboot.h>
 #include <asm/tlbflush.h>
-#include <asm/mv64340.h>
 
 #include "jaguar_atx_fpga.h"
 
diff --git a/arch/mips/momentum/ocelot_c/irq.c b/arch/mips/momentum/ocelot_c/irq.c
index 300fe8e4fbe8..a5764bc20e36 100644
--- a/arch/mips/momentum/ocelot_c/irq.c
+++ b/arch/mips/momentum/ocelot_c/irq.c
@@ -41,11 +41,11 @@
 #include <linux/slab.h>
 #include <linux/random.h>
 #include <linux/bitops.h>
+#include <linux/mv643xx.h>
 #include <asm/bootinfo.h>
 #include <asm/io.h>
 #include <asm/irq_cpu.h>
 #include <asm/mipsregs.h>
-#include <asm/mv64340.h>
 #include <asm/system.h>
 
 extern asmlinkage void ocelot_handle_int(void);
diff --git a/arch/mips/momentum/ocelot_c/prom.c b/arch/mips/momentum/ocelot_c/prom.c
index 5b6809724b15..e92364482c7b 100644
--- a/arch/mips/momentum/ocelot_c/prom.c
+++ b/arch/mips/momentum/ocelot_c/prom.c
@@ -19,10 +19,10 @@
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/bootmem.h>
+#include <linux/mv643xx.h>
 
 #include <asm/addrspace.h>
 #include <asm/bootinfo.h>
-#include <asm/mv64340.h>
 #include <asm/pmon.h>
 
 #include "ocelot_c_fpga.h"
diff --git a/arch/mips/momentum/ocelot_c/setup.c b/arch/mips/momentum/ocelot_c/setup.c
index 15998d8a9341..bd02e60d037a 100644
--- a/arch/mips/momentum/ocelot_c/setup.c
+++ b/arch/mips/momentum/ocelot_c/setup.c
@@ -54,6 +54,7 @@
 #include <linux/pm.h>
 #include <linux/timex.h>
 #include <linux/vmalloc.h>
+#include <linux/mv643xx.h>
 
 #include <asm/time.h>
 #include <asm/bootinfo.h>
@@ -64,9 +65,9 @@
 #include <asm/processor.h>
 #include <asm/ptrace.h>
 #include <asm/reboot.h>
+#include <asm/marvell.h>
 #include <linux/bootmem.h>
 #include <linux/blkdev.h>
-#include <asm/mv64340.h>
 #include "ocelot_c_fpga.h"
 
 unsigned long marvell_base;
@@ -252,22 +253,22 @@ void __init plat_setup(void)
         /* shut down ethernet ports, just to be sure our memory doesn't get
          * corrupted by random ethernet traffic.
          */
-        MV_WRITE(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(0), 0xff << 8);
-        MV_WRITE(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(1), 0xff << 8);
-        MV_WRITE(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(0), 0xff << 8);
-        MV_WRITE(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(1), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(0), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(1), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(0), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(1), 0xff << 8);
         do {}
-          while (MV_READ(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(0)) & 0xff);
+          while (MV_READ(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(0)) & 0xff);
         do {}
-          while (MV_READ(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(1)) & 0xff);
+          while (MV_READ(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(1)) & 0xff);
         do {}
-          while (MV_READ(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(0)) & 0xff);
+          while (MV_READ(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(0)) & 0xff);
         do {}
-          while (MV_READ(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(1)) & 0xff);
-        MV_WRITE(MV64340_ETH_PORT_SERIAL_CONTROL_REG(0),
-                 MV_READ(MV64340_ETH_PORT_SERIAL_CONTROL_REG(0)) & ~1);
-        MV_WRITE(MV64340_ETH_PORT_SERIAL_CONTROL_REG(1),
-                 MV_READ(MV64340_ETH_PORT_SERIAL_CONTROL_REG(1)) & ~1);
+          while (MV_READ(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(1)) & 0xff);
+        MV_WRITE(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(0),
+                 MV_READ(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(0)) & ~1);
+        MV_WRITE(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(1),
+                 MV_READ(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(1)) & ~1);
 
         /* Turn off the Bit-Error LED */
         OCELOT_FPGA_WRITE(0x80, CLR);
diff --git a/arch/mips/pci/pci-ocelot-c.c b/arch/mips/pci/pci-ocelot-c.c
index 1d84d36e034d..027759f7c904 100644
--- a/arch/mips/pci/pci-ocelot-c.c
+++ b/arch/mips/pci/pci-ocelot-c.c
@@ -3,15 +3,17 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2004 by Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 2004, 06 by Ralf Baechle (ralf@linux-mips.org)
  */
 
 #include <linux/types.h>
 #include <linux/pci.h>
-#include <asm/mv64340.h>
+#include <linux/mv643xx.h>
 
 #include <linux/init.h>
 
+#include <asm/marvell.h>
+
 /*
  * We assume the address ranges have already been setup appropriately by
  * the firmware.  PMON in case of the Ocelot C does that.
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index fec07a12c6cd..fae42da7468d 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -607,7 +607,7 @@ config KEXEC
           strongly in flux, so no good recommendation can be made.
 
 config CRASH_DUMP
-        bool "kernel crash dumps (EXPERIMENTAL)"
+        bool "Build a kdump crash kernel (EXPERIMENTAL)"
         depends on PPC_MULTIPLATFORM && PPC64 && EXPERIMENTAL
         help
           Build a kernel suitable for use as a kdump capture kernel.
diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
index e0192c26037b..70e65b13e033 100644
--- a/arch/powerpc/boot/crt0.S
+++ b/arch/powerpc/boot/crt0.S
@@ -45,7 +45,8 @@ _zimage_start:
         bdnz    2b
 
         /* Do a cache flush for our text, in case OF didn't */
-3:      lis     r9,_start@h
+3:      lis     r9,_start@ha
+        addi    r9,r9,_start@l
         add     r9,r0,r9
         lis     r8,_etext@ha
         addi    r8,r8,_etext@l
@@ -53,7 +54,7 @@ _zimage_start:
 4:      dcbf    r0,r9
         icbi    r0,r9
         addi    r9,r9,0x20
-        cmplwi  0,r9,8
+        cmplw   cr0,r9,r8
         blt     4b
         sync
         isync
diff --git a/arch/powerpc/configs/cell_defconfig b/arch/powerpc/configs/cell_defconfig
index 063b84f2cbea..3c2acab63736 100644
--- a/arch/powerpc/configs/cell_defconfig
+++ b/arch/powerpc/configs/cell_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:26 2005
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:48 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=4
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -48,8 +51,6 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -111,7 +116,6 @@ CONFIG_PPC_MULTIPLATFORM=y
 # CONFIG_PPC_PMAC is not set
 # CONFIG_PPC_MAPLE is not set
 CONFIG_PPC_CELL=y
-CONFIG_PPC_OF=y
 # CONFIG_U3_DART is not set
 CONFIG_PPC_RTAS=y
 # CONFIG_RTAS_ERROR_LOGGING is not set
@@ -120,11 +124,15 @@ CONFIG_RTAS_FLASH=y
 CONFIG_MMIO_NVRAM=y
 CONFIG_CELL_IIC=y
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
 #
+# Cell Broadband Engine options
+#
+CONFIG_SPU_FS=y
+
+#
 # Kernel options
 #
 # CONFIG_HZ_100 is not set
@@ -140,6 +148,7 @@ CONFIG_BINFMT_ELF=y
 CONFIG_FORCE_MAX_ZONEORDER=13
 # CONFIG_IOMMU_VMERGE is not set
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -191,6 +200,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -234,6 +244,25 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
 #
 # IP: Netfilter Configuration
@@ -251,37 +280,23 @@ CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
 CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
 CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
 CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
 CONFIG_IP_NF_MATCH_OWNER=m
 CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
 CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_MATCH_POLICY=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -297,11 +312,8 @@ CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_TOS=m
 CONFIG_IP_NF_TARGET_ECN=m
 CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
 CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -311,7 +323,6 @@ CONFIG_IP_NF_ARP_MANGLE=m
 #
 # CONFIG_IP6_NF_QUEUE is not set
 # CONFIG_IP6_NF_IPTABLES is not set
-# CONFIG_IP6_NF_TARGET_NFQUEUE is not set
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -322,6 +333,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -540,9 +556,11 @@ CONFIG_E1000=m
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 CONFIG_SKGE=m
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_BNX2 is not set
+CONFIG_SPIDER_NET=y
 # CONFIG_MV643XX_ETH is not set
 
 #
@@ -628,13 +646,16 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
+# CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINK is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
@@ -646,6 +667,7 @@ CONFIG_SERIAL_NONSTANDARD=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -756,6 +778,12 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -827,7 +855,7 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -847,6 +875,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -886,6 +915,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -951,6 +981,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1021,18 +1052,20 @@ CONFIG_TEXTSEARCH_FSM=m
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=15
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
@@ -1040,6 +1073,11 @@ CONFIG_DEBUGGER=y
 # CONFIG_XMON is not set
 CONFIG_IRQSTACKS=y
 # CONFIG_BOOTX_TEXT is not set
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/iseries_defconfig b/arch/powerpc/configs/iseries_defconfig
index c775027947f9..1816a46742f6 100644
--- a/arch/powerpc/configs/iseries_defconfig
+++ b/arch/powerpc/configs/iseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:32 2005
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:52 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+# CONFIG_PPC_UDBG_16550 is not set
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=32
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -49,8 +52,6 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -60,8 +61,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -70,8 +73,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_ISERIES=y
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_IBMVIO=y
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
@@ -183,6 +187,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -220,6 +225,28 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
 #
 # IP: Netfilter Configuration
@@ -237,39 +264,23 @@ CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
 CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
 CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
 CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
 CONFIG_IP_NF_MATCH_OWNER=m
 CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
 CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_MATCH_POLICY=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -285,13 +296,9 @@ CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_TOS=m
 CONFIG_IP_NF_TARGET_ECN=m
 CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
 CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
 CONFIG_IP_NF_TARGET_CLUSTERIP=m
 CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -305,6 +312,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -451,13 +463,7 @@ CONFIG_SCSI_IBMVSCSI=m
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -574,6 +580,7 @@ CONFIG_E1000=m
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
@@ -723,6 +730,12 @@ CONFIG_MAX_RAW_DEVS=256
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -788,7 +801,7 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -825,6 +838,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -865,6 +879,7 @@ CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -993,31 +1008,36 @@ CONFIG_TEXTSEARCH_FSM=m
 #
 # Instrumentation Support
 #
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=y
 # CONFIG_KPROBES is not set
 
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 # CONFIG_DEBUGGER is not set
 CONFIG_IRQSTACKS=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/maple_defconfig b/arch/powerpc/configs/maple_defconfig
index 68194c03f6d1..80a0db43aeb7 100644
--- a/arch/powerpc/configs/maple_defconfig
+++ b/arch/powerpc/configs/maple_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:36 2005
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:54 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -32,7 +36,6 @@ CONFIG_NR_CPUS=2
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -47,8 +50,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -111,14 +116,12 @@ CONFIG_PPC_MULTIPLATFORM=y
 # CONFIG_PPC_PMAC is not set
 CONFIG_PPC_MAPLE=y
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
 # CONFIG_PPC_RTAS is not set
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_MPIC_BROKEN_U3=y
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
@@ -138,6 +141,7 @@ CONFIG_BINFMT_ELF=y
 CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -189,6 +193,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -226,6 +231,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -461,6 +471,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
@@ -553,6 +564,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -651,6 +663,12 @@ CONFIG_I2C_AMD8111=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -738,12 +756,14 @@ CONFIG_USB_UHCI_HCD=y
 # may also be needed; see USB_STORAGE Help for more information
 #
 # CONFIG_USB_STORAGE is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 # CONFIG_USB_AIPTEK is not set
@@ -757,6 +777,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -797,6 +818,7 @@ CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
 # CONFIG_USB_SERIAL_ANYDATA is not set
 # CONFIG_USB_SERIAL_BELKIN is not set
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
 # CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set
 # CONFIG_USB_SERIAL_CP2101 is not set
 CONFIG_USB_SERIAL_CYPRESS_M8=m
@@ -873,7 +895,7 @@ CONFIG_USB_EZUSB=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -891,6 +913,7 @@ CONFIG_JBD=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -927,6 +950,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -988,6 +1012,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1053,18 +1078,20 @@ CONFIG_ZLIB_INFLATE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 CONFIG_DEBUG_SLAB=y
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1073,6 +1100,11 @@ CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 # CONFIG_IRQSTACKS is not set
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/mpc834x_sys_defconfig b/arch/powerpc/configs/mpc834x_sys_defconfig
index 3bff761965c2..5078b0441d61 100644
--- a/arch/powerpc/configs/mpc834x_sys_defconfig
+++ b/arch/powerpc/configs/mpc834x_sys_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-g461d4edf-dirty
-# Fri Jan 13 11:01:47 2006
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:56 2006
 #
 # CONFIG_PPC64 is not set
 CONFIG_PPC32=y
@@ -43,7 +43,6 @@ CONFIG_PPC_STD_MMU_32=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -189,6 +188,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -226,6 +226,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -511,6 +516,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -615,6 +621,12 @@ CONFIG_I2C_MPC=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -632,6 +644,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_FSCPOS is not set
 # CONFIG_SENSORS_GL518SM is not set
@@ -716,7 +729,7 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -826,6 +839,7 @@ CONFIG_PARTITION_ADVANCED=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -899,13 +913,3 @@ CONFIG_CRYPTO_DES=y
 #
 # Hardware crypto devices
 #
-
-#
-# SEC2.x Options
-#
-CONFIG_MPC8349E_SEC2x=y
-
-#
-# SEC2.x Test Options
-#
-CONFIG_MPC8349E_SEC2xTEST=y
diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
index 2ace57d1e333..57a027971d67 100644
--- a/arch/powerpc/configs/pmac32_defconfig
+++ b/arch/powerpc/configs/pmac32_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15
-# Sat Jan 14 16:26:08 2006
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:21:32 2006
 #
 # CONFIG_PPC64 is not set
 CONFIG_PPC32=y
@@ -17,8 +17,8 @@ CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 # CONFIG_PPC_UDBG_16550 is not set
-# CONFIG_CRASH_DUMP is not set
 # CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -43,7 +43,6 @@ CONFIG_PPC_STD_MMU_32=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -236,6 +235,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -271,6 +271,25 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
 #
 # IP: Netfilter Configuration
@@ -288,37 +307,22 @@ CONFIG_IP_NF_AMANDA=m
 CONFIG_IP_NF_PPTP=m
 # CONFIG_IP_NF_QUEUE is not set
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
 CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
 CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
 CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
 CONFIG_IP_NF_MATCH_OWNER=m
-# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
-# CONFIG_IP_NF_MATCH_REALM is not set
-# CONFIG_IP_NF_MATCH_SCTP is not set
-CONFIG_IP_NF_MATCH_DCCP=m
-# CONFIG_IP_NF_MATCH_COMMENT is not set
-# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
-CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_MATCH_ADDRTYPE=m
+CONFIG_IP_NF_MATCH_HASHLIMIT=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-# CONFIG_IP_NF_TARGET_LOG is not set
+CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
-# CONFIG_IP_NF_TARGET_NFQUEUE is not set
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -331,9 +335,12 @@ CONFIG_IP_NF_NAT_FTP=m
 CONFIG_IP_NF_NAT_TFTP=m
 CONFIG_IP_NF_NAT_AMANDA=m
 CONFIG_IP_NF_NAT_PPTP=m
-# CONFIG_IP_NF_MANGLE is not set
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_TOS=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_DSCP=m
+CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -360,6 +367,11 @@ CONFIG_IP_DCCP_TFRC_LIB=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -377,6 +389,7 @@ CONFIG_IP_DCCP_TFRC_LIB=m
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
+CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -568,7 +581,6 @@ CONFIG_IDEDMA_PCI_AUTO=y
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
 CONFIG_BLK_DEV_PDC202XX_NEW=y
-# CONFIG_PDC202XX_FORCE is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
 # CONFIG_BLK_DEV_SLC90E66 is not set
@@ -654,8 +666,7 @@ CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA2XXX_EMBEDDED_FIRMWARE is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -991,6 +1002,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=m
 CONFIG_SERIAL_PMACZILOG=m
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -1098,6 +1110,12 @@ CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -1348,6 +1366,7 @@ CONFIG_USB_PRINTER=m
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+CONFIG_USB_HIDINPUT_POWERBOOK=y
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 # CONFIG_USB_AIPTEK is not set
@@ -1488,7 +1507,7 @@ CONFIG_USB_EZUSB=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -1609,6 +1628,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1692,6 +1712,7 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUGGER=y
 CONFIG_XMON=y
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 0362a70aa97c..395e49847788 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -407,7 +407,7 @@ CONFIG_IDEPCI_SHARE_IRQ=y
 # CONFIG_BLK_DEV_OFFBOARD is not set
 CONFIG_BLK_DEV_GENERIC=y
 # CONFIG_BLK_DEV_OPTI621 is not set
-# CONFIG_BLK_DEV_SL82C105 is not set
+CONFIG_BLK_DEV_SL82C105=y
 CONFIG_BLK_DEV_IDEDMA_PCI=y
 # CONFIG_BLK_DEV_IDEDMA_FORCED is not set
 CONFIG_IDEDMA_PCI_AUTO=y
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index c367520bc1c3..ba92bab7cc2c 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -589,7 +589,6 @@ void __devinit scan_phb(struct pci_controller *hose)
 #endif /* CONFIG_PPC_MULTIPLATFORM */
         if (mode == PCI_PROBE_NORMAL)
                 hose->last_busno = bus->subordinate = pci_scan_child_bus(bus);
-        pci_bus_add_devices(bus);
 }
 
 static int __init pcibios_init(void)
@@ -608,8 +607,10 @@ static int __init pcibios_init(void)
         printk("PCI: Probing PCI hardware\n");
 
         /* Scan all of the recorded PCI controllers.  */
-        list_for_each_entry_safe(hose, tmp, &hose_list, list_node)
+        list_for_each_entry_safe(hose, tmp, &hose_list, list_node) {
                 scan_phb(hose);
+                pci_bus_add_devices(hose->bus);
+        }
 
 #ifndef CONFIG_PPC_ISERIES
         if (pci_probe_only)
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index af32922db65b..dfa5398ab3c8 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -109,15 +109,6 @@ EXPORT_SYMBOL(_insw_ns);
 EXPORT_SYMBOL(_outsw_ns);
 EXPORT_SYMBOL(_insl_ns);
 EXPORT_SYMBOL(_outsl_ns);
-EXPORT_SYMBOL(ioremap);
-#ifdef CONFIG_44x
-EXPORT_SYMBOL(ioremap64);
-#endif
-EXPORT_SYMBOL(__ioremap);
-EXPORT_SYMBOL(iounmap);
-#ifdef CONFIG_PPC32
-EXPORT_SYMBOL(ioremap_bot);     /* aka VMALLOC_END */
-#endif
 
 #if defined(CONFIG_PPC32) && (defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_IDE_MODULE))
 EXPORT_SYMBOL(ppc_ide_md);
@@ -160,7 +151,6 @@ EXPORT_SYMBOL(__flush_icache_range);
 EXPORT_SYMBOL(flush_dcache_range);
 
 #ifdef CONFIG_SMP
-EXPORT_SYMBOL(smp_call_function);
 #ifdef CONFIG_PPC32
 EXPORT_SYMBOL(smp_hw_index);
 #endif
diff --git a/arch/powerpc/kernel/rtas-rtc.c b/arch/powerpc/kernel/rtas-rtc.c
index 635d3b9a8811..34d073fb6091 100644
--- a/arch/powerpc/kernel/rtas-rtc.c
+++ b/arch/powerpc/kernel/rtas-rtc.c
@@ -52,7 +52,7 @@ void rtas_get_rtc_time(struct rtc_time *rtc_tm)
                 error = rtas_call(rtas_token("get-time-of-day"), 0, 8, ret);
                 if (error == RTAS_CLOCK_BUSY || rtas_is_extended_busy(error)) {
                         if (in_interrupt() && printk_ratelimit()) {
-                                memset(&rtc_tm, 0, sizeof(struct rtc_time));
+                                memset(rtc_tm, 0, sizeof(struct rtc_time));
                                 printk(KERN_WARNING "error: reading clock"
                                        " would delay interrupt\n");
                                 return; /* delay not allowed */
diff --git a/arch/powerpc/kernel/rtas_pci.c b/arch/powerpc/kernel/rtas_pci.c
index 03afb79e27e5..57b539a03fa9 100644
--- a/arch/powerpc/kernel/rtas_pci.c
+++ b/arch/powerpc/kernel/rtas_pci.c
@@ -278,8 +278,7 @@ static int phb_set_bus_ranges(struct device_node *dev,
         return 0;
 }
 
-static int __devinit setup_phb(struct device_node *dev,
-                               struct pci_controller *phb)
+int __devinit setup_phb(struct device_node *dev, struct pci_controller *phb)
 {
         if (is_python(dev))
                 python_countermeasures(dev);
@@ -357,27 +356,6 @@ unsigned long __init find_and_init_phbs(void)
         return 0;
 }
 
-struct pci_controller * __devinit init_phb_dynamic(struct device_node *dn)
-{
-        struct pci_controller *phb;
-        int primary;
-
-        primary = list_empty(&hose_list);
-        phb = pcibios_alloc_controller(dn);
-        if (!phb)
-                return NULL;
-        setup_phb(dn, phb);
-        pci_process_bridge_OF_ranges(phb, dn, primary);
-
-        pci_setup_phb_io_dynamic(phb, primary);
-
-        pci_devs_phb_init_dynamic(phb);
-        scan_phb(phb);
-
-        return phb;
-}
-EXPORT_SYMBOL(init_phb_dynamic);
-
 /* RPA-specific bits for removing PHBs */
 int pcibios_remove_root_bus(struct pci_controller *phb)
 {
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 4f20a5f15d49..4a27218a086c 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -503,9 +503,9 @@ static inline void update_gtod(u64 new_tb_stamp, u64 new_stamp_xsec,
          * the two values of tb_update_count match and are even then the
          * tb_to_xs and stamp_xsec values are consistent.  If not, then it
          * loops back and reads them again until this criteria is met.
+         * We expect the caller to have done the first increment of
+         * vdso_data->tb_update_count already.
          */
-        ++(vdso_data->tb_update_count);
-        smp_wmb();
         vdso_data->tb_orig_stamp = new_tb_stamp;
         vdso_data->stamp_xsec = new_stamp_xsec;
         vdso_data->tb_to_xs = new_tb_to_xs;
@@ -530,20 +530,15 @@ static __inline__ void timer_recalc_offset(u64 cur_tb)
         unsigned long offset;
         u64 new_stamp_xsec;
         u64 tlen, t2x;
+        u64 tb, xsec_old, xsec_new;
+        struct gettimeofday_vars *varp;
 
         if (__USE_RTC())
                 return;
         tlen = current_tick_length();
         offset = cur_tb - do_gtod.varp->tb_orig_stamp;
-        if (tlen == last_tick_len && offset < 0x80000000u) {
-                /* check that we're still in sync; if not, resync */
-                struct timeval tv;
-                __do_gettimeofday(&tv, cur_tb);
-                if (tv.tv_sec <= xtime.tv_sec &&
-                    (tv.tv_sec < xtime.tv_sec ||
-                     tv.tv_usec * 1000 <= xtime.tv_nsec))
-                        return;
-        }
+        if (tlen == last_tick_len && offset < 0x80000000u)
+                return;
         if (tlen != last_tick_len) {
                 t2x = mulhdu(tlen << TICKLEN_SHIFT, ticklen_to_xs);
                 last_tick_len = tlen;
@@ -552,6 +547,21 @@ static __inline__ void timer_recalc_offset(u64 cur_tb)
         new_stamp_xsec = (u64) xtime.tv_nsec * XSEC_PER_SEC;
         do_div(new_stamp_xsec, 1000000000);
         new_stamp_xsec += (u64) xtime.tv_sec * XSEC_PER_SEC;
+
+        ++vdso_data->tb_update_count;
+        smp_mb();
+
+        /*
+         * Make sure time doesn't go backwards for userspace gettimeofday.
+         */
+        tb = get_tb();
+        varp = do_gtod.varp;
+        xsec_old = mulhdu(tb - varp->tb_orig_stamp, varp->tb_to_xs)
+                + varp->stamp_xsec;
+        xsec_new = mulhdu(tb - cur_tb, t2x) + new_stamp_xsec;
+        if (xsec_new < xsec_old)
+                new_stamp_xsec += xsec_old - xsec_new;
+
         update_gtod(cur_tb, new_stamp_xsec, t2x);
 }
 
@@ -800,6 +810,10 @@ int do_settimeofday(struct timespec *tv)
         }
 #endif
 
+        /* Make userspace gettimeofday spin until we're done. */
+        ++vdso_data->tb_update_count;
+        smp_mb();
+
         /*
          * Subtract off the number of nanoseconds since the
          * beginning of the last tick.
@@ -961,10 +975,16 @@ void __init time_init(void)
          * It is computed as:
          * ticklen_to_xs = 2^N / (tb_ticks_per_jiffy * 1e9)
          * where N = 64 + 20 - TICKLEN_SCALE - TICKLEN_SHIFT
-         * so as to give the result as a 0.64 fixed-point fraction.
+         * which turns out to be N = 51 - SHIFT_HZ.
+         * This gives the result as a 0.64 fixed-point fraction.
+         * That value is reduced by an offset amounting to 1 xsec per
+         * 2^31 timebase ticks to avoid problems with time going backwards
+         * by 1 xsec when we do timer_recalc_offset due to losing the
+         * fractional xsec.  That offset is equal to ppc_tb_freq/2^51
+         * since there are 2^20 xsec in a second.
          */
-        div128_by_32(1ULL << (64 + 20 - TICKLEN_SCALE - TICKLEN_SHIFT), 0,
-                     tb_ticks_per_jiffy, &res);
+        div128_by_32((1ULL << 51) - ppc_tb_freq, 0,
+                     tb_ticks_per_jiffy << SHIFT_HZ, &res);
         div128_by_32(res.result_high, res.result_low, NSEC_PER_SEC, &res);
         ticklen_to_xs = res.result_low;
 
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index f4e5ac122615..d296eb6b4545 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -37,6 +37,7 @@
 
 unsigned long ioremap_base;
 unsigned long ioremap_bot;
+EXPORT_SYMBOL(ioremap_bot);     /* aka VMALLOC_END */
 int io_bat_index;
 
 #if defined(CONFIG_6xx) || defined(CONFIG_POWER3)
@@ -153,6 +154,7 @@ ioremap64(unsigned long long addr, unsigned long size)
 {
         return __ioremap(addr, size, _PAGE_NO_CACHE);
 }
+EXPORT_SYMBOL(ioremap64);
 
 void __iomem *
 ioremap(phys_addr_t addr, unsigned long size)
@@ -162,6 +164,7 @@ ioremap(phys_addr_t addr, unsigned long size)
         return ioremap64(addr64, size);
 }
 #endif /* CONFIG_PHYS_64BIT */
+EXPORT_SYMBOL(ioremap);
 
 void __iomem *
 __ioremap(phys_addr_t addr, unsigned long size, unsigned long flags)
@@ -247,6 +250,7 @@ __ioremap(phys_addr_t addr, unsigned long size, unsigned long flags)
 out:
         return (void __iomem *) (v + ((unsigned long)addr & ~PAGE_MASK));
 }
+EXPORT_SYMBOL(__ioremap);
 
 void iounmap(volatile void __iomem *addr)
 {
@@ -259,6 +263,7 @@ void iounmap(volatile void __iomem *addr)
         if (addr > high_memory && (unsigned long) addr < ioremap_bot)
                 vunmap((void *) (PAGE_MASK & (unsigned long)addr));
 }
+EXPORT_SYMBOL(iounmap);
 
 void __iomem *ioport_map(unsigned long port, unsigned int len)
 {
diff --git a/arch/powerpc/platforms/powermac/feature.c b/arch/powerpc/platforms/powermac/feature.c
index c8b4a2b115a9..e49eddd5042d 100644
--- a/arch/powerpc/platforms/powermac/feature.c
+++ b/arch/powerpc/platforms/powermac/feature.c
@@ -2489,9 +2489,7 @@ found:
                         pmac_mb.model_id = PMAC_TYPE_COMET;
                 iounmap(mach_id_ptr);
         }
-#endif /* CONFIG_POWER4 */
 
-#ifdef CONFIG_6xx
         /* Set default value of powersave_nap on machines that support it.
          * It appears that uninorth rev 3 has a problem with it, we don't
          * enable it on those. In theory, the flush-on-lock property is
@@ -2520,10 +2518,11 @@ found:
          * NAP mode
          */
         powersave_lowspeed = 1;
-#endif /* CONFIG_6xx */
-#ifdef CONFIG_POWER4
+
+#else /* CONFIG_POWER4 */
         powersave_nap = 1;
-#endif
+#endif  /* CONFIG_POWER4 */
+
         /* Check for "mobile" machine */
         if (model && (strncmp(model, "PowerBook", 9) == 0
                    || strncmp(model, "iBook", 5) == 0))
diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
index 97c54e19c1b5..385aab90c4d2 100644
--- a/arch/powerpc/platforms/powermac/setup.c
+++ b/arch/powerpc/platforms/powermac/setup.c
@@ -621,10 +621,6 @@ static void __init pmac_init_early(void)
         /* Probe motherboard chipset */
         pmac_feature_init();
 
-        /* We can NAP */
-        powersave_nap = 1;
-        printk(KERN_INFO "Using native/NAP idle loop\n");
-
         /* Initialize debug stuff */
         udbg_scc_init(!!strstr(cmd_line, "sccdbg"));
         udbg_adb_init(!!strstr(cmd_line, "btextdbg"));
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 4e5c8f8d869d..a57032cf6f1b 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -19,7 +19,7 @@ config SCANLOG
         depends on RTAS_PROC && PPC_PSERIES
 
 config LPARCFG
-        tristate "LPAR Configuration Data"
+        bool "LPAR Configuration Data"
         depends on PPC_PSERIES || PPC_ISERIES
         help
         Provide system capacity information via human readable
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index f3bad900bbcf..44abdeb9ca03 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -27,6 +27,7 @@
 
 #include <linux/pci.h>
 #include <asm/pci-bridge.h>
+#include <asm/ppc-pci.h>
 
 static struct pci_bus *
 find_bus_among_children(struct pci_bus *bus,
@@ -179,3 +180,30 @@ pcibios_add_pci_devices(struct pci_bus * bus)
         }
 }
 EXPORT_SYMBOL_GPL(pcibios_add_pci_devices);
+
+struct pci_controller * __devinit init_phb_dynamic(struct device_node *dn)
+{
+        struct pci_controller *phb;
+        int primary;
+
+        primary = list_empty(&hose_list);
+        phb = pcibios_alloc_controller(dn);
+        if (!phb)
+                return NULL;
+        setup_phb(dn, phb);
+        pci_process_bridge_OF_ranges(phb, dn, 0);
+
+        pci_setup_phb_io_dynamic(phb, primary);
+
+        pci_devs_phb_init_dynamic(phb);
+
+        if (dn->child)
+                eeh_add_device_tree_early(dn);
+
+        scan_phb(phb);
+        pcibios_fixup_new_pci_devices(phb->bus, 0);
+        pci_bus_add_devices(phb->bus);
+
+        return phb;
+}
+EXPORT_SYMBOL_GPL(init_phb_dynamic);
diff --git a/arch/s390/lib/spinlock.c b/arch/s390/lib/spinlock.c
index 60f80a4eed4e..b9b7958a226a 100644
--- a/arch/s390/lib/spinlock.c
+++ b/arch/s390/lib/spinlock.c
@@ -2,8 +2,7 @@
  *  arch/s390/lib/spinlock.c
  *    Out of line spinlock code.
  *
- *  S390 version
- *    Copyright (C) 2004 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Copyright (C) IBM Corp. 2004, 2006
  *    Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com)
  */
 
@@ -44,6 +43,8 @@ _raw_spin_lock_wait(raw_spinlock_t *lp, unsigned int pc)
                         _diag44();
                         count = spin_retry;
                 }
+                if (__raw_spin_is_locked(lp))
+                        continue;
                 if (_raw_compare_and_swap(&lp->lock, 0, pc) == 0)
                         return;
         }
@@ -56,6 +57,8 @@ _raw_spin_trylock_retry(raw_spinlock_t *lp, unsigned int pc)
         int count = spin_retry;
 
         while (count-- > 0) {
+                if (__raw_spin_is_locked(lp))
+                        continue;
                 if (_raw_compare_and_swap(&lp->lock, 0, pc) == 0)
                         return 1;
         }
@@ -74,6 +77,8 @@ _raw_read_lock_wait(raw_rwlock_t *rw)
                         _diag44();
                         count = spin_retry;
                 }
+                if (!__raw_read_can_lock(rw))
+                        continue;
                 old = rw->lock & 0x7fffffffU;
                 if (_raw_compare_and_swap(&rw->lock, old, old + 1) == old)
                         return;
@@ -88,6 +93,8 @@ _raw_read_trylock_retry(raw_rwlock_t *rw)
         int count = spin_retry;
 
         while (count-- > 0) {
+                if (!__raw_read_can_lock(rw))
+                        continue;
                 old = rw->lock & 0x7fffffffU;
                 if (_raw_compare_and_swap(&rw->lock, old, old + 1) == old)
                         return 1;
@@ -106,6 +113,8 @@ _raw_write_lock_wait(raw_rwlock_t *rw)
                         _diag44();
                         count = spin_retry;
                 }
+                if (!__raw_write_can_lock(rw))
+                        continue;
                 if (_raw_compare_and_swap(&rw->lock, 0, 0x80000000) == 0)
                         return;
         }
@@ -118,6 +127,8 @@ _raw_write_trylock_retry(raw_rwlock_t *rw)
         int count = spin_retry;
 
         while (count-- > 0) {
+                if (!__raw_write_can_lock(rw))
+                        continue;
                 if (_raw_compare_and_swap(&rw->lock, 0, 0x80000000) == 0)
                         return 1;
         }
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index e73621d03a28..e9b275d90737 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -392,9 +392,9 @@ config SH_TMU
 
 endmenu
 
-source "arch/sh/boards/renesas/hs7751rvoip/Kconfig"
+#source "arch/sh/boards/renesas/hs7751rvoip/Kconfig"
 
-source "arch/sh/boards/renesas/rts7751r2d/Kconfig"
+#source "arch/sh/boards/renesas/rts7751r2d/Kconfig"
 
 config SH_PCLK_FREQ
         int "Peripheral clock frequency (in Hz)"
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 7ee4a14ec3b1..e90ef5db8913 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -26,6 +26,10 @@ config GENERIC_HARDIRQS
         bool
         default y
 
+config RWSEM_GENERIC_SPINLOCK
+       bool
+       default y
+
 source "init/Kconfig"
 
 menu "Processor type and features"
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index 18a455651121..52f3eb45d2b9 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -6,17 +6,29 @@
 # $Id: Kconfig,v 1.4.2.7 2005/07/08 22:05:38 dsp_llnl Exp $
 #
 
-menu 'EDAC - error detection and reporting (RAS)'
+menu 'EDAC - error detection and reporting (RAS) (EXPERIMENTAL)'
 
 config EDAC
-        tristate "EDAC core system error reporting"
-        depends on X86
+        tristate "EDAC core system error reporting (EXPERIMENTAL)"
+        depends on X86 && EXPERIMENTAL
         help
           EDAC is designed to report errors in the core system.
           These are low-level errors that are reported in the CPU or
           supporting chipset: memory errors, cache errors, PCI errors,
           thermal throttling, etc..  If unsure, select 'Y'.
 
+          If this code is reporting problems on your system, please
+          see the EDAC project web pages for more information at:
+
+          <http://bluesmoke.sourceforge.net/>
+
+          and:
+
+          <http://buttersideup.com/edacwiki>
+
+          There is also a mailing list for the EDAC project, which can
+          be found via the sourceforge page.
+
 
 comment "Reporting subsystems"
         depends on EDAC
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index b10ee4698b1d..9c205274c1cb 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -38,6 +38,12 @@
 
 #define EDAC_MC_VERSION "edac_mc  Ver: 2.0.0 " __DATE__
 
+/* For now, disable the EDAC sysfs code.  The sysfs interface that EDAC
+ * presents to user space needs more thought, and is likely to change
+ * substantially.
+ */
+#define DISABLE_EDAC_SYSFS
+
 #ifdef CONFIG_EDAC_DEBUG
 /* Values of 0 to 4 will generate output */
 int edac_debug_level = 1;
@@ -47,7 +53,7 @@ EXPORT_SYMBOL(edac_debug_level);
 /* EDAC Controls, setable by module parameter, and sysfs */
 static int log_ue = 1;
 static int log_ce = 1;
-static int panic_on_ue = 1;
+static int panic_on_ue;
 static int poll_msec = 1000;
 
 static int check_pci_parity = 0;        /* default YES check PCI parity */
@@ -77,6 +83,8 @@ static int pci_whitelist_count ;
 
 /*  START sysfs data and methods */
 
+#ifndef DISABLE_EDAC_SYSFS
+
 static const char *mem_types[] = {
         [MEM_EMPTY] = "Empty",
         [MEM_RESERVED] = "Reserved",
@@ -132,11 +140,13 @@ static struct kobject edac_pci_kobj;
  * /sys/devices/system/edac/mc;
  *      data structures and methods
  */
+#if 0
 static ssize_t memctrl_string_show(void *ptr, char *buffer)
 {
         char *value = (char*) ptr;
         return sprintf(buffer, "%s\n", value);
 }
+#endif
 
 static ssize_t memctrl_int_show(void *ptr, char *buffer)
 {
@@ -207,7 +217,9 @@ struct memctrl_dev_attribute attr_##_name = {			\
 };
 
 /* cwrow<id> attribute f*/
+#if 0
 MEMCTRL_STRING_ATTR(mc_version,EDAC_MC_VERSION,S_IRUGO,memctrl_string_show,NULL);
+#endif
 
 /* csrow<id> control files */
 MEMCTRL_ATTR(panic_on_ue,S_IRUGO|S_IWUSR,memctrl_int_show,memctrl_int_store);
@@ -222,7 +234,6 @@ static struct memctrl_dev_attribute *memctrl_attr[] = {
         &attr_log_ue,
         &attr_log_ce,
         &attr_poll_msec,
-        &attr_mc_version,
         NULL,
 };
 
@@ -238,6 +249,7 @@ static struct kobj_type ktype_memctrl = {
         .default_attrs  = (struct attribute **) memctrl_attr,
 };
 
+#endif  /* DISABLE_EDAC_SYSFS */
 
 /* Initialize the main sysfs entries for edac:
  *   /sys/devices/system/edac
@@ -248,6 +260,11 @@ static struct kobj_type ktype_memctrl = {
  *         !0 FAILURE
  */
 static int edac_sysfs_memctrl_setup(void)
+#ifdef DISABLE_EDAC_SYSFS
+{
+        return 0;
+}
+#else
 {
         int err=0;
 
@@ -280,6 +297,7 @@ static int edac_sysfs_memctrl_setup(void)
 
         return err;
 }
+#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * MC teardown:
@@ -287,6 +305,7 @@ static int edac_sysfs_memctrl_setup(void)
  */
 static void edac_sysfs_memctrl_teardown(void)
 {
+#ifndef DISABLE_EDAC_SYSFS
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
         /* Unregister the MC's kobject */
@@ -297,8 +316,11 @@ static void edac_sysfs_memctrl_teardown(void)
 
         /* Unregister the 'edac' object */
         sysdev_class_unregister(&edac_class);
+#endif  /* DISABLE_EDAC_SYSFS */
 }
 
+#ifndef DISABLE_EDAC_SYSFS
+
 /*
  * /sys/devices/system/edac/pci;
  *      data structures and methods
@@ -309,6 +331,8 @@ struct list_control {
         int *count;
 };
 
+
+#if 0
 /* Output the list as:  vendor_id:device:id<,vendor_id:device_id> */
 static ssize_t edac_pci_list_string_show(void *ptr, char *buffer)
 {
@@ -430,6 +454,7 @@ static ssize_t edac_pci_list_string_store(void *ptr, const char *buffer,
         return count;
 }
 
+#endif
 static ssize_t edac_pci_int_show(void *ptr, char *buffer)
 {
         int *value = ptr;
@@ -498,6 +523,7 @@ struct edac_pci_dev_attribute edac_pci_attr_##_name = {		\
         .store  = _store,                                       \
 };
 
+#if 0
 static struct list_control pci_whitelist_control = {
         .list = pci_whitelist,
         .count = &pci_whitelist_count
@@ -520,6 +546,7 @@ EDAC_PCI_STRING_ATTR(pci_parity_blacklist,
         S_IRUGO|S_IWUSR,
         edac_pci_list_string_show,
         edac_pci_list_string_store);
+#endif
 
 /* PCI Parity control files */
 EDAC_PCI_ATTR(check_pci_parity,S_IRUGO|S_IWUSR,edac_pci_int_show,edac_pci_int_store);
@@ -531,8 +558,6 @@ static struct edac_pci_dev_attribute *edac_pci_attr[] = {
         &edac_pci_attr_check_pci_parity,
         &edac_pci_attr_panic_on_pci_parity,
         &edac_pci_attr_pci_parity_count,
-        &edac_pci_attr_pci_parity_whitelist,
-        &edac_pci_attr_pci_parity_blacklist,
         NULL,
 };
 
@@ -548,11 +573,18 @@ static struct kobj_type ktype_edac_pci = {
         .default_attrs  = (struct attribute **) edac_pci_attr,
 };
 
+#endif  /* DISABLE_EDAC_SYSFS */
+
 /**
  * edac_sysfs_pci_setup()
  *
  */
 static int edac_sysfs_pci_setup(void)
+#ifdef DISABLE_EDAC_SYSFS
+{
+        return 0;
+}
+#else
 {
         int err;
 
@@ -576,16 +608,20 @@ static int edac_sysfs_pci_setup(void)
         }
         return err;
 }
-
+#endif  /* DISABLE_EDAC_SYSFS */
 
 static void edac_sysfs_pci_teardown(void)
 {
+#ifndef DISABLE_EDAC_SYSFS
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
         kobject_unregister(&edac_pci_kobj);
         kobject_put(&edac_pci_kobj);
+#endif
 }
 
+#ifndef DISABLE_EDAC_SYSFS
+
 /* EDAC sysfs CSROW data structures and methods */
 
 /* Set of more detailed csrow<id> attribute show/store functions */
@@ -1039,6 +1075,8 @@ static struct kobj_type ktype_mci = {
         .default_attrs  = (struct attribute **) mci_attr,
 };
 
+#endif  /* DISABLE_EDAC_SYSFS */
+
 #define EDAC_DEVICE_SYMLINK     "device"
 
 /*
@@ -1050,6 +1088,11 @@ static struct kobj_type ktype_mci = {
  *      !0      Failure
  */
 static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+#ifdef DISABLE_EDAC_SYSFS
+{
+        return 0;
+}
+#else
 {
         int i;
         int err;
@@ -1118,12 +1161,14 @@ fail:
 
         return err;
 }
+#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * remove a Memory Controller instance
  */
 static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 {
+#ifndef DISABLE_EDAC_SYSFS
         int i;
 
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
@@ -1140,6 +1185,7 @@ static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 
         kobject_unregister(&mci->edac_mci_kobj);
         kobject_put(&mci->edac_mci_kobj);
+#endif  /* DISABLE_EDAC_SYSFS */
 }
 
 /* END OF sysfs data and methods */
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 8ed6ddbb9c5d..4652512f7d1a 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -39,7 +39,7 @@
 #include "dcdbas.h"
 
 #define DRIVER_NAME             "dcdbas"
-#define DRIVER_VERSION          "5.6.0-1"
+#define DRIVER_VERSION          "5.6.0-2"
 #define DRIVER_DESCRIPTION      "Dell Systems Management Base Driver"
 
 static struct platform_device *dcdbas_pdev;
@@ -581,9 +581,13 @@ static int __init dcdbas_init(void)
  */
 static void __exit dcdbas_exit(void)
 {
-        platform_device_unregister(dcdbas_pdev);
+        /*
+         * make sure functions that use dcdbas_pdev are called
+         * before platform_device_unregister
+         */
         unregister_reboot_notifier(&dcdbas_reboot_nb);
         smi_data_buf_free();
+        platform_device_unregister(dcdbas_pdev);
 }
 
 module_init(dcdbas_init);
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 19b1b0121726..ad6217467676 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -58,7 +58,7 @@ static unsigned int psmouse_resetafter = 5;
 module_param_named(resetafter, psmouse_resetafter, uint, 0644);
 MODULE_PARM_DESC(resetafter, "Reset device after so many bad packets (0 = never).");
 
-static unsigned int psmouse_resync_time = 5;
+static unsigned int psmouse_resync_time;
 module_param_named(resync_time, psmouse_resync_time, uint, 0644);
 MODULE_PARM_DESC(resync_time, "How long can mouse stay idle before forcing resync (in seconds, 0 = never).");
 
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index 6eb93e45fcd3..4a478eb0e27d 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -825,7 +825,7 @@ proc_get_info(char *page, char **start, off_t off,
         p += sprintf(p, "PMU driver version     : %d\n", PMU_DRIVER_VERSION);
         p += sprintf(p, "PMU firmware version   : %02x\n", pmu_version);
         p += sprintf(p, "AC Power               : %d\n",
-                ((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0));
+                ((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0) || pmu_battery_count == 0);
         p += sprintf(p, "Battery count          : %d\n", pmu_battery_count);
 
         return p - page;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d39f584cd8b3..5d88329e3c7a 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -306,6 +306,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
         r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
         int mirror, behind = test_bit(R1BIO_BehindIO, &r1_bio->state);
         conf_t *conf = mddev_to_conf(r1_bio->mddev);
+        struct bio *to_put = NULL;
 
         if (bio->bi_size)
                 return 1;
@@ -323,6 +324,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                  * this branch is our 'one mirror IO has finished' event handler:
                  */
                 r1_bio->bios[mirror] = NULL;
+                to_put = bio;
                 if (!uptodate) {
                         md_error(r1_bio->mddev, conf->mirrors[mirror].rdev);
                         /* an I/O failed, we can't clear the bitmap */
@@ -375,7 +377,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                         /* Don't dec_pending yet, we want to hold
                          * the reference over the retry
                          */
-                        return 0;
+                        goto out;
                 }
                 if (test_bit(R1BIO_BehindIO, &r1_bio->state)) {
                         /* free extra copy of the data pages */
@@ -392,10 +394,11 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                 raid_end_bio_io(r1_bio);
         }
 
-        if (r1_bio->bios[mirror]==NULL)
-                bio_put(bio);
-
         rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
+ out:
+        if (to_put)
+                bio_put(to_put);
+
         return 0;
 }
 
@@ -857,7 +860,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
         atomic_set(&r1_bio->remaining, 0);
         atomic_set(&r1_bio->behind_remaining, 0);
 
-        do_barriers = bio->bi_rw & BIO_RW_BARRIER;
+        do_barriers = bio_barrier(bio);
         if (do_barriers)
                 set_bit(R1BIO_Barrier, &r1_bio->state);
 
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 8416ceff524b..41715cacf926 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -1,7 +1,7 @@
 /*
     mxb - v4l2 driver for the Multimedia eXtension Board
     
-    Copyright (C) 1998-2003 Michael Hunold <michael@mihu.de>
+    Copyright (C) 1998-2006 Michael Hunold <michael@mihu.de>
 
     Visit http://www.mihu.de/linux/saa7146/mxb/
     for further details about this card.
@@ -327,6 +327,7 @@ static int mxb_init_done(struct saa7146_dev* dev)
         struct video_decoder_init init;
         struct i2c_msg msg;
         struct tuner_setup tun_setup;
+        v4l2_std_id std = V4L2_STD_PAL_BG;
 
         int i = 0, err = 0;
         struct  tea6415c_multiplex vm;  
@@ -361,6 +362,9 @@ static int mxb_init_done(struct saa7146_dev* dev)
         mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_FREQUENCY,
                                         &mxb->cur_freq);
 
+        /* set a default video standard */
+        mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
+
         /* mute audio on tea6420s */
         mxb->tea6420_1->driver->command(mxb->tea6420_1,TEA6420_SWITCH, &TEA6420_line[6][0]);
         mxb->tea6420_2->driver->command(mxb->tea6420_2,TEA6420_SWITCH, &TEA6420_line[6][1]);
@@ -921,17 +925,21 @@ static int std_callback(struct saa7146_dev* dev, struct saa7146_standard *std)
         int one = 1;
 
         if(V4L2_STD_PAL_I == std->id ) {
+                v4l2_std_id std = V4L2_STD_PAL_I;
                 DEB_D(("VIDIOC_S_STD: setting mxb for PAL_I.\n"));
                 /* set the 7146 gpio register -- I don't know what this does exactly */
                 saa7146_write(dev, GPIO_CTRL, 0x00404050);
                 /* unset the 7111 gpio register -- I don't know what this does exactly */
                 mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_SET_GPIO, &zero);
+                mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
         } else {
+                v4l2_std_id std = V4L2_STD_PAL_BG;
                 DEB_D(("VIDIOC_S_STD: setting mxb for PAL/NTSC/SECAM.\n"));
                 /* set the 7146 gpio register -- I don't know what this does exactly */
                 saa7146_write(dev, GPIO_CTRL, 0x00404050);
                 /* set the 7111 gpio register -- I don't know what this does exactly */
                 mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_SET_GPIO, &one);
+                mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
         }
         return 0;
 }
diff --git a/drivers/misc/ibmasm/ibmasm.h b/drivers/misc/ibmasm/ibmasm.h
index 1cef2387fa65..6aba41954448 100644
--- a/drivers/misc/ibmasm/ibmasm.h
+++ b/drivers/misc/ibmasm/ibmasm.h
@@ -101,15 +101,16 @@ struct command {
 static inline void command_put(struct command *cmd)
 {
         unsigned long flags;
+        spinlock_t *lock = cmd->lock;
 
-        spin_lock_irqsave(cmd->lock, flags);
-        kobject_put(&cmd->kobj);
-        spin_unlock_irqrestore(cmd->lock, flags);
+        spin_lock_irqsave(lock, flags);
+        kobject_put(&cmd->kobj);
+        spin_unlock_irqrestore(lock, flags);
 }
 
 static inline void command_get(struct command *cmd)
 {
-        kobject_get(&cmd->kobj);
+        kobject_get(&cmd->kobj);
 }
 
 
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 155737e7483f..a19480d07888 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -178,7 +178,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
                  * we're at a block boundary and need to erase the whole block.
                  */
                 pageaddr = instr->addr / priv->page_size;
-                do_block = (pageaddr & 0x7) == 0 && instr->len <= blocksize;
+                do_block = (pageaddr & 0x7) == 0 && instr->len >= blocksize;
                 pageaddr = pageaddr << priv->page_offset;
 
                 command[0] = do_block ? OP_ERASE_BLOCK : OP_ERASE_PAGE;
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 824e430486c2..830528dce0ca 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1574,6 +1574,7 @@ MODULE_LICENSE("GPL");
 
 static int __init el3_init_module(void)
 {
+        int ret = 0;
         el3_cards = 0;
 
         if (debug >= 0)
@@ -1589,14 +1590,16 @@ static int __init el3_init_module(void)
         }
 
 #ifdef CONFIG_EISA
-        if (eisa_driver_register (&el3_eisa_driver) < 0) {
-                eisa_driver_unregister (&el3_eisa_driver);
-        }
+        ret = eisa_driver_register(&el3_eisa_driver);
 #endif
 #ifdef CONFIG_MCA
-        mca_register_driver(&el3_mca_driver);
+        {
+                int err = mca_register_driver(&el3_mca_driver);
+                if (ret == 0)
+                        ret = err;
+        }
 #endif
-        return 0;
+        return ret;
 }
 
 static void __exit el3_cleanup_module(void)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index e45a8f959719..aa633fa95e64 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1087,7 +1087,8 @@ config NE2000
           without a specific driver are compatible with NE2000.
 
           If you have a PCI NE2000 card however, say N here and Y to "PCI
-          NE2000 support", above. If you have a NE2000 card and are running on
+          NE2000 and clone support" under "EISA, VLB, PCI and on board
+          controllers" below. If you have a NE2000 card and are running on
           an MCA system (a bus system used on some IBM PS/2 computers and
           laptops), say N here and Y to "NE/2 (ne2000 MCA version) support",
           below.
diff --git a/drivers/net/de620.c b/drivers/net/de620.c
index 0069f5fa973a..22fc5b869a60 100644
--- a/drivers/net/de620.c
+++ b/drivers/net/de620.c
@@ -1012,7 +1012,7 @@ static int __init read_eeprom(struct net_device *dev)
 #ifdef MODULE
 static struct net_device *de620_dev;
 
-int init_module(void)
+int __init init_module(void)
 {
         de620_dev = de620_probe(-1);
         if (IS_ERR(de620_dev))
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 430c628279b3..fb9dae302dcc 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -50,8 +50,8 @@
 
 */
 #define DRV_NAME        "D-Link DL2000-based linux driver"
-#define DRV_VERSION     "v1.17a"
-#define DRV_RELDATE     "2002/10/04"
+#define DRV_VERSION     "v1.17b"
+#define DRV_RELDATE     "2006/03/10"
 #include "dl2k.h"
 
 static char version[] __devinitdata =
@@ -765,7 +765,7 @@ rio_free_tx (struct net_device *dev, int irq)
                         break;
                 skb = np->tx_skbuff[entry];
                 pci_unmap_single (np->pdev,
-                                  np->tx_ring[entry].fraginfo,
+                                  np->tx_ring[entry].fraginfo & 0xffffffffffff,
                                   skb->len, PCI_DMA_TODEVICE);
                 if (irq)
                         dev_kfree_skb_irq (skb);
@@ -892,14 +892,16 @@ receive_packet (struct net_device *dev)
 
                         /* Small skbuffs for short packets */
                         if (pkt_len > copy_thresh) {
-                                pci_unmap_single (np->pdev, desc->fraginfo,
+                                pci_unmap_single (np->pdev,
+                                                  desc->fraginfo & 0xffffffffffff,
                                                   np->rx_buf_sz,
                                                   PCI_DMA_FROMDEVICE);
                                 skb_put (skb = np->rx_skbuff[entry], pkt_len);
                                 np->rx_skbuff[entry] = NULL;
                         } else if ((skb = dev_alloc_skb (pkt_len + 2)) != NULL) {
                                 pci_dma_sync_single_for_cpu(np->pdev,
-                                                            desc->fraginfo,
+                                                            desc->fraginfo & 
+                                                                0xffffffffffff,
                                                             np->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
                                 skb->dev = dev;
@@ -910,7 +912,8 @@ receive_packet (struct net_device *dev)
                                                   pkt_len, 0);
                                 skb_put (skb, pkt_len);
                                 pci_dma_sync_single_for_device(np->pdev,
-                                                               desc->fraginfo,
+                                                               desc->fraginfo &
+                                                                 0xffffffffffff,
                                                                np->rx_buf_sz,
                                                                PCI_DMA_FROMDEVICE);
                         }
@@ -1796,8 +1799,9 @@ rio_close (struct net_device *dev)
                 np->rx_ring[i].fraginfo = 0;
                 skb = np->rx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single (np->pdev, np->rx_ring[i].fraginfo,
-                                          skb->len, PCI_DMA_FROMDEVICE);
+                        pci_unmap_single(np->pdev, 
+                                         np->rx_ring[i].fraginfo & 0xffffffffffff,
+                                         skb->len, PCI_DMA_FROMDEVICE);
                         dev_kfree_skb (skb);
                         np->rx_skbuff[i] = NULL;
                 }
@@ -1805,8 +1809,9 @@ rio_close (struct net_device *dev)
         for (i = 0; i < TX_RING_SIZE; i++) {
                 skb = np->tx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single (np->pdev, np->tx_ring[i].fraginfo,
-                                          skb->len, PCI_DMA_TODEVICE);
+                        pci_unmap_single(np->pdev, 
+                                         np->tx_ring[i].fraginfo & 0xffffffffffff,
+                                         skb->len, PCI_DMA_TODEVICE);
                         dev_kfree_skb (skb);
                         np->tx_skbuff[i] = NULL;
                 }
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5b7d0f425af2..4c4db96d0b7b 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -2917,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                         if (!__pskb_pull_tail(skb, pull_size)) {
                                 printk(KERN_ERR "__pskb_pull_tail failed.\n");
                                 dev_kfree_skb_any(skb);
-                                return -EFAULT;
+                                return NETDEV_TX_OK;
                         }
                         len = skb->len - skb->data_len;
                 }
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 72c1630977d6..73260364cba3 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -74,7 +74,7 @@
 #define TX_RING_SIZE            512
 #define TX_DEF_PENDING          (TX_RING_SIZE - 1)
 #define TX_MIN_PENDING          64
-#define MAX_SKB_TX_LE           (4 + 2*MAX_SKB_FRAGS)
+#define MAX_SKB_TX_LE           (4 + (sizeof(dma_addr_t)/sizeof(u32))*MAX_SKB_FRAGS)
 
 #define STATUS_RING_SIZE        2048    /* 2 ports * (TX + 2*RX) */
 #define STATUS_LE_BYTES         (STATUS_RING_SIZE*sizeof(struct sky2_status_le))
@@ -622,8 +622,8 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
 
         /* Configure Rx MAC FIFO */
         sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_CLR);
-        sky2_write16(hw, SK_REG(port, RX_GMF_CTRL_T),
-                     GMF_RX_CTRL_DEF);
+        sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T),
+                     GMF_OPER_ON | GMF_RX_F_FL_ON);
 
         /* Flush Rx MAC FIFO on any flow control or error */
         sky2_write16(hw, SK_REG(port, RX_GMF_FL_MSK), GMR_FS_ANY_ERR);
@@ -995,6 +995,10 @@ static int sky2_rx_start(struct sky2_port *sky2)
                 sky2_rx_add(sky2, re->mapaddr);
         }
 
+        /* Truncate oversize frames */
+        sky2_write16(hw, SK_REG(sky2->port, RX_GMF_TR_THR), sky2->rx_bufsize - 8);
+        sky2_write32(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), RX_TRUNC_ON);
+
         /* Tell chip about available buffers */
         sky2_write16(hw, Y2_QADDR(rxq, PREF_UNIT_PUT_IDX), sky2->rx_put);
         sky2->rx_last_put = sky2_read16(hw, Y2_QADDR(rxq, PREF_UNIT_PUT_IDX));
@@ -1145,6 +1149,7 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         struct sky2_tx_le *le = NULL;
         struct tx_ring_info *re;
         unsigned i, len;
+        int avail;
         dma_addr_t mapping;
         u32 addr64;
         u16 mss;
@@ -1287,12 +1292,16 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         re->idx = sky2->tx_prod;
         le->ctrl |= EOP;
 
+        avail = tx_avail(sky2);
+        if (mss != 0 || avail < TX_MIN_PENDING) {
+                le->ctrl |= FRC_STAT;
+                if (avail <= MAX_SKB_TX_LE)
+                        netif_stop_queue(dev);
+        }
+
         sky2_put_idx(hw, txqaddr[sky2->port], sky2->tx_prod,
                      &sky2->tx_last_put, TX_RING_SIZE);
 
-        if (tx_avail(sky2) <= MAX_SKB_TX_LE)
-                netif_stop_queue(dev);
-
 out_unlock:
         spin_unlock(&sky2->tx_lock);
 
@@ -1707,10 +1716,12 @@ static void sky2_tx_timeout(struct net_device *dev)
 
 
 #define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
-/* Want receive buffer size to be multiple of 64 bits, and incl room for vlan */
+/* Want receive buffer size to be multiple of 64 bits
+ * and incl room for vlan and truncation
+ */
 static inline unsigned sky2_buf_size(int mtu)
 {
-        return roundup(mtu + ETH_HLEN + 4, 8);
+        return roundup(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
 }
 
 static int sky2_change_mtu(struct net_device *dev, int new_mtu)
@@ -1793,7 +1804,7 @@ static struct sk_buff *sky2_receive(struct sky2_port *sky2,
         if (!(status & GMR_FS_RX_OK))
                 goto resubmit;
 
-        if ((status >> 16) != length || length > sky2->rx_bufsize)
+        if (length > sky2->netdev->mtu + ETH_HLEN)
                 goto oversize;
 
         if (length < copybreak) {
@@ -3243,8 +3254,7 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
                 }
         }
 
-        err = request_irq(pdev->irq, sky2_intr, SA_SHIRQ | SA_SAMPLE_RANDOM,
-                          DRV_NAME, hw);
+        err = request_irq(pdev->irq, sky2_intr, SA_SHIRQ, DRV_NAME, hw);
         if (err) {
                 printk(KERN_ERR PFX "%s: cannot assign irq %d\n",
                        pci_name(pdev), pdev->irq);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 15545620ab0e..b8f1524da557 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -10543,8 +10543,6 @@ static char * __devinit tg3_bus_string(struct tg3 *tp, char *str)
                         strcat(str, "66MHz");
                 else if (clock_ctrl == 6)
                         strcat(str, "100MHz");
-                else if (clock_ctrl == 7)
-                        strcat(str, "133MHz");
         } else {
                 strcpy(str, "PCI:");
                 if (tp->tg3_flags & TG3_FLAG_PCI_HIGH_SPEED)
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index d7fb3ffe06ac..2d0cfbceee22 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1362,7 +1362,6 @@ static int de_open (struct net_device *dev)
 {
         struct de_private *de = dev->priv;
         int rc;
-        unsigned long flags;
 
         if (netif_msg_ifup(de))
                 printk(KERN_DEBUG "%s: enabling interface\n", dev->name);
@@ -1376,18 +1375,20 @@ static int de_open (struct net_device *dev)
                 return rc;
         }
 
-        rc = de_init_hw(de);
-        if (rc) {
-                printk(KERN_ERR "%s: h/w init failure, err=%d\n",
-                       dev->name, rc);
-                goto err_out_free;
-        }
+        dw32(IntrMask, 0);
 
         rc = request_irq(dev->irq, de_interrupt, SA_SHIRQ, dev->name, dev);
         if (rc) {
                 printk(KERN_ERR "%s: IRQ %d request failure, err=%d\n",
                        dev->name, dev->irq, rc);
-                goto err_out_hw;
+                goto err_out_free;
+        }
+
+        rc = de_init_hw(de);
+        if (rc) {
+                printk(KERN_ERR "%s: h/w init failure, err=%d\n",
+                       dev->name, rc);
+                goto err_out_free_irq;
         }
 
         netif_start_queue(dev);
@@ -1395,11 +1396,8 @@ static int de_open (struct net_device *dev)
 
         return 0;
 
-err_out_hw:
-        spin_lock_irqsave(&de->lock, flags);
-        de_stop_hw(de);
-        spin_unlock_irqrestore(&de->lock, flags);
-
+err_out_free_irq:
+        free_irq(dev->irq, dev);
 err_out_free:
         de_free_rings(de);
         return rc;
@@ -1455,6 +1453,8 @@ static void de_tx_timeout (struct net_device *dev)
         synchronize_irq(dev->irq);
         de_clean_rings(de);
 
+        de_init_rings(de);
+
         de_init_hw(de);
         
         netif_wake_queue(dev);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 50b8c6754b1e..a1ed2d983740 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -249,8 +249,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv,
 
         if (align)
                 skb_reserve(skb, align);
-        if (memcpy_fromiovec(skb_put(skb, len), iv, len))
+        if (memcpy_fromiovec(skb_put(skb, len), iv, len)) {
+                tun->stats.rx_dropped++;
+                kfree_skb(skb);
                 return -EFAULT;
+        }
 
         skb->dev = tun->dev;
         switch (tun->flags & TUN_TYPE_MASK) {
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 54ad93daca3c..bb96ce1db08c 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -411,7 +411,7 @@ static int pcmcia_device_probe(struct device * dev)
          * pseudo devices, and if not, add the second one.
          */
         did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
-        if ((did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
+        if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
                 pcmcia_add_pseudo_device(p_dev->socket);
 
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 4c1acc8daa82..1aa3c261718a 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -94,7 +94,7 @@ dasd_devices_show(struct seq_file *m, void *v)
                 seq_printf(m, "basic");
                 break;
         case DASD_STATE_UNFMT:
-                seq_printf(m, "unnformatted");
+                seq_printf(m, "unformatted");
                 break;
         case DASD_STATE_READY:
         case DASD_STATE_ONLINE:
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 1bbf231f8aaf..3c77d65960db 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -409,6 +409,9 @@ __init_channel_subsystem(struct subchannel_id schid, void *data)
                 /* -ENXIO: no more subchannels. */
                 case -ENXIO:
                         return ret;
+                /* -EIO: this subchannel set not supported. */
+                case -EIO:
+                        return ret;
                 default:
                         return 0;
                 }
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 7f551d66f47f..6eba56cd89ba 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -664,6 +664,7 @@ do { \
 #define ZFCP_STATUS_UNIT_TEMPORARY              0x00000002
 #define ZFCP_STATUS_UNIT_SHARED                 0x00000004
 #define ZFCP_STATUS_UNIT_READONLY               0x00000008
+#define ZFCP_STATUS_UNIT_REGISTERED             0x00000010
 
 /* FSF request status (this does not have a common part) */
 #define ZFCP_STATUS_FSFREQ_NOT_INIT             0x00000000
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index e3c4bdd29a60..57cb628a05aa 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -3391,10 +3391,13 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
                     && (!atomic_test_mask(ZFCP_STATUS_UNIT_TEMPORARY,
                                           &unit->status))
                     && !unit->device
-                    && port->rport)
-                        scsi_add_device(port->adapter->scsi_host, 0,
-                                        port->rport->scsi_target_id,
-                                        unit->scsi_lun);
+                    && port->rport) {
+                        atomic_set_mask(ZFCP_STATUS_UNIT_REGISTERED,
+                                        &unit->status);
+                        scsi_scan_target(&port->rport->dev, 0,
+                                         port->rport->scsi_target_id,
+                                         unit->scsi_lun, 0);
+                }
                 zfcp_unit_put(unit);
                 break;
         case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 9f6b4d7a46f3..9e6d07d7b3c8 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -68,7 +68,7 @@ struct zfcp_data zfcp_data = {
               eh_host_reset_handler:   zfcp_scsi_eh_host_reset_handler,
                                        /* FIXME(openfcp): Tune */
               can_queue:               4096,
-              this_id:                 0,
+              this_id:                 -1,
               /*
                * FIXME:
                * one less? can zfcp_create_sbale cope with it?
@@ -183,7 +183,8 @@ zfcp_scsi_slave_alloc(struct scsi_device *sdp)
 
         read_lock_irqsave(&zfcp_data.config_lock, flags);
         unit = zfcp_unit_lookup(adapter, sdp->channel, sdp->id, sdp->lun);
-        if (unit) {
+        if (unit && atomic_test_mask(ZFCP_STATUS_UNIT_REGISTERED,
+                                     &unit->status)) {
                 sdp->hostdata = unit;
                 unit->device = sdp;
                 zfcp_unit_get(unit);
@@ -208,6 +209,7 @@ zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
         struct zfcp_unit *unit = (struct zfcp_unit *) sdpnt->hostdata;
 
         if (unit) {
+                atomic_clear_mask(ZFCP_STATUS_UNIT_REGISTERED, &unit->status);
                 sdpnt->hostdata = NULL;
                 unit->device = NULL;
                 zfcp_unit_put(unit);
@@ -291,7 +293,7 @@ zfcp_scsi_command_async(struct zfcp_adapter *adapter, struct zfcp_unit *unit,
                                "on port 0x%016Lx in recovery\n",
                                zfcp_get_busid_by_unit(unit),
                                unit->fcp_lun, unit->port->wwpn);
-                retval = SCSI_MLQUEUE_DEVICE_BUSY;
+                zfcp_scsi_command_fail(scpnt, DID_NO_CONNECT);
                 goto out;
         }
 
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index a800fb51168b..559ff7aae3f1 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -742,23 +742,17 @@ static irqreturn_t ahci_interrupt (int irq, void *dev_instance, struct pt_regs *
                         struct ata_queued_cmd *qc;
                         qc = ata_qc_from_tag(ap, ap->active_tag);
                         if (!ahci_host_intr(ap, qc))
-                                if (ata_ratelimit()) {
-                                        struct pci_dev *pdev =
-                                                to_pci_dev(ap->host_set->dev);
-                                        dev_printk(KERN_WARNING, &pdev->dev,
+                                if (ata_ratelimit())
+                                        dev_printk(KERN_WARNING, host_set->dev,
                                           "unhandled interrupt on port %u\n",
                                           i);
-                                }
 
                         VPRINTK("port %u\n", i);
                 } else {
                         VPRINTK("port %u (no irq)\n", i);
-                        if (ata_ratelimit()) {
-                                struct pci_dev *pdev =
-                                        to_pci_dev(ap->host_set->dev);
-                                dev_printk(KERN_WARNING, &pdev->dev,
+                        if (ata_ratelimit())
+                                dev_printk(KERN_WARNING, host_set->dev,
                                         "interrupt on disabled port %u\n", i);
-                        }
                 }
 
                 irq_ack |= (1 << i);
diff --git a/drivers/scsi/pcmcia/Kconfig b/drivers/scsi/pcmcia/Kconfig
index df52190f4d94..eac8e179cfff 100644
--- a/drivers/scsi/pcmcia/Kconfig
+++ b/drivers/scsi/pcmcia/Kconfig
@@ -8,6 +8,7 @@ menu "PCMCIA SCSI adapter support"
 config PCMCIA_AHA152X
         tristate "Adaptec AHA152X PCMCIA support"
         depends on m && !64BIT
+        select SCSI_SPI_ATTRS
         help
           Say Y here if you intend to attach this type of PCMCIA SCSI host
           adapter to your computer.
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index f01ec0a7c506..84c3937ae8fb 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -126,6 +126,7 @@ static struct {
         {"ADAPTEC", "Adaptec 5400S", NULL, BLIST_FORCELUN},
         {"AFT PRO", "-IX CF", "0.0>", BLIST_FORCELUN},
         {"BELKIN", "USB 2 HS-CF", "1.95",  BLIST_FORCELUN | BLIST_INQUIRY_36},
+        {"BROWNIE", "1600U3P", NULL, BLIST_NOREPORTLUN},
         {"CANON", "IPUBJD", NULL, BLIST_SPARSELUN},
         {"CBOX3", "USB Storage-SMC", "300A", BLIST_FORCELUN | BLIST_INQUIRY_36},
         {"CMD", "CRA-7280", NULL, BLIST_SPARSELUN},     /* CMD RAID Controller */
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 929032e370db..13ea64119b73 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -223,7 +223,7 @@ static void fc_rport_terminate(struct fc_rport  *rport);
  */
 #define FC_STARGET_NUM_ATTRS    3
 #define FC_RPORT_NUM_ATTRS      9
-#define FC_HOST_NUM_ATTRS       16
+#define FC_HOST_NUM_ATTRS       17
 
 struct fc_internal {
         struct scsi_transport_template t;
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index f3763d2ccb86..a37579ce6d76 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2301,7 +2301,6 @@ static void receive_chars(struct uart_port *the_port)
         int read_count, request_count = IOC4_MAX_CHARS;
         struct uart_icount *icount;
         struct uart_info *info = the_port->info;
-        int flip = 0;
         unsigned long pflags;
 
         /* Make sure all the pointers are "good" ones */
@@ -2313,7 +2312,7 @@ static void receive_chars(struct uart_port *the_port)
         spin_lock_irqsave(&the_port->lock, pflags);
         tty = info->tty;
 
-        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS - 2);
+        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS);
 
         if (request_count > 0) {
                 icount = &the_port->icount;
@@ -2326,8 +2325,7 @@ static void receive_chars(struct uart_port *the_port)
 
         spin_unlock_irqrestore(&the_port->lock, pflags);
 
-        if (flip)
-                tty_flip_buffer_push(tty);
+        tty_flip_buffer_push(tty);
 }
 
 /**
diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index df8e5667b348..466042808daf 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -253,7 +253,7 @@ static void arcfb_lcd_update_page(struct arcfb_par *par, unsigned int upper,
 {
         unsigned char *src;
         unsigned int xindex, yindex, chipindex, linesize;
-        int i, count;
+        int i;
         unsigned char val;
         unsigned char bitmask, rightshift;
 
@@ -282,7 +282,6 @@ static void arcfb_lcd_update_page(struct arcfb_par *par, unsigned int upper,
                 }
                 ks108_writeb_data(par, chipindex, val);
                 left++;
-                count++;
                 if (bitmask == 0x80) {
                         bitmask = 1;
                         src++;
@@ -460,11 +459,11 @@ static ssize_t arcfb_write(struct file *file, const char __user *buf, size_t cou
         inode = file->f_dentry->d_inode;
         fbidx = iminor(inode);
         info = registered_fb[fbidx];
-        par = info->par;
 
         if (!info || !info->screen_base)
                 return -ENODEV;
 
+        par = info->par;
         xres = info->var.xres;
         fbmemlength = (xres * info->var.yres)/8;
 
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index bfc8a93b2c73..620c9a934e0e 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1326,7 +1326,7 @@ static int aty128_var_to_pll(u32 period_in_ps, struct aty128_pll *pll,
         unsigned char post_dividers[] = {1,2,4,8,3,6,12};
         u32 output_freq;
         u32 vclk;        /* in .01 MHz */
-        int i;
+        int i = 0;
         u32 n, d;
 
         vclk = 100000000 / period_in_ps;        /* convert units to 10 kHz */
@@ -1340,15 +1340,16 @@ static int aty128_var_to_pll(u32 period_in_ps, struct aty128_pll *pll,
         /* now, find an acceptable divider */
         for (i = 0; i < sizeof(post_dividers); i++) {
                 output_freq = post_dividers[i] * vclk;
-                if (output_freq >= c.ppll_min && output_freq <= c.ppll_max)
+                if (output_freq >= c.ppll_min && output_freq <= c.ppll_max) {
+                        pll->post_divider = post_dividers[i];
                         break;
+                }
         }
 
         /* calculate feedback divider */
         n = c.ref_divider * output_freq;
         d = c.ref_clk;
 
-        pll->post_divider = post_dividers[i];
         pll->feedback_divider = round_div(n, d);
         pll->vclk = vclk;
 
diff --git a/drivers/video/aty/radeon_monitor.c b/drivers/video/aty/radeon_monitor.c
index 7f9838dceab5..98c05bc0de44 100644
--- a/drivers/video/aty/radeon_monitor.c
+++ b/drivers/video/aty/radeon_monitor.c
@@ -396,6 +396,10 @@ static int __devinit radeon_parse_monitor_layout(struct radeonfb_info *rinfo,
                                 s1[i] = *s;
                         i++;
                 }
+
+                if (i > 4)
+                        i = 4;
+
         } while (*s++);
         if (second)
                 s2[i] = 0;
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index bd39bbd88d41..151fda8dded0 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -172,7 +172,7 @@ struct backlight_device *backlight_device_register(const char *name, void *devda
 
         new_bd = kmalloc(sizeof(struct backlight_device), GFP_KERNEL);
         if (unlikely(!new_bd))
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
 
         init_MUTEX(&new_bd->sem);
         new_bd->props = bp;
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index 9e32485ee7bb..86908a60c630 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -171,7 +171,7 @@ struct lcd_device *lcd_device_register(const char *name, void *devdata,
 
         new_ld = kmalloc(sizeof(struct lcd_device), GFP_KERNEL);
         if (unlikely(!new_ld))
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
 
         init_MUTEX(&new_ld->sem);
         new_ld->props = lp;
diff --git a/drivers/video/imsttfb.c b/drivers/video/imsttfb.c
index ad416ae47596..7db42542eb19 100644
--- a/drivers/video/imsttfb.c
+++ b/drivers/video/imsttfb.c
@@ -1510,6 +1510,8 @@ imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 default:
                         printk(KERN_INFO "imsttfb: Device 0x%x unknown, "
                                          "contact maintainer.\n", pdev->device);
+                        release_mem_region(addr, size);
+                        framebuffer_release(info);
                         return -ENODEV;
         }
 
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 6b8bd3cdf9c0..995b47c165a7 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
         if (regno > 255)
                 return 1;
 
-        switch (dinfo->depth) {
-        case 8:
-                {
-                        red >>= 8;
-                        green >>= 8;
-                        blue >>= 8;
+        if (dinfo->depth == 8) {
+                red >>= 8;
+                green >>= 8;
+                blue >>= 8;
+
+                intelfbhw_setcolreg(dinfo, regno, red, green, blue,
+                                    transp);
+        }
 
-                        intelfbhw_setcolreg(dinfo, regno, red, green, blue,
-                                            transp);
+        if (regno < 16) {
+                switch (dinfo->depth) {
+                case 15:
+                        dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
+                                ((green & 0xf800) >>  6) |
+                                ((blue & 0xf800) >> 11);
+                        break;
+                case 16:
+                        dinfo->pseudo_palette[regno] = (red & 0xf800) |
+                                ((green & 0xfc00) >>  5) |
+                                ((blue  & 0xf800) >> 11);
+                        break;
+                case 24:
+                        dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
+                                (green & 0xff00) |
+                                ((blue  & 0xff00) >> 8);
+                        break;
                 }
-                break;
-        case 15:
-                dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
-                                               ((green & 0xf800) >>  6) |
-                                               ((blue & 0xf800) >> 11);
-                break;
-        case 16:
-                dinfo->pseudo_palette[regno] = (red & 0xf800) |
-                                               ((green & 0xfc00) >>  5) |
-                                               ((blue  & 0xf800) >> 11);
-                break;
-        case 24:
-                dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
-                                               (green & 0xff00) |
-                                               ((blue  & 0xff00) >> 8);
-                break;
         }
+
         return 0;
 }
 
diff --git a/drivers/video/kyro/STG4000VTG.c b/drivers/video/kyro/STG4000VTG.c
index 3690b04190af..bd389709d234 100644
--- a/drivers/video/kyro/STG4000VTG.c
+++ b/drivers/video/kyro/STG4000VTG.c
@@ -17,7 +17,7 @@
 void DisableVGA(volatile STG4000REG __iomem *pSTGReg)
 {
         u32 tmp;
-        volatile u32 count, i;
+        volatile u32 count = 0, i;
 
         /* Reset the VGA registers */
         tmp = STG_READ_REG(SoftwareReset);
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index a2e201dc40f7..b961d5601bd9 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -486,10 +486,8 @@ static void vgaHWRestore(const struct fb_info *info,
 static inline int neo2200_sync(struct fb_info *info)
 {
         struct neofb_par *par = info->par;
-        int waitcycles;
 
-        while (readl(&par->neo2200->bltStat) & 1)
-                waitcycles++;
+        while (readl(&par->neo2200->bltStat) & 1);
         return 0;
 }
 
diff --git a/drivers/video/s1d13xxxfb.c b/drivers/video/s1d13xxxfb.c
index e5d0f92eeae3..feec47bdd479 100644
--- a/drivers/video/s1d13xxxfb.c
+++ b/drivers/video/s1d13xxxfb.c
@@ -588,6 +588,7 @@ s1d13xxxfb_probe(struct platform_device *pdev)
                 goto bail;
         }
 
+        platform_set_drvdata(pdev, info);
         default_par = info->par;
         default_par->regs = ioremap_nocache(pdev->resource[1].start,
                         pdev->resource[1].end - pdev->resource[1].start +1);
@@ -638,8 +639,6 @@ s1d13xxxfb_probe(struct platform_device *pdev)
                 goto bail;
         }
 
-        platform_set_drvdata(pdev, info);
-
         printk(KERN_INFO "fb%d: %s frame buffer device\n",
                info->node, info->fix.id);
 
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index ab727eaa7f43..10e6b3aab9ea 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -2021,8 +2021,8 @@ static int __devinit savagefb_probe (struct pci_dev* dev,
 #if defined(CONFIG_FB_SAVAGE_I2C)
         savagefb_create_i2c_busses(info);
         savagefb_probe_i2c_connector(info, &par->edid);
-        kfree(par->edid);
         fb_edid_to_monspecs(par->edid, &info->monspecs);
+        kfree(par->edid);
         fb_videomode_to_modelist(info->monspecs.modedb,
                                  info->monspecs.modedb_len,
                                  &info->modelist);
diff --git a/drivers/video/tdfxfb.c b/drivers/video/tdfxfb.c
index 3e7baf4c9fa8..5e5328d682db 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/tdfxfb.c
@@ -786,28 +786,32 @@ static int tdfxfb_setcolreg(unsigned regno, unsigned red, unsigned green,
         if (regno >= info->cmap.len || regno > 255) return 1;
    
         switch (info->fix.visual) {
-                case FB_VISUAL_PSEUDOCOLOR:
-                        rgbcol =(((u32)red   & 0xff00) << 8) |
-                                (((u32)green & 0xff00) << 0) |
-                                (((u32)blue  & 0xff00) >> 8);
-                        do_setpalentry(par, regno, rgbcol);
-                        break;
-                /* Truecolor has no hardware color palettes. */
-                case FB_VISUAL_TRUECOLOR:
+        case FB_VISUAL_PSEUDOCOLOR:
+                rgbcol =(((u32)red   & 0xff00) << 8) |
+                        (((u32)green & 0xff00) << 0) |
+                        (((u32)blue  & 0xff00) >> 8);
+                do_setpalentry(par, regno, rgbcol);
+                break;
+        /* Truecolor has no hardware color palettes. */
+        case FB_VISUAL_TRUECOLOR:
+                if (regno < 16) {
                         rgbcol = (CNVT_TOHW( red, info->var.red.length) <<
                                   info->var.red.offset) |
-                                 (CNVT_TOHW( green, info->var.green.length) <<
-                                  info->var.green.offset) |
-                                 (CNVT_TOHW( blue, info->var.blue.length) <<
-                                  info->var.blue.offset) |
-                                 (CNVT_TOHW( transp, info->var.transp.length) <<
-                                  info->var.transp.offset);
-                                par->palette[regno] = rgbcol;
-                        break;
-                default:
-                        DPRINTK("bad depth %u\n", info->var.bits_per_pixel);
-                        break;
+                                (CNVT_TOHW( green, info->var.green.length) <<
+                                 info->var.green.offset) |
+                                (CNVT_TOHW( blue, info->var.blue.length) <<
+                                 info->var.blue.offset) |
+                                (CNVT_TOHW( transp, info->var.transp.length) <<
+                                 info->var.transp.offset);
+                        par->palette[regno] = rgbcol;
+                }
+
+                break;
+        default:
+                DPRINTK("bad depth %u\n", info->var.bits_per_pixel);
+                break;
         }
+
         return 0;
 }
 
diff --git a/fs/buffer.c b/fs/buffer.c
index 62cfd17dc5fe..a9b399402007 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3060,6 +3060,7 @@ int buffer_migrate_page(struct page *newpage, struct page *page)
 {
         struct address_space *mapping = page->mapping;
         struct buffer_head *bh, *head;
+        int rc;
 
         if (!mapping)
                 return -EAGAIN;
@@ -3069,8 +3070,9 @@ int buffer_migrate_page(struct page *newpage, struct page *page)
 
         head = page_buffers(page);
 
-        if (migrate_page_remove_references(newpage, page, 3))
-                return -EAGAIN;
+        rc = migrate_page_remove_references(newpage, page, 3);
+        if (rc)
+                return rc;
 
         bh = head;
         do {
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 848044af7e16..27f3e787faca 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1155,15 +1155,16 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode,
  * For writes, i_mutex is not held on entry; it is never taken.
  *
  * DIO_LOCKING (simple locking for regular files)
- * For writes we are called under i_mutex and return with i_mutex held, even though
- * it is internally dropped.
+ * For writes we are called under i_mutex and return with i_mutex held, even
+ * though it is internally dropped.
  * For reads, i_mutex is not held on entry, but it is taken and dropped before
  * returning.
  *
  * DIO_OWN_LOCKING (filesystem provides synchronisation and handling of
  *      uninitialised data, allowing parallel direct readers and writers)
  * For writes we are called without i_mutex, return without it, never touch it.
- * For reads, i_mutex is held on entry and will be released before returning.
+ * For reads we are called under i_mutex and return with i_mutex held, even
+ * though it may be internally dropped.
  *
  * Additional i_alloc_sem locking requirements described inline below.
  */
@@ -1182,7 +1183,8 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         ssize_t retval = -EINVAL;
         loff_t end = offset;
         struct dio *dio;
-        int reader_with_isem = (rw == READ && dio_lock_type == DIO_OWN_LOCKING);
+        int release_i_mutex = 0;
+        int acquire_i_mutex = 0;
 
         if (rw & WRITE)
                 current->flags |= PF_SYNCWRITE;
@@ -1225,7 +1227,6 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
          *      writers need to grab i_alloc_sem only (i_mutex is already held)
          * For regular files using DIO_OWN_LOCKING,
          *      neither readers nor writers take any locks here
-         *      (i_mutex is already held and release for writers here)
          */
         dio->lock_type = dio_lock_type;
         if (dio_lock_type != DIO_NO_LOCKING) {
@@ -1236,7 +1237,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                         mapping = iocb->ki_filp->f_mapping;
                         if (dio_lock_type != DIO_OWN_LOCKING) {
                                 mutex_lock(&inode->i_mutex);
-                                reader_with_isem = 1;
+                                release_i_mutex = 1;
                         }
 
                         retval = filemap_write_and_wait_range(mapping, offset,
@@ -1248,7 +1249,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 
                         if (dio_lock_type == DIO_OWN_LOCKING) {
                                 mutex_unlock(&inode->i_mutex);
-                                reader_with_isem = 0;
+                                acquire_i_mutex = 1;
                         }
                 }
 
@@ -1269,11 +1270,13 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                                 nr_segs, blkbits, get_blocks, end_io, dio);
 
         if (rw == READ && dio_lock_type == DIO_LOCKING)
-                reader_with_isem = 0;
+                release_i_mutex = 0;
 
 out:
-        if (reader_with_isem)
+        if (release_i_mutex)
                 mutex_unlock(&inode->i_mutex);
+        else if (acquire_i_mutex)
+                mutex_lock(&inode->i_mutex);
         if (rw & WRITE)
                 current->flags &= ~PF_SYNCWRITE;
         return retval;
diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
index 7442bdd1267a..b3dbd716cd3a 100644
--- a/fs/ext2/dir.c
+++ b/fs/ext2/dir.c
@@ -256,11 +256,10 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
         unsigned long npages = dir_pages(inode);
         unsigned chunk_mask = ~(ext2_chunk_size(inode)-1);
         unsigned char *types = NULL;
-        int need_revalidate = (filp->f_version != inode->i_version);
-        int ret;
+        int need_revalidate = filp->f_version != inode->i_version;
 
         if (pos > inode->i_size - EXT2_DIR_REC_LEN(1))
-                goto success;
+                return 0;
 
         if (EXT2_HAS_INCOMPAT_FEATURE(sb, EXT2_FEATURE_INCOMPAT_FILETYPE))
                 types = ext2_filetype_table;
@@ -275,12 +274,15 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                                    "bad page in #%lu",
                                    inode->i_ino);
                         filp->f_pos += PAGE_CACHE_SIZE - offset;
-                        ret = -EIO;
-                        goto done;
+                        return -EIO;
                 }
                 kaddr = page_address(page);
-                if (need_revalidate) {
-                        offset = ext2_validate_entry(kaddr, offset, chunk_mask);
+                if (unlikely(need_revalidate)) {
+                        if (offset) {
+                                offset = ext2_validate_entry(kaddr, offset, chunk_mask);
+                                filp->f_pos = (n<<PAGE_CACHE_SHIFT) + offset;
+                        }
+                        filp->f_version = inode->i_version;
                         need_revalidate = 0;
                 }
                 de = (ext2_dirent *)(kaddr+offset);
@@ -289,9 +291,8 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                         if (de->rec_len == 0) {
                                 ext2_error(sb, __FUNCTION__,
                                         "zero-length directory entry");
-                                ret = -EIO;
                                 ext2_put_page(page);
-                                goto done;
+                                return -EIO;
                         }
                         if (de->inode) {
                                 int over;
@@ -306,19 +307,14 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                                                 le32_to_cpu(de->inode), d_type);
                                 if (over) {
                                         ext2_put_page(page);
-                                        goto success;
+                                        return 0;
                                 }
                         }
                         filp->f_pos += le16_to_cpu(de->rec_len);
                 }
                 ext2_put_page(page);
         }
-
-success:
-        ret = 0;
-done:
-        filp->f_version = inode->i_version;
-        return ret;
+        return 0;
 }
 
 /*
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 3fc4238e9703..0384e539b88f 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1624,15 +1624,14 @@ static int ext3_block_truncate_page(handle_t *handle, struct page *page,
          * For "nobh" option,  we can only work if we don't need to
          * read-in the page - otherwise we create buffers to do the IO.
          */
-        if (!page_has_buffers(page) && test_opt(inode->i_sb, NOBH)) {
-                if (PageUptodate(page)) {
-                        kaddr = kmap_atomic(page, KM_USER0);
-                        memset(kaddr + offset, 0, length);
-                        flush_dcache_page(page);
-                        kunmap_atomic(kaddr, KM_USER0);
-                        set_page_dirty(page);
-                        goto unlock;
-                }
+        if (!page_has_buffers(page) && test_opt(inode->i_sb, NOBH) &&
+             ext3_should_writeback_data(inode) && PageUptodate(page)) {
+                kaddr = kmap_atomic(page, KM_USER0);
+                memset(kaddr + offset, 0, length);
+                flush_dcache_page(page);
+                kunmap_atomic(kaddr, KM_USER0);
+                set_page_dirty(page);
+                goto unlock;
         }
 
         if (!page_has_buffers(page))
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 8bd8ac077704..b8f5cd1e540d 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -2141,7 +2141,8 @@ retry:
                  * We have a transaction open.  All is sweetness.  It also sets
                  * i_size in generic_commit_write().
                  */
-                err = page_symlink(inode, symname, l);
+                err = __page_symlink(inode, symname, l,
+                                mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
                 if (err) {
                         ext3_dec_count(handle, inode);
                         ext3_mark_inode_dirty(handle, inode);
diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index b635e167a3fa..d4d0c41490cd 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -406,7 +406,8 @@ static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info
         int err = 0, pointed = 0;
         struct jffs2_eraseblock *jeb;
         unsigned char *buffer;
-        uint32_t crc, ofs, retlen, len;
+        uint32_t crc, ofs, len;
+        size_t retlen;
 
         BUG_ON(tn->csize == 0);
 
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 5f0652df5d47..f1695642d0f7 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -112,7 +112,7 @@ static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_r
  *          negative error code on failure.
  */
 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
-                                struct jffs2_raw_dirent *rd, uint32_t read, struct jffs2_full_dirent **fdp,
+                                struct jffs2_raw_dirent *rd, size_t read, struct jffs2_full_dirent **fdp,
                                 uint32_t *latest_mctime, uint32_t *mctime_ver)
 {
         struct jffs2_full_dirent *fd;
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2967b7393415..79b5404db100 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -532,10 +532,10 @@ dbUpdatePMap(struct inode *ipbmap,
 
                 lastlblkno = lblkno;
 
+                LOGSYNC_LOCK(log, flags);
                 if (mp->lsn != 0) {
                         /* inherit older/smaller lsn */
                         logdiff(diffp, mp->lsn, log);
-                        LOGSYNC_LOCK(log, flags);
                         if (difft < diffp) {
                                 mp->lsn = lsn;
 
@@ -548,20 +548,17 @@ dbUpdatePMap(struct inode *ipbmap,
                         logdiff(diffp, mp->clsn, log);
                         if (difft > diffp)
                                 mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log, flags);
                 } else {
                         mp->log = log;
                         mp->lsn = lsn;
 
                         /* insert bp after tblock in logsync list */
-                        LOGSYNC_LOCK(log, flags);
-
                         log->count++;
                         list_add(&mp->synclist, &tblk->synclist);
 
                         mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log, flags);
                 }
+                LOGSYNC_UNLOCK(log, flags);
         }
 
         /* write the last buffer. */
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 31b4aa13dd4b..4efa0d0eec39 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2844,11 +2844,11 @@ diUpdatePMap(struct inode *ipimap,
          */
         lsn = tblk->lsn;
         log = JFS_SBI(tblk->sb)->log;
+        LOGSYNC_LOCK(log, flags);
         if (mp->lsn != 0) {
                 /* inherit older/smaller lsn */
                 logdiff(difft, lsn, log);
                 logdiff(diffp, mp->lsn, log);
-                LOGSYNC_LOCK(log, flags);
                 if (difft < diffp) {
                         mp->lsn = lsn;
                         /* move mp after tblock in logsync list */
@@ -2860,17 +2860,15 @@ diUpdatePMap(struct inode *ipimap,
                 logdiff(diffp, mp->clsn, log);
                 if (difft > diffp)
                         mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log, flags);
         } else {
                 mp->log = log;
                 mp->lsn = lsn;
                 /* insert mp after tblock in logsync list */
-                LOGSYNC_LOCK(log, flags);
                 log->count++;
                 list_add(&mp->synclist, &tblk->synclist);
                 mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log, flags);
         }
+        LOGSYNC_UNLOCK(log, flags);
         write_metapage(mp);
         return (0);
 }
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index 220058d8616d..970b6a6aa337 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -662,12 +662,18 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
          * reclaimed while we're stuck in the unlock call. */
         fl->fl_u.nfs_fl.flags &= ~NFS_LCK_GRANTED;
 
+        /*
+         * Note: the server is supposed to either grant us the unlock
+         * request, or to deny it with NLM_LCK_DENIED_GRACE_PERIOD. In either
+         * case, we want to unlock.
+         */
+        do_vfs_lock(fl);
+
         if (req->a_flags & RPC_TASK_ASYNC) {
                 status = nlmclnt_async_call(req, NLMPROC_UNLOCK,
                                         &nlmclnt_unlock_ops);
                 /* Hrmf... Do the unlock early since locks_remove_posix()
                  * really expects us to free the lock synchronously */
-                do_vfs_lock(fl);
                 if (status < 0) {
                         nlmclnt_release_lockargs(req);
                         kfree(req);
@@ -680,7 +686,6 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
         if (status < 0)
                 return status;
 
-        do_vfs_lock(fl);
         if (resp->status == NLM_LCK_GRANTED)
                 return 0;
 
diff --git a/fs/namei.c b/fs/namei.c
index 557dcf395ca1..8dc2b038d5d9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2613,13 +2613,15 @@ void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
         }
 }
 
-int page_symlink(struct inode *inode, const char *symname, int len)
+int __page_symlink(struct inode *inode, const char *symname, int len,
+                gfp_t gfp_mask)
 {
         struct address_space *mapping = inode->i_mapping;
-        struct page *page = grab_cache_page(mapping, 0);
+        struct page *page;
         int err = -ENOMEM;
         char *kaddr;
 
+        page = find_or_create_page(mapping, 0, gfp_mask);
         if (!page)
                 goto fail;
         err = mapping->a_ops->prepare_write(NULL, page, 0, len-1);
@@ -2654,6 +2656,12 @@ fail:
         return err;
 }
 
+int page_symlink(struct inode *inode, const char *symname, int len)
+{
+        return __page_symlink(inode, symname, len,
+                        mapping_gfp_mask(inode->i_mapping));
+}
+
 struct inode_operations page_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = page_follow_link_light,
@@ -2672,6 +2680,7 @@ EXPORT_SYMBOL(lookup_one_len);
 EXPORT_SYMBOL(page_follow_link_light);
 EXPORT_SYMBOL(page_put_link);
 EXPORT_SYMBOL(page_readlink);
+EXPORT_SYMBOL(__page_symlink);
 EXPORT_SYMBOL(page_symlink);
 EXPORT_SYMBOL(page_symlink_inode_operations);
 EXPORT_SYMBOL(path_lookup);
diff --git a/fs/namespace.c b/fs/namespace.c
index 058a44865beb..39c81a8d6316 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1338,7 +1338,7 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
 
         new_ns = kmalloc(sizeof(struct namespace), GFP_KERNEL);
         if (!new_ns)
-                goto out;
+                return NULL;
 
         atomic_set(&new_ns->count, 1);
         INIT_LIST_HEAD(&new_ns->list);
@@ -1352,7 +1352,7 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
         if (!new_ns->root) {
                 up_write(&namespace_sem);
                 kfree(new_ns);
-                goto out;
+                return NULL;
         }
         spin_lock(&vfsmount_lock);
         list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
@@ -1393,7 +1393,6 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
         if (altrootmnt)
                 mntput(altrootmnt);
 
-out:
         return new_ns;
 }
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 04ab2fc360e7..4e9b3a1b36c5 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -57,6 +57,7 @@
 #define NFSDBG_FACILITY         NFSDBG_VFS
 #define MAX_DIRECTIO_SIZE       (4096UL << PAGE_SHIFT)
 
+static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty);
 static kmem_cache_t *nfs_direct_cachep;
 
 /*
@@ -107,6 +108,15 @@ nfs_get_user_pages(int rw, unsigned long user_addr, size_t size,
                                         page_count, (rw == READ), 0,
                                         *pages, NULL);
                 up_read(&current->mm->mmap_sem);
+                /*
+                 * If we got fewer pages than expected from get_user_pages(),
+                 * the user buffer runs off the end of a mapping; return EFAULT.
+                 */
+                if (result >= 0 && result < page_count) {
+                        nfs_free_user_pages(*pages, result, 0);
+                        *pages = NULL;
+                        result = -EFAULT;
+                }
         }
         return result;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 984ca3454d04..f8c0066e02e1 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1430,7 +1430,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
         if (status == 0)
                 status = nfs4_do_fsinfo(server, fhandle, info);
 out:
-        return status;
+        return nfs4_map_errors(status);
 }
 
 static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
diff --git a/include/asm-arm/fpstate.h b/include/asm-arm/fpstate.h
index f7430e3aa55d..6246bf83627d 100644
--- a/include/asm-arm/fpstate.h
+++ b/include/asm-arm/fpstate.h
@@ -55,8 +55,10 @@ struct fp_soft_struct {
         unsigned int save[FP_SOFT_SIZE];                /* undefined information */
 };
 
+#define IWMMXT_SIZE     0x98
+
 struct iwmmxt_struct {
-        unsigned int save[0x98/sizeof(int) + 1];
+        unsigned int save[IWMMXT_SIZE / sizeof(unsigned int)];
 };
 
 union fp_state {
diff --git a/include/asm-arm/system.h b/include/asm-arm/system.h
index eb2de8c10515..ec91d1ff032a 100644
--- a/include/asm-arm/system.h
+++ b/include/asm-arm/system.h
@@ -415,6 +415,9 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
         return ret;
 }
 
+extern void disable_hlt(void);
+extern void enable_hlt(void);
+
 #endif /* __ASSEMBLY__ */
 
 #define arch_align_stack(x) (x)
diff --git a/include/asm-arm/thread_info.h b/include/asm-arm/thread_info.h
index 33a33cbb6329..cfbccb63c67b 100644
--- a/include/asm-arm/thread_info.h
+++ b/include/asm-arm/thread_info.h
@@ -59,7 +59,7 @@ struct thread_info {
         struct cpu_context_save cpu_context;    /* cpu context */
         __u8                    used_cp[16];    /* thread used copro */
         unsigned long           tp_value;
-        union fp_state          fpstate;
+        union fp_state          fpstate __attribute__((aligned(8)));
         union vfp_state         vfpstate;
         struct restart_block    restart_block;
 };
diff --git a/include/asm-m68k/atomic.h b/include/asm-m68k/atomic.h
index a4a84d5c65d5..862e497c2645 100644
--- a/include/asm-m68k/atomic.h
+++ b/include/asm-m68k/atomic.h
@@ -55,6 +55,7 @@ static inline int atomic_inc_and_test(atomic_t *v)
 }
 
 #ifdef CONFIG_RMW_INSNS
+
 static inline int atomic_add_return(int i, atomic_t *v)
 {
         int t, tmp;
@@ -82,7 +83,12 @@ static inline int atomic_sub_return(int i, atomic_t *v)
                         : "g" (i), "2" (atomic_read(v)));
         return t;
 }
+
+#define atomic_cmpxchg(v, o, n) ((int)cmpxchg(&((v)->counter), (o), (n)))
+#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+
 #else /* !CONFIG_RMW_INSNS */
+
 static inline int atomic_add_return(int i, atomic_t * v)
 {
         unsigned long flags;
@@ -110,6 +116,32 @@ static inline int atomic_sub_return(int i, atomic_t * v)
 
         return t;
 }
+
+static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
+{
+        unsigned long flags;
+        int prev;
+
+        local_irq_save(flags);
+        prev = atomic_read(v);
+        if (prev == old)
+                atomic_set(v, new);
+        local_irq_restore(flags);
+        return prev;
+}
+
+static inline int atomic_xchg(atomic_t *v, int new)
+{
+        unsigned long flags;
+        int prev;
+
+        local_irq_save(flags);
+        prev = atomic_read(v);
+        atomic_set(v, new);
+        local_irq_restore(flags);
+        return prev;
+}
+
 #endif /* !CONFIG_RMW_INSNS */
 
 #define atomic_dec_return(v)    atomic_sub_return(1, (v))
@@ -139,9 +171,6 @@ static inline void atomic_set_mask(unsigned long mask, unsigned long *v)
         __asm__ __volatile__("orl %1,%0" : "+m" (*v) : "id" (mask));
 }
 
-#define atomic_cmpxchg(v, o, n) ((int)cmpxchg(&((v)->counter), (o), (n)))
-#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-
 #define atomic_add_unless(v, a, u)                              \
 ({                                                              \
         int c, old;                                             \
diff --git a/include/asm-mips/vga.h b/include/asm-mips/vga.h
index ca5cec97e167..34755c0a6398 100644
--- a/include/asm-mips/vga.h
+++ b/include/asm-mips/vga.h
@@ -26,6 +26,9 @@
  *  <linux/vt_buffer.h> has already done the right job for us.
  */
 
+#undef scr_writew
+#undef scr_readw
+
 static inline void scr_writew(u16 val, volatile u16 *addr)
 {
         *addr = cpu_to_le16(val);
diff --git a/include/asm-powerpc/ppc-pci.h b/include/asm-powerpc/ppc-pci.h
index f80482c7231f..cf79bc7ebb55 100644
--- a/include/asm-powerpc/ppc-pci.h
+++ b/include/asm-powerpc/ppc-pci.h
@@ -38,6 +38,7 @@ void *traverse_pci_devices(struct device_node *start, traverse_func pre,
 
 void pci_devs_phb_init(void);
 void pci_devs_phb_init_dynamic(struct pci_controller *phb);
+int setup_phb(struct device_node *dev, struct pci_controller *phb);
 void __devinit scan_phb(struct pci_controller *hose);
 
 /* From rtas_pci.h */
diff --git a/include/linux/compat_ioctl.h b/include/linux/compat_ioctl.h
index 8fad50f8e389..ae7dfb790df3 100644
--- a/include/linux/compat_ioctl.h
+++ b/include/linux/compat_ioctl.h
@@ -696,6 +696,8 @@ COMPATIBLE_IOCTL(MEMLOCK)
 COMPATIBLE_IOCTL(MEMUNLOCK)
 COMPATIBLE_IOCTL(MEMGETREGIONCOUNT)
 COMPATIBLE_IOCTL(MEMGETREGIONINFO)
+COMPATIBLE_IOCTL(MEMGETBADBLOCK)
+COMPATIBLE_IOCTL(MEMSETBADBLOCK)
 /* NBD */
 ULONG_IOCTL(NBD_SET_SOCK)
 ULONG_IOCTL(NBD_SET_BLKSIZE)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 51c0c93bdf93..128d0082522c 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1664,6 +1664,8 @@ extern int vfs_follow_link(struct nameidata *, const char *);
 extern int page_readlink(struct dentry *, char __user *, int);
 extern void *page_follow_link_light(struct dentry *, struct nameidata *);
 extern void page_put_link(struct dentry *, struct nameidata *, void *);
+extern int __page_symlink(struct inode *inode, const char *symname, int len,
+                gfp_t gfp_mask);
 extern int page_symlink(struct inode *inode, const char *symname, int len);
 extern struct inode_operations page_symlink_inode_operations;
 extern int generic_readlink(struct dentry *, char __user *, int);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 20f9148e38d9..7851e6b520cf 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -157,9 +157,9 @@ extern void FASTCALL(free_cold_page(struct page *page));
 
 void page_alloc_init(void);
 #ifdef CONFIG_NUMA
-void drain_remote_pages(void);
+void drain_node_pages(int node);
 #else
-static inline void drain_remote_pages(void) { };
+static inline void drain_node_pages(int node) { };
 #endif
 
 #endif /* __LINUX_GFP_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index ff2e09c953b9..62e6314382f0 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -892,7 +892,6 @@ static inline int pid_alive(struct task_struct *p)
 }
 
 extern void free_task(struct task_struct *tsk);
-extern void __put_task_struct(struct task_struct *tsk);
 #define get_task_struct(tsk) do { atomic_inc(&(tsk)->usage); } while(0)
 
 extern void __put_task_struct_cb(struct rcu_head *rhp);
diff --git a/kernel/fork.c b/kernel/fork.c
index fbea12d7a943..ccdfbb16c86d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -108,8 +108,10 @@ void free_task(struct task_struct *tsk)
 }
 EXPORT_SYMBOL(free_task);
 
-void __put_task_struct(struct task_struct *tsk)
+void __put_task_struct_cb(struct rcu_head *rhp)
 {
+        struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
+
         WARN_ON(!(tsk->exit_state & (EXIT_DEAD | EXIT_ZOMBIE)));
         WARN_ON(atomic_read(&tsk->usage));
         WARN_ON(tsk == current);
@@ -1060,6 +1062,12 @@ static task_t *copy_process(unsigned long clone_flags,
         p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL;
 
         /*
+         * sigaltstack should be cleared when sharing the same VM
+         */
+        if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
+                p->sas_ss_sp = p->sas_ss_size = 0;
+
+        /*
          * Syscall tracing should be turned off in the child regardless
          * of CLONE_PTRACE.
          */
diff --git a/kernel/sched.c b/kernel/sched.c
index e82c99f1db64..4d46e90f59c3 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -178,13 +178,6 @@ static unsigned int task_timeslice(task_t *p)
 #define task_hot(p, now, sd) ((long long) ((now) - (p)->last_ran)       \
                                 < (long long) (sd)->cache_hot_time)
 
-void __put_task_struct_cb(struct rcu_head *rhp)
-{
-        __put_task_struct(container_of(rhp, struct task_struct, rcu));
-}
-
-EXPORT_SYMBOL_GPL(__put_task_struct_cb);
-
 /*
  * These are the runqueue data structures:
  */
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a918f77f02f3..1fe76d963ac2 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -130,6 +130,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
                 onlined_pages++;
         }
         zone->present_pages += onlined_pages;
+        zone->zone_pgdat->node_present_pages += onlined_pages;
 
         setup_per_zone_pages_min();
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 954981b14303..2a8206009422 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -748,7 +748,7 @@ long do_mbind(unsigned long start, unsigned long len,
                                       MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
             || mode > MPOL_MAX)
                 return -EINVAL;
-        if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_RESOURCE))
+        if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_NICE))
                 return -EPERM;
 
         if (start & ~PAGE_MASK)
@@ -942,20 +942,20 @@ asmlinkage long sys_migrate_pages(pid_t pid, unsigned long maxnode,
          */
         if ((current->euid != task->suid) && (current->euid != task->uid) &&
             (current->uid != task->suid) && (current->uid != task->uid) &&
-            !capable(CAP_SYS_ADMIN)) {
+            !capable(CAP_SYS_NICE)) {
                 err = -EPERM;
                 goto out;
         }
 
         task_nodes = cpuset_mems_allowed(task);
         /* Is the user allowed to access the target nodes? */
-        if (!nodes_subset(new, task_nodes) && !capable(CAP_SYS_ADMIN)) {
+        if (!nodes_subset(new, task_nodes) && !capable(CAP_SYS_NICE)) {
                 err = -EPERM;
                 goto out;
         }
 
         err = do_migrate_pages(mm, &old, &new,
-                capable(CAP_SYS_ADMIN) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
+                capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
 out:
         mmput(mm);
         return err;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 791690d7d3fa..234bd4895d14 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -590,21 +590,20 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
 }
 
 #ifdef CONFIG_NUMA
-/* Called from the slab reaper to drain remote pagesets */
-void drain_remote_pages(void)
+/*
+ * Called from the slab reaper to drain pagesets on a particular node that
+ * belong to the currently executing processor.
+ */
+void drain_node_pages(int nodeid)
 {
-        struct zone *zone;
-        int i;
+        int i, z;
         unsigned long flags;
 
         local_irq_save(flags);
-        for_each_zone(zone) {
+        for (z = 0; z < MAX_NR_ZONES; z++) {
+                struct zone *zone = NODE_DATA(nodeid)->node_zones + z;
                 struct per_cpu_pageset *pset;
 
-                /* Do not drain local pagesets */
-                if (zone->zone_pgdat->node_id == numa_node_id())
-                        continue;
-
                 pset = zone_pcp(zone, smp_processor_id());
                 for (i = 0; i < ARRAY_SIZE(pset->pcp); i++) {
                         struct per_cpu_pages *pcp;
diff --git a/mm/rmap.c b/mm/rmap.c
index d8ce5ff61454..67f0e20b101f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -537,9 +537,6 @@ void page_add_new_anon_rmap(struct page *page,
  */
 void page_add_file_rmap(struct page *page)
 {
-        BUG_ON(PageAnon(page));
-        BUG_ON(!pfn_valid(page_to_pfn(page)));
-
         if (atomic_inc_and_test(&page->_mapcount))
                 __inc_page_state(nr_mapped);
 }
diff --git a/mm/slab.c b/mm/slab.c
index 61800b88e241..d0bd7f07ab04 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -789,6 +789,47 @@ static void __slab_error(const char *function, struct kmem_cache *cachep, char *
         dump_stack();
 }
 
+#ifdef CONFIG_NUMA
+/*
+ * Special reaping functions for NUMA systems called from cache_reap().
+ * These take care of doing round robin flushing of alien caches (containing
+ * objects freed on different nodes from which they were allocated) and the
+ * flushing of remote pcps by calling drain_node_pages.
+ */
+static DEFINE_PER_CPU(unsigned long, reap_node);
+
+static void init_reap_node(int cpu)
+{
+        int node;
+
+        node = next_node(cpu_to_node(cpu), node_online_map);
+        if (node == MAX_NUMNODES)
+                node = 0;
+
+        __get_cpu_var(reap_node) = node;
+}
+
+static void next_reap_node(void)
+{
+        int node = __get_cpu_var(reap_node);
+
+        /*
+         * Also drain per cpu pages on remote zones
+         */
+        if (node != numa_node_id())
+                drain_node_pages(node);
+
+        node = next_node(node, node_online_map);
+        if (unlikely(node >= MAX_NUMNODES))
+                node = first_node(node_online_map);
+        __get_cpu_var(reap_node) = node;
+}
+
+#else
+#define init_reap_node(cpu) do { } while (0)
+#define next_reap_node(void) do { } while (0)
+#endif
+
 /*
  * Initiate the reap timer running on the target CPU.  We run at around 1 to 2Hz
  * via the workqueue/eventd.
@@ -806,6 +847,7 @@ static void __devinit start_cpu_timer(int cpu)
          * at that time.
          */
         if (keventd_up() && reap_work->func == NULL) {
+                init_reap_node(cpu);
                 INIT_WORK(reap_work, cache_reap, NULL);
                 schedule_delayed_work_on(cpu, reap_work, HZ + 3 * cpu);
         }
@@ -884,6 +926,23 @@ static void __drain_alien_cache(struct kmem_cache *cachep,
         }
 }
 
+/*
+ * Called from cache_reap() to regularly drain alien caches round robin.
+ */
+static void reap_alien(struct kmem_cache *cachep, struct kmem_list3 *l3)
+{
+        int node = __get_cpu_var(reap_node);
+
+        if (l3->alien) {
+                struct array_cache *ac = l3->alien[node];
+                if (ac && ac->avail) {
+                        spin_lock_irq(&ac->lock);
+                        __drain_alien_cache(cachep, ac, node);
+                        spin_unlock_irq(&ac->lock);
+                }
+        }
+}
+
 static void drain_alien_cache(struct kmem_cache *cachep, struct array_cache **alien)
 {
         int i = 0;
@@ -902,6 +961,7 @@ static void drain_alien_cache(struct kmem_cache *cachep, struct array_cache **al
 #else
 
 #define drain_alien_cache(cachep, alien) do { } while (0)
+#define reap_alien(cachep, l3) do { } while (0)
 
 static inline struct array_cache **alloc_alien_cache(int node, int limit)
 {
@@ -3497,8 +3557,7 @@ static void cache_reap(void *unused)
                 check_irq_on();
 
                 l3 = searchp->nodelists[numa_node_id()];
-                if (l3->alien)
-                        drain_alien_cache(searchp, l3->alien);
+                reap_alien(searchp, l3);
                 spin_lock_irq(&l3->list_lock);
 
                 drain_array_locked(searchp, cpu_cache_get(searchp), 0,
@@ -3548,7 +3607,7 @@ static void cache_reap(void *unused)
         }
         check_irq_on();
         mutex_unlock(&cache_chain_mutex);
-        drain_remote_pages();
+        next_reap_node();
         /* Setup the next iteration */
         schedule_delayed_work(&__get_cpu_var(reap_work), REAPTIMEOUT_CPUC);
 }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index b0af7593d01e..4fe7e3aa02e2 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -700,7 +700,7 @@ int migrate_page_remove_references(struct page *newpage,
          * the page.
          */
         if (!mapping || page_mapcount(page) + nr_refs != page_count(page))
-                return 1;
+                return -EAGAIN;
 
         /*
          * Establish swap ptes for anonymous pages or destroy pte
@@ -721,13 +721,15 @@ int migrate_page_remove_references(struct page *newpage,
          * If the page was not migrated then the PageSwapCache bit
          * is still set and the operation may continue.
          */
-        try_to_unmap(page, 1);
+        if (try_to_unmap(page, 1) == SWAP_FAIL)
+                /* A vma has VM_LOCKED set -> Permanent failure */
+                return -EPERM;
 
         /*
          * Give up if we were unable to remove all mappings.
          */
         if (page_mapcount(page))
-                return 1;
+                return -EAGAIN;
 
         write_lock_irq(&mapping->tree_lock);
 
@@ -738,7 +740,7 @@ int migrate_page_remove_references(struct page *newpage,
         if (!page_mapping(page) || page_count(page) != nr_refs ||
                         *radix_pointer != page) {
                 write_unlock_irq(&mapping->tree_lock);
-                return 1;
+                return -EAGAIN;
         }
 
         /*
@@ -813,10 +815,14 @@ EXPORT_SYMBOL(migrate_page_copy);
  */
 int migrate_page(struct page *newpage, struct page *page)
 {
+        int rc;
+
         BUG_ON(PageWriteback(page));    /* Writeback must be complete */
 
-        if (migrate_page_remove_references(newpage, page, 2))
-                return -EAGAIN;
+        rc = migrate_page_remove_references(newpage, page, 2);
+
+        if (rc)
+                return rc;
 
         migrate_page_copy(newpage, page);
 
@@ -1883,7 +1889,8 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
 
         if (!(gfp_mask & __GFP_WAIT) ||
                 zone->all_unreclaimable ||
-                atomic_read(&zone->reclaim_in_progress) > 0)
+                atomic_read(&zone->reclaim_in_progress) > 0 ||
+                (p->flags & PF_MEMALLOC))
                         return 0;
 
         node_id = zone->zone_pgdat->node_id;
diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
index 8bf6d9f6e9d3..905087e0d485 100644
--- a/net/bridge/netfilter/Makefile
+++ b/net/bridge/netfilter/Makefile
@@ -29,4 +29,4 @@ obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 
 # watchers
 obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
-obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_ulog.o
+obj-$(CONFIG_BRIDGE_EBT_ULOG) += ebt_ulog.o
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 57d290d89ec2..8ee4d016740d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -847,10 +847,11 @@ int ip_append_data(struct sock *sk,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
                         (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip_ufo_append_data(sk, getfrag, from, length, hh_len,
-                               fragheaderlen, transhdrlen, mtu, flags))
+                err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                         fragheaderlen, transhdrlen, mtu,
+                                         flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index dd1048be8a01..7d7ab94a7a2e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -771,7 +771,7 @@ static int get_entries(const struct arpt_get_entries *entries,
         struct arpt_table *t;
 
         t = xt_find_table_lock(NF_ARP, entries->name);
-        if (t || !IS_ERR(t)) {
+        if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n",
                          private->number);
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 63cf7e540847..e0e9d1383c7c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                 /* Update AIMD parameters */
                 if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-                               ca->ai < HSTCP_AIMD_MAX)
+                               ca->ai < HSTCP_AIMD_MAX - 1)
                                 ca->ai++;
                 } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a7623ead39a8..9f498a6c8895 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1036,6 +1036,10 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         limit = min(send_win, cong_win);
 
+        /* If a full-sized TSO skb can be sent, do it. */
+        if (limit >= 65536)
+                return 0;
+
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b7d8822c1be4..19727d941962 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -822,7 +822,7 @@ struct ipv6_saddr_score {
         int             addr_type;
         unsigned int    attrs;
         int             matchlen;
-        unsigned int    scope;
+        int             scope;
         unsigned int    rule;
 };
 
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c7932cb420a5..84963749ab77 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -279,7 +279,7 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
                 goto out;
         memcpy(tmp_hdr, skb->nh.raw, hdr_len);
         if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
-                goto out;
+                goto free_out;
         skb->nh.ipv6h->priority    = 0;
         skb->nh.ipv6h->flow_lbl[0] = 0;
         skb->nh.ipv6h->flow_lbl[1] = 0;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 4154f3a8b6cf..bb8ffb8a14c5 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -87,7 +87,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
                                      struct inet_timewait_sock **twp)
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const struct inet_sock *inet = inet_sk(sk);
+        struct inet_sock *inet = inet_sk(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
@@ -129,6 +129,10 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         }
 
 unique:
+        /* Must record num and sport now. Otherwise we will see
+         * in hash table socket with a funny identity. */
+        inet->num = lport;
+        inet->sport = htons(lport);
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index f999edd846a9..5bf70b1442ea 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -944,10 +944,11 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
-                                fragheaderlen, transhdrlen, mtu, flags))
+                err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                          fragheaderlen, transhdrlen, mtu,
+                                          flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cac38b2e147a..2cf5fb8322c4 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -928,8 +928,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
 
         if (nfqa[NFQA_CFG_PARAMS-1]) {
                 struct nfqnl_msg_config_params *params;
-                params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
 
+                if (!queue) {
+                        ret = -ENOENT;
+                        goto out_put;
+                }
+                params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
                 nfqnl_set_mode(queue, params->copy_mode,
                                 ntohl(params->copy_range));
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 6b9772d95872..59dc7d140600 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1194,6 +1194,9 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
                 msg->msg_namelen = sizeof(*addr);
         }
 
+        if (nlk->flags & NETLINK_RECV_PKTINFO)
+                netlink_cmsg_recv_pktinfo(msg, skb);
+
         if (NULL == siocb->scm) {
                 memset(&scm, 0, sizeof(scm));
                 siocb->scm = &scm;
@@ -1205,8 +1208,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
                 netlink_dump(sk);
 
         scm_recv(sock, msg, siocb->scm, flags);
-        if (nlk->flags & NETLINK_RECV_PKTINFO)
-                netlink_cmsg_recv_pktinfo(msg, skb);
 
 out:
         netlink_rcv_wake(sk);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 792ce59940ec..2ffa11c6e8de 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -707,7 +707,7 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
 
 rtattr_failure:
 nlmsg_failure:
-        skb_trim(skb, b - skb->data);
+        kfree_skb(skb);
         return -1;
 }
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d2f0550c4ba0..d78479782045 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -113,7 +113,7 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
 
         err = -EINVAL;
         if (!xprt)
-                goto out_err;
+                goto out_no_xprt;
         if (vers >= program->nrvers || !(version = program->version[vers]))
                 goto out_err;
 
@@ -182,6 +182,7 @@ out_no_path:
         kfree(clnt);
 out_err:
         xprt_destroy(xprt);
+out_no_xprt:
         return ERR_PTR(err);
 }
 
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 802d4fe0f55c..e838d042f7f5 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-        struct rpc_task *task;
-
+        struct rpc_task *task, *next;
         struct list_head *head;
+
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                while (!list_empty(head)) {
-                        task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
+                list_for_each_entry_safe(task, next, head, u.tk_wait.list)
                         __rpc_wake_up_task(task);
-                }
                 if (head == &queue->tasks[0])
                         break;
                 head--;
@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
+        struct rpc_task *task, *next;
         struct list_head *head;
-        struct rpc_task *task;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                while (!list_empty(head)) {
-                        task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
+                list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
                         task->tk_status = status;
                         __rpc_wake_up_task(task);
                 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b7773bf68efa..b65c201e9ff5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1262,7 +1262,7 @@ static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
 
         rc = task_has_perm(parent, child, PROCESS__PTRACE);
         /* Save the SID of the tracing process for later use in apply_creds. */
-        if (!rc)
+        if (!(child->ptrace & PT_PTRACED) && !rc)
                 csec->ptrace_sid = psec->sid;
         return rc;
 }