31 files changed, 191 insertions, 118 deletions
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 22e4c466e5a3..d12fb97a5337 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -82,6 +82,7 @@ EXPORT_SYMBOL(acpi_strict);
 acpi_interrupt_flags acpi_sci_flags __initdata;
 int acpi_sci_override_gsi __initdata;
 int acpi_skip_timer_override __initdata;
+int acpi_use_timer_override __initdata;
 #ifdef CONFIG_X86_LOCAL_APIC
 static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
@@ -1300,6 +1301,13 @@ static int __init parse_acpi_skip_timer_override(char *arg)
        return 0;
 }
 early_param("acpi_skip_timer_override", parse_acpi_skip_timer_override);
+static int __init parse_acpi_use_timer_override(char *arg)
+{
+        acpi_use_timer_override = 1;
+        return 0;
+}
+early_param("acpi_use_timer_override", parse_acpi_use_timer_override);
 #endif /* CONFIG_X86_IO_APIC */
 static int __init setup_acpi_sci(char *s)
diff --git a/arch/i386/kernel/acpi/earlyquirk.c b/arch/i386/kernel/acpi/earlyquirk.c
index fe799b11ac0a..c9841692bb7c 100644
--- a/arch/i386/kernel/acpi/earlyquirk.c
+++ b/arch/i386/kernel/acpi/earlyquirk.c
@@ -27,11 +27,17 @@ static int __init check_bridge(int vendor, int device)
 #ifdef CONFIG_ACPI
        /* According to Nvidia all timer overrides are bogus unless HPET
           is enabled. */
-        if (vendor == PCI_VENDOR_ID_NVIDIA) {
+        if (!acpi_use_timer_override && vendor == PCI_VENDOR_ID_NVIDIA) {
                nvidia_hpet_detected = 0;
                acpi_table_parse(ACPI_HPET, nvidia_hpet_check);
                if (nvidia_hpet_detected == 0) {
                        acpi_skip_timer_override = 1;
+                          printk(KERN_INFO "Nvidia board "
+                       "detected. Ignoring ACPI "
+                       "timer override.\n");
+                printk(KERN_INFO "If you got timer trouble "
+                                 "try acpi_use_timer_override\n");
                }
        }
 #endif
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index ad84bc2802a6..3b7a63e0ed1a 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -1287,9 +1287,11 @@ static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
                        trigger == IOAPIC_LEVEL)
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                         handle_fasteoi_irq, "fasteoi");
-        else
+        else {
+                irq_desc[irq].status |= IRQ_DELAYED_DISABLE;
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                         handle_edge_irq, "edge");
+        }
        set_intr_gate(vector, interrupt[irq]);
 }
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index dbc4aae91959..69163998adeb 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
 */
 static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
 {
-        static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+        static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
        return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
 }
 static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
 {
-        static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+        static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
        write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
        return 1;
 }
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 14682396f7f7..683b12c6f76c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -484,6 +484,15 @@ source "net/Kconfig"
 source "drivers/Kconfig"
+config MSPEC
+        tristate "Memory special operations driver"
+        depends on IA64
+        select IA64_UNCACHED_ALLOCATOR
+        help
+          If you have an ia64 and you want to enable memory special
+          operations support (formerly known as fetchop), say Y here,
+          otherwise say N.
 source "fs/Kconfig"
 source "lib/Kconfig"
diff --git a/arch/ia64/hp/sim/Kconfig b/arch/ia64/hp/sim/Kconfig
index 18ccb1266e18..f92306bbedb8 100644
--- a/arch/ia64/hp/sim/Kconfig
+++ b/arch/ia64/hp/sim/Kconfig
@@ -13,8 +13,8 @@ config HP_SIMSERIAL_CONSOLE
        depends on HP_SIMSERIAL
 config HP_SIMSCSI
-        tristate "Simulated SCSI disk"
+        bool "Simulated SCSI disk"
-        depends on SCSI
+        depends on SCSI=y
 endmenu
diff --git a/arch/ia64/hp/sim/hpsim_irq.c b/arch/ia64/hp/sim/hpsim_irq.c
index 8145547bb52d..c2f58ff364e7 100644
--- a/arch/ia64/hp/sim/hpsim_irq.c
+++ b/arch/ia64/hp/sim/hpsim_irq.c
@@ -27,7 +27,7 @@ hpsim_set_affinity_noop (unsigned int a, cpumask_t b)
 }
 static struct hw_interrupt_type irq_type_hp_sim = {
-        .typename =     "hpsim",
+        .name =         "hpsim",
        .startup =      hpsim_irq_startup,
        .shutdown =     hpsim_irq_noop,
        .enable =       hpsim_irq_noop,
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 9bf15fefa7e4..60d64950e3c2 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -426,7 +426,7 @@ iosapic_end_level_irq (unsigned int irq)
 #define iosapic_ack_level_irq           nop
 struct hw_interrupt_type irq_type_iosapic_level = {
-        .typename =     "IO-SAPIC-level",
+        .name =         "IO-SAPIC-level",
        .startup =      iosapic_startup_level_irq,
        .shutdown =     iosapic_shutdown_level_irq,
        .enable =       iosapic_enable_level_irq,
@@ -473,7 +473,7 @@ iosapic_ack_edge_irq (unsigned int irq)
 #define iosapic_end_edge_irq            nop
 struct hw_interrupt_type irq_type_iosapic_edge = {
-        .typename =     "IO-SAPIC-edge",
+        .name =         "IO-SAPIC-edge",
        .startup =      iosapic_startup_edge_irq,
        .shutdown =     iosapic_disable_edge_irq,
        .enable =       iosapic_enable_edge_irq,
@@ -664,7 +664,7 @@ register_intr (unsigned int gsi, int vector, unsigned char delivery,
                        printk(KERN_WARNING
                               "%s: changing vector %d from %s to %s\n",
                               __FUNCTION__, vector,
-                               idesc->chip->typename, irq_type->typename);
+                               idesc->chip->name, irq_type->name);
                idesc->chip = irq_type;
        }
        return 0;
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index f07c0864b0b4..54d55e4d64f7 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -76,7 +76,7 @@ int show_interrupts(struct seq_file *p, void *v)
                        seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
                }
 #endif
-                seq_printf(p, " %14s", irq_desc[i].chip->typename);
+                seq_printf(p, " %14s", irq_desc[i].chip->name);
                seq_printf(p, "  %s", action->name);
                for (action=action->next; action; action = action->next)
@@ -197,7 +197,7 @@ void fixup_irqs(void)
                        struct pt_regs *old_regs = set_irq_regs(NULL);
                        vectors_in_migration[irq]=0;
-                        __do_IRQ(irq);
+                        generic_handle_irq(irq);
                        set_irq_regs(old_regs);
                }
        }
diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
index 9c6dafa2d0df..ba3ba8bc50be 100644
--- a/arch/ia64/kernel/irq_ia64.c
+++ b/arch/ia64/kernel/irq_ia64.c
@@ -186,7 +186,7 @@ ia64_handle_irq (ia64_vector vector, struct pt_regs *regs)
                        ia64_setreg(_IA64_REG_CR_TPR, vector);
                        ia64_srlz_d();
-                        __do_IRQ(local_vector_to_irq(vector));
+                        generic_handle_irq(local_vector_to_irq(vector));
                        /*
                         * Disable interrupts and send EOI:
@@ -242,7 +242,7 @@ void ia64_process_pending_intr(void)
                         * Probably could shared code.
                         */
                        vectors_in_migration[local_vector_to_irq(vector)]=0;
-                        __do_IRQ(local_vector_to_irq(vector));
+                        generic_handle_irq(local_vector_to_irq(vector));
                        set_irq_regs(old_regs);
                        /*
diff --git a/arch/ia64/kernel/irq_lsapic.c b/arch/ia64/kernel/irq_lsapic.c
index 1ab58b09f3d7..c2f07beb1759 100644
--- a/arch/ia64/kernel/irq_lsapic.c
+++ b/arch/ia64/kernel/irq_lsapic.c
@@ -34,7 +34,7 @@ static int lsapic_retrigger(unsigned int irq)
 }
 struct hw_interrupt_type irq_type_ia64_lsapic = {
-        .typename =     "LSAPIC",
+        .name =         "LSAPIC",
        .startup =      lsapic_noop_startup,
        .shutdown =     lsapic_noop,
        .enable =       lsapic_noop,
diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index eee5c1cfbe32..f3a9585e98a8 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c
@@ -70,8 +70,10 @@ huge_pte_offset (struct mm_struct *mm, unsigned long addr)
 * Don't actually need to do any preparation, but need to make sure
 * the address is in the right region.
 */
-int prepare_hugepage_range(unsigned long addr, unsigned long len)
+int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
 {
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
        if (len & ~HPAGE_MASK)
                return -EINVAL;
        if (addr & ~HPAGE_MASK)
diff --git a/arch/ia64/sn/kernel/bte.c b/arch/ia64/sn/kernel/bte.c
index 7f73ad4408aa..ff1c55601178 100644
--- a/arch/ia64/sn/kernel/bte.c
+++ b/arch/ia64/sn/kernel/bte.c
@@ -381,14 +381,13 @@ bte_result_t bte_unaligned_copy(u64 src, u64 dest, u64 len, u64 mode)
                 * bcopy to the destination.
                 */
-                /* Add the leader from source */
-                headBteLen = len + (src & L1_CACHE_MASK);
-                /* Add the trailing bytes from footer. */
-                headBteLen += L1_CACHE_BYTES - (headBteLen & L1_CACHE_MASK);
-                headBteSource = src & ~L1_CACHE_MASK;
                headBcopySrcOffset = src & L1_CACHE_MASK;
                headBcopyDest = dest;
                headBcopyLen = len;
+                headBteSource = src - headBcopySrcOffset;
+                /* Add the leading and trailing bytes from source */
+                headBteLen = L1_CACHE_ALIGN(len + headBcopySrcOffset);
        }
        if (headBcopyLen > 0) {
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 7bb6ad188ba3..0b49459a878a 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -201,7 +201,7 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
 }
 struct hw_interrupt_type irq_type_sn = {
-        .typename       = "SN hub",
+        .name           = "SN hub",
        .startup        = sn_startup_irq,
        .shutdown       = sn_shutdown_irq,
        .enable         = sn_enable_irq,
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2bd9b7fb0f6c..0673dbedb241 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -740,7 +740,7 @@ config ARCH_SPARSEMEM_ENABLE
 config ARCH_SPARSEMEM_DEFAULT
        def_bool y
-        depends on SMP && PPC_PSERIES
+        depends on (SMP && PPC_PSERIES) || PPC_CELL
 config ARCH_POPULATES_NODE_MAP
        def_bool y
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index eab7318729e9..b5fb1fee76f8 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -179,11 +179,11 @@ if [ -z "$cacheit" ]; then
 fi
 if [ -n "$initrd" ]; then
-    addsec $tmp "$initrd" initrd
+    addsec $tmp "$initrd" $isection
 fi
 if [ -n "$dtb" ]; then
-    addsec $tmp "$dtb" dtb
+    addsec $tmp "$dtb" .kernel:dtb
 fi
 if [ "$platform" != "miboot" ]; then
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 4b6bb3ffe3dc..4be3c6414b04 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -21,6 +21,11 @@ SECTIONS
    __got2_end = .;
  }
+  . = ALIGN(8);
+  _dtb_start = .;
+  .kernel:dtb : { *(.kernel:dtb) }
+  _dtb_end = .;
  . = ALIGN(4096);
  _vmlinux_start =  .;
  .kernel:vmlinux.strip : { *(.kernel:vmlinux.strip) }
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 1442b63a75da..6f6fc977cb39 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -72,6 +72,10 @@
 #define VALIDATE_BUF_SIZE 4096    
 #define RTAS_MSG_MAXLEN   64
+/* Quirk - RTAS requires 4k list length and block size */
+#define RTAS_BLKLIST_LENGTH 4096
+#define RTAS_BLK_SIZE 4096
 struct flash_block {
        char *data;
        unsigned long length;
@@ -83,7 +87,7 @@ struct flash_block {
 * into a version/length and translate the pointers
 * to absolute.
 */
-#define FLASH_BLOCKS_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct flash_block))
+#define FLASH_BLOCKS_PER_NODE ((RTAS_BLKLIST_LENGTH - 16) / sizeof(struct flash_block))
 struct flash_block_list {
        unsigned long num_blocks;
        struct flash_block_list *next;
@@ -96,6 +100,9 @@ struct flash_block_list_header { /* just the header of flash_block_list */
 static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
+/* Use slab cache to guarantee 4k alignment */
+static kmem_cache_t *flash_block_cache = NULL;
 #define FLASH_BLOCK_LIST_VERSION (1UL)
 /* Local copy of the flash block list.
@@ -153,7 +160,7 @@ static int flash_list_valid(struct flash_block_list *flist)
                                return FLASH_IMG_NULL_DATA;
                        }
                        block_size = f->blocks[i].length;
-                        if (block_size <= 0 || block_size > PAGE_SIZE) {
+                        if (block_size <= 0 || block_size > RTAS_BLK_SIZE) {
                                return FLASH_IMG_BAD_LEN;
                        }
                        image_size += block_size;
@@ -177,9 +184,9 @@ static void free_flash_list(struct flash_block_list *f)
        while (f) {
                for (i = 0; i < f->num_blocks; i++)
-                        free_page((unsigned long)(f->blocks[i].data));
+                        kmem_cache_free(flash_block_cache, f->blocks[i].data);
                next = f->next;
-                free_page((unsigned long)f);
+                kmem_cache_free(flash_block_cache, f);
                f = next;
        }
 }
@@ -278,6 +285,12 @@ static ssize_t rtas_flash_read(struct file *file, char __user *buf,
        return msglen;
 }
+/* constructor for flash_block_cache */
+void rtas_block_ctor(void *ptr, kmem_cache_t *cache, unsigned long flags)
+{
+        memset(ptr, 0, RTAS_BLK_SIZE);
+}
 /* We could be much more efficient here.  But to keep this function
 * simple we allocate a page to the block list no matter how small the
 * count is.  If the system is low on memory it will be just as well
@@ -302,7 +315,7 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
         * proc file
         */
        if (uf->flist == NULL) {
-                uf->flist = (struct flash_block_list *) get_zeroed_page(GFP_KERNEL);
+                uf->flist = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                if (!uf->flist)
                        return -ENOMEM;
        }
@@ -313,21 +326,21 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
        next_free = fl->num_blocks;
        if (next_free == FLASH_BLOCKS_PER_NODE) {
                /* Need to allocate another block_list */
-                fl->next = (struct flash_block_list *)get_zeroed_page(GFP_KERNEL);
+                fl->next = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                if (!fl->next)
                        return -ENOMEM;
                fl = fl->next;
                next_free = 0;
        }
-        if (count > PAGE_SIZE)
+        if (count > RTAS_BLK_SIZE)
-                count = PAGE_SIZE;
+                count = RTAS_BLK_SIZE;
-        p = (char *)get_zeroed_page(GFP_KERNEL);
+        p = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
        if (!p)
                return -ENOMEM;
        
        if(copy_from_user(p, buffer, count)) {
-                free_page((unsigned long)p);
+                kmem_cache_free(flash_block_cache, p);
                return -EFAULT;
        }
        fl->blocks[next_free].data = p;
@@ -791,6 +804,16 @@ int __init rtas_flash_init(void)
                goto cleanup;
        rtas_flash_term_hook = rtas_flash_firmware;
+        flash_block_cache = kmem_cache_create("rtas_flash_cache",
+                                RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
+                                rtas_block_ctor, NULL);
+        if (!flash_block_cache) {
+                printk(KERN_ERR "%s: failed to create block cache\n",
+                                __FUNCTION__);
+                rc = -ENOMEM;
+                goto cleanup;
+        }
        return 0;
 cleanup:
@@ -805,6 +828,10 @@ cleanup:
 void __exit rtas_flash_cleanup(void)
 {
        rtas_flash_term_hook = NULL;
+        if (flash_block_cache)
+                kmem_cache_destroy(flash_block_cache);
        remove_flash_pde(firmware_flash_pde);
        remove_flash_pde(firmware_update_pde);
        remove_flash_pde(validate_pde);
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index fd68b74c07c3..506d89768d45 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -491,11 +491,15 @@ static int open_high_hpage_areas(struct mm_struct *mm, u16 newareas)
        return 0;
 }
-int prepare_hugepage_range(unsigned long addr, unsigned long len)
+int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
 {
        int err = 0;
-        if ( (addr+len) < addr )
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
+        if (len & ~HPAGE_MASK)
+                return -EINVAL;
+        if (addr & ~HPAGE_MASK)
                return -EINVAL;
        if (addr < 0x100000000UL)
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index d0fb959e3ef1..7aa809d5a244 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -655,14 +655,19 @@ static int __init spu_map_interrupts(struct spu *spu, struct device_node *np)
        for (i=0; i < 3; i++) {
                ret = of_irq_map_one(np, i, &oirq);
-                if (ret)
+                if (ret) {
+                        pr_debug("spu_new: failed to get irq %d\n", i);
                        goto err;
+                }
                ret = -EINVAL;
+                pr_debug("  irq %d no 0x%x on %s\n", i, oirq.specifier[0],
+                         oirq.controller->full_name);
                spu->irqs[i] = irq_create_of_mapping(oirq.controller,
                                        oirq.specifier, oirq.size);
-                if (spu->irqs[i] == NO_IRQ)
+                if (spu->irqs[i] == NO_IRQ) {
+                        pr_debug("spu_new: failed to map it !\n");
                        goto err;
+                }
        }
        return 0;
@@ -681,7 +686,7 @@ static int spu_map_resource(struct device_node *node, int nr,
        struct resource resource = { };
        int ret;
-        ret = of_address_to_resource(node, 0, &resource);
+        ret = of_address_to_resource(node, nr, &resource);
        if (ret)
                goto out;
@@ -704,22 +709,42 @@ static int __init spu_map_device(struct spu *spu, struct device_node *node)
        ret = spu_map_resource(node, 0, (void __iomem**)&spu->local_store,
                                        &spu->local_store_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 0\n",
+                         node->full_name);
                goto out;
+        }
        ret = spu_map_resource(node, 1, (void __iomem**)&spu->problem,
                                        &spu->problem_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 1\n",
+                         node->full_name);
                goto out_unmap;
+        }
        ret = spu_map_resource(node, 2, (void __iomem**)&spu->priv2,
                                        NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 2\n",
+                         node->full_name);
                goto out_unmap;
+        }
        if (!firmware_has_feature(FW_FEATURE_LPAR))
                ret = spu_map_resource(node, 3, (void __iomem**)&spu->priv1,
                                        NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 3\n",
+                         node->full_name);
                goto out_unmap;
+        }
+        pr_debug("spu_new: %s maps:\n", node->full_name);
+        pr_debug("  local store   : 0x%016lx -> 0x%p\n",
+                 spu->local_store_phys, spu->local_store);
+        pr_debug("  problem state : 0x%016lx -> 0x%p\n",
+                 spu->problem_phys, spu->problem);
+        pr_debug("  priv2         :                       0x%p\n", spu->priv2);
+        pr_debug("  priv1         :                       0x%p\n", spu->priv1);
        return 0;
 out_unmap:
diff --git a/arch/x86_64/boot/setup.S b/arch/x86_64/boot/setup.S
index c3bfd223ab49..770940cc0108 100644
--- a/arch/x86_64/boot/setup.S
+++ b/arch/x86_64/boot/setup.S
@@ -836,13 +836,12 @@ gdt:
        .word   0x9200                          # data read/write
        .word   0x00CF                          # granularity = 4096, 386
                                                #  (+5th nibble of limit)
+gdt_end:
 idt_48:
        .word   0                               # idt limit = 0
        .word   0, 0                            # idt base = 0L
 gdt_48:
-        .word   0x8000                          # gdt limit=2048,
+        .word   gdt_end-gdt-1                   # gdt limit
-                                                #  256 GDT entries
        .word   0, 0                            # gdt base (filled in later)
 # Include video setup & detection code
diff --git a/arch/x86_64/ia32/ptrace32.c b/arch/x86_64/ia32/ptrace32.c
index 3a7561d4703e..04566fe5de49 100644
--- a/arch/x86_64/ia32/ptrace32.c
+++ b/arch/x86_64/ia32/ptrace32.c
@@ -244,6 +244,8 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
        case PTRACE_DETACH:
        case PTRACE_SYSCALL:
        case PTRACE_SETOPTIONS:
+        case PTRACE_SET_THREAD_AREA:
+        case PTRACE_GET_THREAD_AREA:
                return sys_ptrace(request, pid, addr, data); 
        default:
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index a75c829c2b02..6fe191c58084 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -278,7 +278,7 @@ e820_register_active_regions(int nid, unsigned long start_pfn,
                                                                >> PAGE_SHIFT;
                /* Skip map entries smaller than a page */
-                if (ei_startpfn > ei_endpfn)
+                if (ei_startpfn >= ei_endpfn)
                        continue;
                /* Check if end_pfn_map should be updated */
@@ -594,7 +594,9 @@ static int __init parse_memmap_opt(char *p)
                 * size before original memory map is
                 * reset.
                 */
+                e820_register_active_regions(0, 0, -1UL);
                saved_max_pfn = e820_end_of_ram();
+                remove_all_active_ranges();
 #endif
                end_pfn_map = 0;
                e820.nr_map = 0;
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 2b1245d86258..68273bff58cc 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -45,7 +45,13 @@ static void nvidia_bugs(void)
        /*
         * All timer overrides on Nvidia are
         * wrong unless HPET is enabled.
+         * Unfortunately that's not true on many Asus boards.
+         * We don't know yet how to detect this automatically, but
+         * at least allow a command line override.
         */
+        if (acpi_use_timer_override)
+                return;
        nvidia_hpet_detected = 0;
        acpi_table_parse(ACPI_HPET, nvidia_hpet_check);
        if (nvidia_hpet_detected == 0) {
@@ -53,6 +59,8 @@ static void nvidia_bugs(void)
                printk(KERN_INFO "Nvidia board "
                       "detected. Ignoring ACPI "
                       "timer override.\n");
+                printk(KERN_INFO "If you got timer trouble "
+                        "try acpi_use_timer_override\n");
        }
 #endif
        /* RED-PEN skip them on mptables too? */
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 41bfc49301ad..14654e682411 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -790,9 +790,11 @@ static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
                        trigger == IOAPIC_LEVEL)
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                              handle_fasteoi_irq, "fasteoi");
-        else
+        else {
+                irq_desc[irq].status |= IRQ_DELAYED_DISABLE;
                set_irq_chip_and_handler_name(irq, &ioapic_chip,
                                              handle_edge_irq, "edge");
+        }
 }
 static void __init setup_IO_APIC_irqs(void)
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 49f7fac6229e..f6226055d53d 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -88,9 +88,8 @@ void enter_idle(void)
 static void __exit_idle(void)
 {
-        if (read_pda(isidle) == 0)
+        if (test_and_clear_bit_pda(0, isidle) == 0)
                return;
-        write_pda(isidle, 0);
        atomic_notifier_call_chain(&idle_notifier, IDLE_END, NULL);
 }
diff --git a/arch/x86_64/kernel/smp.c b/arch/x86_64/kernel/smp.c
index 4f67697f5036..9f74c883568c 100644
--- a/arch/x86_64/kernel/smp.c
+++ b/arch/x86_64/kernel/smp.c
@@ -376,9 +376,8 @@ int smp_call_function_single (int cpu, void (*func) (void *info), void *info,
        /* prevent preemption and reschedule on another processor */
        int me = get_cpu();
        if (cpu == me) {
-                WARN_ON(1);
                put_cpu();
-                return -EBUSY;
+                return 0;
        }
        spin_lock_bh(&call_lock);
        __smp_call_function_single(cpu, func, info, nonatomic, wait);
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 88722f11ca13..e3ef544d2cfb 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -876,15 +876,6 @@ static struct irqaction irq0 = {
        timer_interrupt, IRQF_DISABLED, CPU_MASK_NONE, "timer", NULL, NULL
 };
-static int __cpuinit
-time_cpu_notifier(struct notifier_block *nb, unsigned long action, void *hcpu)
-{
-        unsigned cpu = (unsigned long) hcpu;
-        if (action == CPU_ONLINE)
-                vsyscall_set_cpu(cpu);
-        return NOTIFY_DONE;
-}
 void __init time_init(void)
 {
        if (nohpet)
@@ -925,8 +916,6 @@ void __init time_init(void)
        vxtime.last_tsc = get_cycles_sync();
        set_cyc2ns_scale(cpu_khz);
        setup_irq(0, &irq0);
-        hotcpu_notifier(time_cpu_notifier, 0);
-        time_cpu_notifier(NULL, CPU_ONLINE, (void *)(long)smp_processor_id());
 #ifndef CONFIG_SMP
        time_init_gtod();
diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c
index a98b460af6a1..a730bacecb0b 100644
--- a/arch/x86_64/kernel/vsyscall.c
+++ b/arch/x86_64/kernel/vsyscall.c
@@ -27,6 +27,9 @@
 #include <linux/jiffies.h>
 #include <linux/sysctl.h>
 #include <linux/getcpu.h>
+#include <linux/cpu.h>
+#include <linux/smp.h>
+#include <linux/notifier.h>
 #include <asm/vsyscall.h>
 #include <asm/pgtable.h>
@@ -243,32 +246,17 @@ static ctl_table kernel_root_table2[] = {
 #endif
-static void __cpuinit write_rdtscp_cb(void *info)
+/* Assume __initcall executes before all user space. Hopefully kmod
-{
+   doesn't violate that. We'll find out if it does. */
-        write_rdtscp_aux((unsigned long)info);
+static void __cpuinit vsyscall_set_cpu(int cpu)
-}
-void __cpuinit vsyscall_set_cpu(int cpu)
 {
        unsigned long *d;
        unsigned long node = 0;
 #ifdef CONFIG_NUMA
        node = cpu_to_node[cpu];
 #endif
-        if (cpu_has(&cpu_data[cpu], X86_FEATURE_RDTSCP)) {
+        if (cpu_has(&cpu_data[cpu], X86_FEATURE_RDTSCP))
-                void *info = (void *)((node << 12) | cpu);
+                write_rdtscp_aux((node << 12) | cpu);
-                /* Can happen on preemptive kernel */
-                if (get_cpu() == cpu)
-                        write_rdtscp_cb(info);
-#ifdef CONFIG_SMP
-                else {
-                        /* the notifier is unfortunately not executed on the
-                           target CPU */
-                        smp_call_function_single(cpu,write_rdtscp_cb,info,0,1);
-                }
-#endif
-                put_cpu();
-        }
        /* Store cpu number in limit so that it can be loaded quickly
           in user space in vgetcpu.
@@ -280,6 +268,21 @@ void __cpuinit vsyscall_set_cpu(int cpu)
        *d |= (node >> 4) << 48;
 }
+static void __cpuinit cpu_vsyscall_init(void *arg)
+{
+        /* preemption should be already off */
+        vsyscall_set_cpu(raw_smp_processor_id());
+}
+static int __cpuinit
+cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
+{
+        long cpu = (long)arg;
+        if (action == CPU_ONLINE)
+                smp_call_function_single(cpu, cpu_vsyscall_init, NULL, 0, 1);
+        return NOTIFY_DONE;
+}
 static void __init map_vsyscall(void)
 {
        extern char __vsyscall_0;
@@ -299,6 +302,8 @@ static int __init vsyscall_init(void)
 #ifdef CONFIG_SYSCTL
        register_sysctl_table(kernel_root_table2, 0);
 #endif
+        on_each_cpu(cpu_vsyscall_init, NULL, 0, 1);
+        hotcpu_notifier(cpu_vsyscall_notifier, 0);
        return 0;
 }
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 971dc1181e69..f1f977aafae1 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -655,9 +655,22 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 void __init reserve_bootmem_generic(unsigned long phys, unsigned len) 
 { 
-        /* Should check here against the e820 map to avoid double free */ 
 #ifdef CONFIG_NUMA
        int nid = phys_to_nid(phys);
+#endif
+        unsigned long pfn = phys >> PAGE_SHIFT;
+        if (pfn >= end_pfn) {
+                /* This can happen with kdump kernels when accessing firmware
+                   tables. */
+                if (pfn < end_pfn_map)
+                        return;
+                printk(KERN_ERR "reserve_bootmem: illegal reserve %lx %u\n",
+                                phys, len);
+                return;
+        }
+        /* Should check here against the e820 map to avoid double free */
+#ifdef CONFIG_NUMA
        reserve_bootmem_node(NODE_DATA(nid), phys, len);
 #else                   
        reserve_bootmem(phys, len);    
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index e61093b34c26..f8b6b2800a62 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -163,37 +163,6 @@ static __init void unreachable_devices(void)
        }
 }
-static __init void pci_mmcfg_insert_resources(void)
-{
-#define PCI_MMCFG_RESOURCE_NAME_LEN 19
-        int i;
-        struct resource *res;
-        char *names;
-        unsigned num_buses;
-        res = kcalloc(PCI_MMCFG_RESOURCE_NAME_LEN + sizeof(*res),
-                        pci_mmcfg_config_num, GFP_KERNEL);
-        if (!res) {
-                printk(KERN_ERR "PCI: Unable to allocate MMCONFIG resources\n");
-                return;
-        }
-        names = (void *)&res[pci_mmcfg_config_num];
-        for (i = 0; i < pci_mmcfg_config_num; i++, res++) {
-                num_buses = pci_mmcfg_config[i].end_bus_number -
-                    pci_mmcfg_config[i].start_bus_number + 1;
-                res->name = names;
-                snprintf(names, PCI_MMCFG_RESOURCE_NAME_LEN, "PCI MMCONFIG %u",
-                        pci_mmcfg_config[i].pci_segment_group_number);
-                res->start = pci_mmcfg_config[i].base_address;
-                res->end = res->start + (num_buses << 20) - 1;
-                res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
-                insert_resource(&iomem_resource, res);
-                names += PCI_MMCFG_RESOURCE_NAME_LEN;
-        }
-}
 void __init pci_mmcfg_init(int type)
 {
        int i;
@@ -237,7 +206,6 @@ void __init pci_mmcfg_init(int type)
        }
        unreachable_devices();
-        pci_mmcfg_insert_resources();
        raw_pci_ops = &pci_mmcfg;
        pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;