diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 5bd90a7..f0b5ff1 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -419,7 +419,7 @@
 	 * For the moment only implement delivery to all cpus or one cpu.
 	 * Get current irq_server for the given irq
 	 */
-	irq_server = get_irq_server(irq, 1);
+	irq_server = get_irq_server(virq, 1);
 	if (irq_server == -1) {
 		char cpulist[128];
 		cpumask_scnprintf(cpulist, sizeof(cpulist), cpumask);
diff --git a/arch/sparc/kernel/ebus.c b/arch/sparc/kernel/ebus.c
index e2d02fd..d850785 100644
--- a/arch/sparc/kernel/ebus.c
+++ b/arch/sparc/kernel/ebus.c
@@ -156,6 +156,8 @@
 	dev->prom_node = dp;
 
 	regs = of_get_property(dp, "reg", &len);
+	if (!regs)
+		len = 0;
 	if (len % sizeof(struct linux_prom_registers)) {
 		prom_printf("UGH: proplen for %s was %d, need multiple of %d\n",
 			    dev->prom_node->name, len,
diff --git a/arch/sparc64/kernel/binfmt_aout32.c b/arch/sparc64/kernel/binfmt_aout32.c
index f205fc7..d208cc7 100644
--- a/arch/sparc64/kernel/binfmt_aout32.c
+++ b/arch/sparc64/kernel/binfmt_aout32.c
@@ -177,7 +177,7 @@
 			get_user(c,p++);
 		} while (c);
 	}
-	put_user(NULL,argv);
+	put_user(0,argv);
 	current->mm->arg_end = current->mm->env_start = (unsigned long) p;
 	while (envc-->0) {
 		char c;
@@ -186,7 +186,7 @@
 			get_user(c,p++);
 		} while (c);
 	}
-	put_user(NULL,envp);
+	put_user(0,envp);
 	current->mm->env_end = (unsigned long) p;
 	return sp;
 }
diff --git a/arch/sparc64/kernel/ebus.c b/arch/sparc64/kernel/ebus.c
index bc9ae36..04ab81c 100644
--- a/arch/sparc64/kernel/ebus.c
+++ b/arch/sparc64/kernel/ebus.c
@@ -375,7 +375,10 @@
 		dev->num_addrs = 0;
 		dev->num_irqs = 0;
 	} else {
-		(void) of_get_property(dp, "reg", &len);
+		const int *regs = of_get_property(dp, "reg", &len);
+
+		if (!regs)
+			len = 0;
 		dev->num_addrs = len / sizeof(struct linux_prom_registers);
 
 		for (i = 0; i < dev->num_addrs; i++)
diff --git a/arch/sparc64/lib/NGcopy_from_user.S b/arch/sparc64/lib/NGcopy_from_user.S
index 2d93456..e7f433f 100644
--- a/arch/sparc64/lib/NGcopy_from_user.S
+++ b/arch/sparc64/lib/NGcopy_from_user.S
@@ -1,6 +1,6 @@
 /* NGcopy_from_user.S: Niagara optimized copy from userspace.
  *
- * Copyright (C) 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
 #define EX_LD(x)		\
@@ -8,8 +8,8 @@
 	.section .fixup;	\
 	.align 4;		\
 99:	wr	%g0, ASI_AIUS, %asi;\
-	retl;			\
-	 mov	1, %o0;		\
+	ret;			\
+	 restore %g0, 1, %o0;	\
 	.section __ex_table,"a";\
 	.align 4;		\
 	.word 98b, 99b;		\
@@ -24,7 +24,7 @@
 #define LOAD(type,addr,dest)	type##a [addr] ASI_AIUS, dest
 #define LOAD_TWIN(addr_reg,dest0,dest1)	\
 	ldda [addr_reg] ASI_BLK_INIT_QUAD_LDD_AIUS, dest0
-#define EX_RETVAL(x)		0
+#define EX_RETVAL(x)		%g0
 
 #ifdef __KERNEL__
 #define PREAMBLE					\
diff --git a/arch/sparc64/lib/NGcopy_to_user.S b/arch/sparc64/lib/NGcopy_to_user.S
index 34112d5..6ea01c5 100644
--- a/arch/sparc64/lib/NGcopy_to_user.S
+++ b/arch/sparc64/lib/NGcopy_to_user.S
@@ -1,6 +1,6 @@
 /* NGcopy_to_user.S: Niagara optimized copy to userspace.
  *
- * Copyright (C) 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
 #define EX_ST(x)		\
@@ -8,8 +8,8 @@
 	.section .fixup;	\
 	.align 4;		\
 99:	wr	%g0, ASI_AIUS, %asi;\
-	retl;			\
-	 mov	1, %o0;		\
+	ret;			\
+	 restore %g0, 1, %o0;	\
 	.section __ex_table,"a";\
 	.align 4;		\
 	.word 98b, 99b;		\
@@ -23,7 +23,7 @@
 #define FUNC_NAME		NGcopy_to_user
 #define STORE(type,src,addr)	type##a src, [addr] ASI_AIUS
 #define STORE_ASI		ASI_BLK_INIT_QUAD_LDD_AIUS
-#define EX_RETVAL(x)		0
+#define EX_RETVAL(x)		%g0
 
 #ifdef __KERNEL__
 	/* Writing to %asi is _expensive_ so we hardcode it.
diff --git a/arch/sparc64/lib/NGmemcpy.S b/arch/sparc64/lib/NGmemcpy.S
index 66063a9..605cb3f 100644
--- a/arch/sparc64/lib/NGmemcpy.S
+++ b/arch/sparc64/lib/NGmemcpy.S
@@ -1,6 +1,6 @@
 /* NGmemcpy.S: Niagara optimized memcpy.
  *
- * Copyright (C) 2006 David S. Miller (davem@davemloft.net)
+ * Copyright (C) 2006, 2007 David S. Miller (davem@davemloft.net)
  */
 
 #ifdef __KERNEL__
@@ -16,6 +16,12 @@
 	wr	%g0, ASI_PNF, %asi
 #endif
 
+#ifdef __sparc_v9__
+#define SAVE_AMOUNT	128
+#else
+#define SAVE_AMOUNT	64
+#endif
+
 #ifndef STORE_ASI
 #define STORE_ASI	ASI_BLK_INIT_QUAD_LDD_P
 #endif
@@ -50,7 +56,11 @@
 #endif
 
 #ifndef STORE_INIT
+#ifndef SIMULATE_NIAGARA_ON_NON_NIAGARA
 #define STORE_INIT(src,addr)	stxa src, [addr] %asi
+#else
+#define STORE_INIT(src,addr)	stx src, [addr + 0x00]
+#endif
 #endif
 
 #ifndef FUNC_NAME
@@ -73,18 +83,19 @@
 
 	.globl	FUNC_NAME
 	.type	FUNC_NAME,#function
-FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
-	srlx		%o2, 31, %g2
+FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
+	PREAMBLE
+	save		%sp, -SAVE_AMOUNT, %sp
+	srlx		%i2, 31, %g2
 	cmp		%g2, 0
 	tne		%xcc, 5
-	PREAMBLE
-	mov		%o0, GLOBAL_SPARE
-	cmp		%o2, 0
+	mov		%i0, %o0
+	cmp		%i2, 0
 	be,pn		%XCC, 85f
-	 or		%o0, %o1, %o3
-	cmp		%o2, 16
+	 or		%o0, %i1, %i3
+	cmp		%i2, 16
 	blu,a,pn	%XCC, 80f
-	 or		%o3, %o2, %o3
+	 or		%i3, %i2, %i3
 
 	/* 2 blocks (128 bytes) is the minimum we can do the block
 	 * copy with.  We need to ensure that we'll iterate at least
@@ -93,31 +104,31 @@
 	 * to (64 - 1) bytes from the length before we perform the
 	 * block copy loop.
 	 */
-	cmp		%o2, (2 * 64)
+	cmp		%i2, (2 * 64)
 	blu,pt		%XCC, 70f
-	 andcc		%o3, 0x7, %g0
+	 andcc		%i3, 0x7, %g0
 
 	/* %o0:	dst
-	 * %o1:	src
-	 * %o2:	len  (known to be >= 128)
+	 * %i1:	src
+	 * %i2:	len  (known to be >= 128)
 	 *
-	 * The block copy loops will use %o4/%o5,%g2/%g3 as
+	 * The block copy loops will use %i4/%i5,%g2/%g3 as
 	 * temporaries while copying the data.
 	 */
 
-	LOAD(prefetch, %o1, #one_read)
+	LOAD(prefetch, %i1, #one_read)
 	wr		%g0, STORE_ASI, %asi
 
 	/* Align destination on 64-byte boundary.  */
-	andcc		%o0, (64 - 1), %o4
+	andcc		%o0, (64 - 1), %i4
 	be,pt		%XCC, 2f
-	 sub		%o4, 64, %o4
-	sub		%g0, %o4, %o4	! bytes to align dst
-	sub		%o2, %o4, %o2
-1:	subcc		%o4, 1, %o4
-	EX_LD(LOAD(ldub, %o1, %g1))
+	 sub		%i4, 64, %i4
+	sub		%g0, %i4, %i4	! bytes to align dst
+	sub		%i2, %i4, %i2
+1:	subcc		%i4, 1, %i4
+	EX_LD(LOAD(ldub, %i1, %g1))
 	EX_ST(STORE(stb, %g1, %o0))
-	add		%o1, 1, %o1
+	add		%i1, 1, %i1
 	bne,pt		%XCC, 1b
 	add		%o0, 1, %o0
 
@@ -136,111 +147,155 @@
 	 * aligned store data at a time, this is easy to ensure.
 	 */
 2:
-	andcc		%o1, (16 - 1), %o4
-	andn		%o2, (64 - 1), %g1	! block copy loop iterator
-	sub		%o2, %g1, %o2		! final sub-block copy bytes
+	andcc		%i1, (16 - 1), %i4
+	andn		%i2, (64 - 1), %g1	! block copy loop iterator
 	be,pt		%XCC, 50f
-	 cmp		%o4, 8
-	be,a,pt		%XCC, 10f
-	 sub		%o1, 0x8, %o1
+	 sub		%i2, %g1, %i2		! final sub-block copy bytes
+
+	cmp		%i4, 8
+	be,pt		%XCC, 10f
+	 sub		%i1, %i4, %i1
 
 	/* Neither 8-byte nor 16-byte aligned, shift and mask.  */
-	mov		%g1, %o4
-	and		%o1, 0x7, %g1
-	sll		%g1, 3, %g1
-	mov		64, %o3
-	andn		%o1, 0x7, %o1
-	EX_LD(LOAD(ldx, %o1, %g2))
-	sub		%o3, %g1, %o3
-	sllx		%g2, %g1, %g2
+	and		%i4, 0x7, GLOBAL_SPARE
+	sll		GLOBAL_SPARE, 3, GLOBAL_SPARE
+	mov		64, %i5
+	EX_LD(LOAD_TWIN(%i1, %g2, %g3))
+	sub		%i5, GLOBAL_SPARE, %i5
+	mov		16, %o4
+	mov		32, %o5
+	mov		48, %o7
+	mov		64, %i3
 
-#define SWIVEL_ONE_DWORD(SRC, TMP1, TMP2, PRE_VAL, PRE_SHIFT, POST_SHIFT, DST)\
-	EX_LD(LOAD(ldx, SRC, TMP1)); \
-	srlx		TMP1, PRE_SHIFT, TMP2; \
-	or		TMP2, PRE_VAL, TMP2; \
-	EX_ST(STORE_INIT(TMP2, DST)); \
-	sllx		TMP1, POST_SHIFT, PRE_VAL;
+	bg,pn	   	%XCC, 9f
+	 nop
 
-1:	add		%o1, 0x8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x00)
-	add		%o1, 0x8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x08)
-	add		%o1, 0x8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x10)
-	add		%o1, 0x8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x18)
-	add		%o1, 32, %o1
-	LOAD(prefetch, %o1, #one_read)
-	sub		%o1, 32 - 8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x20)
-	add		%o1, 8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x28)
-	add		%o1, 8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x30)
-	add		%o1, 8, %o1
-	SWIVEL_ONE_DWORD(%o1, %g3, %o5, %g2, %o3, %g1, %o0 + 0x38)
-	subcc		%o4, 64, %o4
-	bne,pt		%XCC, 1b
+#define MIX_THREE_WORDS(WORD1, WORD2, WORD3, PRE_SHIFT, POST_SHIFT, TMP) \
+	sllx		WORD1, POST_SHIFT, WORD1; \
+	srlx		WORD2, PRE_SHIFT, TMP; \
+	sllx		WORD2, POST_SHIFT, WORD2; \
+	or		WORD1, TMP, WORD1; \
+	srlx		WORD3, PRE_SHIFT, TMP; \
+	or		WORD2, TMP, WORD2;
+
+8:	EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3))
+	MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1)
+	LOAD(prefetch, %i1 + %i3, #one_read)
+
+	EX_ST(STORE_INIT(%g2, %o0 + 0x00))
+	EX_ST(STORE_INIT(%g3, %o0 + 0x08))
+
+	EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3))
+	MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1)
+
+	EX_ST(STORE_INIT(%o2, %o0 + 0x10))
+	EX_ST(STORE_INIT(%o3, %o0 + 0x18))
+
+	EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+	MIX_THREE_WORDS(%g2, %g3, %o2, %i5, GLOBAL_SPARE, %o1)
+
+	EX_ST(STORE_INIT(%g2, %o0 + 0x20))
+	EX_ST(STORE_INIT(%g3, %o0 + 0x28))
+
+	EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3))
+	add		%i1, 64, %i1
+	MIX_THREE_WORDS(%o2, %o3, %g2, %i5, GLOBAL_SPARE, %o1)
+
+	EX_ST(STORE_INIT(%o2, %o0 + 0x30))
+	EX_ST(STORE_INIT(%o3, %o0 + 0x38))
+
+	subcc		%g1, 64, %g1
+	bne,pt		%XCC, 8b
 	 add		%o0, 64, %o0
 
-#undef SWIVEL_ONE_DWORD
-
-	srl		%g1, 3, %g1
 	ba,pt		%XCC, 60f
-	 add		%o1, %g1, %o1
+	 add		%i1, %i4, %i1
+
+9:	EX_LD(LOAD_TWIN(%i1 + %o4, %o2, %o3))
+	MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1)
+	LOAD(prefetch, %i1 + %i3, #one_read)
+
+	EX_ST(STORE_INIT(%g3, %o0 + 0x00))
+	EX_ST(STORE_INIT(%o2, %o0 + 0x08))
+
+	EX_LD(LOAD_TWIN(%i1 + %o5, %g2, %g3))
+	MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1)
+
+	EX_ST(STORE_INIT(%o3, %o0 + 0x10))
+	EX_ST(STORE_INIT(%g2, %o0 + 0x18))
+
+	EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+	MIX_THREE_WORDS(%g3, %o2, %o3, %i5, GLOBAL_SPARE, %o1)
+
+	EX_ST(STORE_INIT(%g3, %o0 + 0x20))
+	EX_ST(STORE_INIT(%o2, %o0 + 0x28))
+
+	EX_LD(LOAD_TWIN(%i1 + %i3, %g2, %g3))
+	add		%i1, 64, %i1
+	MIX_THREE_WORDS(%o3, %g2, %g3, %i5, GLOBAL_SPARE, %o1)
+
+	EX_ST(STORE_INIT(%o3, %o0 + 0x30))
+	EX_ST(STORE_INIT(%g2, %o0 + 0x38))
+
+	subcc		%g1, 64, %g1
+	bne,pt		%XCC, 9b
+	 add		%o0, 64, %o0
+
+	ba,pt		%XCC, 60f
+	 add		%i1, %i4, %i1
 
 10:	/* Destination is 64-byte aligned, source was only 8-byte
 	 * aligned but it has been subtracted by 8 and we perform
 	 * one twin load ahead, then add 8 back into source when
 	 * we finish the loop.
 	 */
-	EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-1:	add		%o1, 16, %o1
-	EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-	add		%o1, 16 + 32, %o1
-	LOAD(prefetch, %o1, #one_read)
-	sub		%o1, 32, %o1
+	EX_LD(LOAD_TWIN(%i1, %o4, %o5))
+	mov	16, %o7
+	mov	32, %g2
+	mov	48, %g3
+	mov	64, %o1
+1:	EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+	LOAD(prefetch, %i1 + %o1, #one_read)
 	EX_ST(STORE_INIT(%o5, %o0 + 0x00))	! initializes cache line
-	EX_ST(STORE_INIT(%g2, %o0 + 0x08))
-	EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-	add		%o1, 16, %o1
-	EX_ST(STORE_INIT(%g3, %o0 + 0x10))
+	EX_ST(STORE_INIT(%o2, %o0 + 0x08))
+	EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5))
+	EX_ST(STORE_INIT(%o3, %o0 + 0x10))
 	EX_ST(STORE_INIT(%o4, %o0 + 0x18))
-	EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-	add		%o1, 16, %o1
+	EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3))
 	EX_ST(STORE_INIT(%o5, %o0 + 0x20))
-	EX_ST(STORE_INIT(%g2, %o0 + 0x28))
-	EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-	EX_ST(STORE_INIT(%g3, %o0 + 0x30))
+	EX_ST(STORE_INIT(%o2, %o0 + 0x28))
+	EX_LD(LOAD_TWIN(%i1 + %o1, %o4, %o5))
+	add		%i1, 64, %i1
+	EX_ST(STORE_INIT(%o3, %o0 + 0x30))
 	EX_ST(STORE_INIT(%o4, %o0 + 0x38))
 	subcc		%g1, 64, %g1
 	bne,pt		%XCC, 1b
 	 add		%o0, 64, %o0
 
 	ba,pt		%XCC, 60f
-	 add		%o1, 0x8, %o1
+	 add		%i1, 0x8, %i1
 
 50:	/* Destination is 64-byte aligned, and source is 16-byte
 	 * aligned.
 	 */
-1:	EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-	add	%o1, 16, %o1
-	EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-	add	%o1, 16 + 32, %o1
-	LOAD(prefetch, %o1, #one_read)
-	sub	%o1, 32, %o1
+	mov	16, %o7
+	mov	32, %g2
+	mov	48, %g3
+	mov	64, %o1
+1:	EX_LD(LOAD_TWIN(%i1 + %g0, %o4, %o5))
+	EX_LD(LOAD_TWIN(%i1 + %o7, %o2, %o3))
+	LOAD(prefetch, %i1 + %o1, #one_read)
 	EX_ST(STORE_INIT(%o4, %o0 + 0x00))	! initializes cache line
 	EX_ST(STORE_INIT(%o5, %o0 + 0x08))
-	EX_LD(LOAD_TWIN(%o1, %o4, %o5))
-	add	%o1, 16, %o1
-	EX_ST(STORE_INIT(%g2, %o0 + 0x10))
-	EX_ST(STORE_INIT(%g3, %o0 + 0x18))
-	EX_LD(LOAD_TWIN(%o1, %g2, %g3))
-	add	%o1, 16, %o1
+	EX_LD(LOAD_TWIN(%i1 + %g2, %o4, %o5))
+	EX_ST(STORE_INIT(%o2, %o0 + 0x10))
+	EX_ST(STORE_INIT(%o3, %o0 + 0x18))
+	EX_LD(LOAD_TWIN(%i1 + %g3, %o2, %o3))
+	add	%i1, 64, %i1
 	EX_ST(STORE_INIT(%o4, %o0 + 0x20))
 	EX_ST(STORE_INIT(%o5, %o0 + 0x28))
-	EX_ST(STORE_INIT(%g2, %o0 + 0x30))
-	EX_ST(STORE_INIT(%g3, %o0 + 0x38))
+	EX_ST(STORE_INIT(%o2, %o0 + 0x30))
+	EX_ST(STORE_INIT(%o3, %o0 + 0x38))
 	subcc	%g1, 64, %g1
 	bne,pt	%XCC, 1b
 	 add	%o0, 64, %o0
@@ -249,47 +304,47 @@
 60:	
 	membar		#Sync
 
-	/* %o2 contains any final bytes still needed to be copied
+	/* %i2 contains any final bytes still needed to be copied
 	 * over. If anything is left, we copy it one byte at a time.
 	 */
-	RESTORE_ASI(%o3)
-	brz,pt		%o2, 85f
-	 sub		%o0, %o1, %o3
+	RESTORE_ASI(%i3)
+	brz,pt		%i2, 85f
+	 sub		%o0, %i1, %i3
 	ba,a,pt		%XCC, 90f
 
 	.align		64
 70: /* 16 < len <= 64 */
 	bne,pn		%XCC, 75f
-	 sub		%o0, %o1, %o3
+	 sub		%o0, %i1, %i3
 
 72:
-	andn		%o2, 0xf, %o4
-	and		%o2, 0xf, %o2
-1:	subcc		%o4, 0x10, %o4
-	EX_LD(LOAD(ldx, %o1, %o5))
-	add		%o1, 0x08, %o1
-	EX_LD(LOAD(ldx, %o1, %g1))
-	sub		%o1, 0x08, %o1
-	EX_ST(STORE(stx, %o5, %o1 + %o3))
-	add		%o1, 0x8, %o1
-	EX_ST(STORE(stx, %g1, %o1 + %o3))
+	andn		%i2, 0xf, %i4
+	and		%i2, 0xf, %i2
+1:	subcc		%i4, 0x10, %i4
+	EX_LD(LOAD(ldx, %i1, %i5))
+	add		%i1, 0x08, %i1
+	EX_LD(LOAD(ldx, %i1, %g1))
+	sub		%i1, 0x08, %i1
+	EX_ST(STORE(stx, %i5, %i1 + %i3))
+	add		%i1, 0x8, %i1
+	EX_ST(STORE(stx, %g1, %i1 + %i3))
 	bgu,pt		%XCC, 1b
-	 add		%o1, 0x8, %o1
-73:	andcc		%o2, 0x8, %g0
+	 add		%i1, 0x8, %i1
+73:	andcc		%i2, 0x8, %g0
 	be,pt		%XCC, 1f
 	 nop
-	sub		%o2, 0x8, %o2
-	EX_LD(LOAD(ldx, %o1, %o5))
-	EX_ST(STORE(stx, %o5, %o1 + %o3))
-	add		%o1, 0x8, %o1
-1:	andcc		%o2, 0x4, %g0
+	sub		%i2, 0x8, %i2
+	EX_LD(LOAD(ldx, %i1, %i5))
+	EX_ST(STORE(stx, %i5, %i1 + %i3))
+	add		%i1, 0x8, %i1
+1:	andcc		%i2, 0x4, %g0
 	be,pt		%XCC, 1f
 	 nop
-	sub		%o2, 0x4, %o2
-	EX_LD(LOAD(lduw, %o1, %o5))
-	EX_ST(STORE(stw, %o5, %o1 + %o3))
-	add		%o1, 0x4, %o1
-1:	cmp		%o2, 0
+	sub		%i2, 0x4, %i2
+	EX_LD(LOAD(lduw, %i1, %i5))
+	EX_ST(STORE(stw, %i5, %i1 + %i3))
+	add		%i1, 0x4, %i1
+1:	cmp		%i2, 0
 	be,pt		%XCC, 85f
 	 nop
 	ba,pt		%xcc, 90f
@@ -300,71 +355,71 @@
 	sub		%g1, 0x8, %g1
 	be,pn		%icc, 2f
 	 sub		%g0, %g1, %g1
-	sub		%o2, %g1, %o2
+	sub		%i2, %g1, %i2
 
 1:	subcc		%g1, 1, %g1
-	EX_LD(LOAD(ldub, %o1, %o5))
-	EX_ST(STORE(stb, %o5, %o1 + %o3))
+	EX_LD(LOAD(ldub, %i1, %i5))
+	EX_ST(STORE(stb, %i5, %i1 + %i3))
 	bgu,pt		%icc, 1b
-	 add		%o1, 1, %o1
+	 add		%i1, 1, %i1
 
-2:	add		%o1, %o3, %o0
-	andcc		%o1, 0x7, %g1
+2:	add		%i1, %i3, %o0
+	andcc		%i1, 0x7, %g1
 	bne,pt		%icc, 8f
 	 sll		%g1, 3, %g1
 
-	cmp		%o2, 16
+	cmp		%i2, 16
 	bgeu,pt		%icc, 72b
 	 nop
 	ba,a,pt		%xcc, 73b
 
-8:	mov		64, %o3
-	andn		%o1, 0x7, %o1
-	EX_LD(LOAD(ldx, %o1, %g2))
-	sub		%o3, %g1, %o3
-	andn		%o2, 0x7, %o4
+8:	mov		64, %i3
+	andn		%i1, 0x7, %i1
+	EX_LD(LOAD(ldx, %i1, %g2))
+	sub		%i3, %g1, %i3
+	andn		%i2, 0x7, %i4
 	sllx		%g2, %g1, %g2
-1:	add		%o1, 0x8, %o1
-	EX_LD(LOAD(ldx, %o1, %g3))
-	subcc		%o4, 0x8, %o4
-	srlx		%g3, %o3, %o5
-	or		%o5, %g2, %o5
-	EX_ST(STORE(stx, %o5, %o0))
+1:	add		%i1, 0x8, %i1
+	EX_LD(LOAD(ldx, %i1, %g3))
+	subcc		%i4, 0x8, %i4
+	srlx		%g3, %i3, %i5
+	or		%i5, %g2, %i5
+	EX_ST(STORE(stx, %i5, %o0))
 	add		%o0, 0x8, %o0
 	bgu,pt		%icc, 1b
 	 sllx		%g3, %g1, %g2
 
 	srl		%g1, 3, %g1
-	andcc		%o2, 0x7, %o2
+	andcc		%i2, 0x7, %i2
 	be,pn		%icc, 85f
-	 add		%o1, %g1, %o1
+	 add		%i1, %g1, %i1
 	ba,pt		%xcc, 90f
-	 sub		%o0, %o1, %o3
+	 sub		%o0, %i1, %i3
 
 	.align		64
 80: /* 0 < len <= 16 */
-	andcc		%o3, 0x3, %g0
+	andcc		%i3, 0x3, %g0
 	bne,pn		%XCC, 90f
-	 sub		%o0, %o1, %o3
+	 sub		%o0, %i1, %i3
 
 1:
-	subcc		%o2, 4, %o2
-	EX_LD(LOAD(lduw, %o1, %g1))
-	EX_ST(STORE(stw, %g1, %o1 + %o3))
+	subcc		%i2, 4, %i2
+	EX_LD(LOAD(lduw, %i1, %g1))
+	EX_ST(STORE(stw, %g1, %i1 + %i3))
 	bgu,pt		%XCC, 1b
-	 add		%o1, 4, %o1
+	 add		%i1, 4, %i1
 
-85:	retl
-	 mov		EX_RETVAL(GLOBAL_SPARE), %o0
+85:	ret
+	 restore	EX_RETVAL(%i0), %g0, %o0
 
 	.align		32
 90:
-	subcc		%o2, 1, %o2
-	EX_LD(LOAD(ldub, %o1, %g1))
-	EX_ST(STORE(stb, %g1, %o1 + %o3))
+	subcc		%i2, 1, %i2
+	EX_LD(LOAD(ldub, %i1, %g1))
+	EX_ST(STORE(stb, %g1, %i1 + %i3))
 	bgu,pt		%XCC, 90b
-	 add		%o1, 1, %o1
-	retl
-	 mov		EX_RETVAL(GLOBAL_SPARE), %o0
+	 add		%i1, 1, %i1
+	ret
+	 restore	EX_RETVAL(%i0), %g0, %o0
 
 	.size		FUNC_NAME, .-FUNC_NAME
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 3b8bf18..6996eb5 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -921,6 +921,13 @@
 {
 	static struct dmi_system_id sysids[] = {
 		{
+			.ident = "TECRA M3",
+			.matches = {
+				DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+				DMI_MATCH(DMI_PRODUCT_NAME, "TECRA M3"),
+			},
+		},
+		{
 			.ident = "TECRA M5",
 			.matches = {
 				DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 397c714..af274e5 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1550,11 +1550,13 @@
 	 *	As close as possible to RFC 793, which
 	 *	suggests using a 250 kHz clock.
 	 *	Further reading shows this assumes 2 Mb/s networks.
-	 *	For 10 Gb/s Ethernet, a 1 GHz clock is appropriate.
-	 *	That's funny, Linux has one built in!  Use it!
-	 *	(Networks are faster now - should this be increased?)
+	 *	For 10 Mb/s Ethernet, a 1 MHz clock is appropriate.
+	 *	For 10 Gb/s Ethernet, a 1 GHz clock should be ok, but
+	 *	we also need to limit the resolution so that the u32 seq
+	 *	overlaps less than one time per MSL (2 minutes).
+	 *	Choosing a clock of 64 ns period is OK. (period of 274 s)
 	 */
-	seq += ktime_get_real().tv64;
+	seq += ktime_get_real().tv64 >> 6;
 #if 0
 	printk("init_seq(%lx, %lx, %d, %d) = %d\n",
 	       saddr, daddr, sport, dport, seq);
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index c9fbe8e..67c67a8 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -639,6 +639,16 @@
 
 		se->block_start = 0;
 		se->sum_sleep_runtime += delta;
+
+		/*
+		 * Blocking time is in units of nanosecs, so shift by 20 to
+		 * get a milliseconds-range estimation of the amount of
+		 * time that the task spent sleeping:
+		 */
+		if (unlikely(prof_on == SLEEP_PROFILING)) {
+			profile_hits(SLEEP_PROFILING, (void *)get_wchan(tsk),
+				     delta >> 20);
+		}
 	}
 #endif
 }
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index f2de2e4..6284c99b 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -366,6 +366,12 @@
 	frag = WLAN_GET_SEQ_FRAG(sc);
 	hdrlen = ieee80211_get_hdrlen(fc);
 
+	if (skb->len < hdrlen) {
+		printk(KERN_INFO "%s: invalid SKB length %d\n",
+			dev->name, skb->len);
+		goto rx_dropped;
+	}
+
 	/* Put this code here so that we avoid duplicating it in all
 	 * Rx paths. - Jean II */
 #ifdef CONFIG_WIRELESS_EXT
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 3a23e30..b542c87 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/ipv6.h>
 #include <linux/skbuff.h>
+#include <linux/jhash.h>
 #include <net/ip.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
@@ -95,7 +96,7 @@
 
 /* Variables */
 	struct timer_list perturb_timer;
-	int		perturbation;
+	u32		perturbation;
 	sfq_index	tail;		/* Index of current slot in round */
 	sfq_index	max_depth;	/* Maximal depth */
 
@@ -109,12 +110,7 @@
 
 static __inline__ unsigned sfq_fold_hash(struct sfq_sched_data *q, u32 h, u32 h1)
 {
-	int pert = q->perturbation;
-
-	/* Have we any rotation primitives? If not, WHY? */
-	h ^= (h1<<pert) ^ (h1>>(0x1F - pert));
-	h ^= h>>10;
-	return h & 0x3FF;
+	return jhash_2words(h, h1, q->perturbation) & (SFQ_HASH_DIVISOR - 1);
 }
 
 static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
@@ -256,6 +252,13 @@
 		q->ht[hash] = x = q->dep[SFQ_DEPTH].next;
 		q->hash[x] = hash;
 	}
+	/* If selected queue has length q->limit, this means that
+	 * all another queues are empty and that we do simple tail drop,
+	 * i.e. drop _this_ packet.
+	 */
+	if (q->qs[x].qlen >= q->limit)
+		return qdisc_drop(skb, sch);
+
 	sch->qstats.backlog += skb->len;
 	__skb_queue_tail(&q->qs[x], skb);
 	sfq_inc(q, x);
@@ -294,6 +297,19 @@
 	}
 	sch->qstats.backlog += skb->len;
 	__skb_queue_head(&q->qs[x], skb);
+	/* If selected queue has length q->limit+1, this means that
+	 * all another queues are empty and we do simple tail drop.
+	 * This packet is still requeued at head of queue, tail packet
+	 * is dropped.
+	 */
+	if (q->qs[x].qlen > q->limit) {
+		skb = q->qs[x].prev;
+		__skb_unlink(skb, &q->qs[x]);
+		sch->qstats.drops++;
+		sch->qstats.backlog -= skb->len;
+		kfree_skb(skb);
+		return NET_XMIT_CN;
+	}
 	sfq_inc(q, x);
 	if (q->qs[x].qlen == 1) {		/* The flow is new */
 		if (q->tail == SFQ_DEPTH) {	/* It is the first flow */
@@ -370,12 +386,10 @@
 	struct Qdisc *sch = (struct Qdisc*)arg;
 	struct sfq_sched_data *q = qdisc_priv(sch);
 
-	q->perturbation = net_random()&0x1F;
+	get_random_bytes(&q->perturbation, 4);
 
-	if (q->perturb_period) {
-		q->perturb_timer.expires = jiffies + q->perturb_period;
-		add_timer(&q->perturb_timer);
-	}
+	if (q->perturb_period)
+		mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
 }
 
 static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
@@ -391,7 +405,7 @@
 	q->quantum = ctl->quantum ? : psched_mtu(sch->dev);
 	q->perturb_period = ctl->perturb_period*HZ;
 	if (ctl->limit)
-		q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 2);
+		q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 1);
 
 	qlen = sch->q.qlen;
 	while (sch->q.qlen > q->limit)
@@ -400,8 +414,8 @@
 
 	del_timer(&q->perturb_timer);
 	if (q->perturb_period) {
-		q->perturb_timer.expires = jiffies + q->perturb_period;
-		add_timer(&q->perturb_timer);
+		mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
+		get_random_bytes(&q->perturbation, 4);
 	}
 	sch_tree_unlock(sch);
 	return 0;
@@ -423,12 +437,13 @@
 		q->dep[i+SFQ_DEPTH].next = i+SFQ_DEPTH;
 		q->dep[i+SFQ_DEPTH].prev = i+SFQ_DEPTH;
 	}
-	q->limit = SFQ_DEPTH - 2;
+	q->limit = SFQ_DEPTH - 1;
 	q->max_depth = 0;
 	q->tail = SFQ_DEPTH;
 	if (opt == NULL) {
 		q->quantum = psched_mtu(sch->dev);
 		q->perturb_period = 0;
+		get_random_bytes(&q->perturbation, 4);
 	} else {
 		int err = sfq_change(sch, opt);
 		if (err)