94 files changed, 741 insertions, 649 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 81d68d5b7ee..c824b4d6275 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3084,9 +3084,13 @@ F:	kernel/kgdb.c
 KMEMCHECK
 M:      Vegard Nossum <vegardno@ifi.uio.no>
-P       Pekka Enberg
+M:      Pekka Enberg <penberg@cs.helsinki.fi>
-M:      penberg@cs.helsinki.fi
 S:      Maintained
+F:      Documentation/kmemcheck.txt
+F:      arch/x86/include/asm/kmemcheck.h
+F:      arch/x86/mm/kmemcheck/
+F:      include/linux/kmemcheck.h
+F:      mm/kmemcheck.c
 KMEMLEAK
 M:      Catalin Marinas <catalin.marinas@arm.com>
@@ -4328,6 +4332,8 @@ F:	drivers/video/aty/aty128fb.c
 RALINK RT2X00 WIRELESS LAN DRIVER
 P:      rt2x00 project
+M:      Ivo van Doorn <IvDoorn@gmail.com>
+M:      Gertjan van Wingerde <gwingerde@gmail.com>
 L:      linux-wireless@vger.kernel.org
 L:      users@rt2x00.serialmonkey.com (moderated for non-subscribers)
 W:      http://rt2x00.serialmonkey.com/
@@ -4415,7 +4421,7 @@ RFKILL
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
-F       Documentation/rfkill.txt
+F:      Documentation/rfkill.txt
 F:      net/rfkill/
 RISCOM8 DRIVER
diff --git a/arch/arm/mach-omap2/board-zoom2.c b/arch/arm/mach-omap2/board-zoom2.c
index ea00486a5e5..51e0b3ba5f3 100644
--- a/arch/arm/mach-omap2/board-zoom2.c
+++ b/arch/arm/mach-omap2/board-zoom2.c
@@ -30,57 +30,56 @@
 /* Zoom2 has Qwerty keyboard*/
 static int board_keymap[] = {
        KEY(0, 0, KEY_E),
-        KEY(1, 0, KEY_R),
+        KEY(0, 1, KEY_R),
-        KEY(2, 0, KEY_T),
+        KEY(0, 2, KEY_T),
-        KEY(3, 0, KEY_HOME),
+        KEY(0, 3, KEY_HOME),
-        KEY(6, 0, KEY_I),
+        KEY(0, 6, KEY_I),
-        KEY(7, 0, KEY_LEFTSHIFT),
+        KEY(0, 7, KEY_LEFTSHIFT),
-        KEY(0, 1, KEY_D),
+        KEY(1, 0, KEY_D),
        KEY(1, 1, KEY_F),
-        KEY(2, 1, KEY_G),
+        KEY(1, 2, KEY_G),
-        KEY(3, 1, KEY_SEND),
+        KEY(1, 3, KEY_SEND),
-        KEY(6, 1, KEY_K),
+        KEY(1, 6, KEY_K),
-        KEY(7, 1, KEY_ENTER),
+        KEY(1, 7, KEY_ENTER),
-        KEY(0, 2, KEY_X),
+        KEY(2, 0, KEY_X),
-        KEY(1, 2, KEY_C),
+        KEY(2, 1, KEY_C),
        KEY(2, 2, KEY_V),
-        KEY(3, 2, KEY_END),
+        KEY(2, 3, KEY_END),
-        KEY(6, 2, KEY_DOT),
+        KEY(2, 6, KEY_DOT),
-        KEY(7, 2, KEY_CAPSLOCK),
+        KEY(2, 7, KEY_CAPSLOCK),
-        KEY(0, 3, KEY_Z),
+        KEY(3, 0, KEY_Z),
-        KEY(1, 3, KEY_KPPLUS),
+        KEY(3, 1, KEY_KPPLUS),
-        KEY(2, 3, KEY_B),
+        KEY(3, 2, KEY_B),
        KEY(3, 3, KEY_F1),
-        KEY(6, 3, KEY_O),
+        KEY(3, 6, KEY_O),
-        KEY(7, 3, KEY_SPACE),
+        KEY(3, 7, KEY_SPACE),
-        KEY(0, 4, KEY_W),
+        KEY(4, 0, KEY_W),
-        KEY(1, 4, KEY_Y),
+        KEY(4, 1, KEY_Y),
-        KEY(2, 4, KEY_U),
+        KEY(4, 2, KEY_U),
-        KEY(3, 4, KEY_F2),
+        KEY(4, 3, KEY_F2),
        KEY(4, 4, KEY_VOLUMEUP),
-        KEY(6, 4, KEY_L),
+        KEY(4, 6, KEY_L),
-        KEY(7, 4, KEY_LEFT),
+        KEY(4, 7, KEY_LEFT),
-        KEY(0, 5, KEY_S),
+        KEY(5, 0, KEY_S),
-        KEY(1, 5, KEY_H),
+        KEY(5, 1, KEY_H),
-        KEY(2, 5, KEY_J),
+        KEY(5, 2, KEY_J),
-        KEY(3, 5, KEY_F3),
+        KEY(5, 3, KEY_F3),
        KEY(5, 5, KEY_VOLUMEDOWN),
-        KEY(6, 5, KEY_M),
+        KEY(5, 6, KEY_M),
-        KEY(4, 5, KEY_ENTER),
+        KEY(5, 7, KEY_ENTER),
-        KEY(7, 5, KEY_RIGHT),
+        KEY(6, 0, KEY_Q),
-        KEY(0, 6, KEY_Q),
+        KEY(6, 1, KEY_A),
-        KEY(1, 6, KEY_A),
+        KEY(6, 2, KEY_N),
-        KEY(2, 6, KEY_N),
+        KEY(6, 3, KEY_BACKSPACE),
-        KEY(3, 6, KEY_BACKSPACE),
        KEY(6, 6, KEY_P),
-        KEY(7, 6, KEY_UP),
        KEY(6, 7, KEY_SELECT),
-        KEY(7, 7, KEY_DOWN),
+        KEY(7, 0, KEY_PROG1),   /*MACRO 1 <User defined> */
-        KEY(0, 7, KEY_PROG1),   /*MACRO 1 <User defined> */
+        KEY(7, 1, KEY_PROG2),   /*MACRO 2 <User defined> */
-        KEY(1, 7, KEY_PROG2),   /*MACRO 2 <User defined> */
+        KEY(7, 2, KEY_PROG3),   /*MACRO 3 <User defined> */
-        KEY(2, 7, KEY_PROG3),   /*MACRO 3 <User defined> */
+        KEY(7, 3, KEY_PROG4),   /*MACRO 4 <User defined> */
-        KEY(3, 7, KEY_PROG4),   /*MACRO 4 <User defined> */
+        KEY(7, 5, KEY_RIGHT),
-        0
+        KEY(7, 6, KEY_UP),
+        KEY(7, 7, KEY_DOWN)
 };
 static struct matrix_keymap_data board_map_data = {
diff --git a/arch/arm/mach-omap2/clock34xx.c b/arch/arm/mach-omap2/clock34xx.c
index 489556eecbd..7c5c00df3c7 100644
--- a/arch/arm/mach-omap2/clock34xx.c
+++ b/arch/arm/mach-omap2/clock34xx.c
@@ -473,7 +473,7 @@ static u16 _omap3_dpll_compute_freqsel(struct clk *clk, u8 n)
        unsigned long fint;
        u16 f = 0;
-        fint = clk->dpll_data->clk_ref->rate / (n + 1);
+        fint = clk->dpll_data->clk_ref->rate / n;
        pr_debug("clock: fint is %lu\n", fint);
diff --git a/arch/arm/mach-omap2/clock34xx.h b/arch/arm/mach-omap2/clock34xx.h
index c8119781e00..9565c05bebd 100644
--- a/arch/arm/mach-omap2/clock34xx.h
+++ b/arch/arm/mach-omap2/clock34xx.h
@@ -489,9 +489,9 @@ static struct clk core_ck = {
 static struct clk dpll3_m2x2_ck = {
        .name           = "dpll3_m2x2_ck",
        .ops            = &clkops_null,
-        .parent         = &dpll3_x2_ck,
+        .parent         = &dpll3_m2_ck,
        .clkdm_name     = "dpll3_clkdm",
-        .recalc         = &followparent_recalc,
+        .recalc         = &omap3_clkoutx2_recalc,
 };
 /* The PWRDN bit is apparently only available on 3430ES2 and above */
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index f8657568b1b..f3c992e2965 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -378,7 +378,7 @@ EXPORT_SYMBOL(gpmc_cs_request);
 void gpmc_cs_free(int cs)
 {
        spin_lock(&gpmc_mem_lock);
-        if (cs >= GPMC_CS_NUM || !gpmc_cs_reserved(cs)) {
+        if (cs >= GPMC_CS_NUM || cs < 0 || !gpmc_cs_reserved(cs)) {
                printk(KERN_ERR "Trying to free non-reserved GPMC CS%d\n", cs);
                BUG();
                spin_unlock(&gpmc_mem_lock);
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 71ebd7fcfea..7c345b757df 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -373,7 +373,7 @@ static inline int gpio_valid(int gpio)
 static int check_gpio(int gpio)
 {
-        if (unlikely(gpio_valid(gpio)) < 0) {
+        if (unlikely(gpio_valid(gpio) < 0)) {
                printk(KERN_ERR "omap-gpio: invalid GPIO %d\n", gpio);
                dump_stack();
                return -1;
diff --git a/arch/sh/kernel/cpu/irq/imask.c b/arch/sh/kernel/cpu/irq/imask.c
index 6b5d191eec3..a351ed84eec 100644
--- a/arch/sh/kernel/cpu/irq/imask.c
+++ b/arch/sh/kernel/cpu/irq/imask.c
@@ -68,7 +68,7 @@ static void unmask_imask_irq(unsigned int irq)
 }
 static struct irq_chip imask_irq_chip = {
-        .typename       = "SR.IMASK",
+        .name           = "SR.IMASK",
        .mask           = mask_imask_irq,
        .unmask         = unmask_imask_irq,
        .mask_ack       = mask_imask_irq,
diff --git a/arch/sh/kernel/cpu/irq/intc-sh5.c b/arch/sh/kernel/cpu/irq/intc-sh5.c
index 6c092f1f555..06e7e2959b5 100644
--- a/arch/sh/kernel/cpu/irq/intc-sh5.c
+++ b/arch/sh/kernel/cpu/irq/intc-sh5.c
@@ -85,7 +85,7 @@ static void mask_and_ack_intc(unsigned int);
 static void end_intc_irq(unsigned int irq);
 static struct irq_chip intc_irq_type = {
-        .typename = "INTC",
+        .name = "INTC",
        .startup = startup_intc_irq,
        .shutdown = shutdown_intc_irq,
        .enable = enable_intc_irq,
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 4068467ce7b..10e1f0390bb 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -1161,12 +1161,6 @@ static int intel_i915_configure(void)
        intel_i9xx_setup_flush();
-#ifdef USE_PCI_DMA_API 
-        if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(36)))
-                dev_err(&intel_private.pcidev->dev,
-                        "set gfx device dma mask 36bit failed!\n");
-#endif
        return 0;
 }
@@ -2456,6 +2450,11 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                                &bridge->mode);
        }
+        if (bridge->driver->mask_memory == intel_i965_mask_memory)
+                if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(36)))
+                        dev_err(&intel_private.pcidev->dev,
+                                "set gfx device dma mask 36bit failed!\n");
        pci_set_drvdata(pdev, bridge);
        return agp_add_bridge(bridge);
 }
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index a4bbb28f10b..2e8552dc5ed 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -221,6 +221,9 @@ int tty_port_block_til_ready(struct tty_port *port,
           the port has just hung up or is in another error state */
        if ((filp->f_flags & O_NONBLOCK) ||
                        (tty->flags & (1 << TTY_IO_ERROR))) {
+                /* Indicate we are open */
+                if (tty->termios->c_cflag & CBAUD)
+                        tty_port_raise_dtr_rts(port);
                port->flags |= ASYNC_NORMAL_ACTIVE;
                return 0;
        }
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index faed794cf75..a6624ad252c 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -5481,7 +5481,7 @@ HFCmulti_init(void)
                if (err) {
                        printk(KERN_ERR "error registering embedded driver: "
                                "%x\n", err);
-                        return -err;
+                        return err;
                }
                HFC_cnt++;
                printk(KERN_INFO "%d devices registered\n", HFC_cnt);
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 2d14b64202a..642d5aaf53c 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -1535,10 +1535,8 @@ static int isdn_ppp_mp_bundle_array_init(void)
        int sz = ISDN_MAX_CHANNELS*sizeof(ippp_bundle);
        if( (isdn_ppp_bundle_arr = kzalloc(sz, GFP_KERNEL)) == NULL )
                return -ENOMEM;
-        for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
+        for( i = 0; i < ISDN_MAX_CHANNELS; i++ )
                spin_lock_init(&isdn_ppp_bundle_arr[i].lock);
-                skb_queue_head_init(&isdn_ppp_bundle_arr[i].frags);
-        }
        return 0;
 }
@@ -1571,7 +1569,7 @@ static int isdn_ppp_mp_init( isdn_net_local * lp, ippp_bundle * add_to )
                if ((lp->netdev->pb = isdn_ppp_mp_bundle_alloc()) == NULL)
                        return -ENOMEM;
                lp->next = lp->last = lp;       /* nobody else in a queue */
-                skb_queue_head_init(&lp->netdev->pb->frags);
+                lp->netdev->pb->frags = NULL;
                lp->netdev->pb->frames = 0;
                lp->netdev->pb->seq = UINT_MAX;
        }
@@ -1583,29 +1581,28 @@ static int isdn_ppp_mp_init( isdn_net_local * lp, ippp_bundle * add_to )
 static u32 isdn_ppp_mp_get_seq( int short_seq, 
                                        struct sk_buff * skb, u32 last_seq );
-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
+static struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
-                                struct sk_buff *to);
+                        struct sk_buff * from, struct sk_buff * to );
-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
+static void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
-                                   struct sk_buff *from, struct sk_buff *to,
+                                struct sk_buff * from, struct sk_buff * to );
-                                   u32 lastseq);
+static void isdn_ppp_mp_free_skb( ippp_bundle * mp, struct sk_buff * skb );
-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb);
 static void isdn_ppp_mp_print_recv_pkt( int slot, struct sk_buff * skb );
 static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp, 
-                                struct sk_buff *skb)
+                                                        struct sk_buff *skb)
 {
-        struct sk_buff *newfrag, *frag, *start, *nextf;
-        u32 newseq, minseq, thisseq;
-        isdn_mppp_stats *stats;
        struct ippp_struct *is;
+        isdn_net_local * lpq;
+        ippp_bundle * mp;
+        isdn_mppp_stats * stats;
+        struct sk_buff * newfrag, * frag, * start, *nextf;
+        u32 newseq, minseq, thisseq;
        unsigned long flags;
-        isdn_net_local *lpq;
-        ippp_bundle *mp;
        int slot;
        spin_lock_irqsave(&net_dev->pb->lock, flags);
-        mp = net_dev->pb;
+        mp = net_dev->pb;
-        stats = &mp->stats;
+        stats = &mp->stats;
        slot = lp->ppp_slot;
        if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
                printk(KERN_ERR "%s: lp->ppp_slot(%d)\n",
@@ -1616,19 +1613,20 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
                return;
        }
        is = ippp_table[slot];
-        if (++mp->frames > stats->max_queue_len)
+        if( ++mp->frames > stats->max_queue_len )
                stats->max_queue_len = mp->frames;
+        
        if (is->debug & 0x8)
                isdn_ppp_mp_print_recv_pkt(lp->ppp_slot, skb);
-        newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ,
+        newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ, 
-                                     skb, is->last_link_seqno);
+                                                skb, is->last_link_seqno);
        /* if this packet seq # is less than last already processed one,
         * toss it right away, but check for sequence start case first 
         */
-        if (mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT)) {
+        if( mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT) ) {
                mp->seq = newseq;       /* the first packet: required for
                                         * rfc1990 non-compliant clients --
                                         * prevents constant packet toss */
@@ -1638,7 +1636,7 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
                spin_unlock_irqrestore(&mp->lock, flags);
                return;
        }
+        
        /* find the minimum received sequence number over all links */
        is->last_link_seqno = minseq = newseq;
        for (lpq = net_dev->queue;;) {
@@ -1659,31 +1657,22 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
                                         * packets */
        newfrag = skb;
-        /* Insert new fragment into the proper sequence slot.  */
+        /* if this new fragment is before the first one, then enqueue it now. */
-        skb_queue_walk(&mp->frags, frag) {
+        if ((frag = mp->frags) == NULL || MP_LT(newseq, MP_SEQ(frag))) {
-                if (MP_SEQ(frag) == newseq) {
+                newfrag->next = frag;
-                        isdn_ppp_mp_free_skb(mp, newfrag);
+                mp->frags = frag = newfrag;
-                        newfrag = NULL;
+                newfrag = NULL;
-                        break;
+        }
-                }
-                if (MP_LT(newseq, MP_SEQ(frag))) {
-                        __skb_queue_before(&mp->frags, frag, newfrag);
-                        newfrag = NULL;
-                        break;
-                }
-        }
-        if (newfrag)
-                __skb_queue_tail(&mp->frags, newfrag);
-        frag = skb_peek(&mp->frags);
+        start = MP_FLAGS(frag) & MP_BEGIN_FRAG &&
-        start = ((MP_FLAGS(frag) & MP_BEGIN_FRAG) &&
+                                MP_SEQ(frag) == mp->seq ? frag : NULL;
-                 (MP_SEQ(frag) == mp->seq)) ? frag : NULL;
-        if (!start)
-                goto check_overflow;
-        /* main fragment traversing loop
+        /* 
+         * main fragment traversing loop
         *
         * try to accomplish several tasks:
+         * - insert new fragment into the proper sequence slot (once that's done
+         *   newfrag will be set to NULL)
         * - reassemble any complete fragment sequence (non-null 'start'
         *   indicates there is a continguous sequence present)
         * - discard any incomplete sequences that are below minseq -- due
@@ -1692,46 +1681,71 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
         *   come to complete such sequence and it should be discarded
         *
         * loop completes when we accomplished the following tasks:
+         * - new fragment is inserted in the proper sequence ('newfrag' is 
+         *   set to NULL)
         * - we hit a gap in the sequence, so no reassembly/processing is 
         *   possible ('start' would be set to NULL)
         *
         * algorithm for this code is derived from code in the book
         * 'PPP Design And Debugging' by James Carlson (Addison-Wesley)
         */
-        skb_queue_walk_safe(&mp->frags, frag, nextf) {
+        while (start != NULL || newfrag != NULL) {
-                thisseq = MP_SEQ(frag);
+                thisseq = MP_SEQ(frag);
-                /* check for misplaced start */
+                nextf = frag->next;
-                if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
-                        printk(KERN_WARNING"isdn_mppp(seq %d): new "
+                /* drop any duplicate fragments */
-                               "BEGIN flag with no prior END", thisseq);
+                if (newfrag != NULL && thisseq == newseq) {
-                        stats->seqerrs++;
+                        isdn_ppp_mp_free_skb(mp, newfrag);
-                        stats->frame_drops++;
+                        newfrag = NULL;
-                        isdn_ppp_mp_discard(mp, start, frag);
+                }
-                        start = frag;
-                } else if (MP_LE(thisseq, minseq)) {            
+                /* insert new fragment before next element if possible. */
-                        if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
+                if (newfrag != NULL && (nextf == NULL || 
+                                                MP_LT(newseq, MP_SEQ(nextf)))) {
+                        newfrag->next = nextf;
+                        frag->next = nextf = newfrag;
+                        newfrag = NULL;
+                }
+                if (start != NULL) {
+                        /* check for misplaced start */
+                        if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
+                                printk(KERN_WARNING"isdn_mppp(seq %d): new "
+                                      "BEGIN flag with no prior END", thisseq);
+                                stats->seqerrs++;
+                                stats->frame_drops++;
+                                start = isdn_ppp_mp_discard(mp, start,frag);
+                                nextf = frag->next;
+                        }
+                } else if (MP_LE(thisseq, minseq)) {            
+                        if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
                                start = frag;
-                        else {
+                        else {
                                if (MP_FLAGS(frag) & MP_END_FRAG)
-                                        stats->frame_drops++;
+                                        stats->frame_drops++;
-                                __skb_unlink(skb, &mp->frags);
+                                if( mp->frags == frag )
+                                        mp->frags = nextf;      
                                isdn_ppp_mp_free_skb(mp, frag);
+                                frag = nextf;
                                continue;
-                        }
+                        }
                }
+                
-                /* if we have end fragment, then we have full reassembly
+                /* if start is non-null and we have end fragment, then
-                 * sequence -- reassemble and process packet now
+                 * we have full reassembly sequence -- reassemble 
+                 * and process packet now
                 */
-                if (MP_FLAGS(frag) & MP_END_FRAG) {
+                if (start != NULL && (MP_FLAGS(frag) & MP_END_FRAG)) {
-                        minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
+                        minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
-                        /* Reassemble the packet then dispatch it */
+                        /* Reassemble the packet then dispatch it */
-                        isdn_ppp_mp_reassembly(net_dev, lp, start, frag, thisseq);
+                        isdn_ppp_mp_reassembly(net_dev, lp, start, nextf);
+      
+                        start = NULL;
+                        frag = NULL;
-                        start = NULL;
+                        mp->frags = nextf;
-                        frag = NULL;
+                }
-                }
                /* check if need to update start pointer: if we just
                 * reassembled the packet and sequence is contiguous
@@ -1742,25 +1756,26 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
                 * below low watermark and set start to the next frag or
                 * clear start ptr.
                 */ 
-                if (nextf != (struct sk_buff *)&mp->frags && 
+                if (nextf != NULL && 
                    ((thisseq+1) & MP_LONGSEQ_MASK) == MP_SEQ(nextf)) {
-                        /* if we just reassembled and the next one is here, 
+                        /* if we just reassembled and the next one is here, 
-                         * then start another reassembly.
+                         * then start another reassembly. */
-                         */
-                        if (frag == NULL) {
+                        if (frag == NULL) {
                                if (MP_FLAGS(nextf) & MP_BEGIN_FRAG)
-                                        start = nextf;
+                                        start = nextf;
-                                else {
+                                else
-                                        printk(KERN_WARNING"isdn_mppp(seq %d):"
+                                {
-                                               " END flag with no following "
+                                        printk(KERN_WARNING"isdn_mppp(seq %d):"
-                                               "BEGIN", thisseq);
+                                                " END flag with no following "
+                                                "BEGIN", thisseq);
                                        stats->seqerrs++;
                                }
                        }
-                } else {
-                        if (nextf != (struct sk_buff *)&mp->frags &&
+                } else {
-                            frag != NULL &&
+                        if ( nextf != NULL && frag != NULL &&
-                            MP_LT(thisseq, minseq)) {
+                                                MP_LT(thisseq, minseq)) {
                                /* we've got a break in the sequence
                                 * and we not at the end yet
                                 * and we did not just reassembled
@@ -1769,39 +1784,41 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
                                 * discard all the frames below low watermark 
                                 * and start over */
                                stats->frame_drops++;
-                                isdn_ppp_mp_discard(mp, start, nextf);
+                                mp->frags = isdn_ppp_mp_discard(mp,start,nextf);
                        }
                        /* break in the sequence, no reassembly */
-                        start = NULL;
+                        start = NULL;
-                }
+                }
-                if (!start)
+                                
-                        break;
+                frag = nextf;
-        }
+        }       /* while -- main loop */
+        
-check_overflow:
+        if (mp->frags == NULL)
+                mp->frags = frag;
+                
        /* rather straighforward way to deal with (not very) possible 
-         * queue overflow
+         * queue overflow */
-         */
        if (mp->frames > MP_MAX_QUEUE_LEN) {
                stats->overflows++;
-                skb_queue_walk_safe(&mp->frags, frag, nextf) {
+                while (mp->frames > MP_MAX_QUEUE_LEN) {
-                        if (mp->frames <= MP_MAX_QUEUE_LEN)
+                        frag = mp->frags->next;
-                                break;
+                        isdn_ppp_mp_free_skb(mp, mp->frags);
-                        __skb_unlink(frag, &mp->frags);
+                        mp->frags = frag;
-                        isdn_ppp_mp_free_skb(mp, frag);
                }
        }
        spin_unlock_irqrestore(&mp->lock, flags);
 }
-static void isdn_ppp_mp_cleanup(isdn_net_local *lp)
+static void isdn_ppp_mp_cleanup( isdn_net_local * lp )
 {
-        struct sk_buff *skb, *tmp;
+        struct sk_buff * frag = lp->netdev->pb->frags;
+        struct sk_buff * nextfrag;
-        skb_queue_walk_safe(&lp->netdev->pb->frags, skb, tmp) {
+        while( frag ) {
-                __skb_unlink(skb, &lp->netdev->pb->frags);
+                nextfrag = frag->next;
-                isdn_ppp_mp_free_skb(lp->netdev->pb, skb);
+                isdn_ppp_mp_free_skb(lp->netdev->pb, frag);
-        }
+                frag = nextfrag;
+        }
+        lp->netdev->pb->frags = NULL;
 }
 static u32 isdn_ppp_mp_get_seq( int short_seq, 
@@ -1838,115 +1855,72 @@ static u32 isdn_ppp_mp_get_seq( int short_seq,
        return seq;
 }
-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
+struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
-                                struct sk_buff *to)
+                        struct sk_buff * from, struct sk_buff * to )
 {
-        if (from) {
+        if( from )
-                struct sk_buff *skb, *tmp;
+                while (from != to) {
-                int freeing = 0;
+                        struct sk_buff * next = from->next;
+                        isdn_ppp_mp_free_skb(mp, from);
-                skb_queue_walk_safe(&mp->frags, skb, tmp) {
+                        from = next;
-                        if (skb == to)
-                                break;
-                        if (skb == from)
-                                freeing = 1;
-                        if (!freeing)
-                                continue;
-                        __skb_unlink(skb, &mp->frags);
-                        isdn_ppp_mp_free_skb(mp, skb);
                }
-        }
+        return from;
-}
-static unsigned int calc_tot_len(struct sk_buff_head *queue,
-                                 struct sk_buff *from, struct sk_buff *to)
-{
-        unsigned int tot_len = 0;
-        struct sk_buff *skb;
-        int found_start = 0;
-        skb_queue_walk(queue, skb) {
-                if (skb == from)
-                        found_start = 1;
-                if (!found_start)
-                        continue;
-                tot_len += skb->len - MP_HEADER_LEN;
-                if (skb == to)
-                        break;
-        }
-        return tot_len;
 }
-/* Reassemble packet using fragments in the reassembly queue from
+void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
- * 'from' until 'to', inclusive.
+                                struct sk_buff * from, struct sk_buff * to )
- */
-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
-                                   struct sk_buff *from, struct sk_buff *to,
-                                   u32 lastseq)
 {
-        ippp_bundle *mp = net_dev->pb;
+        ippp_bundle * mp = net_dev->pb;
-        unsigned int tot_len;
-        struct sk_buff *skb;
        int proto;
+        struct sk_buff * skb;
+        unsigned int tot_len;
        if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
                printk(KERN_ERR "%s: lp->ppp_slot(%d) out of range\n",
                        __func__, lp->ppp_slot);
                return;
        }
+        if( MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG) ) {
-        tot_len = calc_tot_len(&mp->frags, from, to);
+                if( ippp_table[lp->ppp_slot]->debug & 0x40 )
-        if (MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG)) {
-                if (ippp_table[lp->ppp_slot]->debug & 0x40)
                        printk(KERN_DEBUG "isdn_mppp: reassembly: frame %d, "
-                               "len %d\n", MP_SEQ(from), from->len);
+                                        "len %d\n", MP_SEQ(from), from->len );
                skb = from;
                skb_pull(skb, MP_HEADER_LEN);
-                __skb_unlink(skb, &mp->frags);
                mp->frames--;   
        } else {
-                struct sk_buff *walk, *tmp;
+                struct sk_buff * frag;
-                int found_start = 0;
+                int n;
-                if (ippp_table[lp->ppp_slot]->debug & 0x40)
+                for(tot_len=n=0, frag=from; frag != to; frag=frag->next, n++)
-                        printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
+                        tot_len += frag->len - MP_HEADER_LEN;
-                               "to %d, len %d\n", MP_SEQ(from), lastseq,
-                               tot_len);
-                skb = dev_alloc_skb(tot_len);
+                if( ippp_table[lp->ppp_slot]->debug & 0x40 )
-                if (!skb)
+                        printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
+                                "to %d, len %d\n", MP_SEQ(from), 
+                                (MP_SEQ(from)+n-1) & MP_LONGSEQ_MASK, tot_len );
+                if( (skb = dev_alloc_skb(tot_len)) == NULL ) {
                        printk(KERN_ERR "isdn_mppp: cannot allocate sk buff "
-                               "of size %d\n", tot_len);
+                                        "of size %d\n", tot_len);
+                        isdn_ppp_mp_discard(mp, from, to);
-                found_start = 0;
+                        return;
-                skb_queue_walk_safe(&mp->frags, walk, tmp) {
+                }
-                        if (walk == from)
-                                found_start = 1;
-                        if (!found_start)
-                                continue;
-                        if (skb) {
+                while( from != to ) {
-                                unsigned int len = walk->len - MP_HEADER_LEN;
+                        unsigned int len = from->len - MP_HEADER_LEN;
-                                skb_copy_from_linear_data_offset(walk, MP_HEADER_LEN,
-                                                                 skb_put(skb, len),
-                                                                 len);
-                        }
-                        __skb_unlink(walk, &mp->frags);
-                        isdn_ppp_mp_free_skb(mp, walk);
-                        if (walk == to)
+                        skb_copy_from_linear_data_offset(from, MP_HEADER_LEN,
-                                break;
+                                                         skb_put(skb,len),
+                                                         len);
+                        frag = from->next;
+                        isdn_ppp_mp_free_skb(mp, from);
+                        from = frag; 
                }
        }
-        if (!skb)
-                return;
        proto = isdn_ppp_strip_proto(skb);
        isdn_ppp_push_higher(net_dev, lp, skb, proto);
 }
-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb)
+static void isdn_ppp_mp_free_skb(ippp_bundle * mp, struct sk_buff * skb)
 {
        dev_kfree_skb(skb);
        mp->frames--;
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index df32c109b7a..772f6d2489c 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -35,66 +35,16 @@ config CAN_CALC_BITTIMING
          arguments "tq", "prop_seg", "phase_seg1", "phase_seg2" and "sjw".
          If unsure, say Y.
-config CAN_SJA1000
-        depends on CAN_DEV && HAS_IOMEM
-        tristate "Philips SJA1000"
-        ---help---
-          Driver for the SJA1000 CAN controllers from Philips or NXP
-config CAN_SJA1000_ISA
-        depends on CAN_SJA1000 && ISA
-        tristate "ISA Bus based legacy SJA1000 driver"
-        ---help---
-          This driver adds legacy support for SJA1000 chips connected to
-          the ISA bus using I/O port, memory mapped or indirect access.
-config CAN_SJA1000_PLATFORM
-        depends on CAN_SJA1000
-        tristate "Generic Platform Bus based SJA1000 driver"
-        ---help---
-          This driver adds support for the SJA1000 chips connected to
-          the "platform bus" (Linux abstraction for directly to the
-          processor attached devices).  Which can be found on various
-          boards from Phytec (http://www.phytec.de) like the PCM027,
-          PCM038.
-config CAN_SJA1000_OF_PLATFORM
-        depends on CAN_SJA1000 && PPC_OF
-        tristate "Generic OF Platform Bus based SJA1000 driver"
-        ---help---
-          This driver adds support for the SJA1000 chips connected to
-          the OpenFirmware "platform bus" found on embedded systems with
-          OpenFirmware bindings, e.g. if you have a PowerPC based system
-          you may want to enable this option.
-config CAN_EMS_PCI
-        tristate "EMS CPC-PCI, CPC-PCIe and CPC-104P Card"
-        depends on PCI && CAN_SJA1000
-        ---help---
-          This driver is for the one, two or four channel CPC-PCI,
-          CPC-PCIe and CPC-104P cards from EMS Dr. Thomas Wuensche
-          (http://www.ems-wuensche.de).
-config CAN_EMS_USB
-        tristate "EMS CPC-USB/ARM7 CAN/USB interface"
-        depends on USB && CAN_DEV
-        ---help---
-          This driver is for the one channel CPC-USB/ARM7 CAN/USB interface
-          from from EMS Dr. Thomas Wuensche (http://www.ems-wuensche.de).
-config CAN_KVASER_PCI
-        tristate "Kvaser PCIcanx and Kvaser PCIcan PCI Cards"
-        depends on PCI && CAN_SJA1000
-        ---help---
-          This driver is for the the PCIcanx and PCIcan cards (1, 2 or
-          4 channel) from Kvaser (http://www.kvaser.com).
 config CAN_AT91
        tristate "Atmel AT91 onchip CAN controller"
-        depends on CAN && CAN_DEV && ARCH_AT91SAM9263
+        depends on CAN_DEV && ARCH_AT91SAM9263
        ---help---
          This is a driver for the SoC CAN controller in Atmel's AT91SAM9263.
+source "drivers/net/can/sja1000/Kconfig"
+source "drivers/net/can/usb/Kconfig"
 config CAN_DEBUG_DEVICES
        bool "CAN devices debugging messages"
        depends on CAN
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 564e31c9fee..2868fe842a4 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -629,6 +629,11 @@ nla_put_failure:
        return -EMSGSIZE;
 }
+static size_t can_get_xstats_size(const struct net_device *dev)
+{
+        return sizeof(struct can_device_stats);
+}
 static int can_fill_xstats(struct sk_buff *skb, const struct net_device *dev)
 {
        struct can_priv *priv = netdev_priv(dev);
@@ -657,6 +662,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = {
        .changelink     = can_changelink,
        .get_size       = can_get_size,
        .fill_info      = can_fill_info,
+        .get_xstats_size = can_get_xstats_size,
        .fill_xstats    = can_fill_xstats,
 };
diff --git a/drivers/net/can/sja1000/Kconfig b/drivers/net/can/sja1000/Kconfig
new file mode 100644
index 00000000000..4c674927f24
--- /dev/null
+++ b/drivers/net/can/sja1000/Kconfig
@@ -0,0 +1,47 @@
+menuconfig CAN_SJA1000
+        tristate "Philips/NXP SJA1000 devices"
+        depends on CAN_DEV && HAS_IOMEM
+if CAN_SJA1000
+config CAN_SJA1000_ISA
+        tristate "ISA Bus based legacy SJA1000 driver"
+        depends on ISA
+        ---help---
+          This driver adds legacy support for SJA1000 chips connected to
+          the ISA bus using I/O port, memory mapped or indirect access.
+config CAN_SJA1000_PLATFORM
+        tristate "Generic Platform Bus based SJA1000 driver"
+        ---help---
+          This driver adds support for the SJA1000 chips connected to
+          the "platform bus" (Linux abstraction for directly to the
+          processor attached devices).  Which can be found on various
+          boards from Phytec (http://www.phytec.de) like the PCM027,
+          PCM038.
+config CAN_SJA1000_OF_PLATFORM
+        tristate "Generic OF Platform Bus based SJA1000 driver"
+        depends on PPC_OF
+        ---help---
+          This driver adds support for the SJA1000 chips connected to
+          the OpenFirmware "platform bus" found on embedded systems with
+          OpenFirmware bindings, e.g. if you have a PowerPC based system
+          you may want to enable this option.
+config CAN_EMS_PCI
+        tristate "EMS CPC-PCI, CPC-PCIe and CPC-104P Card"
+        depends on PCI
+        ---help---
+          This driver is for the one, two or four channel CPC-PCI,
+          CPC-PCIe and CPC-104P cards from EMS Dr. Thomas Wuensche
+          (http://www.ems-wuensche.de).
+config CAN_KVASER_PCI
+        tristate "Kvaser PCIcanx and Kvaser PCIcan PCI Cards"
+        depends on PCI
+        ---help---
+          This driver is for the the PCIcanx and PCIcan cards (1, 2 or
+          4 channel) from Kvaser (http://www.kvaser.com).
+endif
diff --git a/drivers/net/can/usb/Kconfig b/drivers/net/can/usb/Kconfig
new file mode 100644
index 00000000000..bbc78e0b8a1
--- /dev/null
+++ b/drivers/net/can/usb/Kconfig
@@ -0,0 +1,10 @@
+menu "CAN USB interfaces"
+        depends on USB && CAN_DEV
+config CAN_EMS_USB
+        tristate "EMS CPC-USB/ARM7 CAN/USB interface"
+        ---help---
+          This driver is for the one channel CPC-USB/ARM7 CAN/USB interface
+          from from EMS Dr. Thomas Wuensche (http://www.ems-wuensche.de).
+endmenu
diff --git a/drivers/net/can/usb/Makefile b/drivers/net/can/usb/Makefile
index c3f75ba701b..0afd51d4c7a 100644
--- a/drivers/net/can/usb/Makefile
+++ b/drivers/net/can/usb/Makefile
@@ -3,3 +3,5 @@
 #
 obj-$(CONFIG_CAN_EMS_USB) += ems_usb.o
+ccflags-$(CONFIG_CAN_DEBUG_DEVICES) := -DDEBUG
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index f86612857a7..6366061712f 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -879,7 +879,7 @@ recycle:
        pci_dma_sync_single_for_cpu(adap->pdev, dma_addr, len,
                                    PCI_DMA_FROMDEVICE);
        (*sd->pg_chunk.p_cnt)--;
-        if (!*sd->pg_chunk.p_cnt)
+        if (!*sd->pg_chunk.p_cnt && sd->pg_chunk.page != fl->pg_chunk.page)
                pci_unmap_page(adap->pdev,
                               sd->pg_chunk.mapping,
                               fl->alloc_size,
@@ -2088,7 +2088,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                                    PCI_DMA_FROMDEVICE);
        (*sd->pg_chunk.p_cnt)--;
-        if (!*sd->pg_chunk.p_cnt)
+        if (!*sd->pg_chunk.p_cnt && sd->pg_chunk.page != fl->pg_chunk.page)
                pci_unmap_page(adap->pdev,
                               sd->pg_chunk.mapping,
                               fl->alloc_size,
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 3179521aee9..db638037947 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -2140,9 +2140,6 @@ static int emac_poll(struct napi_struct *napi, int budget)
        u32 status = 0;
        u32 num_pkts = 0;
-        if (!netif_running(ndev))
-                return 0;
        /* Check interrupt vectors and call packet processing */
        status = emac_read(EMAC_MACINVECTOR);
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index e1da4666f20..3116601dbfe 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5821,10 +5821,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                        dev->dev_addr);
                dev_printk(KERN_ERR, &pci_dev->dev,
                        "Please complain to your hardware vendor. Switching to a random MAC.\n");
-                dev->dev_addr[0] = 0x00;
+                random_ether_addr(dev->dev_addr);
-                dev->dev_addr[1] = 0x00;
-                dev->dev_addr[2] = 0x6c;
-                get_random_bytes(&dev->dev_addr[3], 3);
        }
        dprintk(KERN_DEBUG "%s: MAC Address %pM\n",
diff --git a/drivers/net/ibm_newemac/emac.h b/drivers/net/ibm_newemac/emac.h
index d34adf99fc6..8a61b597a16 100644
--- a/drivers/net/ibm_newemac/emac.h
+++ b/drivers/net/ibm_newemac/emac.h
@@ -263,8 +263,8 @@ struct emac_regs {
 /* EMACx_TRTR */
-#define EMAC_TRTR_SHIFT_EMAC4           27
+#define EMAC_TRTR_SHIFT_EMAC4           24
-#define EMAC_TRTR_SHIFT                 24
+#define EMAC_TRTR_SHIFT         27
 /* EMAC specific TX descriptor control fields (write access) */
 #define EMAC_TX_CTRL_GFCS               0x0200
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 5bd9e6bf6f2..a5036f7c192 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5994,6 +5994,7 @@ static pci_ers_result_t ixgbe_io_slot_reset(struct pci_dev *pdev)
        } else {
                pci_set_master(pdev);
                pci_restore_state(pdev);
+                pci_save_state(pdev);
                pci_wake_from_d3(pdev, false);
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 8659d341e76..35897134a5d 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -139,7 +139,7 @@ out:
        return NULL;
 }
-static void __devinit mdio_gpio_bus_deinit(struct device *dev)
+static void mdio_gpio_bus_deinit(struct device *dev)
 {
        struct mii_bus *bus = dev_get_drvdata(dev);
        struct mdio_gpio_info *bitbang = bus->priv;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 9bf2a6be903..965adb6174c 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1944,8 +1944,15 @@ ppp_receive_mp_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
        }
        /* Pull completed packets off the queue and receive them. */
-        while ((skb = ppp_mp_reconstruct(ppp)))
+        while ((skb = ppp_mp_reconstruct(ppp))) {
-                ppp_receive_nonmp_frame(ppp, skb);
+                if (pskb_may_pull(skb, 2))
+                        ppp_receive_nonmp_frame(ppp, skb);
+                else {
+                        ++ppp->dev->stats.rx_length_errors;
+                        kfree_skb(skb);
+                        ppp_receive_error(ppp);
+                }
+        }
        return;
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 7dfcb58b0eb..8b14c6eda7c 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -1085,7 +1085,7 @@ static int __devinit r6040_init_one(struct pci_dev *pdev,
        int bar = 0;
        u16 *adrp;
-        printk(KERN_INFO "%s\n", version);
+        printk("%s\n", version);
        err = pci_enable_device(pdev);
        if (err)
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index fa493567848..b9221bdc718 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3243,9 +3243,9 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
 static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
                                  struct net_device *dev)
 {
-        unsigned int mtu = dev->mtu;
+        unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-        tp->rx_buf_sz = (mtu > RX_BUF_SIZE) ? mtu + ETH_HLEN + 8 : RX_BUF_SIZE;
+        tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
 }
 static int rtl8169_open(struct net_device *dev)
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index ddccf5fa56b..0dd7839322b 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -3494,6 +3494,7 @@ static void s2io_reset(struct s2io_nic *sp)
                /* Restore the PCI state saved during initialization. */
                pci_restore_state(sp->pdev);
+                pci_save_state(sp->pdev);
                pci_read_config_word(sp->pdev, 0x2, &val16);
                if (check_pci_device_id(val16) != (u16)PCI_ANY_ID)
                        break;
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index ccdd196f529..f9cdcbcb77d 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -986,7 +986,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
        struct net_device *dev = pdata->dev;
        int npackets = 0;
-        while (likely(netif_running(dev)) && (npackets < budget)) {
+        while (npackets < budget) {
                unsigned int pktlength;
                unsigned int pktwords;
                struct sk_buff *skb;
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 7019a0d1a82..61640b99b70 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2063,7 +2063,15 @@ static int gem_check_invariants(struct gem *gp)
                mif_cfg &= ~MIF_CFG_PSELECT;
                writel(mif_cfg, gp->regs + MIF_CFG);
        } else {
-                gp->phy_type = phy_serialink;
+#ifdef CONFIG_SPARC
+                const char *p;
+                p = of_get_property(gp->of_node, "shared-pins", NULL);
+                if (p && !strcmp(p, "serdes"))
+                        gp->phy_type = phy_serdes;
+                else
+#endif
+                        gp->phy_type = phy_serialink;
        }
        if (gp->phy_type == phy_mii_mdio1 ||
            gp->phy_type == phy_mii_mdio0) {
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 9c6ab5378f6..95a8e232b58 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1125,7 +1125,6 @@ ath5k_mode_setup(struct ath5k_softc *sc)
        /* configure operational mode */
        ath5k_hw_set_opmode(ah);
-        ath5k_hw_set_mcast_filter(ah, 0, 0);
        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "RX filter 0x%x\n", rfilt);
 }
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index b767c3b67b2..b548c8eaaae 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -63,12 +63,16 @@ static const struct pci_device_id ath5k_led_devices[] = {
        { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0422), ATH_LED(1, 1) },
        /* E-machines E510 (tuliom@gmail.com) */
        { ATH_SDEVICE(PCI_VENDOR_ID_AMBIT, 0x0428), ATH_LED(3, 0) },
+        /* BenQ Joybook R55v (nowymarluk@wp.pl) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0100), ATH_LED(1, 0) },
        /* Acer Extensa 5620z (nekoreeve@gmail.com) */
        { ATH_SDEVICE(PCI_VENDOR_ID_QMI, 0x0105), ATH_LED(3, 0) },
        /* Fukato Datacask Jupiter 1014a (mrb74@gmx.at) */
        { ATH_SDEVICE(PCI_VENDOR_ID_AZWAVE, 0x1026), ATH_LED(3, 0) },
        /* IBM ThinkPad AR5BXB6 (legovini@spiro.fisica.unipd.it) */
        { ATH_SDEVICE(PCI_VENDOR_ID_IBM, 0x058a), ATH_LED(1, 0) },
+        /* HP Compaq CQ60-206US (ddreggors@jumptv.com) */
+        { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137a), ATH_LED(3, 1) },
        /* HP Compaq C700 (nitrousnrg@gmail.com) */
        { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) },
        /* IBM-specific AR5212 (all others) */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 86f35827f00..098dda1a67c 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4521,9 +4521,8 @@ static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
 {
        struct b43_wl *wl = hw_to_b43_wl(hw);
-        mutex_lock(&wl->mutex);
+        /* FIXME: add locking */
        b43_update_templates(wl);
-        mutex_unlock(&wl->mutex);
        return 0;
 }
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 240cff1e697..6e2fc0cb6f8 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6029,7 +6029,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
        struct ipw2100_priv *priv;
        struct net_device *dev;
-        dev = alloc_ieee80211(sizeof(struct ipw2100_priv), 0);
+        dev = alloc_ieee80211(sizeof(struct ipw2100_priv));
        if (!dev)
                return NULL;
        priv = libipw_priv(dev);
@@ -6342,7 +6342,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                sysfs_remove_group(&pci_dev->dev.kobj,
                                   &ipw2100_attribute_group);
-                free_ieee80211(dev, 0);
+                free_ieee80211(dev);
                pci_set_drvdata(pci_dev, NULL);
        }
@@ -6400,7 +6400,7 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
                if (dev->base_addr)
                        iounmap((void __iomem *)dev->base_addr);
-                free_ieee80211(dev, 0);
+                free_ieee80211(dev);
        }
        pci_release_regions(pci_dev);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 827824d45de..a6ca536e44f 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -104,25 +104,6 @@ static int antenna = CFG_SYS_ANTENNA_BOTH;
 static int rtap_iface = 0;     /* def: 0 -- do not create rtap interface */
 #endif
-static struct ieee80211_rate ipw2200_rates[] = {
-        { .bitrate = 10 },
-        { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
-        { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
-        { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
-        { .bitrate = 60 },
-        { .bitrate = 90 },
-        { .bitrate = 120 },
-        { .bitrate = 180 },
-        { .bitrate = 240 },
-        { .bitrate = 360 },
-        { .bitrate = 480 },
-        { .bitrate = 540 }
-};
-#define ipw2200_a_rates         (ipw2200_rates + 4)
-#define ipw2200_num_a_rates     8
-#define ipw2200_bg_rates        (ipw2200_rates + 0)
-#define ipw2200_num_bg_rates    12
 #ifdef CONFIG_IPW2200_QOS
 static int qos_enable = 0;
@@ -8674,6 +8655,24 @@ static int ipw_sw_reset(struct ipw_priv *priv, int option)
 *
 */
+static int ipw_wx_get_name(struct net_device *dev,
+                           struct iw_request_info *info,
+                           union iwreq_data *wrqu, char *extra)
+{
+        struct ipw_priv *priv = libipw_priv(dev);
+        mutex_lock(&priv->mutex);
+        if (priv->status & STATUS_RF_KILL_MASK)
+                strcpy(wrqu->name, "radio off");
+        else if (!(priv->status & STATUS_ASSOCIATED))
+                strcpy(wrqu->name, "unassociated");
+        else
+                snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11%c",
+                         ipw_modes[priv->assoc_request.ieee_mode]);
+        IPW_DEBUG_WX("Name: %s\n", wrqu->name);
+        mutex_unlock(&priv->mutex);
+        return 0;
+}
 static int ipw_set_channel(struct ipw_priv *priv, u8 channel)
 {
        if (channel == 0) {
@@ -9973,7 +9972,7 @@ static int ipw_wx_sw_reset(struct net_device *dev,
 /* Rebase the WE IOCTLs to zero for the handler array */
 #define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
 static iw_handler ipw_wx_handlers[] = {
-        IW_IOCTL(SIOCGIWNAME) = (iw_handler) cfg80211_wext_giwname,
+        IW_IOCTL(SIOCGIWNAME) = ipw_wx_get_name,
        IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
        IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
        IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
@@ -11417,100 +11416,16 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
-        int i, rc = 0;
        struct ipw_priv *priv = libipw_priv(dev);
-        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
-        struct wireless_dev *wdev = &priv->ieee->wdev;
        mutex_lock(&priv->mutex);
        if (ipw_up(priv)) {
-                rc = -EIO;
+                mutex_unlock(&priv->mutex);
-                goto out;
+                return -EIO;
-        }
-        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
-        /* fill-out priv->ieee->bg_band */
-        if (geo->bg_channels) {
-                struct ieee80211_supported_band *bg_band = &priv->ieee->bg_band;
-                bg_band->band = IEEE80211_BAND_2GHZ;
-                bg_band->n_channels = geo->bg_channels;
-                bg_band->channels =
-                        kzalloc(geo->bg_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
-                /* translate geo->bg to bg_band.channels */
-                for (i = 0; i < geo->bg_channels; i++) {
-                        bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
-                        bg_band->channels[i].center_freq = geo->bg[i].freq;
-                        bg_band->channels[i].hw_value = geo->bg[i].channel;
-                        bg_band->channels[i].max_power = geo->bg[i].max_power;
-                        if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
-                                bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
-                        if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
-                                bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
-                        if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
-                                bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_RADAR;
-                        /* No equivalent for LIBIPW_CH_80211H_RULES,
-                           LIBIPW_CH_UNIFORM_SPREADING, or
-                           LIBIPW_CH_B_ONLY... */
-                }
-                /* point at bitrate info */
-                bg_band->bitrates = ipw2200_bg_rates;
-                bg_band->n_bitrates = ipw2200_num_bg_rates;
-                wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
-        }
-        /* fill-out priv->ieee->a_band */
-        if (geo->a_channels) {
-                struct ieee80211_supported_band *a_band = &priv->ieee->a_band;
-                a_band->band = IEEE80211_BAND_5GHZ;
-                a_band->n_channels = geo->a_channels;
-                a_band->channels =
-                        kzalloc(geo->a_channels *
-                                sizeof(struct ieee80211_channel), GFP_KERNEL);
-                /* translate geo->bg to a_band.channels */
-                for (i = 0; i < geo->a_channels; i++) {
-                        a_band->channels[i].band = IEEE80211_BAND_2GHZ;
-                        a_band->channels[i].center_freq = geo->a[i].freq;
-                        a_band->channels[i].hw_value = geo->a[i].channel;
-                        a_band->channels[i].max_power = geo->a[i].max_power;
-                        if (geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY)
-                                a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
-                        if (geo->a[i].flags & LIBIPW_CH_NO_IBSS)
-                                a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
-                        if (geo->a[i].flags & LIBIPW_CH_RADAR_DETECT)
-                                a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_RADAR;
-                        /* No equivalent for LIBIPW_CH_80211H_RULES,
-                           LIBIPW_CH_UNIFORM_SPREADING, or
-                           LIBIPW_CH_B_ONLY... */
-                }
-                /* point at bitrate info */
-                a_band->bitrates = ipw2200_a_rates;
-                a_band->n_bitrates = ipw2200_num_a_rates;
-                wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = a_band;
-        }
-        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
-        /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
-                rc = -EIO;
-                goto out;
        }
-out:
        mutex_unlock(&priv->mutex);
-        return rc;
+        return 0;
 }
 /* PCI driver stuff */
@@ -11641,7 +11556,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
        if (priv->prom_net_dev)
                return -EPERM;
-        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv), 1);
+        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv));
        if (priv->prom_net_dev == NULL)
                return -ENOMEM;
@@ -11660,7 +11575,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
        rc = register_netdev(priv->prom_net_dev);
        if (rc) {
-                free_ieee80211(priv->prom_net_dev, 1);
+                free_ieee80211(priv->prom_net_dev);
                priv->prom_net_dev = NULL;
                return rc;
        }
@@ -11674,7 +11589,7 @@ static void ipw_prom_free(struct ipw_priv *priv)
                return;
        unregister_netdev(priv->prom_net_dev);
-        free_ieee80211(priv->prom_net_dev, 1);
+        free_ieee80211(priv->prom_net_dev);
        priv->prom_net_dev = NULL;
 }
@@ -11702,7 +11617,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        struct ipw_priv *priv;
        int i;
-        net_dev = alloc_ieee80211(sizeof(struct ipw_priv), 0);
+        net_dev = alloc_ieee80211(sizeof(struct ipw_priv));
        if (net_dev == NULL) {
                err = -ENOMEM;
                goto out;
@@ -11850,7 +11765,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
      out_free_ieee80211:
-        free_ieee80211(priv->net_dev, 0);
+        free_ieee80211(priv->net_dev);
      out:
        return err;
 }
@@ -11917,7 +11832,7 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
        pci_release_regions(pdev);
        pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
-        free_ieee80211(priv->net_dev, 0);
+        free_ieee80211(priv->net_dev);
        free_firmware();
 }
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index bf45391172f..1e334ff6bd5 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -31,7 +31,6 @@
 #include <linux/ieee80211.h>
 #include <net/lib80211.h>
-#include <net/cfg80211.h>
 #define LIBIPW_VERSION "git-1.1.13"
@@ -784,15 +783,12 @@ struct libipw_geo {
 struct libipw_device {
        struct net_device *dev;
-        struct wireless_dev wdev;
        struct libipw_security sec;
        /* Bookkeeping structures */
        struct libipw_stats ieee_stats;
        struct libipw_geo geo;
-        struct ieee80211_supported_band bg_band;
-        struct ieee80211_supported_band a_band;
        /* Probe / Beacon management */
        struct list_head network_free_list;
@@ -1018,8 +1014,8 @@ static inline int libipw_is_cck_rate(u8 rate)
 }
 /* ieee80211.c */
-extern void free_ieee80211(struct net_device *dev, int monitor);
+extern void free_ieee80211(struct net_device *dev);
-extern struct net_device *alloc_ieee80211(int sizeof_priv, int monitor);
+extern struct net_device *alloc_ieee80211(int sizeof_priv);
 extern int libipw_change_mtu(struct net_device *dev, int new_mtu);
 extern void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index a0e9f6aed7d..eb2b60834c1 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -62,9 +62,6 @@ MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_AUTHOR(DRV_COPYRIGHT);
 MODULE_LICENSE("GPL");
-struct cfg80211_ops libipw_config_ops = { };
-void *libipw_wiphy_privid = &libipw_wiphy_privid;
 static int libipw_networks_allocate(struct libipw_device *ieee)
 {
        if (ieee->networks)
@@ -143,7 +140,7 @@ int libipw_change_mtu(struct net_device *dev, int new_mtu)
 }
 EXPORT_SYMBOL(libipw_change_mtu);
-struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
+struct net_device *alloc_ieee80211(int sizeof_priv)
 {
        struct libipw_device *ieee;
        struct net_device *dev;
@@ -160,31 +157,10 @@ struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
        ieee->dev = dev;
-        if (!monitor) {
-                ieee->wdev.wiphy = wiphy_new(&libipw_config_ops, 0);
-                if (!ieee->wdev.wiphy) {
-                        LIBIPW_ERROR("Unable to allocate wiphy.\n");
-                        goto failed_free_netdev;
-                }
-                ieee->dev->ieee80211_ptr = &ieee->wdev;
-                ieee->wdev.iftype = NL80211_IFTYPE_STATION;
-                /* Fill-out wiphy structure bits we know...  Not enough info
-                   here to call set_wiphy_dev or set MAC address or channel info
-                   -- have to do that in ->ndo_init... */
-                ieee->wdev.wiphy->privid = libipw_wiphy_privid;
-                ieee->wdev.wiphy->max_scan_ssids = 1;
-                ieee->wdev.wiphy->max_scan_ie_len = 0;
-                ieee->wdev.wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION)
-                                                | BIT(NL80211_IFTYPE_ADHOC);
-        }
        err = libipw_networks_allocate(ieee);
        if (err) {
                LIBIPW_ERROR("Unable to allocate beacon storage: %d\n", err);
-                goto failed_free_wiphy;
+                goto failed_free_netdev;
        }
        libipw_networks_initialize(ieee);
@@ -217,31 +193,19 @@ struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
        return dev;
-failed_free_wiphy:
-        if (!monitor)
-                wiphy_free(ieee->wdev.wiphy);
 failed_free_netdev:
        free_netdev(dev);
 failed:
        return NULL;
 }
-void free_ieee80211(struct net_device *dev, int monitor)
+void free_ieee80211(struct net_device *dev)
 {
        struct libipw_device *ieee = netdev_priv(dev);
        lib80211_crypt_info_free(&ieee->crypt_info);
        libipw_networks_free(ieee);
-        /* free cfg80211 resources */
-        if (!monitor) {
-                wiphy_unregister(ieee->wdev.wiphy);
-                kfree(ieee->a_band.channels);
-                kfree(ieee->bg_band.channels);
-                wiphy_free(ieee->wdev.wiphy);
-        }
        free_netdev(dev);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 2716b91ba9f..950267ab556 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -161,5 +161,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_1000,
        .shadow_ram_support = false,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c295b8ee922..1473452ba22 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -175,6 +175,7 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 /*
@@ -198,6 +199,7 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -218,6 +220,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -238,6 +241,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 struct iwl_cfg iwl6050_3agn_cfg = {
@@ -258,6 +262,7 @@ struct iwl_cfg iwl6050_3agn_cfg = {
        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
        .shadow_ram_support = true,
        .ht_greenfield_support = true,
+        .use_rts_for_ht = true, /* use rts/cts protection */
 };
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 346dc06fa7b..81726ee3285 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -418,6 +418,15 @@ static void rs_tl_turn_on_agg(struct iwl_priv *priv, u8 tid,
        else if (tid == IWL_AGG_ALL_TID)
                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
                        rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
+        if (priv->cfg->use_rts_for_ht) {
+                /*
+                 * switch to RTS/CTS if it is the prefer protection method
+                 * for HT traffic
+                 */
+                IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
+                priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
+                iwlcore_commit_rxon(priv);
+        }
 }
 static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index eaafae091f5..921dc4a26fe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -116,9 +116,6 @@ int iwl_commit_rxon(struct iwl_priv *priv)
        /* always get timestamp with Rx frame */
        priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK;
-        /* allow CTS-to-self if possible. this is relevant only for
-         * 5000, but will not damage 4965 */
-        priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
        ret = iwl_check_rxon_cmd(priv);
        if (ret) {
@@ -218,6 +215,13 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                                        "Could not send WEP static key.\n");
                }
+                /*
+                 * allow CTS-to-self if possible for new association.
+                 * this is relevant only for 5000 series and up,
+                 * but will not damage 4965
+                 */
+                priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
                /* Apply the new configuration
                 * RXON assoc doesn't clear the station table in uCode,
                 */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index e50103a956b..7754538c219 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -213,6 +213,7 @@ struct iwl_mod_params {
 * @pa_type: used by 6000 series only to identify the type of Power Amplifier
 * @max_ll_items: max number of OTP blocks
 * @shadow_ram_support: shadow support for OTP memory
+ * @use_rts_for_ht: use rts/cts protection for HT traffic
 *
 * We enable the driver to be backward compatible wrt API version. The
 * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -255,6 +256,7 @@ struct iwl_cfg {
        const bool shadow_ram_support;
        const bool ht_greenfield_support;
        const bool broken_powersave;
+        bool use_rts_for_ht;
 };
 /***************************
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 039b555e4d7..53d56ab83c0 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -169,16 +169,19 @@ static int lbs_ethtool_set_wol(struct net_device *dev,
        struct lbs_private *priv = dev->ml_priv;
        uint32_t criteria = 0;
-        if (priv->wol_criteria == 0xffffffff && wol->wolopts)
-                return -EOPNOTSUPP;
        if (wol->wolopts & ~(WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY))
                return -EOPNOTSUPP;
-        if (wol->wolopts & WAKE_UCAST) criteria |= EHS_WAKE_ON_UNICAST_DATA;
+        if (wol->wolopts & WAKE_UCAST)
-        if (wol->wolopts & WAKE_MCAST) criteria |= EHS_WAKE_ON_MULTICAST_DATA;
+                criteria |= EHS_WAKE_ON_UNICAST_DATA;
-        if (wol->wolopts & WAKE_BCAST) criteria |= EHS_WAKE_ON_BROADCAST_DATA;
+        if (wol->wolopts & WAKE_MCAST)
-        if (wol->wolopts & WAKE_PHY)   criteria |= EHS_WAKE_ON_MAC_EVENT;
+                criteria |= EHS_WAKE_ON_MULTICAST_DATA;
+        if (wol->wolopts & WAKE_BCAST)
+                criteria |= EHS_WAKE_ON_BROADCAST_DATA;
+        if (wol->wolopts & WAKE_PHY)
+                criteria |= EHS_WAKE_ON_MAC_EVENT;
+        if (wol->wolopts == 0)
+                criteria |= EHS_REMOVE_WAKEUP;
        return lbs_host_sleep_cfg(priv, criteria, (struct wol_config *)NULL);
 }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 17e199546ee..92af9b96bb7 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -426,12 +426,16 @@ static const char p54u_romboot_3887[] = "~~~~";
 static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
 {
        struct p54u_priv *priv = dev->priv;
-        u8 buf[4];
+        u8 *buf;
        int ret;
-        memcpy(&buf, p54u_romboot_3887, sizeof(buf));
+        buf = kmalloc(4, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        memcpy(buf, p54u_romboot_3887, 4);
        ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
-                            buf, sizeof(buf));
+                            buf, 4);
+        kfree(buf);
        if (ret)
                dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
                        "boot ROM (%d)!\n", ret);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
index 9fab13e4004..cad8037ab2a 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
@@ -18,6 +18,7 @@
 #include <net/mac80211.h>
 #include "rtl8187.h"
+#include "rtl8187_rfkill.h"
 static bool rtl8187_is_radio_enabled(struct rtl8187_priv *priv)
 {
diff --git a/drivers/scsi/bfa/bfad_fwimg.c b/drivers/scsi/bfa/bfad_fwimg.c
index b2f6949bc8d..bd34b0db2d6 100644
--- a/drivers/scsi/bfa/bfad_fwimg.c
+++ b/drivers/scsi/bfa/bfad_fwimg.c
@@ -41,6 +41,8 @@ u32 *bfi_image_cb;
 #define BFAD_FW_FILE_CT "ctfw.bin"
 #define BFAD_FW_FILE_CB "cbfw.bin"
+MODULE_FIRMWARE(BFAD_FW_FILE_CT);
+MODULE_FIRMWARE(BFAD_FW_FILE_CB);
 u32 *
 bfad_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 158c99243c0..55d012a9a66 100644
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -948,7 +948,7 @@ bfad_os_fc_host_init(struct bfad_im_port_s *im_port)
        if (bfad_supported_fc4s & (BFA_PORT_ROLE_FCP_IM | BFA_PORT_ROLE_FCP_TM))
                /* For FCP type 0x08 */
                fc_host_supported_fc4s(host)[2] = 1;
-        if (bfad_supported_fc4s | BFA_PORT_ROLE_FCP_IPFC)
+        if (bfad_supported_fc4s & BFA_PORT_ROLE_FCP_IPFC)
                /* For LLC/SNAP type 0x05 */
                fc_host_supported_fc4s(host)[3] = 0x20;
        /* For fibre channel services type 0x20 */
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 185e6bc4dd4..9e8fce0f0c1 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *ha, int handle, gdth_evt_str *estr)
        eindex = handle;
    estr->event_source = 0;
-    if (eindex >= MAX_EVENTS) {
+    if (eindex < 0 || eindex >= MAX_EVENTS) {
        spin_unlock_irqrestore(&ha->smp_lock, flags);
        return eindex;
    }
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 5f045505a1f..76d294fc784 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4189,6 +4189,25 @@ static irqreturn_t ipr_handle_other_interrupt(struct ipr_ioa_cfg *ioa_cfg,
 }
 /**
+ * ipr_isr_eh - Interrupt service routine error handler
+ * @ioa_cfg:    ioa config struct
+ * @msg:        message to log
+ *
+ * Return value:
+ *      none
+ **/
+static void ipr_isr_eh(struct ipr_ioa_cfg *ioa_cfg, char *msg)
+{
+        ioa_cfg->errors_logged++;
+        dev_err(&ioa_cfg->pdev->dev, "%s\n", msg);
+        if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
+                ioa_cfg->sdt_state = GET_DUMP;
+        ipr_initiate_ioa_reset(ioa_cfg, IPR_SHUTDOWN_NONE);
+}
+/**
 * ipr_isr - Interrupt service routine
 * @irq:        irq number
 * @devp:       pointer to ioa config struct
@@ -4203,6 +4222,7 @@ static irqreturn_t ipr_isr(int irq, void *devp)
        volatile u32 int_reg, int_mask_reg;
        u32 ioasc;
        u16 cmd_index;
+        int num_hrrq = 0;
        struct ipr_cmnd *ipr_cmd;
        irqreturn_t rc = IRQ_NONE;
@@ -4233,13 +4253,7 @@ static irqreturn_t ipr_isr(int irq, void *devp)
                                     IPR_HRRQ_REQ_RESP_HANDLE_MASK) >> IPR_HRRQ_REQ_RESP_HANDLE_SHIFT;
                        if (unlikely(cmd_index >= IPR_NUM_CMD_BLKS)) {
-                                ioa_cfg->errors_logged++;
+                                ipr_isr_eh(ioa_cfg, "Invalid response handle from IOA");
-                                dev_err(&ioa_cfg->pdev->dev, "Invalid response handle from IOA\n");
-                                if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
-                                        ioa_cfg->sdt_state = GET_DUMP;
-                                ipr_initiate_ioa_reset(ioa_cfg, IPR_SHUTDOWN_NONE);
                                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
                                return IRQ_HANDLED;
                        }
@@ -4266,8 +4280,18 @@ static irqreturn_t ipr_isr(int irq, void *devp)
                if (ipr_cmd != NULL) {
                        /* Clear the PCI interrupt */
-                        writel(IPR_PCII_HRRQ_UPDATED, ioa_cfg->regs.clr_interrupt_reg);
+                        do {
-                        int_reg = readl(ioa_cfg->regs.sense_interrupt_reg) & ~int_mask_reg;
+                                writel(IPR_PCII_HRRQ_UPDATED, ioa_cfg->regs.clr_interrupt_reg);
+                                int_reg = readl(ioa_cfg->regs.sense_interrupt_reg) & ~int_mask_reg;
+                        } while (int_reg & IPR_PCII_HRRQ_UPDATED &&
+                                        num_hrrq++ < IPR_MAX_HRRQ_RETRIES);
+                        if (int_reg & IPR_PCII_HRRQ_UPDATED) {
+                                ipr_isr_eh(ioa_cfg, "Error clearing HRRQ");
+                                spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags);
+                                return IRQ_HANDLED;
+                        }
                } else
                        break;
        }
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index 163245a1c3e..19bbcf39f0c 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -144,6 +144,7 @@
 #define IPR_IOA_MAX_SECTORS                             32767
 #define IPR_VSET_MAX_SECTORS                            512
 #define IPR_MAX_CDB_LEN                                 16
+#define IPR_MAX_HRRQ_RETRIES                            3
 #define IPR_DEFAULT_BUS_WIDTH                           16
 #define IPR_80MBs_SCSI_RATE             ((80 * 10) / (IPR_DEFAULT_BUS_WIDTH / 8))
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index b3381959acc..33cf988c8c8 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -960,7 +960,6 @@ static int sas_ex_discover_dev(struct domain_device *dev, int phy_id)
                        }
                }
-                res = 0;
        }
        return res;
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index f7c70e2a822..0a97bc9074b 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1071,7 +1071,7 @@ static struct pmcraid_cmd *pmcraid_init_hcam
        ioarcb->data_transfer_length = cpu_to_le32(rcb_size);
-        ioadl[0].flags |= cpu_to_le32(IOADL_FLAGS_READ_LAST);
+        ioadl[0].flags |= IOADL_FLAGS_READ_LAST;
        ioadl[0].data_len = cpu_to_le32(rcb_size);
        ioadl[0].address = cpu_to_le32(dma);
@@ -2251,7 +2251,7 @@ static void pmcraid_request_sense(struct pmcraid_cmd *cmd)
        ioadl->address = cpu_to_le64(cmd->sense_buffer_dma);
        ioadl->data_len = cpu_to_le32(SCSI_SENSE_BUFFERSIZE);
-        ioadl->flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+        ioadl->flags = IOADL_FLAGS_LAST_DESC;
        /* request sense might be called as part of error response processing
         * which runs in tasklets context. It is possible that mid-layer might
@@ -3017,7 +3017,7 @@ static int pmcraid_build_ioadl(
                ioadl[i].flags = 0;
        }
        /* setup last descriptor */
-        ioadl[i - 1].flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+        ioadl[i - 1].flags = IOADL_FLAGS_LAST_DESC;
        return 0;
 }
@@ -3387,7 +3387,7 @@ static int pmcraid_build_passthrough_ioadls(
        }
        /* setup the last descriptor */
-        ioadl[i - 1].flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+        ioadl[i - 1].flags = IOADL_FLAGS_LAST_DESC;
        return 0;
 }
@@ -5314,7 +5314,7 @@ static void pmcraid_querycfg(struct pmcraid_cmd *cmd)
                cpu_to_le32(sizeof(struct pmcraid_config_table));
        ioadl = &(ioarcb->add_data.u.ioadl[0]);
-        ioadl->flags = cpu_to_le32(IOADL_FLAGS_LAST_DESC);
+        ioadl->flags = IOADL_FLAGS_LAST_DESC;
        ioadl->address = cpu_to_le64(pinstance->cfg_table_bus_addr);
        ioadl->data_len = cpu_to_le32(sizeof(struct pmcraid_config_table));
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index a67fed10598..c6f70dae9b2 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3656,6 +3656,7 @@ fc_bsg_host_dispatch(struct request_queue *q, struct Scsi_Host *shost,
 fail_host_msg:
        /* return the errno failure code as the only status */
        BUG_ON(job->reply_len < sizeof(uint32_t));
+        job->reply->reply_payload_rcv_len = 0;
        job->reply->result = ret;
        job->reply_len = sizeof(uint32_t);
        fc_bsg_jobdone(job);
@@ -3741,6 +3742,7 @@ check_bidi:
 fail_rport_msg:
        /* return the errno failure code as the only status */
        BUG_ON(job->reply_len < sizeof(uint32_t));
+        job->reply->reply_payload_rcv_len = 0;
        job->reply->result = ret;
        job->reply_len = sizeof(uint32_t);
        fc_bsg_jobdone(job);
@@ -3797,6 +3799,7 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost,
                /* check if we have the msgcode value at least */
                if (job->request_len < sizeof(uint32_t)) {
                        BUG_ON(job->reply_len < sizeof(uint32_t));
+                        job->reply->reply_payload_rcv_len = 0;
                        job->reply->result = -ENOMSG;
                        job->reply_len = sizeof(uint32_t);
                        fc_bsg_jobdone(job);
diff --git a/drivers/spi/spi_stmp.c b/drivers/spi/spi_stmp.c
index d871dc23909..2552bb36400 100644
--- a/drivers/spi/spi_stmp.c
+++ b/drivers/spi/spi_stmp.c
@@ -242,7 +242,7 @@ static int stmp_spi_txrx_dma(struct stmp_spi *ss, int cs,
        wait_for_completion(&ss->done);
        if (!busy_wait(readl(ss->regs + HW_SSP_CTRL0) & BM_SSP_CTRL0_RUN))
-                status = ETIMEDOUT;
+                status = -ETIMEDOUT;
        if (!dma_buf)
                dma_unmap_single(ss->master_dev, spi_buf_dma, len, dir);
diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c
index b74212d698c..e8b89e8ac9b 100644
--- a/drivers/ssb/scan.c
+++ b/drivers/ssb/scan.c
@@ -162,6 +162,8 @@ static u8 chipid_to_nrcores(u16 chipid)
 static u32 scan_read32(struct ssb_bus *bus, u8 current_coreidx,
                       u16 offset)
 {
+        u32 lo, hi;
        switch (bus->bustype) {
        case SSB_BUSTYPE_SSB:
                offset += current_coreidx * SSB_CORE_SIZE;
@@ -174,7 +176,9 @@ static u32 scan_read32(struct ssb_bus *bus, u8 current_coreidx,
                        offset -= 0x800;
                } else
                        ssb_pcmcia_switch_segment(bus, 0);
-                break;
+                lo = readw(bus->mmio + offset);
+                hi = readw(bus->mmio + offset + 2);
+                return lo | (hi << 16);
        case SSB_BUSTYPE_SDIO:
                offset += current_coreidx * SSB_CORE_SIZE;
                return ssb_sdio_scan_read32(bus, offset);
diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c
index 02347c57357..aa53db9f2e8 100644
--- a/drivers/uio/uio_pdrv_genirq.c
+++ b/drivers/uio/uio_pdrv_genirq.c
@@ -178,6 +178,7 @@ static int uio_pdrv_genirq_probe(struct platform_device *pdev)
        return 0;
 bad1:
        kfree(priv);
+        pm_runtime_disable(&pdev->dev);
 bad0:
        return ret;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e3861b21e77..e4eca7810bc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -609,9 +609,9 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
        acm->throttle = 0;
-        tasklet_schedule(&acm->urb_task);
        set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
        rv = tty_port_block_til_ready(&acm->port, tty, filp);
+        tasklet_schedule(&acm->urb_task);
 done:
        mutex_unlock(&acm->mutex);
 err_out:
@@ -686,15 +686,21 @@ static void acm_tty_close(struct tty_struct *tty, struct file *filp)
        /* Perform the closing process and see if we need to do the hardware
           shutdown */
-        if (!acm || tty_port_close_start(&acm->port, tty, filp) == 0)
+        if (!acm)
+                return;
+        if (tty_port_close_start(&acm->port, tty, filp) == 0) {
+                mutex_lock(&open_mutex);
+                if (!acm->dev) {
+                        tty_port_tty_set(&acm->port, NULL);
+                        acm_tty_unregister(acm);
+                        tty->driver_data = NULL;
+                }
+                mutex_unlock(&open_mutex);
                return;
+        }
        acm_port_down(acm, 0);
        tty_port_close_end(&acm->port, tty);
-        mutex_lock(&open_mutex);
        tty_port_tty_set(&acm->port, NULL);
-        if (!acm->dev)
-                acm_tty_unregister(acm);
-        mutex_unlock(&open_mutex);
 }
 static int acm_tty_write(struct tty_struct *tty,
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 78bb7710f36..24eb7478191 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -87,6 +87,7 @@ static int ohci_restart (struct ohci_hcd *ohci);
 #ifdef CONFIG_PCI
 static void quirk_amd_pll(int state);
 static void amd_iso_dev_put(void);
+static void sb800_prefetch(struct ohci_hcd *ohci, int on);
 #else
 static inline void quirk_amd_pll(int state)
 {
@@ -96,6 +97,10 @@ static inline void amd_iso_dev_put(void)
 {
        return;
 }
+static inline void sb800_prefetch(struct ohci_hcd *ohci, int on)
+{
+        return;
+}
 #endif
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index d2ba04dd785..b8a1148f248 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -177,6 +177,13 @@ static int ohci_quirk_amd700(struct usb_hcd *hcd)
                return 0;
        pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+        /* SB800 needs pre-fetch fix */
+        if ((rev >= 0x40) && (rev <= 0x4f)) {
+                ohci->flags |= OHCI_QUIRK_AMD_PREFETCH;
+                ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
+        }
        if ((rev > 0x3b) || (rev < 0x30)) {
                pci_dev_put(amd_smbus_dev);
                amd_smbus_dev = NULL;
@@ -262,6 +269,19 @@ static void amd_iso_dev_put(void)
 }
+static void sb800_prefetch(struct ohci_hcd *ohci, int on)
+{
+        struct pci_dev *pdev;
+        u16 misc;
+        pdev = to_pci_dev(ohci_to_hcd(ohci)->self.controller);
+        pci_read_config_word(pdev, 0x50, &misc);
+        if (on == 0)
+                pci_write_config_word(pdev, 0x50, misc & 0xfcff);
+        else
+                pci_write_config_word(pdev, 0x50, misc | 0x0300);
+}
 /* List of quirks for OHCI */
 static const struct pci_device_id ohci_pci_quirks[] = {
        {
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index 16fecb8ecc3..35288bcae0d 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -49,9 +49,12 @@ __acquires(ohci->lock)
        switch (usb_pipetype (urb->pipe)) {
        case PIPE_ISOCHRONOUS:
                ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--;
-                if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
+                if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
-                                && quirk_amdiso(ohci))
+                        if (quirk_amdiso(ohci))
-                        quirk_amd_pll(1);
+                                quirk_amd_pll(1);
+                        if (quirk_amdprefetch(ohci))
+                                sb800_prefetch(ohci, 0);
+                }
                break;
        case PIPE_INTERRUPT:
                ohci_to_hcd(ohci)->self.bandwidth_int_reqs--;
@@ -680,9 +683,12 @@ static void td_submit_urb (
                                data + urb->iso_frame_desc [cnt].offset,
                                urb->iso_frame_desc [cnt].length, urb, cnt);
                }
-                if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
+                if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
-                                && quirk_amdiso(ohci))
+                        if (quirk_amdiso(ohci))
-                        quirk_amd_pll(0);
+                                quirk_amd_pll(0);
+                        if (quirk_amdprefetch(ohci))
+                                sb800_prefetch(ohci, 1);
+                }
                periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0
                        && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0;
                break;
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 222011f6172..5bf15fed0d9 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -402,6 +402,7 @@ struct ohci_hcd {
 #define OHCI_QUIRK_FRAME_NO     0x80                    /* no big endian frame_no shift */
 #define OHCI_QUIRK_HUB_POWER    0x100                   /* distrust firmware power/oc setup */
 #define OHCI_QUIRK_AMD_ISO      0x200                   /* ISO transfers*/
+#define OHCI_QUIRK_AMD_PREFETCH 0x400                   /* pre-fetch for ISO transfer */
        // there are also chip quirks/bugs in init logic
        struct work_struct      nec_work;       /* Worker for NEC quirk */
@@ -433,6 +434,10 @@ static inline int quirk_amdiso(struct ohci_hcd *ohci)
 {
        return ohci->flags & OHCI_QUIRK_AMD_ISO;
 }
+static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
+{
+        return ohci->flags & OHCI_QUIRK_AMD_PREFETCH;
+}
 #else
 static inline int quirk_nec(struct ohci_hcd *ohci)
 {
@@ -446,6 +451,10 @@ static inline int quirk_amdiso(struct ohci_hcd *ohci)
 {
        return 0;
 }
+static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
+{
+        return 0;
+}
 #endif
 /* convert between an hcd pointer and the corresponding ohci_hcd */
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1db4fea8c17..b8fd270a8b0 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -802,9 +802,11 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
        int i;
        /* Free the Event Ring Segment Table and the actual Event Ring */
-        xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
+        if (xhci->ir_set) {
-        xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+                xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
-        xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
+                xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+                xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
+        }
        size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
        if (xhci->erst.entries)
                pci_free_consistent(pdev, size,
@@ -841,9 +843,9 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
                                xhci->dcbaa, xhci->dcbaa->dma);
        xhci->dcbaa = NULL;
+        scratchpad_free(xhci);
        xhci->page_size = 0;
        xhci->page_shift = 0;
-        scratchpad_free(xhci);
 }
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 173c39c7648..821b7b4709d 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -864,9 +864,11 @@ static struct xhci_segment *trb_in_td(
        cur_seg = start_seg;
        do {
+                if (start_dma == 0)
+                        return 0;
                /* We may get an event for a Link TRB in the middle of a TD */
                end_seg_dma = xhci_trb_virt_to_dma(cur_seg,
-                                &start_seg->trbs[TRBS_PER_SEGMENT - 1]);
+                                &cur_seg->trbs[TRBS_PER_SEGMENT - 1]);
                /* If the end TRB isn't in this segment, this is set to 0 */
                end_trb_dma = xhci_trb_virt_to_dma(cur_seg, end_trb);
@@ -893,8 +895,9 @@ static struct xhci_segment *trb_in_td(
                }
                cur_seg = cur_seg->next;
                start_dma = xhci_trb_virt_to_dma(cur_seg, &cur_seg->trbs[0]);
-        } while (1);
+        } while (cur_seg != start_seg);
+        return 0;
 }
 /*
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 9ed3e741bee..10f3205798e 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -348,12 +348,12 @@ static unsigned int mon_buff_area_alloc_contiguous(struct mon_reader_bin *rp,
 /*
 * Return a few (kilo-)bytes to the head of the buffer.
- * This is used if a DMA fetch fails.
+ * This is used if a data fetch fails.
 */
 static void mon_buff_area_shrink(struct mon_reader_bin *rp, unsigned int size)
 {
-        size = (size + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
+        /* size &= ~(PKT_ALIGN-1);  -- we're called with aligned size */
        rp->b_cnt -= size;
        if (rp->b_in < size)
                rp->b_in += rp->b_size;
@@ -433,6 +433,7 @@ static void mon_bin_event(struct mon_reader_bin *rp, struct urb *urb,
        unsigned int urb_length;
        unsigned int offset;
        unsigned int length;
+        unsigned int delta;
        unsigned int ndesc, lendesc;
        unsigned char dir;
        struct mon_bin_hdr *ep;
@@ -537,8 +538,10 @@ static void mon_bin_event(struct mon_reader_bin *rp, struct urb *urb,
        if (length != 0) {
                ep->flag_data = mon_bin_get_data(rp, offset, urb, length);
                if (ep->flag_data != 0) {       /* Yes, it's 0x00, not '0' */
-                        ep->len_cap = 0;
+                        delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
-                        mon_buff_area_shrink(rp, length);
+                        ep->len_cap -= length;
+                        delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
+                        mon_buff_area_shrink(rp, delta);
                }
        } else {
                ep->flag_data = data_tag;
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 698252a4dc5..bd254ec97d1 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -50,6 +50,8 @@ static int cp210x_tiocmset_port(struct usb_serial_port *port, struct file *,
 static void cp210x_break_ctl(struct tty_struct *, int);
 static int cp210x_startup(struct usb_serial *);
 static void cp210x_disconnect(struct usb_serial *);
+static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
+static int cp210x_carrier_raised(struct usb_serial_port *p);
 static int debug;
@@ -143,6 +145,8 @@ static struct usb_serial_driver cp210x_device = {
        .tiocmset               = cp210x_tiocmset,
        .attach                 = cp210x_startup,
        .disconnect             = cp210x_disconnect,
+        .dtr_rts                = cp210x_dtr_rts,
+        .carrier_raised         = cp210x_carrier_raised
 };
 /* Config request types */
@@ -746,6 +750,14 @@ static int cp210x_tiocmset_port(struct usb_serial_port *port, struct file *file,
        return cp210x_set_config(port, CP210X_SET_MHS, &control, 2);
 }
+static void cp210x_dtr_rts(struct usb_serial_port *p, int on)
+{
+        if (on)
+                cp210x_tiocmset_port(p, NULL,  TIOCM_DTR|TIOCM_RTS, 0);
+        else
+                cp210x_tiocmset_port(p, NULL,  0, TIOCM_DTR|TIOCM_RTS);
+}
 static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
 {
        struct usb_serial_port *port = tty->driver_data;
@@ -768,6 +780,15 @@ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
        return result;
 }
+static int cp210x_carrier_raised(struct usb_serial_port *p)
+{
+        unsigned int control;
+        cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
+        if (control & CONTROL_DCD)
+                return 1;
+        return 0;
+}
 static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 {
        struct usb_serial_port *port = tty->driver_data;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index cd44c68954d..319aaf9725b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -308,6 +308,7 @@ static int  option_resume(struct usb_serial *serial);
 #define DLINK_VENDOR_ID                         0x1186
 #define DLINK_PRODUCT_DWM_652                   0x3e04
+#define DLINK_PRODUCT_DWM_652_U5                0xce16
 #define QISDA_VENDOR_ID                         0x1da5
 #define QISDA_PRODUCT_H21_4512                  0x4512
@@ -586,6 +587,7 @@ static struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
        { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+        { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
        { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index d065894ce38..035d56835b7 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -704,7 +704,7 @@ static int __init fb_probe(struct platform_device *device)
        if (i == ARRAY_SIZE(known_lcd_panels)) {
                dev_err(&device->dev, "GLCD: No valid panel found\n");
-                ret = ENODEV;
+                ret = -ENODEV;
                goto err_clk_disable;
        } else
                dev_info(&device->dev, "GLCD: Found %s panel\n",
diff --git a/fs/fcntl.c b/fs/fcntl.c
index fc089f2f7f5..2cf93ec40a6 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -284,7 +284,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
                type = PIDTYPE_PID;
                break;
-        case F_OWNER_GID:
+        case F_OWNER_PGRP:
                type = PIDTYPE_PGID;
                break;
@@ -321,7 +321,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
                break;
        case PIDTYPE_PGID:
-                owner.type = F_OWNER_GID;
+                owner.type = F_OWNER_PGRP;
                break;
        default:
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 07f77a7945c..822c2d50651 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -571,7 +571,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                rsslim,
                mm ? mm->start_code : 0,
                mm ? mm->end_code : 0,
-                (permitted) ? task->stack_start : 0,
+                (permitted && mm) ? task->stack_start : 0,
                esp,
                eip,
                /* The signal information here is obsolete.
diff --git a/include/asm-generic/fcntl.h b/include/asm-generic/fcntl.h
index cd2d7896e34..495dc8af404 100644
--- a/include/asm-generic/fcntl.h
+++ b/include/asm-generic/fcntl.h
@@ -89,7 +89,7 @@
 #define F_OWNER_TID     0
 #define F_OWNER_PID     1
-#define F_OWNER_GID     2
+#define F_OWNER_PGRP    2
 struct f_owner_ex {
        int     type;
diff --git a/include/linux/isdn_ppp.h b/include/linux/isdn_ppp.h
index 4c218ee7587..8687a7dc063 100644
--- a/include/linux/isdn_ppp.h
+++ b/include/linux/isdn_ppp.h
@@ -157,7 +157,7 @@ typedef struct {
 typedef struct {
  int mp_mrru;                        /* unused                             */
-  struct sk_buff_head frags;    /* fragments sl list */
+  struct sk_buff * frags;       /* fragments sl list -- use skb->next */
  long frames;                  /* number of frames in the frame list */
  unsigned int seq;             /* last processed packet seq #: any packets
                                 * with smaller seq # will be dropped
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index cd15df6c63c..5e781d824e6 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -301,6 +301,8 @@ static inline int unregister_pm_notifier(struct notifier_block *nb)
 #define pm_notifier(fn, pri)    do { (void)(fn); } while (0)
 #endif /* !CONFIG_PM_SLEEP */
+extern struct mutex pm_mutex;
 #ifndef CONFIG_HIBERNATION
 static inline void register_nosave_region(unsigned long b, unsigned long e)
 {
@@ -308,8 +310,23 @@ static inline void register_nosave_region(unsigned long b, unsigned long e)
 static inline void register_nosave_region_late(unsigned long b, unsigned long e)
 {
 }
-#endif
-extern struct mutex pm_mutex;
+static inline void lock_system_sleep(void) {}
+static inline void unlock_system_sleep(void) {}
+#else
+/* Let some subsystems like memory hotadd exclude hibernation */
+static inline void lock_system_sleep(void)
+{
+        mutex_lock(&pm_mutex);
+}
+static inline void unlock_system_sleep(void)
+{
+        mutex_unlock(&pm_mutex);
+}
+#endif
 #endif /* _LINUX_SUSPEND_H */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 6e5f0e0c796..cd2e18778f8 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1980,7 +1980,7 @@ void sctp_assoc_set_primary(struct sctp_association *,
 void sctp_assoc_del_nonprimary_peers(struct sctp_association *,
                                    struct sctp_transport *);
 int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *,
-                                     gfp_t);
+                                     sctp_scope_t, gfp_t);
 int sctp_assoc_set_bind_addr_from_cookie(struct sctp_association *,
                                         struct sctp_cookie*,
                                         gfp_t gfp);
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 6e728b17690..47941fc5aba 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -797,30 +797,23 @@ static inline unsigned int scsi_host_get_prot(struct Scsi_Host *shost)
 static inline unsigned int scsi_host_dif_capable(struct Scsi_Host *shost, unsigned int target_type)
 {
-        switch (target_type) {
+        static unsigned char cap[] = { 0,
-        case 1:
+                                       SHOST_DIF_TYPE1_PROTECTION,
-                if (shost->prot_capabilities & SHOST_DIF_TYPE1_PROTECTION)
+                                       SHOST_DIF_TYPE2_PROTECTION,
-                        return target_type;
+                                       SHOST_DIF_TYPE3_PROTECTION };
-        case 2:
-                if (shost->prot_capabilities & SHOST_DIF_TYPE2_PROTECTION)
-                        return target_type;
-        case 3:
-                if (shost->prot_capabilities & SHOST_DIF_TYPE3_PROTECTION)
-                        return target_type;
-        }
-        return 0;
+        return shost->prot_capabilities & cap[target_type] ? target_type : 0;
 }
 static inline unsigned int scsi_host_dix_capable(struct Scsi_Host *shost, unsigned int target_type)
 {
 #if defined(CONFIG_BLK_DEV_INTEGRITY)
-        switch (target_type) {
+        static unsigned char cap[] = { SHOST_DIX_TYPE0_PROTECTION,
-        case 0: return shost->prot_capabilities & SHOST_DIX_TYPE0_PROTECTION;
+                                       SHOST_DIX_TYPE1_PROTECTION,
-        case 1: return shost->prot_capabilities & SHOST_DIX_TYPE1_PROTECTION;
+                                       SHOST_DIX_TYPE2_PROTECTION,
-        case 2: return shost->prot_capabilities & SHOST_DIX_TYPE2_PROTECTION;
+                                       SHOST_DIX_TYPE3_PROTECTION };
-        case 3: return shost->prot_capabilities & SHOST_DIX_TYPE3_PROTECTION;
-        }
+        return shost->prot_capabilities & cap[target_type];
 #endif
        return 0;
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 12328147132..67e526b6ae8 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -692,31 +692,29 @@ int schedule_on_each_cpu(work_func_t func)
        if (!works)
                return -ENOMEM;
+        get_online_cpus();
        /*
-         * when running in keventd don't schedule a work item on itself.
+         * When running in keventd don't schedule a work item on
-         * Can just call directly because the work queue is already bound.
+         * itself.  Can just call directly because the work queue is
-         * This also is faster.
+         * already bound.  This also is faster.
-         * Make this a generic parameter for other workqueues?
         */
-        if (current_is_keventd()) {
+        if (current_is_keventd())
                orig = raw_smp_processor_id();
-                INIT_WORK(per_cpu_ptr(works, orig), func);
-                func(per_cpu_ptr(works, orig));
-        }
-        get_online_cpus();
        for_each_online_cpu(cpu) {
                struct work_struct *work = per_cpu_ptr(works, cpu);
-                if (cpu == orig)
-                        continue;
                INIT_WORK(work, func);
-                schedule_work_on(cpu, work);
-        }
-        for_each_online_cpu(cpu) {
                if (cpu != orig)
-                        flush_work(per_cpu_ptr(works, cpu));
+                        schedule_work_on(cpu, work);
        }
+        if (orig >= 0)
+                func(per_cpu_ptr(works, orig));
+        for_each_online_cpu(cpu)
+                flush_work(per_cpu_ptr(works, cpu));
        put_online_cpus();
        free_percpu(works);
        return 0;
diff --git a/lib/string.c b/lib/string.c
index b19b87af65a..e96421ab9a9 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -246,13 +246,17 @@ EXPORT_SYMBOL(strlcat);
 #undef strcmp
 int strcmp(const char *cs, const char *ct)
 {
-        signed char __res;
+        unsigned char c1, c2;
        while (1) {
-                if ((__res = *cs - *ct++) != 0 || !*cs++)
+                c1 = *cs++;
+                c2 = *ct++;
+                if (c1 != c2)
+                        return c1 < c2 ? -1 : 1;
+                if (!c1)
                        break;
        }
-        return __res;
+        return 0;
 }
 EXPORT_SYMBOL(strcmp);
 #endif
@@ -266,14 +270,18 @@ EXPORT_SYMBOL(strcmp);
 */
 int strncmp(const char *cs, const char *ct, size_t count)
 {
-        signed char __res = 0;
+        unsigned char c1, c2;
        while (count) {
-                if ((__res = *cs - *ct++) != 0 || !*cs++)
+                c1 = *cs++;
+                c2 = *ct++;
+                if (c1 != c2)
+                        return c1 < c2 ? -1 : 1;
+                if (!c1)
                        break;
                count--;
        }
-        return __res;
+        return 0;
 }
 EXPORT_SYMBOL(strncmp);
 #endif
diff --git a/mm/Kconfig b/mm/Kconfig
index fd3386242cf..44cf6f0a3a6 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -128,12 +128,9 @@ config SPARSEMEM_VMEMMAP
 config MEMORY_HOTPLUG
        bool "Allow for memory hot-add"
        depends on SPARSEMEM || X86_64_ACPI_NUMA
-        depends on HOTPLUG && !(HIBERNATION && !S390) && ARCH_ENABLE_MEMORY_HOTPLUG
+        depends on HOTPLUG && ARCH_ENABLE_MEMORY_HOTPLUG
        depends on (IA64 || X86 || PPC_BOOK3S_64 || SUPERH || S390)
-comment "Memory hotplug is currently incompatible with Software Suspend"
-        depends on SPARSEMEM && HOTPLUG && HIBERNATION && !S390
 config MEMORY_HOTPLUG_SPARSE
        def_bool y
        depends on SPARSEMEM && MEMORY_HOTPLUG
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 821dee59637..2047465cd27 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -26,6 +26,7 @@
 #include <linux/migrate.h>
 #include <linux/page-isolation.h>
 #include <linux/pfn.h>
+#include <linux/suspend.h>
 #include <asm/tlbflush.h>
@@ -447,7 +448,8 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
 }
 #endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
-static pg_data_t *hotadd_new_pgdat(int nid, u64 start)
+/* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
+static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
 {
        struct pglist_data *pgdat;
        unsigned long zones_size[MAX_NR_ZONES] = {0};
@@ -484,14 +486,18 @@ int __ref add_memory(int nid, u64 start, u64 size)
        struct resource *res;
        int ret;
+        lock_system_sleep();
        res = register_memory_resource(start, size);
+        ret = -EEXIST;
        if (!res)
-                return -EEXIST;
+                goto out;
        if (!node_online(nid)) {
                pgdat = hotadd_new_pgdat(nid, start);
+                ret = -ENOMEM;
                if (!pgdat)
-                        return -ENOMEM;
+                        goto out;
                new_pgdat = 1;
        }
@@ -514,7 +520,8 @@ int __ref add_memory(int nid, u64 start, u64 size)
                BUG_ON(ret);
        }
-        return ret;
+        goto out;
 error:
        /* rollback pgdat allocation and others */
        if (new_pgdat)
@@ -522,6 +529,8 @@ error:
        if (res)
                release_memory_resource(res);
+out:
+        unlock_system_sleep();
        return ret;
 }
 EXPORT_SYMBOL_GPL(add_memory);
@@ -758,6 +767,8 @@ int offline_pages(unsigned long start_pfn,
        if (!test_pages_in_a_zone(start_pfn, end_pfn))
                return -EINVAL;
+        lock_system_sleep();
        zone = page_zone(pfn_to_page(start_pfn));
        node = zone_to_nid(zone);
        nr_pages = end_pfn - start_pfn;
@@ -765,7 +776,7 @@ int offline_pages(unsigned long start_pfn,
        /* set above range as isolated */
        ret = start_isolate_page_range(start_pfn, end_pfn);
        if (ret)
-                return ret;
+                goto out;
        arg.start_pfn = start_pfn;
        arg.nr_pages = nr_pages;
@@ -843,6 +854,7 @@ repeat:
        writeback_set_ratelimit();
        memory_notify(MEM_OFFLINE, &arg);
+        unlock_system_sleep();
        return 0;
 failed_removal:
@@ -852,6 +864,8 @@ failed_removal:
        /* pushback to free area */
        undo_isolate_page_range(start_pfn, end_pfn);
+out:
+        unlock_system_sleep();
        return ret;
 }
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 8836575f9d7..a29c5ab5815 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -281,8 +281,11 @@ out_uninit_applicant:
        if (ngrp)
                vlan_gvrp_uninit_applicant(real_dev);
 out_free_group:
-        if (ngrp)
+        if (ngrp) {
-                vlan_group_free(ngrp);
+                hlist_del_rcu(&ngrp->hlist);
+                /* Free the group, after all cpu's are done. */
+                call_rcu(&ngrp->rcu, vlan_rcu_free);
+        }
        return err;
 }
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index a9750984f77..b7c4224f4e7 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -211,6 +211,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
        conn->type  = type;
        conn->mode  = HCI_CM_ACTIVE;
        conn->state = BT_OPEN;
+        conn->auth_type = HCI_AT_GENERAL_BONDING;
        conn->power_save = 1;
        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 77e9fb130ad..947f8bbb4bb 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2205,7 +2205,7 @@ static int l2cap_build_conf_req(struct sock *sk, void *data)
 {
        struct l2cap_pinfo *pi = l2cap_pi(sk);
        struct l2cap_conf_req *req = data;
-        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_ERTM };
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
        void *ptr = req->data;
        BT_DBG("sk %p", sk);
@@ -2394,6 +2394,10 @@ done:
                        rfc.monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
                        break;
                case L2CAP_MODE_STREAMING:
@@ -2401,6 +2405,10 @@ done:
                        pi->max_pdu_size = rfc.max_pdu_size;
                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
                        break;
                default:
@@ -2410,9 +2418,6 @@ done:
                        rfc.mode = pi->mode;
                }
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
                if (result == L2CAP_CONF_SUCCESS)
                        pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
        }
diff --git a/net/core/dev.c b/net/core/dev.c
index b8f74cfb1bf..fe10551d367 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -942,14 +942,15 @@ rollback:
        ret = notifier_to_errno(ret);
        if (ret) {
-                if (err) {
+                /* err >= 0 after dev_alloc_name() or stores the first errno */
-                        printk(KERN_ERR
+                if (err >= 0) {
-                               "%s: name change rollback failed: %d.\n",
-                               dev->name, ret);
-                } else {
                        err = ret;
                        memcpy(dev->name, oldname, IFNAMSIZ);
                        goto rollback;
+                } else {
+                        printk(KERN_ERR
+                               "%s: name change rollback failed: %d.\n",
+                               dev->name, ret);
                }
        }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 80a96166df3..ec85681a7dd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2701,7 +2701,8 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                NAPI_GRO_CB(skb)->free = 1;
                goto done;
-        }
+        } else if (skb_gro_len(p) != pinfo->gso_size)
+                return -E2BIG;
        headroom = skb_headroom(p);
        nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 630a56df7b4..99508d66a64 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -483,8 +483,10 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                return -EINVAL;
        }
-        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL) {
+                dev_put(dev);
                return -EADDRNOTAVAIL;
+        }
        IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)++;
        ip_rt_multicast_event(in_dev);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 98440ad8255..f1813bc7108 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1183,7 +1183,9 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
        struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
-        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
+             KERN_INFO "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
+             tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
 #endif
        if (inet_csk_ack_scheduled(sk)) {
@@ -1430,11 +1432,13 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        /* Now that we have two receive queues this
                         * shouldn't happen.
                         */
-                        if (before(*seq, TCP_SKB_CB(skb)->seq)) {
+                        if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
-                                printk(KERN_INFO "recvmsg bug: copied %X "
+                             KERN_INFO "recvmsg bug: copied %X "
-                                       "seq %X\n", *seq, TCP_SKB_CB(skb)->seq);
+                                       "seq %X rcvnxt %X fl %X\n", *seq,
+                                       TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+                                       flags))
                                break;
-                        }
                        offset = *seq - TCP_SKB_CB(skb)->seq;
                        if (tcp_hdr(skb)->syn)
                                offset--;
@@ -1443,8 +1447,9 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        if (tcp_hdr(skb)->fin)
                                goto found_fin_ok;
                        WARN(!(flags & MSG_PEEK), KERN_INFO "recvmsg bug 2: "
-                                        "copied %X seq %X\n", *seq,
+                                        "copied %X seq %X rcvnxt %X fl %X\n",
-                                        TCP_SKB_CB(skb)->seq);
+                                        *seq, TCP_SKB_CB(skb)->seq,
+                                        tp->rcv_nxt, flags);
                }
                /* Well, if we have backlog, try to process it now yet. */
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 8450960df24..7eed77a39d0 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1485,15 +1485,13 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
 * local endpoint and the remote peer.
 */
 int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
-                                     gfp_t gfp)
+                                     sctp_scope_t scope, gfp_t gfp)
 {
-        sctp_scope_t scope;
        int flags;
        /* Use scoping rules to determine the subset of addresses from
         * the endpoint.
         */
-        scope = sctp_scope(&asoc->peer.active_path->ipaddr);
        flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
        if (asoc->peer.ipv4_address)
                flags |= SCTP_ADDR4_PEERSUPP;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index c8fae1983dd..d4df45022ff 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -384,6 +384,11 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
        if (!new_asoc)
                goto nomem;
+        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
+                                             sctp_scope(sctp_source(chunk)),
+                                             GFP_ATOMIC) < 0)
+                goto nomem_init;
        /* The call, sctp_process_init(), can fail on memory allocation.  */
        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
                               sctp_source(chunk),
@@ -401,9 +406,6 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
                len = ntohs(err_chunk->chunk_hdr->length) -
                        sizeof(sctp_chunkhdr_t);
-        if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
-                goto nomem_init;
        repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
        if (!repl)
                goto nomem_init;
@@ -1452,6 +1454,10 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
        if (!new_asoc)
                goto nomem;
+        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
+                                sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
+                goto nomem;
        /* In the outbound INIT ACK the endpoint MUST copy its current
         * Verification Tag and Peers Verification tag into a reserved
         * place (local tie-tag and per tie-tag) within the state cookie.
@@ -1488,9 +1494,6 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
                        sizeof(sctp_chunkhdr_t);
        }
-        if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
-                goto nomem;
        repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
        if (!repl)
                goto nomem;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c8d05758661..3a95fcb17a9 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1080,6 +1080,13 @@ static int __sctp_connect(struct sock* sk,
                                err = -ENOMEM;
                                goto out_free;
                        }
+                        err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
+                                                              GFP_KERNEL);
+                        if (err < 0) {
+                                goto out_free;
+                        }
                }
                /* Prime the peer's transport structures.  */
@@ -1095,11 +1102,6 @@ static int __sctp_connect(struct sock* sk,
                walk_size += af->sockaddr_len;
        }
-        err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-        if (err < 0) {
-                goto out_free;
-        }
        /* In case the user of sctp_connectx() wants an association
         * id back, assign one now.
         */
@@ -1274,22 +1276,30 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
 }
 /*
- * New (hopefully final) interface for the API.  The option buffer is used
+ * New (hopefully final) interface for the API.
- * both for the returned association id and the addresses.
+ * We use the sctp_getaddrs_old structure so that use-space library
+ * can avoid any unnecessary allocations.   The only defferent part
+ * is that we store the actual length of the address buffer into the
+ * addrs_num structure member.  That way we can re-use the existing
+ * code.
 */
 SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
                                        char __user *optval,
                                        int __user *optlen)
 {
+        struct sctp_getaddrs_old param;
        sctp_assoc_t assoc_id = 0;
        int err = 0;
-        if (len < sizeof(assoc_id))
+        if (len < sizeof(param))
                return -EINVAL;
+        if (copy_from_user(&param, optval, sizeof(param)))
+                return -EFAULT;
        err = __sctp_setsockopt_connectx(sk,
-                        (struct sockaddr __user *)(optval + sizeof(assoc_id)),
+                        (struct sockaddr __user *)param.addrs,
-                        len - sizeof(assoc_id), &assoc_id);
+                        param.addr_num, &assoc_id);
        if (err == 0 || err == -EINPROGRESS) {
                if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
@@ -1689,6 +1699,11 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                        goto out_unlock;
                }
                asoc = new_asoc;
+                err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
+                if (err < 0) {
+                        err = -ENOMEM;
+                        goto out_free;
+                }
                /* If the SCTP_INIT ancillary data is specified, set all
                 * the association init values accordingly.
@@ -1718,11 +1733,6 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                        err = -ENOMEM;
                        goto out_free;
                }
-                err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-                if (err < 0) {
-                        err = -ENOMEM;
-                        goto out_free;
-                }
        }
        /* ASSERT: we have a valid association at this point.  */
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index c256e483931..3b141bb32fa 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -308,7 +308,8 @@ void sctp_transport_route(struct sctp_transport *transport,
                /* Initialize sk->sk_rcv_saddr, if the transport is the
                 * association's active path for getsockname().
                 */
-                if (asoc && (transport == asoc->peer.active_path))
+                if (asoc && (!asoc->peer.primary_path ||
+                                (transport == asoc->peer.active_path)))
                        opt->pf->af->to_sk_saddr(&transport->saddr,
                                                 asoc->base.sk);
        } else
diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
index b8dd693f879..a4e2b1dac94 100644
--- a/security/integrity/ima/ima_iint.c
+++ b/security/integrity/ima/ima_iint.c
@@ -58,11 +58,11 @@ struct ima_iint_cache *ima_iint_insert(struct inode *inode)
        if (!ima_initialized)
                return iint;
-        iint = kmem_cache_alloc(iint_cache, GFP_KERNEL);
+        iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
        if (!iint)
                return iint;
-        rc = radix_tree_preload(GFP_KERNEL);
+        rc = radix_tree_preload(GFP_NOFS);
        if (rc < 0)
                goto out;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 84a52efdb2d..70583719282 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -11462,6 +11462,7 @@ static struct snd_pci_quirk alc262_cfg_tbl[] = {
        SND_PCI_QUIRK(0x104d, 0x9016, "Sony VAIO", ALC262_AUTO), /* dig-only */
        SND_PCI_QUIRK(0x104d, 0x9025, "Sony VAIO Z21MN", ALC262_TOSHIBA_S06),
        SND_PCI_QUIRK(0x104d, 0x9035, "Sony VAIO VGN-FW170J", ALC262_AUTO),
+        SND_PCI_QUIRK(0x104d, 0x9047, "Sony VAIO Type G", ALC262_AUTO),
        SND_PCI_QUIRK_MASK(0x104d, 0xff00, 0x9000, "Sony VAIO",
                           ALC262_SONY_ASSAMD),
        SND_PCI_QUIRK(0x1179, 0x0001, "Toshiba dynabook SS RX1",
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index 0b8dcb5cd72..6b24d8bb02b 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -265,8 +265,8 @@ static const int bosr_usb_divisor_table[] = {
 #define UPPER_GROUP ((1<<8) | (1<<9) | (1<<10) | (1<<11)        | (1<<15))
 static const unsigned short sr_valid_mask[] = {
        LOWER_GROUP|UPPER_GROUP,        /* Normal, bosr - 0*/
-        LOWER_GROUP|UPPER_GROUP,        /* Normal, bosr - 1*/
        LOWER_GROUP,                    /* Usb, bosr - 0*/
+        LOWER_GROUP|UPPER_GROUP,        /* Normal, bosr - 1*/
        UPPER_GROUP,                    /* Usb, bosr - 1*/
 };
 /*
diff --git a/sound/soc/omap/omap3evm.c b/sound/soc/omap/omap3evm.c
index 9114c263077..13aa380de16 100644
--- a/sound/soc/omap/omap3evm.c
+++ b/sound/soc/omap/omap3evm.c
@@ -144,4 +144,4 @@ module_exit(omap3evm_soc_exit);
 MODULE_AUTHOR("Anuj Aggarwal <anuj.aggarwal@ti.com>");
 MODULE_DESCRIPTION("ALSA SoC OMAP3 EVM");
-MODULE_LICENSE("GPLv2");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/omap/omap3pandora.c b/sound/soc/omap/omap3pandora.c
index ad219aaf7cb..0cd06f5dd35 100644
--- a/sound/soc/omap/omap3pandora.c
+++ b/sound/soc/omap/omap3pandora.c
@@ -134,7 +134,7 @@ static int omap3pandora_hp_event(struct snd_soc_dapm_widget *w,
 *  |P| <--- TWL4030 <--------- Line In and MICs
 */
 static const struct snd_soc_dapm_widget omap3pandora_out_dapm_widgets[] = {
-        SND_SOC_DAPM_DAC("PCM DAC", "Playback", SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_DAC("PCM DAC", "HiFi Playback", SND_SOC_NOPM, 0, 0),
        SND_SOC_DAPM_PGA_E("Headphone Amplifier", SND_SOC_NOPM,
                           0, 0, NULL, 0, omap3pandora_hp_event,
                           SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
@@ -181,6 +181,7 @@ static int omap3pandora_out_init(struct snd_soc_codec *codec)
        snd_soc_dapm_nc_pin(codec, "CARKITR");
        snd_soc_dapm_nc_pin(codec, "HFL");
        snd_soc_dapm_nc_pin(codec, "HFR");
+        snd_soc_dapm_nc_pin(codec, "VIBRA");
        ret = snd_soc_dapm_new_controls(codec, omap3pandora_out_dapm_widgets,
                                ARRAY_SIZE(omap3pandora_out_dapm_widgets));
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index 9efcfd08d74..c998220b99c 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -1071,6 +1071,15 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, unsig
        channels = (ftr[0] - 7) / csize - 1;
        master_bits = snd_usb_combine_bytes(ftr + 6, csize);
+        /* master configuration quirks */
+        switch (state->chip->usb_id) {
+        case USB_ID(0x08bb, 0x2702):
+                snd_printk(KERN_INFO
+                           "usbmixer: master volume quirk for PCM2702 chip\n");
+                /* disable non-functional volume control */
+                master_bits &= ~(1 << (USB_FEATURE_VOLUME - 1));
+                break;
+        }
        if (channels > 0)
                first_ch_bits = snd_usb_combine_bytes(ftr + 6 + csize, csize);
        else