30 files changed, 321 insertions, 231 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 7f6c051cac65..0f6d13bd4688 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -532,13 +532,13 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 
 ASUS ACPI EXTRAS DRIVER
+P:      Corentin Chary
+M:      corentincj@iksaif.net
 P:      Karol Kozimor
 M:      sziwan@users.sourceforge.net
-P:      Julien Lerouge
-M:      julien.lerouge@free.fr
 L:      acpi4asus-user@lists.sourceforge.net
 W:      http://sourceforge.net/projects/acpi4asus
-W:      http://julien.lerouge.free.fr
+W:      http://xf.iksaif.net/acpi4asus
 S:      Maintained
 
 ATA OVER ETHERNET DRIVER
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 094300b3a81f..cbcb2c27f48b 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -333,7 +333,7 @@ acpi_parse_ioapic(acpi_table_entry_header * header, const unsigned long end)
 /*
  * Parse Interrupt Source Override for the ACPI SCI
  */
-static void acpi_sci_ioapic_setup(u32 gsi, u16 polarity, u16 trigger)
+static void __init acpi_sci_ioapic_setup(u32 gsi, u16 polarity, u16 trigger)
 {
         if (trigger == 0)       /* compatible SCI trigger is level */
                 trigger = 3;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 9c52d87d6f04..4144d5dd442e 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -424,7 +424,7 @@ static void acpi_ec_gpe_query(void *ec_cxt)
 
         snprintf(object_name, 8, "_Q%2.2X", value);
 
-        printk(KERN_INFO PREFIX "evaluating %s\n", object_name);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s", object_name));
 
         acpi_evaluate_object(ec->handle, object_name, NULL, NULL);
 }
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 96d4a0bb2203..ec796ad087df 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -6,13 +6,21 @@ menu "HID Devices"
 
 config HID
         tristate "Generic HID support"
+        depends on INPUT
         default y
         ---help---
-          Say Y here if you want generic HID support to connect keyboards,
-          mice, joysticks, graphic tablets, or any other HID based devices
-          to your computer. You also need to select particular types of
-          HID devices you want to compile support for, in the particular
-          driver menu (USB, Bluetooth)
+          A human interface device (HID) is a type of computer device that
+          interacts directly with and takes input from humans. The term "HID"
+          most commonly used to refer to the USB-HID specification, but other
+          devices (such as, but not strictly limited to, Bluetooth) are
+          designed using HID specification (this involves certain keyboards,
+          mice, tablets, etc). This option compiles into kernel the generic
+          HID layer code (parser, usages, etc.), which can then be used by
+          transport-specific HID implementation (like USB or Bluetooth).
+
+          For docs and specs, see http://www.usb.org/developers/hidpage/
+
+          If unsure, say Y
 
 endmenu
 
diff --git a/drivers/net/Space.c b/drivers/net/Space.c
index 602ed31a5dd9..9305eb9b1b98 100644
--- a/drivers/net/Space.c
+++ b/drivers/net/Space.c
@@ -349,22 +349,11 @@ static void __init trif_probe2(int unit)
 #endif
 
 
-/*
- *      The loopback device is global so it can be directly referenced
- *      by the network code. Also, it must be first on device list.
- */
-extern int loopback_init(void);
-
 /*  Statically configured drivers -- order matters here. */
 static int __init net_olddevs_init(void)
 {
         int num;
 
-        if (loopback_init()) {
-                printk(KERN_ERR "Network loopback device setup failed\n");
-        }
-
-
 #ifdef CONFIG_SBNI
         for (num = 0; num < 8; ++num)
                 sbni_probe(num);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index c26a4b8e552a..ca2b21f9d444 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -154,8 +154,8 @@ static int ifb_xmit(struct sk_buff *skb, struct net_device *dev)
         int ret = 0;
         u32 from = G_TC_FROM(skb->tc_verd);
 
-        stats->tx_packets++;
-        stats->tx_bytes+=skb->len;
+        stats->rx_packets++;
+        stats->rx_bytes+=skb->len;
 
         if (!from || !skb->input_dev) {
 dropped:
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 82c10dec1b5a..2b739fd584f1 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -229,9 +229,11 @@ struct net_device loopback_dev = {
 };
 
 /* Setup and register the loopback device. */
-int __init loopback_init(void)
+static int __init loopback_init(void)
 {
         return register_netdev(&loopback_dev);
 };
 
+module_init(loopback_init);
+
 EXPORT_SYMBOL(loopback_dev);
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 785e4a535f9e..616be8d0fa85 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -90,7 +90,8 @@
 
 #define ADVERTISE_MASK  (SUPPORTED_10baseT_Half | SUPPORTED_10baseT_Full | \
                          SUPPORTED_100baseT_Half | SUPPORTED_100baseT_Full | \
-                         SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
+                         SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full | \
+                         SUPPORTED_Pause | SUPPORTED_Autoneg)
 
 #define DRV_NAME        "sungem"
 #define DRV_VERSION     "0.98"
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index 49800b25907d..d21991ee88c4 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -3,10 +3,9 @@
  *
  * This file could be shared with other drivers.
  *
- * (c) 2002, Benjamin Herrenscmidt (benh@kernel.crashing.org)
+ * (c) 2002-2007, Benjamin Herrenscmidt (benh@kernel.crashing.org)
  *
  * TODO:
- *  - Implement WOL
  *  - Add support for PHYs that provide an IRQ line
  *  - Eventually moved the entire polling state machine in
  *    there (out of the eth driver), so that it can easily be
@@ -152,6 +151,44 @@ static int bcm5221_suspend(struct mii_phy* phy)
         return 0;
 }
 
+static int bcm5241_init(struct mii_phy* phy)
+{
+        u16 data;
+
+        data = phy_read(phy, MII_BCM5221_TEST);
+        phy_write(phy, MII_BCM5221_TEST,
+                data | MII_BCM5221_TEST_ENABLE_SHADOWS);
+
+        data = phy_read(phy, MII_BCM5221_SHDOW_AUX_STAT2);
+        phy_write(phy, MII_BCM5221_SHDOW_AUX_STAT2,
+                data | MII_BCM5221_SHDOW_AUX_STAT2_APD);
+
+        data = phy_read(phy, MII_BCM5221_SHDOW_AUX_MODE4);
+        phy_write(phy, MII_BCM5221_SHDOW_AUX_MODE4,
+                data & ~MII_BCM5241_SHDOW_AUX_MODE4_STANDBYPWR);
+
+        data = phy_read(phy, MII_BCM5221_TEST);
+        phy_write(phy, MII_BCM5221_TEST,
+                data & ~MII_BCM5221_TEST_ENABLE_SHADOWS);
+
+        return 0;
+}
+
+static int bcm5241_suspend(struct mii_phy* phy)
+{
+        u16 data;
+
+        data = phy_read(phy, MII_BCM5221_TEST);
+        phy_write(phy, MII_BCM5221_TEST,
+                data | MII_BCM5221_TEST_ENABLE_SHADOWS);
+
+        data = phy_read(phy, MII_BCM5221_SHDOW_AUX_MODE4);
+        phy_write(phy, MII_BCM5221_SHDOW_AUX_MODE4,
+                  data | MII_BCM5241_SHDOW_AUX_MODE4_STANDBYPWR);
+
+        return 0;
+}
+
 static int bcm5400_init(struct mii_phy* phy)
 {
         u16 data;
@@ -373,6 +410,10 @@ static int bcm54xx_setup_aneg(struct mii_phy *phy, u32 advertise)
                 adv |= ADVERTISE_100HALF;
         if (advertise & ADVERTISED_100baseT_Full)
                 adv |= ADVERTISE_100FULL;
+        if (advertise & ADVERTISED_Pause)
+                adv |= ADVERTISE_PAUSE_CAP;
+        if (advertise & ADVERTISED_Asym_Pause)
+                adv |= ADVERTISE_PAUSE_ASYM;
         phy_write(phy, MII_ADVERTISE, adv);
 
         /* Setup 1000BT advertise */
@@ -436,12 +477,15 @@ static int bcm54xx_read_link(struct mii_phy *phy)
                 val = phy_read(phy, MII_BCM5400_AUXSTATUS);
                 link_mode = ((val & MII_BCM5400_AUXSTATUS_LINKMODE_MASK) >>
                              MII_BCM5400_AUXSTATUS_LINKMODE_SHIFT);
-                phy->duplex = phy_BCM5400_link_table[link_mode][0] ? DUPLEX_FULL : DUPLEX_HALF;
+                phy->duplex = phy_BCM5400_link_table[link_mode][0] ?
+                        DUPLEX_FULL : DUPLEX_HALF;
                 phy->speed = phy_BCM5400_link_table[link_mode][2] ?
                                 SPEED_1000 :
-                                (phy_BCM5400_link_table[link_mode][1] ? SPEED_100 : SPEED_10);
+                                (phy_BCM5400_link_table[link_mode][1] ?
+                                 SPEED_100 : SPEED_10);
                 val = phy_read(phy, MII_LPA);
-                phy->pause = ((val & LPA_PAUSE) != 0);
+                phy->pause = (phy->duplex == DUPLEX_FULL) &&
+                        ((val & LPA_PAUSE) != 0);
         }
         /* On non-aneg, we assume what we put in BMCR is the speed,
          * though magic-aneg shouldn't prevent this case from occurring
@@ -450,6 +494,28 @@ static int bcm54xx_read_link(struct mii_phy *phy)
         return 0;
 }
 
+static int marvell88e1111_init(struct mii_phy* phy)
+{
+        u16 rev;
+
+        /* magic init sequence for rev 0 */
+        rev = phy_read(phy, MII_PHYSID2) & 0x000f;
+        if (rev == 0) {
+                phy_write(phy, 0x1d, 0x000a);
+                phy_write(phy, 0x1e, 0x0821);
+
+                phy_write(phy, 0x1d, 0x0006);
+                phy_write(phy, 0x1e, 0x8600);
+
+                phy_write(phy, 0x1d, 0x000b);
+                phy_write(phy, 0x1e, 0x0100);
+
+                phy_write(phy, 0x1d, 0x0004);
+                phy_write(phy, 0x1e, 0x4850);
+        }
+        return 0;
+}
+
 static int marvell_setup_aneg(struct mii_phy *phy, u32 advertise)
 {
         u16 ctl, adv;
@@ -471,6 +537,10 @@ static int marvell_setup_aneg(struct mii_phy *phy, u32 advertise)
                 adv |= ADVERTISE_100HALF;
         if (advertise & ADVERTISED_100baseT_Full)
                 adv |= ADVERTISE_100FULL;
+        if (advertise & ADVERTISED_Pause)
+                adv |= ADVERTISE_PAUSE_CAP;
+        if (advertise & ADVERTISED_Asym_Pause)
+                adv |= ADVERTISE_PAUSE_ASYM;
         phy_write(phy, MII_ADVERTISE, adv);
 
         /* Setup 1000BT advertise & enable crossover detect
@@ -549,7 +619,7 @@ static int marvell_setup_forced(struct mii_phy *phy, int speed, int fd)
 
 static int marvell_read_link(struct mii_phy *phy)
 {
-        u16 status;
+        u16 status, pmask;
 
         if (phy->autoneg) {
                 status = phy_read(phy, MII_M1011_PHY_SPEC_STATUS);
@@ -565,7 +635,9 @@ static int marvell_read_link(struct mii_phy *phy)
                         phy->duplex = DUPLEX_FULL;
                 else
                         phy->duplex = DUPLEX_HALF;
-                phy->pause = 0; /* XXX Check against spec ! */
+                pmask = MII_M1011_PHY_SPEC_STATUS_TX_PAUSE |
+                        MII_M1011_PHY_SPEC_STATUS_RX_PAUSE;
+                phy->pause = (status & pmask) == pmask;
         }
         /* On non-aneg, we assume what we put in BMCR is the speed,
          * though magic-aneg shouldn't prevent this case from occurring
@@ -595,6 +667,10 @@ static int genmii_setup_aneg(struct mii_phy *phy, u32 advertise)
                 adv |= ADVERTISE_100HALF;
         if (advertise & ADVERTISED_100baseT_Full)
                 adv |= ADVERTISE_100FULL;
+        if (advertise & ADVERTISED_Pause)
+                adv |= ADVERTISE_PAUSE_CAP;
+        if (advertise & ADVERTISED_Asym_Pause)
+                adv |= ADVERTISE_PAUSE_ASYM;
         phy_write(phy, MII_ADVERTISE, adv);
 
         /* Start/Restart aneg */
@@ -666,7 +742,8 @@ static int genmii_read_link(struct mii_phy *phy)
                         phy->speed = SPEED_100;
                 else
                         phy->speed = SPEED_10;
-                phy->pause = 0;
+                phy->pause = (phy->duplex == DUPLEX_FULL) &&
+                        ((lpa & LPA_PAUSE) != 0);
         }
         /* On non-aneg, we assume what we put in BMCR is the speed,
          * though magic-aneg shouldn't prevent this case from occurring
@@ -676,11 +753,19 @@ static int genmii_read_link(struct mii_phy *phy)
 }
 
 
-#define MII_BASIC_FEATURES      (SUPPORTED_10baseT_Half | SUPPORTED_10baseT_Full | \
-                                 SUPPORTED_100baseT_Half | SUPPORTED_100baseT_Full | \
-                                 SUPPORTED_Autoneg | SUPPORTED_TP | SUPPORTED_MII)
-#define MII_GBIT_FEATURES       (MII_BASIC_FEATURES | \
-                                 SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
+#define MII_BASIC_FEATURES \
+        (SUPPORTED_10baseT_Half | SUPPORTED_10baseT_Full |      \
+         SUPPORTED_100baseT_Half | SUPPORTED_100baseT_Full |    \
+         SUPPORTED_Autoneg | SUPPORTED_TP | SUPPORTED_MII |     \
+         SUPPORTED_Pause)
+
+/* On gigabit capable PHYs, we advertise Pause support but not asym pause
+ * support for now as I'm not sure it's supported and Darwin doesn't do
+ * it neither. --BenH.
+ */
+#define MII_GBIT_FEATURES \
+        (MII_BASIC_FEATURES |   \
+         SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
 
 /* Broadcom BCM 5201 */
 static struct mii_phy_ops bcm5201_phy_ops = {
@@ -720,6 +805,24 @@ static struct mii_phy_def bcm5221_phy_def = {
         .ops            = &bcm5221_phy_ops
 };
 
+/* Broadcom BCM 5241 */
+static struct mii_phy_ops bcm5241_phy_ops = {
+        .suspend        = bcm5241_suspend,
+        .init           = bcm5241_init,
+        .setup_aneg     = genmii_setup_aneg,
+        .setup_forced   = genmii_setup_forced,
+        .poll_link      = genmii_poll_link,
+        .read_link      = genmii_read_link,
+};
+static struct mii_phy_def bcm5241_phy_def = {
+        .phy_id         = 0x0143bc30,
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "BCM5241",
+        .features       = MII_BASIC_FEATURES,
+        .magic_aneg     = 1,
+        .ops            = &bcm5241_phy_ops
+};
+
 /* Broadcom BCM 5400 */
 static struct mii_phy_ops bcm5400_phy_ops = {
         .init           = bcm5400_init,
@@ -854,11 +957,8 @@ static struct mii_phy_def bcm5462V_phy_def = {
         .ops            = &bcm5462V_phy_ops
 };
 
-/* Marvell 88E1101 (Apple seem to deal with 2 different revs,
- * I masked out the 8 last bits to get both, but some specs
- * would be useful here) --BenH.
- */
-static struct mii_phy_ops marvell_phy_ops = {
+/* Marvell 88E1101 amd 88E1111 */
+static struct mii_phy_ops marvell88e1101_phy_ops = {
         .suspend        = generic_suspend,
         .setup_aneg     = marvell_setup_aneg,
         .setup_forced   = marvell_setup_forced,
@@ -866,13 +966,41 @@ static struct mii_phy_ops marvell_phy_ops = {
         .read_link      = marvell_read_link
 };
 
-static struct mii_phy_def marvell_phy_def = {
-        .phy_id         = 0x01410c00,
-        .phy_id_mask    = 0xffffff00,
-        .name           = "Marvell 88E1101",
+static struct mii_phy_ops marvell88e1111_phy_ops = {
+        .init           = marvell88e1111_init,
+        .suspend        = generic_suspend,
+        .setup_aneg     = marvell_setup_aneg,
+        .setup_forced   = marvell_setup_forced,
+        .poll_link      = genmii_poll_link,
+        .read_link      = marvell_read_link
+};
+
+/* two revs in darwin for the 88e1101 ... I could use a datasheet
+ * to get the proper names...
+ */
+static struct mii_phy_def marvell88e1101v1_phy_def = {
+        .phy_id         = 0x01410c20,
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "Marvell 88E1101v1",
+        .features       = MII_GBIT_FEATURES,
+        .magic_aneg     = 1,
+        .ops            = &marvell88e1101_phy_ops
+};
+static struct mii_phy_def marvell88e1101v2_phy_def = {
+        .phy_id         = 0x01410c60,
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "Marvell 88E1101v2",
+        .features       = MII_GBIT_FEATURES,
+        .magic_aneg     = 1,
+        .ops            = &marvell88e1101_phy_ops
+};
+static struct mii_phy_def marvell88e1111_phy_def = {
+        .phy_id         = 0x01410cc0,
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "Marvell 88E1111",
         .features       = MII_GBIT_FEATURES,
         .magic_aneg     = 1,
-        .ops            = &marvell_phy_ops
+        .ops            = &marvell88e1111_phy_ops
 };
 
 /* Generic implementation for most 10/100 PHYs */
@@ -895,6 +1023,7 @@ static struct mii_phy_def genmii_phy_def = {
 static struct mii_phy_def* mii_phy_table[] = {
         &bcm5201_phy_def,
         &bcm5221_phy_def,
+        &bcm5241_phy_def,
         &bcm5400_phy_def,
         &bcm5401_phy_def,
         &bcm5411_phy_def,
@@ -902,7 +1031,9 @@ static struct mii_phy_def* mii_phy_table[] = {
         &bcm5421k2_phy_def,
         &bcm5461_phy_def,
         &bcm5462V_phy_def,
-        &marvell_phy_def,
+        &marvell88e1101v1_phy_def,
+        &marvell88e1101v2_phy_def,
+        &marvell88e1111_phy_def,
         &genmii_phy_def,
         NULL
 };
diff --git a/drivers/net/sungem_phy.h b/drivers/net/sungem_phy.h
index 8ee1ca0471cf..1d70ba6f9f10 100644
--- a/drivers/net/sungem_phy.h
+++ b/drivers/net/sungem_phy.h
@@ -30,7 +30,7 @@ struct mii_phy_def
 struct mii_phy
 {
         struct mii_phy_def*     def;
-        int                     advertising;
+        u32                     advertising;
         int                     mii_id;
 
         /* 1: autoneg enabled, 0: disabled */
@@ -85,6 +85,9 @@ extern int mii_phy_probe(struct mii_phy *phy, int mii_id);
 #define MII_BCM5221_SHDOW_AUX_MODE4_IDDQMODE    0x0001
 #define MII_BCM5221_SHDOW_AUX_MODE4_CLKLOPWR    0x0004
 
+/* MII BCM5241 Additional registers */
+#define MII_BCM5241_SHDOW_AUX_MODE4_STANDBYPWR  0x0008
+
 /* MII BCM5400 1000-BASET Control register */
 #define MII_BCM5400_GB_CONTROL                  0x09
 #define MII_BCM5400_GB_CONTROL_FULLDUPLEXCAP    0x0200
@@ -115,5 +118,7 @@ extern int mii_phy_probe(struct mii_phy *phy, int mii_id);
 #define MII_M1011_PHY_SPEC_STATUS_SPD_MASK      0xc000
 #define MII_M1011_PHY_SPEC_STATUS_FULLDUPLEX    0x2000
 #define MII_M1011_PHY_SPEC_STATUS_RESOLVED      0x0800
+#define MII_M1011_PHY_SPEC_STATUS_TX_PAUSE      0x0008
+#define MII_M1011_PHY_SPEC_STATUS_RX_PAUSE      0x0004
 
 #endif /* __SUNGEM_PHY_H__ */
diff --git a/drivers/usb/input/Kconfig b/drivers/usb/input/Kconfig
index f877cd4f317a..258a5d09d3dc 100644
--- a/drivers/usb/input/Kconfig
+++ b/drivers/usb/input/Kconfig
@@ -12,10 +12,8 @@ config USB_HID
         ---help---
           Say Y here if you want full HID support to connect USB keyboards,
           mice, joysticks, graphic tablets, or any other HID based devices
-          to your computer via USB. You also need to select HID Input layer
-          support (below) if you want to use keyboards, mice, joysticks and
-          the like ... as well as Uninterruptible Power Supply (UPS) and
-          monitor control devices.
+          to your computer via USB, as well as Uninterruptible Power Supply
+          (UPS) and monitor control devices.
 
           You can't use this driver and the HIDBP (Boot Protocol) keyboard
           and mouse drivers at the same time. More information is available:
diff --git a/drivers/video/backlight/corgi_bl.c b/drivers/video/backlight/corgi_bl.c
index 61587ca2cdbb..fde1d9518123 100644
--- a/drivers/video/backlight/corgi_bl.c
+++ b/drivers/video/backlight/corgi_bl.c
@@ -121,7 +121,7 @@ static int corgibl_probe(struct platform_device *pdev)
                 machinfo->limit_mask = -1;
 
         corgi_backlight_device = backlight_device_register ("corgi-bl",
-                NULL, &corgibl_data);
+                &pdev->dev, NULL, &corgibl_data);
         if (IS_ERR (corgi_backlight_device))
                 return PTR_ERR (corgi_backlight_device);
 
diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
index 1c569fb543ae..c07d8207fb54 100644
--- a/drivers/video/backlight/hp680_bl.c
+++ b/drivers/video/backlight/hp680_bl.c
@@ -105,7 +105,7 @@ static struct backlight_properties hp680bl_data = {
 static int __init hp680bl_probe(struct platform_device *dev)
 {
         hp680_backlight_device = backlight_device_register ("hp680-bl",
-                NULL, &hp680bl_data);
+                &dev->dev, NULL, &hp680bl_data);
         if (IS_ERR (hp680_backlight_device))
                 return PTR_ERR (hp680_backlight_device);
 
diff --git a/drivers/video/backlight/locomolcd.c b/drivers/video/backlight/locomolcd.c
index 2d7905410b2a..fc812d96c31d 100644
--- a/drivers/video/backlight/locomolcd.c
+++ b/drivers/video/backlight/locomolcd.c
@@ -184,7 +184,7 @@ static int locomolcd_probe(struct locomo_dev *ldev)
 
         local_irq_restore(flags);
 
-        locomolcd_bl_device = backlight_device_register("locomo-bl", NULL, &locomobl_data);
+        locomolcd_bl_device = backlight_device_register("locomo-bl", &ldev->dev, NULL, &locomobl_data);
 
         if (IS_ERR (locomolcd_bl_device))
                 return PTR_ERR (locomolcd_bl_device);
diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h
index 9e6c23c360b2..ebc1f697615a 100644
--- a/include/acpi/acconfig.h
+++ b/include/acpi/acconfig.h
@@ -105,7 +105,7 @@
 
 /* Maximum object reference count (detects object deletion issues) */
 
-#define ACPI_MAX_REFERENCE_COUNT        0x800
+#define ACPI_MAX_REFERENCE_COUNT        0x1000
 
 /* Size of cached memory mapping for system memory operation region */
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index b7d8317f22ac..cd8fa0c858ae 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -242,7 +242,7 @@ extern int tcp_memory_pressure;
 
 static inline int before(__u32 seq1, __u32 seq2)
 {
-        return (__s32)(seq2-seq1) > 0;
+        return (__s32)(seq1-seq2) < 0;
 }
 #define after(seq2, seq1)       before(seq1, seq2)
 
diff --git a/include/net/x25.h b/include/net/x25.h
index 0ad90ebcf86e..e47fe440d9d7 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -259,6 +259,7 @@ extern int  x25_decode(struct sock *, struct sk_buff *, int *, int *, int *, int
 extern void x25_disconnect(struct sock *, int, unsigned char, unsigned char);
 
 /* x25_timer.c */
+extern void x25_init_timers(struct sock *sk);
 extern void x25_start_heartbeat(struct sock *);
 extern void x25_start_t2timer(struct sock *);
 extern void x25_start_t21timer(struct sock *);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index bee558a41800..6c84ccb8c9d7 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -610,7 +610,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
         struct ebt_entry_target *t;
         struct ebt_target *target;
         unsigned int i, j, hook = 0, hookmask = 0;
-        size_t gap = e->next_offset - e->target_offset;
+        size_t gap;
         int ret;
 
         /* don't mess with the struct ebt_entries */
@@ -660,6 +660,7 @@ ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
         if (ret != 0)
                 goto cleanup_watchers;
         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
+        gap = e->next_offset - e->target_offset;
         target = find_target_lock(t->u.name, &ret, &ebt_mutex);
         if (!target)
                 goto cleanup_watchers;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 1897a3a385d8..04d4b93c68eb 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -148,6 +148,7 @@
 #include <linux/seq_file.h>
 #include <linux/wait.h>
 #include <linux/etherdevice.h>
+#include <linux/kthread.h>
 #include <net/checksum.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
@@ -360,8 +361,7 @@ struct pktgen_thread {
         spinlock_t if_lock;
         struct list_head if_list;       /* All device here */
         struct list_head th_list;
-        int removed;
-        char name[32];
+        struct task_struct *tsk;
         char result[512];
         u32 max_before_softirq; /* We'll call do_softirq to prevent starvation. */
 
@@ -1689,7 +1689,7 @@ static int pktgen_thread_show(struct seq_file *seq, void *v)
         BUG_ON(!t);
 
         seq_printf(seq, "Name: %s  max_before_softirq: %d\n",
-                   t->name, t->max_before_softirq);
+                   t->tsk->comm, t->max_before_softirq);
 
         seq_printf(seq, "Running: ");
 
@@ -3112,7 +3112,7 @@ static void pktgen_rem_thread(struct pktgen_thread *t)
 {
         /* Remove from the thread list */
 
-        remove_proc_entry(t->name, pg_proc_dir);
+        remove_proc_entry(t->tsk->comm, pg_proc_dir);
 
         mutex_lock(&pktgen_thread_lock);
 
@@ -3260,58 +3260,40 @@ out:;
  * Main loop of the thread goes here
  */
 
-static void pktgen_thread_worker(struct pktgen_thread *t)
+static int pktgen_thread_worker(void *arg)
 {
         DEFINE_WAIT(wait);
+        struct pktgen_thread *t = arg;
         struct pktgen_dev *pkt_dev = NULL;
         int cpu = t->cpu;
-        sigset_t tmpsig;
         u32 max_before_softirq;
         u32 tx_since_softirq = 0;
 
-        daemonize("pktgen/%d", cpu);
-
-        /* Block all signals except SIGKILL, SIGSTOP and SIGTERM */
-
-        spin_lock_irq(&current->sighand->siglock);
-        tmpsig = current->blocked;
-        siginitsetinv(&current->blocked,
-                      sigmask(SIGKILL) | sigmask(SIGSTOP) | sigmask(SIGTERM));
-
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
-
-        /* Migrate to the right CPU */
-        set_cpus_allowed(current, cpumask_of_cpu(cpu));
-        if (smp_processor_id() != cpu)
-                BUG();
+        BUG_ON(smp_processor_id() != cpu);
 
         init_waitqueue_head(&t->queue);
 
-        t->control &= ~(T_TERMINATE);
-        t->control &= ~(T_RUN);
-        t->control &= ~(T_STOP);
-        t->control &= ~(T_REMDEVALL);
-        t->control &= ~(T_REMDEV);
-
         t->pid = current->pid;
 
         PG_DEBUG(printk("pktgen: starting pktgen/%d:  pid=%d\n", cpu, current->pid));
 
         max_before_softirq = t->max_before_softirq;
 
-        __set_current_state(TASK_INTERRUPTIBLE);
-        mb();
+        set_current_state(TASK_INTERRUPTIBLE);
 
-        while (1) {
-
-                __set_current_state(TASK_RUNNING);
+        while (!kthread_should_stop()) {
+                pkt_dev = next_to_run(t);
 
-                /*
-                 * Get next dev to xmit -- if any.
-                 */
+                if (!pkt_dev &&
+                    (t->control & (T_STOP | T_RUN | T_REMDEVALL | T_REMDEV))
+                    == 0) {
+                        prepare_to_wait(&(t->queue), &wait,
+                                        TASK_INTERRUPTIBLE);
+                        schedule_timeout(HZ / 10);
+                        finish_wait(&(t->queue), &wait);
+                }
 
-                pkt_dev = next_to_run(t);
+                __set_current_state(TASK_RUNNING);
 
                 if (pkt_dev) {
 
@@ -3329,21 +3311,8 @@ static void pktgen_thread_worker(struct pktgen_thread *t)
                                         do_softirq();
                                 tx_since_softirq = 0;
                         }
-                } else {
-                        prepare_to_wait(&(t->queue), &wait, TASK_INTERRUPTIBLE);
-                        schedule_timeout(HZ / 10);
-                        finish_wait(&(t->queue), &wait);
                 }
 
-                /*
-                 * Back from sleep, either due to the timeout or signal.
-                 * We check if we have any "posted" work for us.
-                 */
-
-                if (t->control & T_TERMINATE || signal_pending(current))
-                        /* we received a request to terminate ourself */
-                        break;
-
                 if (t->control & T_STOP) {
                         pktgen_stop(t);
                         t->control &= ~(T_STOP);
@@ -3364,20 +3333,19 @@ static void pktgen_thread_worker(struct pktgen_thread *t)
                         t->control &= ~(T_REMDEV);
                 }
 
-                if (need_resched())
-                        schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
         }
 
-        PG_DEBUG(printk("pktgen: %s stopping all device\n", t->name));
+        PG_DEBUG(printk("pktgen: %s stopping all device\n", t->tsk->comm));
         pktgen_stop(t);
 
-        PG_DEBUG(printk("pktgen: %s removing all device\n", t->name));
+        PG_DEBUG(printk("pktgen: %s removing all device\n", t->tsk->comm));
         pktgen_rem_all_ifs(t);
 
-        PG_DEBUG(printk("pktgen: %s removing thread.\n", t->name));
+        PG_DEBUG(printk("pktgen: %s removing thread.\n", t->tsk->comm));
         pktgen_rem_thread(t);
 
-        t->removed = 1;
+        return 0;
 }
 
 static struct pktgen_dev *pktgen_find_dev(struct pktgen_thread *t,
@@ -3495,37 +3463,11 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         return add_dev_to_thread(t, pkt_dev);
 }
 
-static struct pktgen_thread *__init pktgen_find_thread(const char *name)
+static int __init pktgen_create_thread(int cpu)
 {
         struct pktgen_thread *t;
-
-        mutex_lock(&pktgen_thread_lock);
-
-        list_for_each_entry(t, &pktgen_threads, th_list)
-                if (strcmp(t->name, name) == 0) {
-                        mutex_unlock(&pktgen_thread_lock);
-                        return t;
-                }
-
-        mutex_unlock(&pktgen_thread_lock);
-        return NULL;
-}
-
-static int __init pktgen_create_thread(const char *name, int cpu)
-{
-        int err;
-        struct pktgen_thread *t = NULL;
         struct proc_dir_entry *pe;
-
-        if (strlen(name) > 31) {
-                printk("pktgen: ERROR:  Thread name cannot be more than 31 characters.\n");
-                return -EINVAL;
-        }
-
-        if (pktgen_find_thread(name)) {
-                printk("pktgen: ERROR: thread: %s already exists\n", name);
-                return -EINVAL;
-        }
+        struct task_struct *p;
 
         t = kzalloc(sizeof(struct pktgen_thread), GFP_KERNEL);
         if (!t) {
@@ -3533,14 +3475,29 @@ static int __init pktgen_create_thread(const char *name, int cpu)
                 return -ENOMEM;
         }
 
-        strcpy(t->name, name);
         spin_lock_init(&t->if_lock);
         t->cpu = cpu;
 
-        pe = create_proc_entry(t->name, 0600, pg_proc_dir);
+        INIT_LIST_HEAD(&t->if_list);
+
+        list_add_tail(&t->th_list, &pktgen_threads);
+
+        p = kthread_create(pktgen_thread_worker, t, "kpktgend_%d", cpu);
+        if (IS_ERR(p)) {
+                printk("pktgen: kernel_thread() failed for cpu %d\n", t->cpu);
+                list_del(&t->th_list);
+                kfree(t);
+                return PTR_ERR(p);
+        }
+        kthread_bind(p, cpu);
+        t->tsk = p;
+
+        pe = create_proc_entry(t->tsk->comm, 0600, pg_proc_dir);
         if (!pe) {
                 printk("pktgen: cannot create %s/%s procfs entry.\n",
-                       PG_PROC_DIR, t->name);
+                       PG_PROC_DIR, t->tsk->comm);
+                kthread_stop(p);
+                list_del(&t->th_list);
                 kfree(t);
                 return -EINVAL;
         }
@@ -3548,21 +3505,7 @@ static int __init pktgen_create_thread(const char *name, int cpu)
         pe->proc_fops = &pktgen_thread_fops;
         pe->data = t;
 
-        INIT_LIST_HEAD(&t->if_list);
-
-        list_add_tail(&t->th_list, &pktgen_threads);
-
-        t->removed = 0;
-
-        err = kernel_thread((void *)pktgen_thread_worker, (void *)t,
-                          CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
-        if (err < 0) {
-                printk("pktgen: kernel_thread() failed for cpu %d\n", t->cpu);
-                remove_proc_entry(t->name, pg_proc_dir);
-                list_del(&t->th_list);
-                kfree(t);
-                return err;
-        }
+        wake_up_process(p);
 
         return 0;
 }
@@ -3643,10 +3586,8 @@ static int __init pg_init(void)
 
         for_each_online_cpu(cpu) {
                 int err;
-                char buf[30];
 
-                sprintf(buf, "kpktgend_%i", cpu);
-                err = pktgen_create_thread(buf, cpu);
+                err = pktgen_create_thread(cpu);
                 if (err)
                         printk("pktgen: WARNING: Cannot create thread for cpu %d (%d)\n",
                                         cpu, err);
@@ -3674,9 +3615,8 @@ static void __exit pg_cleanup(void)
 
         list_for_each_safe(q, n, &pktgen_threads) {
                 t = list_entry(q, struct pktgen_thread, th_list);
-                t->control |= (T_TERMINATE);
-
-                wait_event_interruptible_timeout(queue, (t->removed == 1), HZ);
+                kthread_stop(t->tsk);
+                kfree(t);
         }
 
         /* Un-register us from receiving netdevice events */
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 84bed40273ad..25c8a42965df 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -165,9 +165,8 @@ struct in_device *inetdev_init(struct net_device *dev)
                               NET_IPV4_NEIGH, "ipv4", NULL, NULL);
 #endif
 
-        /* Account for reference dev->ip_ptr */
+        /* Account for reference dev->ip_ptr (below) */
         in_dev_hold(in_dev);
-        rcu_assign_pointer(dev->ip_ptr, in_dev);
 
 #ifdef CONFIG_SYSCTL
         devinet_sysctl_register(in_dev, &in_dev->cnf);
@@ -176,6 +175,8 @@ struct in_device *inetdev_init(struct net_device *dev)
         if (dev->flags & IFF_UP)
                 ip_mc_up(in_dev);
 out:
+        /* we can receive as soon as ip_ptr is set -- do this last */
+        rcu_assign_pointer(dev->ip_ptr, in_dev);
         return in_dev;
 out_kfree:
         kfree(in_dev);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index a68966059b50..c47ce7076bd5 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -15,16 +15,19 @@ int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
         struct flowi fl = {};
         struct dst_entry *odst;
         unsigned int hh_len;
+        unsigned int type;
 
+        type = inet_addr_type(iph->saddr);
         if (addr_type == RTN_UNSPEC)
-                addr_type = inet_addr_type(iph->saddr);
+                addr_type = type;
 
         /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
          * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
          */
         if (addr_type == RTN_LOCAL) {
                 fl.nl_u.ip4_u.daddr = iph->daddr;
-                fl.nl_u.ip4_u.saddr = iph->saddr;
+                if (type == RTN_LOCAL)
+                        fl.nl_u.ip4_u.saddr = iph->saddr;
                 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
                 fl.oif = (*pskb)->sk ? (*pskb)->sk->sk_bound_dev_if : 0;
                 fl.mark = (*pskb)->mark;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index f6026d4ac428..47bd3ad18b71 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -6,8 +6,8 @@ menu "IP: Netfilter Configuration"
         depends on INET && NETFILTER
 
 config NF_CONNTRACK_IPV4
-        tristate "IPv4 connection tracking support (required for NAT) (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "IPv4 connection tracking support (required for NAT)"
+        depends on NF_CONNTRACK
         ---help---
           Connection tracking keeps a record of what packets have passed
           through your machine, in order to figure out how they are related
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 09696f16aa95..fc1f153c86ba 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -919,13 +919,13 @@ copy_entries_to_user(unsigned int total_size,
 #ifdef CONFIG_COMPAT
 struct compat_delta {
         struct compat_delta *next;
-        u_int16_t offset;
+        unsigned int offset;
         short delta;
 };
 
 static struct compat_delta *compat_offsets = NULL;
 
-static int compat_add_offset(u_int16_t offset, short delta)
+static int compat_add_offset(unsigned int offset, short delta)
 {
         struct compat_delta *tmp;
 
@@ -957,7 +957,7 @@ static void compat_flush_offsets(void)
         }
 }
 
-static short compat_calc_jump(u_int16_t offset)
+static short compat_calc_jump(unsigned int offset)
 {
         struct compat_delta *tmp;
         short delta;
@@ -997,7 +997,7 @@ static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info,
                 void *base, struct xt_table_info *newinfo)
 {
         struct ipt_entry_target *t;
-        u_int16_t entry_offset;
+        unsigned int entry_offset;
         int off, i, ret;
 
         off = 0;
@@ -1467,7 +1467,7 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
 {
         struct ipt_entry_target *t;
         struct ipt_target *target;
-        u_int16_t entry_offset;
+        unsigned int entry_offset;
         int ret, off, h, j;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 28b9233956b5..d669685afd04 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -127,10 +127,13 @@ masquerade_target(struct sk_buff **pskb,
 static inline int
 device_cmp(struct ip_conntrack *i, void *ifindex)
 {
+        int ret;
 #ifdef CONFIG_NF_NAT_NEEDED
         struct nf_conn_nat *nat = nfct_nat(i);
+
+        if (!nat)
+                return 0;
 #endif
-        int ret;
 
         read_lock_bh(&masq_lock);
 #ifdef CONFIG_NF_NAT_NEEDED
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9b0a90643151..171e5b55d7d6 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -413,8 +413,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         if (netif_carrier_ok(dev))
                 ndev->if_flags |= IF_READY;
 
-        /* protected by rtnl_lock */
-        rcu_assign_pointer(dev->ip6_ptr, ndev);
 
         ipv6_mc_init_dev(ndev);
         ndev->tstamp = jiffies;
@@ -425,6 +423,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                               NULL);
         addrconf_sysctl_register(ndev, &ndev->cnf);
 #endif
+        /* protected by rtnl_lock */
+        rcu_assign_pointer(dev->ip6_ptr, ndev);
         return ndev;
 }
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 1b853c34d301..cd10e44db015 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -44,8 +44,7 @@ choice
         depends on NF_CONNTRACK_ENABLED
 
 config NF_CONNTRACK_SUPPORT
-        bool "Layer 3 Independent Connection tracking (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        bool "Layer 3 Independent Connection tracking"
         help
           Layer 3 independent connection tracking is experimental scheme
           which generalize ip_conntrack to support other layer 3 protocols.
@@ -122,7 +121,7 @@ config NF_CONNTRACK_EVENTS
 
 config NF_CT_PROTO_GRE
         tristate
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        depends on NF_CONNTRACK
 
 config NF_CT_PROTO_SCTP
         tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
@@ -136,8 +135,8 @@ config NF_CT_PROTO_SCTP
           Documentation/modules.txt.  If unsure, say `N'.
 
 config NF_CONNTRACK_AMANDA
-        tristate "Amanda backup protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "Amanda backup protocol support"
+        depends on NF_CONNTRACK
         select TEXTSEARCH
         select TEXTSEARCH_KMP
         help
@@ -151,8 +150,8 @@ config NF_CONNTRACK_AMANDA
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_FTP
-        tristate "FTP protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "FTP protocol support"
+        depends on NF_CONNTRACK
         help
           Tracking FTP connections is problematic: special helpers are
           required for tracking them, and doing masquerading and other forms
@@ -184,8 +183,8 @@ config NF_CONNTRACK_H323
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_IRC
-        tristate "IRC protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "IRC protocol support"
+        depends on NF_CONNTRACK
         help
           There is a commonly-used extension to IRC called
           Direct Client-to-Client Protocol (DCC).  This enables users to send
@@ -218,8 +217,8 @@ config NF_CONNTRACK_NETBIOS_NS
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_PPTP
-        tristate "PPtP protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "PPtP protocol support"
+        depends on NF_CONNTRACK
         select NF_CT_PROTO_GRE
         help
           This module adds support for PPTP (Point to Point Tunnelling
@@ -249,8 +248,8 @@ config NF_CONNTRACK_SIP
           To compile it as a module, choose M here.  If unsure, say N.
 
 config NF_CONNTRACK_TFTP
-        tristate "TFTP protocol support (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && NF_CONNTRACK
+        tristate "TFTP protocol support"
+        depends on NF_CONNTRACK
         help
           TFTP connection tracking helper, this is required depending
           on how restrictive your ruleset is.
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index a5a6e192ac2d..f28bf69d3d42 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -745,7 +745,7 @@ static int __init xt_hashlimit_init(void)
         }
         hashlimit_procdir6 = proc_mkdir("ip6t_hashlimit", proc_net);
         if (!hashlimit_procdir6) {
-                printk(KERN_ERR "xt_hashlimit: tnable to create proc dir "
+                printk(KERN_ERR "xt_hashlimit: unable to create proc dir "
                                 "entry\n");
                 goto err4;
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 276131fe56dd..383dd4e82ee1 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -472,8 +472,7 @@ static int netlink_release(struct socket *sock)
                                 NETLINK_URELEASE, &n);
         }       
 
-        if (nlk->module)
-                module_put(nlk->module);
+        module_put(nlk->module);
 
         netlink_table_grab();
         if (nlk->flags & NETLINK_KERNEL_SOCKET) {
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 52a2726d327f..b5c80b189902 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -484,8 +484,6 @@ out:
         return sk;
 }
 
-void x25_init_timers(struct sock *sk);
-
 static int x25_create(struct socket *sock, int protocol)
 {
         struct sock *sk;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e5372b11fc8f..82f36d396fca 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -434,18 +434,19 @@ error_no_put:
         return NULL;
 }
 
-static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_usersa_info *p = NLMSG_DATA(nlh);
         struct xfrm_state *x;
         int err;
         struct km_event c;
 
-        err = verify_newsa_info(p, (struct rtattr **)xfrma);
+        err = verify_newsa_info(p, xfrma);
         if (err)
                 return err;
 
-        x = xfrm_state_construct(p, (struct rtattr **)xfrma, &err);
+        x = xfrm_state_construct(p, xfrma, &err);
         if (!x)
                 return err;
 
@@ -507,14 +508,15 @@ static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
         return x;
 }
 
-static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         int err = -ESRCH;
         struct km_event c;
         struct xfrm_usersa_id *p = NLMSG_DATA(nlh);
 
-        x = xfrm_user_state_lookup(p, (struct rtattr **)xfrma, &err);
+        x = xfrm_user_state_lookup(p, xfrma, &err);
         if (x == NULL)
                 return err;
 
@@ -672,14 +674,15 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
         return skb;
 }
 
-static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_get_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_usersa_id *p = NLMSG_DATA(nlh);
         struct xfrm_state *x;
         struct sk_buff *resp_skb;
         int err = -ESRCH;
 
-        x = xfrm_user_state_lookup(p, (struct rtattr **)xfrma, &err);
+        x = xfrm_user_state_lookup(p, xfrma, &err);
         if (x == NULL)
                 goto out_noput;
 
@@ -718,7 +721,8 @@ static int verify_userspi_info(struct xfrm_userspi_info *p)
         return 0;
 }
 
-static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         struct xfrm_userspi_info *p;
@@ -1013,7 +1017,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p,
         return NULL;
 }
 
-static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_userpolicy_info *p = NLMSG_DATA(nlh);
         struct xfrm_policy *xp;
@@ -1024,11 +1029,11 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         err = verify_newpolicy_info(p);
         if (err)
                 return err;
-        err = verify_sec_ctx_len((struct rtattr **)xfrma);
+        err = verify_sec_ctx_len(xfrma);
         if (err)
                 return err;
 
-        xp = xfrm_policy_construct(p, (struct rtattr **)xfrma, &err);
+        xp = xfrm_policy_construct(p, xfrma, &err);
         if (!xp)
                 return err;
 
@@ -1227,7 +1232,8 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
         return skb;
 }
 
-static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_policy *xp;
         struct xfrm_userpolicy_id *p;
@@ -1239,7 +1245,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         p = NLMSG_DATA(nlh);
         delete = nlh->nlmsg_type == XFRM_MSG_DELPOLICY;
 
-        err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
+        err = copy_from_user_policy_type(&type, xfrma);
         if (err)
                 return err;
 
@@ -1250,11 +1256,10 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         if (p->index)
                 xp = xfrm_policy_byid(type, p->dir, p->index, delete);
         else {
-                struct rtattr **rtattrs = (struct rtattr **)xfrma;
-                struct rtattr *rt = rtattrs[XFRMA_SEC_CTX-1];
+                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                 struct xfrm_policy tmp;
 
-                err = verify_sec_ctx_len(rtattrs);
+                err = verify_sec_ctx_len(xfrma);
                 if (err)
                         return err;
 
@@ -1302,7 +1307,8 @@ out:
         return err;
 }
 
-static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct km_event c;
         struct xfrm_usersa_flush *p = NLMSG_DATA(nlh);
@@ -1367,7 +1373,8 @@ nlmsg_failure:
         return -1;
 }
 
-static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         struct sk_buff *r_skb;
@@ -1415,7 +1422,8 @@ static int xfrm_get_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         return err;
 }
 
-static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         struct km_event c;
@@ -1439,7 +1447,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
                 goto out;
 
         spin_lock_bh(&x->lock);
-        err = xfrm_update_ae_params(x,(struct rtattr **)xfrma);
+        err = xfrm_update_ae_params(x, xfrma);
         spin_unlock_bh(&x->lock);
         if (err < 0)
                 goto out;
@@ -1455,14 +1463,15 @@ out:
         return err;
 }
 
-static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct km_event c;
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err;
         struct xfrm_audit audit_info;
 
-        err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
+        err = copy_from_user_policy_type(&type, xfrma);
         if (err)
                 return err;
 
@@ -1477,7 +1486,8 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **x
         return 0;
 }
 
-static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_policy *xp;
         struct xfrm_user_polexpire *up = NLMSG_DATA(nlh);
@@ -1485,18 +1495,17 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void *
         u8 type = XFRM_POLICY_TYPE_MAIN;
         int err = -ENOENT;
 
-        err = copy_from_user_policy_type(&type, (struct rtattr **)xfrma);
+        err = copy_from_user_policy_type(&type, xfrma);
         if (err)
                 return err;
 
         if (p->index)
                 xp = xfrm_policy_byid(type, p->dir, p->index, 0);
         else {
-                struct rtattr **rtattrs = (struct rtattr **)xfrma;
-                struct rtattr *rt = rtattrs[XFRMA_SEC_CTX-1];
+                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                 struct xfrm_policy tmp;
 
-                err = verify_sec_ctx_len(rtattrs);
+                err = verify_sec_ctx_len(xfrma);
                 if (err)
                         return err;
 
@@ -1537,7 +1546,8 @@ out:
         return err;
 }
 
-static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_state *x;
         int err;
@@ -1568,7 +1578,8 @@ out:
         return err;
 }
 
-static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
+static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
+                struct rtattr **xfrma)
 {
         struct xfrm_policy *xp;
         struct xfrm_user_tmpl *ut;
@@ -1647,7 +1658,7 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
 #undef XMSGSIZE
 
 static struct xfrm_link {
-        int (*doit)(struct sk_buff *, struct nlmsghdr *, void **);
+        int (*doit)(struct sk_buff *, struct nlmsghdr *, struct rtattr **);
         int (*dump)(struct sk_buff *, struct netlink_callback *);
 } xfrm_dispatch[XFRM_NR_MSGTYPES] = {
         [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
@@ -1735,7 +1746,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err
 
         if (link->doit == NULL)
                 goto err_einval;
-        *errp = link->doit(skb, nlh, (void **) &xfrma);
+        *errp = link->doit(skb, nlh, xfrma);
 
         return *errp;