109 files changed, 1080 insertions, 940 deletions

diff --git a/Documentation/kobject.txt b/Documentation/kobject.txt
index bf3256e04027..51a8021ee532 100644
--- a/Documentation/kobject.txt
+++ b/Documentation/kobject.txt
@@ -305,7 +305,7 @@ should not be manipulated by any other user.
 
 A kset keeps its children in a standard kernel linked list.  Kobjects point
 back to their containing kset via their kset field. In almost all cases,
-the kobjects belonging to a ket have that kset (or, strictly, its embedded
+the kobjects belonging to a kset have that kset (or, strictly, its embedded
 kobject) in their parent.
 
 As a kset contains a kobject within it, it should always be dynamically
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index 01c6c3d8a7e3..64b3f146e4b0 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -503,7 +503,7 @@ generate input device EV_KEY events.
 In addition to the EV_KEY events, thinkpad-acpi may also issue EV_SW
 events for switches:
 
-SW_RADIO        T60 and later hardare rfkill rocker switch
+SW_RFKILL_ALL   T60 and later hardare rfkill rocker switch
 SW_TABLET_MODE  Tablet ThinkPads HKEY events 0x5009 and 0x500A
 
 Non hot-key ACPI HKEY event map:
diff --git a/MAINTAINERS b/MAINTAINERS
index e3560df4608e..9d4304266043 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -228,21 +228,21 @@ ACPI BATTERY DRIVERS
 P:      Alexey Starikovskiy
 M:      astarikovskiy@suse.de
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 
 ACPI EC DRIVER
 P:      Alexey Starikovskiy
 M:      astarikovskiy@suse.de
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 
 ACPI FAN DRIVER
 P:      Len Brown
 M:      len.brown@intel.com
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 
 ACPI PCI HOTPLUG DRIVER
@@ -255,14 +255,14 @@ ACPI THERMAL DRIVER
 P:      Len Brown
 M:      len.brown@intel.com
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 
 ACPI VIDEO DRIVER
 P:      Rui Zhang
 M:      rui.zhang@intel.com
 L:      linux-acpi@vger.kernel.org
-W:      http://acpi.sourceforge.net/
+W:      http://www.lesswatts.org/projects/acpi/
 S:      Supported
 
 ACPI WMI DRIVER
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 853d1f11be00..43687cc60dfb 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -465,7 +465,6 @@ void __init acpi_numa_slit_init(struct acpi_table_slit *slit)
                 printk(KERN_ERR
                        "ACPI 2.0 SLIT: size mismatch: %d expected, %d actual\n",
                        len, slit->header.length);
-                memset(numa_slit, 10, sizeof(numa_slit));
                 return;
         }
         slit_table = slit;
@@ -574,8 +573,14 @@ void __init acpi_numa_arch_fixup(void)
         printk(KERN_INFO "Number of memory chunks in system = %d\n",
                num_node_memblks);
 
-        if (!slit_table)
+        if (!slit_table) {
+                for (i = 0; i < MAX_NUMNODES; i++)
+                        for (j = 0; j < MAX_NUMNODES; j++)
+                                node_distance(i, j) = i == j ? LOCAL_DISTANCE :
+                                                        REMOTE_DISTANCE;
                 return;
+        }
+
         memset(numa_slit, -1, sizeof(numa_slit));
         for (i = 0; i < slit_table->locality_count; i++) {
                 if (!pxm_bit_test(i))
diff --git a/arch/ia64/kvm/mmio.c b/arch/ia64/kvm/mmio.c
index 351bf70da463..7f1a858bc69f 100644
--- a/arch/ia64/kvm/mmio.c
+++ b/arch/ia64/kvm/mmio.c
@@ -159,7 +159,8 @@ static void mmio_access(struct kvm_vcpu *vcpu, u64 src_pa, u64 *dest,
 
         if (p->u.ioreq.state == STATE_IORESP_READY) {
                 if (dir == IOREQ_READ)
-                        *dest = p->u.ioreq.data;
+                        /* it's necessary to ensure zero extending */
+                        *dest = p->u.ioreq.data & (~0UL >> (64-(s*8)));
         } else
                 panic_vm(vcpu);
 out:
diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index f5d7a5eab96e..75dff7cfa814 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -116,8 +116,6 @@ static void kvmppc_44x_shadow_release(struct kvm_vcpu *vcpu,
         struct tlbe *stlbe = &vcpu->arch.shadow_tlb[index];
         struct page *page = vcpu->arch.shadow_pages[index];
 
-        kunmap(vcpu->arch.shadow_pages[index]);
-
         if (get_tlb_v(stlbe)) {
                 if (kvmppc_44x_tlbe_is_writable(stlbe))
                         kvm_release_page_dirty(page);
@@ -144,18 +142,19 @@ void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 gvaddr, gfn_t gfn, u64 asid,
         stlbe = &vcpu->arch.shadow_tlb[victim];
 
         /* Get reference to new page. */
-        down_write(&current->mm->mmap_sem);
+        down_read(&current->mm->mmap_sem);
         new_page = gfn_to_page(vcpu->kvm, gfn);
         if (is_error_page(new_page)) {
-                printk(KERN_ERR "Couldn't get guest page!\n");
+                printk(KERN_ERR "Couldn't get guest page for gfn %lx!\n", gfn);
                 kvm_release_page_clean(new_page);
+                up_read(&current->mm->mmap_sem);
                 return;
         }
         hpaddr = page_to_phys(new_page);
 
         /* Drop reference to old page. */
         kvmppc_44x_shadow_release(vcpu, victim);
-        up_write(&current->mm->mmap_sem);
+        up_read(&current->mm->mmap_sem);
 
         vcpu->arch.shadow_pages[victim] = new_page;
 
diff --git a/arch/powerpc/kvm/booke_guest.c b/arch/powerpc/kvm/booke_guest.c
index 712d89a28c46..9c8ad850c6e3 100644
--- a/arch/powerpc/kvm/booke_guest.c
+++ b/arch/powerpc/kvm/booke_guest.c
@@ -227,39 +227,6 @@ void kvmppc_check_and_deliver_interrupts(struct kvm_vcpu *vcpu)
         }
 }
 
-static int kvmppc_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu)
-{
-        enum emulation_result er;
-        int r;
-
-        er = kvmppc_emulate_instruction(run, vcpu);
-        switch (er) {
-        case EMULATE_DONE:
-                /* Future optimization: only reload non-volatiles if they were
-                 * actually modified. */
-                r = RESUME_GUEST_NV;
-                break;
-        case EMULATE_DO_MMIO:
-                run->exit_reason = KVM_EXIT_MMIO;
-                /* We must reload nonvolatiles because "update" load/store
-                 * instructions modify register state. */
-                /* Future optimization: only reload non-volatiles if they were
-                 * actually modified. */
-                r = RESUME_HOST_NV;
-                break;
-        case EMULATE_FAIL:
-                /* XXX Deliver Program interrupt to guest. */
-                printk(KERN_EMERG "%s: emulation failed (%08x)\n", __func__,
-                       vcpu->arch.last_inst);
-                r = RESUME_HOST;
-                break;
-        default:
-                BUG();
-        }
-
-        return r;
-}
-
 /**
  * kvmppc_handle_exit
  *
diff --git a/arch/powerpc/kvm/emulate.c b/arch/powerpc/kvm/emulate.c
index a03fe0c80698..000097461283 100644
--- a/arch/powerpc/kvm/emulate.c
+++ b/arch/powerpc/kvm/emulate.c
@@ -246,6 +246,11 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu)
         case 31:
                 switch (get_xop(inst)) {
 
+                case 23:                                        /* lwzx */
+                        rt = get_rt(inst);
+                        emulated = kvmppc_handle_load(run, vcpu, rt, 4, 1);
+                        break;
+
                 case 83:                                        /* mfmsr */
                         rt = get_rt(inst);
                         vcpu->arch.gpr[rt] = vcpu->arch.msr;
@@ -267,6 +272,13 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu)
                         kvmppc_set_msr(vcpu, vcpu->arch.gpr[rs]);
                         break;
 
+                case 151:                                       /* stwx */
+                        rs = get_rs(inst);
+                        emulated = kvmppc_handle_store(run, vcpu,
+                                                       vcpu->arch.gpr[rs],
+                                                       4, 1);
+                        break;
+
                 case 163:                                       /* wrteei */
                         vcpu->arch.msr = (vcpu->arch.msr & ~MSR_EE)
                                          | (inst & MSR_EE);
diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c
index f639a152869f..a0775e1f08df 100644
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -20,7 +20,7 @@ static int __diag_time_slice_end(struct kvm_vcpu *vcpu)
         VCPU_EVENT(vcpu, 5, "%s", "diag time slice end");
         vcpu->stat.diagnose_44++;
         vcpu_put(vcpu);
-        schedule();
+        yield();
         vcpu_load(vcpu);
         return 0;
 }
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index fcd1ed8015c1..84a7fed4cd4e 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -339,6 +339,11 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
         if (kvm_cpu_has_interrupt(vcpu))
                 return 0;
 
+        __set_cpu_idle(vcpu);
+        spin_lock_bh(&vcpu->arch.local_int.lock);
+        vcpu->arch.local_int.timer_due = 0;
+        spin_unlock_bh(&vcpu->arch.local_int.lock);
+
         if (psw_interrupts_disabled(vcpu)) {
                 VCPU_EVENT(vcpu, 3, "%s", "disabled wait");
                 __unset_cpu_idle(vcpu);
@@ -366,8 +371,6 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
 no_timer:
         spin_lock_bh(&vcpu->arch.local_int.float_int->lock);
         spin_lock_bh(&vcpu->arch.local_int.lock);
-        __set_cpu_idle(vcpu);
-        vcpu->arch.local_int.timer_due = 0;
         add_wait_queue(&vcpu->arch.local_int.wq, &wait);
         while (list_empty(&vcpu->arch.local_int.list) &&
                 list_empty(&vcpu->arch.local_int.float_int->list) &&
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 0ac36a649eba..6558b09ff579 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -423,6 +423,8 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
         return -EINVAL; /* not implemented yet */
 }
 
+extern void s390_handle_mcck(void);
+
 static void __vcpu_run(struct kvm_vcpu *vcpu)
 {
         memcpy(&vcpu->arch.sie_block->gg14, &vcpu->arch.guest_gprs[14], 16);
@@ -430,13 +432,21 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
         if (need_resched())
                 schedule();
 
+        if (test_thread_flag(TIF_MCCK_PENDING))
+                s390_handle_mcck();
+
+        kvm_s390_deliver_pending_interrupts(vcpu);
+
         vcpu->arch.sie_block->icptcode = 0;
         local_irq_disable();
         kvm_guest_enter();
         local_irq_enable();
         VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                    atomic_read(&vcpu->arch.sie_block->cpuflags));
-        sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs);
+        if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
+                VCPU_EVENT(vcpu, 3, "%s", "fault in sie instruction");
+                kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+        }
         VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
                    vcpu->arch.sie_block->icptcode);
         local_irq_disable();
@@ -475,7 +485,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
         might_sleep();
 
         do {
-                kvm_s390_deliver_pending_interrupts(vcpu);
                 __vcpu_run(vcpu);
                 rc = kvm_handle_sie_intercept(vcpu);
         } while (!signal_pending(current) && !rc);
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 5c1aea97cd12..3d98ba82ea67 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -254,36 +254,46 @@ void disable_noexec(struct mm_struct *mm, struct task_struct *tsk)
 int s390_enable_sie(void)
 {
         struct task_struct *tsk = current;
-        struct mm_struct *mm;
-        int rc;
+        struct mm_struct *mm, *old_mm;
 
-        task_lock(tsk);
-
-        rc = 0;
+        /* Do we have pgstes? if yes, we are done */
         if (tsk->mm->context.pgstes)
-                goto unlock;
+                return 0;
 
-        rc = -EINVAL;
+        /* lets check if we are allowed to replace the mm */
+        task_lock(tsk);
         if (!tsk->mm || atomic_read(&tsk->mm->mm_users) > 1 ||
-            tsk->mm != tsk->active_mm || tsk->mm->ioctx_list)
-                goto unlock;
+            tsk->mm != tsk->active_mm || tsk->mm->ioctx_list) {
+                task_unlock(tsk);
+                return -EINVAL;
+        }
+        task_unlock(tsk);
 
-        tsk->mm->context.pgstes = 1;    /* dirty little tricks .. */
+        /* we copy the mm with pgstes enabled */
+        tsk->mm->context.pgstes = 1;
         mm = dup_mm(tsk);
         tsk->mm->context.pgstes = 0;
-
-        rc = -ENOMEM;
         if (!mm)
-                goto unlock;
-        mmput(tsk->mm);
+                return -ENOMEM;
+
+        /* Now lets check again if somebody attached ptrace etc */
+        task_lock(tsk);
+        if (!tsk->mm || atomic_read(&tsk->mm->mm_users) > 1 ||
+            tsk->mm != tsk->active_mm || tsk->mm->ioctx_list) {
+                mmput(mm);
+                task_unlock(tsk);
+                return -EINVAL;
+        }
+
+        /* ok, we are alone. No ptrace, no threads, etc. */
+        old_mm = tsk->mm;
         tsk->mm = tsk->active_mm = mm;
         preempt_disable();
         update_mm(mm, tsk);
         cpu_set(smp_processor_id(), mm->cpu_vm_mask);
         preempt_enable();
-        rc = 0;
-unlock:
         task_unlock(tsk);
-        return rc;
+        mmput(old_mm);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(s390_enable_sie);
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 7c077a9d9777..f2f5d260874e 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -200,7 +200,6 @@ int __pit_timer_fn(struct kvm_kpit_state *ps)
 
         atomic_inc(&pt->pending);
         smp_mb__after_atomic_inc();
-        /* FIXME: handle case where the guest is in guest mode */
         if (vcpu0 && waitqueue_active(&vcpu0->wq)) {
                 vcpu0->arch.mp_state = KVM_MP_STATE_RUNNABLE;
                 wake_up_interruptible(&vcpu0->wq);
@@ -237,6 +236,19 @@ static enum hrtimer_restart pit_timer_fn(struct hrtimer *data)
                 return HRTIMER_NORESTART;
 }
 
+void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
+{
+        struct kvm_pit *pit = vcpu->kvm->arch.vpit;
+        struct hrtimer *timer;
+
+        if (vcpu->vcpu_id != 0 || !pit)
+                return;
+
+        timer = &pit->pit_state.pit_timer.timer;
+        if (hrtimer_cancel(timer))
+                hrtimer_start(timer, timer->expires, HRTIMER_MODE_ABS);
+}
+
 static void destroy_pit_timer(struct kvm_kpit_timer *pt)
 {
         pr_debug("pit: execute del timer!\n");
diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
index ce1f583459b1..76d736b5f664 100644
--- a/arch/x86/kvm/irq.c
+++ b/arch/x86/kvm/irq.c
@@ -94,3 +94,9 @@ void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec)
         /* TODO: PIT, RTC etc. */
 }
 EXPORT_SYMBOL_GPL(kvm_timer_intr_post);
+
+void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
+{
+        __kvm_migrate_apic_timer(vcpu);
+        __kvm_migrate_pit_timer(vcpu);
+}
diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
index 1802134b836f..2a15be2275c0 100644
--- a/arch/x86/kvm/irq.h
+++ b/arch/x86/kvm/irq.h
@@ -84,6 +84,8 @@ void kvm_timer_intr_post(struct kvm_vcpu *vcpu, int vec);
 void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
 void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
 void __kvm_migrate_apic_timer(struct kvm_vcpu *vcpu);
+void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu);
+void __kvm_migrate_timers(struct kvm_vcpu *vcpu);
 
 int pit_has_pending_timer(struct kvm_vcpu *vcpu);
 int apic_has_pending_timer(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 7246b60afb96..ee3f53098f0c 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -658,7 +658,7 @@ static int is_empty_shadow_page(u64 *spt)
         u64 *end;
 
         for (pos = spt, end = pos + PAGE_SIZE / sizeof(u64); pos != end; pos++)
-                if (*pos != shadow_trap_nonpresent_pte) {
+                if (is_shadow_present_pte(*pos)) {
                         printk(KERN_ERR "%s: %p %llx\n", __func__,
                                pos, *pos);
                         return 0;
@@ -1858,6 +1858,7 @@ static void free_mmu_pages(struct kvm_vcpu *vcpu)
                 sp = container_of(vcpu->kvm->arch.active_mmu_pages.next,
                                   struct kvm_mmu_page, link);
                 kvm_mmu_zap_page(vcpu->kvm, sp);
+                cond_resched();
         }
         free_page((unsigned long)vcpu->arch.mmu.pae_root);
 }
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 156fe10288ae..934c7b619396 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -418,7 +418,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr,
 
         /* mmio */
         if (is_error_pfn(pfn)) {
-                pgprintk("gfn %x is mmio\n", walker.gfn);
+                pgprintk("gfn %lx is mmio\n", walker.gfn);
                 kvm_release_pfn_clean(pfn);
                 return 1;
         }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index ab22615eee89..6b0d5fa5bab3 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -688,7 +688,7 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                 delta = vcpu->arch.host_tsc - tsc_this;
                 svm->vmcb->control.tsc_offset += delta;
                 vcpu->cpu = cpu;
-                kvm_migrate_apic_timer(vcpu);
+                kvm_migrate_timers(vcpu);
         }
 
         for (i = 0; i < NR_HOST_SAVE_USER_MSRS; i++)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bfe4db11989c..02efbe75f317 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -608,7 +608,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 
         if (vcpu->cpu != cpu) {
                 vcpu_clear(vmx);
-                kvm_migrate_apic_timer(vcpu);
+                kvm_migrate_timers(vcpu);
                 vpid_sync_vcpu_all(vmx);
         }
 
@@ -1036,6 +1036,7 @@ static void hardware_enable(void *garbage)
 static void hardware_disable(void *garbage)
 {
         asm volatile (ASM_VMX_VMXOFF : : : "cc");
+        write_cr4(read_cr4() & ~X86_CR4_VMXE);
 }
 
 static __init int adjust_vmx_controls(u32 ctl_min, u32 ctl_opt,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 21338bdb28ff..00acf1301a15 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2758,7 +2758,7 @@ again:
 
         if (vcpu->requests) {
                 if (test_and_clear_bit(KVM_REQ_MIGRATE_TIMER, &vcpu->requests))
-                        __kvm_migrate_apic_timer(vcpu);
+                        __kvm_migrate_timers(vcpu);
                 if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
                                        &vcpu->requests)) {
                         kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;
diff --git a/arch/x86/kvm/x86_emulate.c b/arch/x86/kvm/x86_emulate.c
index 8a96320ab071..932f216d890c 100644
--- a/arch/x86/kvm/x86_emulate.c
+++ b/arch/x86/kvm/x86_emulate.c
@@ -1727,7 +1727,8 @@ twobyte_insn:
                         if (rc)
                                 goto done;
 
-                        kvm_emulate_hypercall(ctxt->vcpu);
+                        /* Let the processor re-execute the fixed hypercall */
+                        c->eip = ctxt->vcpu->arch.rip;
                         /* Disable writeback. */
                         c->dst.type = OP_NONE;
                         break;
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 3890234e5b26..99649dccad28 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -97,36 +97,9 @@ static __init inline int srat_disabled(void)
         return numa_off || acpi_numa < 0;
 }
 
-/*
- * A lot of BIOS fill in 10 (= no distance) everywhere. This messes
- * up the NUMA heuristics which wants the local node to have a smaller
- * distance than the others.
- * Do some quick checks here and only use the SLIT if it passes.
- */
-static __init int slit_valid(struct acpi_table_slit *slit)
-{
-        int i, j;
-        int d = slit->locality_count;
-        for (i = 0; i < d; i++) {
-                for (j = 0; j < d; j++)  {
-                        u8 val = slit->entry[d*i + j];
-                        if (i == j) {
-                                if (val != LOCAL_DISTANCE)
-                                        return 0;
-                        } else if (val <= LOCAL_DISTANCE)
-                                return 0;
-                }
-        }
-        return 1;
-}
-
 /* Callback for SLIT parsing */
 void __init acpi_numa_slit_init(struct acpi_table_slit *slit)
 {
-        if (!slit_valid(slit)) {
-                printk(KERN_INFO "ACPI: SLIT table looks invalid. Not used.\n");
-                return;
-        }
         acpi_slit = slit;
 }
 
diff --git a/drivers/acpi/bay.c b/drivers/acpi/bay.c
index d2fc94161848..26038c2a2a71 100644
--- a/drivers/acpi/bay.c
+++ b/drivers/acpi/bay.c
@@ -301,16 +301,20 @@ static int bay_add(acpi_handle handle, int id)
          */
         pdev->dev.uevent_suppress = 0;
 
-        if (acpi_bay_add_fs(new_bay)) {
-                platform_device_unregister(new_bay->pdev);
-                goto bay_add_err;
-        }
-
         /* register for events on this device */
         status = acpi_install_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
                         bay_notify, new_bay);
         if (ACPI_FAILURE(status)) {
-                printk(KERN_ERR PREFIX "Error installing bay notify handler\n");
+                printk(KERN_INFO PREFIX "Error installing bay notify handler\n");
+                platform_device_unregister(new_bay->pdev);
+                goto bay_add_err;
+        }
+
+        if (acpi_bay_add_fs(new_bay)) {
+                acpi_remove_notify_handler(handle, ACPI_SYSTEM_NOTIFY,
+                                           bay_notify);
+                platform_device_unregister(new_bay->pdev);
+                goto bay_add_err;
         }
 
         /* if we are on a dock station, we should register for dock
diff --git a/drivers/acpi/dispatcher/dsfield.c b/drivers/acpi/dispatcher/dsfield.c
index c78078315be9..f988a5e7d2b4 100644
--- a/drivers/acpi/dispatcher/dsfield.c
+++ b/drivers/acpi/dispatcher/dsfield.c
@@ -450,10 +450,6 @@ acpi_ds_init_field_objects(union acpi_parse_object *op,
                 return_ACPI_STATUS(AE_BAD_PARAMETER);
         }
 
-        if (!arg) {
-                return_ACPI_STATUS(AE_AML_NO_OPERAND);
-        }
-
         /* Creating new namespace node(s), should not already exist */
 
         flags = ACPI_NS_NO_UPSEARCH | ACPI_NS_DONT_OPEN_SCOPE |
@@ -467,6 +463,7 @@ acpi_ds_init_field_objects(union acpi_parse_object *op,
 
         /*
          * Walk the list of entries in the field_list
+         * Note: field_list can be of zero length. In this case, Arg will be NULL.
          */
         while (arg) {
                 /*
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index fa44fb96fc34..96c542f7fded 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -834,7 +834,7 @@ static int dock_add(acpi_handle handle)
                 goto dock_add_err;
         }
 
-        printk(KERN_INFO PREFIX "%s \n", ACPI_DOCK_DRIVER_DESCRIPTION);
+        printk(KERN_INFO PREFIX "%s\n", ACPI_DOCK_DRIVER_DESCRIPTION);
 
         return 0;
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 0924992187e8..5622aee996b2 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -194,7 +194,7 @@ static int acpi_ec_wait(struct acpi_ec *ec, enum ec_event event, int force_poll)
                 while (time_before(jiffies, delay)) {
                         if (acpi_ec_check_status(ec, event))
                                 return 0;
-                        udelay(ACPI_EC_UDELAY);
+                        msleep(1);
                 }
         }
         pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c
index 24da921d13e3..39d742190584 100644
--- a/drivers/acpi/executer/exconfig.c
+++ b/drivers/acpi/executer/exconfig.c
@@ -375,9 +375,15 @@ acpi_ex_load_op(union acpi_operand_object *obj_desc,
                 goto cleanup;
         }
 
+        /*
+         * Add the table to the namespace.
+         *
+         * Note: We load the table objects relative to the root of the namespace.
+         * This appears to go against the ACPI specification, but we do it for
+         * compatibility with other ACPI implementations.
+         */
         status =
-            acpi_ex_add_table(table_index, walk_state->scope_info->scope.node,
-                              &ddb_handle);
+            acpi_ex_add_table(table_index, acpi_gbl_root_node, &ddb_handle);
         if (ACPI_FAILURE(status)) {
 
                 /* On error, table_ptr was deallocated above */
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 06f8634fe58b..2808dc60fd67 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -272,6 +272,12 @@ static u32 rtc_handler(void *context)
 static inline void rtc_wake_setup(void)
 {
         acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, NULL);
+        /*
+         * After the RTC handler is installed, the Fixed_RTC event should
+         * be disabled. Only when the RTC alarm is set will it be enabled.
+         */
+        acpi_clear_event(ACPI_EVENT_RTC);
+        acpi_disable_event(ACPI_EVENT_RTC, 0);
 }
 
 static void rtc_wake_on(struct device *dev)
diff --git a/drivers/acpi/hardware/hwsleep.c b/drivers/acpi/hardware/hwsleep.c
index d9937e05ec6a..dba3cfbe8cba 100644
--- a/drivers/acpi/hardware/hwsleep.c
+++ b/drivers/acpi/hardware/hwsleep.c
@@ -223,15 +223,17 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state)
                 break;
         }
 
-        /* Set the system indicators to show the desired sleep state. */
-
+        /*
+         * Set the system indicators to show the desired sleep state.
+         * _SST is an optional method (return no error if not found)
+         */
         status = acpi_evaluate_object(NULL, METHOD_NAME__SST, &arg_list, NULL);
         if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
                 ACPI_EXCEPTION((AE_INFO, status,
                                 "While executing method _SST"));
         }
 
-        return_ACPI_STATUS(status);
+        return_ACPI_STATUS(AE_OK);
 }
 
 ACPI_EXPORT_SYMBOL(acpi_enter_sleep_state_prep)
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 5d59cb33b1a5..658e5f3abae0 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -140,19 +140,42 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)
         }
 }
 
+/*
+ * A lot of BIOS fill in 10 (= no distance) everywhere. This messes
+ * up the NUMA heuristics which wants the local node to have a smaller
+ * distance than the others.
+ * Do some quick checks here and only use the SLIT if it passes.
+ */
+static __init int slit_valid(struct acpi_table_slit *slit)
+{
+        int i, j;
+        int d = slit->locality_count;
+        for (i = 0; i < d; i++) {
+                for (j = 0; j < d; j++)  {
+                        u8 val = slit->entry[d*i + j];
+                        if (i == j) {
+                                if (val != LOCAL_DISTANCE)
+                                        return 0;
+                        } else if (val <= LOCAL_DISTANCE)
+                                return 0;
+                }
+        }
+        return 1;
+}
+
 static int __init acpi_parse_slit(struct acpi_table_header *table)
 {
         struct acpi_table_slit *slit;
-        u32 localities;
 
         if (!table)
                 return -EINVAL;
 
         slit = (struct acpi_table_slit *)table;
 
-        /* downcast just for %llu vs %lu for i386/ia64  */
-        localities = (u32) slit->locality_count;
-
+        if (!slit_valid(slit)) {
+                printk(KERN_INFO "ACPI: SLIT table looks invalid. Not used.\n");
+                return -EINVAL;
+        }
         acpi_numa_slit_init(slit);
 
         return 0;
diff --git a/drivers/acpi/parser/psargs.c b/drivers/acpi/parser/psargs.c
index f1e8bf65e24e..e94463778845 100644
--- a/drivers/acpi/parser/psargs.c
+++ b/drivers/acpi/parser/psargs.c
@@ -268,7 +268,7 @@ acpi_ps_get_next_namepath(struct acpi_walk_state *walk_state,
          */
         if (ACPI_SUCCESS(status) &&
             possible_method_call && (node->type == ACPI_TYPE_METHOD)) {
-                if (walk_state->op->common.aml_opcode == AML_UNLOAD_OP) {
+                if (walk_state->opcode == AML_UNLOAD_OP) {
                         /*
                          * acpi_ps_get_next_namestring has increased the AML pointer,
                          * so we need to restore the saved AML pointer for method call.
@@ -691,7 +691,7 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
 
                         /* To support super_name arg of Unload */
 
-                        if (walk_state->op->common.aml_opcode == AML_UNLOAD_OP) {
+                        if (walk_state->opcode == AML_UNLOAD_OP) {
                                 status =
                                     acpi_ps_get_next_namepath(walk_state,
                                                               parser_state, arg,
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 386e5aa48834..9dd0fa93b9e1 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -86,7 +86,6 @@ static int acpi_processor_info_open_fs(struct inode *inode, struct file *file);
 static void acpi_processor_notify(acpi_handle handle, u32 event, void *data);
 static acpi_status acpi_processor_hotadd_init(acpi_handle handle, int *p_cpu);
 static int acpi_processor_handle_eject(struct acpi_processor *pr);
-extern int acpi_processor_tstate_has_changed(struct acpi_processor *pr);
 
 
 static const struct acpi_device_id processor_device_ids[] = {
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 2dd2c1f3a01c..556ee1585192 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1669,6 +1669,7 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
                 return -EINVAL;
         }
 
+        dev->cpu = pr->id;
         for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
                 dev->states[i].name[0] = '\0';
                 dev->states[i].desc[0] = '\0';
@@ -1738,7 +1739,7 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
 
 int acpi_processor_cst_has_changed(struct acpi_processor *pr)
 {
-        int ret;
+        int ret = 0;
 
         if (boot_option_idle_override)
                 return 0;
@@ -1756,8 +1757,10 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
         cpuidle_pause_and_lock();
         cpuidle_disable_device(&pr->power.dev);
         acpi_processor_get_power_info(pr);
-        acpi_processor_setup_cpuidle(pr);
-        ret = cpuidle_enable_device(&pr->power.dev);
+        if (pr->flags.power) {
+                acpi_processor_setup_cpuidle(pr);
+                ret = cpuidle_enable_device(&pr->power.dev);
+        }
         cpuidle_resume_and_unlock();
 
         return ret;
@@ -1813,7 +1816,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
         if (pr->flags.power) {
 #ifdef CONFIG_CPU_IDLE
                 acpi_processor_setup_cpuidle(pr);
-                pr->power.dev.cpu = pr->id;
                 if (cpuidle_register_device(&pr->power.dev))
                         return -EIO;
 #endif
@@ -1850,8 +1852,7 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
                 return 0;
 
 #ifdef CONFIG_CPU_IDLE
-        if (pr->flags.power)
-                cpuidle_unregister_device(&pr->power.dev);
+        cpuidle_unregister_device(&pr->power.dev);
 #endif
         pr->flags.power_setup_done = 0;
 
diff --git a/drivers/acpi/sleep/proc.c b/drivers/acpi/sleep/proc.c
index 8a5fe8710513..224c57c03381 100644
--- a/drivers/acpi/sleep/proc.c
+++ b/drivers/acpi/sleep/proc.c
@@ -495,6 +495,12 @@ static int __init acpi_sleep_proc_init(void)
                     acpi_root_dir, &acpi_system_alarm_fops);
 
         acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, NULL);
+        /*
+         * Disable the RTC event after installing RTC handler.
+         * Only when RTC alarm is set will it be enabled.
+         */
+        acpi_clear_event(ACPI_EVENT_RTC);
+        acpi_disable_event(ACPI_EVENT_RTC, 0);
 #endif                          /* HAVE_ACPI_LEGACY_ALARM */
 
         /* 'wakeup device' [R/W] */
diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c
index 769f24855eb6..5bd2dec9a7ac 100644
--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -77,7 +77,6 @@ static ssize_t acpi_table_show(struct kobject *kobj,
             container_of(bin_attr, struct acpi_table_attr, attr);
         struct acpi_table_header *table_header = NULL;
         acpi_status status;
-        ssize_t ret_count = count;
 
         status =
             acpi_get_table(table_attr->name, table_attr->instance,
@@ -85,18 +84,8 @@ static ssize_t acpi_table_show(struct kobject *kobj,
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        if (offset >= table_header->length) {
-                ret_count = 0;
-                goto end;
-        }
-
-        if (offset + ret_count > table_header->length)
-                ret_count = table_header->length - offset;
-
-        memcpy(buf, ((char *)table_header) + offset, ret_count);
-
-      end:
-        return ret_count;
+        return memory_read_from_buffer(buf, count, &offset,
+                                        table_header, table_header->length);
 }
 
 static void acpi_table_attr_init(struct acpi_table_attr *table_attr,
diff --git a/drivers/acpi/tables/tbinstal.c b/drivers/acpi/tables/tbinstal.c
index 402f93e1ff20..5336ce88f89f 100644
--- a/drivers/acpi/tables/tbinstal.c
+++ b/drivers/acpi/tables/tbinstal.c
@@ -123,24 +123,13 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc,
                 }
         }
 
-        /* The table must be either an SSDT or a PSDT or an OEMx */
-
-        if (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_PSDT)&&
-            !ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT)&&
-            strncmp(table_desc->pointer->signature, "OEM", 3)) {
-                /* Check for a printable name */
-                if (acpi_ut_valid_acpi_name(
-                        *(u32 *) table_desc->pointer->signature)) {
-                        ACPI_ERROR((AE_INFO, "Table has invalid signature "
-                                        "[%4.4s], must be SSDT or PSDT",
-                                    table_desc->pointer->signature));
-                } else {
-                        ACPI_ERROR((AE_INFO, "Table has invalid signature "
-                                        "(0x%8.8X), must be SSDT or PSDT",
-                                    *(u32 *) table_desc->pointer->signature));
-                }
-                return_ACPI_STATUS(AE_BAD_SIGNATURE);
-        }
+        /*
+         * Originally, we checked the table signature for "SSDT" or "PSDT" here.
+         * Next, we added support for OEMx tables, signature "OEM".
+         * Valid tables were encountered with a null signature, so we've just
+         * given up on validating the signature, since it seems to be a waste
+         * of code. The original code was removed (05/2008).
+         */
 
         (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
 
diff --git a/drivers/acpi/tables/tbxface.c b/drivers/acpi/tables/tbxface.c
index fb57b93c2495..0e319604d3e7 100644
--- a/drivers/acpi/tables/tbxface.c
+++ b/drivers/acpi/tables/tbxface.c
@@ -540,7 +540,7 @@ static acpi_status acpi_tb_load_namespace(void)
                 acpi_tb_print_table_header(0, table);
 
                 if (no_auto_ssdt == 0) {
-                        printk(KERN_WARNING "ACPI: DSDT override uses original SSDTs unless \"acpi_no_auto_ssdt\"");
+                        printk(KERN_WARNING "ACPI: DSDT override uses original SSDTs unless \"acpi_no_auto_ssdt\"\n");
                 }
         }
 
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 504385b1f211..84c795fb9b1e 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -364,10 +364,17 @@ static int acpi_thermal_trips_update(struct acpi_thermal *tz, int flag)
         if (flag & ACPI_TRIPS_CRITICAL) {
                 status = acpi_evaluate_integer(tz->device->handle,
                                 "_CRT", NULL, &tz->trips.critical.temperature);
-                if (ACPI_FAILURE(status)) {
+                /*
+                 * Treat freezing temperatures as invalid as well; some
+                 * BIOSes return really low values and cause reboots at startup.
+                 * Below zero (Celcius) values clearly aren't right for sure..
+                 * ... so lets discard those as invalid.
+                 */
+                if (ACPI_FAILURE(status) ||
+                                tz->trips.critical.temperature <= 2732) {
                         tz->trips.critical.flags.valid = 0;
                         ACPI_EXCEPTION((AE_INFO, status,
-                                        "No critical threshold"));
+                                        "No or invalid critical threshold"));
                         return -ENODEV;
                 } else {
                         tz->trips.critical.flags.valid = 1;
diff --git a/drivers/acpi/utilities/utmisc.c b/drivers/acpi/utilities/utmisc.c
index e4ba7192cd15..1f057b71db1a 100644
--- a/drivers/acpi/utilities/utmisc.c
+++ b/drivers/acpi/utilities/utmisc.c
@@ -1048,6 +1048,7 @@ acpi_ut_exception(char *module_name,
         va_start(args, format);
         acpi_os_vprintf(format, args);
         acpi_os_printf(" [%X]\n", ACPI_CA_VERSION);
+        va_end(args);
 }
 
 EXPORT_SYMBOL(acpi_ut_exception);
@@ -1063,7 +1064,6 @@ acpi_ut_warning(char *module_name, u32 line_number, char *format, ...)
         acpi_os_vprintf(format, args);
         acpi_os_printf(" [%X]\n", ACPI_CA_VERSION);
         va_end(args);
-        va_end(args);
 }
 
 void ACPI_INTERNAL_VAR_XFACE
diff --git a/drivers/atm/eni.h b/drivers/atm/eni.h
index d04fefb0841f..e4c9525e60b3 100644
--- a/drivers/atm/eni.h
+++ b/drivers/atm/eni.h
@@ -18,7 +18,6 @@
 #include "midway.h"
 
 
-#define KERNEL_OFFSET   0xC0000000      /* kernel 0x0 is at phys 0xC0000000 */
 #define DEV_LABEL       "eni"
 
 #define UBR_BUFFER      (128*1024)      /* UBR buffer size */
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 422cfcad486d..ee0a51a3a41d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -762,6 +762,7 @@ static void device_remove_class_symlinks(struct device *dev)
 /**
  * dev_set_name - set a device name
  * @dev: device
+ * @fmt: format string for the device's name
  */
 int dev_set_name(struct device *dev, const char *fmt, ...)
 {
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index fc555a90bb21..23554b676d6e 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -38,6 +38,8 @@ static void cpuidle_kick_cpus(void)
 static void cpuidle_kick_cpus(void) {}
 #endif
 
+static int __cpuidle_register_device(struct cpuidle_device *dev);
+
 /**
  * cpuidle_idle_call - the main idle loop
  *
@@ -138,6 +140,12 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
         if (!dev->state_count)
                 return -EINVAL;
 
+        if (dev->registered == 0) {
+                ret = __cpuidle_register_device(dev);
+                if (ret)
+                        return ret;
+        }
+
         if ((ret = cpuidle_add_state_sysfs(dev)))
                 return ret;
 
@@ -232,10 +240,13 @@ static void poll_idle_init(struct cpuidle_device *dev) {}
 #endif /* CONFIG_ARCH_HAS_CPU_RELAX */
 
 /**
- * cpuidle_register_device - registers a CPU's idle PM feature
+ * __cpuidle_register_device - internal register function called before register
+ * and enable routines
  * @dev: the cpu
+ *
+ * cpuidle_lock mutex must be held before this is called
  */
-int cpuidle_register_device(struct cpuidle_device *dev)
+static int __cpuidle_register_device(struct cpuidle_device *dev)
 {
         int ret;
         struct sys_device *sys_dev = get_cpu_sysdev((unsigned long)dev->cpu);
@@ -247,18 +258,34 @@ int cpuidle_register_device(struct cpuidle_device *dev)
 
         init_completion(&dev->kobj_unregister);
 
-        mutex_lock(&cpuidle_lock);
-
         poll_idle_init(dev);
 
         per_cpu(cpuidle_devices, dev->cpu) = dev;
         list_add(&dev->device_list, &cpuidle_detected_devices);
         if ((ret = cpuidle_add_sysfs(sys_dev))) {
-                mutex_unlock(&cpuidle_lock);
                 module_put(cpuidle_curr_driver->owner);
                 return ret;
         }
 
+        dev->registered = 1;
+        return 0;
+}
+
+/**
+ * cpuidle_register_device - registers a CPU's idle PM feature
+ * @dev: the cpu
+ */
+int cpuidle_register_device(struct cpuidle_device *dev)
+{
+        int ret;
+
+        mutex_lock(&cpuidle_lock);
+
+        if ((ret = __cpuidle_register_device(dev))) {
+                mutex_unlock(&cpuidle_lock);
+                return ret;
+        }
+
         cpuidle_enable_device(dev);
         cpuidle_install_idle_handler();
 
@@ -278,6 +305,9 @@ void cpuidle_unregister_device(struct cpuidle_device *dev)
 {
         struct sys_device *sys_dev = get_cpu_sysdev((unsigned long)dev->cpu);
 
+        if (dev->registered == 0)
+                return;
+
         cpuidle_pause_and_lock();
 
         cpuidle_disable_device(dev);
diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
index 5fcbdccd7a53..16a874bb1561 100644
--- a/drivers/isdn/hardware/eicon/divasmain.c
+++ b/drivers/isdn/hardware/eicon/divasmain.c
@@ -806,7 +806,6 @@ static int DIVA_INIT_FUNCTION divas_init(void)
 
         if (!create_divas_proc()) {
 #ifdef MODULE
-                remove_divas_proc();
                 divas_unregister_chrdev();
                 divasfunc_exit();
 #endif
diff --git a/drivers/isdn/hardware/eicon/divasproc.c b/drivers/isdn/hardware/eicon/divasproc.c
index fae895828a17..040827288ec9 100644
--- a/drivers/isdn/hardware/eicon/divasproc.c
+++ b/drivers/isdn/hardware/eicon/divasproc.c
@@ -125,8 +125,8 @@ static const struct file_operations divas_fops = {
 
 int create_divas_proc(void)
 {
-        proc_create(divas_proc_name, S_IFREG | S_IRUGO, proc_net_eicon,
-                    &divas_fops);
+        divas_proc_entry = proc_create(divas_proc_name, S_IFREG | S_IRUGO,
+                                        proc_net_eicon, &divas_fops);
         if (!divas_proc_entry)
                 return (0);
 
diff --git a/drivers/isdn/hysdn/hysdn_procconf.c b/drivers/isdn/hysdn/hysdn_procconf.c
index 15906d005b05..484299b031f8 100644
--- a/drivers/isdn/hysdn/hysdn_procconf.c
+++ b/drivers/isdn/hysdn/hysdn_procconf.c
@@ -207,30 +207,17 @@ hysdn_conf_write(struct file *file, const char __user *buf, size_t count, loff_t
 /* read conf file -> output card info data */
 /*******************************************/
 static ssize_t
-hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t * off)
+hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t *off)
 {
         char *cp;
-        int i;
 
-        if (file->f_mode & FMODE_READ) {
-                if (!(cp = file->private_data))
-                        return (-EFAULT);       /* should never happen */
-                i = strlen(cp); /* get total string length */
-                if (*off < i) {
-                        /* still bytes to transfer */
-                        cp += *off;     /* point to desired data offset */
-                        i -= *off;      /* remaining length */
-                        if (i > count)
-                                i = count;      /* limit length to transfer */
-                        if (copy_to_user(buf, cp, i))
-                                return (-EFAULT);       /* copy error */
-                        *off += i;      /* adjust offset */
-                } else
-                        return (0);
-        } else
-                return (-EPERM);        /* no permission to read */
-
-        return (i);
+        if (!(file->f_mode & FMODE_READ))
+                return -EPERM;  /* no permission to read */
+
+        if (!(cp = file->private_data))
+                return -EFAULT; /* should never happen */
+
+        return simple_read_from_buffer(buf, count, off, cp, strlen(cp));
 }                               /* hysdn_conf_read */
 
 /******************/
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index a0ce0b2fa03e..b5969298f3d3 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -1293,7 +1293,7 @@ static void tpacpi_input_send_radiosw(void)
                 mutex_lock(&tpacpi_inputdev_send_mutex);
 
                 input_report_switch(tpacpi_inputdev,
-                                    SW_RADIO, !!wlsw);
+                                    SW_RFKILL_ALL, !!wlsw);
                 input_sync(tpacpi_inputdev);
 
                 mutex_unlock(&tpacpi_inputdev_send_mutex);
@@ -1921,6 +1921,29 @@ static struct attribute *hotkey_mask_attributes[] __initdata = {
         &dev_attr_hotkey_wakeup_hotunplug_complete.attr,
 };
 
+static void hotkey_exit(void)
+{
+#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
+        hotkey_poll_stop_sync();
+#endif
+
+        if (hotkey_dev_attributes)
+                delete_attr_set(hotkey_dev_attributes, &tpacpi_pdev->dev.kobj);
+
+        kfree(hotkey_keycode_map);
+
+        if (tp_features.hotkey) {
+                dbg_printk(TPACPI_DBG_EXIT,
+                           "restoring original hot key mask\n");
+                /* no short-circuit boolean operator below! */
+                if ((hotkey_mask_set(hotkey_orig_mask) |
+                     hotkey_status_set(hotkey_orig_status)) != 0)
+                        printk(TPACPI_ERR
+                               "failed to restore hot key mask "
+                               "to BIOS defaults\n");
+        }
+}
+
 static int __init hotkey_init(struct ibm_init_struct *iibm)
 {
         /* Requirements for changing the default keymaps:
@@ -2060,226 +2083,220 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
         vdbg_printk(TPACPI_DBG_INIT, "hotkeys are %s\n",
                 str_supported(tp_features.hotkey));
 
-        if (tp_features.hotkey) {
-                hotkey_dev_attributes = create_attr_set(13, NULL);
-                if (!hotkey_dev_attributes)
-                        return -ENOMEM;
-                res = add_many_to_attr_set(hotkey_dev_attributes,
-                                hotkey_attributes,
-                                ARRAY_SIZE(hotkey_attributes));
-                if (res)
-                        return res;
+        if (!tp_features.hotkey)
+                return 1;
 
-                /* mask not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
-                   A30, R30, R31, T20-22, X20-21, X22-24.  Detected by checking
-                   for HKEY interface version 0x100 */
-                if (acpi_evalf(hkey_handle, &hkeyv, "MHKV", "qd")) {
-                        if ((hkeyv >> 8) != 1) {
-                                printk(TPACPI_ERR "unknown version of the "
-                                       "HKEY interface: 0x%x\n", hkeyv);
-                                printk(TPACPI_ERR "please report this to %s\n",
-                                       TPACPI_MAIL);
-                        } else {
-                                /*
-                                 * MHKV 0x100 in A31, R40, R40e,
-                                 * T4x, X31, and later
-                                 */
-                                tp_features.hotkey_mask = 1;
-                        }
+        hotkey_dev_attributes = create_attr_set(13, NULL);
+        if (!hotkey_dev_attributes)
+                return -ENOMEM;
+        res = add_many_to_attr_set(hotkey_dev_attributes,
+                        hotkey_attributes,
+                        ARRAY_SIZE(hotkey_attributes));
+        if (res)
+                goto err_exit;
+
+        /* mask not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
+           A30, R30, R31, T20-22, X20-21, X22-24.  Detected by checking
+           for HKEY interface version 0x100 */
+        if (acpi_evalf(hkey_handle, &hkeyv, "MHKV", "qd")) {
+                if ((hkeyv >> 8) != 1) {
+                        printk(TPACPI_ERR "unknown version of the "
+                               "HKEY interface: 0x%x\n", hkeyv);
+                        printk(TPACPI_ERR "please report this to %s\n",
+                               TPACPI_MAIL);
+                } else {
+                        /*
+                         * MHKV 0x100 in A31, R40, R40e,
+                         * T4x, X31, and later
+                         */
+                        tp_features.hotkey_mask = 1;
                 }
+        }
 
-                vdbg_printk(TPACPI_DBG_INIT, "hotkey masks are %s\n",
-                        str_supported(tp_features.hotkey_mask));
+        vdbg_printk(TPACPI_DBG_INIT, "hotkey masks are %s\n",
+                str_supported(tp_features.hotkey_mask));
 
-                if (tp_features.hotkey_mask) {
-                        if (!acpi_evalf(hkey_handle, &hotkey_all_mask,
-                                        "MHKA", "qd")) {
-                                printk(TPACPI_ERR
-                                       "missing MHKA handler, "
-                                       "please report this to %s\n",
-                                       TPACPI_MAIL);
-                                /* FN+F12, FN+F4, FN+F3 */
-                                hotkey_all_mask = 0x080cU;
-                        }
+        if (tp_features.hotkey_mask) {
+                if (!acpi_evalf(hkey_handle, &hotkey_all_mask,
+                                "MHKA", "qd")) {
+                        printk(TPACPI_ERR
+                               "missing MHKA handler, "
+                               "please report this to %s\n",
+                               TPACPI_MAIL);
+                        /* FN+F12, FN+F4, FN+F3 */
+                        hotkey_all_mask = 0x080cU;
                 }
+        }
 
-                /* hotkey_source_mask *must* be zero for
-                 * the first hotkey_mask_get */
-                res = hotkey_status_get(&hotkey_orig_status);
-                if (!res && tp_features.hotkey_mask) {
-                        res = hotkey_mask_get();
-                        hotkey_orig_mask = hotkey_mask;
-                        if (!res) {
-                                res = add_many_to_attr_set(
-                                        hotkey_dev_attributes,
-                                        hotkey_mask_attributes,
-                                        ARRAY_SIZE(hotkey_mask_attributes));
-                        }
-                }
+        /* hotkey_source_mask *must* be zero for
+         * the first hotkey_mask_get */
+        res = hotkey_status_get(&hotkey_orig_status);
+        if (res)
+                goto err_exit;
+
+        if (tp_features.hotkey_mask) {
+                res = hotkey_mask_get();
+                if (res)
+                        goto err_exit;
+
+                hotkey_orig_mask = hotkey_mask;
+                res = add_many_to_attr_set(
+                                hotkey_dev_attributes,
+                                hotkey_mask_attributes,
+                                ARRAY_SIZE(hotkey_mask_attributes));
+                if (res)
+                        goto err_exit;
+        }
 
 #ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
-                if (tp_features.hotkey_mask) {
-                        hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK
-                                                & ~hotkey_all_mask;
-                } else {
-                        hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK;
-                }
+        if (tp_features.hotkey_mask) {
+                hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK
+                                        & ~hotkey_all_mask;
+        } else {
+                hotkey_source_mask = TPACPI_HKEY_NVRAM_GOOD_MASK;
+        }
 
-                vdbg_printk(TPACPI_DBG_INIT,
-                            "hotkey source mask 0x%08x, polling freq %d\n",
-                            hotkey_source_mask, hotkey_poll_freq);
+        vdbg_printk(TPACPI_DBG_INIT,
+                    "hotkey source mask 0x%08x, polling freq %d\n",
+                    hotkey_source_mask, hotkey_poll_freq);
 #endif
 
-                /* Not all thinkpads have a hardware radio switch */
-                if (!res && acpi_evalf(hkey_handle, &status, "WLSW", "qd")) {
-                        tp_features.hotkey_wlsw = 1;
-                        printk(TPACPI_INFO
-                                "radio switch found; radios are %s\n",
-                                enabled(status, 0));
-                        res = add_to_attr_set(hotkey_dev_attributes,
-                                        &dev_attr_hotkey_radio_sw.attr);
-                }
+        /* Not all thinkpads have a hardware radio switch */
+        if (acpi_evalf(hkey_handle, &status, "WLSW", "qd")) {
+                tp_features.hotkey_wlsw = 1;
+                printk(TPACPI_INFO
+                        "radio switch found; radios are %s\n",
+                        enabled(status, 0));
+                res = add_to_attr_set(hotkey_dev_attributes,
+                                &dev_attr_hotkey_radio_sw.attr);
+        }
 
-                /* For X41t, X60t, X61t Tablets... */
-                if (!res && acpi_evalf(hkey_handle, &status, "MHKG", "qd")) {
-                        tp_features.hotkey_tablet = 1;
-                        printk(TPACPI_INFO
-                                "possible tablet mode switch found; "
-                                "ThinkPad in %s mode\n",
-                                (status & TP_HOTKEY_TABLET_MASK)?
-                                        "tablet" : "laptop");
-                        res = add_to_attr_set(hotkey_dev_attributes,
-                                        &dev_attr_hotkey_tablet_mode.attr);
-                }
+        /* For X41t, X60t, X61t Tablets... */
+        if (!res && acpi_evalf(hkey_handle, &status, "MHKG", "qd")) {
+                tp_features.hotkey_tablet = 1;
+                printk(TPACPI_INFO
+                        "possible tablet mode switch found; "
+                        "ThinkPad in %s mode\n",
+                        (status & TP_HOTKEY_TABLET_MASK)?
+                                "tablet" : "laptop");
+                res = add_to_attr_set(hotkey_dev_attributes,
+                                &dev_attr_hotkey_tablet_mode.attr);
+        }
 
-                if (!res)
-                        res = register_attr_set_with_sysfs(
-                                        hotkey_dev_attributes,
-                                        &tpacpi_pdev->dev.kobj);
-                if (res)
-                        return res;
+        if (!res)
+                res = register_attr_set_with_sysfs(
+                                hotkey_dev_attributes,
+                                &tpacpi_pdev->dev.kobj);
+        if (res)
+                goto err_exit;
 
-                /* Set up key map */
+        /* Set up key map */
 
-                hotkey_keycode_map = kmalloc(TPACPI_HOTKEY_MAP_SIZE,
-                                                GFP_KERNEL);
-                if (!hotkey_keycode_map) {
-                        printk(TPACPI_ERR
-                                "failed to allocate memory for key map\n");
-                        return -ENOMEM;
-                }
+        hotkey_keycode_map = kmalloc(TPACPI_HOTKEY_MAP_SIZE,
+                                        GFP_KERNEL);
+        if (!hotkey_keycode_map) {
+                printk(TPACPI_ERR
+                        "failed to allocate memory for key map\n");
+                res = -ENOMEM;
+                goto err_exit;
+        }
 
-                if (thinkpad_id.vendor == PCI_VENDOR_ID_LENOVO) {
-                        dbg_printk(TPACPI_DBG_INIT,
-                                   "using Lenovo default hot key map\n");
-                        memcpy(hotkey_keycode_map, &lenovo_keycode_map,
-                                TPACPI_HOTKEY_MAP_SIZE);
+        if (thinkpad_id.vendor == PCI_VENDOR_ID_LENOVO) {
+                dbg_printk(TPACPI_DBG_INIT,
+                           "using Lenovo default hot key map\n");
+                memcpy(hotkey_keycode_map, &lenovo_keycode_map,
+                        TPACPI_HOTKEY_MAP_SIZE);
+        } else {
+                dbg_printk(TPACPI_DBG_INIT,
+                           "using IBM default hot key map\n");
+                memcpy(hotkey_keycode_map, &ibm_keycode_map,
+                        TPACPI_HOTKEY_MAP_SIZE);
+        }
+
+        set_bit(EV_KEY, tpacpi_inputdev->evbit);
+        set_bit(EV_MSC, tpacpi_inputdev->evbit);
+        set_bit(MSC_SCAN, tpacpi_inputdev->mscbit);
+        tpacpi_inputdev->keycodesize = TPACPI_HOTKEY_MAP_TYPESIZE;
+        tpacpi_inputdev->keycodemax = TPACPI_HOTKEY_MAP_LEN;
+        tpacpi_inputdev->keycode = hotkey_keycode_map;
+        for (i = 0; i < TPACPI_HOTKEY_MAP_LEN; i++) {
+                if (hotkey_keycode_map[i] != KEY_RESERVED) {
+                        set_bit(hotkey_keycode_map[i],
+                                tpacpi_inputdev->keybit);
                 } else {
-                        dbg_printk(TPACPI_DBG_INIT,
-                                   "using IBM default hot key map\n");
-                        memcpy(hotkey_keycode_map, &ibm_keycode_map,
-                                TPACPI_HOTKEY_MAP_SIZE);
-                }
-
-                set_bit(EV_KEY, tpacpi_inputdev->evbit);
-                set_bit(EV_MSC, tpacpi_inputdev->evbit);
-                set_bit(MSC_SCAN, tpacpi_inputdev->mscbit);
-                tpacpi_inputdev->keycodesize = TPACPI_HOTKEY_MAP_TYPESIZE;
-                tpacpi_inputdev->keycodemax = TPACPI_HOTKEY_MAP_LEN;
-                tpacpi_inputdev->keycode = hotkey_keycode_map;
-                for (i = 0; i < TPACPI_HOTKEY_MAP_LEN; i++) {
-                        if (hotkey_keycode_map[i] != KEY_RESERVED) {
-                                set_bit(hotkey_keycode_map[i],
-                                        tpacpi_inputdev->keybit);
-                        } else {
-                                if (i < sizeof(hotkey_reserved_mask)*8)
-                                        hotkey_reserved_mask |= 1 << i;
-                        }
-                }
-
-                if (tp_features.hotkey_wlsw) {
-                        set_bit(EV_SW, tpacpi_inputdev->evbit);
-                        set_bit(SW_RADIO, tpacpi_inputdev->swbit);
-                }
-                if (tp_features.hotkey_tablet) {
-                        set_bit(EV_SW, tpacpi_inputdev->evbit);
-                        set_bit(SW_TABLET_MODE, tpacpi_inputdev->swbit);
+                        if (i < sizeof(hotkey_reserved_mask)*8)
+                                hotkey_reserved_mask |= 1 << i;
                 }
+        }
 
-                /* Do not issue duplicate brightness change events to
-                 * userspace */
-                if (!tp_features.bright_acpimode)
-                        /* update bright_acpimode... */
-                        tpacpi_check_std_acpi_brightness_support();
-
-                if (tp_features.bright_acpimode) {
-                        printk(TPACPI_INFO
-                               "This ThinkPad has standard ACPI backlight "
-                               "brightness control, supported by the ACPI "
-                               "video driver\n");
-                        printk(TPACPI_NOTICE
-                               "Disabling thinkpad-acpi brightness events "
-                               "by default...\n");
-
-                        /* The hotkey_reserved_mask change below is not
-                         * necessary while the keys are at KEY_RESERVED in the
-                         * default map, but better safe than sorry, leave it
-                         * here as a marker of what we have to do, especially
-                         * when we finally become able to set this at runtime
-                         * on response to X.org requests */
-                        hotkey_reserved_mask |=
-                                (1 << TP_ACPI_HOTKEYSCAN_FNHOME)
-                                | (1 << TP_ACPI_HOTKEYSCAN_FNEND);
-                }
+        if (tp_features.hotkey_wlsw) {
+                set_bit(EV_SW, tpacpi_inputdev->evbit);
+                set_bit(SW_RFKILL_ALL, tpacpi_inputdev->swbit);
+        }
+        if (tp_features.hotkey_tablet) {
+                set_bit(EV_SW, tpacpi_inputdev->evbit);
+                set_bit(SW_TABLET_MODE, tpacpi_inputdev->swbit);
+        }
 
-                dbg_printk(TPACPI_DBG_INIT,
-                                "enabling hot key handling\n");
-                res = hotkey_status_set(1);
-                if (res)
-                        return res;
-                res = hotkey_mask_set(((hotkey_all_mask | hotkey_source_mask)
-                                        & ~hotkey_reserved_mask)
-                                        | hotkey_orig_mask);
-                if (res < 0 && res != -ENXIO)
-                        return res;
+        /* Do not issue duplicate brightness change events to
+         * userspace */
+        if (!tp_features.bright_acpimode)
+                /* update bright_acpimode... */
+                tpacpi_check_std_acpi_brightness_support();
 
-                dbg_printk(TPACPI_DBG_INIT,
-                                "legacy hot key reporting over procfs %s\n",
-                                (hotkey_report_mode < 2) ?
-                                        "enabled" : "disabled");
+        if (tp_features.bright_acpimode) {
+                printk(TPACPI_INFO
+                       "This ThinkPad has standard ACPI backlight "
+                       "brightness control, supported by the ACPI "
+                       "video driver\n");
+                printk(TPACPI_NOTICE
+                       "Disabling thinkpad-acpi brightness events "
+                       "by default...\n");
+
+                /* The hotkey_reserved_mask change below is not
+                 * necessary while the keys are at KEY_RESERVED in the
+                 * default map, but better safe than sorry, leave it
+                 * here as a marker of what we have to do, especially
+                 * when we finally become able to set this at runtime
+                 * on response to X.org requests */
+                hotkey_reserved_mask |=
+                        (1 << TP_ACPI_HOTKEYSCAN_FNHOME)
+                        | (1 << TP_ACPI_HOTKEYSCAN_FNEND);
+        }
+
+        dbg_printk(TPACPI_DBG_INIT, "enabling hot key handling\n");
+        res = hotkey_status_set(1);
+        if (res) {
+                hotkey_exit();
+                return res;
+        }
+        res = hotkey_mask_set(((hotkey_all_mask | hotkey_source_mask)
+                                & ~hotkey_reserved_mask)
+                                | hotkey_orig_mask);
+        if (res < 0 && res != -ENXIO) {
+                hotkey_exit();
+                return res;
+        }
 
-                tpacpi_inputdev->open = &hotkey_inputdev_open;
-                tpacpi_inputdev->close = &hotkey_inputdev_close;
+        dbg_printk(TPACPI_DBG_INIT,
+                        "legacy hot key reporting over procfs %s\n",
+                        (hotkey_report_mode < 2) ?
+                                "enabled" : "disabled");
 
-                hotkey_poll_setup_safe(1);
-                tpacpi_input_send_radiosw();
-                tpacpi_input_send_tabletsw();
-        }
+        tpacpi_inputdev->open = &hotkey_inputdev_open;
+        tpacpi_inputdev->close = &hotkey_inputdev_close;
 
-        return (tp_features.hotkey)? 0 : 1;
-}
+        hotkey_poll_setup_safe(1);
+        tpacpi_input_send_radiosw();
+        tpacpi_input_send_tabletsw();
 
-static void hotkey_exit(void)
-{
-#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
-        hotkey_poll_stop_sync();
-#endif
+        return 0;
 
-        if (tp_features.hotkey) {
-                dbg_printk(TPACPI_DBG_EXIT,
-                           "restoring original hot key mask\n");
-                /* no short-circuit boolean operator below! */
-                if ((hotkey_mask_set(hotkey_orig_mask) |
-                     hotkey_status_set(hotkey_orig_status)) != 0)
-                        printk(TPACPI_ERR
-                               "failed to restore hot key mask "
-                               "to BIOS defaults\n");
-        }
+err_exit:
+        delete_attr_set(hotkey_dev_attributes, &tpacpi_pdev->dev.kobj);
+        hotkey_dev_attributes = NULL;
 
-        if (hotkey_dev_attributes) {
-                delete_attr_set(hotkey_dev_attributes, &tpacpi_pdev->dev.kobj);
-                hotkey_dev_attributes = NULL;
-        }
+        return (res < 0)? res : 1;
 }
 
 static void hotkey_notify(struct ibm_struct *ibm, u32 event)
@@ -3319,7 +3336,7 @@ static struct tpacpi_led_classdev tpacpi_led_thinklight = {
 
 static int __init light_init(struct ibm_init_struct *iibm)
 {
-        int rc = 0;
+        int rc;
 
         vdbg_printk(TPACPI_DBG_INIT, "initializing light subdriver\n");
 
@@ -3337,20 +3354,23 @@ static int __init light_init(struct ibm_init_struct *iibm)
                 tp_features.light_status =
                         acpi_evalf(ec_handle, NULL, "KBLT", "qv");
 
-        vdbg_printk(TPACPI_DBG_INIT, "light is %s\n",
-                str_supported(tp_features.light));
+        vdbg_printk(TPACPI_DBG_INIT, "light is %s, light status is %s\n",
+                str_supported(tp_features.light),
+                str_supported(tp_features.light_status));
 
-        if (tp_features.light) {
-                rc = led_classdev_register(&tpacpi_pdev->dev,
-                                           &tpacpi_led_thinklight.led_classdev);
-        }
+        if (!tp_features.light)
+                return 1;
+
+        rc = led_classdev_register(&tpacpi_pdev->dev,
+                                   &tpacpi_led_thinklight.led_classdev);
 
         if (rc < 0) {
                 tp_features.light = 0;
                 tp_features.light_status = 0;
-        } else {
-                rc = (tp_features.light)? 0 : 1;
+        } else  {
+                rc = 0;
         }
+
         return rc;
 }
 
@@ -3833,7 +3853,7 @@ static const char * const tpacpi_led_names[TPACPI_LED_NUMLEDS] = {
         "tpacpi::standby",
 };
 
-static int led_get_status(unsigned int led)
+static int led_get_status(const unsigned int led)
 {
         int status;
         enum led_status_t led_s;
@@ -3857,41 +3877,42 @@ static int led_get_status(unsigned int led)
         /* not reached */
 }
 
-static int led_set_status(unsigned int led, enum led_status_t ledstatus)
+static int led_set_status(const unsigned int led,
+                          const enum led_status_t ledstatus)
 {
         /* off, on, blink. Index is led_status_t */
-        static const int led_sled_arg1[] = { 0, 1, 3 };
-        static const int led_exp_hlbl[] = { 0, 0, 1 };  /* led# * */
-        static const int led_exp_hlcl[] = { 0, 1, 1 };  /* led# * */
-        static const int led_led_arg1[] = { 0, 0x80, 0xc0 };
+        static const unsigned int led_sled_arg1[] = { 0, 1, 3 };
+        static const unsigned int led_led_arg1[] = { 0, 0x80, 0xc0 };
 
         int rc = 0;
 
         switch (led_supported) {
         case TPACPI_LED_570:
-                        /* 570 */
-                        led = 1 << led;
-                        if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
-                                        led, led_sled_arg1[ledstatus]))
-                                rc = -EIO;
-                        break;
+                /* 570 */
+                if (led > 7)
+                        return -EINVAL;
+                if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
+                                (1 << led), led_sled_arg1[ledstatus]))
+                        rc = -EIO;
+                break;
         case TPACPI_LED_OLD:
-                        /* 600e/x, 770e, 770x, A21e, A2xm/p, T20-22, X20 */
-                        led = 1 << led;
-                        rc = ec_write(TPACPI_LED_EC_HLMS, led);
-                        if (rc >= 0)
-                                rc = ec_write(TPACPI_LED_EC_HLBL,
-                                              led * led_exp_hlbl[ledstatus]);
-                        if (rc >= 0)
-                                rc = ec_write(TPACPI_LED_EC_HLCL,
-                                              led * led_exp_hlcl[ledstatus]);
-                        break;
+                /* 600e/x, 770e, 770x, A21e, A2xm/p, T20-22, X20 */
+                if (led > 7)
+                        return -EINVAL;
+                rc = ec_write(TPACPI_LED_EC_HLMS, (1 << led));
+                if (rc >= 0)
+                        rc = ec_write(TPACPI_LED_EC_HLBL,
+                                      (ledstatus == TPACPI_LED_BLINK) << led);
+                if (rc >= 0)
+                        rc = ec_write(TPACPI_LED_EC_HLCL,
+                                      (ledstatus != TPACPI_LED_OFF) << led);
+                break;
         case TPACPI_LED_NEW:
-                        /* all others */
-                        if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
-                                        led, led_led_arg1[ledstatus]))
-                                rc = -EIO;
-                        break;
+                /* all others */
+                if (!acpi_evalf(led_handle, NULL, NULL, "vdd",
+                                led, led_led_arg1[ledstatus]))
+                        rc = -EIO;
+                break;
         default:
                 rc = -ENXIO;
         }
@@ -3978,7 +3999,6 @@ static void led_exit(void)
         }
 
         kfree(tpacpi_leds);
-        tpacpi_leds = NULL;
 }
 
 static int __init led_init(struct ibm_init_struct *iibm)
@@ -4802,7 +4822,6 @@ static void brightness_exit(void)
                 vdbg_printk(TPACPI_DBG_EXIT,
                             "calling backlight_device_unregister()\n");
                 backlight_device_unregister(ibm_backlight_device);
-                ibm_backlight_device = NULL;
         }
 }
 
@@ -5764,11 +5783,16 @@ static int __init fan_init(struct ibm_init_struct *iibm)
             fan_control_access_mode != TPACPI_FAN_WR_NONE) {
                 rc = sysfs_create_group(&tpacpi_sensors_pdev->dev.kobj,
                                          &fan_attr_group);
-                if (!(rc < 0))
-                        rc = driver_create_file(&tpacpi_hwmon_pdriver.driver,
-                                        &driver_attr_fan_watchdog);
                 if (rc < 0)
                         return rc;
+
+                rc = driver_create_file(&tpacpi_hwmon_pdriver.driver,
+                                        &driver_attr_fan_watchdog);
+                if (rc < 0) {
+                        sysfs_remove_group(&tpacpi_sensors_pdev->dev.kobj,
+                                        &fan_attr_group);
+                        return rc;
+                }
                 return 0;
         } else
                 return 1;
diff --git a/drivers/net/7990.c b/drivers/net/7990.c
index 750a46f4bc58..ad6b8a5b6574 100644
--- a/drivers/net/7990.c
+++ b/drivers/net/7990.c
@@ -506,6 +506,7 @@ int lance_open (struct net_device *dev)
 
         return res;
 }
+EXPORT_SYMBOL_GPL(lance_open);
 
 int lance_close (struct net_device *dev)
 {
@@ -521,6 +522,7 @@ int lance_close (struct net_device *dev)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(lance_close);
 
 void lance_tx_timeout(struct net_device *dev)
 {
@@ -529,7 +531,7 @@ void lance_tx_timeout(struct net_device *dev)
         dev->trans_start = jiffies;
         netif_wake_queue (dev);
 }
-
+EXPORT_SYMBOL_GPL(lance_tx_timeout);
 
 int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
 {
@@ -586,6 +588,7 @@ int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(lance_start_xmit);
 
 /* taken from the depca driver via a2065.c */
 static void lance_load_multicast (struct net_device *dev)
@@ -654,6 +657,7 @@ void lance_set_multicast (struct net_device *dev)
         if (!stopped)
                 netif_start_queue (dev);
 }
+EXPORT_SYMBOL_GPL(lance_set_multicast);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
 void lance_poll(struct net_device *dev)
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 6ddc911e7d15..99e0b4cdc56f 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -637,22 +637,6 @@ static s32 atl1_phy_leave_power_saving(struct atl1_hw *hw)
 }
 
 /*
- * Force the PHY into power saving mode using vendor magic.
- */
-#ifdef CONFIG_PM
-static void atl1_phy_enter_power_saving(struct atl1_hw *hw)
-{
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 0);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0x124E);
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 2);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0x3000);
-        atl1_write_phy_reg(hw, MII_DBG_ADDR, 3);
-        atl1_write_phy_reg(hw, MII_DBG_DATA, 0);
-
-}
-#endif
-
-/*
  * Resets the PHY and make all config validate
  * hw - Struct containing variables accessed by shared code
  *
@@ -2860,7 +2844,6 @@ disable_wol:
         ctrl |= PCIE_PHYMISC_FORCE_RCV_DET;
         iowrite32(ctrl, hw->hw_addr + REG_PCIE_PHYMISC);
         ioread32(hw->hw_addr + REG_PCIE_PHYMISC);
-        atl1_phy_enter_power_saving(hw);
         hw->phy_configured = false;
         pci_enable_wake(pdev, pci_choose_state(pdev, state), 0);
 exit:
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 287a61918739..faae01dc1c4b 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -1766,16 +1766,20 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa)
         mutex_lock(&ehea_bcmc_regs.lock);
 
         /* Deregister old MAC in pHYP */
-        ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
-        if (ret)
-                goto out_upregs;
+        if (port->state == EHEA_PORT_UP) {
+                ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
+                if (ret)
+                        goto out_upregs;
+        }
 
         port->mac_addr = cb0->port_mac_addr << 16;
 
         /* Register new MAC in pHYP */
-        ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
-        if (ret)
-                goto out_upregs;
+        if (port->state == EHEA_PORT_UP) {
+                ret = ehea_broadcast_reg_helper(port, H_REG_BCMC);
+                if (ret)
+                        goto out_upregs;
+        }
 
         ret = 0;
 
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 9eca97fb0a54..2cb244763292 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -3273,6 +3273,20 @@ static void nv_link_irq(struct net_device *dev)
         dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
 }
 
+static void nv_msi_workaround(struct fe_priv *np)
+{
+
+        /* Need to toggle the msi irq mask within the ethernet device,
+         * otherwise, future interrupts will not be detected.
+         */
+        if (np->msi_flags & NV_MSI_ENABLED) {
+                u8 __iomem *base = np->base;
+
+                writel(0, base + NvRegMSIIrqMask);
+                writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+        }
+}
+
 static irqreturn_t nv_nic_irq(int foo, void *data)
 {
         struct net_device *dev = (struct net_device *) data;
@@ -3295,6 +3309,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                 if (!(events & np->irqmask))
                         break;
 
+                nv_msi_workaround(np);
+
                 spin_lock(&np->lock);
                 nv_tx_done(dev);
                 spin_unlock(&np->lock);
@@ -3410,6 +3426,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                 if (!(events & np->irqmask))
                         break;
 
+                nv_msi_workaround(np);
+
                 spin_lock(&np->lock);
                 nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
                 spin_unlock(&np->lock);
@@ -3750,6 +3768,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
         if (!(events & NVREG_IRQ_TIMER))
                 return IRQ_RETVAL(0);
 
+        nv_msi_workaround(np);
+
         spin_lock(&np->lock);
         np->intr_test = 1;
         spin_unlock(&np->lock);
diff --git a/drivers/net/irda/Kconfig b/drivers/net/irda/Kconfig
index ce816ba9c40d..e6317557a531 100644
--- a/drivers/net/irda/Kconfig
+++ b/drivers/net/irda/Kconfig
@@ -329,6 +329,7 @@ config PXA_FICP
 config MCS_FIR
         tristate "MosChip MCS7780 IrDA-USB dongle"
         depends on IRDA && USB && EXPERIMENTAL
+        select CRC32
         help
           Say Y or M here if you want to build support for the MosChip
           MCS7780 IrDA-USB bridge device driver.
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 6321b059ce13..2f38e847e2cd 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -58,8 +58,8 @@ static s32 ixgbe_reset_hw_82598(struct ixgbe_hw *hw);
 
 static s32 ixgbe_get_invariants_82598(struct ixgbe_hw *hw)
 {
-        hw->mac.num_rx_queues = IXGBE_82598_MAX_TX_QUEUES;
-        hw->mac.num_tx_queues = IXGBE_82598_MAX_RX_QUEUES;
+        hw->mac.num_rx_queues = IXGBE_82598_MAX_RX_QUEUES;
+        hw->mac.num_tx_queues = IXGBE_82598_MAX_TX_QUEUES;
         hw->mac.num_rx_addrs = IXGBE_82598_RAR_ENTRIES;
 
         /* PHY ops are filled in by default properly for Fiber only */
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 58a26a47af29..bafb69b6f7cb 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -341,12 +341,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
         struct pppox_sock *relay_po;
 
         if (sk->sk_state & PPPOX_BOUND) {
-                struct pppoe_hdr *ph = pppoe_hdr(skb);
-                int len = ntohs(ph->length);
-                skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
-                if (pskb_trim_rcsum(skb, len))
-                        goto abort_kfree;
-
                 ppp_input(&po->chan, skb);
         } else if (sk->sk_state & PPPOX_RELAY) {
                 relay_po = get_item_by_addr(&po->pppoe_relay);
@@ -357,7 +351,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
                 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
                         goto abort_put;
 
-                skb_pull(skb, sizeof(struct pppoe_hdr));
                 if (!__pppoe_xmit(sk_pppox(relay_po), skb))
                         goto abort_put;
         } else {
@@ -388,6 +381,7 @@ static int pppoe_rcv(struct sk_buff *skb,
 {
         struct pppoe_hdr *ph;
         struct pppox_sock *po;
+        int len;
 
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                 goto out;
@@ -399,10 +393,21 @@ static int pppoe_rcv(struct sk_buff *skb,
                 goto drop;
 
         ph = pppoe_hdr(skb);
+        len = ntohs(ph->length);
+
+        skb_pull_rcsum(skb, sizeof(*ph));
+        if (skb->len < len)
+                goto drop;
 
         po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
-        if (po != NULL)
-                return sk_receive_skb(sk_pppox(po), skb, 0);
+        if (!po)
+                goto drop;
+
+        if (pskb_trim_rcsum(skb, len))
+                goto drop;
+
+        return sk_receive_skb(sk_pppox(po), skb, 0);
+
 drop:
         kfree_skb(skb);
 out:
@@ -427,12 +432,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
         if (dev_net(dev) != &init_net)
                 goto abort;
 
-        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
-                goto abort;
-
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                 goto out;
 
+        if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+                goto abort;
+
         ph = pppoe_hdr(skb);
         if (ph->code != PADT_CODE)
                 goto abort;
@@ -937,12 +942,10 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
         m->msg_namelen = 0;
 
         if (skb) {
-                struct pppoe_hdr *ph = pppoe_hdr(skb);
-                const int len = ntohs(ph->length);
-
-                error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
+                total_len = min(total_len, skb->len);
+                error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
                 if (error == 0)
-                        error = len;
+                        error = total_len;
         }
 
         kfree_skb(skb);
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index 70cfdb46aa27..f9298827a76c 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -783,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
         err = 0;
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
-        if (skb) {
-                err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
-                                     skb->len);
-                if (err < 0)
-                        goto do_skb_free;
-                err = skb->len;
-        }
-do_skb_free:
+        if (!skb)
+                goto end;
+
+        if (len > skb->len)
+                len = skb->len;
+        else if (len < skb->len)
+                msg->msg_flags |= MSG_TRUNC;
+
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
+        if (likely(err == 0))
+                err = len;
+
         kfree_skb(skb);
 end:
         return err;
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d3f749c72d41..790db89db345 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -733,8 +733,10 @@ void falcon_fini_rx(struct efx_rx_queue *rx_queue)
                         continue;
                 break;
         }
-        if (rc)
+        if (rc) {
                 EFX_ERR(efx, "failed to flush rx queue %d\n", rx_queue->queue);
+                efx_schedule_reset(efx, RESET_TYPE_INVISIBLE);
+        }
 
         /* Remove RX descriptor ring from card */
         EFX_ZERO_OWORD(rx_desc_ptr);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3bb60530d4d7..62436b3a18c6 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -4404,7 +4404,9 @@ static int sky2_resume(struct pci_dev *pdev)
                         if (err) {
                                 printk(KERN_ERR PFX "%s: could not up: %d\n",
                                        dev->name, err);
+                                rtnl_lock();
                                 dev_close(dev);
+                                rtnl_unlock();
                                 goto out;
                         }
                 }
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 69e97a1cb1c4..8606818653f8 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -93,14 +93,14 @@
 #define SMC_insw(a, r, p, l)    insw ((unsigned long *)((a) + (r)), p, l)
 # endif
 /* check if the mac in reg is valid */
-#define SMC_GET_MAC_ADDR(addr)                                  \
+#define SMC_GET_MAC_ADDR(lp, addr)                              \
         do {                                                    \
                 unsigned int __v;                               \
-                __v = SMC_inw(ioaddr, ADDR0_REG);               \
+                __v = SMC_inw(ioaddr, ADDR0_REG(lp));           \
                 addr[0] = __v; addr[1] = __v >> 8;              \
-                __v = SMC_inw(ioaddr, ADDR1_REG);               \
+                __v = SMC_inw(ioaddr, ADDR1_REG(lp));           \
                 addr[2] = __v; addr[3] = __v >> 8;              \
-                __v = SMC_inw(ioaddr, ADDR2_REG);               \
+                __v = SMC_inw(ioaddr, ADDR2_REG(lp));           \
                 addr[4] = __v; addr[5] = __v >> 8;              \
                 if (*(u32 *)(&addr[0]) == 0xFFFFFFFF) {         \
                         random_ether_addr(addr);                \
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 07b3f77e7626..cc4bde852542 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.92"
-#define DRV_MODULE_RELDATE      "May 2, 2008"
+#define DRV_MODULE_VERSION      "3.92.1"
+#define DRV_MODULE_RELDATE      "June 9, 2008"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1295,6 +1295,21 @@ static void tg3_frob_aux_power(struct tg3 *tp)
                                      GRC_LCLCTRL_GPIO_OUTPUT0 |
                                      GRC_LCLCTRL_GPIO_OUTPUT1),
                                     100);
+                } else if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5761) {
+                        /* The 5761 non-e device swaps GPIO 0 and GPIO 2. */
+                        u32 grc_local_ctrl = GRC_LCLCTRL_GPIO_OE0 |
+                                             GRC_LCLCTRL_GPIO_OE1 |
+                                             GRC_LCLCTRL_GPIO_OE2 |
+                                             GRC_LCLCTRL_GPIO_OUTPUT0 |
+                                             GRC_LCLCTRL_GPIO_OUTPUT1 |
+                                             tp->grc_local_ctrl;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
+
+                        grc_local_ctrl |= GRC_LCLCTRL_GPIO_OUTPUT2;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
+
+                        grc_local_ctrl &= ~GRC_LCLCTRL_GPIO_OUTPUT0;
+                        tw32_wait_f(GRC_LOCAL_CTRL, grc_local_ctrl, 100);
                 } else {
                         u32 no_gpio2;
                         u32 grc_local_ctrl = 0;
@@ -3168,8 +3183,7 @@ static int tg3_setup_fiber_mii_phy(struct tg3 *tp, int force_reset)
         err |= tg3_readphy(tp, MII_BMCR, &bmcr);
 
         if ((tp->link_config.autoneg == AUTONEG_ENABLE) && !force_reset &&
-            (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT) &&
-             tp->link_config.flowctrl == tp->link_config.active_flowctrl) {
+            (tp->tg3_flags2 & TG3_FLG2_PARALLEL_DETECT)) {
                 /* do nothing, just check for link up at the end */
         } else if (tp->link_config.autoneg == AUTONEG_ENABLE) {
                 u32 adv, new_adv;
@@ -8599,7 +8613,7 @@ static int tg3_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                    (cmd->speed == SPEED_1000))
                 return -EINVAL;
         else if ((cmd->speed == SPEED_1000) &&
-                 (tp->tg3_flags2 & TG3_FLAG_10_100_ONLY))
+                 (tp->tg3_flags & TG3_FLAG_10_100_ONLY))
                 return -EINVAL;
 
         tg3_full_lock(tp, 0);
@@ -11768,6 +11782,15 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755)
                 tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_UART_SEL;
 
+        if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5761) {
+                /* Turn off the debug UART. */
+                tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_UART_SEL;
+                if (tp->tg3_flags2 & TG3_FLG2_IS_NIC)
+                        /* Keep VMain power. */
+                        tp->grc_local_ctrl |= GRC_LCLCTRL_GPIO_OE0 |
+                                              GRC_LCLCTRL_GPIO_OUTPUT0;
+        }
+
         /* Force the chip into D0. */
         err = tg3_set_power_state(tp, PCI_D0);
         if (err) {
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 5450eac9e263..4452306d5328 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -44,11 +44,15 @@ struct virtnet_info
         /* The skb we couldn't send because buffers were full. */
         struct sk_buff *last_xmit_skb;
 
+        /* If we need to free in a timer, this is it. */
+        struct timer_list xmit_free_timer;
+
         /* Number of input buffers, and max we've ever had. */
         unsigned int num, max;
 
         /* For cleaning up after transmission. */
         struct tasklet_struct tasklet;
+        bool free_in_tasklet;
 
         /* Receive & send queues. */
         struct sk_buff_head recv;
@@ -72,7 +76,7 @@ static void skb_xmit_done(struct virtqueue *svq)
         /* Suppress further interrupts. */
         svq->vq_ops->disable_cb(svq);
 
-        /* We were waiting for more output buffers. */
+        /* We were probably waiting for more output buffers. */
         netif_wake_queue(vi->dev);
 
         /* Make sure we re-xmit last_xmit_skb: if there are no more packets
@@ -94,9 +98,7 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
         BUG_ON(len > MAX_PACKET_LEN);
 
         skb_trim(skb, len);
-        skb->protocol = eth_type_trans(skb, dev);
-        pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
-                 ntohs(skb->protocol), skb->len, skb->pkt_type);
+
         dev->stats.rx_bytes += skb->len;
         dev->stats.rx_packets++;
 
@@ -106,6 +108,10 @@ static void receive_skb(struct net_device *dev, struct sk_buff *skb,
                         goto frame_err;
         }
 
+        skb->protocol = eth_type_trans(skb, dev);
+        pr_debug("Receiving skb proto 0x%04x len %i type %i\n",
+                 ntohs(skb->protocol), skb->len, skb->pkt_type);
+
         if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                 pr_debug("GSO!\n");
                 switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -238,9 +244,25 @@ static void free_old_xmit_skbs(struct virtnet_info *vi)
         }
 }
 
+/* If the virtio transport doesn't always notify us when all in-flight packets
+ * are consumed, we fall back to using this function on a timer to free them. */
+static void xmit_free(unsigned long data)
+{
+        struct virtnet_info *vi = (void *)data;
+
+        netif_tx_lock(vi->dev);
+
+        free_old_xmit_skbs(vi);
+
+        if (!skb_queue_empty(&vi->send))
+                mod_timer(&vi->xmit_free_timer, jiffies + (HZ/10));
+
+        netif_tx_unlock(vi->dev);
+}
+
 static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
 {
-        int num;
+        int num, err;
         struct scatterlist sg[2+MAX_SKB_FRAGS];
         struct virtio_net_hdr *hdr;
         const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
@@ -283,7 +305,11 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
         vnet_hdr_to_sg(sg, skb);
         num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
 
-        return vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+        err = vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
+        if (!err && !vi->free_in_tasklet)
+                mod_timer(&vi->xmit_free_timer, jiffies + (HZ/10));
+
+        return err;
 }
 
 static void xmit_tasklet(unsigned long data)
@@ -295,6 +321,8 @@ static void xmit_tasklet(unsigned long data)
                 vi->svq->vq_ops->kick(vi->svq);
                 vi->last_xmit_skb = NULL;
         }
+        if (vi->free_in_tasklet)
+                free_old_xmit_skbs(vi);
         netif_tx_unlock_bh(vi->dev);
 }
 
@@ -435,6 +463,10 @@ static int virtnet_probe(struct virtio_device *vdev)
         vi->vdev = vdev;
         vdev->priv = vi;
 
+        /* If they give us a callback when all buffers are done, we don't need
+         * the timer. */
+        vi->free_in_tasklet = virtio_has_feature(vdev,VIRTIO_F_NOTIFY_ON_EMPTY);
+
         /* We expect two virtqueues, receive then send. */
         vi->rvq = vdev->config->find_vq(vdev, 0, skb_recv_done);
         if (IS_ERR(vi->rvq)) {
@@ -454,6 +486,9 @@ static int virtnet_probe(struct virtio_device *vdev)
 
         tasklet_init(&vi->tasklet, xmit_tasklet, (unsigned long)vi);
 
+        if (!vi->free_in_tasklet)
+                setup_timer(&vi->xmit_free_timer, xmit_free, (unsigned long)vi);
+
         err = register_netdev(dev);
         if (err) {
                 pr_debug("virtio_net: registering device failed\n");
@@ -491,6 +526,9 @@ static void virtnet_remove(struct virtio_device *vdev)
         /* Stop all the virtqueues. */
         vdev->config->reset(vdev);
 
+        if (!vi->free_in_tasklet)
+                del_timer_sync(&vi->xmit_free_timer);
+
         /* Free our skbs in send and recv queues, if any. */
         while ((skb = __skb_dequeue(&vi->recv)) != NULL) {
                 kfree_skb(skb);
@@ -514,7 +552,7 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
         VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
         VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
-        VIRTIO_NET_F_HOST_ECN,
+        VIRTIO_NET_F_HOST_ECN, VIRTIO_F_NOTIFY_ON_EMPTY,
 };
 
 static struct virtio_driver virtio_net = {
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 729336774828..6e704608947c 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -1753,6 +1753,8 @@ static int ipw_radio_kill_sw(struct ipw_priv *priv, int disable_radio)
 
                 if (priv->workqueue) {
                         cancel_delayed_work(&priv->request_scan);
+                        cancel_delayed_work(&priv->request_direct_scan);
+                        cancel_delayed_work(&priv->request_passive_scan);
                         cancel_delayed_work(&priv->scan_event);
                 }
                 queue_work(priv->workqueue, &priv->down);
@@ -2005,6 +2007,8 @@ static void ipw_irq_tasklet(struct ipw_priv *priv)
                 wake_up_interruptible(&priv->wait_command_queue);
                 priv->status &= ~(STATUS_ASSOCIATED | STATUS_ASSOCIATING);
                 cancel_delayed_work(&priv->request_scan);
+                cancel_delayed_work(&priv->request_direct_scan);
+                cancel_delayed_work(&priv->request_passive_scan);
                 cancel_delayed_work(&priv->scan_event);
                 schedule_work(&priv->link_down);
                 queue_delayed_work(priv->workqueue, &priv->rf_kill, 2 * HZ);
@@ -4712,6 +4716,12 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                         priv->status &= ~STATUS_SCAN_FORCED;
 #endif                          /* CONFIG_IPW2200_MONITOR */
 
+                        /* Do queued direct scans first */
+                        if (priv->status & STATUS_DIRECT_SCAN_PENDING) {
+                                queue_delayed_work(priv->workqueue,
+                                                   &priv->request_direct_scan, 0);
+                        }
+
                         if (!(priv->status & (STATUS_ASSOCIATED |
                                               STATUS_ASSOCIATING |
                                               STATUS_ROAMING |
@@ -6267,7 +6277,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
         }
 }
 
-static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
+static int ipw_request_scan_helper(struct ipw_priv *priv, int type, int direct)
 {
         struct ipw_scan_request_ext scan;
         int err = 0, scan_type;
@@ -6278,22 +6288,31 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
 
         mutex_lock(&priv->mutex);
 
+        if (direct && (priv->direct_scan_ssid_len == 0)) {
+                IPW_DEBUG_HC("Direct scan requested but no SSID to scan for\n");
+                priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
+                goto done;
+        }
+
         if (priv->status & STATUS_SCANNING) {
-                IPW_DEBUG_HC("Concurrent scan requested.  Ignoring.\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                IPW_DEBUG_HC("Concurrent scan requested.  Queuing.\n");
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                 goto done;
         }
 
         if (!(priv->status & STATUS_SCAN_FORCED) &&
             priv->status & STATUS_SCAN_ABORTING) {
                 IPW_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                 goto done;
         }
 
         if (priv->status & STATUS_RF_KILL_MASK) {
-                IPW_DEBUG_HC("Aborting scan due to RF Kill activation\n");
-                priv->status |= STATUS_SCAN_PENDING;
+                IPW_DEBUG_HC("Queuing scan due to RF Kill activation\n");
+                priv->status |= direct ? STATUS_DIRECT_SCAN_PENDING :
+                                        STATUS_SCAN_PENDING;
                 goto done;
         }
 
@@ -6321,6 +6340,7 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
                 cpu_to_le16(20);
 
         scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
+        scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
 
 #ifdef CONFIG_IPW2200_MONITOR
         if (priv->ieee->iw_mode == IW_MODE_MONITOR) {
@@ -6360,13 +6380,23 @@ static int ipw_request_scan_helper(struct ipw_priv *priv, int type)
                         cpu_to_le16(2000);
         } else {
 #endif                          /* CONFIG_IPW2200_MONITOR */
-                /* If we are roaming, then make this a directed scan for the
-                 * current network.  Otherwise, ensure that every other scan
-                 * is a fast channel hop scan */
-                if ((priv->status & STATUS_ROAMING)
-                    || (!(priv->status & STATUS_ASSOCIATED)
-                        && (priv->config & CFG_STATIC_ESSID)
-                        && (le32_to_cpu(scan.full_scan_index) % 2))) {
+                /* Honor direct scans first, otherwise if we are roaming make
+                 * this a direct scan for the current network.  Finally,
+                 * ensure that every other scan is a fast channel hop scan */
+                if (direct) {
+                        err = ipw_send_ssid(priv, priv->direct_scan_ssid,
+                                            priv->direct_scan_ssid_len);
+                        if (err) {
+                                IPW_DEBUG_HC("Attempt to send SSID command  "
+                                             "failed\n");
+                                goto done;
+                        }
+
+                        scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
+                } else if ((priv->status & STATUS_ROAMING)
+                           || (!(priv->status & STATUS_ASSOCIATED)
+                               && (priv->config & CFG_STATIC_ESSID)
+                               && (le32_to_cpu(scan.full_scan_index) % 2))) {
                         err = ipw_send_ssid(priv, priv->essid, priv->essid_len);
                         if (err) {
                                 IPW_DEBUG_HC("Attempt to send SSID command "
@@ -6391,7 +6421,12 @@ send_request:
         }
 
         priv->status |= STATUS_SCANNING;
-        priv->status &= ~STATUS_SCAN_PENDING;
+        if (direct) {
+                priv->status &= ~STATUS_DIRECT_SCAN_PENDING;
+                priv->direct_scan_ssid_len = 0;
+        } else
+                priv->status &= ~STATUS_SCAN_PENDING;
+
         queue_delayed_work(priv->workqueue, &priv->scan_check,
                            IPW_SCAN_CHECK_WATCHDOG);
 done:
@@ -6402,15 +6437,22 @@ done:
 static void ipw_request_passive_scan(struct work_struct *work)
 {
         struct ipw_priv *priv =
-                container_of(work, struct ipw_priv, request_passive_scan);
-        ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE);
+                container_of(work, struct ipw_priv, request_passive_scan.work);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_PASSIVE, 0);
 }
 
 static void ipw_request_scan(struct work_struct *work)
 {
         struct ipw_priv *priv =
                 container_of(work, struct ipw_priv, request_scan.work);
-        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 0);
+}
+
+static void ipw_request_direct_scan(struct work_struct *work)
+{
+        struct ipw_priv *priv =
+                container_of(work, struct ipw_priv, request_direct_scan.work);
+        ipw_request_scan_helper(priv, IW_SCAN_TYPE_ACTIVE, 1);
 }
 
 static void ipw_bg_abort_scan(struct work_struct *work)
@@ -9477,99 +9519,38 @@ static int ipw_wx_get_retry(struct net_device *dev,
         return 0;
 }
 
-static int ipw_request_direct_scan(struct ipw_priv *priv, char *essid,
-                                   int essid_len)
-{
-        struct ipw_scan_request_ext scan;
-        int err = 0, scan_type;
-
-        if (!(priv->status & STATUS_INIT) ||
-            (priv->status & STATUS_EXIT_PENDING))
-                return 0;
-
-        mutex_lock(&priv->mutex);
-
-        if (priv->status & STATUS_RF_KILL_MASK) {
-                IPW_DEBUG_HC("Aborting scan due to RF kill activation\n");
-                priv->status |= STATUS_SCAN_PENDING;
-                goto done;
-        }
-
-        IPW_DEBUG_HC("starting request direct scan!\n");
-
-        if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
-                /* We should not sleep here; otherwise we will block most
-                 * of the system (for instance, we hold rtnl_lock when we
-                 * get here).
-                 */
-                err = -EAGAIN;
-                goto done;
-        }
-        memset(&scan, 0, sizeof(scan));
-
-        if (priv->config & CFG_SPEED_SCAN)
-                scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
-                    cpu_to_le16(30);
-        else
-                scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_SCAN] =
-                    cpu_to_le16(20);
-
-        scan.dwell_time[IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN] =
-            cpu_to_le16(20);
-        scan.dwell_time[IPW_SCAN_PASSIVE_FULL_DWELL_SCAN] = cpu_to_le16(120);
-        scan.dwell_time[IPW_SCAN_ACTIVE_DIRECT_SCAN] = cpu_to_le16(20);
-
-        scan.full_scan_index = cpu_to_le32(ieee80211_get_scans(priv->ieee));
-
-        err = ipw_send_ssid(priv, essid, essid_len);
-        if (err) {
-                IPW_DEBUG_HC("Attempt to send SSID command failed\n");
-                goto done;
-        }
-        scan_type = IPW_SCAN_ACTIVE_BROADCAST_AND_DIRECT_SCAN;
-
-        ipw_add_scan_channels(priv, &scan, scan_type);
-
-        err = ipw_send_scan_request_ext(priv, &scan);
-        if (err) {
-                IPW_DEBUG_HC("Sending scan command failed: %08X\n", err);
-                goto done;
-        }
-
-        priv->status |= STATUS_SCANNING;
-
-      done:
-        mutex_unlock(&priv->mutex);
-        return err;
-}
-
 static int ipw_wx_set_scan(struct net_device *dev,
                            struct iw_request_info *info,
                            union iwreq_data *wrqu, char *extra)
 {
         struct ipw_priv *priv = ieee80211_priv(dev);
         struct iw_scan_req *req = (struct iw_scan_req *)extra;
+        struct delayed_work *work = NULL;
 
         mutex_lock(&priv->mutex);
+
         priv->user_requested_scan = 1;
-        mutex_unlock(&priv->mutex);
 
         if (wrqu->data.length == sizeof(struct iw_scan_req)) {
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        ipw_request_direct_scan(priv, req->essid,
-                                                req->essid_len);
-                        return 0;
-                }
-                if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
-                        queue_work(priv->workqueue,
-                                   &priv->request_passive_scan);
-                        return 0;
+                        int len = min((int)req->essid_len,
+                                      (int)sizeof(priv->direct_scan_ssid));
+                        memcpy(priv->direct_scan_ssid, req->essid, len);
+                        priv->direct_scan_ssid_len = len;
+                        work = &priv->request_direct_scan;
+                } else if (req->scan_type == IW_SCAN_TYPE_PASSIVE) {
+                        work = &priv->request_passive_scan;
                 }
+        } else {
+                /* Normal active broadcast scan */
+                work = &priv->request_scan;
         }
 
+        mutex_unlock(&priv->mutex);
+
         IPW_DEBUG_WX("Start scan\n");
 
-        queue_delayed_work(priv->workqueue, &priv->request_scan, 0);
+        queue_delayed_work(priv->workqueue, work, 0);
 
         return 0;
 }
@@ -10731,6 +10712,8 @@ static void ipw_link_up(struct ipw_priv *priv)
         }
 
         cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
         cancel_delayed_work(&priv->scan_event);
         ipw_reset_stats(priv);
         /* Ensure the rate is updated immediately */
@@ -10761,6 +10744,8 @@ static void ipw_link_down(struct ipw_priv *priv)
 
         /* Cancel any queued work ... */
         cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
         cancel_delayed_work(&priv->adhoc_check);
         cancel_delayed_work(&priv->gather_stats);
 
@@ -10800,8 +10785,9 @@ static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
         INIT_WORK(&priv->up, ipw_bg_up);
         INIT_WORK(&priv->down, ipw_bg_down);
         INIT_DELAYED_WORK(&priv->request_scan, ipw_request_scan);
+        INIT_DELAYED_WORK(&priv->request_direct_scan, ipw_request_direct_scan);
+        INIT_DELAYED_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
         INIT_DELAYED_WORK(&priv->scan_event, ipw_scan_event);
-        INIT_WORK(&priv->request_passive_scan, ipw_request_passive_scan);
         INIT_DELAYED_WORK(&priv->gather_stats, ipw_bg_gather_stats);
         INIT_WORK(&priv->abort_scan, ipw_bg_abort_scan);
         INIT_WORK(&priv->roam, ipw_bg_roam);
@@ -11835,6 +11821,8 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
         cancel_delayed_work(&priv->adhoc_check);
         cancel_delayed_work(&priv->gather_stats);
         cancel_delayed_work(&priv->request_scan);
+        cancel_delayed_work(&priv->request_direct_scan);
+        cancel_delayed_work(&priv->request_passive_scan);
         cancel_delayed_work(&priv->scan_event);
         cancel_delayed_work(&priv->rf_kill);
         cancel_delayed_work(&priv->scan_check);
diff --git a/drivers/net/wireless/ipw2200.h b/drivers/net/wireless/ipw2200.h
index cd3295b66dd6..d4ab28b73b32 100644
--- a/drivers/net/wireless/ipw2200.h
+++ b/drivers/net/wireless/ipw2200.h
@@ -1037,6 +1037,7 @@ struct ipw_cmd {	 /* XXX */
 #define STATUS_DISASSOC_PENDING (1<<12)
 #define STATUS_STATE_PENDING    (1<<13)
 
+#define STATUS_DIRECT_SCAN_PENDING (1<<19)
 #define STATUS_SCAN_PENDING     (1<<20)
 #define STATUS_SCANNING         (1<<21)
 #define STATUS_SCAN_ABORTING    (1<<22)
@@ -1292,6 +1293,8 @@ struct ipw_priv {
         struct iw_public_data wireless_data;
 
         int user_requested_scan;
+        u8 direct_scan_ssid[IW_ESSID_MAX_SIZE];
+        u8 direct_scan_ssid_len;
 
         struct workqueue_struct *workqueue;
 
@@ -1301,8 +1304,9 @@ struct ipw_priv {
         struct work_struct system_config;
         struct work_struct rx_replenish;
         struct delayed_work request_scan;
+        struct delayed_work request_direct_scan;
+        struct delayed_work request_passive_scan;
         struct delayed_work scan_event;
-        struct work_struct request_passive_scan;
         struct work_struct adapter_restart;
         struct delayed_work rf_kill;
         struct work_struct up;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index d200d08fb086..8b1528e52d43 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -229,14 +229,15 @@ static int iwl3945_led_register_led(struct iwl3945_priv *priv,
         led->led_dev.brightness_set = iwl3945_led_brightness_set;
         led->led_dev.default_trigger = trigger;
 
+        led->priv = priv;
+        led->type = type;
+
         ret = led_classdev_register(device, &led->led_dev);
         if (ret) {
                 IWL_ERROR("Error: failed to register led handler.\n");
                 return ret;
         }
 
-        led->priv = priv;
-        led->type = type;
         led->registered = 1;
 
         if (set_led && led->led_on)
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 6328b9593877..8124fd9b1353 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1842,6 +1842,9 @@ static void lbs_send_confirmsleep(struct lbs_private *priv)
 
         spin_lock_irqsave(&priv->driver_lock, flags);
 
+        /* We don't get a response on the sleep-confirmation */
+        priv->dnld_sent = DNLD_RES_RECEIVED;
+
         /* If nothing to do, go back to sleep (?) */
         if (!__kfifo_len(priv->event_fifo) && !priv->resp_len[priv->resp_idx])
                 priv->psstate = PS_STATE_SLEEP;
@@ -1904,12 +1907,12 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv)
 
         lbs_deb_enter(LBS_DEB_HOST);
 
+        spin_lock_irqsave(&priv->driver_lock, flags);
         if (priv->dnld_sent) {
                 allowed = 0;
                 lbs_deb_host("dnld_sent was set\n");
         }
 
-        spin_lock_irqsave(&priv->driver_lock, flags);
         /* In-progress command? */
         if (priv->cur_cmd) {
                 allowed = 0;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index e1f066068590..acfc4bfcc262 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -732,8 +732,8 @@ static int lbs_thread(void *data)
                 lbs_deb_thread("4: currenttxskb %p, dnld_sent %d\n",
                        priv->currenttxskb, priv->dnld_sent);
 
-                spin_lock_irq(&priv->driver_lock);
                 /* Process any pending command response */
+                spin_lock_irq(&priv->driver_lock);
                 resp_idx = priv->resp_idx;
                 if (priv->resp_len[resp_idx]) {
                         spin_unlock_irq(&priv->driver_lock);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 6424e5a2c83d..418606ac1c3b 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -719,7 +719,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
         fc = le16_to_cpu(*((__le16 *) buffer));
 
         is_qos = ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
-                 ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_QOS_DATA);
+                 (fc & IEEE80211_STYPE_QOS_DATA);
         is_4addr = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
                    (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
         need_padding = is_qos ^ is_4addr;
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 0201c8adfda7..46c791adb894 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -50,15 +50,17 @@ static int irq_flags(int triggering, int polarity, int shareable)
                         flags = IORESOURCE_IRQ_HIGHEDGE;
         }
 
-        if (shareable)
+        if (shareable == ACPI_SHARED)
                 flags |= IORESOURCE_IRQ_SHAREABLE;
 
         return flags;
 }
 
-static void decode_irq_flags(int flag, int *triggering, int *polarity)
+static void decode_irq_flags(struct pnp_dev *dev, int flags, int *triggering,
+                             int *polarity, int *shareable)
 {
-        switch (flag) {
+        switch (flags & (IORESOURCE_IRQ_LOWLEVEL | IORESOURCE_IRQ_HIGHLEVEL |
+                         IORESOURCE_IRQ_LOWEDGE  | IORESOURCE_IRQ_HIGHEDGE)) {
         case IORESOURCE_IRQ_LOWLEVEL:
                 *triggering = ACPI_LEVEL_SENSITIVE;
                 *polarity = ACPI_ACTIVE_LOW;
@@ -75,7 +77,18 @@ static void decode_irq_flags(int flag, int *triggering, int *polarity)
                 *triggering = ACPI_EDGE_SENSITIVE;
                 *polarity = ACPI_ACTIVE_HIGH;
                 break;
+        default:
+                dev_err(&dev->dev, "can't encode invalid IRQ mode %#x\n",
+                        flags);
+                *triggering = ACPI_EDGE_SENSITIVE;
+                *polarity = ACPI_ACTIVE_HIGH;
+                break;
         }
+
+        if (flags & IORESOURCE_IRQ_SHAREABLE)
+                *shareable = ACPI_SHARED;
+        else
+                *shareable = ACPI_EXCLUSIVE;
 }
 
 static void pnpacpi_parse_allocated_irqresource(struct pnp_dev *dev,
@@ -742,6 +755,9 @@ static acpi_status pnpacpi_type_resources(struct acpi_resource *res, void *data)
         if (pnpacpi_supported_resource(res)) {
                 (*resource)->type = res->type;
                 (*resource)->length = sizeof(struct acpi_resource);
+                if (res->type == ACPI_RESOURCE_TYPE_IRQ)
+                        (*resource)->data.irq.descriptor_length =
+                                        res->data.irq.descriptor_length;
                 (*resource)++;
         }
 
@@ -788,22 +804,21 @@ static void pnpacpi_encode_irq(struct pnp_dev *dev,
                                struct resource *p)
 {
         struct acpi_resource_irq *irq = &resource->data.irq;
-        int triggering, polarity;
+        int triggering, polarity, shareable;
 
-        decode_irq_flags(p->flags & IORESOURCE_BITS, &triggering, &polarity);
+        decode_irq_flags(dev, p->flags, &triggering, &polarity, &shareable);
         irq->triggering = triggering;
         irq->polarity = polarity;
-        if (triggering == ACPI_EDGE_SENSITIVE)
-                irq->sharable = ACPI_EXCLUSIVE;
-        else
-                irq->sharable = ACPI_SHARED;
+        irq->sharable = shareable;
         irq->interrupt_count = 1;
         irq->interrupts[0] = p->start;
 
-        dev_dbg(&dev->dev, "  encode irq %d %s %s %s\n", (int) p->start,
+        dev_dbg(&dev->dev, "  encode irq %d %s %s %s (%d-byte descriptor)\n",
+                (int) p->start,
                 triggering == ACPI_LEVEL_SENSITIVE ? "level" : "edge",
                 polarity == ACPI_ACTIVE_LOW ? "low" : "high",
-                irq->sharable == ACPI_SHARED ? "shared" : "exclusive");
+                irq->sharable == ACPI_SHARED ? "shared" : "exclusive",
+                irq->descriptor_length);
 }
 
 static void pnpacpi_encode_ext_irq(struct pnp_dev *dev,
@@ -811,16 +826,13 @@ static void pnpacpi_encode_ext_irq(struct pnp_dev *dev,
                                    struct resource *p)
 {
         struct acpi_resource_extended_irq *extended_irq = &resource->data.extended_irq;
-        int triggering, polarity;
+        int triggering, polarity, shareable;
 
-        decode_irq_flags(p->flags & IORESOURCE_BITS, &triggering, &polarity);
+        decode_irq_flags(dev, p->flags, &triggering, &polarity, &shareable);
         extended_irq->producer_consumer = ACPI_CONSUMER;
         extended_irq->triggering = triggering;
         extended_irq->polarity = polarity;
-        if (triggering == ACPI_EDGE_SENSITIVE)
-                extended_irq->sharable = ACPI_EXCLUSIVE;
-        else
-                extended_irq->sharable = ACPI_SHARED;
+        extended_irq->sharable = shareable;
         extended_irq->interrupt_count = 1;
         extended_irq->interrupts[0] = p->start;
 
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 436bf1f6d4a6..9a71dae223e8 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -290,9 +290,6 @@ int qeth_set_large_send(struct qeth_card *card,
                         card->dev->features |= NETIF_F_TSO | NETIF_F_SG |
                                                 NETIF_F_HW_CSUM;
                 } else {
-                        PRINT_WARN("TSO not supported on %s. "
-                                   "large_send set to 'no'.\n",
-                                   card->dev->name);
                         card->dev->features &= ~(NETIF_F_TSO | NETIF_F_SG |
                                                 NETIF_F_HW_CSUM);
                         card->options.large_send = QETH_LARGE_SEND_NO;
@@ -1407,12 +1404,6 @@ static void qeth_init_func_level(struct qeth_card *card)
         }
 }
 
-static inline __u16 qeth_raw_devno_from_bus_id(char *id)
-{
-        id += (strlen(id) - 4);
-        return (__u16) simple_strtoul(id, &id, 16);
-}
-
 static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
                 void (*idx_reply_cb)(struct qeth_channel *,
                         struct qeth_cmd_buffer *))
@@ -1439,7 +1430,7 @@ static int qeth_idx_activate_get_answer(struct qeth_channel *channel,
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
 
         if (rc) {
-                PRINT_ERR("Error2 in activating channel rc=%d\n", rc);
+                QETH_DBF_MESSAGE(2, "Error2 in activating channel rc=%d\n", rc);
                 QETH_DBF_TEXT_(SETUP, 2, "2err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
                 wake_up(&card->wait_q);
@@ -1468,6 +1459,7 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
         __u16 temp;
         __u8 tmp;
         int rc;
+        struct ccw_dev_id temp_devid;
 
         card = CARD_FROM_CDEV(channel->ccwdev);
 
@@ -1494,8 +1486,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
                &card->token.issuer_rm_w, QETH_MPC_TOKEN_LENGTH);
         memcpy(QETH_IDX_ACT_FUNC_LEVEL(iob->data),
                &card->info.func_level, sizeof(__u16));
-        temp = qeth_raw_devno_from_bus_id(CARD_DDEV_ID(card));
-        memcpy(QETH_IDX_ACT_QDIO_DEV_CUA(iob->data), &temp, 2);
+        ccw_device_get_id(CARD_DDEV(card), &temp_devid);
+        memcpy(QETH_IDX_ACT_QDIO_DEV_CUA(iob->data), &temp_devid.devno, 2);
         temp = (card->info.cula << 8) + card->info.unit_addr2;
         memcpy(QETH_IDX_ACT_QDIO_DEV_REALADDR(iob->data), &temp, 2);
 
@@ -1508,7 +1500,8 @@ static int qeth_idx_activate_channel(struct qeth_channel *channel,
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
 
         if (rc) {
-                PRINT_ERR("Error1 in activating channel. rc=%d\n", rc);
+                QETH_DBF_MESSAGE(2, "Error1 in activating channel. rc=%d\n",
+                        rc);
                 QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                 atomic_set(&channel->irq_pending, 0);
                 wake_up(&card->wait_q);
@@ -1658,7 +1651,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
 
         reply = qeth_alloc_reply(card);
         if (!reply) {
-                PRINT_WARN("Could not alloc qeth_reply!\n");
                 return -ENOMEM;
         }
         reply->callback = reply_cb;
@@ -2612,15 +2604,9 @@ void qeth_queue_input_buffer(struct qeth_card *card, int index)
                 if (newcount < count) {
                         /* we are in memory shortage so we switch back to
                            traditional skb allocation and drop packages */
-                        if (!atomic_read(&card->force_alloc_skb) &&
-                            net_ratelimit())
-                                PRINT_WARN("Switch to alloc skb\n");
                         atomic_set(&card->force_alloc_skb, 3);
                         count = newcount;
                 } else {
-                        if ((atomic_read(&card->force_alloc_skb) == 1) &&
-                            net_ratelimit())
-                                PRINT_WARN("Switch to sg\n");
                         atomic_add_unless(&card->force_alloc_skb, -1, 0);
                 }
 
@@ -3034,7 +3020,7 @@ int qeth_get_elements_no(struct qeth_card *card, void *hdr,
                 elements_needed = 1 + (((((unsigned long) hdr) % PAGE_SIZE)
                         + skb->len) >> PAGE_SHIFT);
         if ((elements_needed + elems) > QETH_MAX_BUFFER_ELEMENTS(card)) {
-                PRINT_ERR("Invalid size of IP packet "
+                QETH_DBF_MESSAGE(2, "Invalid size of IP packet "
                         "(Number=%d / Length=%d). Discarded.\n",
                         (elements_needed+elems), skb->len);
                 return 0;
@@ -3247,8 +3233,6 @@ int qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                          * free buffers) to handle eddp context */
                         if (qeth_eddp_check_buffers_for_context(queue, ctx)
                                 < 0) {
-                                if (net_ratelimit())
-                                        PRINT_WARN("eddp tx_dropped 1\n");
                                 rc = -EBUSY;
                                 goto out;
                         }
@@ -3260,7 +3244,6 @@ int qeth_do_send_packet(struct qeth_card *card, struct qeth_qdio_out_q *queue,
                 tmp = qeth_eddp_fill_buffer(queue, ctx,
                                                 queue->next_buf_to_fill);
                 if (tmp < 0) {
-                        PRINT_ERR("eddp tx_dropped 2\n");
                         rc = -EBUSY;
                         goto out;
                 }
@@ -3602,8 +3585,6 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
 
         if ((!qeth_adp_supported(card, IPA_SETADP_SET_SNMP_CONTROL)) &&
             (!card->options.layer2)) {
-                PRINT_WARN("SNMP Query MIBS not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                 return -EOPNOTSUPP;
         }
         /* skip 4 bytes (data_len struct member) to get req_len */
@@ -3634,7 +3615,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
         rc = qeth_send_ipa_snmp_cmd(card, iob, QETH_SETADP_BASE_LEN + req_len,
                                     qeth_snmp_command_cb, (void *)&qinfo);
         if (rc)
-                PRINT_WARN("SNMP command failed on %s: (0x%x)\n",
+                QETH_DBF_MESSAGE(2, "SNMP command failed on %s: (0x%x)\n",
                            QETH_CARD_IFNAME(card), rc);
         else {
                 if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
@@ -3807,8 +3788,8 @@ retry:
         if (mpno)
                 mpno = min(mpno - 1, QETH_MAX_PORTNO);
         if (card->info.portno > mpno) {
-                PRINT_ERR("Device %s does not offer port number %d \n.",
-                        CARD_BUS_ID(card), card->info.portno);
+                QETH_DBF_MESSAGE(2, "Device %s does not offer port number %d"
+                        "\n.", CARD_BUS_ID(card), card->info.portno);
                 rc = -ENODEV;
                 goto out;
         }
@@ -3985,8 +3966,6 @@ struct sk_buff *qeth_core_get_next_skb(struct qeth_card *card,
         return skb;
 no_mem:
         if (net_ratelimit()) {
-                PRINT_WARN("No memory for packet received on %s.\n",
-                           QETH_CARD_IFNAME(card));
                 QETH_DBF_TEXT(TRACE, 2, "noskbmem");
                 QETH_DBF_TEXT_(TRACE, 2, "%s", CARD_BUS_ID(card));
         }
@@ -4004,15 +3983,17 @@ static void qeth_unregister_dbf_views(void)
         }
 }
 
-void qeth_dbf_longtext(enum qeth_dbf_names dbf_nix, int level, char *text, ...)
+void qeth_dbf_longtext(enum qeth_dbf_names dbf_nix, int level, char *fmt, ...)
 {
         char dbf_txt_buf[32];
+        va_list args;
 
         if (level > (qeth_dbf[dbf_nix].id)->level)
                 return;
-        snprintf(dbf_txt_buf, sizeof(dbf_txt_buf), text);
+        va_start(args, fmt);
+        vsnprintf(dbf_txt_buf, sizeof(dbf_txt_buf), fmt, args);
+        va_end(args);
         debug_text_event(qeth_dbf[dbf_nix].id, level, dbf_txt_buf);
-        
 }
 EXPORT_SYMBOL_GPL(qeth_dbf_longtext);
 
diff --git a/drivers/s390/net/qeth_core_offl.c b/drivers/s390/net/qeth_core_offl.c
index 822df8362856..452874e89740 100644
--- a/drivers/s390/net/qeth_core_offl.c
+++ b/drivers/s390/net/qeth_core_offl.c
@@ -122,8 +122,8 @@ int qeth_eddp_fill_buffer(struct qeth_qdio_out_q *queue,
                         if (element == 0)
                                 return -EBUSY;
                         else {
-                                PRINT_WARN("could only partially fill eddp "
-                                           "buffer!\n");
+                                QETH_DBF_MESSAGE(2, "could only partially fill"
+                                        "eddp buffer!\n");
                                 goto out;
                         }
                 }
@@ -143,8 +143,6 @@ int qeth_eddp_fill_buffer(struct qeth_qdio_out_q *queue,
                 if (must_refcnt) {
                         must_refcnt = 0;
                         if (qeth_eddp_buf_ref_context(buf, ctx)) {
-                                PRINT_WARN("no memory to create eddp context "
-                                           "reference\n");
                                 goto out_check;
                         }
                 }
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index 08a50f057284..c26e842ad905 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -129,7 +129,6 @@ static ssize_t qeth_dev_portno_store(struct device *dev,
 
         portno = simple_strtoul(buf, &tmp, 16);
         if (portno > QETH_MAX_PORTNO) {
-                PRINT_WARN("portno 0x%X is out of range\n", portno);
                 return -EINVAL;
         }
 
@@ -223,8 +222,6 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev,
          * if though we have to permit priority queueing
          */
         if (card->qdio.no_out_queues == 1) {
-                PRINT_WARN("Priority queueing disabled due "
-                           "to hardware limitations!\n");
                 card->qdio.do_prio_queueing = QETH_PRIOQ_DEFAULT;
                 return -EPERM;
         }
@@ -250,7 +247,6 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev,
                 card->qdio.do_prio_queueing = QETH_NO_PRIO_QUEUEING;
                 card->qdio.default_out_queue = QETH_DEFAULT_QUEUE;
         } else {
-                PRINT_WARN("Unknown queueing type '%s'\n", tmp);
                 return -EINVAL;
         }
         return count;
@@ -291,9 +287,6 @@ static ssize_t qeth_dev_bufcnt_store(struct device *dev,
                 ((cnt > QETH_IN_BUF_COUNT_MAX) ? QETH_IN_BUF_COUNT_MAX : cnt);
         if (old_cnt != cnt) {
                 rc = qeth_realloc_buffer_pool(card, cnt);
-                if (rc)
-                        PRINT_WARN("Error (%d) while setting "
-                                   "buffer count.\n", rc);
         }
         return count;
 }
@@ -355,7 +348,6 @@ static ssize_t qeth_dev_performance_stats_store(struct device *dev,
                 card->perf_stats.initial_rx_packets = card->stats.rx_packets;
                 card->perf_stats.initial_tx_packets = card->stats.tx_packets;
         } else {
-                PRINT_WARN("performance_stats: write 0 or 1 to this file!\n");
                 return -EINVAL;
         }
         return count;
@@ -399,7 +391,6 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
                 newdis = QETH_DISCIPLINE_LAYER2;
                 break;
         default:
-                PRINT_WARN("layer2: write 0 or 1 to this file!\n");
                 return -EINVAL;
         }
 
@@ -463,7 +454,6 @@ static ssize_t qeth_dev_large_send_store(struct device *dev,
         } else if (!strcmp(tmp, "TSO")) {
                 type = QETH_LARGE_SEND_TSO;
         } else {
-                PRINT_WARN("large_send: invalid mode %s!\n", tmp);
                 return -EINVAL;
         }
         if (card->options.large_send == type)
@@ -503,8 +493,6 @@ static ssize_t qeth_dev_blkt_store(struct qeth_card *card,
         if (i <= max_value) {
                 *value = i;
         } else {
-                PRINT_WARN("blkt total time: write values between"
-                           " 0 and %d to this file!\n", max_value);
                 return -EINVAL;
         }
         return count;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 86ec50ddae13..f682f7b14480 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -101,19 +101,16 @@ static struct net_device *qeth_l2_netdev_by_devno(unsigned char *read_dev_no)
 {
         struct qeth_card *card;
         struct net_device *ndev;
-        unsigned char *readno;
-        __u16 temp_dev_no, card_dev_no;
-        char *endp;
+        __u16 temp_dev_no;
         unsigned long flags;
+        struct ccw_dev_id read_devid;
 
         ndev = NULL;
         memcpy(&temp_dev_no, read_dev_no, 2);
         read_lock_irqsave(&qeth_core_card_list.rwlock, flags);
         list_for_each_entry(card, &qeth_core_card_list.list, list) {
-                readno = CARD_RDEV_ID(card);
-                readno += (strlen(readno) - 4);
-                card_dev_no = simple_strtoul(readno, &endp, 16);
-                if (card_dev_no == temp_dev_no) {
+                ccw_device_get_id(CARD_RDEV(card), &read_devid);
+                if (read_devid.devno == temp_dev_no) {
                         ndev = card->dev;
                         break;
                 }
@@ -134,14 +131,14 @@ static int qeth_l2_send_setgroupmac_cb(struct qeth_card *card,
         mac = &cmd->data.setdelmac.mac[0];
         /* MAC already registered, needed in couple/uncouple case */
         if (cmd->hdr.return_code == 0x2005) {
-                PRINT_WARN("Group MAC %02x:%02x:%02x:%02x:%02x:%02x " \
+                QETH_DBF_MESSAGE(2, "Group MAC %02x:%02x:%02x:%02x:%02x:%02x "
                           "already existing on %s \n",
                           mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
                           QETH_CARD_IFNAME(card));
                 cmd->hdr.return_code = 0;
         }
         if (cmd->hdr.return_code)
-                PRINT_ERR("Could not set group MAC " \
+                QETH_DBF_MESSAGE(2, "Could not set group MAC "
                           "%02x:%02x:%02x:%02x:%02x:%02x on %s: %x\n",
                           mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
                           QETH_CARD_IFNAME(card), cmd->hdr.return_code);
@@ -166,7 +163,7 @@ static int qeth_l2_send_delgroupmac_cb(struct qeth_card *card,
         cmd = (struct qeth_ipa_cmd *) data;
         mac = &cmd->data.setdelmac.mac[0];
         if (cmd->hdr.return_code)
-                PRINT_ERR("Could not delete group MAC " \
+                QETH_DBF_MESSAGE(2, "Could not delete group MAC "
                           "%02x:%02x:%02x:%02x:%02x:%02x on %s: %x\n",
                           mac[0], mac[1], mac[2], mac[3], mac[4], mac[5],
                           QETH_CARD_IFNAME(card), cmd->hdr.return_code);
@@ -186,10 +183,8 @@ static void qeth_l2_add_mc(struct qeth_card *card, __u8 *mac)
 
         mc = kmalloc(sizeof(struct qeth_mc_mac), GFP_ATOMIC);
 
-        if (!mc) {
-                PRINT_ERR("no mem vor mc mac address\n");
+        if (!mc)
                 return;
-        }
 
         memcpy(mc->mc_addr, mac, OSA_ADDR_LEN);
         mc->mc_addrlen = OSA_ADDR_LEN;
@@ -280,7 +275,7 @@ static int qeth_l2_send_setdelvlan_cb(struct qeth_card *card,
         QETH_DBF_TEXT(TRACE, 2, "L2sdvcb");
         cmd = (struct qeth_ipa_cmd *) data;
         if (cmd->hdr.return_code) {
-                PRINT_ERR("Error in processing VLAN %i on %s: 0x%x. "
+                QETH_DBF_MESSAGE(2, "Error in processing VLAN %i on %s: 0x%x. "
                           "Continuing\n", cmd->data.setdelvlan.vlan_id,
                           QETH_CARD_IFNAME(card), cmd->hdr.return_code);
                 QETH_DBF_TEXT_(TRACE, 2, "L2VL%4x", cmd->hdr.command);
@@ -333,8 +328,6 @@ static void qeth_l2_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
                 spin_lock_bh(&card->vlanlock);
                 list_add_tail(&id->list, &card->vid_list);
                 spin_unlock_bh(&card->vlanlock);
-        } else {
-                PRINT_ERR("no memory for vid\n");
         }
 }
 
@@ -550,16 +543,15 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
 
         rc = qeth_query_setadapterparms(card);
         if (rc) {
-                PRINT_WARN("could not query adapter parameters on device %s: "
-                           "x%x\n", CARD_BUS_ID(card), rc);
+                QETH_DBF_MESSAGE(2, "could not query adapter parameters on "
+                        "device %s: x%x\n", CARD_BUS_ID(card), rc);
         }
 
         if (card->info.guestlan) {
                 rc = qeth_setadpparms_change_macaddr(card);
                 if (rc) {
-                        PRINT_WARN("couldn't get MAC address on "
-                           "device %s: x%x\n",
-                           CARD_BUS_ID(card), rc);
+                        QETH_DBF_MESSAGE(2, "couldn't get MAC address on "
+                                "device %s: x%x\n", CARD_BUS_ID(card), rc);
                         QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc);
                         return rc;
                 }
@@ -585,8 +577,6 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
         }
 
         if (card->info.type == QETH_CARD_TYPE_OSN) {
-                PRINT_WARN("Setting MAC address on %s is not supported.\n",
-                           dev->name);
                 QETH_DBF_TEXT(TRACE, 3, "setmcOSN");
                 return -EOPNOTSUPP;
         }
@@ -666,7 +656,7 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 ctx = qeth_eddp_create_context(card, new_skb, hdr,
                                                 skb->sk->sk_protocol);
                 if (ctx == NULL) {
-                        PRINT_WARN("could not create eddp context\n");
+                        QETH_DBF_MESSAGE(2, "could not create eddp context\n");
                         goto tx_drop;
                 }
         } else {
@@ -731,6 +721,7 @@ tx_drop:
         if ((new_skb != skb) && new_skb)
                 dev_kfree_skb_any(new_skb);
         dev_kfree_skb_any(skb);
+        netif_wake_queue(dev);
         return NETDEV_TX_OK;
 }
 
@@ -1155,7 +1146,7 @@ static int qeth_osn_send_control_data(struct qeth_card *card, int len,
                               (addr_t) iob, 0, 0);
         spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
         if (rc) {
-                PRINT_WARN("qeth_osn_send_control_data: "
+                QETH_DBF_MESSAGE(2, "qeth_osn_send_control_data: "
                            "ccw_device_start rc = %i\n", rc);
                 QETH_DBF_TEXT_(TRACE, 2, " err%d", rc);
                 qeth_release_buffer(iob->channel, iob);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 94a8ead64ed4..999552c83bbe 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -311,7 +311,6 @@ static struct qeth_ipaddr *qeth_l3_get_addr_buffer(
 
         addr = kzalloc(sizeof(struct qeth_ipaddr), GFP_ATOMIC);
         if (addr == NULL) {
-                PRINT_WARN("Not enough memory to add address\n");
                 return NULL;
         }
         addr->type = QETH_IP_TYPE_NORMAL;
@@ -649,15 +648,6 @@ static void qeth_l3_correct_routing_type(struct qeth_card *card,
                 }
         }
 out_inval:
-        PRINT_WARN("Routing type '%s' not supported for interface %s.\n"
-                   "Router status set to 'no router'.\n",
-                   ((*type == PRIMARY_ROUTER)? "primary router" :
-                    (*type == SECONDARY_ROUTER)? "secondary router" :
-                    (*type == PRIMARY_CONNECTOR)? "primary connector" :
-                    (*type == SECONDARY_CONNECTOR)? "secondary connector" :
-                    (*type == MULTICAST_ROUTER)? "multicast router" :
-                    "unknown"),
-                   card->dev->name);
         *type = NO_ROUTER;
 }
 
@@ -674,9 +664,9 @@ int qeth_l3_setrouting_v4(struct qeth_card *card)
                                   QETH_PROT_IPV4);
         if (rc) {
                 card->options.route4.type = NO_ROUTER;
-                PRINT_WARN("Error (0x%04x) while setting routing type on %s. "
-                           "Type set to 'no router'.\n",
-                           rc, QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
+                        " on %s. Type set to 'no router'.\n", rc,
+                        QETH_CARD_IFNAME(card));
         }
         return rc;
 }
@@ -697,9 +687,9 @@ int qeth_l3_setrouting_v6(struct qeth_card *card)
                                   QETH_PROT_IPV6);
         if (rc) {
                 card->options.route6.type = NO_ROUTER;
-                PRINT_WARN("Error (0x%04x) while setting routing type on %s. "
-                           "Type set to 'no router'.\n",
-                           rc, QETH_CARD_IFNAME(card));
+                QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
+                        " on %s. Type set to 'no router'.\n", rc,
+                        QETH_CARD_IFNAME(card));
         }
 #endif
         return rc;
@@ -737,7 +727,6 @@ int qeth_l3_add_ipato_entry(struct qeth_card *card,
                 if (!memcmp(ipatoe->addr, new->addr,
                             (ipatoe->proto == QETH_PROT_IPV4)? 4:16) &&
                     (ipatoe->mask_bits == new->mask_bits)) {
-                        PRINT_WARN("ipato entry already exists!\n");
                         rc = -EEXIST;
                         break;
                 }
@@ -802,7 +791,6 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
                 rc = -EEXIST;
         spin_unlock_irqrestore(&card->ip_lock, flags);
         if (rc) {
-                PRINT_WARN("Cannot add VIPA. Address already exists!\n");
                 return rc;
         }
         if (!qeth_l3_add_ip(card, ipaddr))
@@ -867,7 +855,6 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
                 rc = -EEXIST;
         spin_unlock_irqrestore(&card->ip_lock, flags);
         if (rc) {
-                PRINT_WARN("Cannot add RXIP. Address already exists!\n");
                 return rc;
         }
         if (!qeth_l3_add_ip(card, ipaddr))
@@ -1020,23 +1007,23 @@ static int qeth_l3_setadapter_hstr(struct qeth_card *card)
                                         IPA_SETADP_SET_BROADCAST_MODE,
                                         card->options.broadcast_mode);
                 if (rc)
-                        PRINT_WARN("couldn't set broadcast mode on "
+                        QETH_DBF_MESSAGE(2, "couldn't set broadcast mode on "
                                    "device %s: x%x\n",
                                    CARD_BUS_ID(card), rc);
                 rc = qeth_l3_send_setadp_mode(card,
                                         IPA_SETADP_ALTER_MAC_ADDRESS,
                                         card->options.macaddr_mode);
                 if (rc)
-                        PRINT_WARN("couldn't set macaddr mode on "
+                        QETH_DBF_MESSAGE(2, "couldn't set macaddr mode on "
                                    "device %s: x%x\n", CARD_BUS_ID(card), rc);
                 return rc;
         }
         if (card->options.broadcast_mode == QETH_TR_BROADCAST_LOCAL)
-                PRINT_WARN("set adapter parameters not available "
+                QETH_DBF_MESSAGE(2, "set adapter parameters not available "
                            "to set broadcast mode, using ALLRINGS "
                            "on device %s:\n", CARD_BUS_ID(card));
         if (card->options.macaddr_mode == QETH_TR_MACADDR_CANONICAL)
-                PRINT_WARN("set adapter parameters not available "
+                QETH_DBF_MESSAGE(2, "set adapter parameters not available "
                            "to set macaddr mode, using NONCANONICAL "
                            "on device %s:\n", CARD_BUS_ID(card));
         return 0;
@@ -2070,7 +2057,7 @@ static struct qeth_card *qeth_l3_get_card_from_dev(struct net_device *dev)
                 card = netdev_priv(dev);
         else if (rc == QETH_VLAN_CARD)
                 card = netdev_priv(vlan_dev_info(dev)->real_dev);
-        if (card->options.layer2)
+        if (card && card->options.layer2)
                 card = NULL;
         QETH_DBF_TEXT_(TRACE, 4, "%d", rc);
         return card ;
@@ -2182,8 +2169,6 @@ static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
         if (card->info.guestlan)
                 return -EOPNOTSUPP;
         if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                 return -EOPNOTSUPP;
         }
         rc = qeth_l3_send_simple_setassparms(card, IPA_ARP_PROCESSING,
@@ -2191,8 +2176,8 @@ static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
                                           no_entries);
         if (rc) {
                 tmp = rc;
-                PRINT_WARN("Could not set number of ARP entries on %s: "
-                        "%s (0x%x/%d)\n", QETH_CARD_IFNAME(card),
+                QETH_DBF_MESSAGE(2, "Could not set number of ARP entries on "
+                        "%s: %s (0x%x/%d)\n", QETH_CARD_IFNAME(card),
                         qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
         }
         return rc;
@@ -2260,9 +2245,6 @@ static int qeth_l3_arp_query_cb(struct qeth_card *card,
                         qdata->no_entries * uentry_size){
                 QETH_DBF_TEXT_(TRACE, 4, "qaer3%i", -ENOMEM);
                 cmd->hdr.return_code = -ENOMEM;
-                PRINT_WARN("query ARP user space buffer is too small for "
-                           "the returned number of ARP entries. "
-                           "Aborting query!\n");
                 goto out_error;
         }
         QETH_DBF_TEXT_(TRACE, 4, "anore%i",
@@ -2324,8 +2306,6 @@ static int qeth_l3_arp_query(struct qeth_card *card, char __user *udata)
 
         if (!qeth_is_supported(card,/*IPA_QUERY_ARP_ADDR_INFO*/
                                IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                 return -EOPNOTSUPP;
         }
         /* get size of userspace buffer and mask_bits -> 6 bytes */
@@ -2344,7 +2324,7 @@ static int qeth_l3_arp_query(struct qeth_card *card, char __user *udata)
                                    qeth_l3_arp_query_cb, (void *)&qinfo);
         if (rc) {
                 tmp = rc;
-                PRINT_WARN("Error while querying ARP cache on %s: %s "
+                QETH_DBF_MESSAGE(2, "Error while querying ARP cache on %s: %s "
                         "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
                         qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
                 if (copy_to_user(udata, qinfo.udata, 4))
@@ -2375,8 +2355,6 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
         if (card->info.guestlan)
                 return -EOPNOTSUPP;
         if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                 return -EOPNOTSUPP;
         }
 
@@ -2391,10 +2369,9 @@ static int qeth_l3_arp_add_entry(struct qeth_card *card,
         if (rc) {
                 tmp = rc;
                 qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
-                PRINT_WARN("Could not add ARP entry for address %s on %s: "
-                           "%s (0x%x/%d)\n",
-                           buf, QETH_CARD_IFNAME(card),
-                           qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+                QETH_DBF_MESSAGE(2, "Could not add ARP entry for address %s "
+                        "on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
+                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
         }
         return rc;
 }
@@ -2417,8 +2394,6 @@ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
         if (card->info.guestlan)
                 return -EOPNOTSUPP;
         if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                 return -EOPNOTSUPP;
         }
         memcpy(buf, entry, 12);
@@ -2433,10 +2408,9 @@ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
                 tmp = rc;
                 memset(buf, 0, 16);
                 qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
-                PRINT_WARN("Could not delete ARP entry for address %s on %s: "
-                           "%s (0x%x/%d)\n",
-                           buf, QETH_CARD_IFNAME(card),
-                           qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+                QETH_DBF_MESSAGE(2, "Could not delete ARP entry for address %s"
+                        " on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
+                        qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
         }
         return rc;
 }
@@ -2456,16 +2430,14 @@ static int qeth_l3_arp_flush_cache(struct qeth_card *card)
         if (card->info.guestlan || (card->info.type == QETH_CARD_TYPE_IQD))
                 return -EOPNOTSUPP;
         if (!qeth_is_supported(card, IPA_ARP_PROCESSING)) {
-                PRINT_WARN("ARP processing not supported "
-                           "on %s!\n", QETH_CARD_IFNAME(card));
                 return -EOPNOTSUPP;
         }
         rc = qeth_l3_send_simple_setassparms(card, IPA_ARP_PROCESSING,
                                           IPA_CMD_ASS_ARP_FLUSH_CACHE, 0);
         if (rc) {
                 tmp = rc;
-                PRINT_WARN("Could not flush ARP cache on %s: %s (0x%x/%d)\n",
-                        QETH_CARD_IFNAME(card),
+                QETH_DBF_MESSAGE(2, "Could not flush ARP cache on %s: %s "
+                        "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
                         qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
         }
         return rc;
@@ -2724,7 +2696,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 ctx = qeth_eddp_create_context(card, new_skb, hdr,
                                                 skb->sk->sk_protocol);
                 if (ctx == NULL) {
-                        PRINT_WARN("could not create eddp context\n");
+                        QETH_DBF_MESSAGE(2, "could not create eddp context\n");
                         goto tx_drop;
                 }
         } else {
@@ -2792,6 +2764,7 @@ tx_drop:
         if ((new_skb != skb) && new_skb)
                 dev_kfree_skb_any(new_skb);
         dev_kfree_skb_any(skb);
+        netif_wake_queue(dev);
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 08f51fd902c4..ac1993708ae9 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -85,7 +85,6 @@ static ssize_t qeth_l3_dev_route_store(struct qeth_card *card,
         } else if (!strcmp(tmp, "multicast_router")) {
                 route->type = MULTICAST_ROUTER;
         } else {
-                PRINT_WARN("Invalid routing type '%s'.\n", tmp);
                 return -EINVAL;
         }
         if (((card->state == CARD_STATE_SOFTSETUP) ||
@@ -137,9 +136,6 @@ static ssize_t qeth_l3_dev_route6_store(struct device *dev,
                 return -EINVAL;
 
         if (!qeth_is_supported(card, IPA_IPV6)) {
-                PRINT_WARN("IPv6 not supported for interface %s.\n"
-                           "Routing status no changed.\n",
-                           QETH_CARD_IFNAME(card));
                 return -ENOTSUPP;
         }
 
@@ -179,7 +175,6 @@ static ssize_t qeth_l3_dev_fake_broadcast_store(struct device *dev,
         if ((i == 0) || (i == 1))
                 card->options.fake_broadcast = i;
         else {
-                PRINT_WARN("fake_broadcast: write 0 or 1 to this file!\n");
                 return -EINVAL;
         }
         return count;
@@ -220,7 +215,6 @@ static ssize_t qeth_l3_dev_broadcast_mode_store(struct device *dev,
 
         if (!((card->info.link_type == QETH_LINK_TYPE_HSTR) ||
               (card->info.link_type == QETH_LINK_TYPE_LANE_TR))) {
-                PRINT_WARN("Device is not a tokenring device!\n");
                 return -EINVAL;
         }
 
@@ -233,8 +227,6 @@ static ssize_t qeth_l3_dev_broadcast_mode_store(struct device *dev,
                 card->options.broadcast_mode = QETH_TR_BROADCAST_ALLRINGS;
                 return count;
         } else {
-                PRINT_WARN("broadcast_mode: invalid mode %s!\n",
-                           tmp);
                 return -EINVAL;
         }
         return count;
@@ -275,7 +267,6 @@ static ssize_t qeth_l3_dev_canonical_macaddr_store(struct device *dev,
 
         if (!((card->info.link_type == QETH_LINK_TYPE_HSTR) ||
               (card->info.link_type == QETH_LINK_TYPE_LANE_TR))) {
-                PRINT_WARN("Device is not a tokenring device!\n");
                 return -EINVAL;
         }
 
@@ -285,7 +276,6 @@ static ssize_t qeth_l3_dev_canonical_macaddr_store(struct device *dev,
                         QETH_TR_MACADDR_CANONICAL :
                         QETH_TR_MACADDR_NONCANONICAL;
         else {
-                PRINT_WARN("canonical_macaddr: write 0 or 1 to this file!\n");
                 return -EINVAL;
         }
         return count;
@@ -327,7 +317,6 @@ static ssize_t qeth_l3_dev_checksum_store(struct device *dev,
         else if (!strcmp(tmp, "no_checksumming"))
                 card->options.checksum_type = NO_CHECKSUMMING;
         else {
-                PRINT_WARN("Unknown checksumming type '%s'\n", tmp);
                 return -EINVAL;
         }
         return count;
@@ -382,8 +371,6 @@ static ssize_t qeth_l3_dev_ipato_enable_store(struct device *dev,
         } else if (!strcmp(tmp, "0")) {
                 card->ipato.enabled = 0;
         } else {
-                PRINT_WARN("ipato_enable: write 0, 1 or 'toggle' to "
-                           "this file\n");
                 return -EINVAL;
         }
         return count;
@@ -422,8 +409,6 @@ static ssize_t qeth_l3_dev_ipato_invert4_store(struct device *dev,
         } else if (!strcmp(tmp, "0")) {
                 card->ipato.invert4 = 0;
         } else {
-                PRINT_WARN("ipato_invert4: write 0, 1 or 'toggle' to "
-                           "this file\n");
                 return -EINVAL;
         }
         return count;
@@ -486,13 +471,10 @@ static int qeth_l3_parse_ipatoe(const char *buf, enum qeth_prot_versions proto,
         /* get address string */
         end = strchr(start, '/');
         if (!end || (end - start >= 40)) {
-                PRINT_WARN("Invalid format for ipato_addx/delx. "
-                           "Use <ip addr>/<mask bits>\n");
                 return -EINVAL;
         }
         strncpy(buffer, start, end - start);
         if (qeth_l3_string_to_ipaddr(buffer, proto, addr)) {
-                PRINT_WARN("Invalid IP address format!\n");
                 return -EINVAL;
         }
         start = end + 1;
@@ -500,7 +482,6 @@ static int qeth_l3_parse_ipatoe(const char *buf, enum qeth_prot_versions proto,
         if (!strlen(start) ||
             (tmp == start) ||
             (*mask_bits > ((proto == QETH_PROT_IPV4) ? 32 : 128))) {
-                PRINT_WARN("Invalid mask bits for ipato_addx/delx !\n");
                 return -EINVAL;
         }
         return 0;
@@ -520,7 +501,6 @@ static ssize_t qeth_l3_dev_ipato_add_store(const char *buf, size_t count,
 
         ipatoe = kzalloc(sizeof(struct qeth_ipato_entry), GFP_KERNEL);
         if (!ipatoe) {
-                PRINT_WARN("No memory to allocate ipato entry\n");
                 return -ENOMEM;
         }
         ipatoe->proto = proto;
@@ -609,8 +589,6 @@ static ssize_t qeth_l3_dev_ipato_invert6_store(struct device *dev,
         } else if (!strcmp(tmp, "0")) {
                 card->ipato.invert6 = 0;
         } else {
-                PRINT_WARN("ipato_invert6: write 0, 1 or 'toggle' to "
-                           "this file\n");
                 return -EINVAL;
         }
         return count;
@@ -724,7 +702,6 @@ static int qeth_l3_parse_vipae(const char *buf, enum qeth_prot_versions proto,
                  u8 *addr)
 {
         if (qeth_l3_string_to_ipaddr(buf, proto, addr)) {
-                PRINT_WARN("Invalid IP address format!\n");
                 return -EINVAL;
         }
         return 0;
@@ -891,7 +868,6 @@ static int qeth_l3_parse_rxipe(const char *buf, enum qeth_prot_versions proto,
                  u8 *addr)
 {
         if (qeth_l3_string_to_ipaddr(buf, proto, addr)) {
-                PRINT_WARN("Invalid IP address format!\n");
                 return -EINVAL;
         }
         return 0;
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 5080f343ad74..5bfbe7659830 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -207,6 +207,7 @@ s390_handle_mcck(void)
                 do_exit(SIGSEGV);
         }
 }
+EXPORT_SYMBOL_GPL(s390_handle_mcck);
 
 /*
  * returns 0 if all registers could be validated
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 28e3d5c5fcac..1f3465201fdf 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -2,6 +2,11 @@ Version 1.53
 ------------
 DFS support added (Microsoft Distributed File System client support needed
 for referrals which enable a hierarchical name space among servers).
+Disable temporary caching of mode bits to servers which do not support
+storing of mode (e.g. Windows servers, when client mounts without cifsacl
+mount option) and add new "dynperm" mount option to enable temporary caching
+of mode (enable old behavior).  Fix hang on mount caused when server crashes
+tcp session during negotiate protocol.
 
 Version 1.52
 ------------
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 5df93fd6303f..86b4d5f405ae 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
 {
         struct inode *inode;
         struct cifs_sb_info *cifs_sb;
-#ifdef CONFIG_CIFS_DFS_UPCALL
-        int len;
-#endif
         int rc = 0;
 
         /* BB should we make this contingent on mount parm? */
@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
          * complex operation (mount), and in case of fail
          * just exit instead of doing mount and attempting
          * undo it if this copy fails?*/
-        len = strlen(data);
-        cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
-        if (cifs_sb->mountdata == NULL) {
-                kfree(sb->s_fs_info);
-                sb->s_fs_info = NULL;
-                return -ENOMEM;
+        if (data) {
+                int len = strlen(data);
+                cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
+                if (cifs_sb->mountdata == NULL) {
+                        kfree(sb->s_fs_info);
+                        sb->s_fs_info = NULL;
+                        return -ENOMEM;
+                }
+                strncpy(cifs_sb->mountdata, data, len + 1);
+                cifs_sb->mountdata[len] = '\0';
         }
-        strncpy(cifs_sb->mountdata, data, len + 1);
-        cifs_sb->mountdata[len] = '\0';
 #endif
 
         rc = cifs_mount(sb, cifs_sb, data, devname);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 08914053242b..9cfcf326ead3 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -333,7 +333,6 @@ struct cifsFileInfo {
         bool messageMode:1;     /* for pipes: message vs byte mode */
         atomic_t wrtPending;   /* handle in use - defer close */
         struct semaphore fh_sem; /* prevents reopen race after dead ses*/
-        char *search_resume_name; /* BB removeme BB */
         struct cifs_search_info srch_inf;
 };
 
@@ -626,7 +625,7 @@ GLOBAL_EXTERN atomic_t tcpSesAllocCount;
 GLOBAL_EXTERN atomic_t tcpSesReconnectCount;
 GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
 
-/* Various Debug counters to remove someday (BB) */
+/* Various Debug counters */
 GLOBAL_EXTERN atomic_t bufAllocCount;    /* current number allocated  */
 #ifdef CONFIG_CIFS_STATS2
 GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 65d58b4e6a61..0f327c224da3 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -79,6 +79,19 @@
 #define TRANS2_GET_DFS_REFERRAL       0x10
 #define TRANS2_REPORT_DFS_INCOSISTENCY 0x11
 
+/* SMB Transact (Named Pipe) subcommand codes */
+#define TRANS_SET_NMPIPE_STATE      0x0001
+#define TRANS_RAW_READ_NMPIPE       0x0011
+#define TRANS_QUERY_NMPIPE_STATE    0x0021
+#define TRANS_QUERY_NMPIPE_INFO     0x0022
+#define TRANS_PEEK_NMPIPE           0x0023
+#define TRANS_TRANSACT_NMPIPE       0x0026
+#define TRANS_RAW_WRITE_NMPIPE      0x0031
+#define TRANS_READ_NMPIPE           0x0036
+#define TRANS_WRITE_NMPIPE          0x0037
+#define TRANS_WAIT_NMPIPE           0x0053
+#define TRANS_CALL_NMPIPE           0x0054
+
 /* NT Transact subcommand codes */
 #define NT_TRANSACT_CREATE            0x01
 #define NT_TRANSACT_IOCTL             0x02
@@ -328,12 +341,13 @@
 #define CREATE_COMPLETE_IF_OPLK 0x00000100      /* should be zero */
 #define CREATE_NO_EA_KNOWLEDGE  0x00000200
 #define CREATE_EIGHT_DOT_THREE  0x00000400      /* doc says this is obsolete
-                                                 open for recovery flag - should
-                                                 be zero */
+                                                 "open for recovery" flag - should
+                                                 be zero in any case */
+#define CREATE_OPEN_FOR_RECOVERY 0x00000400
 #define CREATE_RANDOM_ACCESS    0x00000800
 #define CREATE_DELETE_ON_CLOSE  0x00001000
 #define CREATE_OPEN_BY_ID       0x00002000
-#define CREATE_OPEN_BACKUP_INTN 0x00004000
+#define CREATE_OPEN_BACKUP_INTENT 0x00004000
 #define CREATE_NO_COMPRESSION   0x00008000
 #define CREATE_RESERVE_OPFILTER 0x00100000      /* should be zero */
 #define OPEN_REPARSE_POINT      0x00200000
@@ -722,7 +736,6 @@ typedef struct smb_com_tconx_rsp_ext {
 #define SMB_CSC_CACHE_AUTO_REINT   0x0004
 #define SMB_CSC_CACHE_VDO          0x0008
 #define SMB_CSC_NO_CACHING         0x000C
-
 #define SMB_UNIQUE_FILE_NAME    0x0010
 #define SMB_EXTENDED_SIGNATURES 0x0020
 
@@ -806,7 +819,7 @@ typedef struct smb_com_findclose_req {
 #define ICOUNT_MASK             0x00FF
 #define PIPE_READ_MODE          0x0100
 #define NAMED_PIPE_TYPE         0x0400
-#define PIPE_END_POINT          0x0800
+#define PIPE_END_POINT          0x4000
 #define BLOCKING_NAMED_PIPE     0x8000
 
 typedef struct smb_com_open_req {       /* also handles create */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index fb655b4593c6..4511b708f0f3 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1728,7 +1728,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 {
         int rc = 0;
         LOCK_REQ *pSMB = NULL;
-        LOCK_RSP *pSMBr = NULL;
+/*      LOCK_RSP *pSMBr = NULL; */ /* No response data other than rc to parse */
         int bytes_returned;
         int timeout = 0;
         __u16 count;
@@ -1739,8 +1739,6 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         if (rc)
                 return rc;
 
-        pSMBr = (LOCK_RSP *)pSMB; /* BB removeme BB */
-
         if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
                 timeout = CIFS_ASYNC_OP; /* no response expected */
                 pSMB->Timeout = 0;
@@ -1774,7 +1772,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 
         if (waitFlag) {
                 rc = SendReceiveBlockingLock(xid, tcon, (struct smb_hdr *) pSMB,
-                        (struct smb_hdr *) pSMBr, &bytes_returned);
+                        (struct smb_hdr *) pSMB, &bytes_returned);
                 cifs_small_buf_release(pSMB);
         } else {
                 rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *)pSMB,
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 023434f72c15..e8fa46c7cff2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -653,6 +653,7 @@ multi_t2_fnd:
         spin_lock(&GlobalMid_Lock);
         server->tcpStatus = CifsExiting;
         spin_unlock(&GlobalMid_Lock);
+        wake_up_all(&server->response_q);
 
         /* don't exit until kthread_stop is called */
         set_current_state(TASK_UNINTERRUPTIBLE);
@@ -2120,6 +2121,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
                 }
 
+                if ((volume_info.cifs_acl) && (volume_info.dynperm))
+                        cERROR(1, ("mount option dynperm ignored if cifsacl "
+                                   "mount option supported"));
+
                 tcon =
                     find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
                              volume_info.username);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index f0b5b5f3dd2e..fb69c1fa85c9 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -260,7 +260,9 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                                                  buf, inode->i_sb, xid,
                                                  &fileHandle);
                         if (newinode) {
-                                newinode->i_mode = mode;
+                                if (cifs_sb->mnt_cifs_flags &
+                                    CIFS_MOUNT_DYNPERM)
+                                        newinode->i_mode = mode;
                                 if ((oplock & CIFS_CREATE_ACTION) &&
                                     (cifs_sb->mnt_cifs_flags &
                                      CIFS_MOUNT_SET_UID)) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 8636cec2642c..0aac824371a5 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -546,7 +546,6 @@ int cifs_close(struct inode *inode, struct file *file)
                         msleep(timeout);
                         timeout *= 8;
                 }
-                kfree(pSMBFile->search_resume_name);
                 kfree(file->private_data);
                 file->private_data = NULL;
         } else
@@ -605,12 +604,6 @@ int cifs_closedir(struct inode *inode, struct file *file)
                         else
                                 cifs_buf_release(ptmp);
                 }
-                ptmp = pCFileStruct->search_resume_name;
-                if (ptmp) {
-                        cFYI(1, ("closedir free resume name"));
-                        pCFileStruct->search_resume_name = NULL;
-                        kfree(ptmp);
-                }
                 kfree(file->private_data);
                 file->private_data = NULL;
         }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 129dbfe4dca7..722be543ceec 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -418,6 +418,7 @@ int cifs_get_inode_info(struct inode **pinode,
         char *buf = NULL;
         bool adjustTZ = false;
         bool is_dfs_referral = false;
+        umode_t default_mode;
 
         pTcon = cifs_sb->tcon;
         cFYI(1, ("Getting info on %s", full_path));
@@ -530,47 +531,42 @@ int cifs_get_inode_info(struct inode **pinode,
                 inode->i_mtime.tv_sec += pTcon->ses->server->timeAdj;
         }
 
-        /* set default mode. will override for dirs below */
-        if (atomic_read(&cifsInfo->inUse) == 0)
-                /* new inode, can safely set these fields */
-                inode->i_mode = cifs_sb->mnt_file_mode;
-        else /* since we set the inode type below we need to mask off
-             to avoid strange results if type changes and both
-             get orred in */
-                inode->i_mode &= ~S_IFMT;
-/*      if (attr & ATTR_REPARSE)  */
-        /* We no longer handle these as symlinks because we could not
-           follow them due to the absolute path with drive letter */
-        if (attr & ATTR_DIRECTORY) {
-        /* override default perms since we do not do byte range locking
-           on dirs */
-                inode->i_mode = cifs_sb->mnt_dir_mode;
-                inode->i_mode |= S_IFDIR;
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
-                   (cifsInfo->cifsAttrs & ATTR_SYSTEM) &&
-                   /* No need to le64 convert size of zero */
-                   (pfindData->EndOfFile == 0)) {
-                inode->i_mode = cifs_sb->mnt_file_mode;
-                inode->i_mode |= S_IFIFO;
-/* BB Finish for SFU style symlinks and devices */
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
-                   (cifsInfo->cifsAttrs & ATTR_SYSTEM)) {
-                if (decode_sfu_inode(inode, le64_to_cpu(pfindData->EndOfFile),
-                                     full_path, cifs_sb, xid))
-                        cFYI(1, ("Unrecognized sfu inode type"));
-
-                cFYI(1, ("sfu mode 0%o", inode->i_mode));
+        /* get default inode mode */
+        if (attr & ATTR_DIRECTORY)
+                default_mode = cifs_sb->mnt_dir_mode;
+        else
+                default_mode = cifs_sb->mnt_file_mode;
+
+        /* set permission bits */
+        if (atomic_read(&cifsInfo->inUse) == 0 ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        inode->i_mode |= (S_IWUGO & default_mode);
+                        inode->i_mode &= ~S_IFMT;
+        }
+        /* clear write bits if ATTR_READONLY is set */
+        if (attr & ATTR_READONLY)
+                inode->i_mode &= ~S_IWUGO;
+
+        /* set inode type */
+        if ((attr & ATTR_SYSTEM) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
+                /* no need to fix endianness on 0 */
+                if (pfindData->EndOfFile == 0)
+                        inode->i_mode |= S_IFIFO;
+                else if (decode_sfu_inode(inode,
+                                le64_to_cpu(pfindData->EndOfFile),
+                                full_path, cifs_sb, xid))
+                        cFYI(1, ("unknown SFU file type\n"));
         } else {
-                inode->i_mode |= S_IFREG;
-                /* treat dos attribute of read-only as read-only mode eg 555 */
-                if (cifsInfo->cifsAttrs & ATTR_READONLY)
-                        inode->i_mode &= ~(S_IWUGO);
-                else if ((inode->i_mode & S_IWUGO) == 0)
-                        /* the ATTR_READONLY flag may have been */
-                        /* changed on server -- set any w bits  */
-                        /* allowed by mnt_file_mode             */
-                        inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
-        /* BB add code to validate if device or weird share or device type? */
+                if (attr & ATTR_DIRECTORY)
+                        inode->i_mode |= S_IFDIR;
+                else
+                        inode->i_mode |= S_IFREG;
         }
 
         spin_lock(&inode->i_lock);
@@ -1019,8 +1015,11 @@ mkdir_get_info:
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                         }
                         if (direntry->d_inode) {
-                                direntry->d_inode->i_mode = mode;
-                                direntry->d_inode->i_mode |= S_IFDIR;
+                                if (cifs_sb->mnt_cifs_flags &
+                                     CIFS_MOUNT_DYNPERM)
+                                        direntry->d_inode->i_mode =
+                                                (mode | S_IFDIR);
+
                                 if (cifs_sb->mnt_cifs_flags &
                                      CIFS_MOUNT_SET_UID) {
                                         direntry->d_inode->i_uid =
@@ -1547,13 +1546,26 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                 } else
                         goto cifs_setattr_exit;
         }
-        if (attrs->ia_valid & ATTR_UID) {
-                cFYI(1, ("UID changed to %d", attrs->ia_uid));
-                uid = attrs->ia_uid;
-        }
-        if (attrs->ia_valid & ATTR_GID) {
-                cFYI(1, ("GID changed to %d", attrs->ia_gid));
-                gid = attrs->ia_gid;
+
+        /*
+         * Without unix extensions we can't send ownership changes to the
+         * server, so silently ignore them. This is consistent with how
+         * local DOS/Windows filesystems behave (VFAT, NTFS, etc). With
+         * CIFSACL support + proper Windows to Unix idmapping, we may be
+         * able to support this in the future.
+         */
+        if (!pTcon->unix_ext &&
+            !(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) {
+                attrs->ia_valid &= ~(ATTR_UID | ATTR_GID);
+        } else {
+                if (attrs->ia_valid & ATTR_UID) {
+                        cFYI(1, ("UID changed to %d", attrs->ia_uid));
+                        uid = attrs->ia_uid;
+                }
+                if (attrs->ia_valid & ATTR_GID) {
+                        cFYI(1, ("GID changed to %d", attrs->ia_gid));
+                        gid = attrs->ia_gid;
+                }
         }
 
         time_buf.Attributes = 0;
@@ -1563,7 +1575,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                 attrs->ia_valid &= ~ATTR_MODE;
 
         if (attrs->ia_valid & ATTR_MODE) {
-                cFYI(1, ("Mode changed to 0x%x", attrs->ia_mode));
+                cFYI(1, ("Mode changed to 0%o", attrs->ia_mode));
                 mode = attrs->ia_mode;
         }
 
@@ -1578,18 +1590,18 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
 #ifdef CONFIG_CIFS_EXPERIMENTAL
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL)
                         rc = mode_to_acl(inode, full_path, mode);
-                else if ((mode & S_IWUGO) == 0) {
-#else
-                if ((mode & S_IWUGO) == 0) {
+                else
 #endif
-                        /* not writeable */
-                        if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
-                                set_dosattr = true;
-                                time_buf.Attributes =
-                                        cpu_to_le32(cifsInode->cifsAttrs |
-                                                    ATTR_READONLY);
-                        }
-                } else if (cifsInode->cifsAttrs & ATTR_READONLY) {
+                if (((mode & S_IWUGO) == 0) &&
+                    (cifsInode->cifsAttrs & ATTR_READONLY) == 0) {
+                        set_dosattr = true;
+                        time_buf.Attributes = cpu_to_le32(cifsInode->cifsAttrs |
+                                                          ATTR_READONLY);
+                        /* fix up mode if we're not using dynperm */
+                        if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                                attrs->ia_mode = inode->i_mode & ~S_IWUGO;
+                } else if ((mode & S_IWUGO) &&
+                           (cifsInode->cifsAttrs & ATTR_READONLY)) {
                         /* If file is readonly on server, we would
                         not be able to write to it - so if any write
                         bit is enabled for user or group or other we
@@ -1600,6 +1612,20 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                         /* Windows ignores set to zero */
                         if (time_buf.Attributes == 0)
                                 time_buf.Attributes |= cpu_to_le32(ATTR_NORMAL);
+
+                        /* reset local inode permissions to normal */
+                        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                                attrs->ia_mode &= ~(S_IALLUGO);
+                                if (S_ISDIR(inode->i_mode))
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_dir_mode;
+                                else
+                                        attrs->ia_mode |=
+                                                cifs_sb->mnt_file_mode;
+                        }
+                } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM)) {
+                        /* ignore mode change - ATTR_READONLY hasn't changed */
+                        attrs->ia_valid &= ~ATTR_MODE;
                 }
         }
 
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1d69b8014e0b..4b17f8fe3157 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -519,8 +519,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
                         pnotify = (struct file_notify_information *)
                                 ((char *)&pSMBr->hdr.Protocol + data_offset);
                         cFYI(1, ("dnotify on %s Action: 0x%x",
-                                 pnotify->FileName,
-                                pnotify->Action));  /* BB removeme BB */
+                                 pnotify->FileName, pnotify->Action));
                         /*   cifs_dump_mem("Rcvd notify Data: ",buf,
                                 sizeof(struct smb_hdr)+60); */
                         return true;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 713c25110197..83f306954883 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -132,6 +132,7 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         __u32 attr;
         __u64 allocation_size;
         __u64 end_of_file;
+        umode_t default_mode;
 
         /* save mtime and size */
         local_mtime = tmp_inode->i_mtime;
@@ -187,48 +188,54 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
         if (atomic_read(&cifsInfo->inUse) == 0) {
                 tmp_inode->i_uid = cifs_sb->mnt_uid;
                 tmp_inode->i_gid = cifs_sb->mnt_gid;
-                /* set default mode. will override for dirs below */
-                tmp_inode->i_mode = cifs_sb->mnt_file_mode;
-        } else {
-                /* mask off the type bits since it gets set
-                below and we do not want to get two type
-                bits set */
+        }
+
+        if (attr & ATTR_DIRECTORY)
+                default_mode = cifs_sb->mnt_dir_mode;
+        else
+                default_mode = cifs_sb->mnt_file_mode;
+
+        /* set initial permissions */
+        if ((atomic_read(&cifsInfo->inUse) == 0) ||
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DYNPERM) == 0)
+                tmp_inode->i_mode = default_mode;
+        else {
+                /* just reenable write bits if !ATTR_READONLY */
+                if ((tmp_inode->i_mode & S_IWUGO) == 0 &&
+                    (attr & ATTR_READONLY) == 0)
+                        tmp_inode->i_mode |= (S_IWUGO & default_mode);
+
                 tmp_inode->i_mode &= ~S_IFMT;
         }
 
-        if (attr & ATTR_DIRECTORY) {
-                *pobject_type = DT_DIR;
-                /* override default perms since we do not lock dirs */
-                if (atomic_read(&cifsInfo->inUse) == 0)
-                        tmp_inode->i_mode = cifs_sb->mnt_dir_mode;
-                tmp_inode->i_mode |= S_IFDIR;
-        } else if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) &&
-                   (attr & ATTR_SYSTEM)) {
+        /* clear write bits if ATTR_READONLY is set */
+        if (attr & ATTR_READONLY)
+                tmp_inode->i_mode &= ~S_IWUGO;
+
+        /* set inode type */
+        if ((attr & ATTR_SYSTEM) &&
+            (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) {
                 if (end_of_file == 0)  {
-                        *pobject_type = DT_FIFO;
                         tmp_inode->i_mode |= S_IFIFO;
+                        *pobject_type = DT_FIFO;
                 } else {
-                        /* rather than get the type here, we mark the
-                        inode as needing revalidate and get the real type
-                        (blk vs chr vs. symlink) later ie in lookup */
-                        *pobject_type = DT_REG;
+                        /*
+                         * trying to get the type can be slow, so just call
+                         * this a regular file for now, and mark for reval
+                         */
                         tmp_inode->i_mode |= S_IFREG;
+                        *pobject_type = DT_REG;
                         cifsInfo->time = 0;
                 }
-/* we no longer mark these because we could not follow them */
-/*        } else if (attr & ATTR_REPARSE) {
-                *pobject_type = DT_LNK;
-                tmp_inode->i_mode |= S_IFLNK; */
         } else {
-                *pobject_type = DT_REG;
-                tmp_inode->i_mode |= S_IFREG;
-                if (attr & ATTR_READONLY)
-                        tmp_inode->i_mode &= ~(S_IWUGO);
-                else if ((tmp_inode->i_mode & S_IWUGO) == 0)
-                        /* the ATTR_READONLY flag may have been changed on   */
-                        /* server -- set any w bits allowed by mnt_file_mode */
-                        tmp_inode->i_mode |= (S_IWUGO & cifs_sb->mnt_file_mode);
-        } /* could add code here - to validate if device or weird share type? */
+                if (attr & ATTR_DIRECTORY) {
+                        tmp_inode->i_mode |= S_IFDIR;
+                        *pobject_type = DT_DIR;
+                } else {
+                        tmp_inode->i_mode |= S_IFREG;
+                        *pobject_type = DT_REG;
+                }
+        }
 
         /* can not fill in nlink here as in qpathinfo version and Unx search */
         if (atomic_read(&cifsInfo->inUse) == 0)
@@ -675,8 +682,6 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
                         cifsFile->invalidHandle = true;
                         CIFSFindClose(xid, pTcon, cifsFile->netfid);
                 }
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL;
                 if (cifsFile->srch_inf.ntwrk_buf_start) {
                         cFYI(1, ("freeing SMB ff cache buf on search rewind"));
                         if (cifsFile->srch_inf.smallBuf)
@@ -1043,9 +1048,7 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                 } /* else {
                         cifsFile->invalidHandle = true;
                         CIFSFindClose(xid, pTcon, cifsFile->netfid);
-                }
-                kfree(cifsFile->search_resume_name);
-                cifsFile->search_resume_name = NULL; */
+                } */
 
                 rc = find_cifs_entry(xid, pTcon, file,
                                 &current_entry, &num_to_fill);
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 06480bcabfdc..06ebb6ef72aa 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -319,6 +319,7 @@ static inline int acpi_processor_ppc_has_changed(struct acpi_processor *pr)
 #endif                          /* CONFIG_CPU_FREQ */
 
 /* in processor_throttling.c */
+int acpi_processor_tstate_has_changed(struct acpi_processor *pr);
 int acpi_processor_get_throttling_info(struct acpi_processor *pr);
 extern int acpi_processor_set_throttling(struct acpi_processor *pr, int state);
 extern struct file_operations acpi_processor_throttling_fops;
diff --git a/include/asm-powerpc/kvm_ppc.h b/include/asm-powerpc/kvm_ppc.h
index b35a7e3ef978..5a21115228af 100644
--- a/include/asm-powerpc/kvm_ppc.h
+++ b/include/asm-powerpc/kvm_ppc.h
@@ -57,6 +57,7 @@ extern int kvmppc_handle_store(struct kvm_run *run, struct kvm_vcpu *vcpu,
 
 extern int kvmppc_emulate_instruction(struct kvm_run *run,
                                       struct kvm_vcpu *vcpu);
+extern int kvmppc_emulate_mmio(struct kvm_run *run, struct kvm_vcpu *vcpu);
 
 extern void kvmppc_mmu_map(struct kvm_vcpu *vcpu, u64 gvaddr, gfn_t gfn,
                            u64 asid, u32 flags);
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 51e6b1e520e6..dcf77fa826b5 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -82,6 +82,7 @@ struct cpuidle_state_kobj {
 };
 
 struct cpuidle_device {
+        unsigned int            registered:1;
         unsigned int            enabled:1;
         unsigned int            cpu;
 
diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index d5d40a9f7929..c6801bffe76d 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -53,14 +53,14 @@ struct resource_list {
 #define IORESOURCE_AUTO         0x40000000
 #define IORESOURCE_BUSY         0x80000000      /* Driver has marked this resource busy */
 
-/* ISA PnP IRQ specific bits (IORESOURCE_BITS) */
+/* PnP IRQ specific bits (IORESOURCE_BITS) */
 #define IORESOURCE_IRQ_HIGHEDGE         (1<<0)
 #define IORESOURCE_IRQ_LOWEDGE          (1<<1)
 #define IORESOURCE_IRQ_HIGHLEVEL        (1<<2)
 #define IORESOURCE_IRQ_LOWLEVEL         (1<<3)
 #define IORESOURCE_IRQ_SHAREABLE        (1<<4)
 
-/* ISA PnP DMA specific bits (IORESOURCE_BITS) */
+/* PnP DMA specific bits (IORESOURCE_BITS) */
 #define IORESOURCE_DMA_TYPE_MASK        (3<<0)
 #define IORESOURCE_DMA_8BIT             (0<<0)
 #define IORESOURCE_DMA_8AND16BIT        (1<<0)
@@ -76,7 +76,7 @@ struct resource_list {
 #define IORESOURCE_DMA_TYPEB            (2<<6)
 #define IORESOURCE_DMA_TYPEF            (3<<6)
 
-/* ISA PnP memory I/O specific bits (IORESOURCE_BITS) */
+/* PnP memory I/O specific bits (IORESOURCE_BITS) */
 #define IORESOURCE_MEM_WRITEABLE        (1<<0)  /* dup: IORESOURCE_READONLY */
 #define IORESOURCE_MEM_CACHEABLE        (1<<1)  /* dup: IORESOURCE_CACHEABLE */
 #define IORESOURCE_MEM_RANGELENGTH      (1<<2)  /* dup: IORESOURCE_RANGELENGTH */
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 10b666b61add..cde056e08181 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -396,8 +396,10 @@ static inline struct request_sock *inet6_reqsk_alloc(struct request_sock_ops *op
 {
         struct request_sock *req = reqsk_alloc(ops);
 
-        if (req != NULL)
+        if (req != NULL) {
                 inet_rsk(req)->inet6_rsk_offset = inet6_rsk_offset(req);
+                inet6_rsk(req)->pktopts = NULL;
+        }
 
         return req;
 }
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 398978972b7a..092b1b25291d 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -297,7 +297,7 @@ static inline gpa_t gfn_to_gpa(gfn_t gfn)
         return (gpa_t)gfn << PAGE_SHIFT;
 }
 
-static inline void kvm_migrate_apic_timer(struct kvm_vcpu *vcpu)
+static inline void kvm_migrate_timers(struct kvm_vcpu *vcpu)
 {
         set_bit(KVM_REQ_MIGRATE_TIMER, &vcpu->requests);
 }
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index a2aec2c0cfb5..b358c704d102 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -246,6 +246,7 @@ enum rt_class_t
 {
         RT_TABLE_UNSPEC=0,
 /* User defined values */
+        RT_TABLE_COMPAT=252,
         RT_TABLE_DEFAULT=253,
         RT_TABLE_MAIN=254,
         RT_TABLE_LOCAL=255,
diff --git a/include/linux/ssb/ssb_driver_gige.h b/include/linux/ssb/ssb_driver_gige.h
index 01fbdf5fef22..942e38736901 100644
--- a/include/linux/ssb/ssb_driver_gige.h
+++ b/include/linux/ssb/ssb_driver_gige.h
@@ -100,7 +100,7 @@ extern char * nvram_get(const char *name);
 /* Get the device MAC address */
 static inline void ssb_gige_get_macaddr(struct pci_dev *pdev, u8 *macaddr)
 {
-#ifdef CONFIG_BCM947XX
+#ifdef CONFIG_BCM47XX
         char *res = nvram_get("et0macaddr");
         if (res)
                 memcpy(macaddr, res, 6);
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index 9405aa6cdf26..38c0571820fb 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -38,7 +38,7 @@ struct virtio_net_hdr
 #define VIRTIO_NET_HDR_GSO_ECN          0x80    // TCP has ECN set
         __u8 gso_type;
         __u16 hdr_len;          /* Ethernet + IP + tcp/udp hdrs */
-        __u16 gso_size;         /* Bytes to append to gso_hdr_len per frame */
+        __u16 gso_size;         /* Bytes to append to hdr_len per frame */
         __u16 csum_start;       /* Position to start checksumming from */
         __u16 csum_offset;      /* Offset after that to place checksum */
 };
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a42cd63d241a..9fabe5b38912 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -197,4 +197,14 @@ static inline int inet_iif(const struct sk_buff *skb)
         return skb->rtable->rt_iif;
 }
 
+static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
+{
+        struct request_sock *req = reqsk_alloc(ops);
+
+        if (req != NULL)
+                inet_rsk(req)->opt = NULL;
+
+        return req;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 633147cb6bbc..d448310c82c1 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -433,7 +433,6 @@ extern struct sk_buff *		tcp_make_synack(struct sock *sk,
 
 extern int                      tcp_disconnect(struct sock *sk, int flags);
 
-extern void                     tcp_unhash(struct sock *sk);
 
 /* From syncookies.c */
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index c22a3780c14e..37d27bcb361f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = reqsk_alloc(&dccp_request_sock_ops);
+        req = inet_reqsk_alloc(&dccp_request_sock_ops);
         if (req == NULL)
                 goto drop;
 
@@ -605,7 +605,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq->loc_addr = ip_hdr(skb)->daddr;
         ireq->rmt_addr = ip_hdr(skb)->saddr;
-        ireq->opt       = NULL;
 
         /*
          * Step 3: Process LISTEN state
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9b1129bb7ece..f7fe2a572d7b 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -421,7 +421,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq6 = inet6_rsk(req);
         ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
-        ireq6->pktopts  = NULL;
 
         if (ipv6_opt_accepted(sk, skb) ||
             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 3b83c34019fc..0d4d72827e4b 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -960,7 +960,10 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
         rtm->rtm_dst_len = dst_len;
         rtm->rtm_src_len = 0;
         rtm->rtm_tos = tos;
-        rtm->rtm_table = tb_id;
+        if (tb_id < 256)
+                rtm->rtm_table = tb_id;
+        else
+                rtm->rtm_table = RT_TABLE_COMPAT;
         NLA_PUT_U32(skb, RTA_TABLE, tb_id);
         rtm->rtm_type = type;
         rtm->rtm_flags = fi->fib_flags;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 73ba98921d64..d182a2a26291 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -285,7 +285,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 cookie_check_timestamp(&tcp_opt);
 
         ret = NULL;
-        req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
+        req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
                 goto out;
 
@@ -301,7 +301,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rmt_port          = th->source;
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
-        ireq->opt               = NULL;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index cd601a866c2f..4f8485c67d1a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1285,7 +1285,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = reqsk_alloc(&tcp_request_sock_ops);
+        req = inet_reqsk_alloc(&tcp_request_sock_ops);
         if (!req)
                 goto drop;
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3c6aafb02183..e84b3fd17fb4 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -191,7 +191,7 @@ lookup_protocol:
         np->mcast_hops  = -1;
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
-        np->ipv6only    = init_net.ipv6.sysctl.bindv6only;
+        np->ipv6only    = net->ipv6.sysctl.bindv6only;
 
         /* Init the ipv4 part of the socket since we can have sockets
          * using v6 API for ipv4.
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 938ce4ecde55..3ecc1157994e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -198,7 +198,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
-        ireq6->pktopts = NULL;
 
         if (security_inet_conn_request(sk, skb, req)) {
                 reqsk_free(req);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 715965f0fac0..cb46749d4c32 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1299,7 +1299,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         treq = inet6_rsk(req);
         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
-        treq->pktopts = NULL;
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9bba7ac5fee0..7470e367272b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3030,6 +3030,9 @@ static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
 
 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
 {
+        if (atomic_read(&pfkey_socks_nr) == 0)
+                return 0;
+
         switch (c->event) {
         case XFRM_MSG_EXPIRE:
                 return key_notify_sa_expire(x, c);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c7314bf4bec2..006486b26726 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -899,7 +899,7 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
 
 
 /* ieee80211_ioctl.c */
-int ieee80211_set_freq(struct ieee80211_local *local, int freq);
+int ieee80211_set_freq(struct net_device *dev, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 5c876450b14c..98c0b5e56ecc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -511,6 +511,7 @@ static int ieee80211_stop(struct net_device *dev)
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
                 sdata->u.sta.state = IEEE80211_DISABLED;
+                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
                 del_timer_sync(&sdata->u.sta.timer);
                 /*
                  * When we get here, the interface is marked down.
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 841278f1df8e..4d2b582dd055 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -44,7 +44,7 @@
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
-#define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
+#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
@@ -2336,6 +2336,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         u8 *pos;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_supported_band *sband;
+        union iwreq_data wrqu;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
@@ -2358,13 +2359,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         sdata->drop_unencrypted = bss->capability &
                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        res = ieee80211_set_freq(local, bss->freq);
+        res = ieee80211_set_freq(dev, bss->freq);
 
-        if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
-                printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
-                       "%d MHz\n", dev->name, local->oper_channel->center_freq);
-                return -1;
-        }
+        if (res)
+                return res;
 
         /* Set beacon template */
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -2479,6 +2477,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         ifsta->state = IEEE80211_IBSS_JOINED;
         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
 
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
+
         return res;
 }
 
@@ -3486,7 +3488,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         spin_unlock_bh(&local->sta_bss_lock);
 
         if (selected) {
-                ieee80211_set_freq(local, selected->freq);
+                ieee80211_set_freq(dev, selected->freq);
                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
                         ieee80211_sta_set_ssid(dev, selected->ssid,
                                                selected->ssid_len);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 8311bb24f9f3..a8bb8e31b1ec 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -290,14 +290,22 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
         return 0;
 }
 
-int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz)
+int ieee80211_set_freq(struct net_device *dev, int freqMHz)
 {
         int ret = -EINVAL;
         struct ieee80211_channel *chan;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
 
         if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
+                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
+                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                                "%d MHz\n", dev->name, chan->center_freq);
+                        return ret;
+                }
                 local->oper_channel = chan;
 
                 if (local->sta_sw_scanning || local->sta_hw_scanning)
@@ -315,7 +323,6 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
@@ -329,14 +336,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
-                        return ieee80211_set_freq(local,
+                        return ieee80211_set_freq(dev,
                                 ieee80211_channel_to_frequency(freq->m));
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div > 0)
-                        return ieee80211_set_freq(local, freq->m / div);
+                        return ieee80211_set_freq(dev, freq->m / div);
                 else
                         return -EINVAL;
         }
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 4232fd75dd20..98778cb69c6e 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -45,7 +45,7 @@
 #else
 #define ioapic_debug(fmt, arg...)
 #endif
-static void ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
+static int ioapic_deliver(struct kvm_ioapic *vioapic, int irq);
 
 static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
                                           unsigned long addr,
@@ -89,8 +89,8 @@ static void ioapic_service(struct kvm_ioapic *ioapic, unsigned int idx)
         pent = &ioapic->redirtbl[idx];
 
         if (!pent->fields.mask) {
-                ioapic_deliver(ioapic, idx);
-                if (pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
+                int injected = ioapic_deliver(ioapic, idx);
+                if (injected && pent->fields.trig_mode == IOAPIC_LEVEL_TRIG)
                         pent->fields.remote_irr = 1;
         }
         if (!pent->fields.trig_mode)
@@ -133,7 +133,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
         }
 }
 
-static void ioapic_inj_irq(struct kvm_ioapic *ioapic,
+static int ioapic_inj_irq(struct kvm_ioapic *ioapic,
                            struct kvm_vcpu *vcpu,
                            u8 vector, u8 trig_mode, u8 delivery_mode)
 {
@@ -143,7 +143,7 @@ static void ioapic_inj_irq(struct kvm_ioapic *ioapic,
         ASSERT((delivery_mode == IOAPIC_FIXED) ||
                (delivery_mode == IOAPIC_LOWEST_PRIORITY));
 
-        kvm_apic_set_irq(vcpu, vector, trig_mode);
+        return kvm_apic_set_irq(vcpu, vector, trig_mode);
 }
 
 static u32 ioapic_get_delivery_bitmask(struct kvm_ioapic *ioapic, u8 dest,
@@ -186,7 +186,7 @@ static u32 ioapic_get_delivery_bitmask(struct kvm_ioapic *ioapic, u8 dest,
         return mask;
 }
 
-static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
+static int ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
 {
         u8 dest = ioapic->redirtbl[irq].fields.dest_id;
         u8 dest_mode = ioapic->redirtbl[irq].fields.dest_mode;
@@ -195,7 +195,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
         u8 trig_mode = ioapic->redirtbl[irq].fields.trig_mode;
         u32 deliver_bitmask;
         struct kvm_vcpu *vcpu;
-        int vcpu_id;
+        int vcpu_id, r = 0;
 
         ioapic_debug("dest=%x dest_mode=%x delivery_mode=%x "
                      "vector=%x trig_mode=%x\n",
@@ -204,7 +204,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
         deliver_bitmask = ioapic_get_delivery_bitmask(ioapic, dest, dest_mode);
         if (!deliver_bitmask) {
                 ioapic_debug("no target on destination\n");
-                return;
+                return 0;
         }
 
         switch (delivery_mode) {
@@ -216,7 +216,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
                         vcpu = ioapic->kvm->vcpus[0];
 #endif
                 if (vcpu != NULL)
-                        ioapic_inj_irq(ioapic, vcpu, vector,
+                        r = ioapic_inj_irq(ioapic, vcpu, vector,
                                        trig_mode, delivery_mode);
                 else
                         ioapic_debug("null lowest prio vcpu: "
@@ -234,7 +234,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
                         deliver_bitmask &= ~(1 << vcpu_id);
                         vcpu = ioapic->kvm->vcpus[vcpu_id];
                         if (vcpu) {
-                                ioapic_inj_irq(ioapic, vcpu, vector,
+                                r = ioapic_inj_irq(ioapic, vcpu, vector,
                                                trig_mode, delivery_mode);
                         }
                 }
@@ -246,6 +246,7 @@ static void ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
                        delivery_mode);
                 break;
         }
+        return r;
 }
 
 void kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)