209 files changed, 1842 insertions, 1372 deletions
diff --git a/.gitignore b/.gitignore
index 9bb1cb6d825d..869e1a3b64b6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,10 @@
 # subdirectories here. Add them in the ".gitignore" file
 # in that subdirectory instead.
 #
+# NOTE! Please use 'git-ls-files -i --exclude-standard'
+# command after changing this file, to see if there are
+# any tracked files which get ignored after the change.
+#
 # Normal rules
 #
 .*
@@ -18,19 +22,21 @@
 *.lst
 *.symtypes
 *.order
+*.elf
+*.bin
+*.gz
 #
 # Top-level generic files
 #
 tags
 TAGS
-vmlinux*
+vmlinux
-!vmlinux.lds.S
-!vmlinux.lds.h
 System.map
 Module.markers
 Module.symvers
 !.gitignore
+!.mailmap
 #
 # Generated include files
diff --git a/Documentation/DocBook/kgdb.tmpl b/Documentation/DocBook/kgdb.tmpl
index 028a8444d95e..e8acd1f03456 100644
--- a/Documentation/DocBook/kgdb.tmpl
+++ b/Documentation/DocBook/kgdb.tmpl
@@ -84,10 +84,9 @@
    runs an instance of gdb against the vmlinux file which contains
    the symbols (not boot image such as bzImage, zImage, uImage...).
    In gdb the developer specifies the connection parameters and
-    connects to kgdb.  Depending on which kgdb I/O modules exist in
+    connects to kgdb.  The type of connection a developer makes with
-    the kernel for a given architecture, it may be possible to debug
+    gdb depends on the availability of kgdb I/O modules compiled as
-    the test machine's kernel with the development machine using a
+    builtin's or kernel modules in the test machine's kernel.
-    rs232 or ethernet connection.
    </para>
  </chapter>
  <chapter id="CompilingAKernel">
@@ -223,7 +222,7 @@
  </para>
  <para>
  IMPORTANT NOTE: Using this option with kgdb over the console
-  (kgdboc) or kgdb over ethernet (kgdboe) is not supported.
+  (kgdboc) is not supported.
  </para>
  </sect1>
  </chapter>
@@ -249,18 +248,11 @@
    (gdb) target remote /dev/ttyS0
    </programlisting>
    <para>
-    Example (kgdb to a terminal server):
+    Example (kgdb to a terminal server on tcp port 2012):
    </para>
    <programlisting>
    % gdb ./vmlinux
-    (gdb) target remote udp:192.168.2.2:6443
+    (gdb) target remote 192.168.2.2:2012
-    </programlisting>
-    <para>
-    Example (kgdb over ethernet):
-    </para>
-    <programlisting>
-    % gdb ./vmlinux
-    (gdb) target remote udp:192.168.2.2:6443
    </programlisting>
    <para>
    Once connected, you can debug a kernel the way you would debug an
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 5b3f31faed56..46ece3fba6f9 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -312,3 +312,12 @@ When:	2.6.26
 Why:    Implementation became generic; users should now include
        linux/semaphore.h instead.
 Who:    Matthew Wilcox <willy@linux.intel.com>
+---------------------------
+What:   CONFIG_THERMAL_HWMON
+When:   January 2009
+Why:    This option was introduced just to allow older lm-sensors userspace
+        to keep working over the upgrade to 2.6.26. At the scheduled time of
+        removal fixed lm-sensors (2.x or 3.x) should be readily available.
+Who:    Rene Herman <rene.herman@gmail.com>
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 17a6e46fbd43..17f1f91af35c 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -81,23 +81,23 @@ inet_peer_minttl - INTEGER
        Minimum time-to-live of entries.  Should be enough to cover fragment
        time-to-live on the reassembling side.  This minimum time-to-live  is
        guaranteed if the pool size is less than inet_peer_threshold.
-        Measured in jiffies(1).
+        Measured in seconds.
 inet_peer_maxttl - INTEGER
        Maximum time-to-live of entries.  Unused entries will expire after
        this period of time if there is no memory pressure on the pool (i.e.
        when the number of entries in the pool is very small).
-        Measured in jiffies(1).
+        Measured in seconds.
 inet_peer_gc_mintime - INTEGER
        Minimum interval between garbage collection passes.  This interval is
        in effect under high memory pressure on the pool.
-        Measured in jiffies(1).
+        Measured in seconds.
 inet_peer_gc_maxtime - INTEGER
        Minimum interval between garbage collection passes.  This interval is
        in effect under low (or absent) memory pressure on the pool.
-        Measured in jiffies(1).
+        Measured in seconds.
 TCP variables: 
@@ -794,10 +794,6 @@ tag - INTEGER
        Allows you to write a number, which can be used as required.
        Default value is 0.
-(1) Jiffie: internal timeunit for the kernel. On the i386 1/100s, on the
-Alpha 1/1024s. See the HZ define in /usr/include/asm/param.h for the exact
-value on your system. 
 Alexey Kuznetsov.
 kuznet@ms2.inr.ac.ru
diff --git a/Documentation/networking/s2io.txt b/Documentation/networking/s2io.txt
index 4bde53e85f3f..1e28e2ddb90a 100644
--- a/Documentation/networking/s2io.txt
+++ b/Documentation/networking/s2io.txt
@@ -83,9 +83,9 @@ Valid range: Limited by memory on system
 Default: 30 
 e. intr_type
-Specifies interrupt type. Possible values 1(INTA), 2(MSI), 3(MSI-X)
+Specifies interrupt type. Possible values 0(INTA), 2(MSI-X)
-Valid range: 1-3
+Valid values: 0, 2
-Default: 1 
+Default: 2
 5.  Performance suggestions
 General:
diff --git a/Documentation/video4linux/CARDLIST.au0828 b/Documentation/video4linux/CARDLIST.au0828
index aaae360312e4..86d1c8e7b18f 100644
--- a/Documentation/video4linux/CARDLIST.au0828
+++ b/Documentation/video4linux/CARDLIST.au0828
@@ -1,4 +1,4 @@
  0 -> Unknown board                            (au0828)
-  1 -> Hauppauge HVR950Q                        (au0828)        [2040:7200]
+  1 -> Hauppauge HVR950Q                        (au0828)        [2040:7200,2040:7210,2040:7217,2040:721b,2040:721f,2040:7280,0fd9:0008]
  2 -> Hauppauge HVR850                         (au0828)        [2040:7240]
  3 -> DViCO FusionHDTV USB                     (au0828)        [0fe9:d620]
diff --git a/Makefile b/Makefile
index 2b4977c9844e..6aff5f47c21d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 26
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc8
 NAME = Rotary Wombat
 # *DOCUMENTATION*
diff --git a/arch/blackfin/kernel/cplb-nompu/cplbinit.c b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
index 917325bfbd84..6be0c50122e8 100644
--- a/arch/blackfin/kernel/cplb-nompu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
@@ -254,7 +254,8 @@ close_cplbtab(struct cplb_tab *table)
 }
 /* helper function */
-static void __fill_code_cplbtab(struct cplb_tab *t, int i, u32 a_start, u32 a_end)
+static void __init
+__fill_code_cplbtab(struct cplb_tab *t, int i, u32 a_start, u32 a_end)
 {
        if (cplb_data[i].psize) {
                fill_cplbtab(t,
@@ -291,7 +292,8 @@ static void __fill_code_cplbtab(struct cplb_tab *t, int i, u32 a_start, u32 a_en
        }
 }
-static void __fill_data_cplbtab(struct cplb_tab *t, int i, u32 a_start, u32 a_end)
+static void __init
+__fill_data_cplbtab(struct cplb_tab *t, int i, u32 a_start, u32 a_end)
 {
        if (cplb_data[i].psize) {
                fill_cplbtab(t,
diff --git a/arch/blackfin/kernel/irqchip.c b/arch/blackfin/kernel/irqchip.c
index 73647c158774..07402f57c9de 100644
--- a/arch/blackfin/kernel/irqchip.c
+++ b/arch/blackfin/kernel/irqchip.c
@@ -60,9 +60,14 @@ static struct irq_chip bad_chip = {
 };
 static struct irq_desc bad_irq_desc = {
+        .status = IRQ_DISABLED,
        .chip = &bad_chip,
        .handle_irq = handle_bad_irq,
        .depth = 1,
+        .lock = __SPIN_LOCK_UNLOCKED(irq_desc->lock),
+#ifdef CONFIG_SMP
+        .affinity = CPU_MASK_ALL
+#endif
 };
 int show_interrupts(struct seq_file *p, void *v)
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 082c31dcfd99..39752cdef6ff 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -558,8 +558,6 @@ static struct iosapic_rte_info * __init_refok iosapic_alloc_rte (void)
        if (!iosapic_kmalloc_ok && list_empty(&free_rte_list)) {
                rte = alloc_bootmem(sizeof(struct iosapic_rte_info) *
                                    NR_PREALLOCATE_RTE_ENTRIES);
-                if (!rte)
-                        return NULL;
                for (i = 0; i < NR_PREALLOCATE_RTE_ENTRIES; i++, rte++)
                        list_add(&rte->rte_list, &free_rte_list);
        }
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index f48a809c686d..4ae15c8c2488 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -578,8 +578,6 @@ setup_arch (char **cmdline_p)
        cpu_init();     /* initialize the bootstrap CPU */
        mmu_context_init();     /* initialize context_id bitmap */
-        check_sal_cache_flush();
 #ifdef CONFIG_ACPI
        acpi_boot_init();
 #endif
@@ -607,6 +605,7 @@ setup_arch (char **cmdline_p)
                ia64_mca_init();
        platform_setup(cmdline_p);
+        check_sal_cache_flush();
        paging_init();
 }
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
index 6dd886c5d860..e585f9a2afb9 100644
--- a/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -512,7 +512,7 @@ static ssize_t sn2_ptc_proc_write(struct file *file, const char __user *user, si
        int cpu;
        char optstr[64];
-        if (count > sizeof(optstr))
+        if (count == 0 || count > sizeof(optstr))
                return -EINVAL;
        if (copy_from_user(optstr, user, count))
                return -EFAULT;
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 1cee2f9fdf06..095e04db1c0e 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -273,7 +273,8 @@ endif
 initrd-  := $(patsubst zImage%, zImage.initrd%, $(image-n) $(image-))
 initrd-y := $(patsubst zImage%, zImage.initrd%, \
                $(patsubst dtbImage%, dtbImage.initrd%, \
-                $(patsubst treeImage%, treeImage.initrd%, $(image-y))))
+                $(patsubst simpleImage%, simpleImage.initrd%, \
+                $(patsubst treeImage%, treeImage.initrd%, $(image-y)))))
 initrd-y := $(filter-out $(image-y), $(initrd-y))
 targets += $(image-y) $(initrd-y)
diff --git a/arch/powerpc/kernel/legacy_serial.c b/arch/powerpc/kernel/legacy_serial.c
index 61dd17449ddc..cf37f5ca4b71 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -136,6 +136,11 @@ static int __init add_legacy_soc_port(struct device_node *np,
        if (of_get_property(np, "clock-frequency", NULL) == NULL)
                return -1;
+        /* if reg-shift or offset, don't try to use it */
+        if ((of_get_property(np, "reg-shift", NULL) != NULL) ||
+                (of_get_property(np, "reg-offset", NULL) != NULL))
+                return -1;
        /* if rtas uses this device, don't try to use it as well */
        if (of_get_property(np, "used-by-rtas", NULL) != NULL)
                return -1;
diff --git a/arch/powerpc/platforms/52xx/lite5200_pm.c b/arch/powerpc/platforms/52xx/lite5200_pm.c
index 41c7fd91e99e..fe92e65103ed 100644
--- a/arch/powerpc/platforms/52xx/lite5200_pm.c
+++ b/arch/powerpc/platforms/52xx/lite5200_pm.c
@@ -14,6 +14,7 @@ static struct mpc52xx_sdma __iomem *bes;
 static struct mpc52xx_xlb __iomem *xlb;
 static struct mpc52xx_gpio __iomem *gps;
 static struct mpc52xx_gpio_wkup __iomem *gpw;
+static void __iomem *pci;
 static void __iomem *sram;
 static const int sram_size = 0x4000;    /* 16 kBytes */
 static void __iomem *mbar;
@@ -50,6 +51,8 @@ static int lite5200_pm_prepare(void)
                { .type = "builtin", .compatible = "mpc5200", }, /* efika */
                {}
        };
+        u64 regaddr64 = 0;
+        const u32 *regaddr_p;
        /* deep sleep? let mpc52xx code handle that */
        if (lite5200_pm_target_state == PM_SUSPEND_STANDBY)
@@ -60,8 +63,12 @@ static int lite5200_pm_prepare(void)
        /* map registers */
        np = of_find_matching_node(NULL, immr_ids);
-        mbar = of_iomap(np, 0);
+        regaddr_p = of_get_address(np, 0, NULL, NULL);
+        if (regaddr_p)
+                regaddr64 = of_translate_address(np, regaddr_p);
        of_node_put(np);
+        mbar = ioremap((u32) regaddr64, 0xC000);
        if (!mbar) {
                printk(KERN_ERR "%s:%i Error mapping registers\n", __func__, __LINE__);
                return -ENOSYS;
@@ -71,6 +78,7 @@ static int lite5200_pm_prepare(void)
        pic = mbar + 0x500;
        gps = mbar + 0xb00;
        gpw = mbar + 0xc00;
+        pci = mbar + 0xd00;
        bes = mbar + 0x1200;
        xlb = mbar + 0x1f00;
        sram = mbar + 0x8000;
@@ -85,6 +93,7 @@ static struct mpc52xx_sdma sbes;
 static struct mpc52xx_xlb sxlb;
 static struct mpc52xx_gpio sgps;
 static struct mpc52xx_gpio_wkup sgpw;
+static char spci[0x200];
 static void lite5200_save_regs(void)
 {
@@ -94,6 +103,7 @@ static void lite5200_save_regs(void)
        _memcpy_fromio(&sxlb, xlb, sizeof(*xlb));
        _memcpy_fromio(&sgps, gps, sizeof(*gps));
        _memcpy_fromio(&sgpw, gpw, sizeof(*gpw));
+        _memcpy_fromio(spci, pci, 0x200);
        _memcpy_fromio(saved_sram, sram, sram_size);
 }
@@ -103,6 +113,8 @@ static void lite5200_restore_regs(void)
        int i;
        _memcpy_toio(sram, saved_sram, sram_size);
+        /* PCI Configuration */
+        _memcpy_toio(pci, spci, 0x200);
        /*
         * GPIOs. Interrupt Master Enable has higher address then other
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 52e18e6d2ba0..bf07b6f50fa1 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -383,6 +383,7 @@ config VMI
 config KVM_CLOCK
        bool "KVM paravirtualized clock"
        select PARAVIRT
+        select PARAVIRT_CLOCK
        depends on !(X86_VISWS || X86_VOYAGER)
        help
          Turning on this option will allow you to run a paravirtualized clock
@@ -410,6 +411,10 @@ config PARAVIRT
          over full virtualization.  However, when run without a hypervisor
          the kernel is theoretically slower and slightly larger.
+config PARAVIRT_CLOCK
+        bool
+        default n
 endif
 config MEMTEST_BOOTPARAM
@@ -961,8 +966,8 @@ config NUMA_EMU
          number of nodes. This is only useful for debugging.
 config NODES_SHIFT
-        int "Max num nodes shift(1-15)"
+        int "Max num nodes shift(1-9)"
-        range 1 15  if X86_64
+        range 1 9  if X86_64
        default "6" if X86_64
        default "4" if X86_NUMAQ
        default "3"
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 5e618c3b4720..77807d4769c9 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -82,6 +82,7 @@ obj-$(CONFIG_VMI)		+= vmi_32.o vmiclock_32.o
 obj-$(CONFIG_KVM_GUEST)         += kvm.o
 obj-$(CONFIG_KVM_CLOCK)         += kvmclock.o
 obj-$(CONFIG_PARAVIRT)          += paravirt.o paravirt_patch_$(BITS).o
+obj-$(CONFIG_PARAVIRT_CLOCK)    += pvclock.o
 obj-$(CONFIG_PCSPKR_PLATFORM)   += pcspeaker.o
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index eb9ddd8efb82..95e80e5033c3 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -162,7 +162,7 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
        int ret;
        if (!cpu_has_fxsr)
-                return -ENODEV;
+                return -EIO;
        ret = init_fpu(target);
        if (ret)
@@ -179,7 +179,7 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
        int ret;
        if (!cpu_has_fxsr)
-                return -ENODEV;
+                return -EIO;
        ret = init_fpu(target);
        if (ret)
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 08a30986d472..87edf1ceb1df 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -18,6 +18,7 @@
 #include <linux/clocksource.h>
 #include <linux/kvm_para.h>
+#include <asm/pvclock.h>
 #include <asm/arch_hooks.h>
 #include <asm/msr.h>
 #include <asm/apic.h>
@@ -36,18 +37,9 @@ static int parse_no_kvmclock(char *arg)
 early_param("no-kvmclock", parse_no_kvmclock);
 /* The hypervisor will put information about time periodically here */
-static DEFINE_PER_CPU_SHARED_ALIGNED(struct kvm_vcpu_time_info, hv_clock);
+static DEFINE_PER_CPU_SHARED_ALIGNED(struct pvclock_vcpu_time_info, hv_clock);
-#define get_clock(cpu, field) per_cpu(hv_clock, cpu).field
+static struct pvclock_wall_clock wall_clock;
-static inline u64 kvm_get_delta(u64 last_tsc)
-{
-        int cpu = smp_processor_id();
-        u64 delta = native_read_tsc() - last_tsc;
-        return (delta * get_clock(cpu, tsc_to_system_mul)) >> KVM_SCALE;
-}
-static struct kvm_wall_clock wall_clock;
-static cycle_t kvm_clock_read(void);
 /*
 * The wallclock is the time of day when we booted. Since then, some time may
 * have elapsed since the hypervisor wrote the data. So we try to account for
@@ -55,64 +47,37 @@ static cycle_t kvm_clock_read(void);
 */
 static unsigned long kvm_get_wallclock(void)
 {
-        u32 wc_sec, wc_nsec;
+        struct pvclock_vcpu_time_info *vcpu_time;
-        u64 delta;
        struct timespec ts;
-        int version, nsec;
        int low, high;
        low = (int)__pa(&wall_clock);
        high = ((u64)__pa(&wall_clock) >> 32);
+        native_write_msr(MSR_KVM_WALL_CLOCK, low, high);
-        delta = kvm_clock_read();
+        vcpu_time = &get_cpu_var(hv_clock);
+        pvclock_read_wallclock(&wall_clock, vcpu_time, &ts);
+        put_cpu_var(hv_clock);
-        native_write_msr(MSR_KVM_WALL_CLOCK, low, high);
+        return ts.tv_sec;
-        do {
-                version = wall_clock.wc_version;
-                rmb();
-                wc_sec = wall_clock.wc_sec;
-                wc_nsec = wall_clock.wc_nsec;
-                rmb();
-        } while ((wall_clock.wc_version != version) || (version & 1));
-        delta = kvm_clock_read() - delta;
-        delta += wc_nsec;
-        nsec = do_div(delta, NSEC_PER_SEC);
-        set_normalized_timespec(&ts, wc_sec + delta, nsec);
-        /*
-         * Of all mechanisms of time adjustment I've tested, this one
-         * was the champion!
-         */
-        return ts.tv_sec + 1;
 }
 static int kvm_set_wallclock(unsigned long now)
 {
-        return 0;
+        return -1;
 }
-/*
- * This is our read_clock function. The host puts an tsc timestamp each time
- * it updates a new time. Without the tsc adjustment, we can have a situation
- * in which a vcpu starts to run earlier (smaller system_time), but probes
- * time later (compared to another vcpu), leading to backwards time
- */
 static cycle_t kvm_clock_read(void)
 {
-        u64 last_tsc, now;
+        struct pvclock_vcpu_time_info *src;
-        int cpu;
+        cycle_t ret;
-        preempt_disable();
+        src = &get_cpu_var(hv_clock);
-        cpu = smp_processor_id();
+        ret = pvclock_clocksource_read(src);
+        put_cpu_var(hv_clock);
-        last_tsc = get_clock(cpu, tsc_timestamp);
+        return ret;
-        now = get_clock(cpu, system_time);
-        now += kvm_get_delta(last_tsc);
-        preempt_enable();
-        return now;
 }
 static struct clocksource kvm_clock = {
        .name = "kvm-clock",
        .read = kvm_clock_read,
@@ -123,13 +88,14 @@ static struct clocksource kvm_clock = {
        .flags = CLOCK_SOURCE_IS_CONTINUOUS,
 };
-static int kvm_register_clock(void)
+static int kvm_register_clock(char *txt)
 {
        int cpu = smp_processor_id();
        int low, high;
        low = (int)__pa(&per_cpu(hv_clock, cpu)) | 1;
        high = ((u64)__pa(&per_cpu(hv_clock, cpu)) >> 32);
+        printk(KERN_INFO "kvm-clock: cpu %d, msr %x:%x, %s\n",
+               cpu, high, low, txt);
        return native_write_msr_safe(MSR_KVM_SYSTEM_TIME, low, high);
 }
@@ -140,12 +106,20 @@ static void kvm_setup_secondary_clock(void)
         * Now that the first cpu already had this clocksource initialized,
         * we shouldn't fail.
         */
-        WARN_ON(kvm_register_clock());
+        WARN_ON(kvm_register_clock("secondary cpu clock"));
        /* ok, done with our trickery, call native */
        setup_secondary_APIC_clock();
 }
 #endif
+#ifdef CONFIG_SMP
+void __init kvm_smp_prepare_boot_cpu(void)
+{
+        WARN_ON(kvm_register_clock("primary cpu clock"));
+        native_smp_prepare_boot_cpu();
+}
+#endif
 /*
 * After the clock is registered, the host will keep writing to the
 * registered memory location. If the guest happens to shutdown, this memory
@@ -174,7 +148,7 @@ void __init kvmclock_init(void)
                return;
        if (kvmclock && kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) {
-                if (kvm_register_clock())
+                if (kvm_register_clock("boot clock"))
                        return;
                pv_time_ops.get_wallclock = kvm_get_wallclock;
                pv_time_ops.set_wallclock = kvm_set_wallclock;
@@ -182,6 +156,9 @@ void __init kvmclock_init(void)
 #ifdef CONFIG_X86_LOCAL_APIC
                pv_apic_ops.setup_secondary_clock = kvm_setup_secondary_clock;
 #endif
+#ifdef CONFIG_SMP
+                smp_ops.smp_prepare_boot_cpu = kvm_smp_prepare_boot_cpu;
+#endif
                machine_ops.shutdown  = kvm_shutdown;
 #ifdef CONFIG_KEXEC
                machine_ops.crash_shutdown  = kvm_crash_shutdown;
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
new file mode 100644
index 000000000000..05fbe9a0325a
--- /dev/null
+++ b/arch/x86/kernel/pvclock.c
@@ -0,0 +1,141 @@
+/*  paravirtual clock -- common code used by kvm/xen
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+#include <linux/kernel.h>
+#include <linux/percpu.h>
+#include <asm/pvclock.h>
+/*
+ * These are perodically updated
+ *    xen: magic shared_info page
+ *    kvm: gpa registered via msr
+ * and then copied here.
+ */
+struct pvclock_shadow_time {
+        u64 tsc_timestamp;     /* TSC at last update of time vals.  */
+        u64 system_timestamp;  /* Time, in nanosecs, since boot.    */
+        u32 tsc_to_nsec_mul;
+        int tsc_shift;
+        u32 version;
+};
+/*
+ * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction,
+ * yielding a 64-bit result.
+ */
+static inline u64 scale_delta(u64 delta, u32 mul_frac, int shift)
+{
+        u64 product;
+#ifdef __i386__
+        u32 tmp1, tmp2;
+#endif
+        if (shift < 0)
+                delta >>= -shift;
+        else
+                delta <<= shift;
+#ifdef __i386__
+        __asm__ (
+                "mul  %5       ; "
+                "mov  %4,%%eax ; "
+                "mov  %%edx,%4 ; "
+                "mul  %5       ; "
+                "xor  %5,%5    ; "
+                "add  %4,%%eax ; "
+                "adc  %5,%%edx ; "
+                : "=A" (product), "=r" (tmp1), "=r" (tmp2)
+                : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
+#elif __x86_64__
+        __asm__ (
+                "mul %%rdx ; shrd $32,%%rdx,%%rax"
+                : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
+#else
+#error implement me!
+#endif
+        return product;
+}
+static u64 pvclock_get_nsec_offset(struct pvclock_shadow_time *shadow)
+{
+        u64 delta = native_read_tsc() - shadow->tsc_timestamp;
+        return scale_delta(delta, shadow->tsc_to_nsec_mul, shadow->tsc_shift);
+}
+/*
+ * Reads a consistent set of time-base values from hypervisor,
+ * into a shadow data area.
+ */
+static unsigned pvclock_get_time_values(struct pvclock_shadow_time *dst,
+                                        struct pvclock_vcpu_time_info *src)
+{
+        do {
+                dst->version = src->version;
+                rmb();          /* fetch version before data */
+                dst->tsc_timestamp     = src->tsc_timestamp;
+                dst->system_timestamp  = src->system_time;
+                dst->tsc_to_nsec_mul   = src->tsc_to_system_mul;
+                dst->tsc_shift         = src->tsc_shift;
+                rmb();          /* test version after fetching data */
+        } while ((src->version & 1) || (dst->version != src->version));
+        return dst->version;
+}
+cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
+{
+        struct pvclock_shadow_time shadow;
+        unsigned version;
+        cycle_t ret, offset;
+        do {
+                version = pvclock_get_time_values(&shadow, src);
+                barrier();
+                offset = pvclock_get_nsec_offset(&shadow);
+                ret = shadow.system_timestamp + offset;
+                barrier();
+        } while (version != src->version);
+        return ret;
+}
+void pvclock_read_wallclock(struct pvclock_wall_clock *wall_clock,
+                            struct pvclock_vcpu_time_info *vcpu_time,
+                            struct timespec *ts)
+{
+        u32 version;
+        u64 delta;
+        struct timespec now;
+        /* get wallclock at system boot */
+        do {
+                version = wall_clock->version;
+                rmb();          /* fetch version before time */
+                now.tv_sec  = wall_clock->sec;
+                now.tv_nsec = wall_clock->nsec;
+                rmb();          /* fetch time before checking version */
+        } while ((wall_clock->version & 1) || (version != wall_clock->version));
+        delta = pvclock_clocksource_read(vcpu_time);    /* time since system boot */
+        delta += now.tv_sec * (u64)NSEC_PER_SEC + now.tv_nsec;
+        now.tv_nsec = do_div(delta, NSEC_PER_SEC);
+        now.tv_sec = delta;
+        set_normalized_timespec(ts, now.tv_sec, now.tv_nsec);
+}
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 56078d61c793..3e1cecedde42 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -996,7 +996,6 @@ do_rest:
 #endif
                cpu_clear(cpu, cpu_callout_map); /* was set by do_boot_cpu() */
                cpu_clear(cpu, cpu_initialized); /* was set by cpu_init() */
-                cpu_clear(cpu, cpu_possible_map);
                cpu_clear(cpu, cpu_present_map);
                per_cpu(x86_cpu_to_apicid, cpu) = BAD_APICID;
        }
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index f2f5d260874e..3829aa7b663f 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -200,9 +200,12 @@ int __pit_timer_fn(struct kvm_kpit_state *ps)
        atomic_inc(&pt->pending);
        smp_mb__after_atomic_inc();
-        if (vcpu0 && waitqueue_active(&vcpu0->wq)) {
+        if (vcpu0) {
-                vcpu0->arch.mp_state = KVM_MP_STATE_RUNNABLE;
+                set_bit(KVM_REQ_PENDING_TIMER, &vcpu0->requests);
-                wake_up_interruptible(&vcpu0->wq);
+                if (waitqueue_active(&vcpu0->wq)) {
+                        vcpu0->arch.mp_state = KVM_MP_STATE_RUNNABLE;
+                        wake_up_interruptible(&vcpu0->wq);
+                }
        }
        pt->timer.expires = ktime_add_ns(pt->timer.expires, pt->period);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index c297c50eba63..ebc03f5ae162 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -940,6 +940,7 @@ static int __apic_timer_fn(struct kvm_lapic *apic)
        wait_queue_head_t *q = &apic->vcpu->wq;
        atomic_inc(&apic->timer.pending);
+        set_bit(KVM_REQ_PENDING_TIMER, &apic->vcpu->requests);
        if (waitqueue_active(q)) {
                apic->vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
                wake_up_interruptible(q);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index ee3f53098f0c..7e7c3969f7a2 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -640,6 +640,7 @@ static void rmap_write_protect(struct kvm *kvm, u64 gfn)
                        rmap_remove(kvm, spte);
                        --kvm->stat.lpages;
                        set_shadow_pte(spte, shadow_trap_nonpresent_pte);
+                        spte = NULL;
                        write_protected = 1;
                }
                spte = rmap_next(kvm, rmapp, spte);
@@ -1082,10 +1083,6 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *shadow_pte,
                struct kvm_mmu_page *shadow;
                spte |= PT_WRITABLE_MASK;
-                if (user_fault) {
-                        mmu_unshadow(vcpu->kvm, gfn);
-                        goto unshadowed;
-                }
                shadow = kvm_mmu_lookup_page(vcpu->kvm, gfn);
                if (shadow ||
@@ -1102,8 +1099,6 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *shadow_pte,
                }
        }
-unshadowed:
        if (pte_access & ACC_WRITE_MASK)
                mark_page_dirty(vcpu->kvm, gfn);
@@ -1580,11 +1575,13 @@ static void mmu_pte_write_new_pte(struct kvm_vcpu *vcpu,
                                  u64 *spte,
                                  const void *new)
 {
-        if ((sp->role.level != PT_PAGE_TABLE_LEVEL)
+        if (sp->role.level != PT_PAGE_TABLE_LEVEL) {
-            && !vcpu->arch.update_pte.largepage) {
+                if (!vcpu->arch.update_pte.largepage ||
-                ++vcpu->kvm->stat.mmu_pde_zapped;
+                    sp->role.glevels == PT32_ROOT_LEVEL) {
-                return;
+                        ++vcpu->kvm->stat.mmu_pde_zapped;
-        }
+                        return;
+                }
+        }
        ++vcpu->kvm->stat.mmu_pte_updated;
        if (sp->role.glevels == PT32_ROOT_LEVEL)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 02efbe75f317..540e95179074 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -566,7 +566,7 @@ static void vmx_save_host_state(struct kvm_vcpu *vcpu)
        load_transition_efer(vmx);
 }
-static void vmx_load_host_state(struct vcpu_vmx *vmx)
+static void __vmx_load_host_state(struct vcpu_vmx *vmx)
 {
        unsigned long flags;
@@ -596,6 +596,13 @@ static void vmx_load_host_state(struct vcpu_vmx *vmx)
        reload_host_efer(vmx);
 }
+static void vmx_load_host_state(struct vcpu_vmx *vmx)
+{
+        preempt_disable();
+        __vmx_load_host_state(vmx);
+        preempt_enable();
+}
 /*
 * Switches to specified vcpu, until a matching vcpu_put(), but assumes
 * vcpu mutex is already taken.
@@ -654,7 +661,7 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
 {
-        vmx_load_host_state(to_vmx(vcpu));
+        __vmx_load_host_state(to_vmx(vcpu));
 }
 static void vmx_fpu_activate(struct kvm_vcpu *vcpu)
@@ -884,11 +891,8 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
        switch (msr_index) {
 #ifdef CONFIG_X86_64
        case MSR_EFER:
+                vmx_load_host_state(vmx);
                ret = kvm_set_msr_common(vcpu, msr_index, data);
-                if (vmx->host_state.loaded) {
-                        reload_host_efer(vmx);
-                        load_transition_efer(vmx);
-                }
                break;
        case MSR_FS_BASE:
                vmcs_writel(GUEST_FS_BASE, data);
@@ -910,11 +914,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
                guest_write_tsc(data);
                break;
        default:
+                vmx_load_host_state(vmx);
                msr = find_msr_entry(vmx, msr_index);
                if (msr) {
                        msr->data = data;
-                        if (vmx->host_state.loaded)
-                                load_msrs(vmx->guest_msrs, vmx->save_nmsrs);
                        break;
                }
                ret = kvm_set_msr_common(vcpu, msr_index, data);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 00acf1301a15..63a77caa59f1 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -492,8 +492,8 @@ static int do_set_msr(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
 static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
 {
        static int version;
-        struct kvm_wall_clock wc;
+        struct pvclock_wall_clock wc;
-        struct timespec wc_ts;
+        struct timespec now, sys, boot;
        if (!wall_clock)
                return;
@@ -502,10 +502,19 @@ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
        kvm_write_guest(kvm, wall_clock, &version, sizeof(version));
-        wc_ts = current_kernel_time();
+        /*
-        wc.wc_sec = wc_ts.tv_sec;
+         * The guest calculates current wall clock time by adding
-        wc.wc_nsec = wc_ts.tv_nsec;
+         * system time (updated by kvm_write_guest_time below) to the
-        wc.wc_version = version;
+         * wall clock specified here.  guest system time equals host
+         * system time for us, thus we must fill in host boot time here.
+         */
+        now = current_kernel_time();
+        ktime_get_ts(&sys);
+        boot = ns_to_timespec(timespec_to_ns(&now) - timespec_to_ns(&sys));
+        wc.sec = boot.tv_sec;
+        wc.nsec = boot.tv_nsec;
+        wc.version = version;
        kvm_write_guest(kvm, wall_clock, &wc, sizeof(wc));
@@ -513,6 +522,45 @@ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
        kvm_write_guest(kvm, wall_clock, &version, sizeof(version));
 }
+static uint32_t div_frac(uint32_t dividend, uint32_t divisor)
+{
+        uint32_t quotient, remainder;
+        /* Don't try to replace with do_div(), this one calculates
+         * "(dividend << 32) / divisor" */
+        __asm__ ( "divl %4"
+                  : "=a" (quotient), "=d" (remainder)
+                  : "0" (0), "1" (dividend), "r" (divisor) );
+        return quotient;
+}
+static void kvm_set_time_scale(uint32_t tsc_khz, struct pvclock_vcpu_time_info *hv_clock)
+{
+        uint64_t nsecs = 1000000000LL;
+        int32_t  shift = 0;
+        uint64_t tps64;
+        uint32_t tps32;
+        tps64 = tsc_khz * 1000LL;
+        while (tps64 > nsecs*2) {
+                tps64 >>= 1;
+                shift--;
+        }
+        tps32 = (uint32_t)tps64;
+        while (tps32 <= (uint32_t)nsecs) {
+                tps32 <<= 1;
+                shift++;
+        }
+        hv_clock->tsc_shift = shift;
+        hv_clock->tsc_to_system_mul = div_frac(nsecs, tps32);
+        pr_debug("%s: tsc_khz %u, tsc_shift %d, tsc_mul %u\n",
+                 __FUNCTION__, tsc_khz, hv_clock->tsc_shift,
+                 hv_clock->tsc_to_system_mul);
+}
 static void kvm_write_guest_time(struct kvm_vcpu *v)
 {
        struct timespec ts;
@@ -523,6 +571,11 @@ static void kvm_write_guest_time(struct kvm_vcpu *v)
        if ((!vcpu->time_page))
                return;
+        if (unlikely(vcpu->hv_clock_tsc_khz != tsc_khz)) {
+                kvm_set_time_scale(tsc_khz, &vcpu->hv_clock);
+                vcpu->hv_clock_tsc_khz = tsc_khz;
+        }
        /* Keep irq disabled to prevent changes to the clock */
        local_irq_save(flags);
        kvm_get_msr(v, MSR_IA32_TIME_STAMP_COUNTER,
@@ -537,14 +590,14 @@ static void kvm_write_guest_time(struct kvm_vcpu *v)
        /*
         * The interface expects us to write an even number signaling that the
         * update is finished. Since the guest won't see the intermediate
-         * state, we just write "2" at the end
+         * state, we just increase by 2 at the end.
         */
-        vcpu->hv_clock.version = 2;
+        vcpu->hv_clock.version += 2;
        shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0);
        memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
-                sizeof(vcpu->hv_clock));
+               sizeof(vcpu->hv_clock));
        kunmap_atomic(shared_kaddr, KM_USER0);
@@ -599,10 +652,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
                /* ...but clean it before doing the actual write */
                vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-                vcpu->arch.hv_clock.tsc_to_system_mul =
-                                        clocksource_khz2mult(tsc_khz, 22);
-                vcpu->arch.hv_clock.tsc_shift = 22;
                down_read(&current->mm->mmap_sem);
                vcpu->arch.time_page =
                                gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
@@ -2759,6 +2808,8 @@ again:
        if (vcpu->requests) {
                if (test_and_clear_bit(KVM_REQ_MIGRATE_TIMER, &vcpu->requests))
                        __kvm_migrate_timers(vcpu);
+                if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
+                        kvm_x86_ops->tlb_flush(vcpu);
                if (test_and_clear_bit(KVM_REQ_REPORT_TPR_ACCESS,
                                       &vcpu->requests)) {
                        kvm_run->exit_reason = KVM_EXIT_TPR_ACCESS;
@@ -2772,6 +2823,7 @@ again:
                }
        }
+        clear_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests);
        kvm_inject_pending_timer_irqs(vcpu);
        preempt_disable();
@@ -2781,21 +2833,13 @@ again:
        local_irq_disable();
-        if (need_resched()) {
+        if (vcpu->requests || need_resched()) {
                local_irq_enable();
                preempt_enable();
                r = 1;
                goto out;
        }
-        if (vcpu->requests)
-                if (test_bit(KVM_REQ_MMU_RELOAD, &vcpu->requests)) {
-                        local_irq_enable();
-                        preempt_enable();
-                        r = 1;
-                        goto out;
-                }
        if (signal_pending(current)) {
                local_irq_enable();
                preempt_enable();
@@ -2825,9 +2869,6 @@ again:
        kvm_guest_enter();
-        if (vcpu->requests)
-                if (test_and_clear_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests))
-                        kvm_x86_ops->tlb_flush(vcpu);
        KVMTRACE_0D(VMENTRY, vcpu, entryexit);
        kvm_x86_ops->run(vcpu, kvm_run);
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 156e6d7b0e32..f6d20be7a8f4 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -135,7 +135,7 @@ static __init void *spp_getpage(void)
        return ptr;
 }
-static void
+static __init void
 set_pte_phys(unsigned long vaddr, unsigned long phys, pgprot_t prot)
 {
        pgd_t *pgd;
@@ -214,7 +214,7 @@ void __init cleanup_highmap(void)
 }
 /* NOTE: this is meant to be run only at boot */
-void __set_fixmap(enum fixed_addresses idx, unsigned long phys, pgprot_t prot)
+void __init __set_fixmap(enum fixed_addresses idx, unsigned long phys, pgprot_t prot)
 {
        unsigned long address = __fix_to_virt(idx);
@@ -506,7 +506,7 @@ early_param("memtest", parse_memtest);
 static void __init early_memtest(unsigned long start, unsigned long end)
 {
-        u64 t_start, t_size;
+        unsigned long t_start, t_size;
        unsigned pattern;
        if (!memtest_pattern)
@@ -525,7 +525,7 @@ static void __init early_memtest(unsigned long start, unsigned long end)
                        if (t_start + t_size > end)
                                t_size = end - t_start;
-                        printk(KERN_CONT "\n  %016llx - %016llx pattern %d",
+                        printk(KERN_CONT "\n  %016lx - %016lx pattern %d",
                                t_start, t_start + t_size, pattern);
                        memtest(t_start, t_size, pattern);
diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 2e641be2737e..6c388e593bc8 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -5,8 +5,9 @@
 config XEN
        bool "Xen guest support"
        select PARAVIRT
+        select PARAVIRT_CLOCK
        depends on X86_32
-        depends on X86_CMPXCHG && X86_TSC && !(X86_VISWS || X86_VOYAGER)
+        depends on X86_CMPXCHG && X86_TSC && X86_PAE && !(X86_VISWS || X86_VOYAGER)
        help
          This is the Linux Xen port.  Enabling this will allow the
          kernel to boot in a paravirtualized environment under the
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index c8a56e457d61..f09c1c69c37a 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -785,38 +785,35 @@ static __init void xen_set_pte_init(pte_t *ptep, pte_t pte)
 static __init void xen_pagetable_setup_start(pgd_t *base)
 {
        pgd_t *xen_pgd = (pgd_t *)xen_start_info->pt_base;
+        int i;
        /* special set_pte for pagetable initialization */
        pv_mmu_ops.set_pte = xen_set_pte_init;
        init_mm.pgd = base;
        /*
-         * copy top-level of Xen-supplied pagetable into place.  For
+         * copy top-level of Xen-supplied pagetable into place.  This
-         * !PAE we can use this as-is, but for PAE it is a stand-in
+         * is a stand-in while we copy the pmd pages.
-         * while we copy the pmd pages.
         */
        memcpy(base, xen_pgd, PTRS_PER_PGD * sizeof(pgd_t));
-        if (PTRS_PER_PMD > 1) {
+        /*
-                int i;
+         * For PAE, need to allocate new pmds, rather than
-                /*
+         * share Xen's, since Xen doesn't like pmd's being
-                 * For PAE, need to allocate new pmds, rather than
+         * shared between address spaces.
-                 * share Xen's, since Xen doesn't like pmd's being
+         */
-                 * shared between address spaces.
+        for (i = 0; i < PTRS_PER_PGD; i++) {
-                 */
+                if (pgd_val_ma(xen_pgd[i]) & _PAGE_PRESENT) {
-                for (i = 0; i < PTRS_PER_PGD; i++) {
+                        pmd_t *pmd = (pmd_t *)alloc_bootmem_low_pages(PAGE_SIZE);
-                        if (pgd_val_ma(xen_pgd[i]) & _PAGE_PRESENT) {
-                                pmd_t *pmd = (pmd_t *)alloc_bootmem_low_pages(PAGE_SIZE);
-                                memcpy(pmd, (void *)pgd_page_vaddr(xen_pgd[i]),
+                        memcpy(pmd, (void *)pgd_page_vaddr(xen_pgd[i]),
-                                       PAGE_SIZE);
+                               PAGE_SIZE);
-                                make_lowmem_page_readonly(pmd);
+                        make_lowmem_page_readonly(pmd);
-                                set_pgd(&base[i], __pgd(1 + __pa(pmd)));
+                        set_pgd(&base[i], __pgd(1 + __pa(pmd)));
-                        } else
+                } else
-                                pgd_clear(&base[i]);
+                        pgd_clear(&base[i]);
-                }
        }
        /* make sure zero_page is mapped RO so we can use it in pagetables */
@@ -873,17 +870,7 @@ static __init void xen_pagetable_setup_done(pgd_t *base)
        /* Actually pin the pagetable down, but we can't set PG_pinned
           yet because the page structures don't exist yet. */
-        {
+        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(base)));
-                unsigned level;
-#ifdef CONFIG_X86_PAE
-                level = MMUEXT_PIN_L3_TABLE;
-#else
-                level = MMUEXT_PIN_L2_TABLE;
-#endif
-                pin_pagetable_pfn(level, PFN_DOWN(__pa(base)));
-        }
 }
 /* This is called once we have the cpu_possible_map */
@@ -1093,7 +1080,6 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
        .make_pte = xen_make_pte,
        .make_pgd = xen_make_pgd,
-#ifdef CONFIG_X86_PAE
        .set_pte_atomic = xen_set_pte_atomic,
        .set_pte_present = xen_set_pte_at,
        .set_pud = xen_set_pud,
@@ -1102,7 +1088,6 @@ static const struct pv_mmu_ops xen_mmu_ops __initdata = {
        .make_pmd = xen_make_pmd,
        .pmd_val = xen_pmd_val,
-#endif  /* PAE */
        .activate_mm = xen_activate_mm,
        .dup_mmap = xen_dup_mmap,
@@ -1228,6 +1213,11 @@ asmlinkage void __init xen_start_kernel(void)
        if (xen_feature(XENFEAT_supervisor_mode_kernel))
                pv_info.kernel_rpl = 0;
+        /* Prevent unwanted bits from being set in PTEs. */
+        __supported_pte_mask &= ~_PAGE_GLOBAL;
+        if (!is_initial_xendomain())
+                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
        /* set the limit of our address space */
        xen_reserve_top();
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 3525ef523a74..df40bf74ea75 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -179,50 +179,56 @@ out:
                preempt_enable();
 }
-pteval_t xen_pte_val(pte_t pte)
+/* Assume pteval_t is equivalent to all the other *val_t types. */
+static pteval_t pte_mfn_to_pfn(pteval_t val)
+{
+        if (val & _PAGE_PRESENT) {
+                unsigned long mfn = (val & PTE_MASK) >> PAGE_SHIFT;
+                pteval_t flags = val & ~PTE_MASK;
+                val = (mfn_to_pfn(mfn) << PAGE_SHIFT) | flags;
+        }
+        return val;
+}
+static pteval_t pte_pfn_to_mfn(pteval_t val)
 {
-        pteval_t ret = pte.pte;
+        if (val & _PAGE_PRESENT) {
+                unsigned long pfn = (val & PTE_MASK) >> PAGE_SHIFT;
+                pteval_t flags = val & ~PTE_MASK;
+                val = (pfn_to_mfn(pfn) << PAGE_SHIFT) | flags;
+        }
-        if (ret & _PAGE_PRESENT)
+        return val;
-                ret = machine_to_phys(XMADDR(ret)).paddr | _PAGE_PRESENT;
+}
-        return ret;
+pteval_t xen_pte_val(pte_t pte)
+{
+        return pte_mfn_to_pfn(pte.pte);
 }
 pgdval_t xen_pgd_val(pgd_t pgd)
 {
-        pgdval_t ret = pgd.pgd;
+        return pte_mfn_to_pfn(pgd.pgd);
-        if (ret & _PAGE_PRESENT)
-                ret = machine_to_phys(XMADDR(ret)).paddr | _PAGE_PRESENT;
-        return ret;
 }
 pte_t xen_make_pte(pteval_t pte)
 {
-        if (pte & _PAGE_PRESENT) {
+        pte = pte_pfn_to_mfn(pte);
-                pte = phys_to_machine(XPADDR(pte)).maddr;
+        return native_make_pte(pte);
-                pte &= ~(_PAGE_PCD | _PAGE_PWT);
-        }
-        return (pte_t){ .pte = pte };
 }
 pgd_t xen_make_pgd(pgdval_t pgd)
 {
-        if (pgd & _PAGE_PRESENT)
+        pgd = pte_pfn_to_mfn(pgd);
-                pgd = phys_to_machine(XPADDR(pgd)).maddr;
+        return native_make_pgd(pgd);
-        return (pgd_t){ pgd };
 }
 pmdval_t xen_pmd_val(pmd_t pmd)
 {
-        pmdval_t ret = native_pmd_val(pmd);
+        return pte_mfn_to_pfn(pmd.pmd);
-        if (ret & _PAGE_PRESENT)
-                ret = machine_to_phys(XMADDR(ret)).paddr | _PAGE_PRESENT;
-        return ret;
 }
-#ifdef CONFIG_X86_PAE
 void xen_set_pud(pud_t *ptr, pud_t val)
 {
        struct multicall_space mcs;
@@ -267,17 +273,9 @@ void xen_pmd_clear(pmd_t *pmdp)
 pmd_t xen_make_pmd(pmdval_t pmd)
 {
-        if (pmd & _PAGE_PRESENT)
+        pmd = pte_pfn_to_mfn(pmd);
-                pmd = phys_to_machine(XPADDR(pmd)).maddr;
        return native_make_pmd(pmd);
 }
-#else  /* !PAE */
-void xen_set_pte(pte_t *ptep, pte_t pte)
-{
-        *ptep = pte;
-}
-#endif  /* CONFIG_X86_PAE */
 /*
  (Yet another) pagetable walker.  This one is intended for pinning a
@@ -430,8 +428,6 @@ static int pin_page(struct page *page, enum pt_level level)
   read-only, and can be pinned. */
 void xen_pgd_pin(pgd_t *pgd)
 {
-        unsigned level;
        xen_mc_batch();
        if (pgd_walk(pgd, pin_page, TASK_SIZE)) {
@@ -441,14 +437,7 @@ void xen_pgd_pin(pgd_t *pgd)
                xen_mc_batch();
        }
-#ifdef CONFIG_X86_PAE
+        xen_do_pin(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(pgd)));
-        level = MMUEXT_PIN_L3_TABLE;
-#else
-        level = MMUEXT_PIN_L2_TABLE;
-#endif
-        xen_do_pin(level, PFN_DOWN(__pa(pgd)));
        xen_mc_issue(0);
 }
diff --git a/arch/x86/xen/mmu.h b/arch/x86/xen/mmu.h
index b5e189b1519d..5fe961caffd4 100644
--- a/arch/x86/xen/mmu.h
+++ b/arch/x86/xen/mmu.h
@@ -37,14 +37,13 @@ void xen_exit_mmap(struct mm_struct *mm);
 void xen_pgd_pin(pgd_t *pgd);
 //void xen_pgd_unpin(pgd_t *pgd);
-#ifdef CONFIG_X86_PAE
+pteval_t xen_pte_val(pte_t);
-unsigned long long xen_pte_val(pte_t);
+pmdval_t xen_pmd_val(pmd_t);
-unsigned long long xen_pmd_val(pmd_t);
+pgdval_t xen_pgd_val(pgd_t);
-unsigned long long xen_pgd_val(pgd_t);
-pte_t xen_make_pte(unsigned long long);
+pte_t xen_make_pte(pteval_t);
-pmd_t xen_make_pmd(unsigned long long);
+pmd_t xen_make_pmd(pmdval_t);
-pgd_t xen_make_pgd(unsigned long long);
+pgd_t xen_make_pgd(pgdval_t);
 void xen_set_pte_at(struct mm_struct *mm, unsigned long addr,
                    pte_t *ptep, pte_t pteval);
@@ -53,15 +52,4 @@ void xen_set_pud(pud_t *ptr, pud_t val);
 void xen_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
 void xen_pmd_clear(pmd_t *pmdp);
-#else
-unsigned long xen_pte_val(pte_t);
-unsigned long xen_pmd_val(pmd_t);
-unsigned long xen_pgd_val(pgd_t);
-pte_t xen_make_pte(unsigned long);
-pmd_t xen_make_pmd(unsigned long);
-pgd_t xen_make_pgd(unsigned long);
-#endif
 #endif  /* _XEN_MMU_H */
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 52b2e3856980..41e217503c96 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -14,6 +14,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/math64.h>
+#include <asm/pvclock.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
@@ -31,17 +32,6 @@
 static cycle_t xen_clocksource_read(void);
-/* These are perodically updated in shared_info, and then copied here. */
-struct shadow_time_info {
-        u64 tsc_timestamp;     /* TSC at last update of time vals.  */
-        u64 system_timestamp;  /* Time, in nanosecs, since boot.    */
-        u32 tsc_to_nsec_mul;
-        int tsc_shift;
-        u32 version;
-};
-static DEFINE_PER_CPU(struct shadow_time_info, shadow_time);
 /* runstate info updated by Xen */
 static DEFINE_PER_CPU(struct vcpu_runstate_info, runstate);
@@ -211,7 +201,7 @@ unsigned long long xen_sched_clock(void)
 unsigned long xen_cpu_khz(void)
 {
        u64 xen_khz = 1000000ULL << 32;
-        const struct vcpu_time_info *info =
+        const struct pvclock_vcpu_time_info *info =
                &HYPERVISOR_shared_info->vcpu_info[0].time;
        do_div(xen_khz, info->tsc_to_system_mul);
@@ -223,121 +213,26 @@ unsigned long xen_cpu_khz(void)
        return xen_khz;
 }
-/*
- * Reads a consistent set of time-base values from Xen, into a shadow data
- * area.
- */
-static unsigned get_time_values_from_xen(void)
-{
-        struct vcpu_time_info   *src;
-        struct shadow_time_info *dst;
-        /* src is shared memory with the hypervisor, so we need to
-           make sure we get a consistent snapshot, even in the face of
-           being preempted. */
-        src = &__get_cpu_var(xen_vcpu)->time;
-        dst = &__get_cpu_var(shadow_time);
-        do {
-                dst->version = src->version;
-                rmb();          /* fetch version before data */
-                dst->tsc_timestamp     = src->tsc_timestamp;
-                dst->system_timestamp  = src->system_time;
-                dst->tsc_to_nsec_mul   = src->tsc_to_system_mul;
-                dst->tsc_shift         = src->tsc_shift;
-                rmb();          /* test version after fetching data */
-        } while ((src->version & 1) | (dst->version ^ src->version));
-        return dst->version;
-}
-/*
- * Scale a 64-bit delta by scaling and multiplying by a 32-bit fraction,
- * yielding a 64-bit result.
- */
-static inline u64 scale_delta(u64 delta, u32 mul_frac, int shift)
-{
-        u64 product;
-#ifdef __i386__
-        u32 tmp1, tmp2;
-#endif
-        if (shift < 0)
-                delta >>= -shift;
-        else
-                delta <<= shift;
-#ifdef __i386__
-        __asm__ (
-                "mul  %5       ; "
-                "mov  %4,%%eax ; "
-                "mov  %%edx,%4 ; "
-                "mul  %5       ; "
-                "xor  %5,%5    ; "
-                "add  %4,%%eax ; "
-                "adc  %5,%%edx ; "
-                : "=A" (product), "=r" (tmp1), "=r" (tmp2)
-                : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
-#elif __x86_64__
-        __asm__ (
-                "mul %%rdx ; shrd $32,%%rdx,%%rax"
-                : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
-#else
-#error implement me!
-#endif
-        return product;
-}
-static u64 get_nsec_offset(struct shadow_time_info *shadow)
-{
-        u64 now, delta;
-        now = native_read_tsc();
-        delta = now - shadow->tsc_timestamp;
-        return scale_delta(delta, shadow->tsc_to_nsec_mul, shadow->tsc_shift);
-}
 static cycle_t xen_clocksource_read(void)
 {
-        struct shadow_time_info *shadow = &get_cpu_var(shadow_time);
+        struct pvclock_vcpu_time_info *src;
        cycle_t ret;
-        unsigned version;
-        do {
-                version = get_time_values_from_xen();
-                barrier();
-                ret = shadow->system_timestamp + get_nsec_offset(shadow);
-                barrier();
-        } while (version != __get_cpu_var(xen_vcpu)->time.version);
-        put_cpu_var(shadow_time);
+        src = &get_cpu_var(xen_vcpu)->time;
+        ret = pvclock_clocksource_read(src);
+        put_cpu_var(xen_vcpu);
        return ret;
 }
 static void xen_read_wallclock(struct timespec *ts)
 {
-        const struct shared_info *s = HYPERVISOR_shared_info;
+        struct shared_info *s = HYPERVISOR_shared_info;
-        u32 version;
+        struct pvclock_wall_clock *wall_clock = &(s->wc);
-        u64 delta;
+        struct pvclock_vcpu_time_info *vcpu_time;
-        struct timespec now;
-        /* get wallclock at system boot */
-        do {
-                version = s->wc_version;
-                rmb();          /* fetch version before time */
-                now.tv_sec  = s->wc_sec;
-                now.tv_nsec = s->wc_nsec;
-                rmb();          /* fetch time before checking version */
-        } while ((s->wc_version & 1) | (version ^ s->wc_version));
-        delta = xen_clocksource_read(); /* time since system boot */
+        vcpu_time = &get_cpu_var(xen_vcpu)->time;
-        delta += now.tv_sec * (u64)NSEC_PER_SEC + now.tv_nsec;
+        pvclock_read_wallclock(wall_clock, vcpu_time, ts);
+        put_cpu_var(xen_vcpu);
-        now.tv_nsec = do_div(delta, NSEC_PER_SEC);
-        now.tv_sec = delta;
-        set_normalized_timespec(ts, now.tv_sec, now.tv_nsec);
 }
 unsigned long xen_get_wallclock(void)
@@ -345,7 +240,6 @@ unsigned long xen_get_wallclock(void)
        struct timespec ts;
        xen_read_wallclock(&ts);
        return ts.tv_sec;
 }
@@ -569,8 +463,6 @@ __init void xen_time_init(void)
 {
        int cpu = smp_processor_id();
-        get_time_values_from_xen();
        clocksource_register(&xen_clocksource);
        if (HYPERVISOR_vcpu_op(VCPUOP_stop_periodic_timer, cpu, NULL) == 0) {
diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
index 288d587ce73c..6ec3b4f7719b 100644
--- a/arch/x86/xen/xen-head.S
+++ b/arch/x86/xen/xen-head.S
@@ -17,7 +17,7 @@ ENTRY(startup_xen)
        __FINIT
-.pushsection .bss.page_aligned
+.pushsection .text
        .align PAGE_SIZE_asm
 ENTRY(hypercall_page)
        .skip 0x1000
@@ -30,11 +30,7 @@ ENTRY(hypercall_page)
        ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,          .long  startup_xen)
        ELFNOTE(Xen, XEN_ELFNOTE_HYPERCALL_PAGE, .long  hypercall_page)
        ELFNOTE(Xen, XEN_ELFNOTE_FEATURES,       .asciz "!writable_page_tables|pae_pgdir_above_4gb")
-#ifdef CONFIG_X86_PAE
        ELFNOTE(Xen, XEN_ELFNOTE_PAE_MODE,       .asciz "yes")
-#else
-        ELFNOTE(Xen, XEN_ELFNOTE_PAE_MODE,       .asciz "no")
-#endif
        ELFNOTE(Xen, XEN_ELFNOTE_LOADER,         .asciz "generic")
 #endif /*CONFIG_XEN */
diff --git a/drivers/acpi/bay.c b/drivers/acpi/bay.c
index 26038c2a2a71..61b6c5beb2d3 100644
--- a/drivers/acpi/bay.c
+++ b/drivers/acpi/bay.c
@@ -377,6 +377,9 @@ static int __init bay_init(void)
        INIT_LIST_HEAD(&drive_bays);
+        if (acpi_disabled)
+                return -ENODEV;
        /* look for dockable drive bays */
        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
                ACPI_UINT32_MAX, find_bay, &bays, NULL);
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 96c542f7fded..bb7c51f712bd 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -917,6 +917,9 @@ static int __init dock_init(void)
        dock_station = NULL;
+        if (acpi_disabled)
+                return 0;
        /* look for a dock station */
        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
                            ACPI_UINT32_MAX, find_dock, &num, NULL);
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 2808dc60fd67..9b227d4dc9c9 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -333,6 +333,9 @@ static int __init acpi_rtc_init(void)
 {
        struct device *dev = get_rtc_dev();
+        if (acpi_disabled)
+                return 0;
        if (dev) {
                rtc_wake_setup();
                rtc_info.wake_on = rtc_wake_on;
diff --git a/drivers/char/drm/i915_drv.c b/drivers/char/drm/i915_drv.c
index e8f3d682e3b1..93aed1c38bd2 100644
--- a/drivers/char/drm/i915_drv.c
+++ b/drivers/char/drm/i915_drv.c
@@ -389,6 +389,7 @@ static int i915_resume(struct drm_device *dev)
        pci_restore_state(dev->pdev);
        if (pci_enable_device(dev->pdev))
                return -1;
+        pci_set_master(dev->pdev);
        pci_write_config_byte(dev->pdev, LBB, dev_priv->saveLBB);
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index f7f16e7a8bf3..df036118b8b1 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -62,11 +62,11 @@ static void i915_vblank_tasklet(struct drm_device *dev)
        u32 ropcpp = (0xcc << 16) | ((cpp - 1) << 24);
        RING_LOCALS;
-        if (sarea_priv->front_tiled) {
+        if (IS_I965G(dev) && sarea_priv->front_tiled) {
                cmd |= XY_SRC_COPY_BLT_DST_TILED;
                dst_pitch >>= 2;
        }
-        if (sarea_priv->back_tiled) {
+        if (IS_I965G(dev) && sarea_priv->back_tiled) {
                cmd |= XY_SRC_COPY_BLT_SRC_TILED;
                src_pitch >>= 2;
        }
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index b1a757a5ee27..8f81139d6194 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -981,16 +981,9 @@ EXPORT_SYMBOL_GPL(tty_perform_flush);
 int n_tty_ioctl(struct tty_struct *tty, struct file *file,
                       unsigned int cmd, unsigned long arg)
 {
-        struct tty_struct *real_tty;
        unsigned long flags;
        int retval;
-        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
-            tty->driver->subtype == PTY_TYPE_MASTER)
-                real_tty = tty->link;
-        else
-                real_tty = tty;
        switch (cmd) {
        case TCXONC:
                retval = tty_check_change(tty);
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index 85e2ba7fcfba..bf4830082a13 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -27,6 +27,8 @@
 #include <linux/moduleparam.h>
 #include <linux/connector.h>
 #include <linux/mutex.h>
+#include <linux/proc_fs.h>
+#include <linux/spinlock.h>
 #include <net/sock.h>
@@ -403,6 +405,40 @@ static void cn_callback(void *data)
        mutex_unlock(&notify_lock);
 }
+static int cn_proc_show(struct seq_file *m, void *v)
+{
+        struct cn_queue_dev *dev = cdev.cbdev;
+        struct cn_callback_entry *cbq;
+        seq_printf(m, "Name            ID\n");
+        spin_lock_bh(&dev->queue_lock);
+        list_for_each_entry(cbq, &dev->queue_list, callback_entry) {
+                seq_printf(m, "%-15s %u:%u\n",
+                           cbq->id.name,
+                           cbq->id.id.idx,
+                           cbq->id.id.val);
+        }
+        spin_unlock_bh(&dev->queue_lock);
+        return 0;
+}
+static int cn_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, cn_proc_show, NULL);
+}
+static const struct file_operations cn_file_ops = {
+        .owner   = THIS_MODULE,
+        .open    = cn_proc_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = single_release
+};
 static int __devinit cn_init(void)
 {
        struct cn_dev *dev = &cdev;
@@ -434,6 +470,8 @@ static int __devinit cn_init(void)
                return -EINVAL;
        }
+        proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
        return 0;
 }
@@ -443,6 +481,8 @@ static void __devexit cn_fini(void)
        cn_already_initialized = 0;
+        proc_net_remove(&init_net, "connector");
        cn_del_callback(&dev->id);
        cn_queue_free_dev(dev->cbdev);
        netlink_kernel_release(dev->nls);
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index b2458bb8e9ca..227d2e036cd8 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -1051,7 +1051,8 @@ static int sbp2_scan_unit_dir(struct sbp2_target *tgt, u32 *directory,
                        break;
                case SBP2_CSR_LOGICAL_UNIT_DIRECTORY:
-                        if (sbp2_scan_logical_unit_dir(tgt, ci.p + value) < 0)
+                        /* Adjust for the increment in the iterator */
+                        if (sbp2_scan_logical_unit_dir(tgt, ci.p - 1 + value) < 0)
                                return -ENOMEM;
                        break;
                }
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index b224079d4e1f..d5862e5d99a0 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -109,7 +109,11 @@ static int mthca_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_m
 {
        struct page *page;
-        page = alloc_pages(gfp_mask, order);
+        /*
+         * Use __GFP_ZERO because buggy firmware assumes ICM pages are
+         * cleared, and subtle failures are seen if they aren't.
+         */
+        page = alloc_pages(gfp_mask | __GFP_ZERO, order);
        if (!page)
                return -ENOMEM;
diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index eebc72465fc9..72c63e5dd630 100644
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -28,6 +28,7 @@
 #include <linux/input.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/sched.h>
 /*
 * Check that the effect_id is a valid effect and whether the user
@@ -166,8 +167,10 @@ int input_ff_upload(struct input_dev *dev, struct ff_effect *effect,
        if (ret)
                goto out;
+        spin_lock_irq(&dev->event_lock);
        ff->effects[id] = *effect;
        ff->effect_owners[id] = file;
+        spin_unlock_irq(&dev->event_lock);
 out:
        mutex_unlock(&ff->mutex);
@@ -189,16 +192,22 @@ static int erase_effect(struct input_dev *dev, int effect_id,
        if (error)
                return error;
+        spin_lock_irq(&dev->event_lock);
        ff->playback(dev, effect_id, 0);
+        ff->effect_owners[effect_id] = NULL;
+        spin_unlock_irq(&dev->event_lock);
        if (ff->erase) {
                error = ff->erase(dev, effect_id);
-                if (error)
+                if (error) {
+                        spin_lock_irq(&dev->event_lock);
+                        ff->effect_owners[effect_id] = file;
+                        spin_unlock_irq(&dev->event_lock);
                        return error;
+                }
        }
-        ff->effect_owners[effect_id] = NULL;
        return 0;
 }
@@ -263,8 +272,6 @@ int input_ff_event(struct input_dev *dev, unsigned int type,
        if (type != EV_FF)
                return 0;
-        mutex_lock(&ff->mutex);
        switch (code) {
        case FF_GAIN:
                if (!test_bit(FF_GAIN, dev->ffbit) || value > 0xffff)
@@ -286,7 +293,6 @@ int input_ff_event(struct input_dev *dev, unsigned int type,
                break;
        }
-        mutex_unlock(&ff->mutex);
        return 0;
 }
 EXPORT_SYMBOL_GPL(input_ff_event);
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 5126d5d9ea0e..2e554a4ab337 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -176,7 +176,7 @@ void lguest_arch_run_guest(struct lg_cpu *cpu)
         * we set it now, so we can trap and pass that trap to the Guest if it
         * uses the FPU. */
        if (cpu->ts)
-                lguest_set_ts();
+                unlazy_fpu(current);
        /* SYSENTER is an optimized way of doing system calls.  We can't allow
         * it because it always jumps to privilege level 0.  A normal Guest
@@ -196,6 +196,10 @@ void lguest_arch_run_guest(struct lg_cpu *cpu)
         * trap made the switcher code come back, and an error code which some
         * traps set.  */
+         /* Restore SYSENTER if it's supposed to be on. */
+         if (boot_cpu_has(X86_FEATURE_SEP))
+                wrmsr(MSR_IA32_SYSENTER_CS, __KERNEL_CS, 0);
        /* If the Guest page faulted, then the cr2 register will tell us the
         * bad virtual address.  We have to grab this now, because once we
         * re-enable interrupts an interrupt could fault and thus overwrite
@@ -203,13 +207,12 @@ void lguest_arch_run_guest(struct lg_cpu *cpu)
        if (cpu->regs->trapnum == 14)
                cpu->arch.last_pagefault = read_cr2();
        /* Similarly, if we took a trap because the Guest used the FPU,
-         * we have to restore the FPU it expects to see. */
+         * we have to restore the FPU it expects to see.
+         * math_state_restore() may sleep and we may even move off to
+         * a different CPU. So all the critical stuff should be done
+         * before this.  */
        else if (cpu->regs->trapnum == 7)
                math_state_restore();
-        /* Restore SYSENTER if it's supposed to be on. */
-        if (boot_cpu_has(X86_FEATURE_SEP))
-                wrmsr(MSR_IA32_SYSENTER_CS, __KERNEL_CS, 0);
 }
 /*H:130 Now we've examined the hypercall code; our Guest can make requests.
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 835def11419d..ab6a61db63ce 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -432,6 +432,7 @@ static int crypt_convert(struct crypt_config *cc,
                case 0:
                        atomic_dec(&ctx->pending);
                        ctx->sector++;
+                        cond_resched();
                        continue;
                /* error */
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 7cf512a34ccf..2580ac1b9b0f 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3897,8 +3897,10 @@ static void autorun_devices(int part)
                md_probe(dev, NULL, NULL);
                mddev = mddev_find(dev);
-                if (!mddev) {
+                if (!mddev || !mddev->gendisk) {
-                        printk(KERN_ERR 
+                        if (mddev)
+                                mddev_put(mddev);
+                        printk(KERN_ERR
                                "md: cannot allocate memory for md drive.\n");
                        break;
                }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1de17da34a95..a71277b640ab 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2137,6 +2137,8 @@ static int run(mddev_t *mddev)
                    !test_bit(In_sync, &disk->rdev->flags)) {
                        disk->head_position = 0;
                        mddev->degraded++;
+                        if (disk->rdev)
+                                conf->fullsync = 1;
                }
        }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index c37e256b1176..54c8ee28fcc4 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2898,6 +2898,8 @@ static void handle_stripe5(struct stripe_head *sh)
                for (i = conf->raid_disks; i--; ) {
                        set_bit(R5_Wantwrite, &sh->dev[i].flags);
+                        set_bit(R5_LOCKED, &dev->flags);
+                        s.locked++;
                        if (!test_and_set_bit(STRIPE_OP_IO, &sh->ops.pending))
                                sh->ops.count++;
                }
@@ -2911,6 +2913,7 @@ static void handle_stripe5(struct stripe_head *sh)
                        conf->raid_disks);
                s.locked += handle_write_operations5(sh, 1, 1);
        } else if (s.expanded &&
+                   s.locked == 0 &&
                !test_bit(STRIPE_OP_POSTXOR, &sh->ops.pending)) {
                clear_bit(STRIPE_EXPAND_READY, &sh->state);
                atomic_dec(&conf->reshape_stripes);
@@ -4305,7 +4308,9 @@ static int run(mddev_t *mddev)
                                " disk %d\n", bdevname(rdev->bdev,b),
                                raid_disk);
                        working_disks++;
-                }
+                } else
+                        /* Cannot rely on bitmap to complete recovery */
+                        conf->fullsync = 1;
        }
        /*
diff --git a/drivers/media/common/ir-keymaps.c b/drivers/media/common/ir-keymaps.c
index a3485817e46c..8fa91f846d59 100644
--- a/drivers/media/common/ir-keymaps.c
+++ b/drivers/media/common/ir-keymaps.c
@@ -2201,3 +2201,41 @@ IR_KEYTAB_TYPE ir_codes_powercolor_real_angel[IR_KEYTAB_SIZE] = {
        [0x25] = KEY_POWER,             /* power */
 };
 EXPORT_SYMBOL_GPL(ir_codes_powercolor_real_angel);
+IR_KEYTAB_TYPE ir_codes_avermedia_a16d[IR_KEYTAB_SIZE] = {
+        [0x20] = KEY_LIST,
+        [0x00] = KEY_POWER,
+        [0x28] = KEY_1,
+        [0x18] = KEY_2,
+        [0x38] = KEY_3,
+        [0x24] = KEY_4,
+        [0x14] = KEY_5,
+        [0x34] = KEY_6,
+        [0x2c] = KEY_7,
+        [0x1c] = KEY_8,
+        [0x3c] = KEY_9,
+        [0x12] = KEY_SUBTITLE,
+        [0x22] = KEY_0,
+        [0x32] = KEY_REWIND,
+        [0x3a] = KEY_SHUFFLE,
+        [0x02] = KEY_PRINT,
+        [0x11] = KEY_CHANNELDOWN,
+        [0x31] = KEY_CHANNELUP,
+        [0x0c] = KEY_ZOOM,
+        [0x1e] = KEY_VOLUMEDOWN,
+        [0x3e] = KEY_VOLUMEUP,
+        [0x0a] = KEY_MUTE,
+        [0x04] = KEY_AUDIO,
+        [0x26] = KEY_RECORD,
+        [0x06] = KEY_PLAY,
+        [0x36] = KEY_STOP,
+        [0x16] = KEY_PAUSE,
+        [0x2e] = KEY_REWIND,
+        [0x0e] = KEY_FASTFORWARD,
+        [0x30] = KEY_TEXT,
+        [0x21] = KEY_GREEN,
+        [0x01] = KEY_BLUE,
+        [0x08] = KEY_EPG,
+        [0x2a] = KEY_MENU,
+};
+EXPORT_SYMBOL_GPL(ir_codes_avermedia_a16d);
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index f1894fec32b9..6fb5b4586569 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -649,9 +649,17 @@ int tda18271_calc_rf_cal(struct dvb_frontend *fe, u32 *freq)
        u8 val;
        int ret = tda18271_lookup_map(fe, RF_CAL, freq, &val);
+        /* The TDA18271HD/C1 rf_cal map lookup is expected to go out of range
+         * for frequencies above 61.1 MHz.  In these cases, the internal RF
+         * tracking filters calibration mechanism is used.
+         *
+         * There is no need to warn the user about this.
+         */
+        if (ret < 0)
+                goto fail;
        regs[R_EB14] = val;
+fail:
        return ret;
 }
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 89c01fb1f859..93063c6fbbf6 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -45,6 +45,21 @@ static inline int charge_pump_source(struct dvb_frontend *fe, int force)
                                           TDA18271_MAIN_PLL, force);
 }
+static inline void tda18271_set_if_notch(struct dvb_frontend *fe)
+{
+        struct tda18271_priv *priv = fe->tuner_priv;
+        unsigned char *regs = priv->tda18271_regs;
+        switch (priv->mode) {
+        case TDA18271_ANALOG:
+                regs[R_MPD]  &= ~0x80; /* IF notch = 0 */
+                break;
+        case TDA18271_DIGITAL:
+                regs[R_MPD]  |= 0x80; /* IF notch = 1 */
+                break;
+        }
+}
 static int tda18271_channel_configuration(struct dvb_frontend *fe,
                                          struct tda18271_std_map_item *map,
                                          u32 freq, u32 bw)
@@ -60,25 +75,18 @@ static int tda18271_channel_configuration(struct dvb_frontend *fe,
        regs[R_EP3]  &= ~0x1f; /* clear std bits */
        regs[R_EP3]  |= (map->agc_mode << 3) | map->std;
-        /* set rfagc to high speed mode */
+        if (priv->id == TDA18271HDC2) {
-        regs[R_EP3] &= ~0x04;
+                /* set rfagc to high speed mode */
+                regs[R_EP3] &= ~0x04;
+        }
        /* set cal mode to normal */
        regs[R_EP4]  &= ~0x03;
-        /* update IF output level & IF notch frequency */
+        /* update IF output level */
        regs[R_EP4]  &= ~0x1c; /* clear if level bits */
        regs[R_EP4]  |= (map->if_lvl << 2);
-        switch (priv->mode) {
-        case TDA18271_ANALOG:
-                regs[R_MPD]  &= ~0x80; /* IF notch = 0 */
-                break;
-        case TDA18271_DIGITAL:
-                regs[R_MPD]  |= 0x80; /* IF notch = 1 */
-                break;
-        }
        /* update FM_RFn */
        regs[R_EP4]  &= ~0x80;
        regs[R_EP4]  |= map->fm_rfn << 7;
@@ -95,6 +103,9 @@ static int tda18271_channel_configuration(struct dvb_frontend *fe,
        /* disable Power Level Indicator */
        regs[R_EP1]  |= 0x40;
+        /* make sure thermometer is off */
+        regs[R_TM]   &= ~0x10;
        /* frequency dependent parameters */
        tda18271_calc_ir_measure(fe, &freq);
@@ -135,6 +146,7 @@ static int tda18271_channel_configuration(struct dvb_frontend *fe,
        switch (priv->role) {
        case TDA18271_MASTER:
                tda18271_calc_main_pll(fe, N);
+                tda18271_set_if_notch(fe);
                tda18271_write_regs(fe, R_MPD, 4);
                break;
        case TDA18271_SLAVE:
@@ -142,6 +154,7 @@ static int tda18271_channel_configuration(struct dvb_frontend *fe,
                tda18271_write_regs(fe, R_CPD, 4);
                regs[R_MPD] = regs[R_CPD] & 0x7f;
+                tda18271_set_if_notch(fe);
                tda18271_write_regs(fe, R_MPD, 1);
                break;
        }
@@ -160,12 +173,14 @@ static int tda18271_channel_configuration(struct dvb_frontend *fe,
        msleep(20);
-        /* set rfagc to normal speed mode */
+        if (priv->id == TDA18271HDC2) {
-        if (map->fm_rfn)
+                /* set rfagc to normal speed mode */
-                regs[R_EP3] &= ~0x04;
+                if (map->fm_rfn)
-        else
+                        regs[R_EP3] &= ~0x04;
-                regs[R_EP3] |= 0x04;
+                else
-        ret = tda18271_write_regs(fe, R_EP3, 1);
+                        regs[R_EP3] |= 0x04;
+                ret = tda18271_write_regs(fe, R_EP3, 1);
+        }
 fail:
        return ret;
 }
@@ -507,7 +522,7 @@ static int tda18271_powerscan_init(struct dvb_frontend *fe)
        /* set cal mode to normal */
        regs[R_EP4]  &= ~0x03;
-        /* update IF output level & IF notch frequency */
+        /* update IF output level */
        regs[R_EP4]  &= ~0x1c; /* clear if level bits */
        ret = tda18271_write_regs(fe, R_EP3, 2);
diff --git a/drivers/media/common/tuners/xc5000.c b/drivers/media/common/tuners/xc5000.c
index ceae6db901ec..7cf4f5bdb2ec 100644
--- a/drivers/media/common/tuners/xc5000.c
+++ b/drivers/media/common/tuners/xc5000.c
@@ -177,6 +177,7 @@ static XC_TV_STANDARD XC5000_Standard[MAX_TV_STANDARD] = {
        {"FM Radio-INPUT1",   0x0208, 0x9002}
 };
+static int  xc5000_is_firmware_loaded(struct dvb_frontend *fe);
 static int  xc5000_writeregs(struct xc5000_priv *priv, u8 *buf, u8 len);
 static int  xc5000_readregs(struct xc5000_priv *priv, u8 *buf, u8 len);
 static void xc5000_TunerReset(struct dvb_frontend *fe);
@@ -352,7 +353,7 @@ static int xc_SetTVStandard(struct xc5000_priv *priv,
 static int xc_shutdown(struct xc5000_priv *priv)
 {
-        return 0;
+        return XC_RESULT_SUCCESS;
        /* Fixme: cannot bring tuner back alive once shutdown
         *        without reloading the driver modules.
         *    return xc_write_reg(priv, XREG_POWER_DOWN, 0);
@@ -685,6 +686,25 @@ static int xc5000_set_params(struct dvb_frontend *fe,
        return 0;
 }
+static int xc5000_is_firmware_loaded(struct dvb_frontend *fe)
+{
+        struct xc5000_priv *priv = fe->tuner_priv;
+        int ret;
+        u16 id;
+        ret = xc5000_readreg(priv, XREG_PRODUCT_ID, &id);
+        if (ret == XC_RESULT_SUCCESS) {
+                if (id == XC_PRODUCT_ID_FW_NOT_LOADED)
+                        ret = XC_RESULT_RESET_FAILURE;
+                else
+                        ret = XC_RESULT_SUCCESS;
+        }
+        dprintk(1, "%s() returns %s id = 0x%x\n", __func__,
+                ret == XC_RESULT_SUCCESS ? "True" : "False", id);
+        return ret;
+}
 static int xc_load_fw_and_init_tuner(struct dvb_frontend *fe);
 static int xc5000_set_analog_params(struct dvb_frontend *fe,
@@ -693,7 +713,7 @@ static int xc5000_set_analog_params(struct dvb_frontend *fe,
        struct xc5000_priv *priv = fe->tuner_priv;
        int ret;
-        if(priv->fwloaded == 0)
+        if (xc5000_is_firmware_loaded(fe) != XC_RESULT_SUCCESS)
                xc_load_fw_and_init_tuner(fe);
        dprintk(1, "%s() frequency=%d (in units of 62.5khz)\n",
@@ -808,11 +828,10 @@ static int xc_load_fw_and_init_tuner(struct dvb_frontend *fe)
        struct xc5000_priv *priv = fe->tuner_priv;
        int ret = 0;
-        if (priv->fwloaded == 0) {
+        if (xc5000_is_firmware_loaded(fe) != XC_RESULT_SUCCESS) {
                ret = xc5000_fwupload(fe);
                if (ret != XC_RESULT_SUCCESS)
                        return ret;
-                priv->fwloaded = 1;
        }
        /* Start the tuner self-calibration process */
@@ -852,7 +871,6 @@ static int xc5000_sleep(struct dvb_frontend *fe)
                return -EREMOTEIO;
        }
        else {
-                /* priv->fwloaded = 0; */
                return XC_RESULT_SUCCESS;
        }
 }
@@ -933,7 +951,6 @@ struct dvb_frontend *xc5000_attach(struct dvb_frontend *fe,
                        cfg->i2c_address);
                printk(KERN_INFO
                        "xc5000: Firmware has been loaded previously\n");
-                priv->fwloaded = 1;
                break;
        case XC_PRODUCT_ID_FW_NOT_LOADED:
                printk(KERN_INFO
@@ -941,7 +958,6 @@ struct dvb_frontend *xc5000_attach(struct dvb_frontend *fe,
                        cfg->i2c_address);
                printk(KERN_INFO
                        "xc5000: Firmware has not been loaded previously\n");
-                priv->fwloaded = 0;
                break;
        default:
                printk(KERN_ERR
diff --git a/drivers/media/common/tuners/xc5000_priv.h b/drivers/media/common/tuners/xc5000_priv.h
index ecebfe4745ad..a72a9887fe7f 100644
--- a/drivers/media/common/tuners/xc5000_priv.h
+++ b/drivers/media/common/tuners/xc5000_priv.h
@@ -30,7 +30,6 @@ struct xc5000_priv {
        u32 bandwidth;
        u8  video_standard;
        u8  rf_mode;
-        u8  fwloaded;
        void *devptr;
 };
diff --git a/drivers/media/dvb/dvb-usb/gl861.c b/drivers/media/dvb/dvb-usb/gl861.c
index 0a8ac64a4e33..037f7ffb47b2 100644
--- a/drivers/media/dvb/dvb-usb/gl861.c
+++ b/drivers/media/dvb/dvb-usb/gl861.c
@@ -47,6 +47,8 @@ static int gl861_i2c_msg(struct dvb_usb_device *d, u8 addr,
                return -EINVAL;
        }
+        msleep(1); /* avoid I2C errors */
        return usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), req, type,
                               value, index, rbuf, rlen, 2000);
 }
@@ -92,16 +94,6 @@ static struct i2c_algorithm gl861_i2c_algo = {
 };
 /* Callbacks for DVB USB */
-static int gl861_identify_state(struct usb_device *udev,
-                                struct dvb_usb_device_properties *props,
-                                struct dvb_usb_device_description **desc,
-                                int *cold)
-{
-        *cold = 0;
-        return 0;
-}
 static struct zl10353_config gl861_zl10353_config = {
        .demod_address = 0x0f,
        .no_tuner = 1,
@@ -172,7 +164,6 @@ static struct dvb_usb_device_properties gl861_properties = {
        .size_of_priv     = 0,
-        .identify_state   = gl861_identify_state,
        .num_adapters = 1,
        .adapter = {{
@@ -194,13 +185,15 @@ static struct dvb_usb_device_properties gl861_properties = {
        .num_device_descs = 2,
        .devices = {
-                {   "MSI Mega Sky 55801 DVB-T USB2.0",
+                {
-                        { &gl861_table[0], NULL },
+                        .name = "MSI Mega Sky 55801 DVB-T USB2.0",
-                        { NULL },
+                        .cold_ids = { NULL },
+                        .warm_ids = { &gl861_table[0], NULL },
                },
-                {   "A-LINK DTU DVB-T USB2.0",
+                {
-                        { &gl861_table[1], NULL },
+                        .name = "A-LINK DTU DVB-T USB2.0",
-                        { NULL },
+                        .cold_ids = { NULL },
+                        .warm_ids = { &gl861_table[1], NULL },
                },
        }
 };
diff --git a/drivers/media/dvb/dvb-usb/umt-010.c b/drivers/media/dvb/dvb-usb/umt-010.c
index 9e7653bb3b66..118aab1a3e54 100644
--- a/drivers/media/dvb/dvb-usb/umt-010.c
+++ b/drivers/media/dvb/dvb-usb/umt-010.c
@@ -107,7 +107,7 @@ static struct dvb_usb_device_properties umt_properties = {
                        /* parameter for the MPEG2-data transfer */
                        .stream = {
                                .type = USB_BULK,
-                                .count = 20,
+                                .count = MAX_NO_URBS_FOR_DATA_STREAM,
                                .endpoint = 0x06,
                                .u = {
                                        .bulk = {
diff --git a/drivers/media/dvb/frontends/au8522.c b/drivers/media/dvb/frontends/au8522.c
index 084a280c2d7f..03900d241a76 100644
--- a/drivers/media/dvb/frontends/au8522.c
+++ b/drivers/media/dvb/frontends/au8522.c
@@ -463,10 +463,13 @@ static int au8522_set_frontend(struct dvb_frontend *fe,
                               struct dvb_frontend_parameters *p)
 {
        struct au8522_state *state = fe->demodulator_priv;
+        int ret = -EINVAL;
        dprintk("%s(frequency=%d)\n", __func__, p->frequency);
-        state->current_frequency = p->frequency;
+        if ((state->current_frequency == p->frequency) &&
+            (state->current_modulation == p->u.vsb.modulation))
+                return 0;
        au8522_enable_modulation(fe, p->u.vsb.modulation);
@@ -476,11 +479,16 @@ static int au8522_set_frontend(struct dvb_frontend *fe,
        if (fe->ops.tuner_ops.set_params) {
                if (fe->ops.i2c_gate_ctrl)
                        fe->ops.i2c_gate_ctrl(fe, 1);
-                fe->ops.tuner_ops.set_params(fe, p);
+                ret = fe->ops.tuner_ops.set_params(fe, p);
                if (fe->ops.i2c_gate_ctrl)
                        fe->ops.i2c_gate_ctrl(fe, 0);
        }
+        if (ret < 0)
+                return ret;
+        state->current_frequency = p->frequency;
        return 0;
 }
@@ -498,6 +506,16 @@ static int au8522_init(struct dvb_frontend *fe)
        return 0;
 }
+static int au8522_sleep(struct dvb_frontend *fe)
+{
+        struct au8522_state *state = fe->demodulator_priv;
+        dprintk("%s()\n", __func__);
+        state->current_frequency = 0;
+        return 0;
+}
 static int au8522_read_status(struct dvb_frontend *fe, fe_status_t *status)
 {
        struct au8522_state *state = fe->demodulator_priv;
@@ -509,10 +527,8 @@ static int au8522_read_status(struct dvb_frontend *fe, fe_status_t *status)
        if (state->current_modulation == VSB_8) {
                dprintk("%s() Checking VSB_8\n", __func__);
                reg = au8522_readreg(state, 0x4088);
-                if (reg & 0x01)
+                if ((reg & 0x03) == 0x03)
-                        *status |= FE_HAS_VITERBI;
+                        *status |= FE_HAS_LOCK | FE_HAS_SYNC | FE_HAS_VITERBI;
-                if (reg & 0x02)
-                        *status |= FE_HAS_LOCK | FE_HAS_SYNC;
        } else {
                dprintk("%s() Checking QAM\n", __func__);
                reg = au8522_readreg(state, 0x4541);
@@ -672,6 +688,7 @@ static struct dvb_frontend_ops au8522_ops = {
        },
        .init                 = au8522_init,
+        .sleep                = au8522_sleep,
        .i2c_gate_ctrl        = au8522_i2c_gate_ctrl,
        .set_frontend         = au8522_set_frontend,
        .get_frontend         = au8522_get_frontend,
diff --git a/drivers/media/dvb/frontends/stv0299.c b/drivers/media/dvb/frontends/stv0299.c
index 17556183e871..35435bef8e79 100644
--- a/drivers/media/dvb/frontends/stv0299.c
+++ b/drivers/media/dvb/frontends/stv0299.c
@@ -63,6 +63,7 @@ struct stv0299_state {
        u32 symbol_rate;
        fe_code_rate_t fec_inner;
        int errmode;
+        u32 ucblocks;
 };
 #define STATUS_BER 0
@@ -501,8 +502,10 @@ static int stv0299_read_ber(struct dvb_frontend* fe, u32* ber)
 {
        struct stv0299_state* state = fe->demodulator_priv;
-        if (state->errmode != STATUS_BER) return 0;
+        if (state->errmode != STATUS_BER)
-        *ber = (stv0299_readreg (state, 0x1d) << 8) | stv0299_readreg (state, 0x1e);
+                return -ENOSYS;
+        *ber = stv0299_readreg(state, 0x1e) | (stv0299_readreg(state, 0x1d) << 8);
        return 0;
 }
@@ -540,8 +543,12 @@ static int stv0299_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
        struct stv0299_state* state = fe->demodulator_priv;
-        if (state->errmode != STATUS_UCBLOCKS) *ucblocks = 0;
+        if (state->errmode != STATUS_UCBLOCKS)
-        else *ucblocks = (stv0299_readreg (state, 0x1d) << 8) | stv0299_readreg (state, 0x1e);
+                return -ENOSYS;
+        state->ucblocks += stv0299_readreg(state, 0x1e);
+        state->ucblocks += (stv0299_readreg(state, 0x1d) << 8);
+        *ucblocks = state->ucblocks;
        return 0;
 }
diff --git a/drivers/media/dvb/frontends/tda10023.c b/drivers/media/dvb/frontends/tda10023.c
index 0727b80bc4d2..c6ff5b82ff80 100644
--- a/drivers/media/dvb/frontends/tda10023.c
+++ b/drivers/media/dvb/frontends/tda10023.c
@@ -116,9 +116,12 @@ static u8 tda10023_readreg (struct tda10023_state* state, u8 reg)
        int ret;
        ret = i2c_transfer (state->i2c, msg, 2);
-        if (ret != 2)
+        if (ret != 2) {
-                printk("DVB: TDA10023: %s: readreg error (ret == %i)\n",
+                int num = state->frontend.dvb ? state->frontend.dvb->num : -1;
-                                 __func__, ret);
+                printk(KERN_ERR "DVB: TDA10023(%d): %s: readreg error "
+                        "(reg == 0x%02x, ret == %i)\n",
+                        num, __func__, reg, ret);
+        }
        return b1[0];
 }
@@ -129,11 +132,12 @@ static int tda10023_writereg (struct tda10023_state* state, u8 reg, u8 data)
        int ret;
        ret = i2c_transfer (state->i2c, &msg, 1);
-        if (ret != 1)
+        if (ret != 1) {
-                printk("DVB: TDA10023(%d): %s, writereg error "
+                int num = state->frontend.dvb ? state->frontend.dvb->num : -1;
+                printk(KERN_ERR "DVB: TDA10023(%d): %s, writereg error "
                        "(reg == 0x%02x, val == 0x%02x, ret == %i)\n",
-                        state->frontend.dvb->num, __func__, reg, data, ret);
+                        num, __func__, reg, data, ret);
+        }
        return (ret != 1) ? -EREMOTEIO : 0;
 }
@@ -464,7 +468,7 @@ struct dvb_frontend* tda10023_attach(const struct tda1002x_config* config,
        int i;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10023_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10023_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 49973846373e..a0d638653567 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -1248,11 +1248,14 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
                                     struct i2c_adapter* i2c)
 {
        struct tda1004x_state *state;
+        int id;
        /* allocate memory for the internal state */
        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
-        if (!state)
+        if (!state) {
+                printk(KERN_ERR "Can't alocate memory for tda10045 state\n");
                return NULL;
+        }
        /* setup the state */
        state->config = config;
@@ -1260,7 +1263,15 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
        state->demod_type = TDA1004X_DEMOD_TDA10045;
        /* check if the demod is there */
-        if (tda1004x_read_byte(state, TDA1004X_CHIPID) != 0x25) {
+        id = tda1004x_read_byte(state, TDA1004X_CHIPID);
+        if (id < 0) {
+                printk(KERN_ERR "tda10045: chip is not answering. Giving up.\n");
+                kfree(state);
+                return NULL;
+        }
+        if (id != 0x25) {
+                printk(KERN_ERR "Invalid tda1004x ID = 0x%02x. Can't proceed\n", id);
                kfree(state);
                return NULL;
        }
@@ -1307,11 +1318,14 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
                                     struct i2c_adapter* i2c)
 {
        struct tda1004x_state *state;
+        int id;
        /* allocate memory for the internal state */
        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
-        if (!state)
+        if (!state) {
+                printk(KERN_ERR "Can't alocate memory for tda10046 state\n");
                return NULL;
+        }
        /* setup the state */
        state->config = config;
@@ -1319,7 +1333,14 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
        state->demod_type = TDA1004X_DEMOD_TDA10046;
        /* check if the demod is there */
-        if (tda1004x_read_byte(state, TDA1004X_CHIPID) != 0x46) {
+        id = tda1004x_read_byte(state, TDA1004X_CHIPID);
+        if (id < 0) {
+                printk(KERN_ERR "tda10046: chip is not answering. Giving up.\n");
+                kfree(state);
+                return NULL;
+        }
+        if (id != 0x46) {
+                printk(KERN_ERR "Invalid tda1004x ID = 0x%02x. Can't proceed\n", id);
                kfree(state);
                return NULL;
        }
diff --git a/drivers/media/dvb/ttpci/Kconfig b/drivers/media/dvb/ttpci/Kconfig
index d4339b1b3b68..07643e010093 100644
--- a/drivers/media/dvb/ttpci/Kconfig
+++ b/drivers/media/dvb/ttpci/Kconfig
@@ -101,6 +101,7 @@ config DVB_BUDGET
 config DVB_BUDGET_CI
        tristate "Budget cards with onboard CI connector"
        depends on DVB_BUDGET_CORE && I2C
+        depends on INPUT # due to IR
        select DVB_STV0297 if !DVB_FE_CUSTOMISE
        select DVB_STV0299 if !DVB_FE_CUSTOMISE
        select DVB_TDA1004X if !DVB_FE_CUSTOMISE
diff --git a/drivers/media/dvb/ttpci/av7110_hw.c b/drivers/media/dvb/ttpci/av7110_hw.c
index 9d81074b31df..3a3f5279e927 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.c
+++ b/drivers/media/dvb/ttpci/av7110_hw.c
@@ -427,6 +427,7 @@ static int __av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
                        if (err) {
                                printk(KERN_ERR "%s: timeout waiting on busy %s QUEUE\n",
                                        __func__, type);
+                                av7110->arm_errors++;
                                return -ETIMEDOUT;
                        }
                        msleep(1);
@@ -853,10 +854,8 @@ static osd_raw_window_t bpp2bit[8] = {
 static inline int WaitUntilBmpLoaded(struct av7110 *av7110)
 {
-        int ret = wait_event_interruptible_timeout(av7110->bmpq,
+        int ret = wait_event_timeout(av7110->bmpq,
                                av7110->bmp_state != BMP_LOADING, 10*HZ);
-        if (ret == -ERESTARTSYS)
-                return ret;
        if (ret == 0) {
                printk("dvb-ttpci: warning: timeout waiting in LoadBitmap: %d, %d\n",
                       ret, av7110->bmp_state);
diff --git a/drivers/media/video/au0828/au0828-cards.c b/drivers/media/video/au0828/au0828-cards.c
index a2a6983444fa..898e12395e7c 100644
--- a/drivers/media/video/au0828/au0828-cards.c
+++ b/drivers/media/video/au0828/au0828-cards.c
@@ -77,8 +77,14 @@ static void hauppauge_eeprom(struct au0828_dev *dev, u8 *eeprom_data)
        /* Make sure we support the board model */
        switch (tv.model) {
+        case 72000: /* WinTV-HVR950q (Retail, IR, ATSC/QAM */
        case 72001: /* WinTV-HVR950q (Retail, IR, ATSC/QAM and basic analog video */
+        case 72211: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
+        case 72221: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
+        case 72231: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
+        case 72241: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM and basic analog video */
        case 72301: /* WinTV-HVR850 (Retail, IR, ATSC and basic analog video */
+        case 72500: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM */
                break;
        default:
                printk(KERN_WARNING "%s: warning: "
@@ -175,6 +181,18 @@ struct usb_device_id au0828_usb_id_table [] = {
                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR850 },
        { USB_DEVICE(0x0fe9, 0xd620),
                .driver_info = AU0828_BOARD_DVICO_FUSIONHDTV7 },
+        { USB_DEVICE(0x2040, 0x7210),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+        { USB_DEVICE(0x2040, 0x7217),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+        { USB_DEVICE(0x2040, 0x721b),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+        { USB_DEVICE(0x2040, 0x721f),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+        { USB_DEVICE(0x2040, 0x7280),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+        { USB_DEVICE(0x0fd9, 0x0008),
+                .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
        { },
 };
diff --git a/drivers/media/video/cx18/Kconfig b/drivers/media/video/cx18/Kconfig
index 5f942690570c..9aefdc5ea79a 100644
--- a/drivers/media/video/cx18/Kconfig
+++ b/drivers/media/video/cx18/Kconfig
@@ -10,8 +10,8 @@ config VIDEO_CX18
        select VIDEO_TVEEPROM
        select VIDEO_CX2341X
        select VIDEO_CS5345
-        select DVB_S5H1409
+        select DVB_S5H1409 if !DVB_FE_CUSTOMISE
-        select MEDIA_TUNER_MXL5005S
+        select MEDIA_TUNER_MXL5005S if !DVB_FE_CUSTOMISE
        ---help---
          This is a video4linux driver for Conexant cx23418 based
          PCI combo video recorder devices.
diff --git a/drivers/media/video/cx18/cx18-av-core.c b/drivers/media/video/cx18/cx18-av-core.c
index 9a26751615c6..faca43eb940f 100644
--- a/drivers/media/video/cx18/cx18-av-core.c
+++ b/drivers/media/video/cx18/cx18-av-core.c
@@ -69,6 +69,58 @@ int cx18_av_and_or4(struct cx18 *cx, u16 addr, u32 and_mask,
                             or_value);
 }
+int cx18_av_write_no_acfg(struct cx18 *cx, u16 addr, u8 value, int no_acfg_mask)
+{
+        int retval;
+        u32 saved_reg[8] = {0};
+        if (no_acfg_mask & CXADEC_NO_ACFG_AFE) {
+                saved_reg[0] = cx18_av_read4(cx, CXADEC_CHIP_CTRL);
+                saved_reg[1] = cx18_av_read4(cx, CXADEC_AFE_CTRL);
+        }
+        if (no_acfg_mask & CXADEC_NO_ACFG_PLL) {
+                saved_reg[2] = cx18_av_read4(cx, CXADEC_PLL_CTRL1);
+                saved_reg[3] = cx18_av_read4(cx, CXADEC_VID_PLL_FRAC);
+        }
+        if (no_acfg_mask & CXADEC_NO_ACFG_VID) {
+                saved_reg[4] = cx18_av_read4(cx, CXADEC_HORIZ_TIM_CTRL);
+                saved_reg[5] = cx18_av_read4(cx, CXADEC_VERT_TIM_CTRL);
+                saved_reg[6] = cx18_av_read4(cx, CXADEC_SRC_COMB_CFG);
+                saved_reg[7] = cx18_av_read4(cx, CXADEC_CHROMA_VBIOFF_CFG);
+        }
+        retval = cx18_av_write(cx, addr, value);
+        if (no_acfg_mask & CXADEC_NO_ACFG_AFE) {
+                cx18_av_write4(cx, CXADEC_CHIP_CTRL, saved_reg[0]);
+                cx18_av_write4(cx, CXADEC_AFE_CTRL,  saved_reg[1]);
+        }
+        if (no_acfg_mask & CXADEC_NO_ACFG_PLL) {
+                cx18_av_write4(cx, CXADEC_PLL_CTRL1,    saved_reg[2]);
+                cx18_av_write4(cx, CXADEC_VID_PLL_FRAC, saved_reg[3]);
+        }
+        if (no_acfg_mask & CXADEC_NO_ACFG_VID) {
+                cx18_av_write4(cx, CXADEC_HORIZ_TIM_CTRL,    saved_reg[4]);
+                cx18_av_write4(cx, CXADEC_VERT_TIM_CTRL,     saved_reg[5]);
+                cx18_av_write4(cx, CXADEC_SRC_COMB_CFG,      saved_reg[6]);
+                cx18_av_write4(cx, CXADEC_CHROMA_VBIOFF_CFG, saved_reg[7]);
+        }
+        return retval;
+}
+int cx18_av_and_or_no_acfg(struct cx18 *cx, u16 addr, unsigned and_mask,
+                           u8 or_value, int no_acfg_mask)
+{
+        return cx18_av_write_no_acfg(cx, addr,
+                                     (cx18_av_read(cx, addr) & and_mask) |
+                                     or_value, no_acfg_mask);
+}
 /* ----------------------------------------------------------------------- */
 static int set_input(struct cx18 *cx, enum cx18_av_video_input vid_input,
@@ -170,13 +222,15 @@ static void input_change(struct cx18 *cx)
        /* Follow step 8c and 8d of section 3.16 in the cx18_av datasheet */
        if (std & V4L2_STD_SECAM)
-                cx18_av_write(cx, 0x402, 0);
+                cx18_av_write_no_acfg(cx, 0x402, 0, CXADEC_NO_ACFG_ALL);
        else {
-                cx18_av_write(cx, 0x402, 0x04);
+                cx18_av_write_no_acfg(cx, 0x402, 0x04, CXADEC_NO_ACFG_ALL);
                cx18_av_write(cx, 0x49f, (std & V4L2_STD_NTSC) ? 0x14 : 0x11);
        }
-        cx18_av_and_or(cx, 0x401, ~0x60, 0);
+        cx18_av_and_or_no_acfg(cx, 0x401, ~0x60, 0,
-        cx18_av_and_or(cx, 0x401, ~0x60, 0x60);
+                                CXADEC_NO_ACFG_PLL | CXADEC_NO_ACFG_VID);
+        cx18_av_and_or_no_acfg(cx, 0x401, ~0x60, 0x60,
+                                CXADEC_NO_ACFG_PLL | CXADEC_NO_ACFG_VID);
        if (std & V4L2_STD_525_60) {
                if (std == V4L2_STD_NTSC_M_JP) {
@@ -228,7 +282,7 @@ static int set_input(struct cx18 *cx, enum cx18_av_video_input vid_input,
                if ((vid_input & ~0xff0) ||
                    luma < CX18_AV_SVIDEO_LUMA1 ||
-                    luma > CX18_AV_SVIDEO_LUMA4 ||
+                    luma > CX18_AV_SVIDEO_LUMA8 ||
                    chroma < CX18_AV_SVIDEO_CHROMA4 ||
                    chroma > CX18_AV_SVIDEO_CHROMA8) {
                        CX18_ERR("0x%04x is not a valid video input!\n",
@@ -262,7 +316,8 @@ static int set_input(struct cx18 *cx, enum cx18_av_video_input vid_input,
        cx18_av_write(cx, 0x103, reg);
        /* Set INPUT_MODE to Composite (0) or S-Video (1) */
-        cx18_av_and_or(cx, 0x401, ~0x6, is_composite ? 0 : 0x02);
+        cx18_av_and_or_no_acfg(cx, 0x401, ~0x6, is_composite ? 0 : 0x02,
+                                CXADEC_NO_ACFG_PLL | CXADEC_NO_ACFG_VID);
        /* Set CH_SEL_ADC2 to 1 if input comes from CH3 */
        cx18_av_and_or(cx, 0x102, ~0x2, (reg & 0x80) == 0 ? 2 : 0);
        /* Set DUAL_MODE_ADC2 to 1 if input comes from both CH2 and CH3 */
@@ -318,12 +373,12 @@ static int set_v4lstd(struct cx18 *cx)
           This happens for example with the Yuan MPC622. */
        if (fmt >= 4 && fmt < 8) {
                /* Set format to NTSC-M */
-                cx18_av_and_or(cx, 0x400, ~0xf, 1);
+                cx18_av_and_or_no_acfg(cx, 0x400, ~0xf, 1, CXADEC_NO_ACFG_AFE);
                /* Turn off LCOMB */
                cx18_av_and_or(cx, 0x47b, ~6, 0);
        }
-        cx18_av_and_or(cx, 0x400, ~0xf, fmt);
+        cx18_av_and_or_no_acfg(cx, 0x400, ~0xf, fmt, CXADEC_NO_ACFG_AFE);
-        cx18_av_and_or(cx, 0x403, ~0x3, pal_m);
+        cx18_av_and_or_no_acfg(cx, 0x403, ~0x3, pal_m, CXADEC_NO_ACFG_ALL);
        cx18_av_vbi_setup(cx);
        input_change(cx);
        return 0;
diff --git a/drivers/media/video/cx18/cx18-av-core.h b/drivers/media/video/cx18/cx18-av-core.h
index 786901d72e9a..c172823ce1d8 100644
--- a/drivers/media/video/cx18/cx18-av-core.h
+++ b/drivers/media/video/cx18/cx18-av-core.h
@@ -37,12 +37,16 @@ enum cx18_av_video_input {
        CX18_AV_COMPOSITE7,
        CX18_AV_COMPOSITE8,
-        /* S-Video inputs consist of one luma input (In1-In4) ORed with one
+        /* S-Video inputs consist of one luma input (In1-In8) ORed with one
           chroma input (In5-In8) */
        CX18_AV_SVIDEO_LUMA1 = 0x10,
        CX18_AV_SVIDEO_LUMA2 = 0x20,
        CX18_AV_SVIDEO_LUMA3 = 0x30,
        CX18_AV_SVIDEO_LUMA4 = 0x40,
+        CX18_AV_SVIDEO_LUMA5 = 0x50,
+        CX18_AV_SVIDEO_LUMA6 = 0x60,
+        CX18_AV_SVIDEO_LUMA7 = 0x70,
+        CX18_AV_SVIDEO_LUMA8 = 0x80,
        CX18_AV_SVIDEO_CHROMA4 = 0x400,
        CX18_AV_SVIDEO_CHROMA5 = 0x500,
        CX18_AV_SVIDEO_CHROMA6 = 0x600,
@@ -291,14 +295,24 @@ struct cx18_av_state {
 #define CXADEC_SELECT_AUDIO_STANDARD_FM    0xF9  /* FM radio */
 #define CXADEC_SELECT_AUDIO_STANDARD_AUTO  0xFF  /* Auto detect */
+/* Flags on what to preserve on write to 0x400-0x403 with cx18_av_.*_no_acfg()*/
+#define CXADEC_NO_ACFG_AFE      0x01 /* Preserve 0x100-0x107 */
+#define CXADEC_NO_ACFG_PLL      0x02 /* Preserve 0x108-0x10f */
+#define CXADEC_NO_ACFG_VID      0x04 /* Preserve 0x470-0x47f */
+#define CXADEC_NO_ACFG_ALL      0x07
 /* ----------------------------------------------------------------------- */
 /* cx18_av-core.c                                                          */
 int cx18_av_write(struct cx18 *cx, u16 addr, u8 value);
 int cx18_av_write4(struct cx18 *cx, u16 addr, u32 value);
+int cx18_av_write_no_acfg(struct cx18 *cx, u16 addr, u8 value,
+                                int no_acfg_mask);
 u8 cx18_av_read(struct cx18 *cx, u16 addr);
 u32 cx18_av_read4(struct cx18 *cx, u16 addr);
 int cx18_av_and_or(struct cx18 *cx, u16 addr, unsigned mask, u8 value);
 int cx18_av_and_or4(struct cx18 *cx, u16 addr, u32 mask, u32 value);
+int cx18_av_and_or_no_acfg(struct cx18 *cx, u16 addr, unsigned mask, u8 value,
+                                int no_acfg_mask);
 int cx18_av_cmd(struct cx18 *cx, unsigned int cmd, void *arg);
 /* ----------------------------------------------------------------------- */
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index baccd079243d..c26e0ef5b075 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -23,6 +23,7 @@
 #include "cx18-driver.h"
 #include "cx18-cards.h"
+#include "cx18-av-core.h"
 #include "cx18-i2c.h"
 #include <media/cs5345.h>
@@ -54,22 +55,22 @@ static const struct cx18_card cx18_card_hvr1600_esmt = {
        .hw_all = CX18_HW_TVEEPROM | CX18_HW_TUNER |
                  CX18_HW_CS5345 | CX18_HW_DVB,
        .video_inputs = {
-                { CX18_CARD_INPUT_VID_TUNER,  0, CX23418_COMPOSITE7 },
+                { CX18_CARD_INPUT_VID_TUNER,  0, CX18_AV_COMPOSITE7 },
-                { CX18_CARD_INPUT_SVIDEO1,    1, CX23418_SVIDEO1    },
+                { CX18_CARD_INPUT_SVIDEO1,    1, CX18_AV_SVIDEO1    },
-                { CX18_CARD_INPUT_COMPOSITE1, 1, CX23418_COMPOSITE3 },
+                { CX18_CARD_INPUT_COMPOSITE1, 1, CX18_AV_COMPOSITE3 },
-                { CX18_CARD_INPUT_SVIDEO2,    2, CX23418_SVIDEO2    },
+                { CX18_CARD_INPUT_SVIDEO2,    2, CX18_AV_SVIDEO2    },
-                { CX18_CARD_INPUT_COMPOSITE2, 2, CX23418_COMPOSITE4 },
+                { CX18_CARD_INPUT_COMPOSITE2, 2, CX18_AV_COMPOSITE4 },
        },
        .audio_inputs = {
                { CX18_CARD_INPUT_AUD_TUNER,
-                  CX23418_AUDIO8, CS5345_IN_1 | CS5345_MCLK_1_5 },
+                  CX18_AV_AUDIO8, CS5345_IN_1 | CS5345_MCLK_1_5 },
                { CX18_CARD_INPUT_LINE_IN1,
-                  CX23418_AUDIO_SERIAL, CS5345_IN_2 },
+                  CX18_AV_AUDIO_SERIAL, CS5345_IN_2 },
                { CX18_CARD_INPUT_LINE_IN2,
-                  CX23418_AUDIO_SERIAL, CS5345_IN_2 },
+                  CX18_AV_AUDIO_SERIAL, CS5345_IN_3 },
        },
        .radio_input = { CX18_CARD_INPUT_AUD_TUNER,
-                         CX23418_AUDIO_SERIAL, 0 },
+                         CX18_AV_AUDIO_SERIAL, CS5345_IN_4 },
        .ddr = {
                /* ESMT M13S128324A-5B memory */
                .chip_config = 0x003,
@@ -81,6 +82,11 @@ static const struct cx18_card cx18_card_hvr1600_esmt = {
        },
        .gpio_init.initial_value = 0x3001,
        .gpio_init.direction = 0x3001,
+        .gpio_i2c_slave_reset = {
+                .active_lo_mask = 0x3001,
+                .msecs_asserted = 10,
+                .msecs_recovery = 40,
+        },
        .i2c = &cx18_i2c_std,
 };
@@ -94,22 +100,22 @@ static const struct cx18_card cx18_card_hvr1600_samsung = {
        .hw_all = CX18_HW_TVEEPROM | CX18_HW_TUNER |
                  CX18_HW_CS5345 | CX18_HW_DVB,
        .video_inputs = {
-                { CX18_CARD_INPUT_VID_TUNER,  0, CX23418_COMPOSITE7 },
+                { CX18_CARD_INPUT_VID_TUNER,  0, CX18_AV_COMPOSITE7 },
-                { CX18_CARD_INPUT_SVIDEO1,    1, CX23418_SVIDEO1    },
+                { CX18_CARD_INPUT_SVIDEO1,    1, CX18_AV_SVIDEO1    },
-                { CX18_CARD_INPUT_COMPOSITE1, 1, CX23418_COMPOSITE3 },
+                { CX18_CARD_INPUT_COMPOSITE1, 1, CX18_AV_COMPOSITE3 },
-                { CX18_CARD_INPUT_SVIDEO2,    2, CX23418_SVIDEO2    },
+                { CX18_CARD_INPUT_SVIDEO2,    2, CX18_AV_SVIDEO2    },
-                { CX18_CARD_INPUT_COMPOSITE2, 2, CX23418_COMPOSITE4 },
+                { CX18_CARD_INPUT_COMPOSITE2, 2, CX18_AV_COMPOSITE4 },
        },
        .audio_inputs = {
                { CX18_CARD_INPUT_AUD_TUNER,
-                  CX23418_AUDIO8, CS5345_IN_1 | CS5345_MCLK_1_5 },
+                  CX18_AV_AUDIO8, CS5345_IN_1 | CS5345_MCLK_1_5 },
                { CX18_CARD_INPUT_LINE_IN1,
-                  CX23418_AUDIO_SERIAL, CS5345_IN_2 },
+                  CX18_AV_AUDIO_SERIAL, CS5345_IN_2 },
                { CX18_CARD_INPUT_LINE_IN2,
-                  CX23418_AUDIO_SERIAL, CS5345_IN_2 },
+                  CX18_AV_AUDIO_SERIAL, CS5345_IN_3 },
        },
        .radio_input = { CX18_CARD_INPUT_AUD_TUNER,
-                         CX23418_AUDIO_SERIAL, 0 },
+                         CX18_AV_AUDIO_SERIAL, CS5345_IN_4 },
        .ddr = {
                /* Samsung K4D263238G-VC33 memory */
                .chip_config = 0x003,
@@ -121,6 +127,11 @@ static const struct cx18_card cx18_card_hvr1600_samsung = {
        },
        .gpio_init.initial_value = 0x3001,
        .gpio_init.direction = 0x3001,
+        .gpio_i2c_slave_reset = {
+                .active_lo_mask = 0x3001,
+                .msecs_asserted = 10,
+                .msecs_recovery = 40,
+        },
        .i2c = &cx18_i2c_std,
 };
@@ -141,19 +152,19 @@ static const struct cx18_card cx18_card_h900 = {
        .hw_audio_ctrl = CX18_HW_CX23418,
        .hw_all = CX18_HW_TUNER,
        .video_inputs = {
-                { CX18_CARD_INPUT_VID_TUNER,  0, CX23418_COMPOSITE2 },
+                { CX18_CARD_INPUT_VID_TUNER,  0, CX18_AV_COMPOSITE2 },
                { CX18_CARD_INPUT_SVIDEO1,    1,
-                        CX23418_SVIDEO_LUMA3 | CX23418_SVIDEO_CHROMA4 },
+                        CX18_AV_SVIDEO_LUMA3 | CX18_AV_SVIDEO_CHROMA4 },
-                { CX18_CARD_INPUT_COMPOSITE1, 1, CX23418_COMPOSITE1 },
+                { CX18_CARD_INPUT_COMPOSITE1, 1, CX18_AV_COMPOSITE1 },
        },
        .audio_inputs = {
                { CX18_CARD_INPUT_AUD_TUNER,
-                  CX23418_AUDIO8, 0 },
+                  CX18_AV_AUDIO8, 0 },
                { CX18_CARD_INPUT_LINE_IN1,
-                  CX23418_AUDIO_SERIAL, 0 },
+                  CX18_AV_AUDIO_SERIAL, 0 },
        },
        .radio_input = { CX18_CARD_INPUT_AUD_TUNER,
-                         CX23418_AUDIO_SERIAL, 0 },
+                         CX18_AV_AUDIO_SERIAL, 0 },
        .tuners = {
                { .std = V4L2_STD_ALL, .tuner = TUNER_XC2028 },
        },
@@ -183,23 +194,26 @@ static const struct cx18_card_pci_info cx18_pci_mpc718[] = {
 static const struct cx18_card cx18_card_mpc718 = {
        .type = CX18_CARD_YUAN_MPC718,
        .name = "Yuan MPC718",
-        .comment = "Not yet supported!\n",
+        .comment = "Some Composite and S-Video inputs are currently working.\n",
-        .v4l2_capabilities = 0,
+        .v4l2_capabilities = CX18_CAP_ENCODER,
        .hw_audio_ctrl = CX18_HW_CX23418,
        .hw_all = CX18_HW_TUNER,
        .video_inputs = {
-                { CX18_CARD_INPUT_VID_TUNER,  0, CX23418_COMPOSITE7 },
+                { CX18_CARD_INPUT_VID_TUNER,  0, CX18_AV_COMPOSITE2 },
-                { CX18_CARD_INPUT_SVIDEO1,    1, CX23418_SVIDEO1    },
+                { CX18_CARD_INPUT_SVIDEO1,    1,
-                { CX18_CARD_INPUT_COMPOSITE1, 1, CX23418_COMPOSITE3 },
+                                CX18_AV_SVIDEO_LUMA3 | CX18_AV_SVIDEO_CHROMA4 },
+                { CX18_CARD_INPUT_COMPOSITE1, 1, CX18_AV_COMPOSITE1 },
+                { CX18_CARD_INPUT_SVIDEO2,    2,
+                                CX18_AV_SVIDEO_LUMA7 | CX18_AV_SVIDEO_CHROMA8 },
+                { CX18_CARD_INPUT_COMPOSITE2, 2, CX18_AV_COMPOSITE6 },
+                { CX18_CARD_INPUT_COMPOSITE3, 2, CX18_AV_COMPOSITE3 },
        },
        .audio_inputs = {
-                { CX18_CARD_INPUT_AUD_TUNER,
+                { CX18_CARD_INPUT_AUD_TUNER, CX18_AV_AUDIO5,       0 },
-                  CX23418_AUDIO8, 0 },
+                { CX18_CARD_INPUT_LINE_IN1,  CX18_AV_AUDIO_SERIAL, 0 },
-                { CX18_CARD_INPUT_LINE_IN1,
+                { CX18_CARD_INPUT_LINE_IN2,  CX18_AV_AUDIO_SERIAL, 0 },
-                  CX23418_AUDIO_SERIAL, 0 },
        },
-        .radio_input = { CX18_CARD_INPUT_AUD_TUNER,
+        .radio_input = { CX18_CARD_INPUT_AUD_TUNER, CX18_AV_AUDIO_SERIAL, 0 },
-                         CX23418_AUDIO_SERIAL, 0 },
        .tuners = {
                /* XC3028 tuner */
                { .std = V4L2_STD_ALL, .tuner = TUNER_XC2028 },
diff --git a/drivers/media/video/cx18/cx18-cards.h b/drivers/media/video/cx18/cx18-cards.h
index bccb67f0db16..dc2dd945d4c3 100644
--- a/drivers/media/video/cx18/cx18-cards.h
+++ b/drivers/media/video/cx18/cx18-cards.h
@@ -36,36 +36,6 @@
 #define CX18_CARD_INPUT_COMPOSITE2      5
 #define CX18_CARD_INPUT_COMPOSITE3      6
-enum cx34180_video_input {
-        /* Composite video inputs In1-In8 */
-        CX23418_COMPOSITE1 = 1,
-        CX23418_COMPOSITE2,
-        CX23418_COMPOSITE3,
-        CX23418_COMPOSITE4,
-        CX23418_COMPOSITE5,
-        CX23418_COMPOSITE6,
-        CX23418_COMPOSITE7,
-        CX23418_COMPOSITE8,
-        /* S-Video inputs consist of one luma input (In1-In4) ORed with one
-           chroma input (In5-In8) */
-        CX23418_SVIDEO_LUMA1 = 0x10,
-        CX23418_SVIDEO_LUMA2 = 0x20,
-        CX23418_SVIDEO_LUMA3 = 0x30,
-        CX23418_SVIDEO_LUMA4 = 0x40,
-        CX23418_SVIDEO_CHROMA4 = 0x400,
-        CX23418_SVIDEO_CHROMA5 = 0x500,
-        CX23418_SVIDEO_CHROMA6 = 0x600,
-        CX23418_SVIDEO_CHROMA7 = 0x700,
-        CX23418_SVIDEO_CHROMA8 = 0x800,
-        /* S-Video aliases for common luma/chroma combinations */
-        CX23418_SVIDEO1 = 0x510,
-        CX23418_SVIDEO2 = 0x620,
-        CX23418_SVIDEO3 = 0x730,
-        CX23418_SVIDEO4 = 0x840,
-};
 /* audio inputs */
 #define CX18_CARD_INPUT_AUD_TUNER       1
 #define CX18_CARD_INPUT_LINE_IN1        2
@@ -75,16 +45,6 @@ enum cx34180_video_input {
 #define CX18_CARD_MAX_AUDIO_INPUTS 3
 #define CX18_CARD_MAX_TUNERS       2
-enum cx23418_audio_input {
-        /* Audio inputs: serial or In4-In8 */
-        CX23418_AUDIO_SERIAL,
-        CX23418_AUDIO4 = 4,
-        CX23418_AUDIO5,
-        CX23418_AUDIO6,
-        CX23418_AUDIO7,
-        CX23418_AUDIO8,
-};
 /* V4L2 capability aliases */
 #define CX18_CAP_ENCODER (V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER | \
                          V4L2_CAP_AUDIO | V4L2_CAP_READWRITE)
@@ -118,6 +78,13 @@ struct cx18_gpio_init { /* set initial GPIO DIR and OUT values */
        u32 initial_value;
 };
+struct cx18_gpio_i2c_slave_reset {
+        u32 active_lo_mask; /* GPIO outputs that reset i2c chips when low */
+        u32 active_hi_mask; /* GPIO outputs that reset i2c chips when high */
+        int msecs_asserted; /* time period reset must remain asserted */
+        int msecs_recovery; /* time after deassert for chips to be ready */
+};
 struct cx18_card_tuner {
        v4l2_std_id std;        /* standard for which the tuner is suitable */
        int         tuner;      /* tuner ID (from tuner.h) */
@@ -154,7 +121,8 @@ struct cx18_card {
        /* GPIO card-specific settings */
        u8 xceive_pin;          /* XCeive tuner GPIO reset pin */
-        struct cx18_gpio_init           gpio_init;
+        struct cx18_gpio_init            gpio_init;
+        struct cx18_gpio_i2c_slave_reset gpio_i2c_slave_reset;
        struct cx18_card_tuner tuners[CX18_CARD_MAX_TUNERS];
        struct cx18_card_tuner_i2c *i2c;
diff --git a/drivers/media/video/cx18/cx18-dvb.c b/drivers/media/video/cx18/cx18-dvb.c
index c9744173f969..cae38985b131 100644
--- a/drivers/media/video/cx18/cx18-dvb.c
+++ b/drivers/media/video/cx18/cx18-dvb.c
@@ -69,11 +69,21 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed)
        struct dvb_demux *demux = feed->demux;
        struct cx18_stream *stream = (struct cx18_stream *) demux->priv;
        struct cx18 *cx = stream->cx;
-        int ret = -EINVAL;
+        int ret;
        u32 v;
        CX18_DEBUG_INFO("Start feed: pid = 0x%x index = %d\n",
                        feed->pid, feed->index);
+        mutex_lock(&cx->serialize_lock);
+        ret = cx18_init_on_first_open(cx);
+        mutex_unlock(&cx->serialize_lock);
+        if (ret) {
+                CX18_ERR("Failed to initialize firmware starting DVB feed\n");
+                return ret;
+        }
+        ret = -EINVAL;
        switch (cx->card->type) {
        case CX18_CARD_HVR_1600_ESMT:
        case CX18_CARD_HVR_1600_SAMSUNG:
@@ -101,6 +111,11 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed)
                if (stream->dvb.feeding++ == 0) {
                        CX18_DEBUG_INFO("Starting Transport DMA\n");
                        ret = cx18_start_v4l2_encode_stream(stream);
+                        if (ret < 0) {
+                                CX18_DEBUG_INFO(
+                                        "Failed to start Transport DMA\n");
+                                stream->dvb.feeding--;
+                        }
                } else
                        ret = 0;
                mutex_unlock(&stream->dvb.feedlock);
diff --git a/drivers/media/video/cx18/cx18-gpio.c b/drivers/media/video/cx18/cx18-gpio.c
index ceb63653c926..b302833f6f9d 100644
--- a/drivers/media/video/cx18/cx18-gpio.c
+++ b/drivers/media/video/cx18/cx18-gpio.c
@@ -53,10 +53,34 @@ static void gpio_write(struct cx18 *cx)
        write_reg(((dir & 0xffff) << 16) | (val & 0xffff),
                        CX18_REG_GPIO_OUT1);
        write_reg(dir & 0xffff0000, CX18_REG_GPIO_DIR2);
-        write_reg((dir & 0xffff0000) | ((val & 0xffff0000) >> 16),
+        write_reg_sync((dir & 0xffff0000) | ((val & 0xffff0000) >> 16),
                        CX18_REG_GPIO_OUT2);
 }
+void cx18_reset_i2c_slaves_gpio(struct cx18 *cx)
+{
+        const struct cx18_gpio_i2c_slave_reset *p;
+        p = &cx->card->gpio_i2c_slave_reset;
+        if ((p->active_lo_mask | p->active_hi_mask) == 0)
+                return;
+        /* Assuming that the masks are a subset of the bits in gpio_dir */
+        /* Assert */
+        cx->gpio_val =
+                (cx->gpio_val | p->active_hi_mask) & ~(p->active_lo_mask);
+        gpio_write(cx);
+        schedule_timeout_uninterruptible(msecs_to_jiffies(p->msecs_asserted));
+        /* Deassert */
+        cx->gpio_val =
+                (cx->gpio_val | p->active_lo_mask) & ~(p->active_hi_mask);
+        gpio_write(cx);
+        schedule_timeout_uninterruptible(msecs_to_jiffies(p->msecs_recovery));
+}
 void cx18_gpio_init(struct cx18 *cx)
 {
        cx->gpio_dir = cx->card->gpio_init.direction;
diff --git a/drivers/media/video/cx18/cx18-gpio.h b/drivers/media/video/cx18/cx18-gpio.h
index 41bac8856b50..525c328f748a 100644
--- a/drivers/media/video/cx18/cx18-gpio.h
+++ b/drivers/media/video/cx18/cx18-gpio.h
@@ -21,4 +21,5 @@
 */
 void cx18_gpio_init(struct cx18 *cx);
+void cx18_reset_i2c_slaves_gpio(struct cx18 *cx);
 int cx18_reset_tuner_gpio(void *dev, int cmd, int value);
diff --git a/drivers/media/video/cx18/cx18-i2c.c b/drivers/media/video/cx18/cx18-i2c.c
index 1d6c51a75313..680bc4e35b79 100644
--- a/drivers/media/video/cx18/cx18-i2c.c
+++ b/drivers/media/video/cx18/cx18-i2c.c
@@ -405,6 +405,8 @@ int init_cx18_i2c(struct cx18 *cx)
        cx18_setscl(&cx->i2c_algo_cb_data[1], 1);
        cx18_setsda(&cx->i2c_algo_cb_data[1], 1);
+        cx18_reset_i2c_slaves_gpio(cx);
        return i2c_bit_add_bus(&cx->i2c_adap[0]) ||
                i2c_bit_add_bus(&cx->i2c_adap[1]);
 }
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 607efdcd22f8..1da6f134888d 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -433,7 +433,7 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
                int chroma = vid_input & 0xf00;
                if ((vid_input & ~0xff0) ||
-                    luma < CX25840_SVIDEO_LUMA1 || luma > CX25840_SVIDEO_LUMA4 ||
+                    luma < CX25840_SVIDEO_LUMA1 || luma > CX25840_SVIDEO_LUMA8 ||
                    chroma < CX25840_SVIDEO_CHROMA4 || chroma > CX25840_SVIDEO_CHROMA8) {
                        v4l_err(client, "0x%04x is not a valid video input!\n",
                                vid_input);
diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
index e976fc6bef7c..80c8883e54b5 100644
--- a/drivers/media/video/cx88/cx88-alsa.c
+++ b/drivers/media/video/cx88/cx88-alsa.c
@@ -332,6 +332,12 @@ static int snd_cx88_pcm_open(struct snd_pcm_substream *substream)
        struct snd_pcm_runtime *runtime = substream->runtime;
        int err;
+        if (!chip) {
+                printk(KERN_ERR "BUG: cx88 can't find device struct."
+                                " Can't proceed with open\n");
+                return -ENODEV;
+        }
        err = snd_pcm_hw_constraint_pow2(runtime, 0, SNDRV_PCM_HW_PARAM_PERIODS);
        if (err < 0)
                goto _error;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 92b2a6db4fdc..3c006103c1eb 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -268,6 +268,12 @@ static int snd_em28xx_capture_open(struct snd_pcm_substream *substream)
        dprintk("opening device and trying to acquire exclusive lock\n");
+        if (!dev) {
+                printk(KERN_ERR "BUG: em28xx can't find device struct."
+                                " Can't proceed with open\n");
+                return -ENODEV;
+        }
        /* Sets volume, mute, etc */
        dev->mute = 0;
@@ -415,6 +421,12 @@ static int em28xx_audio_init(struct em28xx *dev)
        static int          devnr;
        int                 ret, err;
+        if (dev->has_audio_class) {
+                /* This device does not support the extension (in this case
+                   the device is expecting the snd-usb-audio module */
+                return 0;
+        }
        printk(KERN_INFO "em28xx-audio.c: probing for em28x1 "
                         "non standard usbaudio\n");
        printk(KERN_INFO "em28xx-audio.c: Copyright (C) 2006 Markus "
@@ -458,6 +470,12 @@ static int em28xx_audio_fini(struct em28xx *dev)
        if (dev == NULL)
                return 0;
+        if (dev->has_audio_class) {
+                /* This device does not support the extension (in this case
+                   the device is expecting the snd-usb-audio module */
+                return 0;
+        }
        if (dev->adev) {
                snd_card_free(dev->adev->sndcard);
                kfree(dev->adev);
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 3e4f3c7e92e7..8cbda43727c3 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -157,6 +157,7 @@ struct em28xx_board em28xx_boards[] = {
                .tda9887_conf = TDA9887_PRESENT,
                .tuner_type   = TUNER_XC2028,
                .mts_firmware = 1,
+                .has_dvb        = 1,
                .decoder      = EM28XX_TVP5150,
                .input          = { {
                        .type     = EM28XX_VMUX_TELEVISION,
@@ -524,6 +525,9 @@ void em28xx_pre_card_setup(struct em28xx *dev)
        rc = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
        if (rc > 0) {
                switch (rc) {
+                case CHIP_ID_EM2860:
+                        em28xx_info("chip ID is em2860\n");
+                        break;
                case CHIP_ID_EM2883:
                        em28xx_info("chip ID is em2882/em2883\n");
                        dev->wait_after_write = 0;
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index 8cf4983f0039..0b2333ee07f8 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -382,6 +382,11 @@ static int dvb_init(struct em28xx *dev)
        int result = 0;
        struct em28xx_dvb *dvb;
+        if (!dev->has_dvb) {
+                /* This device does not support the extension */
+                return 0;
+        }
        dvb = kzalloc(sizeof(struct em28xx_dvb), GFP_KERNEL);
        if (dvb == NULL) {
@@ -444,6 +449,11 @@ out_free:
 static int dvb_fini(struct em28xx *dev)
 {
+        if (!dev->has_dvb) {
+                /* This device does not support the extension */
+                return 0;
+        }
        if (dev->dvb) {
                unregister_dvb(dev->dvb);
                dev->dvb = NULL;
diff --git a/drivers/media/video/em28xx/em28xx-reg.h b/drivers/media/video/em28xx/em28xx-reg.h
index 9058bed07953..fac1ab23f621 100644
--- a/drivers/media/video/em28xx/em28xx-reg.h
+++ b/drivers/media/video/em28xx/em28xx-reg.h
@@ -84,5 +84,6 @@
 /* FIXME: Need to be populated with the other chip ID's */
 enum em28xx_chip_id {
+        CHIP_ID_EM2860 = 34,
        CHIP_ID_EM2883 = 36,
 };
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index fb163ecd9216..285bc62bbe46 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1848,32 +1848,28 @@ static DEFINE_MUTEX(em28xx_extension_devlist_lock);
 int em28xx_register_extension(struct em28xx_ops *ops)
 {
-        struct em28xx *h, *dev = NULL;
+        struct em28xx *dev = NULL;
-        list_for_each_entry(h, &em28xx_devlist, devlist)
-                dev = h;
        mutex_lock(&em28xx_extension_devlist_lock);
        list_add_tail(&ops->next, &em28xx_extension_devlist);
-        if (dev)
+        list_for_each_entry(dev, &em28xx_devlist, devlist) {
-                ops->init(dev);
+                if (dev)
+                        ops->init(dev);
+        }
        printk(KERN_INFO "Em28xx: Initialized (%s) extension\n", ops->name);
        mutex_unlock(&em28xx_extension_devlist_lock);
        return 0;
 }
 EXPORT_SYMBOL(em28xx_register_extension);
 void em28xx_unregister_extension(struct em28xx_ops *ops)
 {
-        struct em28xx *h, *dev = NULL;
+        struct em28xx *dev = NULL;
-        list_for_each_entry(h, &em28xx_devlist, devlist)
-                dev = h;
-        if (dev)
+        list_for_each_entry(dev, &em28xx_devlist, devlist) {
-                ops->fini(dev);
+                if (dev)
+                        ops->fini(dev);
+        }
        mutex_lock(&em28xx_extension_devlist_lock);
        printk(KERN_INFO "Em28xx: Removed (%s) extension\n", ops->name);
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 7cc8e9b19fb7..5ec5bb9a94d2 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -1019,12 +1019,12 @@ static int pxa_camera_probe(struct platform_device *pdev)
        struct pxa_camera_dev *pcdev;
        struct resource *res;
        void __iomem *base;
-        unsigned int irq;
+        int irq;
        int err = 0;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        irq = platform_get_irq(pdev, 0);
-        if (!res || !irq) {
+        if (!res || irq < 0) {
                err = -ENODEV;
                goto exit;
        }
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index ba3082422a01..f118de6e3672 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -613,9 +613,15 @@ static int snd_card_saa7134_capture_open(struct snd_pcm_substream * substream)
        struct snd_pcm_runtime *runtime = substream->runtime;
        snd_card_saa7134_pcm_t *pcm;
        snd_card_saa7134_t *saa7134 = snd_pcm_substream_chip(substream);
-        struct saa7134_dev *dev = saa7134->dev;
+        struct saa7134_dev *dev;
        int amux, err;
+        if (!saa7134) {
+                printk(KERN_ERR "BUG: saa7134 can't find device struct."
+                                " Can't proceed with open\n");
+                return -ENODEV;
+        }
+        dev = saa7134->dev;
        mutex_lock(&dev->dmasound.lock);
        dev->dmasound.read_count  = 0;
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index b111903aa322..2618cfa592e7 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -4114,11 +4114,7 @@ struct saa7134_board saa7134_boards[] = {
                .radio_type     = UNSET,
                .tuner_addr     = ADDR_UNSET,
                .radio_addr     = ADDR_UNSET,
-                 /*
-                    TODO:
                 .mpeg           = SAA7134_MPEG_DVB,
-                 */
                 .inputs         = {{
                         .name = name_tv,
                         .vmux = 1,
@@ -4157,7 +4153,7 @@ struct saa7134_board saa7134_boards[] = {
                } },
                .radio = {
                        .name = name_radio,
-                        .amux = LINE1,
+                        .amux = TV,
                },
        },
        [SAA7134_BOARD_AVERMEDIA_M115] = {
@@ -4167,6 +4163,7 @@ struct saa7134_board saa7134_boards[] = {
                .radio_type     = UNSET,
                .tuner_addr     = ADDR_UNSET,
                .radio_addr     = ADDR_UNSET,
+                .mpeg           = SAA7134_MPEG_DVB,
                .inputs         = {{
                        .name = name_tv,
                        .vmux = 1,
@@ -5351,22 +5348,21 @@ static int saa7134_xc2028_callback(struct saa7134_dev *dev,
 {
        switch (command) {
        case XC2028_TUNER_RESET:
-                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2, 0x06e20000, 0x06e20000);
+                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x00008000, 0x00000000);
-                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x06a20000, 0x06a20000);
+                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x00008000, 0x00008000);
-                mdelay(250);
+                switch (dev->board) {
-                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2, 0x06e20000, 0);
+                case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
-                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x06a20000, 0);
+                        saa7134_set_gpio(dev, 23, 0);
-                mdelay(250);
+                        msleep(10);
-                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2, 0x06e20000, 0x06e20000);
+                        saa7134_set_gpio(dev, 23, 1);
-                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x06a20000, 0x06a20000);
+                break;
-                mdelay(250);
+                case SAA7134_BOARD_AVERMEDIA_A16D:
-                saa_andorl(SAA7133_ANALOG_IO_SELECT >> 2, 0x02, 0x02);
+                        saa7134_set_gpio(dev, 21, 0);
-                saa_andorl(SAA7134_ANALOG_IN_CTRL1 >> 2, 0x81, 0x81);
+                        msleep(10);
-                saa_andorl(SAA7134_AUDIO_CLOCK0 >> 2, 0x03187de7, 0x03187de7);
+                        saa7134_set_gpio(dev, 21, 1);
-                saa_andorl(SAA7134_AUDIO_PLL_CTRL >> 2, 0x03, 0x03);
+                break;
-                saa_andorl(SAA7134_AUDIO_CLOCKS_PER_FIELD0 >> 2,
+                }
-                           0x0001e000, 0x0001e000);
+        return 0;
-                return 0;
        }
        return -EINVAL;
 }
@@ -5553,9 +5549,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x08000000, 0x00000000);
                break;
        case SAA7134_BOARD_AVERMEDIA_CARDBUS:
-        case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
        case SAA7134_BOARD_AVERMEDIA_M115:
-        case SAA7134_BOARD_AVERMEDIA_A16D:
                /* power-down tuner chip */
                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0xffffffff, 0);
                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0xffffffff, 0);
@@ -5565,6 +5559,18 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0xffffffff, 0xffffffff);
                msleep(10);
                break;
+        case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
+                saa7134_set_gpio(dev, 23, 0);
+                msleep(10);
+                saa7134_set_gpio(dev, 23, 1);
+                break;
+        case SAA7134_BOARD_AVERMEDIA_A16D:
+                saa7134_set_gpio(dev, 21, 0);
+                msleep(10);
+                saa7134_set_gpio(dev, 21, 1);
+                msleep(1);
+                dev->has_remote = SAA7134_REMOTE_GPIO;
+                break;
        case SAA7134_BOARD_BEHOLD_COLUMBUS_TVFM:
                /* power-down tuner chip */
                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0x000A8004, 0x000A8004);
@@ -5615,7 +5621,8 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0x80040100, 0x80040100);
                saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x80040100, 0x00040100);
                printk("%s: %s: hybrid analog/dvb card\n"
-                       "%s: Sorry, only the analog inputs are supported for now.\n",
+                       "%s: Sorry, only analog s-video and composite input "
+                       "are supported for now.\n",
                        dev->name, card(dev).name, dev->name);
                break;
        }
@@ -5675,6 +5682,7 @@ static void saa7134_tuner_setup(struct saa7134_dev *dev)
                switch (dev->board) {
                case SAA7134_BOARD_AVERMEDIA_A16D:
+                case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
                        ctl.demod = XC3028_FE_ZARLINK456;
                        break;
                default:
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 469f93aac008..341b101b0357 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -153,12 +153,12 @@ static int mt352_aver777_init(struct dvb_frontend* fe)
        return 0;
 }
-static int mt352_aver_a16d_init(struct dvb_frontend *fe)
+static int mt352_avermedia_xc3028_init(struct dvb_frontend *fe)
 {
-        static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x2d };
+        static u8 clock_config []  = { CLOCK_CTL, 0x38, 0x2d };
-        static u8 reset []         = { RESET,      0x80 };
+        static u8 reset []         = { RESET, 0x80 };
-        static u8 adc_ctl_1_cfg [] = { ADC_CTL_1,  0x40 };
+        static u8 adc_ctl_1_cfg [] = { ADC_CTL_1, 0x40 };
-        static u8 agc_cfg []       = { AGC_TARGET, 0x28, 0xa0 };
+        static u8 agc_cfg []       = { AGC_TARGET, 0xe };
        static u8 capt_range_cfg[] = { CAPT_RANGE, 0x33 };
        mt352_write(fe, clock_config,   sizeof(clock_config));
@@ -167,12 +167,9 @@ static int mt352_aver_a16d_init(struct dvb_frontend *fe)
        mt352_write(fe, adc_ctl_1_cfg,  sizeof(adc_ctl_1_cfg));
        mt352_write(fe, agc_cfg,        sizeof(agc_cfg));
        mt352_write(fe, capt_range_cfg, sizeof(capt_range_cfg));
        return 0;
 }
 static int mt352_pinnacle_tuner_set_params(struct dvb_frontend* fe,
                                           struct dvb_frontend_parameters* params)
 {
@@ -215,14 +212,10 @@ static struct mt352_config avermedia_777 = {
        .demod_init    = mt352_aver777_init,
 };
-static struct mt352_config avermedia_16d = {
+static struct mt352_config avermedia_xc3028_mt352_dev = {
-        .demod_address = 0xf,
-        .demod_init    = mt352_aver_a16d_init,
-};
-static struct mt352_config avermedia_e506r_mt352_dev = {
        .demod_address   = (0x1e >> 1),
        .no_tuner        = 1,
+        .demod_init      = mt352_avermedia_xc3028_init,
 };
 /* ==================================================================
@@ -975,9 +968,10 @@ static int dvb_init(struct saa7134_dev *dev)
                }
                break;
        case SAA7134_BOARD_AVERMEDIA_A16D:
-                dprintk("avertv A16D dvb setup\n");
+                dprintk("AverMedia A16D dvb setup\n");
-                dev->dvb.frontend = dvb_attach(mt352_attach, &avermedia_16d,
+                dev->dvb.frontend = dvb_attach(mt352_attach,
-                                               &dev->i2c_adap);
+                                                &avermedia_xc3028_mt352_dev,
+                                                &dev->i2c_adap);
                attach_xc3028 = 1;
                break;
        case SAA7134_BOARD_MD7134:
@@ -1091,7 +1085,8 @@ static int dvb_init(struct saa7134_dev *dev)
                                        ads_tech_duo_config.tuner_address);
                                goto dettach_frontend;
                        }
-                }
+                } else
+                        wprintk("failed to attach tda10046\n");
                break;
        case SAA7134_BOARD_TEVION_DVBT_220RF:
                if (configure_tda827x_fe(dev, &tevion_dvbt220rf_config,
@@ -1260,11 +1255,14 @@ static int dvb_init(struct saa7134_dev *dev)
                        goto dettach_frontend;
                break;
        case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
+                dprintk("AverMedia E506R dvb setup\n");
+                saa7134_set_gpio(dev, 25, 0);
+                msleep(10);
+                saa7134_set_gpio(dev, 25, 1);
                dev->dvb.frontend = dvb_attach(mt352_attach,
-                                               &avermedia_e506r_mt352_dev,
+                                                &avermedia_xc3028_mt352_dev,
-                                               &dev->i2c_adap);
+                                                &dev->i2c_adap);
                attach_xc3028 = 1;
-                break;
        case SAA7134_BOARD_MD7134_BRIDGE_2:
                dev->dvb.frontend = dvb_attach(tda10086_attach,
                                                &sd1878_4m, &dev->i2c_adap);
@@ -1338,7 +1336,8 @@ static int dvb_init(struct saa7134_dev *dev)
        return ret;
 dettach_frontend:
-        dvb_frontend_detach(dev->dvb.frontend);
+        if (dev->dvb.frontend)
+                dvb_frontend_detach(dev->dvb.frontend);
        dev->dvb.frontend = NULL;
        return -1;
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 81431ee41842..3ae71a340822 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -110,9 +110,10 @@ static int ts_release(struct inode *inode, struct file *file)
 {
        struct saa7134_dev *dev = file->private_data;
+        mutex_lock(&dev->empress_tsq.vb_lock);
        videobuf_stop(&dev->empress_tsq);
        videobuf_mmap_free(&dev->empress_tsq);
-        dev->empress_users--;
        /* stop the encoder */
        ts_reset_encoder(dev);
@@ -121,6 +122,10 @@ static int ts_release(struct inode *inode, struct file *file)
        saa_writeb(SAA7134_AUDIO_MUTE_CTRL,
                saa_readb(SAA7134_AUDIO_MUTE_CTRL) | (1 << 6));
+        dev->empress_users--;
+        mutex_unlock(&dev->empress_tsq.vb_lock);
        return 0;
 }
@@ -218,8 +223,7 @@ static int empress_enum_fmt_cap(struct file *file, void  *priv,
 static int empress_g_fmt_cap(struct file *file, void *priv,
                                struct v4l2_format *f)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        saa7134_i2c_call_clients(dev, VIDIOC_G_FMT, f);
@@ -232,8 +236,7 @@ static int empress_g_fmt_cap(struct file *file, void *priv,
 static int empress_s_fmt_cap(struct file *file, void *priv,
                                struct v4l2_format *f)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        saa7134_i2c_call_clients(dev, VIDIOC_S_FMT, f);
@@ -247,8 +250,7 @@ static int empress_s_fmt_cap(struct file *file, void *priv,
 static int empress_reqbufs(struct file *file, void *priv,
                                        struct v4l2_requestbuffers *p)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        return videobuf_reqbufs(&dev->empress_tsq, p);
 }
@@ -256,24 +258,21 @@ static int empress_reqbufs(struct file *file, void *priv,
 static int empress_querybuf(struct file *file, void *priv,
                                        struct v4l2_buffer *b)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        return videobuf_querybuf(&dev->empress_tsq, b);
 }
 static int empress_qbuf(struct file *file, void *priv, struct v4l2_buffer *b)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        return videobuf_qbuf(&dev->empress_tsq, b);
 }
 static int empress_dqbuf(struct file *file, void *priv, struct v4l2_buffer *b)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        return videobuf_dqbuf(&dev->empress_tsq, b,
                                file->f_flags & O_NONBLOCK);
@@ -282,8 +281,7 @@ static int empress_dqbuf(struct file *file, void *priv, struct v4l2_buffer *b)
 static int empress_streamon(struct file *file, void *priv,
                                        enum v4l2_buf_type type)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        return videobuf_streamon(&dev->empress_tsq);
 }
@@ -291,8 +289,7 @@ static int empress_streamon(struct file *file, void *priv,
 static int empress_streamoff(struct file *file, void *priv,
                                        enum v4l2_buf_type type)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        return videobuf_streamoff(&dev->empress_tsq);
 }
@@ -300,8 +297,7 @@ static int empress_streamoff(struct file *file, void *priv,
 static int empress_s_ext_ctrls(struct file *file, void *priv,
                               struct v4l2_ext_controls *ctrls)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        /* count == 0 is abused in saa6752hs.c, so that special
                case is handled here explicitly. */
@@ -320,8 +316,7 @@ static int empress_s_ext_ctrls(struct file *file, void *priv,
 static int empress_g_ext_ctrls(struct file *file, void *priv,
                               struct v4l2_ext_controls *ctrls)
 {
-        struct saa7134_fh *fh = priv;
+        struct saa7134_dev *dev = file->private_data;
-        struct saa7134_dev *dev = fh->dev;
        if (ctrls->ctrl_class != V4L2_CTRL_CLASS_MPEG)
                return -EINVAL;
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index 919632b10aae..76e6501d238d 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -323,6 +323,15 @@ int saa7134_input_init1(struct saa7134_dev *dev)
                saa_setb(SAA7134_GPIO_GPMODE1, 0x1);
                saa_setb(SAA7134_GPIO_GPSTATUS1, 0x1);
                break;
+        case SAA7134_BOARD_AVERMEDIA_A16D:
+                ir_codes     = ir_codes_avermedia_a16d;
+                mask_keycode = 0x02F200;
+                mask_keydown = 0x000400;
+                polling      = 50; /* ms */
+                /* Without this we won't receive key up events */
+                saa_setb(SAA7134_GPIO_GPMODE1, 0x1);
+                saa_setb(SAA7134_GPIO_GPSTATUS1, 0x1);
+                break;
        case SAA7134_BOARD_KWORLD_TERMINATOR:
                ir_codes     = ir_codes_pixelview;
                mask_keycode = 0x00001f;
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index a1b92446c8b4..d015bfe00950 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -763,15 +763,6 @@ static struct device_driver ic_drv = {
        .owner  = THIS_MODULE,
 };
-/*
- * Image capture host - this is a host device, not a bus device, so,
- * no bus reference, no probing.
- */
-static struct class soc_camera_host_class = {
-        .owner          = THIS_MODULE,
-        .name           = "camera_host",
-};
 static void dummy_release(struct device *dev)
 {
 }
@@ -801,7 +792,6 @@ int soc_camera_host_register(struct soc_camera_host *ici)
        /* Number might be equal to the platform device ID */
        sprintf(ici->dev.bus_id, "camera_host%d", ici->nr);
-        ici->dev.class = &soc_camera_host_class;
        mutex_lock(&list_lock);
        list_for_each_entry(ix, &hosts, list) {
@@ -1003,14 +993,9 @@ static int __init soc_camera_init(void)
        ret = driver_register(&ic_drv);
        if (ret)
                goto edrvr;
-        ret = class_register(&soc_camera_host_class);
-        if (ret)
-                goto eclr;
        return 0;
-eclr:
-        driver_unregister(&ic_drv);
 edrvr:
        bus_unregister(&soc_camera_bus_type);
        return ret;
@@ -1018,7 +1003,6 @@ edrvr:
 static void __exit soc_camera_exit(void)
 {
-        class_unregister(&soc_camera_host_class);
        driver_unregister(&ic_drv);
        bus_unregister(&soc_camera_bus_type);
 }
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 31e8af0ba278..67a661cf5219 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -51,12 +51,51 @@
 #define VIDEO_NUM_DEVICES       256
 #define VIDEO_NAME              "video4linux"
+struct std_descr {
+        v4l2_std_id std;
+        const char *descr;
+};
+static const struct std_descr standards[] = {
+        { V4L2_STD_NTSC,        "NTSC"      },
+        { V4L2_STD_NTSC_M,      "NTSC-M"    },
+        { V4L2_STD_NTSC_M_JP,   "NTSC-M-JP" },
+        { V4L2_STD_NTSC_M_KR,   "NTSC-M-KR" },
+        { V4L2_STD_NTSC_443,    "NTSC-443"  },
+        { V4L2_STD_PAL,         "PAL"       },
+        { V4L2_STD_PAL_BG,      "PAL-BG"    },
+        { V4L2_STD_PAL_B,       "PAL-B"     },
+        { V4L2_STD_PAL_B1,      "PAL-B1"    },
+        { V4L2_STD_PAL_G,       "PAL-G"     },
+        { V4L2_STD_PAL_H,       "PAL-H"     },
+        { V4L2_STD_PAL_I,       "PAL-I"     },
+        { V4L2_STD_PAL_DK,      "PAL-DK"    },
+        { V4L2_STD_PAL_D,       "PAL-D"     },
+        { V4L2_STD_PAL_D1,      "PAL-D1"    },
+        { V4L2_STD_PAL_K,       "PAL-K"     },
+        { V4L2_STD_PAL_M,       "PAL-M"     },
+        { V4L2_STD_PAL_N,       "PAL-N"     },
+        { V4L2_STD_PAL_Nc,      "PAL-Nc"    },
+        { V4L2_STD_PAL_60,      "PAL-60"    },
+        { V4L2_STD_SECAM,       "SECAM"     },
+        { V4L2_STD_SECAM_B,     "SECAM-B"   },
+        { V4L2_STD_SECAM_G,     "SECAM-G"   },
+        { V4L2_STD_SECAM_H,     "SECAM-H"   },
+        { V4L2_STD_SECAM_DK,    "SECAM-DK"  },
+        { V4L2_STD_SECAM_D,     "SECAM-D"   },
+        { V4L2_STD_SECAM_K,     "SECAM-K"   },
+        { V4L2_STD_SECAM_K1,    "SECAM-K1"  },
+        { V4L2_STD_SECAM_L,     "SECAM-L"   },
+        { V4L2_STD_SECAM_LC,    "SECAM-Lc"  },
+        { 0,                    "Unknown"   }
+};
 /* video4linux standard ID conversion to standard name
 */
-char *v4l2_norm_to_name(v4l2_std_id id)
+const char *v4l2_norm_to_name(v4l2_std_id id)
 {
-        char *name;
        u32 myid = id;
+        int i;
        /* HACK: ppc32 architecture doesn't have __ucmpdi2 function to handle
           64 bit comparations. So, on that architecture, with some gcc
@@ -64,110 +103,17 @@ char *v4l2_norm_to_name(v4l2_std_id id)
         */
        BUG_ON(myid != id);
-        switch (myid) {
+        for (i = 0; standards[i].std; i++)
-        case V4L2_STD_PAL:
+                if (myid == standards[i].std)
-                name = "PAL";
+                        break;
-                break;
+        return standards[i].descr;
-        case V4L2_STD_PAL_BG:
-                name = "PAL-BG";
-                break;
-        case V4L2_STD_PAL_DK:
-                name = "PAL-DK";
-                break;
-        case V4L2_STD_PAL_B:
-                name = "PAL-B";
-                break;
-        case V4L2_STD_PAL_B1:
-                name = "PAL-B1";
-                break;
-        case V4L2_STD_PAL_G:
-                name = "PAL-G";
-                break;
-        case V4L2_STD_PAL_H:
-                name = "PAL-H";
-                break;
-        case V4L2_STD_PAL_I:
-                name = "PAL-I";
-                break;
-        case V4L2_STD_PAL_D:
-                name = "PAL-D";
-                break;
-        case V4L2_STD_PAL_D1:
-                name = "PAL-D1";
-                break;
-        case V4L2_STD_PAL_K:
-                name = "PAL-K";
-                break;
-        case V4L2_STD_PAL_M:
-                name = "PAL-M";
-                break;
-        case V4L2_STD_PAL_N:
-                name = "PAL-N";
-                break;
-        case V4L2_STD_PAL_Nc:
-                name = "PAL-Nc";
-                break;
-        case V4L2_STD_PAL_60:
-                name = "PAL-60";
-                break;
-        case V4L2_STD_NTSC:
-                name = "NTSC";
-                break;
-        case V4L2_STD_NTSC_M:
-                name = "NTSC-M";
-                break;
-        case V4L2_STD_NTSC_M_JP:
-                name = "NTSC-M-JP";
-                break;
-        case V4L2_STD_NTSC_443:
-                name = "NTSC-443";
-                break;
-        case V4L2_STD_NTSC_M_KR:
-                name = "NTSC-M-KR";
-                break;
-        case V4L2_STD_SECAM:
-                name = "SECAM";
-                break;
-        case V4L2_STD_SECAM_DK:
-                name = "SECAM-DK";
-                break;
-        case V4L2_STD_SECAM_B:
-                name = "SECAM-B";
-                break;
-        case V4L2_STD_SECAM_D:
-                name = "SECAM-D";
-                break;
-        case V4L2_STD_SECAM_G:
-                name = "SECAM-G";
-                break;
-        case V4L2_STD_SECAM_H:
-                name = "SECAM-H";
-                break;
-        case V4L2_STD_SECAM_K:
-                name = "SECAM-K";
-                break;
-        case V4L2_STD_SECAM_K1:
-                name = "SECAM-K1";
-                break;
-        case V4L2_STD_SECAM_L:
-                name = "SECAM-L";
-                break;
-        case V4L2_STD_SECAM_LC:
-                name = "SECAM-LC";
-                break;
-        default:
-                name = "Unknown";
-                break;
-        }
-        return name;
 }
 EXPORT_SYMBOL(v4l2_norm_to_name);
 /* Fill in the fields of a v4l2_standard structure according to the
   'id' and 'transmission' parameters.  Returns negative on error.  */
 int v4l2_video_std_construct(struct v4l2_standard *vs,
-                             int id, char *name)
+                             int id, const char *name)
 {
        u32 index = vs->index;
@@ -1218,95 +1164,40 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
        case VIDIOC_ENUMSTD:
        {
                struct v4l2_standard *p = arg;
-                v4l2_std_id id = vfd->tvnorms,curr_id=0;
+                v4l2_std_id id = vfd->tvnorms, curr_id = 0;
-                unsigned int index = p->index,i;
+                unsigned int index = p->index, i, j = 0;
+                const char *descr = "";
-                if (index<0) {
-                        ret=-EINVAL;
+                /* Return norm array in a canonical way */
-                        break;
+                for (i = 0; i <= index && id; i++) {
-                }
+                        /* last std value in the standards array is 0, so this
+                           while always ends there since (id & 0) == 0. */
-                /* Return norm array on a canonical way */
+                        while ((id & standards[j].std) != standards[j].std)
-                for (i=0;i<= index && id; i++) {
+                                j++;
-                        if ( (id & V4L2_STD_PAL) == V4L2_STD_PAL) {
+                        curr_id = standards[j].std;
-                                curr_id = V4L2_STD_PAL;
+                        descr = standards[j].descr;
-                        } else if ( (id & V4L2_STD_PAL_BG) == V4L2_STD_PAL_BG) {
+                        j++;
-                                curr_id = V4L2_STD_PAL_BG;
+                        if (curr_id == 0)
-                        } else if ( (id & V4L2_STD_PAL_DK) == V4L2_STD_PAL_DK) {
-                                curr_id = V4L2_STD_PAL_DK;
-                        } else if ( (id & V4L2_STD_PAL_B) == V4L2_STD_PAL_B) {
-                                curr_id = V4L2_STD_PAL_B;
-                        } else if ( (id & V4L2_STD_PAL_B1) == V4L2_STD_PAL_B1) {
-                                curr_id = V4L2_STD_PAL_B1;
-                        } else if ( (id & V4L2_STD_PAL_G) == V4L2_STD_PAL_G) {
-                                curr_id = V4L2_STD_PAL_G;
-                        } else if ( (id & V4L2_STD_PAL_H) == V4L2_STD_PAL_H) {
-                                curr_id = V4L2_STD_PAL_H;
-                        } else if ( (id & V4L2_STD_PAL_I) == V4L2_STD_PAL_I) {
-                                curr_id = V4L2_STD_PAL_I;
-                        } else if ( (id & V4L2_STD_PAL_D) == V4L2_STD_PAL_D) {
-                                curr_id = V4L2_STD_PAL_D;
-                        } else if ( (id & V4L2_STD_PAL_D1) == V4L2_STD_PAL_D1) {
-                                curr_id = V4L2_STD_PAL_D1;
-                        } else if ( (id & V4L2_STD_PAL_K) == V4L2_STD_PAL_K) {
-                                curr_id = V4L2_STD_PAL_K;
-                        } else if ( (id & V4L2_STD_PAL_M) == V4L2_STD_PAL_M) {
-                                curr_id = V4L2_STD_PAL_M;
-                        } else if ( (id & V4L2_STD_PAL_N) == V4L2_STD_PAL_N) {
-                                curr_id = V4L2_STD_PAL_N;
-                        } else if ( (id & V4L2_STD_PAL_Nc) == V4L2_STD_PAL_Nc) {
-                                curr_id = V4L2_STD_PAL_Nc;
-                        } else if ( (id & V4L2_STD_PAL_60) == V4L2_STD_PAL_60) {
-                                curr_id = V4L2_STD_PAL_60;
-                        } else if ( (id & V4L2_STD_NTSC) == V4L2_STD_NTSC) {
-                                curr_id = V4L2_STD_NTSC;
-                        } else if ( (id & V4L2_STD_NTSC_M) == V4L2_STD_NTSC_M) {
-                                curr_id = V4L2_STD_NTSC_M;
-                        } else if ( (id & V4L2_STD_NTSC_M_JP) == V4L2_STD_NTSC_M_JP) {
-                                curr_id = V4L2_STD_NTSC_M_JP;
-                        } else if ( (id & V4L2_STD_NTSC_443) == V4L2_STD_NTSC_443) {
-                                curr_id = V4L2_STD_NTSC_443;
-                        } else if ( (id & V4L2_STD_NTSC_M_KR) == V4L2_STD_NTSC_M_KR) {
-                                curr_id = V4L2_STD_NTSC_M_KR;
-                        } else if ( (id & V4L2_STD_SECAM) == V4L2_STD_SECAM) {
-                                curr_id = V4L2_STD_SECAM;
-                        } else if ( (id & V4L2_STD_SECAM_DK) == V4L2_STD_SECAM_DK) {
-                                curr_id = V4L2_STD_SECAM_DK;
-                        } else if ( (id & V4L2_STD_SECAM_B) == V4L2_STD_SECAM_B) {
-                                curr_id = V4L2_STD_SECAM_B;
-                        } else if ( (id & V4L2_STD_SECAM_D) == V4L2_STD_SECAM_D) {
-                                curr_id = V4L2_STD_SECAM_D;
-                        } else if ( (id & V4L2_STD_SECAM_G) == V4L2_STD_SECAM_G) {
-                                curr_id = V4L2_STD_SECAM_G;
-                        } else if ( (id & V4L2_STD_SECAM_H) == V4L2_STD_SECAM_H) {
-                                curr_id = V4L2_STD_SECAM_H;
-                        } else if ( (id & V4L2_STD_SECAM_K) == V4L2_STD_SECAM_K) {
-                                curr_id = V4L2_STD_SECAM_K;
-                        } else if ( (id & V4L2_STD_SECAM_K1) == V4L2_STD_SECAM_K1) {
-                                curr_id = V4L2_STD_SECAM_K1;
-                        } else if ( (id & V4L2_STD_SECAM_L) == V4L2_STD_SECAM_L) {
-                                curr_id = V4L2_STD_SECAM_L;
-                        } else if ( (id & V4L2_STD_SECAM_LC) == V4L2_STD_SECAM_LC) {
-                                curr_id = V4L2_STD_SECAM_LC;
-                        } else {
                                break;
-                        }
+                        if (curr_id != V4L2_STD_PAL &&
-                        id &= ~curr_id;
+                            curr_id != V4L2_STD_SECAM &&
+                            curr_id != V4L2_STD_NTSC)
+                                id &= ~curr_id;
                }
-                if (i<=index)
+                if (i <= index)
                        return -EINVAL;
-                v4l2_video_std_construct(p, curr_id,v4l2_norm_to_name(curr_id));
+                v4l2_video_std_construct(p, curr_id, descr);
                p->index = index;
-                dbgarg (cmd, "index=%d, id=%Ld, name=%s, fps=%d/%d, "
+                dbgarg(cmd, "index=%d, id=%Ld, name=%s, fps=%d/%d, "
                                "framelines=%d\n", p->index,
                                (unsigned long long)p->id, p->name,
                                p->frameperiod.numerator,
                                p->frameperiod.denominator,
                                p->framelines);
-                ret=0;
+                ret = 0;
                break;
        }
        case VIDIOC_G_STD:
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index 845be1864f68..5ff9a58b6135 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -327,13 +327,14 @@ static void vivi_fillbuff(struct vivi_dev *dev, struct vivi_buffer *buf)
        int hmax  = buf->vb.height;
        int wmax  = buf->vb.width;
        struct timeval ts;
-        char *tmpbuf = kmalloc(wmax * 2, GFP_ATOMIC);
+        char *tmpbuf;
        void *vbuf = videobuf_to_vmalloc(&buf->vb);
-        if (!tmpbuf)
+        if (!vbuf)
                return;
-        if (!vbuf)
+        tmpbuf = kmalloc(wmax * 2, GFP_ATOMIC);
+        if (!tmpbuf)
                return;
        for (h = 0; h < hmax; h++) {
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 2edda8cc7f99..aabad8ce7458 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1768,9 +1768,10 @@ vortex_timer(unsigned long data)
        case XCVR_MII: case XCVR_NWAY:
                {
                        ok = 1;
-                        spin_lock_bh(&vp->lock);
+                        /* Interrupts are already disabled */
+                        spin_lock(&vp->lock);
                        vortex_check_media(dev, 0);
-                        spin_unlock_bh(&vp->lock);
+                        spin_unlock(&vp->lock);
                }
                break;
          default:                                      /* Other media types handled by Tx timeouts. */
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index f3cba5e24ec5..1037b1332312 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1803,6 +1803,8 @@ static int e100_rx_alloc_skb(struct nic *nic, struct rx *rx)
        if (rx->prev->skb) {
                struct rfd *prev_rfd = (struct rfd *)rx->prev->skb->data;
                put_unaligned_le32(rx->dma_addr, &prev_rfd->link);
+                pci_dma_sync_single_for_device(nic->pdev, rx->prev->dma_addr,
+                        sizeof(struct rfd), PCI_DMA_TODEVICE);
        }
        return 0;
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 701531e72e7b..a3f6a9c72ec8 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -347,7 +347,7 @@ e1000_set_tso(struct net_device *netdev, u32 data)
        else
                netdev->features &= ~NETIF_F_TSO;
-        if (data)
+        if (data && (adapter->hw.mac_type > e1000_82547_rev_2))
                netdev->features |= NETIF_F_TSO6;
        else
                netdev->features &= ~NETIF_F_TSO6;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index cab1835173cd..648a87bbf467 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2535,7 +2535,8 @@ void e1000e_down(struct e1000_adapter *adapter)
        adapter->link_speed = 0;
        adapter->link_duplex = 0;
-        e1000e_reset(adapter);
+        if (!pci_channel_offline(adapter->pdev))
+                e1000e_reset(adapter);
        e1000_clean_tx_ring(adapter);
        e1000_clean_rx_ring(adapter);
diff --git a/drivers/net/hamradio/dmascc.c b/drivers/net/hamradio/dmascc.c
index 0b94833e23f7..e8cfadefa4b6 100644
--- a/drivers/net/hamradio/dmascc.c
+++ b/drivers/net/hamradio/dmascc.c
@@ -1077,8 +1077,6 @@ static inline void rx_off(struct scc_priv *priv)
 static void start_timer(struct scc_priv *priv, int t, int r15)
 {
-        unsigned long flags;
        outb(priv->tmr_mode, priv->tmr_ctrl);
        if (t == 0) {
                tm_isr(priv);
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index ae398f04c7b4..e79a26a886c8 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -718,7 +718,8 @@ void igb_down(struct igb_adapter *adapter)
        adapter->link_speed = 0;
        adapter->link_duplex = 0;
-        igb_reset(adapter);
+        if (!pci_channel_offline(adapter->pdev))
+                igb_reset(adapter);
        igb_clean_all_tx_rings(adapter);
        igb_clean_all_rx_rings(adapter);
 }
diff --git a/drivers/net/ipg.c b/drivers/net/ipg.c
index 679a0826780e..2c03f4e2ccc4 100644
--- a/drivers/net/ipg.c
+++ b/drivers/net/ipg.c
@@ -1271,7 +1271,7 @@ static void ipg_nic_rx_with_end(struct net_device *dev,
                        framelen = le64_to_cpu(rxfd->rfs) & IPG_RFS_RXFRAMELEN;
-                        endframeLen = framelen - jumbo->current_size;
+                        endframelen = framelen - jumbo->current_size;
                        /*
                        if (framelen > IPG_RXFRAG_SIZE)
                                framelen=IPG_RXFRAG_SIZE;
@@ -1279,8 +1279,8 @@ static void ipg_nic_rx_with_end(struct net_device *dev,
                        if (framelen > IPG_RXSUPPORT_SIZE)
                                dev_kfree_skb_irq(jumbo->skb);
                        else {
-                                memcpy(skb_put(jumbo->skb, endframeLen),
+                                memcpy(skb_put(jumbo->skb, endframelen),
-                                       skb->data, endframeLen);
+                                       skb->data, endframelen);
                                jumbo->skb->protocol =
                                    eth_type_trans(jumbo->skb, dev);
@@ -1352,16 +1352,16 @@ static int ipg_nic_rx(struct net_device *dev)
                switch (ipg_nic_rx_check_frame_type(dev)) {
                case FRAME_WITH_START_WITH_END:
-                        ipg_nic_rx_with_start_and_end(dev, tp, rxfd, entry);
+                        ipg_nic_rx_with_start_and_end(dev, sp, rxfd, entry);
                        break;
                case FRAME_WITH_START:
-                        ipg_nic_rx_with_start(dev, tp, rxfd, entry);
+                        ipg_nic_rx_with_start(dev, sp, rxfd, entry);
                        break;
                case FRAME_WITH_END:
-                        ipg_nic_rx_with_end(dev, tp, rxfd, entry);
+                        ipg_nic_rx_with_end(dev, sp, rxfd, entry);
                        break;
                case FRAME_NO_START_NO_END:
-                        ipg_nic_rx_no_start_no_end(dev, tp, rxfd, entry);
+                        ipg_nic_rx_no_start_no_end(dev, sp, rxfd, entry);
                        break;
                }
        }
@@ -1808,7 +1808,7 @@ static int ipg_nic_open(struct net_device *dev)
        /* initialize JUMBO Frame control variable */
        sp->jumbo.found_start = 0;
        sp->jumbo.current_size = 0;
-        sp->jumbo.skb = 0;
+        sp->jumbo.skb = NULL;
        dev->mtu = IPG_TXFRAG_SIZE;
 #endif
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 7b859220c255..8f0460901153 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1969,7 +1969,8 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
        netif_carrier_off(netdev);
        netif_stop_queue(netdev);
-        ixgbe_reset(adapter);
+        if (!pci_channel_offline(adapter->pdev))
+                ixgbe_reset(adapter);
        ixgbe_clean_all_tx_rings(adapter);
        ixgbe_clean_all_rx_rings(adapter);
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 6797ed069f1f..63cd67b931e7 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -71,14 +71,18 @@ static irqreturn_t netxen_intr(int irq, void *data);
 static irqreturn_t netxen_msi_intr(int irq, void *data);
 /*  PCI Device ID Table  */
+#define ENTRY(device) \
+        {PCI_DEVICE(0x4040, (device)), \
+        .class = PCI_CLASS_NETWORK_ETHERNET << 8, .class_mask = ~0}
 static struct pci_device_id netxen_pci_tbl[] __devinitdata = {
-        {PCI_DEVICE(0x4040, 0x0001), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0001),
-        {PCI_DEVICE(0x4040, 0x0002), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0002),
-        {PCI_DEVICE(0x4040, 0x0003), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0003),
-        {PCI_DEVICE(0x4040, 0x0004), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0004),
-        {PCI_DEVICE(0x4040, 0x0005), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0005),
-        {PCI_DEVICE(0x4040, 0x0024), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0024),
-        {PCI_DEVICE(0x4040, 0x0025), PCI_DEVICE_CLASS(0x020000, ~0)},
+        ENTRY(0x0025),
        {0,}
 };
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index ce95c5d168fe..70d012e90dcf 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -525,12 +525,14 @@ static int axnet_open(struct net_device *dev)
    int ret;
    axnet_dev_t *info = PRIV(dev);
    struct pcmcia_device *link = info->p_dev;
+    unsigned int nic_base = dev->base_addr;
    
    DEBUG(2, "axnet_open('%s')\n", dev->name);
    if (!pcmcia_dev_present(link))
        return -ENODEV;
+    outb_p(0xFF, nic_base + EN0_ISR); /* Clear bogus intr. */
    ret = request_irq(dev->irq, ei_irq_wrapper, IRQF_SHARED, "axnet_cs", dev);
    if (ret)
            return ret;
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index fd8158a86f64..2d4c4ad89b8d 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -969,6 +969,7 @@ static int pcnet_open(struct net_device *dev)
    int ret;
    pcnet_dev_t *info = PRIV(dev);
    struct pcmcia_device *link = info->p_dev;
+    unsigned int nic_base = dev->base_addr;
    DEBUG(2, "pcnet_open('%s')\n", dev->name);
@@ -976,6 +977,8 @@ static int pcnet_open(struct net_device *dev)
        return -ENODEV;
    set_misc_reg(dev);
+    outb_p(0xFF, nic_base + EN0_ISR); /* Clear bogus intr. */
    ret = request_irq(dev->irq, ei_irq_wrapper, IRQF_SHARED, dev_info, dev);
    if (ret)
            return ret;
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index b7f7b2227d56..bccee68bd48a 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -3701,7 +3701,9 @@ static int ql_cycle_adapter(struct ql3_adapter *qdev, int reset)
                printk(KERN_ERR PFX
                                "%s: Driver up/down cycle failed, "
                                "closing device\n",qdev->ndev->name);
+                rtnl_lock();
                dev_close(qdev->ndev);
+                rtnl_unlock();
                return -1;
        }
        return 0;
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 858b191517b3..504a48ff73c8 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -273,7 +273,7 @@ static void r6040_init_ring_desc(struct r6040_descriptor *desc_ring,
        dma_addr_t mapping = desc_dma;
        while (size-- > 0) {
-                mapping += sizeof(sizeof(*desc));
+                mapping += sizeof(*desc);
                desc->ndesc = cpu_to_le32(mapping);
                desc->vndescp = desc + 1;
                desc++;
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index b5c1e663417d..ae7b697456b4 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2625,9 +2625,7 @@ static int fill_rx_buffers(struct ring_info *ring)
                        rxdp1->Buffer0_ptr = pci_map_single
                            (ring->pdev, skb->data, size - NET_IP_ALIGN,
                                PCI_DMA_FROMDEVICE);
-                        if( (rxdp1->Buffer0_ptr == 0) ||
+                        if(pci_dma_mapping_error(rxdp1->Buffer0_ptr))
-                                (rxdp1->Buffer0_ptr ==
-                                DMA_ERROR_CODE))
                                goto pci_map_failed;
                        rxdp->Control_2 =
@@ -2657,6 +2655,7 @@ static int fill_rx_buffers(struct ring_info *ring)
                        skb->data = (void *) (unsigned long)tmp;
                        skb_reset_tail_pointer(skb);
+                        /* AK: check is wrong. 0 can be valid dma address */
                        if (!(rxdp3->Buffer0_ptr))
                                rxdp3->Buffer0_ptr =
                                   pci_map_single(ring->pdev, ba->ba_0,
@@ -2665,8 +2664,7 @@ static int fill_rx_buffers(struct ring_info *ring)
                                pci_dma_sync_single_for_device(ring->pdev,
                                (dma_addr_t) rxdp3->Buffer0_ptr,
                                    BUF0_LEN, PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer0_ptr == 0) ||
+                        if (pci_dma_mapping_error(rxdp3->Buffer0_ptr))
-                                (rxdp3->Buffer0_ptr == DMA_ERROR_CODE))
                                goto pci_map_failed;
                        rxdp->Control_2 = SET_BUFFER0_SIZE_3(BUF0_LEN);
@@ -2681,18 +2679,17 @@ static int fill_rx_buffers(struct ring_info *ring)
                                (ring->pdev, skb->data, ring->mtu + 4,
                                                PCI_DMA_FROMDEVICE);
-                                if( (rxdp3->Buffer2_ptr == 0) ||
+                                if (pci_dma_mapping_error(rxdp3->Buffer2_ptr))
-                                        (rxdp3->Buffer2_ptr == DMA_ERROR_CODE))
                                        goto pci_map_failed;
+                                /* AK: check is wrong */
                                if (!rxdp3->Buffer1_ptr)
                                        rxdp3->Buffer1_ptr =
                                                pci_map_single(ring->pdev,
                                                ba->ba_1, BUF1_LEN,
                                                PCI_DMA_FROMDEVICE);
-                                if( (rxdp3->Buffer1_ptr == 0) ||
+                                if (pci_dma_mapping_error(rxdp3->Buffer1_ptr)) {
-                                        (rxdp3->Buffer1_ptr == DMA_ERROR_CODE)) {
                                        pci_unmap_single
                                                (ring->pdev,
                                                (dma_addr_t)(unsigned long)
@@ -4264,16 +4261,14 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                txdp->Buffer_Pointer = pci_map_single(sp->pdev,
                                        fifo->ufo_in_band_v,
                                        sizeof(u64), PCI_DMA_TODEVICE);
-                if((txdp->Buffer_Pointer == 0) ||
+                if (pci_dma_mapping_error(txdp->Buffer_Pointer))
-                        (txdp->Buffer_Pointer == DMA_ERROR_CODE))
                        goto pci_map_failed;
                txdp++;
        }
        txdp->Buffer_Pointer = pci_map_single
            (sp->pdev, skb->data, frg_len, PCI_DMA_TODEVICE);
-        if((txdp->Buffer_Pointer == 0) ||
+        if (pci_dma_mapping_error(txdp->Buffer_Pointer))
-                (txdp->Buffer_Pointer == DMA_ERROR_CODE))
                goto pci_map_failed;
        txdp->Host_Control = (unsigned long) skb;
@@ -6884,10 +6879,8 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                                pci_map_single( sp->pdev, (*skb)->data,
                                        size - NET_IP_ALIGN,
                                        PCI_DMA_FROMDEVICE);
-                        if( (rxdp1->Buffer0_ptr == 0) ||
+                        if (pci_dma_mapping_error(rxdp1->Buffer0_ptr))
-                                (rxdp1->Buffer0_ptr == DMA_ERROR_CODE)) {
                                goto memalloc_failed;
-                        }
                        rxdp->Host_Control = (unsigned long) (*skb);
                }
        } else if ((sp->rxd_mode == RXD_MODE_3B) && (rxdp->Host_Control == 0)) {
@@ -6913,15 +6906,12 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                                pci_map_single(sp->pdev, (*skb)->data,
                                               dev->mtu + 4,
                                               PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer2_ptr == 0) ||
+                        if (pci_dma_mapping_error(rxdp3->Buffer2_ptr))
-                                (rxdp3->Buffer2_ptr == DMA_ERROR_CODE)) {
                                goto memalloc_failed;
-                        }
                        rxdp3->Buffer0_ptr = *temp0 =
                                pci_map_single( sp->pdev, ba->ba_0, BUF0_LEN,
                                                PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer0_ptr == 0) ||
+                        if (pci_dma_mapping_error(rxdp3->Buffer0_ptr)) {
-                                (rxdp3->Buffer0_ptr == DMA_ERROR_CODE)) {
                                pci_unmap_single (sp->pdev,
                                        (dma_addr_t)rxdp3->Buffer2_ptr,
                                        dev->mtu + 4, PCI_DMA_FROMDEVICE);
@@ -6933,8 +6923,7 @@ static int set_rxd_buffer_pointer(struct s2io_nic *sp, struct RxD_t *rxdp,
                        rxdp3->Buffer1_ptr = *temp1 =
                                pci_map_single(sp->pdev, ba->ba_1, BUF1_LEN,
                                                PCI_DMA_FROMDEVICE);
-                        if( (rxdp3->Buffer1_ptr == 0) ||
+                        if (pci_dma_mapping_error(rxdp3->Buffer1_ptr)) {
-                                (rxdp3->Buffer1_ptr == DMA_ERROR_CODE)) {
                                pci_unmap_single (sp->pdev,
                                        (dma_addr_t)rxdp3->Buffer0_ptr,
                                        BUF0_LEN, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 4706f7f9acb6..1827b6686c98 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -75,10 +75,6 @@ static int debug_level = ERR_DBG;
 /* DEBUG message print. */
 #define DBG_PRINT(dbg_level, args...)  if(!(debug_level<dbg_level)) printk(args)
-#ifndef DMA_ERROR_CODE
-#define DMA_ERROR_CODE          (~(dma_addr_t)0x0)
-#endif
 /* Protocol assist features of the NIC */
 #define L3_CKSUM_OK 0xFFFF
 #define L4_CKSUM_OK 0xFFFF
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 10e4e85da3fc..b07b8cbadeaf 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1394,6 +1394,7 @@ tc35815_open(struct net_device *dev)
        tc35815_chip_init(dev);
        spin_unlock_irq(&lp->lock);
+        netif_carrier_off(dev);
        /* schedule a link state check */
        phy_start(lp->phy_dev);
@@ -1735,7 +1736,6 @@ tc35815_rx(struct net_device *dev)
                        skb = lp->rx_skbs[cur_bd].skb;
                        prefetch(skb->data);
                        lp->rx_skbs[cur_bd].skb = NULL;
-                        lp->fbl_count--;
                        pci_unmap_single(lp->pci_dev,
                                         lp->rx_skbs[cur_bd].skb_dma,
                                         RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
@@ -1791,6 +1791,7 @@ tc35815_rx(struct net_device *dev)
 #ifdef TC35815_USE_PACKEDBUFFER
                        while (lp->fbl_curid != id)
 #else
+                        lp->fbl_count--;
                        while (lp->fbl_count < RX_BUF_NUM)
 #endif
                        {
@@ -2453,6 +2454,7 @@ static int tc35815_resume(struct pci_dev *pdev)
                return 0;
        pci_set_power_state(pdev, PCI_D0);
        tc35815_restart(dev);
+        netif_carrier_off(dev);
        if (lp->phy_dev)
                phy_start(lp->phy_dev);
        netif_device_attach(dev);
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 249e18053d5f..069f8bb0a99f 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -32,6 +32,7 @@
 #include <linux/x25.h>
 #include <linux/lapb.h>
 #include <linux/init.h>
+#include <linux/rtnetlink.h>
 #include "x25_asy.h"
 #include <net/x25device.h>
@@ -601,8 +602,10 @@ static void x25_asy_close_tty(struct tty_struct *tty)
        if (!sl || sl->magic != X25_ASY_MAGIC)
                return;
+        rtnl_lock();
        if (sl->dev->flags & IFF_UP)
                dev_close(sl->dev);
+        rtnl_unlock();
        tty->disc_data = NULL;
        sl->tty = NULL;
diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index 36a9c42df835..76f4c7bad8b8 100644
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -72,6 +72,9 @@ static void b43_led_brightness_set(struct led_classdev *led_dev,
        struct b43_wldev *dev = led->dev;
        bool radio_enabled;
+        if (unlikely(b43_status(dev) < B43_STAT_INITIALIZED))
+                return;
        /* Checking the radio-enabled status here is slightly racy,
         * but we want to avoid the locking overhead and we don't care
         * whether the LED has the wrong state for a second. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index fa4b0d8b74a2..a70827793086 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2883,12 +2883,11 @@ static int b43_op_tx(struct ieee80211_hw *hw,
        if (unlikely(skb->len < 2 + 2 + 6)) {
                /* Too short, this can't be a valid frame. */
-                dev_kfree_skb_any(skb);
+                goto drop_packet;
-                return NETDEV_TX_OK;
        }
        B43_WARN_ON(skb_shinfo(skb)->nr_frags);
        if (unlikely(!dev))
-                return NETDEV_TX_BUSY;
+                goto drop_packet;
        /* Transmissions on seperate queues can run concurrently. */
        read_lock_irqsave(&wl->tx_lock, flags);
@@ -2904,7 +2903,12 @@ static int b43_op_tx(struct ieee80211_hw *hw,
        read_unlock_irqrestore(&wl->tx_lock, flags);
        if (unlikely(err))
-                return NETDEV_TX_BUSY;
+                goto drop_packet;
+        return NETDEV_TX_OK;
+drop_packet:
+        /* We can not transmit this packet. Drop it. */
+        dev_kfree_skb_any(skb);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index c990f87b107a..93ddc1cbcc8b 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -876,6 +876,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
        if (!ring)
                goto out;
        ring->type = type;
+        ring->dev = dev;
        nr_slots = B43legacy_RXRING_SLOTS;
        if (for_tx)
@@ -922,7 +923,6 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev,
                                 DMA_TO_DEVICE);
        }
-        ring->dev = dev;
        ring->nr_slots = nr_slots;
        ring->mmio_base = b43legacy_dmacontroller_base(type, controller_index);
        ring->index = controller_index;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 204077c13870..3e612d0a13e8 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2378,8 +2378,10 @@ static int b43legacy_op_tx(struct ieee80211_hw *hw,
        } else
                err = b43legacy_dma_tx(dev, skb, ctl);
 out:
-        if (unlikely(err))
+        if (unlikely(err)) {
-                return NETDEV_TX_BUSY;
+                /* Drop the packet. */
+                dev_kfree_skb_any(skb);
+        }
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 4fd73809602e..020f450e9dba 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -64,7 +64,7 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
        int hdrlen, phdrlen, head_need, tail_need;
        u16 fc;
        int prism_header, ret;
-        struct ieee80211_hdr_4addr *hdr;
+        struct ieee80211_hdr_4addr *fhdr;
        iface = netdev_priv(dev);
        local = iface->local;
@@ -83,8 +83,8 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb,
                phdrlen = 0;
        }
-        hdr = (struct ieee80211_hdr_4addr *) skb->data;
+        fhdr = (struct ieee80211_hdr_4addr *) skb->data;
-        fc = le16_to_cpu(hdr->frame_ctl);
+        fc = le16_to_cpu(fhdr->frame_ctl);
        if (type == PRISM2_RX_MGMT && (fc & IEEE80211_FCTL_VERS)) {
                printk(KERN_DEBUG "%s: dropped management frame with header "
@@ -551,7 +551,7 @@ hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr_4addr *hdr,
             hdr->addr1[2] != 0xff || hdr->addr1[3] != 0xff ||
             hdr->addr1[4] != 0xff || hdr->addr1[5] != 0xff)) {
                /* RA (or BSSID) is not ours - drop */
-                PDEBUG(DEBUG_EXTRA, "%s: received WDS frame with "
+                PDEBUG(DEBUG_EXTRA2, "%s: received WDS frame with "
                       "not own or broadcast %s=%s\n",
                       local->dev->name,
                       fc & IEEE80211_FCTL_FROMDS ? "RA" : "BSSID",
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 0acd9589c48c..ab981afd481d 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -1930,7 +1930,7 @@ static void handle_pspoll(local_info_t *local,
                PDEBUG(DEBUG_PS, "   PSPOLL and AID[15:14] not set\n");
                return;
        }
-        aid &= ~BIT(15) & ~BIT(14);
+        aid &= ~(BIT(15) | BIT(14));
        if (aid == 0 || aid > MAX_AID_TABLE_SIZE) {
                PDEBUG(DEBUG_PS, "   invalid aid=%d\n", aid);
                return;
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index ed4317a17cbb..80039a0ae027 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -533,10 +533,10 @@ static void prism2_detach(struct pcmcia_device *link)
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 #define CFG_CHECK2(fn, retf) \
-do { int ret = (retf); \
+do { int _ret = (retf); \
-if (ret != 0) { \
+if (_ret != 0) { \
-        PDEBUG(DEBUG_EXTRA, "CardServices(" #fn ") returned %d\n", ret); \
+        PDEBUG(DEBUG_EXTRA, "CardServices(" #fn ") returned %d\n", _ret); \
-        cs_error(link, fn, ret); \
+        cs_error(link, fn, _ret); \
        goto next_entry; \
 } \
 } while (0)
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index cdf90c40f11b..936f52e3d95c 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2835,7 +2835,7 @@ static void hostap_passive_scan(unsigned long data)
 {
        local_info_t *local = (local_info_t *) data;
        struct net_device *dev = local->dev;
-        u16 channel;
+        u16 chan;
        if (local->passive_scan_interval <= 0)
                return;
@@ -2872,11 +2872,11 @@ static void hostap_passive_scan(unsigned long data)
                printk(KERN_DEBUG "%s: passive scan channel %d\n",
                       dev->name, local->passive_scan_channel);
-                channel = local->passive_scan_channel;
+                chan = local->passive_scan_channel;
                local->passive_scan_state = PASSIVE_SCAN_WAIT;
                local->passive_scan_timer.expires = jiffies + HZ / 10;
        } else {
-                channel = local->channel;
+                chan = local->channel;
                local->passive_scan_state = PASSIVE_SCAN_LISTEN;
                local->passive_scan_timer.expires = jiffies +
                        local->passive_scan_interval * HZ;
@@ -2884,9 +2884,9 @@ static void hostap_passive_scan(unsigned long data)
        if (hfa384x_cmd_callback(dev, HFA384X_CMDCODE_TEST |
                                 (HFA384X_TEST_CHANGE_CHANNEL << 8),
-                                 channel, NULL, 0))
+                                 chan, NULL, 0))
                printk(KERN_ERR "%s: passive scan channel set %d "
-                       "failed\n", dev->name, channel);
+                       "failed\n", dev->name, chan);
        add_timer(&local->passive_scan_timer);
 }
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index f7aec9309d04..a38e85f334df 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -594,7 +594,8 @@ void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx)
 }
-int hostap_80211_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+static int hostap_80211_header_parse(const struct sk_buff *skb,
+                                     unsigned char *haddr)
 {
        struct hostap_interface *iface = netdev_priv(skb->dev);
        local_info_t *local = iface->local;
@@ -857,7 +858,6 @@ const struct header_ops hostap_80211_ops = {
        .rebuild        = eth_rebuild_header,
        .cache          = eth_header_cache,
        .cache_update   = eth_header_cache_update,
        .parse          = hostap_80211_header_parse,
 };
 EXPORT_SYMBOL(hostap_80211_ops);
@@ -1150,7 +1150,6 @@ EXPORT_SYMBOL(hostap_set_roaming);
 EXPORT_SYMBOL(hostap_set_auth_algs);
 EXPORT_SYMBOL(hostap_dump_rx_header);
 EXPORT_SYMBOL(hostap_dump_tx_header);
-EXPORT_SYMBOL(hostap_80211_header_parse);
 EXPORT_SYMBOL(hostap_80211_get_hdrlen);
 EXPORT_SYMBOL(hostap_get_stats);
 EXPORT_SYMBOL(hostap_setup_dev);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 13925b627e3b..b1b3c523185d 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2227,7 +2227,10 @@ static int iwl3945_scan_initiate(struct iwl3945_priv *priv)
        }
        IWL_DEBUG_INFO("Starting scan...\n");
-        priv->scan_bands = 2;
+        if (priv->cfg->sku & IWL_SKU_G)
+                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        if (priv->cfg->sku & IWL_SKU_A)
+                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
        set_bit(STATUS_SCANNING, &priv->status);
        priv->scan_start = jiffies;
        priv->scan_pass_start = priv->scan_start;
@@ -3352,13 +3355,18 @@ static void iwl3945_rx_scan_complete_notif(struct iwl3945_priv *priv,
        cancel_delayed_work(&priv->scan_check);
        IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands == 2) ? "2.4" : "5.2",
+                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
+                                                        "2.4" : "5.2",
                       jiffies_to_msecs(elapsed_jiffies
                                        (priv->scan_pass_start, jiffies)));
-        /* Remove this scanned band from the list
+        /* Remove this scanned band from the list of pending
-         * of pending bands to scan */
+         * bands to scan, band G precedes A in order of scanning
-        priv->scan_bands--;
+         * as seen in iwl3945_bg_request_scan */
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
+        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
        /* If a request to abort was given, or the scan did not succeed
         * then we reset the scan state machine and terminate,
@@ -4972,7 +4980,7 @@ static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv,
                ch_info = iwl3945_get_channel_info(priv, band, scan_ch->channel);
                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
+                        IWL_DEBUG_SCAN("Channel %d is INVALID for this band.\n",
                                       scan_ch->channel);
                        continue;
                }
@@ -6315,21 +6323,16 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
        /* flags + rate selection */
-        switch (priv->scan_bands) {
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
-        case 2:
                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
                scan->good_CRC_th = 0;
                band = IEEE80211_BAND_2GHZ;
-                break;
+        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
-        case 1:
                scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
                scan->good_CRC_th = IWL_GOOD_CRC_TH;
                band = IEEE80211_BAND_5GHZ;
-                break;
+        } else {
-        default:
                IWL_WARNING("Invalid scan band count\n");
                goto done;
        }
@@ -6770,7 +6773,7 @@ static int iwl3945_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *co
        ch_info = iwl3945_get_channel_info(priv, conf->channel->band,
                                           conf->channel->hw_value);
        if (!is_channel_valid(ch_info)) {
-                IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this SKU.\n",
+                IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this band.\n",
                               conf->channel->hw_value, conf->channel->band);
                IWL_DEBUG_MAC80211("leave - invalid channel\n");
                spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 883b42f7e998..5ed16ce78468 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -1774,7 +1774,10 @@ static int iwl4965_scan_initiate(struct iwl_priv *priv)
        }
        IWL_DEBUG_INFO("Starting scan...\n");
-        priv->scan_bands = 2;
+        if (priv->cfg->sku & IWL_SKU_G)
+                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        if (priv->cfg->sku & IWL_SKU_A)
+                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
        set_bit(STATUS_SCANNING, &priv->status);
        priv->scan_start = jiffies;
        priv->scan_pass_start = priv->scan_start;
@@ -3023,8 +3026,9 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
        IWL_DEBUG_TX_REPLY("Tx queue reclaim %d\n", index);
        if (index != -1) {
-                int freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
 #ifdef CONFIG_IWL4965_HT
+                int freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
                if (tid != MAX_TID_COUNT)
                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
                if (iwl4965_queue_space(&txq->q) > txq->q.low_mark &&
@@ -3276,13 +3280,18 @@ static void iwl4965_rx_scan_complete_notif(struct iwl_priv *priv,
        cancel_delayed_work(&priv->scan_check);
        IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands == 2) ? "2.4" : "5.2",
+                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
+                                                "2.4" : "5.2",
                       jiffies_to_msecs(elapsed_jiffies
                                        (priv->scan_pass_start, jiffies)));
-        /* Remove this scanned band from the list
+        /* Remove this scanned band from the list of pending
-         * of pending bands to scan */
+         * bands to scan, band G precedes A in order of scanning
-        priv->scan_bands--;
+         * as seen in iwl_bg_request_scan */
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
+        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
+                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
        /* If a request to abort was given, or the scan did not succeed
         * then we reset the scan state machine and terminate,
@@ -3292,7 +3301,7 @@ static void iwl4965_rx_scan_complete_notif(struct iwl_priv *priv,
                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
        } else {
                /* If there are more bands on this scan pass reschedule */
-                if (priv->scan_bands > 0)
+                if (priv->scan_bands)
                        goto reschedule;
        }
@@ -4635,10 +4644,9 @@ static int iwl4965_get_channels_for_scan(struct iwl_priv *priv,
                scan_ch->channel = ieee80211_frequency_to_channel(channels[i].center_freq);
-                ch_info = iwl_get_channel_info(priv, band,
+                ch_info = iwl_get_channel_info(priv, band, scan_ch->channel);
-                                         scan_ch->channel);
                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
+                        IWL_DEBUG_SCAN("Channel %d is INVALID for this band.\n",
                                       scan_ch->channel);
                        continue;
                }
@@ -5830,8 +5838,7 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
        scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
-        switch (priv->scan_bands) {
+        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
-        case 2:
                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                scan->tx_cmd.rate_n_flags =
                                iwl4965_hw_set_rate_n_flags(IWL_RATE_1M_PLCP,
@@ -5839,17 +5846,13 @@ static void iwl4965_bg_request_scan(struct work_struct *data)
                scan->good_CRC_th = 0;
                band = IEEE80211_BAND_2GHZ;
-                break;
+        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
-        case 1:
                scan->tx_cmd.rate_n_flags =
                                iwl4965_hw_set_rate_n_flags(IWL_RATE_6M_PLCP,
                                RATE_MCS_ANT_B_MSK);
                scan->good_CRC_th = IWL_GOOD_CRC_TH;
                band = IEEE80211_BAND_5GHZ;
-                break;
+        } else {
-        default:
                IWL_WARNING("Invalid scan band count\n");
                goto done;
        }
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 762e85bef55d..e43bae97ed8f 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -290,7 +290,7 @@ islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb)
                avs->version = cpu_to_be32(P80211CAPTURE_VERSION);
                avs->length = cpu_to_be32(sizeof (struct avs_80211_1_header));
-                avs->mactime = cpu_to_be64(le64_to_cpu(clock));
+                avs->mactime = cpu_to_be64(clock);
                avs->hosttime = cpu_to_be64(jiffies);
                avs->phytype = cpu_to_be32(6);  /*OFDM: 6 for (g), 8 for (a) */
                avs->channel = cpu_to_be32(channel_of_freq(freq));
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index fdbd0ef2be4b..61e59c17a60a 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -138,11 +138,8 @@ static void rt2500usb_bbp_write(struct rt2x00_dev *rt2x00dev,
         * Wait until the BBP becomes ready.
         */
        reg = rt2500usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY)) {
+        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY))
-                ERROR(rt2x00dev, "PHY_CSR8 register busy. Write failed.\n");
+                goto exit_fail;
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
        /*
         * Write the data into the BBP.
@@ -155,6 +152,13 @@ static void rt2500usb_bbp_write(struct rt2x00_dev *rt2x00dev,
        rt2500usb_register_write_lock(rt2x00dev, PHY_CSR7, reg);
        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        return;
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        ERROR(rt2x00dev, "PHY_CSR8 register busy. Write failed.\n");
 }
 static void rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
@@ -168,10 +172,8 @@ static void rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
         * Wait until the BBP becomes ready.
         */
        reg = rt2500usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY)) {
+        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY))
-                ERROR(rt2x00dev, "PHY_CSR8 register busy. Read failed.\n");
+                goto exit_fail;
-                return;
-        }
        /*
         * Write the request into the BBP.
@@ -186,17 +188,21 @@ static void rt2500usb_bbp_read(struct rt2x00_dev *rt2x00dev,
         * Wait until the BBP becomes ready.
         */
        reg = rt2500usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY)) {
+        if (rt2x00_get_field16(reg, PHY_CSR8_BUSY))
-                ERROR(rt2x00dev, "PHY_CSR8 register busy. Read failed.\n");
+                goto exit_fail;
-                *value = 0xff;
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
        rt2500usb_register_read_lock(rt2x00dev, PHY_CSR7, &reg);
        *value = rt2x00_get_field16(reg, PHY_CSR7_DATA);
        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        return;
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        ERROR(rt2x00dev, "PHY_CSR8 register busy. Read failed.\n");
+        *value = 0xff;
 }
 static void rt2500usb_rf_write(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 611d98320593..b4bf1e09cf9a 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -821,6 +821,7 @@ struct rt2x00_dev {
        /*
         * Scheduled work.
         */
+        struct workqueue_struct *workqueue;
        struct work_struct intf_work;
        struct work_struct filter_work;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 2673d568bcac..c997d4f28ab3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -75,7 +75,7 @@ static void rt2x00lib_start_link_tuner(struct rt2x00_dev *rt2x00dev)
        rt2x00lib_reset_link_tuner(rt2x00dev);
-        queue_delayed_work(rt2x00dev->hw->workqueue,
+        queue_delayed_work(rt2x00dev->workqueue,
                           &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
 }
@@ -137,14 +137,6 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
                return;
        /*
-         * Stop all scheduled work.
-         */
-        if (work_pending(&rt2x00dev->intf_work))
-                cancel_work_sync(&rt2x00dev->intf_work);
-        if (work_pending(&rt2x00dev->filter_work))
-                cancel_work_sync(&rt2x00dev->filter_work);
-        /*
         * Stop the TX queues.
         */
        ieee80211_stop_queues(rt2x00dev->hw);
@@ -398,8 +390,8 @@ static void rt2x00lib_link_tuner(struct work_struct *work)
         * Increase tuner counter, and reschedule the next link tuner run.
         */
        rt2x00dev->link.count++;
-        queue_delayed_work(rt2x00dev->hw->workqueue, &rt2x00dev->link.work,
+        queue_delayed_work(rt2x00dev->workqueue,
-                           LINK_TUNE_INTERVAL);
+                           &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
 }
 static void rt2x00lib_packetfilter_scheduled(struct work_struct *work)
@@ -433,6 +425,15 @@ static void rt2x00lib_intf_scheduled_iter(void *data, u8 *mac,
        spin_unlock(&intf->lock);
+        /*
+         * It is possible the radio was disabled while the work had been
+         * scheduled. If that happens we should return here immediately,
+         * note that in the spinlock protected area above the delayed_flags
+         * have been cleared correctly.
+         */
+        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags))
+                return;
        if (delayed_flags & DELAYED_UPDATE_BEACON) {
                skb = ieee80211_beacon_get(rt2x00dev->hw, vif, &control);
                if (skb && rt2x00dev->ops->hw->beacon_update(rt2x00dev->hw,
@@ -441,7 +442,7 @@ static void rt2x00lib_intf_scheduled_iter(void *data, u8 *mac,
        }
        if (delayed_flags & DELAYED_CONFIG_ERP)
-                rt2x00lib_config_erp(rt2x00dev, intf, &intf->conf);
+                rt2x00lib_config_erp(rt2x00dev, intf, &conf);
        if (delayed_flags & DELAYED_LED_ASSOC)
                rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
@@ -487,7 +488,7 @@ void rt2x00lib_beacondone(struct rt2x00_dev *rt2x00dev)
                                                   rt2x00lib_beacondone_iter,
                                                   rt2x00dev);
-        queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
+        queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_beacondone);
@@ -1130,6 +1131,10 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        /*
         * Initialize configuration work.
         */
+        rt2x00dev->workqueue = create_singlethread_workqueue("rt2x00lib");
+        if (!rt2x00dev->workqueue)
+                goto exit;
        INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
        INIT_WORK(&rt2x00dev->filter_work, rt2x00lib_packetfilter_scheduled);
        INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00lib_link_tuner);
@@ -1190,6 +1195,13 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
        rt2x00leds_unregister(rt2x00dev);
        /*
+         * Stop all queued work. Note that most tasks will already be halted
+         * during rt2x00lib_disable_radio() and rt2x00lib_uninitialize().
+         */
+        flush_workqueue(rt2x00dev->workqueue);
+        destroy_workqueue(rt2x00dev->workqueue);
+        /*
         * Free ieee80211_hw memory.
         */
        rt2x00lib_remove_hw(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 87e280a21971..9cb023edd2e9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -428,7 +428,7 @@ void rt2x00mac_configure_filter(struct ieee80211_hw *hw,
        if (!test_bit(DRIVER_REQUIRE_SCHEDULED, &rt2x00dev->flags))
                rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
        else
-                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->filter_work);
+                queue_work(rt2x00dev->workqueue, &rt2x00dev->filter_work);
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_configure_filter);
@@ -509,7 +509,7 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
        memcpy(&intf->conf, bss_conf, sizeof(*bss_conf));
        if (delayed) {
                intf->delayed_flags |= delayed;
-                queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->intf_work);
+                queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
        }
        spin_unlock(&intf->lock);
 }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index fff8386e816b..83cc0147f698 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -134,11 +134,8 @@ static void rt73usb_bbp_write(struct rt2x00_dev *rt2x00dev,
         * Wait until the BBP becomes ready.
         */
        reg = rt73usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Write failed.\n");
+                goto exit_fail;
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
        /*
         * Write the data into the BBP.
@@ -151,6 +148,13 @@ static void rt73usb_bbp_write(struct rt2x00_dev *rt2x00dev,
        rt73usb_register_write_lock(rt2x00dev, PHY_CSR3, reg);
        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        return;
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        ERROR(rt2x00dev, "PHY_CSR3 register busy. Write failed.\n");
 }
 static void rt73usb_bbp_read(struct rt2x00_dev *rt2x00dev,
@@ -164,11 +168,8 @@ static void rt73usb_bbp_read(struct rt2x00_dev *rt2x00dev,
         * Wait until the BBP becomes ready.
         */
        reg = rt73usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
+                goto exit_fail;
-                mutex_unlock(&rt2x00dev->usb_cache_mutex);
-                return;
-        }
        /*
         * Write the request into the BBP.
@@ -184,14 +185,19 @@ static void rt73usb_bbp_read(struct rt2x00_dev *rt2x00dev,
         * Wait until the BBP becomes ready.
         */
        reg = rt73usb_bbp_check(rt2x00dev);
-        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY)) {
+        if (rt2x00_get_field32(reg, PHY_CSR3_BUSY))
-                ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
+                goto exit_fail;
-                *value = 0xff;
-                return;
-        }
        *value = rt2x00_get_field32(reg, PHY_CSR3_VALUE);
        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        return;
+exit_fail:
+        mutex_unlock(&rt2x00dev->usb_cache_mutex);
+        ERROR(rt2x00dev, "PHY_CSR3 register busy. Read failed.\n");
+        *value = 0xff;
 }
 static void rt73usb_rf_write(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
index a0b6d414953d..59fbef08d690 100644
--- a/drivers/scsi/esp_scsi.c
+++ b/drivers/scsi/esp_scsi.c
@@ -2359,6 +2359,24 @@ void scsi_esp_unregister(struct esp *esp)
 }
 EXPORT_SYMBOL(scsi_esp_unregister);
+static int esp_target_alloc(struct scsi_target *starget)
+{
+        struct esp *esp = shost_priv(dev_to_shost(&starget->dev));
+        struct esp_target_data *tp = &esp->target[starget->id];
+        tp->starget = starget;
+        return 0;
+}
+static void esp_target_destroy(struct scsi_target *starget)
+{
+        struct esp *esp = shost_priv(dev_to_shost(&starget->dev));
+        struct esp_target_data *tp = &esp->target[starget->id];
+        tp->starget = NULL;
+}
 static int esp_slave_alloc(struct scsi_device *dev)
 {
        struct esp *esp = shost_priv(dev->host);
@@ -2370,8 +2388,6 @@ static int esp_slave_alloc(struct scsi_device *dev)
                return -ENOMEM;
        dev->hostdata = lp;
-        tp->starget = dev->sdev_target;
        spi_min_period(tp->starget) = esp->min_period;
        spi_max_offset(tp->starget) = 15;
@@ -2608,6 +2624,8 @@ struct scsi_host_template scsi_esp_template = {
        .name                   = "esp",
        .info                   = esp_info,
        .queuecommand           = esp_queuecommand,
+        .target_alloc           = esp_target_alloc,
+        .target_destroy         = esp_target_destroy,
        .slave_alloc            = esp_slave_alloc,
        .slave_configure        = esp_slave_configure,
        .slave_destroy          = esp_slave_destroy,
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 45df83b9d847..0fe031f003e7 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -61,7 +61,7 @@ static int ses_probe(struct device *dev)
        return err;
 }
-#define SES_TIMEOUT 30
+#define SES_TIMEOUT (30 * HZ)
 #define SES_RETRIES 3
 static int ses_recv_diag(struct scsi_device *sdev, int page_code,
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 4b628526df09..a86e952ed4ca 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -12,3 +12,12 @@ menuconfig THERMAL
          cooling devices.
          All platforms with ACPI thermal support can use this driver.
          If you want this support, you should say Y or M here.
+config THERMAL_HWMON
+        bool "Hardware monitoring support"
+        depends on HWMON=y || HWMON=THERMAL
+        help
+          The generic thermal sysfs driver's hardware monitoring support
+          requires a 2.10.7/3.0.2 or later lm-sensors userspace.
+          Say Y if your user-space is new enough.
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 6098787341f3..fe07462d5947 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -295,8 +295,8 @@ thermal_cooling_device_trip_point_show(struct device *dev,
 /* Device management */
-#if defined(CONFIG_HWMON) ||    \
+#if defined(CONFIG_THERMAL_HWMON)
-        (defined(CONFIG_HWMON_MODULE) && defined(CONFIG_THERMAL_MODULE))
 /* hwmon sys I/F */
 #include <linux/hwmon.h>
 static LIST_HEAD(thermal_hwmon_list);
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index 8662a6b7a30b..25b352b664d9 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -68,7 +68,6 @@ obj-$(CONFIG_WAFER_WDT) += wafer5823wdt.o
 obj-$(CONFIG_I6300ESB_WDT) += i6300esb.o
 obj-$(CONFIG_ITCO_WDT) += iTCO_wdt.o iTCO_vendor_support.o
 obj-$(CONFIG_IT8712F_WDT) += it8712f_wdt.o
-CFLAGS_hpwdt.o += -O
 obj-$(CONFIG_HP_WATCHDOG) += hpwdt.o
 obj-$(CONFIG_SC1200_WDT) += sc1200wdt.o
 obj-$(CONFIG_SCx200_WDT) += scx200_wdt.o
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 4f0f22b020ea..76e5b7386af9 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -529,7 +529,7 @@ void xen_evtchn_do_upcall(struct pt_regs *regs)
 #ifndef CONFIG_X86 /* No need for a barrier -- XCHG is a barrier on x86. */
                /* Clear master flag /before/ clearing selector flag. */
-                rmb();
+                wmb();
 #endif
                pending_words = xchg(&vcpu_info->evtchn_pending_sel, 0);
                while (pending_words != 0) {
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 470c10ceb0fb..10d8a0aa871a 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -931,8 +931,16 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
        struct gendisk *disk;
        int ret;
        int part;
+        int perm = 0;
-        ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);
+        if (file->f_mode & FMODE_READ)
+                perm |= MAY_READ;
+        if (file->f_mode & FMODE_WRITE)
+                perm |= MAY_WRITE;
+        /*
+         * hooks: /n/, see "layering violations".
+         */
+        ret = devcgroup_inode_permission(bdev->bd_inode, perm);
        if (ret != 0)
                return ret;
diff --git a/fs/dcache.c b/fs/dcache.c
index 3ee588d5f585..6068c25b393c 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -17,6 +17,7 @@
 #include <linux/syscalls.h>
 #include <linux/string.h>
 #include <linux/mm.h>
+#include <linux/fdtable.h>
 #include <linux/fs.h>
 #include <linux/fsnotify.h>
 #include <linux/slab.h>
@@ -106,9 +107,10 @@ static void dentry_lru_remove(struct dentry *dentry)
 /*
 * Release the dentry's inode, using the filesystem
 * d_iput() operation if defined.
- * Called with dcache_lock and per dentry lock held, drops both.
 */
 static void dentry_iput(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
        struct inode *inode = dentry->d_inode;
        if (inode) {
@@ -132,12 +134,13 @@ static void dentry_iput(struct dentry * dentry)
 * d_kill - kill dentry and return parent
 * @dentry: dentry to kill
 *
- * Called with dcache_lock and d_lock, releases both.  The dentry must
+ * The dentry must already be unhashed and removed from the LRU.
- * already be unhashed and removed from the LRU.
 *
 * If this is the root of the dentry tree, return NULL.
 */
 static struct dentry *d_kill(struct dentry *dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
 {
        struct dentry *parent;
@@ -383,11 +386,11 @@ restart:
 * Try to prune ancestors as well.  This is necessary to prevent
 * quadratic behavior of shrink_dcache_parent(), but is also expected
 * to be beneficial in reducing dentry cache fragmentation.
- *
- * Called with dcache_lock, drops it and then regains.
- * Called with dentry->d_lock held, drops it.
 */
 static void prune_one_dentry(struct dentry * dentry)
+        __releases(dentry->d_lock)
+        __releases(dcache_lock)
+        __acquires(dcache_lock)
 {
        __d_drop(dentry);
        dentry = d_kill(dentry);
@@ -1604,10 +1607,9 @@ static int d_isparent(struct dentry *p1, struct dentry *p2)
 *
 * Note: If ever the locking in lock_rename() changes, then please
 * remember to update this too...
- *
- * On return, dcache_lock will have been unlocked.
 */
 static struct dentry *__d_unalias(struct dentry *dentry, struct dentry *alias)
+        __releases(dcache_lock)
 {
        struct mutex *m1 = NULL, *m2 = NULL;
        struct dentry *ret;
@@ -1743,11 +1745,9 @@ out_nolock:
 shouldnt_be_hashed:
        spin_unlock(&dcache_lock);
        BUG();
-        goto shouldnt_be_hashed;
 }
-static int prepend(char **buffer, int *buflen, const char *str,
+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
-                          int namelen)
 {
        *buflen -= namelen;
        if (*buflen < 0)
@@ -1757,8 +1757,13 @@ static int prepend(char **buffer, int *buflen, const char *str,
        return 0;
 }
+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
+{
+        return prepend(buffer, buflen, name->name, name->len);
+}
 /**
- * d_path - return the path of a dentry
+ * __d_path - return the path of a dentry
 * @path: the dentry/vfsmount to report
 * @root: root vfsmnt/dentry (may be modified by this function)
 * @buffer: buffer to return value in
@@ -1779,9 +1784,10 @@ char *__d_path(const struct path *path, struct path *root,
 {
        struct dentry *dentry = path->dentry;
        struct vfsmount *vfsmnt = path->mnt;
-        char * end = buffer+buflen;
+        char *end = buffer + buflen;
-        char * retval;
+        char *retval;
+        spin_lock(&vfsmount_lock);
        prepend(&end, &buflen, "\0", 1);
        if (!IS_ROOT(dentry) && d_unhashed(dentry) &&
                (prepend(&end, &buflen, " (deleted)", 10) != 0))
@@ -1800,38 +1806,37 @@ char *__d_path(const struct path *path, struct path *root,
                        break;
                if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
                        /* Global root? */
-                        spin_lock(&vfsmount_lock);
                        if (vfsmnt->mnt_parent == vfsmnt) {
-                                spin_unlock(&vfsmount_lock);
                                goto global_root;
                        }
                        dentry = vfsmnt->mnt_mountpoint;
                        vfsmnt = vfsmnt->mnt_parent;
-                        spin_unlock(&vfsmount_lock);
                        continue;
                }
                parent = dentry->d_parent;
                prefetch(parent);
-                if ((prepend(&end, &buflen, dentry->d_name.name,
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
-                                dentry->d_name.len) != 0) ||
                    (prepend(&end, &buflen, "/", 1) != 0))
                        goto Elong;
                retval = end;
                dentry = parent;
        }
+out:
+        spin_unlock(&vfsmount_lock);
        return retval;
 global_root:
        retval += 1;    /* hit the slash */
-        if (prepend(&retval, &buflen, dentry->d_name.name,
+        if (prepend_name(&retval, &buflen, &dentry->d_name) != 0)
-                    dentry->d_name.len) != 0)
                goto Elong;
        root->mnt = vfsmnt;
        root->dentry = dentry;
-        return retval;
+        goto out;
 Elong:
-        return ERR_PTR(-ENAMETOOLONG);
+        retval = ERR_PTR(-ENAMETOOLONG);
+        goto out;
 }
 /**
@@ -1845,9 +1850,9 @@ Elong:
 *
 * Returns the buffer or an error code if the path was too long.
 *
- * "buflen" should be positive. Caller holds the dcache_lock.
+ * "buflen" should be positive.
 */
-char *d_path(struct path *path, char *buf, int buflen)
+char *d_path(const struct path *path, char *buf, int buflen)
 {
        char *res;
        struct path root;
@@ -1915,16 +1920,11 @@ char *dentry_path(struct dentry *dentry, char *buf, int buflen)
        retval = end-1;
        *retval = '/';
-        for (;;) {
+        while (!IS_ROOT(dentry)) {
-                struct dentry *parent;
+                struct dentry *parent = dentry->d_parent;
-                if (IS_ROOT(dentry))
-                        break;
-                parent = dentry->d_parent;
                prefetch(parent);
+                if ((prepend_name(&end, &buflen, &dentry->d_name) != 0) ||
-                if ((prepend(&end, &buflen, dentry->d_name.name,
-                                dentry->d_name.len) != 0) ||
                    (prepend(&end, &buflen, "/", 1) != 0))
                        goto Elong;
@@ -1975,7 +1975,7 @@ asmlinkage long sys_getcwd(char __user *buf, unsigned long size)
        error = -ENOENT;
        /* Has the current directory has been unlinked? */
        spin_lock(&dcache_lock);
-        if (pwd.dentry->d_parent == pwd.dentry || !d_unhashed(pwd.dentry)) {
+        if (IS_ROOT(pwd.dentry) || !d_unhashed(pwd.dentry)) {
                unsigned long len;
                struct path tmp = root;
                char * cwd;
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index c19184f2e70e..bec76b1c2bb0 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -246,15 +246,11 @@ static void find_metapath(const struct gfs2_sbd *sdp, u64 block,
 }
-static inline unsigned int zero_metapath_length(const struct metapath *mp,
+static inline unsigned int metapath_branch_start(const struct metapath *mp)
-                                                unsigned height)
 {
-        unsigned int i;
+        if (mp->mp_list[0] == 0)
-        for (i = 0; i < height - 1; i++) {
+                return 2;
-                if (mp->mp_list[i] != 0)
+        return 1;
-                        return i;
-        }
-        return height;
 }
 /**
@@ -436,7 +432,7 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
        struct gfs2_sbd *sdp = GFS2_SB(inode);
        struct buffer_head *dibh = mp->mp_bh[0];
        u64 bn, dblock = 0;
-        unsigned n, i, blks, alloced = 0, iblks = 0, zmpl = 0;
+        unsigned n, i, blks, alloced = 0, iblks = 0, branch_start = 0;
        unsigned dblks = 0;
        unsigned ptrs_per_blk;
        const unsigned end_of_metadata = height - 1;
@@ -471,9 +467,8 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                        /* Building up tree height */
                        state = ALLOC_GROW_HEIGHT;
                        iblks = height - ip->i_height;
-                        zmpl = zero_metapath_length(mp, height);
+                        branch_start = metapath_branch_start(mp);
-                        iblks -= zmpl;
+                        iblks += (height - branch_start);
-                        iblks += height;
                }
        }
@@ -509,13 +504,13 @@ static int gfs2_bmap_alloc(struct inode *inode, const sector_t lblock,
                                        sizeof(struct gfs2_meta_header));
                                *ptr = zero_bn;
                                state = ALLOC_GROW_DEPTH;
-                                for(i = zmpl; i < height; i++) {
+                                for(i = branch_start; i < height; i++) {
                                        if (mp->mp_bh[i] == NULL)
                                                break;
                                        brelse(mp->mp_bh[i]);
                                        mp->mp_bh[i] = NULL;
                                }
-                                i = zmpl;
+                                i = branch_start;
                        }
                        if (n == 0)
                                break;
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6387523a3153..3401628d742b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -195,7 +195,7 @@ ulong_aligned:
           depending on architecture.  I've experimented with several ways
           of writing this section such as using an else before the goto
           but this one seems to be the fastest. */
-        while ((unsigned char *)plong < end - 1) {
+        while ((unsigned char *)plong < end - sizeof(unsigned long)) {
                prefetch(plong + 1);
                if (((*plong) & LBITMASK) != lskipval)
                        break;
diff --git a/fs/locks.c b/fs/locks.c
index 11dbf08651b7..dce8c747371c 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -561,9 +561,6 @@ static void locks_insert_lock(struct file_lock **pos, struct file_lock *fl)
        /* insert into file's list */
        fl->fl_next = *pos;
        *pos = fl;
-        if (fl->fl_ops && fl->fl_ops->fl_insert)
-                fl->fl_ops->fl_insert(fl);
 }
 /*
@@ -586,9 +583,6 @@ static void locks_delete_lock(struct file_lock **thisfl_p)
                fl->fl_fasync = NULL;
        }
-        if (fl->fl_ops && fl->fl_ops->fl_remove)
-                fl->fl_ops->fl_remove(fl);
        if (fl->fl_nspid) {
                put_pid(fl->fl_nspid);
                fl->fl_nspid = NULL;
diff --git a/fs/namei.c b/fs/namei.c
index c7e43536c49a..01e67dddcc3d 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -581,15 +581,13 @@ static __always_inline int link_path_walk(const char *name, struct nameidata *nd
        int result;
        /* make sure the stuff we saved doesn't go away */
-        dget(save.dentry);
+        path_get(&save);
-        mntget(save.mnt);
        result = __link_path_walk(name, nd);
        if (result == -ESTALE) {
                /* nd->path had been dropped */
                nd->path = save;
-                dget(nd->path.dentry);
+                path_get(&nd->path);
-                mntget(nd->path.mnt);
                nd->flags |= LOOKUP_REVAL;
                result = __link_path_walk(name, nd);
        }
@@ -1216,8 +1214,9 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
        nd->flags = flags;
        nd->depth = 0;
-        nd->path.mnt = mntget(mnt);
+        nd->path.dentry = dentry;
-        nd->path.dentry = dget(dentry);
+        nd->path.mnt = mnt;
+        path_get(&nd->path);
        retval = path_walk(name, nd);
        if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
@@ -2857,16 +2856,17 @@ int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
        struct nameidata nd;
        void *cookie;
+        int res;
        nd.depth = 0;
        cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
-        if (!IS_ERR(cookie)) {
+        if (IS_ERR(cookie))
-                int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
+                return PTR_ERR(cookie);
-                if (dentry->d_inode->i_op->put_link)
-                        dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+        res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
-                cookie = ERR_PTR(res);
+        if (dentry->d_inode->i_op->put_link)
-        }
+                dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
-        return PTR_ERR(cookie);
+        return res;
 }
 int vfs_follow_link(struct nameidata *nd, const char *link)
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 49c7cd0502cc..779d2eb649c5 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -130,10 +130,11 @@ static int xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p,
                                struct mnt_fhstatus *res)
 {
        struct nfs_fh *fh = res->fh;
+        unsigned size;
        if ((res->status = ntohl(*p++)) == 0) {
-                int size = ntohl(*p++);
+                size = ntohl(*p++);
-                if (size <= NFS3_FHSIZE) {
+                if (size <= NFS3_FHSIZE && size != 0) {
                        fh->size = size;
                        memcpy(fh->data, p, size);
                } else
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2a4a024a4e7b..614efeed5437 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1216,8 +1216,6 @@ static int nfs_validate_mount_data(void *options,
 {
        struct nfs_mount_data *data = (struct nfs_mount_data *)options;
-        memset(args, 0, sizeof(*args));
        if (data == NULL)
                goto out_no_data;
@@ -1251,13 +1249,13 @@ static int nfs_validate_mount_data(void *options,
        case 5:
                memset(data->context, 0, sizeof(data->context));
        case 6:
-                if (data->flags & NFS_MOUNT_VER3)
+                if (data->flags & NFS_MOUNT_VER3) {
+                        if (data->root.size > NFS3_FHSIZE || data->root.size == 0)
+                                goto out_invalid_fh;
                        mntfh->size = data->root.size;
-                else
+                } else
                        mntfh->size = NFS2_FHSIZE;
-                if (mntfh->size > sizeof(mntfh->data))
-                        goto out_invalid_fh;
                memcpy(mntfh->data, data->root.data, mntfh->size);
                if (mntfh->size < sizeof(mntfh->data))
@@ -1585,24 +1583,29 @@ static int nfs_get_sb(struct file_system_type *fs_type,
 {
        struct nfs_server *server = NULL;
        struct super_block *s;
-        struct nfs_fh mntfh;
+        struct nfs_parsed_mount_data *data;
-        struct nfs_parsed_mount_data data;
+        struct nfs_fh *mntfh;
        struct dentry *mntroot;
        int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
        struct nfs_sb_mountdata sb_mntdata = {
                .mntflags = flags,
        };
-        int error;
+        int error = -ENOMEM;
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
-        security_init_mnt_opts(&data.lsm_opts);
+        security_init_mnt_opts(&data->lsm_opts);
        /* Validate the mount data */
-        error = nfs_validate_mount_data(raw_data, &data, &mntfh, dev_name);
+        error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
        if (error < 0)
                goto out;
        /* Get a volume representation */
-        server = nfs_create_server(&data, &mntfh);
+        server = nfs_create_server(data, mntfh);
        if (IS_ERR(server)) {
                error = PTR_ERR(server);
                goto out;
@@ -1630,16 +1633,16 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        if (!s->s_root) {
                /* initial superblock/root creation */
-                nfs_fill_super(s, &data);
+                nfs_fill_super(s, data);
        }
-        mntroot = nfs_get_root(s, &mntfh);
+        mntroot = nfs_get_root(s, mntfh);
        if (IS_ERR(mntroot)) {
                error = PTR_ERR(mntroot);
                goto error_splat_super;
        }
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
        if (error)
                goto error_splat_root;
@@ -1649,9 +1652,12 @@ static int nfs_get_sb(struct file_system_type *fs_type,
        error = 0;
 out:
-        kfree(data.nfs_server.hostname);
+        kfree(data->nfs_server.hostname);
-        kfree(data.mount_server.hostname);
+        kfree(data->mount_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
        return error;
 out_err_nosb:
@@ -1800,8 +1806,6 @@ static int nfs4_validate_mount_data(void *options,
        struct nfs4_mount_data *data = (struct nfs4_mount_data *)options;
        char *c;
-        memset(args, 0, sizeof(*args));
        if (data == NULL)
                goto out_no_data;
@@ -1959,26 +1963,31 @@ out_no_client_address:
 static int nfs4_get_sb(struct file_system_type *fs_type,
        int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt)
 {
-        struct nfs_parsed_mount_data data;
+        struct nfs_parsed_mount_data *data;
        struct super_block *s;
        struct nfs_server *server;
-        struct nfs_fh mntfh;
+        struct nfs_fh *mntfh;
        struct dentry *mntroot;
        int (*compare_super)(struct super_block *, void *) = nfs_compare_super;
        struct nfs_sb_mountdata sb_mntdata = {
                .mntflags = flags,
        };
-        int error;
+        int error = -ENOMEM;
-        security_init_mnt_opts(&data.lsm_opts);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        mntfh = kzalloc(sizeof(*mntfh), GFP_KERNEL);
+        if (data == NULL || mntfh == NULL)
+                goto out_free_fh;
+        security_init_mnt_opts(&data->lsm_opts);
        /* Validate the mount data */
-        error = nfs4_validate_mount_data(raw_data, &data, dev_name);
+        error = nfs4_validate_mount_data(raw_data, data, dev_name);
        if (error < 0)
                goto out;
        /* Get a volume representation */
-        server = nfs4_create_server(&data, &mntfh);
+        server = nfs4_create_server(data, mntfh);
        if (IS_ERR(server)) {
                error = PTR_ERR(server);
                goto out;
@@ -2009,13 +2018,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
                nfs4_fill_super(s);
        }
-        mntroot = nfs4_get_root(s, &mntfh);
+        mntroot = nfs4_get_root(s, mntfh);
        if (IS_ERR(mntroot)) {
                error = PTR_ERR(mntroot);
                goto error_splat_super;
        }
-        error = security_sb_set_mnt_opts(s, &data.lsm_opts);
+        error = security_sb_set_mnt_opts(s, &data->lsm_opts);
        if (error)
                goto error_splat_root;
@@ -2025,10 +2034,13 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
        error = 0;
 out:
-        kfree(data.client_address);
+        kfree(data->client_address);
-        kfree(data.nfs_server.export_path);
+        kfree(data->nfs_server.export_path);
-        kfree(data.nfs_server.hostname);
+        kfree(data->nfs_server.hostname);
-        security_free_mnt_opts(&data.lsm_opts);
+        security_free_mnt_opts(&data->lsm_opts);
+out_free_fh:
+        kfree(mntfh);
+        kfree(data);
        return error;
 out_free:
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 6d8ace3e3259..f333848fd3be 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -739,12 +739,13 @@ int nfs_updatepage(struct file *file, struct page *page,
        }
        status = nfs_writepage_setup(ctx, page, offset, count);
-        __set_page_dirty_nobuffers(page);
+        if (status < 0)
+                nfs_set_pageerror(page);
+        else
+                __set_page_dirty_nobuffers(page);
        dprintk("NFS:      nfs_updatepage returns %d (isize %Ld)\n",
                        status, (long long)i_size_read(inode));
-        if (status < 0)
-                nfs_set_pageerror(page);
        return status;
 }
diff --git a/fs/pipe.c b/fs/pipe.c
index ec228bc9f882..700f4e0d9572 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1003,8 +1003,7 @@ struct file *create_write_pipe(void)
 void free_write_pipe(struct file *f)
 {
        free_pipe_info(f->f_dentry->d_inode);
-        dput(f->f_path.dentry);
+        path_put(&f->f_path);
-        mntput(f->f_path.mnt);
        put_filp(f);
 }
@@ -1015,8 +1014,8 @@ struct file *create_read_pipe(struct file *wrf)
                return ERR_PTR(-ENFILE);
        /* Grab pipe from the writer */
-        f->f_path.mnt = mntget(wrf->f_path.mnt);
+        f->f_path = wrf->f_path;
-        f->f_path.dentry = dget(wrf->f_path.dentry);
+        path_get(&wrf->f_path);
        f->f_mapping = wrf->f_path.dentry->d_inode->i_mapping;
        f->f_pos = 0;
@@ -1068,8 +1067,7 @@ int do_pipe(int *fd)
 err_fdr:
        put_unused_fd(fdr);
 err_read_pipe:
-        dput(fr->f_dentry);
+        path_put(&fr->f_path);
-        mntput(fr->f_vfsmnt);
        put_filp(fr);
 err_write_pipe:
        free_write_pipe(fw);
diff --git a/fs/select.c b/fs/select.c
index 8dda969614a9..da0e88201c3a 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -249,7 +249,6 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                                retval++;
                                        }
                                }
-                                cond_resched();
                        }
                        if (res_in)
                                *rinp = res_in;
@@ -257,6 +256,7 @@ int do_select(int n, fd_set_bits *fds, s64 *timeout)
                                *routp = res_out;
                        if (res_ex)
                                *rexp = res_ex;
+                        cond_resched();
                }
                wait = NULL;
                if (retval || !*timeout || signal_pending(current))
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 7a5f69be6ac2..44cc702f96cc 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -682,38 +682,26 @@ static int udf_vrs(struct super_block *sb, int silent)
 /*
 * Check whether there is an anchor block in the given block
 */
-static int udf_check_anchor_block(struct super_block *sb, sector_t block,
+static int udf_check_anchor_block(struct super_block *sb, sector_t block)
-                                        bool varconv)
 {
-        struct buffer_head *bh = NULL;
+        struct buffer_head *bh;
-        tag *t;
        uint16_t ident;
-        uint32_t location;
-        if (varconv) {
+        if (UDF_QUERY_FLAG(sb, UDF_FLAG_VARCONV) &&
-                if (udf_fixed_to_variable(block) >=
+            udf_fixed_to_variable(block) >=
-                    sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
+            sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits)
-                        return 0;
+                return 0;
-                bh = sb_bread(sb, udf_fixed_to_variable(block));
-        }
-        else
-                bh = sb_bread(sb, block);
+        bh = udf_read_tagged(sb, block, block, &ident);
        if (!bh)
                return 0;
-        t = (tag *)bh->b_data;
-        ident = le16_to_cpu(t->tagIdent);
-        location = le32_to_cpu(t->tagLocation);
        brelse(bh);
-        if (ident != TAG_IDENT_AVDP)
-                return 0;
+        return ident == TAG_IDENT_AVDP;
-        return location == block;
 }
 /* Search for an anchor volume descriptor pointer */
-static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
+static sector_t udf_scan_anchors(struct super_block *sb, sector_t lastblock)
-                                        sector_t lastblock)
 {
        sector_t last[6];
        int i;
@@ -739,7 +727,7 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                                sb->s_blocksize_bits)
                        continue;
-                if (udf_check_anchor_block(sb, last[i], varconv)) {
+                if (udf_check_anchor_block(sb, last[i])) {
                        sbi->s_anchor[0] = last[i];
                        sbi->s_anchor[1] = last[i] - 256;
                        return last[i];
@@ -748,17 +736,17 @@ static sector_t udf_scan_anchors(struct super_block *sb, bool varconv,
                if (last[i] < 256)
                        continue;
-                if (udf_check_anchor_block(sb, last[i] - 256, varconv)) {
+                if (udf_check_anchor_block(sb, last[i] - 256)) {
                        sbi->s_anchor[1] = last[i] - 256;
                        return last[i];
                }
        }
-        if (udf_check_anchor_block(sb, sbi->s_session + 256, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 256)) {
                sbi->s_anchor[0] = sbi->s_session + 256;
                return last[0];
        }
-        if (udf_check_anchor_block(sb, sbi->s_session + 512, varconv)) {
+        if (udf_check_anchor_block(sb, sbi->s_session + 512)) {
                sbi->s_anchor[0] = sbi->s_session + 512;
                return last[0];
        }
@@ -780,23 +768,24 @@ static void udf_find_anchor(struct super_block *sb)
        int i;
        struct udf_sb_info *sbi = UDF_SB(sb);
-        lastblock = udf_scan_anchors(sb, 0, sbi->s_last_block);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
        if (lastblock)
                goto check_anchor;
        /* No anchor found? Try VARCONV conversion of block numbers */
+        UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
        /* Firstly, we try to not convert number of the last block */
-        lastblock = udf_scan_anchors(sb, 1,
+        lastblock = udf_scan_anchors(sb,
                                udf_variable_to_fixed(sbi->s_last_block));
-        if (lastblock) {
+        if (lastblock)
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
                goto check_anchor;
-        }
        /* Secondly, we try with converted number of the last block */
-        lastblock = udf_scan_anchors(sb, 1, sbi->s_last_block);
+        lastblock = udf_scan_anchors(sb, sbi->s_last_block);
-        if (lastblock)
+        if (!lastblock) {
-                UDF_SET_FLAG(sb, UDF_FLAG_VARCONV);
+                /* VARCONV didn't help. Clear it. */
+                UDF_CLEAR_FLAG(sb, UDF_FLAG_VARCONV);
+        }
 check_anchor:
        /*
diff --git a/fs/utimes.c b/fs/utimes.c
index af059d5cb485..b6b664e7145e 100644
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -40,14 +40,9 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
 #endif
-static bool nsec_special(long nsec)
-{
-        return nsec == UTIME_OMIT || nsec == UTIME_NOW;
-}
 static bool nsec_valid(long nsec)
 {
-        if (nsec_special(nsec))
+        if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
                return true;
        return nsec >= 0 && nsec <= 999999999;
@@ -102,7 +97,11 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        if (error)
                goto dput_and_out;
-        /* Don't worry, the checks are done in inode_change_ok() */
+        if (times && times[0].tv_nsec == UTIME_NOW &&
+                     times[1].tv_nsec == UTIME_NOW)
+                times = NULL;
+        /* In most cases, the checks are done in inode_change_ok() */
        newattrs.ia_valid = ATTR_CTIME | ATTR_MTIME | ATTR_ATIME;
        if (times) {
                error = -EPERM;
@@ -124,28 +123,34 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                        newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
                        newattrs.ia_valid |= ATTR_MTIME_SET;
                }
-        }
-        /*
+                /*
-         * If times is NULL or both times are either UTIME_OMIT or
+                 * For the UTIME_OMIT/UTIME_NOW and UTIME_NOW/UTIME_OMIT
-         * UTIME_NOW, then need to check permissions, because
+                 * cases, we need to make an extra check that is not done by
-         * inode_change_ok() won't do it.
+                 * inode_change_ok().
-         */
+                 */
-        if (!times || (nsec_special(times[0].tv_nsec) &&
+                if (((times[0].tv_nsec == UTIME_NOW &&
-                       nsec_special(times[1].tv_nsec))) {
+                            times[1].tv_nsec == UTIME_OMIT)
+                     ||
+                     (times[0].tv_nsec == UTIME_OMIT &&
+                            times[1].tv_nsec == UTIME_NOW))
+                    && !is_owner_or_cap(inode))
+                        goto mnt_drop_write_and_out;
+        } else {
+                /*
+                 * If times is NULL (or both times are UTIME_NOW),
+                 * then we need to check permissions, because
+                 * inode_change_ok() won't do it.
+                 */
                error = -EACCES;
                if (IS_IMMUTABLE(inode))
                        goto mnt_drop_write_and_out;
                if (!is_owner_or_cap(inode)) {
-                        if (f) {
+                        error = permission(inode, MAY_WRITE, NULL);
-                                if (!(f->f_mode & FMODE_WRITE))
+                        if (error)
-                                        goto mnt_drop_write_and_out;
+                                goto mnt_drop_write_and_out;
-                        } else {
-                                error = vfs_permission(&nd, MAY_WRITE);
-                                if (error)
-                                        goto mnt_drop_write_and_out;
-                        }
                }
        }
        mutex_lock(&inode->i_mutex);
@@ -169,14 +174,6 @@ asmlinkage long sys_utimensat(int dfd, char __user *filename, struct timespec __
        if (utimes) {
                if (copy_from_user(&tstimes, utimes, sizeof(tstimes)))
                        return -EFAULT;
-                if ((tstimes[0].tv_nsec == UTIME_OMIT ||
-                     tstimes[0].tv_nsec == UTIME_NOW) &&
-                    tstimes[0].tv_sec != 0)
-                        return -EINVAL;
-                if ((tstimes[1].tv_nsec == UTIME_OMIT ||
-                     tstimes[1].tv_nsec == UTIME_NOW) &&
-                    tstimes[1].tv_sec != 0)
-                        return -EINVAL;
                /* Nothing to do, we must not even check the path.  */
                if (tstimes[0].tv_nsec == UTIME_OMIT &&
diff --git a/include/asm-alpha/percpu.h b/include/asm-alpha/percpu.h
index 82e8a94b4b2f..3495e8e00d70 100644
--- a/include/asm-alpha/percpu.h
+++ b/include/asm-alpha/percpu.h
@@ -69,6 +69,8 @@ extern unsigned long __per_cpu_offset[NR_CPUS];
 #define __get_cpu_var(var)              per_cpu_var(var)
 #define __raw_get_cpu_var(var)          per_cpu_var(var)
+#define PER_CPU_ATTRIBUTES
 #endif /* SMP */
 #define DECLARE_PER_CPU(type, name) extern __typeof__(type) per_cpu_var(name)
diff --git a/include/asm-generic/Kbuild.asm b/include/asm-generic/Kbuild.asm
index 92a6d91d0c1a..7cd25b8e7c9a 100644
--- a/include/asm-generic/Kbuild.asm
+++ b/include/asm-generic/Kbuild.asm
@@ -1,6 +1,6 @@
 header-y  += kvm.h
-ifeq ($(wildcard include/asm-$(SRCARCH)/a.out.h),include/asm-$(SRCARCH)/a.out.h)
+ifneq ($(wildcard $(srctree)/include/asm-$(SRCARCH)/a.out.h),)
 unifdef-y += a.out.h
 endif
 unifdef-y += auxvec.h
diff --git a/include/asm-powerpc/Kbuild b/include/asm-powerpc/Kbuild
index 7381916dfcbb..bca352e033c3 100644
--- a/include/asm-powerpc/Kbuild
+++ b/include/asm-powerpc/Kbuild
@@ -1,6 +1,5 @@
 include include/asm-generic/Kbuild.asm
-header-y += a.out.h
 header-y += auxvec.h
 header-y += ioctls.h
 header-y += mman.h
diff --git a/include/asm-x86/kvm_host.h b/include/asm-x86/kvm_host.h
index 1d8cd01fa514..844f2a89afbc 100644
--- a/include/asm-x86/kvm_host.h
+++ b/include/asm-x86/kvm_host.h
@@ -18,6 +18,7 @@
 #include <linux/kvm_para.h>
 #include <linux/kvm_types.h>
+#include <asm/pvclock-abi.h>
 #include <asm/desc.h>
 #define KVM_MAX_VCPUS 16
@@ -282,7 +283,8 @@ struct kvm_vcpu_arch {
        struct x86_emulate_ctxt emulate_ctxt;
        gpa_t time;
-        struct kvm_vcpu_time_info hv_clock;
+        struct pvclock_vcpu_time_info hv_clock;
+        unsigned int hv_clock_tsc_khz;
        unsigned int time_offset;
        struct page *time_page;
 };
diff --git a/include/asm-x86/kvm_para.h b/include/asm-x86/kvm_para.h
index 509845942070..bfd9900742bf 100644
--- a/include/asm-x86/kvm_para.h
+++ b/include/asm-x86/kvm_para.h
@@ -48,24 +48,6 @@ struct kvm_mmu_op_release_pt {
 #ifdef __KERNEL__
 #include <asm/processor.h>
-/* xen binary-compatible interface. See xen headers for details */
-struct kvm_vcpu_time_info {
-        uint32_t version;
-        uint32_t pad0;
-        uint64_t tsc_timestamp;
-        uint64_t system_time;
-        uint32_t tsc_to_system_mul;
-        int8_t   tsc_shift;
-        int8_t   pad[3];
-} __attribute__((__packed__)); /* 32 bytes */
-struct kvm_wall_clock {
-        uint32_t wc_version;
-        uint32_t wc_sec;
-        uint32_t wc_nsec;
-} __attribute__((__packed__));
 extern void kvmclock_init(void);
diff --git a/include/asm-x86/msr.h b/include/asm-x86/msr.h
index 3707650a169b..2b5f2c91db25 100644
--- a/include/asm-x86/msr.h
+++ b/include/asm-x86/msr.h
@@ -18,7 +18,7 @@ static inline unsigned long long native_read_tscp(unsigned int *aux)
        unsigned long low, high;
        asm volatile(".byte 0x0f,0x01,0xf9"
                     : "=a" (low), "=d" (high), "=c" (*aux));
-        return low | ((u64)high >> 32);
+        return low | ((u64)high << 32);
 }
 /*
diff --git a/include/asm-x86/pvclock-abi.h b/include/asm-x86/pvclock-abi.h
new file mode 100644
index 000000000000..6857f840b243
--- /dev/null
+++ b/include/asm-x86/pvclock-abi.h
@@ -0,0 +1,42 @@
+#ifndef _ASM_X86_PVCLOCK_ABI_H_
+#define _ASM_X86_PVCLOCK_ABI_H_
+#ifndef __ASSEMBLY__
+/*
+ * These structs MUST NOT be changed.
+ * They are the ABI between hypervisor and guest OS.
+ * Both Xen and KVM are using this.
+ *
+ * pvclock_vcpu_time_info holds the system time and the tsc timestamp
+ * of the last update. So the guest can use the tsc delta to get a
+ * more precise system time.  There is one per virtual cpu.
+ *
+ * pvclock_wall_clock references the point in time when the system
+ * time was zero (usually boot time), thus the guest calculates the
+ * current wall clock by adding the system time.
+ *
+ * Protocol for the "version" fields is: hypervisor raises it (making
+ * it uneven) before it starts updating the fields and raises it again
+ * (making it even) when it is done.  Thus the guest can make sure the
+ * time values it got are consistent by checking the version before
+ * and after reading them.
+ */
+struct pvclock_vcpu_time_info {
+        u32   version;
+        u32   pad0;
+        u64   tsc_timestamp;
+        u64   system_time;
+        u32   tsc_to_system_mul;
+        s8    tsc_shift;
+        u8    pad[3];
+} __attribute__((__packed__)); /* 32 bytes */
+struct pvclock_wall_clock {
+        u32   version;
+        u32   sec;
+        u32   nsec;
+} __attribute__((__packed__));
+#endif /* __ASSEMBLY__ */
+#endif /* _ASM_X86_PVCLOCK_ABI_H_ */
diff --git a/include/asm-x86/pvclock.h b/include/asm-x86/pvclock.h
new file mode 100644
index 000000000000..85b1bba8e0a3
--- /dev/null
+++ b/include/asm-x86/pvclock.h
@@ -0,0 +1,13 @@
+#ifndef _ASM_X86_PVCLOCK_H_
+#define _ASM_X86_PVCLOCK_H_
+#include <linux/clocksource.h>
+#include <asm/pvclock-abi.h>
+/* some helper functions for xen and kvm pv clock sources */
+cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src);
+void pvclock_read_wallclock(struct pvclock_wall_clock *wall,
+                            struct pvclock_vcpu_time_info *vcpu,
+                            struct timespec *ts);
+#endif /* _ASM_X86_PVCLOCK_H_ */
diff --git a/include/asm-x86/xen/page.h b/include/asm-x86/xen/page.h
index baf3a4dce28c..e11f24038b1d 100644
--- a/include/asm-x86/xen/page.h
+++ b/include/asm-x86/xen/page.h
@@ -150,13 +150,9 @@ static inline pte_t __pte_ma(pteval_t x)
        return (pte_t) { .pte = x };
 }
-#ifdef CONFIG_X86_PAE
 #define pmd_val_ma(v) ((v).pmd)
 #define pud_val_ma(v) ((v).pgd.pgd)
 #define __pmd_ma(x)     ((pmd_t) { (x) } )
-#else  /* !X86_PAE */
-#define pmd_val_ma(v)   ((v).pud.pgd.pgd)
-#endif  /* CONFIG_X86_PAE */
 #define pgd_val_ma(x)   ((x).pgd)
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index b6fbb2573e88..71d70d1fbce2 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -166,7 +166,7 @@ unifdef-y += acct.h
 unifdef-y += adb.h
 unifdef-y += adfs_fs.h
 unifdef-y += agpgart.h
-ifeq ($(wildcard include/asm-$(SRCARCH)/a.out.h),include/asm-$(SRCARCH)/a.out.h)
+ifneq ($(wildcard $(srctree)/include/asm-$(SRCARCH)/a.out.h),)
 unifdef-y += a.out.h
 endif
 unifdef-y += apm_bios.h
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 63c3bb98558f..8b82974bdc12 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -571,7 +571,7 @@ extern void		    audit_log_lost(const char *message);
 extern int                  audit_update_lsm_rules(void);
                                /* Private API (for audit.c only) */
-extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
+extern int audit_filter_user(struct netlink_skb_parms *cb);
 extern int audit_filter_type(int type);
 extern int  audit_receive_filter(int type, int pid, int uid, int seq,
                                void *data, size_t datasz, uid_t loginuid,
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 2a6639407c80..d982eb89c77d 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -300,7 +300,7 @@ extern int d_validate(struct dentry *, struct dentry *);
 extern char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
 extern char *__d_path(const struct path *path, struct path *root, char *, int);
-extern char *d_path(struct path *, char *, int);
+extern char *d_path(const struct path *, char *, int);
 extern char *dentry_path(struct dentry *, char *, int);
 /* Allocation counts.. */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index d490779f18d9..7c1080826832 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -894,8 +894,6 @@ static inline int file_check_writeable(struct file *filp)
 typedef struct files_struct *fl_owner_t;
 struct file_lock_operations {
-        void (*fl_insert)(struct file_lock *);  /* lock insertion callback */
-        void (*fl_remove)(struct file_lock *);  /* lock removal callback */
        void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
        void (*fl_release_private)(struct file_lock *);
 };
diff --git a/include/linux/inet_lro.h b/include/linux/inet_lro.h
index 80335b7d77c5..c4335faebb63 100644
--- a/include/linux/inet_lro.h
+++ b/include/linux/inet_lro.h
@@ -84,7 +84,11 @@ struct net_lro_mgr {
                                    from received packets and eth protocol
                                    is still ETH_P_8021Q */
-        u32 ip_summed;      /* Set in non generated SKBs in page mode */
+        /*
+         * Set for generated SKBs that are not added to
+         * the frag list in fragmented mode
+         */
+        u32 ip_summed;
        u32 ip_summed_aggr; /* Set in aggregated SKBs: CHECKSUM_UNNECESSARY
                             * or CHECKSUM_NONE */
diff --git a/include/linux/input.h b/include/linux/input.h
index e075c4b762fb..d150c57e5f0a 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -534,8 +534,8 @@ struct input_absinfo {
 #define KEY_FRAMEBACK           0x1b4   /* Consumer - transport controls */
 #define KEY_FRAMEFORWARD        0x1b5
 #define KEY_CONTEXT_MENU        0x1b6   /* GenDesc - system context menu */
+#define KEY_MEDIA_REPEAT        0x1b7   /* Consumer - transport control */
 #define KEY_DEL_EOL             0x1c0
 #define KEY_DEL_EOS             0x1c1
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 092b1b25291d..de9d1df4bba2 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -33,6 +33,7 @@
 #define KVM_REQ_REPORT_TPR_ACCESS  2
 #define KVM_REQ_MMU_RELOAD         3
 #define KVM_REQ_TRIPLE_FAULT       4
+#define KVM_REQ_PENDING_TIMER      5
 struct kvm_vcpu;
 extern struct kmem_cache *kvm_vcpu_cache;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f27fd2009334..25f87102ab66 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -88,6 +88,8 @@ struct wireless_dev;
 #define NETDEV_TX_BUSY 1        /* driver tx path was busy*/
 #define NETDEV_TX_LOCKED -1     /* driver tx lock was already taken */
+#ifdef  __KERNEL__
 /*
 *      Compute the worst case header length according to the protocols
 *      used.
@@ -114,6 +116,8 @@ struct wireless_dev;
 #define MAX_HEADER (LL_MAX_HEADER + 48)
 #endif
+#endif  /*  __KERNEL__  */
 struct net_device_subqueue
 {
        /* Give a control state for each queue.  This struct may contain
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index 06d3e6eb9ca8..917707e6151d 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -66,8 +66,7 @@ struct thermal_cooling_device {
                                ((long)t-2732+5)/10 : ((long)t-2732-5)/10)
 #define CELSIUS_TO_KELVIN(t)    ((t)*10+2732)
-#if defined(CONFIG_HWMON) ||    \
+#if defined(CONFIG_THERMAL_HWMON)
-        (defined(CONFIG_HWMON_MODULE) && defined(CONFIG_THERMAL_MODULE))
 /* thermal zone devices with the same type share one hwmon device */
 struct thermal_hwmon_device {
        char type[THERMAL_NAME_LENGTH];
@@ -94,8 +93,7 @@ struct thermal_zone_device {
        struct idr idr;
        struct mutex lock;      /* protect cooling devices list */
        struct list_head node;
-#if defined(CONFIG_HWMON) ||    \
+#if defined(CONFIG_THERMAL_HWMON)
-        (defined(CONFIG_HWMON_MODULE) && defined(CONFIG_THERMAL_MODULE))
        struct list_head hwmon_node;
        struct thermal_hwmon_device *hwmon;
        struct thermal_hwmon_attr temp_input;   /* hwmon sys attr */
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 59f1c0bd8f9c..d2a003586761 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -27,8 +27,7 @@
 *      This routine is called by the kernel to write a series of
 *      characters to the tty device.  The characters may come from
 *      user space or kernel space.  This routine will return the
- *      number of characters actually accepted for writing.  This
+ *      number of characters actually accepted for writing.
- *      routine is mandatory.
 *
 *      Optional: Required for writable devices.
 *
@@ -134,7 +133,7 @@
 *      This routine notifies the tty driver that it should hangup the
 *      tty device.
 *
- *      Required:
+ *      Optional:
 *
 * void (*break_ctl)(struct tty_stuct *tty, int state);
 *
diff --git a/include/media/cx25840.h b/include/media/cx25840.h
index cd599ad29fb2..db431d513f2f 100644
--- a/include/media/cx25840.h
+++ b/include/media/cx25840.h
@@ -32,12 +32,16 @@ enum cx25840_video_input {
        CX25840_COMPOSITE7,
        CX25840_COMPOSITE8,
-        /* S-Video inputs consist of one luma input (In1-In4) ORed with one
+        /* S-Video inputs consist of one luma input (In1-In8) ORed with one
           chroma input (In5-In8) */
        CX25840_SVIDEO_LUMA1 = 0x10,
        CX25840_SVIDEO_LUMA2 = 0x20,
        CX25840_SVIDEO_LUMA3 = 0x30,
        CX25840_SVIDEO_LUMA4 = 0x40,
+        CX25840_SVIDEO_LUMA5 = 0x50,
+        CX25840_SVIDEO_LUMA6 = 0x60,
+        CX25840_SVIDEO_LUMA7 = 0x70,
+        CX25840_SVIDEO_LUMA8 = 0x80,
        CX25840_SVIDEO_CHROMA4 = 0x400,
        CX25840_SVIDEO_CHROMA5 = 0x500,
        CX25840_SVIDEO_CHROMA6 = 0x600,
diff --git a/include/media/ir-common.h b/include/media/ir-common.h
index bfee8be5d63f..b8e8aa91905a 100644
--- a/include/media/ir-common.h
+++ b/include/media/ir-common.h
@@ -146,6 +146,7 @@ extern IR_KEYTAB_TYPE ir_codes_behold_columbus[IR_KEYTAB_SIZE];
 extern IR_KEYTAB_TYPE ir_codes_pinnacle_pctv_hd[IR_KEYTAB_SIZE];
 extern IR_KEYTAB_TYPE ir_codes_genius_tvgo_a11mce[IR_KEYTAB_SIZE];
 extern IR_KEYTAB_TYPE ir_codes_powercolor_real_angel[IR_KEYTAB_SIZE];
+extern IR_KEYTAB_TYPE ir_codes_avermedia_a16d[IR_KEYTAB_SIZE];
 #endif
diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
index 33f01ae08f76..859f7a6f6f67 100644
--- a/include/media/v4l2-dev.h
+++ b/include/media/v4l2-dev.h
@@ -40,9 +40,9 @@
 #define VFL_TYPE_VTX            3
 /*  Video standard functions  */
-extern char *v4l2_norm_to_name(v4l2_std_id id);
+extern const char *v4l2_norm_to_name(v4l2_std_id id);
 extern int v4l2_video_std_construct(struct v4l2_standard *vs,
-                                    int id, char *name);
+                                    int id, const char *name);
 /* Prints the ioctl in a human-readable format */
 extern void v4l_printk_ioctl(unsigned int cmd);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index dae3f9ec1154..bcd1623245cb 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -595,6 +595,15 @@ enum ieee80211_key_alg {
        ALG_CCMP,
 };
+/**
+ * enum ieee80211_key_len - key length
+ * @WEP40: WEP 5 byte long key
+ * @WEP104: WEP 13 byte long key
+ */
+enum ieee80211_key_len {
+        LEN_WEP40 = 5,
+        LEN_WEP104 = 13,
+};
 /**
 * enum ieee80211_key_flags - key flags
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index ab502ec1c61c..a87fc0312edc 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -178,7 +178,7 @@ extern struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops);
 extern struct Qdisc *qdisc_create_dflt(struct net_device *dev,
                                       struct Qdisc_ops *ops, u32 parentid);
 extern void tcf_destroy(struct tcf_proto *tp);
-extern void tcf_destroy_chain(struct tcf_proto *fl);
+extern void tcf_destroy_chain(struct tcf_proto **fl);
 static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
                                       struct sk_buff_head *list)
diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h
index 9b018da48cf3..819a0331cda9 100644
--- a/include/xen/interface/xen.h
+++ b/include/xen/interface/xen.h
@@ -10,6 +10,7 @@
 #define __XEN_PUBLIC_XEN_H__
 #include <asm/xen/interface.h>
+#include <asm/pvclock-abi.h>
 /*
 * XEN "SYSTEM CALLS" (a.k.a. HYPERCALLS).
@@ -336,7 +337,7 @@ struct vcpu_info {
        uint8_t evtchn_upcall_mask;
        unsigned long evtchn_pending_sel;
        struct arch_vcpu_info arch;
-        struct vcpu_time_info time;
+        struct pvclock_vcpu_time_info time;
 }; /* 64 bytes (x86) */
 /*
@@ -384,9 +385,7 @@ struct shared_info {
         * Wallclock time: updated only by control software. Guests should base
         * their gettimeofday() syscall on this wallclock-base value.
         */
-        uint32_t wc_version;      /* Version counter: see vcpu_time_info_t. */
+        struct pvclock_wall_clock wc;
-        uint32_t wc_sec;          /* Secs  00:00:00 UTC, Jan 1, 1970.  */
-        uint32_t wc_nsec;         /* Nsecs 00:00:00 UTC, Jan 1, 1970.  */
        struct arch_shared_info arch;
diff --git a/kernel/audit.c b/kernel/audit.c
index e8692a5748c2..e092f1c0ce30 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -738,7 +738,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                if (!audit_enabled && msg_type != AUDIT_USER_AVC)
                        return 0;
-                err = audit_filter_user(&NETLINK_CB(skb), msg_type);
+                err = audit_filter_user(&NETLINK_CB(skb));
                if (err == 1) {
                        err = 0;
                        if (msg_type == AUDIT_USER_TTY) {
@@ -779,7 +779,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                }
                /* fallthrough */
        case AUDIT_LIST:
-                err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
+                err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
                                           uid, seq, data, nlmsg_len(nlh),
                                           loginuid, sessionid, sid);
                break;
@@ -798,7 +798,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                }
                /* fallthrough */
        case AUDIT_LIST_RULES:
-                err = audit_receive_filter(nlh->nlmsg_type, NETLINK_CB(skb).pid,
+                err = audit_receive_filter(msg_type, NETLINK_CB(skb).pid,
                                           uid, seq, data, nlmsg_len(nlh),
                                           loginuid, sessionid, sid);
                break;
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 0e0bd27e6512..98c50cc671bb 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1544,6 +1544,7 @@ static void audit_log_rule_change(uid_t loginuid, u32 sessionid, u32 sid,
 * @data: payload data
 * @datasz: size of payload data
 * @loginuid: loginuid of sender
+ * @sessionid: sessionid for netlink audit message
 * @sid: SE Linux Security ID of sender
 */
 int audit_receive_filter(int type, int pid, int uid, int seq, void *data,
@@ -1720,7 +1721,7 @@ static int audit_filter_user_rules(struct netlink_skb_parms *cb,
        return 1;
 }
-int audit_filter_user(struct netlink_skb_parms *cb, int type)
+int audit_filter_user(struct netlink_skb_parms *cb)
 {
        enum audit_state state = AUDIT_DISABLED;
        struct audit_entry *e;
diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index 79e3c90113c2..3ec23c3ec97f 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -1499,7 +1499,8 @@ int kgdb_nmicallback(int cpu, void *regs)
        return 1;
 }
-void kgdb_console_write(struct console *co, const char *s, unsigned count)
+static void kgdb_console_write(struct console *co, const char *s,
+   unsigned count)
 {
        unsigned long flags;
diff --git a/kernel/sched.c b/kernel/sched.c
index b048ad8a11af..a66e85639de2 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4398,22 +4398,20 @@ do_wait_for_common(struct completion *x, long timeout, int state)
                             signal_pending(current)) ||
                            (state == TASK_KILLABLE &&
                             fatal_signal_pending(current))) {
-                                __remove_wait_queue(&x->wait, &wait);
+                                timeout = -ERESTARTSYS;
-                                return -ERESTARTSYS;
+                                break;
                        }
                        __set_current_state(state);
                        spin_unlock_irq(&x->wait.lock);
                        timeout = schedule_timeout(timeout);
                        spin_lock_irq(&x->wait.lock);
-                        if (!timeout) {
+                } while (!x->done && timeout);
-                                __remove_wait_queue(&x->wait, &wait);
-                                return timeout;
-                        }
-                } while (!x->done);
                __remove_wait_queue(&x->wait, &wait);
+                if (!x->done)
+                        return timeout;
        }
        x->done--;
-        return timeout;
+        return timeout ?: 1;
 }
 static long __sched
@@ -5889,6 +5887,7 @@ static void migrate_dead_tasks(unsigned int dead_cpu)
                next = pick_next_task(rq, rq->curr);
                if (!next)
                        break;
+                next->sched_class->put_prev_task(rq, next);
                migrate_dead(dead_cpu, next);
        }
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 1dad5bbb59b6..0f3c19197fa4 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -250,7 +250,8 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
                        if (rt_rq->rt_time || rt_rq->rt_nr_running)
                                idle = 0;
                        spin_unlock(&rt_rq->rt_runtime_lock);
-                }
+                } else if (rt_rq->rt_nr_running)
+                        idle = 0;
                if (enqueue)
                        sched_rt_rq_enqueue(rt_rq);
diff --git a/lib/ts_bm.c b/lib/ts_bm.c
index d90822c378a4..4a7fce72898e 100644
--- a/lib/ts_bm.c
+++ b/lib/ts_bm.c
@@ -63,7 +63,7 @@ static unsigned int bm_find(struct ts_config *conf, struct ts_state *state)
        struct ts_bm *bm = ts_config_priv(conf);
        unsigned int i, text_len, consumed = state->offset;
        const u8 *text;
-        int shift = bm->patlen, bs;
+        int shift = bm->patlen - 1, bs;
        for (;;) {
                text_len = conf->get_next_block(consumed, &text, conf, state);
diff --git a/mm/memory.c b/mm/memory.c
index 9aefaae46858..d14b251a25a6 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1045,6 +1045,26 @@ no_page_table:
        return page;
 }
+/* Can we do the FOLL_ANON optimization? */
+static inline int use_zero_page(struct vm_area_struct *vma)
+{
+        /*
+         * We don't want to optimize FOLL_ANON for make_pages_present()
+         * when it tries to page in a VM_LOCKED region. As to VM_SHARED,
+         * we want to get the page from the page tables to make sure
+         * that we serialize and update with any other user of that
+         * mapping.
+         */
+        if (vma->vm_flags & (VM_LOCKED | VM_SHARED))
+                return 0;
+        /*
+         * And if we have a fault or a nopfn routine, it's not an
+         * anonymous region.
+         */
+        return !vma->vm_ops ||
+                (!vma->vm_ops->fault && !vma->vm_ops->nopfn);
+}
 int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                unsigned long start, int len, int write, int force,
                struct page **pages, struct vm_area_struct **vmas)
@@ -1119,8 +1139,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                foll_flags = FOLL_TOUCH;
                if (pages)
                        foll_flags |= FOLL_GET;
-                if (!write && !(vma->vm_flags & VM_LOCKED) &&
+                if (!write && use_zero_page(vma))
-                    (!vma->vm_ops || !vma->vm_ops->fault))
                        foll_flags |= FOLL_ANON;
                do {
@@ -1766,7 +1785,6 @@ gotten:
        page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
        if (likely(pte_same(*page_table, orig_pte))) {
                if (old_page) {
-                        page_remove_rmap(old_page, vma);
                        if (!PageAnon(old_page)) {
                                dec_mm_counter(mm, file_rss);
                                inc_mm_counter(mm, anon_rss);
@@ -1788,6 +1806,32 @@ gotten:
                lru_cache_add_active(new_page);
                page_add_new_anon_rmap(new_page, vma, address);
+                if (old_page) {
+                        /*
+                         * Only after switching the pte to the new page may
+                         * we remove the mapcount here. Otherwise another
+                         * process may come and find the rmap count decremented
+                         * before the pte is switched to the new page, and
+                         * "reuse" the old page writing into it while our pte
+                         * here still points into it and can be read by other
+                         * threads.
+                         *
+                         * The critical issue is to order this
+                         * page_remove_rmap with the ptp_clear_flush above.
+                         * Those stores are ordered by (if nothing else,)
+                         * the barrier present in the atomic_add_negative
+                         * in page_remove_rmap.
+                         *
+                         * Then the TLB flush in ptep_clear_flush ensures that
+                         * no process can access the old page before the
+                         * decremented mapcount is visible. And the old page
+                         * cannot be reused until after the decremented
+                         * mapcount is visible. So transitively, TLBs to
+                         * old page will be flushed before it can be reused.
+                         */
+                        page_remove_rmap(old_page, vma);
+                }
                /* Free the old page.. */
                new_page = old_page;
                ret |= VM_FAULT_WRITE;
diff --git a/net/core/dev.c b/net/core/dev.c
index c421a1f8f0b9..fca23a3bf12c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -454,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
        for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
                if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
                        memset(s[i].name, 0, sizeof(s[i].name));
-                        strcpy(s[i].name, name);
+                        strlcpy(s[i].name, name, IFNAMSIZ);
                        memcpy(&s[i].map, map, sizeof(s[i].map));
                        break;
                }
@@ -479,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)
        for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
                if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
-                    !strncmp(dev->name, s[i].name, strlen(s[i].name))) {
+                    !strcmp(dev->name, s[i].name)) {
                        dev->irq        = s[i].map.irq;
                        dev->base_addr  = s[i].map.base_addr;
                        dev->mem_start  = s[i].map.mem_start;
@@ -2973,7 +2973,7 @@ EXPORT_SYMBOL(dev_unicast_delete);
 /**
 *      dev_unicast_add         - add a secondary unicast address
 *      @dev: device
- *      @addr: address to delete
+ *      @addr: address to add
 *      @alen: length of @addr
 *
 *      Add a secondary unicast address to the device or increase
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index e3e9ab0f74e3..277a2302eb3a 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -226,7 +226,7 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        ops = lookup_rules_ops(net, frh->family);
        if (ops == NULL) {
-                err = EAFNOSUPPORT;
+                err = -EAFNOSUPPORT;
                goto errout;
        }
@@ -365,7 +365,7 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        ops = lookup_rules_ops(net, frh->family);
        if (ops == NULL) {
-                err = EAFNOSUPPORT;
+                err = -EAFNOSUPPORT;
                goto errout;
        }
diff --git a/net/core/filter.c b/net/core/filter.c
index 4f8369729a4e..df3744355839 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -68,7 +68,6 @@ static inline void *load_pointer(struct sk_buff *skb, int k,
 *      sk_filter - run a packet through a socket filter
 *      @sk: sock associated with &sk_buff
 *      @skb: buffer to filter
- *      @needlock: set to 1 if the sock is not locked by caller.
 *
 * Run the filter code and then cut skb->data to correct size returned by
 * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1e556d312117..366621610e76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1292,12 +1292,14 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
 {
        unsigned int nr_pages = spd->nr_pages;
        unsigned int poff, plen, len, toff, tlen;
-        int headlen, seg;
+        int headlen, seg, error = 0;
        toff = *offset;
        tlen = *total_len;
-        if (!tlen)
+        if (!tlen) {
+                error = 1;
                goto err;
+        }
        /*
         * if the offset is greater than the linear part, go directly to
@@ -1339,7 +1341,8 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                 * just jump directly to update and return, no point
                 * in going over fragments when the output is full.
                 */
-                if (spd_fill_page(spd, virt_to_page(p), plen, poff, skb))
+                error = spd_fill_page(spd, virt_to_page(p), plen, poff, skb);
+                if (error)
                        goto done;
                tlen -= plen;
@@ -1369,7 +1372,8 @@ map_frag:
                if (!plen)
                        break;
-                if (spd_fill_page(spd, f->page, plen, poff, skb))
+                error = spd_fill_page(spd, f->page, plen, poff, skb);
+                if (error)
                        break;
                tlen -= plen;
@@ -1382,7 +1386,10 @@ done:
                return 0;
        }
 err:
-        return 1;
+        /* update the offset to reflect the linear part skip, if any */
+        if (!error)
+                *offset = toff;
+        return error;
 }
 /*
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 4ed429bd5951..0546a0bc97ea 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -192,14 +192,21 @@ EXPORT_SYMBOL(inet_frag_evictor);
 static struct inet_frag_queue *inet_frag_intern(struct netns_frags *nf,
                struct inet_frag_queue *qp_in, struct inet_frags *f,
-                unsigned int hash, void *arg)
+                void *arg)
 {
        struct inet_frag_queue *qp;
 #ifdef CONFIG_SMP
        struct hlist_node *n;
 #endif
+        unsigned int hash;
        write_lock(&f->lock);
+        /*
+         * While we stayed w/o the lock other CPU could update
+         * the rnd seed, so we need to re-calculate the hash
+         * chain. Fortunatelly the qp_in can be used to get one.
+         */
+        hash = f->hashfn(qp_in);
 #ifdef CONFIG_SMP
        /* With SMP race we have to recheck hash table, because
         * such entry could be created on other cpu, while we
@@ -247,7 +254,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 }
 static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
-                struct inet_frags *f, void *arg, unsigned int hash)
+                struct inet_frags *f, void *arg)
 {
        struct inet_frag_queue *q;
@@ -255,7 +262,7 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf,
        if (q == NULL)
                return NULL;
-        return inet_frag_intern(nf, q, f, hash, arg);
+        return inet_frag_intern(nf, q, f, arg);
 }
 struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
@@ -264,7 +271,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
        struct inet_frag_queue *q;
        struct hlist_node *n;
-        read_lock(&f->lock);
        hlist_for_each_entry(q, n, &f->hash[hash], list) {
                if (q->net == nf && f->match(q, key)) {
                        atomic_inc(&q->refcnt);
@@ -274,6 +280,6 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
        }
        read_unlock(&f->lock);
-        return inet_frag_create(nf, f, key, hash);
+        return inet_frag_create(nf, f, key);
 }
 EXPORT_SYMBOL(inet_frag_find);
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 4a4d49fca1f2..cfd034a2b96e 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -383,8 +383,7 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
 out2: /* send aggregated SKBs to stack */
        lro_flush(lro_mgr, lro_desc);
-out:  /* Original SKB has to be posted to stack */
+out:
-        skb->ip_summed = lro_mgr->ip_summed;
        return 1;
 }
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index cd6ce6ac6358..37221f659159 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -229,6 +229,8 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
        arg.iph = iph;
        arg.user = user;
+        read_lock(&ip4_frags.lock);
        hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
        q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index fc54a48fde1e..850825dc86e6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -260,6 +260,8 @@
 #include <linux/socket.h>
 #include <linux/random.h>
 #include <linux/bootmem.h>
+#include <linux/highmem.h>
+#include <linux/swap.h>
 #include <linux/cache.h>
 #include <linux/err.h>
 #include <linux/crypto.h>
@@ -2620,7 +2622,7 @@ __setup("thash_entries=", set_thash_entries);
 void __init tcp_init(void)
 {
        struct sk_buff *skb = NULL;
-        unsigned long limit;
+        unsigned long nr_pages, limit;
        int order, i, max_share;
        BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -2689,8 +2691,9 @@ void __init tcp_init(void)
         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
         * memory, with a floor of 128 pages.
         */
-        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        nr_pages = totalram_pages - totalhigh_pages;
-        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = min(nr_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
        limit = max(limit, 128UL);
        sysctl_tcp_mem[0] = limit / 4 * 3;
        sysctl_tcp_mem[1] = limit;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 12695be2c255..ffe869ac1bcf 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2291,7 +2291,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
        }
        seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
-                        "%08X %5d %8d %lu %d %p %u %u %u %u %d%n",
+                        "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
                i, src, srcp, dest, destp, sk->sk_state,
                tp->write_seq - tp->snd_una,
                sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
@@ -2303,8 +2303,8 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                icsk->icsk_probes_out,
                sock_i_ino(sk),
                atomic_read(&sk->sk_refcnt), sk,
-                icsk->icsk_rto,
+                jiffies_to_clock_t(icsk->icsk_rto),
-                icsk->icsk_ack.ato,
+                jiffies_to_clock_t(icsk->icsk_ack.ato),
                (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                tp->snd_cwnd,
                tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh,
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 27a5e8b48d93..f405cea21a8b 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -129,7 +129,7 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
                .priority       = NF_IP6_PRI_MANGLE,
        },
        {
-                .hook           = ip6t_local_hook,
+                .hook           = ip6t_route_hook,
                .owner          = THIS_MODULE,
                .pf             = PF_INET6,
                .hooknum        = NF_INET_LOCAL_IN,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e65e26e210ee..cf20bc4fd60d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -207,9 +207,10 @@ fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
        arg.id = id;
        arg.src = src;
        arg.dst = dst;
+        read_lock_bh(&nf_frags.lock);
        hash = ip6qhashfn(id, src, dst);
-        local_bh_disable();
        q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
        local_bh_enable();
        if (q == NULL)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 798cabc7535b..a60d7d129713 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -247,6 +247,8 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
        arg.id = id;
        arg.src = src;
        arg.dst = dst;
+        read_lock(&ip6_frags.lock);
        hash = ip6qhashfn(id, src, dst);
        q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d1f3e19b06c7..7ff687020fa9 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -240,7 +240,7 @@ static inline int rt6_need_strict(struct in6_addr *daddr)
 static inline struct rt6_info *rt6_device_match(struct net *net,
                                                    struct rt6_info *rt,
                                                    int oif,
-                                                    int strict)
+                                                    int flags)
 {
        struct rt6_info *local = NULL;
        struct rt6_info *sprt;
@@ -253,7 +253,7 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
                        if (dev->flags & IFF_LOOPBACK) {
                                if (sprt->rt6i_idev == NULL ||
                                    sprt->rt6i_idev->dev->ifindex != oif) {
-                                        if (strict && oif)
+                                        if (flags & RT6_LOOKUP_F_IFACE && oif)
                                                continue;
                                        if (local && (!oif ||
                                                      local->rt6i_idev->dev->ifindex == oif))
@@ -266,7 +266,7 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
                if (local)
                        return local;
-                if (strict)
+                if (flags & RT6_LOOKUP_F_IFACE)
                        return net->ipv6.ip6_null_entry;
        }
        return rt;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cb46749d4c32..40ea9c36d24b 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2036,7 +2036,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2052,8 +2052,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                   icsk->icsk_probes_out,
                   sock_i_ino(sp),
                   atomic_read(&sp->sk_refcnt), sp,
-                   icsk->icsk_rto,
+                   jiffies_to_clock_t(icsk->icsk_rto),
-                   icsk->icsk_ack.ato,
+                   jiffies_to_clock_t(icsk->icsk_ack.ato),
                   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
                   tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
                   );
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 150d66dbda9d..220e83be3ef4 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -380,6 +380,15 @@ void ieee80211_key_free(struct ieee80211_key *key)
        if (!key)
                return;
+        if (!key->sdata) {
+                /* The key has not been linked yet, simply free it
+                 * and don't Oops */
+                if (key->conf.alg == ALG_CCMP)
+                        ieee80211_aes_key_free(key->u.ccmp.tfm);
+                kfree(key);
+                return;
+        }
        spin_lock_irqsave(&key->sdata->local->key_lock, flags);
        __ieee80211_key_free(key);
        spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 6106cb79060c..e8404212ad57 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -95,6 +95,13 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                        }
                }
+                if (alg == ALG_WEP &&
+                        key_len != LEN_WEP40 && key_len != LEN_WEP104) {
+                        ieee80211_key_free(key);
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
                ieee80211_key_link(key, sdata, sta);
                if (set_tx_key || (!sta && !sdata->default_key && key))
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 635b996c8c35..5d09e8698b57 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -323,8 +323,7 @@ static void wme_qdiscop_destroy(struct Qdisc* qd)
        struct ieee80211_hw *hw = &local->hw;
        int queue;
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
-        q->filter_list = NULL;
        for (queue=0; queue < hw->queues; queue++) {
                skb_queue_purge(&q->requeued[queue]);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index ba94004fe323..271cd01d57ae 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -331,12 +331,13 @@ static unsigned int get_conntrack_index(const struct tcphdr *tcph)
   I.   Upper bound for valid data:     seq <= sender.td_maxend
   II.  Lower bound for valid data:     seq + len >= sender.td_end - receiver.td_maxwin
-   III. Upper bound for valid ack:      sack <= receiver.td_end
+   III. Upper bound for valid (s)ack:   sack <= receiver.td_end
-   IV.  Lower bound for valid ack:      ack >= receiver.td_end - MAXACKWINDOW
+   IV.  Lower bound for valid (s)ack:   sack >= receiver.td_end - MAXACKWINDOW
-   where sack is the highest right edge of sack block found in the packet.
+   where sack is the highest right edge of sack block found in the packet
+   or ack in the case of packet without SACK option.
-   The upper bound limit for a valid ack is not ignored -
+   The upper bound limit for a valid (s)ack is not ignored -
   we doesn't have to deal with fragments.
 */
@@ -606,12 +607,12 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 before(seq, sender->td_maxend + 1),
                 after(end, sender->td_end - receiver->td_maxwin - 1),
                 before(sack, receiver->td_end + 1),
-                 after(ack, receiver->td_end - MAXACKWINDOW(sender)));
+                 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
        if (before(seq, sender->td_maxend + 1) &&
            after(end, sender->td_end - receiver->td_maxwin - 1) &&
            before(sack, receiver->td_end + 1) &&
-            after(ack, receiver->td_end - MAXACKWINDOW(sender))) {
+            after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
                /*
                 * Take into account window scaling (RFC 1323).
                 */
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 0099da5b2591..52b2611a6eb6 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1534,7 +1534,7 @@ static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
                }
        }
        list_for_each_entry_rcu(addr6, &iface->addr6_list, list) {
-                if (addr6->valid || iter_addr6++ < skip_addr6)
+                if (!addr6->valid || iter_addr6++ < skip_addr6)
                        continue;
                if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
                                           iface,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9b97f8006c9c..349aba189558 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -886,7 +886,7 @@ retry:
                return netlink_unicast_kernel(sk, skb);
        if (sk_filter(sk, skb)) {
-                int err = skb->len;
+                err = skb->len;
                kfree_skb(skb);
                sock_put(sk);
                return err;
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index 47bbf45ae5d7..2d106cfe1d27 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -132,6 +132,7 @@ errout:
 * @maxtype: maximum attribute type to be expected
 * @head: head of attribute stream
 * @len: length of attribute stream
+ * @policy: validation policy
 *
 * Parses a stream of attributes and stores a pointer to each attribute in
 * the tb array accessable via the attribute type. Attributes with a type
@@ -194,7 +195,7 @@ struct nlattr *nla_find(struct nlattr *head, int len, int attrtype)
 /**
 * nla_strlcpy - Copy string attribute payload into a sized buffer
 * @dst: where to copy the string to
- * @src: attribute to copy the string from
+ * @nla: attribute to copy the string from
 * @dstsize: size of destination buffer
 *
 * Copies at most dstsize - 1 bytes into the destination buffer.
@@ -340,9 +341,9 @@ struct nlattr *nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
 }
 /**
- * nla_reserve - reserve room for attribute without header
+ * nla_reserve_nohdr - reserve room for attribute without header
 * @skb: socket buffer to reserve room on
- * @len: length of attribute payload
+ * @attrlen: length of attribute payload
 *
 * Reserves room for attribute payload without a header.
 *
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 82adfe6447d7..9437b27ff84d 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -106,17 +106,6 @@ config NET_SCH_PRIO
          To compile this code as a module, choose M here: the
          module will be called sch_prio.
-config NET_SCH_RR
-        tristate "Multi Band Round Robin Queuing (RR)"
-        select NET_SCH_PRIO
-        ---help---
-          Say Y here if you want to use an n-band round robin packet
-          scheduler.
-          The module uses sch_prio for its framework and is aliased as
-          sch_rr, so it will load sch_prio, although it is referred
-          to using sch_rr.
 config NET_SCH_RED
        tristate "Random Early Detection (RED)"
        ---help---
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c40773cdbe45..10f01ad04380 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1252,12 +1252,12 @@ void tcf_destroy(struct tcf_proto *tp)
        kfree(tp);
 }
-void tcf_destroy_chain(struct tcf_proto *fl)
+void tcf_destroy_chain(struct tcf_proto **fl)
 {
        struct tcf_proto *tp;
-        while ((tp = fl) != NULL) {
+        while ((tp = *fl) != NULL) {
-                fl = tp->next;
+                *fl = tp->next;
                tcf_destroy(tp);
        }
 }
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 335273416384..db0e23ae85f8 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -160,7 +160,7 @@ static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
        *prev = flow->next;
        pr_debug("atm_tc_put: qdisc %p\n", flow->q);
        qdisc_destroy(flow->q);
-        tcf_destroy_chain(flow->filter_list);
+        tcf_destroy_chain(&flow->filter_list);
        if (flow->sock) {
                pr_debug("atm_tc_put: f_count %d\n",
                        file_count(flow->sock->file));
@@ -586,10 +586,11 @@ static void atm_tc_destroy(struct Qdisc *sch)
        struct atm_flow_data *flow;
        pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
+        for (flow = p->flows; flow; flow = flow->next)
+                tcf_destroy_chain(&flow->filter_list);
        /* races ? */
        while ((flow = p->flows)) {
-                tcf_destroy_chain(flow->filter_list);
-                flow->filter_list = NULL;
                if (flow->ref > 1)
                        printk(KERN_ERR "atm_destroy: %p->ref = %d\n", flow,
                               flow->ref);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 09969c1fbc08..2a3c97f7dc63 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1704,7 +1704,7 @@ static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
        BUG_TRAP(!cl->filters);
-        tcf_destroy_chain(cl->filter_list);
+        tcf_destroy_chain(&cl->filter_list);
        qdisc_destroy(cl->q);
        qdisc_put_rtab(cl->R_tab);
        gen_kill_estimator(&cl->bstats, &cl->rate_est);
@@ -1728,10 +1728,8 @@ cbq_destroy(struct Qdisc* sch)
         * be bound to classes which have been destroyed already. --TGR '04
         */
        for (h = 0; h < 16; h++) {
-                for (cl = q->classes[h]; cl; cl = cl->next) {
+                for (cl = q->classes[h]; cl; cl = cl->next)
-                        tcf_destroy_chain(cl->filter_list);
+                        tcf_destroy_chain(&cl->filter_list);
-                        cl->filter_list = NULL;
-                }
        }
        for (h = 0; h < 16; h++) {
                struct cbq_class *next;
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 64465bacbe79..c4c1317cd47d 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -416,7 +416,7 @@ static void dsmark_destroy(struct Qdisc *sch)
        pr_debug("dsmark_destroy(sch %p,[qdisc %p])\n", sch, p);
-        tcf_destroy_chain(p->filter_list);
+        tcf_destroy_chain(&p->filter_list);
        qdisc_destroy(p->q);
        kfree(p->mask);
 }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index d355e5e47fe3..13afa7214392 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -468,7 +468,7 @@ struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops)
        return sch;
 errout:
-        return ERR_PTR(-err);
+        return ERR_PTR(err);
 }
 struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops,
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index fdfaa3fcc16d..e817aa00441d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1123,7 +1123,7 @@ hfsc_destroy_class(struct Qdisc *sch, struct hfsc_class *cl)
 {
        struct hfsc_sched *q = qdisc_priv(sch);
-        tcf_destroy_chain(cl->filter_list);
+        tcf_destroy_chain(&cl->filter_list);
        qdisc_destroy(cl->qdisc);
        gen_kill_estimator(&cl->bstats, &cl->rate_est);
        if (cl != &q->root)
@@ -1541,6 +1541,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
        unsigned int i;
        for (i = 0; i < HFSC_HSIZE; i++) {
+                list_for_each_entry(cl, &q->clhash[i], hlist)
+                        tcf_destroy_chain(&cl->filter_list);
+        }
+        for (i = 0; i < HFSC_HSIZE; i++) {
                list_for_each_entry_safe(cl, next, &q->clhash[i], hlist)
                        hfsc_destroy_class(sch, cl);
        }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 6807c97985a5..3fb58f428f72 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1238,7 +1238,7 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
        qdisc_put_rtab(cl->rate);
        qdisc_put_rtab(cl->ceil);
-        tcf_destroy_chain(cl->filter_list);
+        tcf_destroy_chain(&cl->filter_list);
        while (!list_empty(&cl->children))
                htb_destroy_class(sch, list_entry(cl->children.next,
@@ -1267,7 +1267,7 @@ static void htb_destroy(struct Qdisc *sch)
           and surprisingly it worked in 2.4. But it must precede it
           because filter need its target class alive to be able to call
           unbind_filter on it (without Oops). */
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
        while (!list_empty(&q->root))
                htb_destroy_class(sch, list_entry(q->root.next,
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 274b1ddb160c..956c80ad5965 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -104,7 +104,7 @@ static void ingress_destroy(struct Qdisc *sch)
 {
        struct ingress_qdisc_data *p = qdisc_priv(sch);
-        tcf_destroy_chain(p->filter_list);
+        tcf_destroy_chain(&p->filter_list);
 }
 static int ingress_dump(struct Qdisc *sch, struct sk_buff *skb)
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 4aa2b45dad0a..5532f1031ab5 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -219,7 +219,7 @@ prio_destroy(struct Qdisc* sch)
        int prio;
        struct prio_sched_data *q = qdisc_priv(sch);
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
        for (prio=0; prio<q->bands; prio++)
                qdisc_destroy(q->queues[prio]);
 }
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f0463d757a98..6a97afbfb952 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -520,7 +520,7 @@ static void sfq_destroy(struct Qdisc *sch)
 {
        struct sfq_sched_data *q = qdisc_priv(sch);
-        tcf_destroy_chain(q->filter_list);
+        tcf_destroy_chain(&q->filter_list);
        q->perturb_period = 0;
        del_timer_sync(&q->perturb_timer);
 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 657835f227d3..783317dacd30 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -487,8 +487,8 @@ static int unix_socketpair(struct socket *, struct socket *);
 static int unix_accept(struct socket *, struct socket *, int);
 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
-static unsigned int unix_datagram_poll(struct file *, struct socket *,
+static unsigned int unix_dgram_poll(struct file *, struct socket *,
-                                       poll_table *);
+                                    poll_table *);
 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
 static int unix_shutdown(struct socket *, int);
 static int unix_stream_sendmsg(struct kiocb *, struct socket *,
@@ -534,7 +534,7 @@ static const struct proto_ops unix_dgram_ops = {
        .socketpair =   unix_socketpair,
        .accept =       sock_no_accept,
        .getname =      unix_getname,
-        .poll =         unix_datagram_poll,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     unix_shutdown,
@@ -555,7 +555,7 @@ static const struct proto_ops unix_seqpacket_ops = {
        .socketpair =   unix_socketpair,
        .accept =       unix_accept,
        .getname =      unix_getname,
-        .poll =         unix_datagram_poll,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       unix_listen,
        .shutdown =     unix_shutdown,
@@ -1994,29 +1994,13 @@ static unsigned int unix_poll(struct file * file, struct socket *sock, poll_tabl
        return mask;
 }
-static unsigned int unix_datagram_poll(struct file *file, struct socket *sock,
+static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
-                                       poll_table *wait)
+                                    poll_table *wait)
 {
-        struct sock *sk = sock->sk, *peer;
+        struct sock *sk = sock->sk, *other;
-        unsigned int mask;
+        unsigned int mask, writable;
        poll_wait(file, sk->sk_sleep, wait);
-        peer = unix_peer_get(sk);
-        if (peer) {
-                if (peer != sk) {
-                        /*
-                         * Writability of a connected socket additionally
-                         * depends on the state of the receive queue of the
-                         * peer.
-                         */
-                        poll_wait(file, &unix_sk(peer)->peer_wait, wait);
-                } else {
-                        sock_put(peer);
-                        peer = NULL;
-                }
-        }
        mask = 0;
        /* exceptional events? */
@@ -2042,14 +2026,26 @@ static unsigned int unix_datagram_poll(struct file *file, struct socket *sock,
        }
        /* writable? */
-        if (unix_writable(sk) && !(peer && unix_recvq_full(peer)))
+        writable = unix_writable(sk);
+        if (writable) {
+                other = unix_peer_get(sk);
+                if (other) {
+                        if (unix_peer(other) != sk) {
+                                poll_wait(file, &unix_sk(other)->peer_wait,
+                                          wait);
+                                if (unix_recvq_full(other))
+                                        writable = 0;
+                        }
+                        sock_put(other);
+                }
+        }
+        if (writable)
                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
        else
                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
-        if (peer)
-                sock_put(peer);
        return mask;
 }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 185488da2466..855bff4b3250 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -80,6 +80,23 @@ static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
                                     IEEE80211_CHAN_RADAR),
 };
+static const struct ieee80211_channel_range ieee80211_EU_channels[] = {
+        /* IEEE 802.11b/g, channels 1..13 */
+        RANGE_PWR(2412, 2472, 20, 6, 0),
+        /* IEEE 802.11a, channel 36*/
+        RANGE_PWR(5180, 5180, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channel 40*/
+        RANGE_PWR(5200, 5200, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channel 44*/
+        RANGE_PWR(5220, 5220, 23, 6, IEEE80211_CHAN_PASSIVE_SCAN),
+        /* IEEE 802.11a, channels 48..64 */
+        RANGE_PWR(5240, 5320, 23, 6, IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_RADAR),
+        /* IEEE 802.11a, channels 100..140 */
+        RANGE_PWR(5500, 5700, 30, 6, IEEE80211_CHAN_NO_IBSS |
+                                     IEEE80211_CHAN_RADAR),
+};
 #define REGDOM(_code)                                                   \
        {                                                               \
                .code = __stringify(_code),                             \
@@ -90,6 +107,7 @@ static const struct ieee80211_channel_range ieee80211_JP_channels[] = {
 static const struct ieee80211_regdomain ieee80211_regdoms[] = {
        REGDOM(US),
        REGDOM(JP),
+        REGDOM(EU),
 };
diff --git a/sound/isa/sb/sb_mixer.c b/sound/isa/sb/sb_mixer.c
index 91d14224f6b3..73d4572d136b 100644
--- a/sound/isa/sb/sb_mixer.c
+++ b/sound/isa/sb/sb_mixer.c
@@ -925,7 +925,7 @@ static unsigned char als4000_saved_regs[] = {
 static void save_mixer(struct snd_sb *chip, unsigned char *regs, int num_regs)
 {
        unsigned char *val = chip->saved_regs;
-        snd_assert(num_regs > ARRAY_SIZE(chip->saved_regs), return);
+        snd_assert(num_regs <= ARRAY_SIZE(chip->saved_regs), return);
        for (; num_regs; num_regs--)
                *val++ = snd_sbmixer_read(chip, *regs++);
 }
@@ -933,7 +933,7 @@ static void save_mixer(struct snd_sb *chip, unsigned char *regs, int num_regs)
 static void restore_mixer(struct snd_sb *chip, unsigned char *regs, int num_regs)
 {
        unsigned char *val = chip->saved_regs;
-        snd_assert(num_regs > ARRAY_SIZE(chip->saved_regs), return);
+        snd_assert(num_regs <= ARRAY_SIZE(chip->saved_regs), return);
        for (; num_regs; num_regs--)
                snd_sbmixer_write(chip, *regs++, *val++);
 }
diff --git a/sound/pci/aw2/aw2-alsa.c b/sound/pci/aw2/aw2-alsa.c
index 56f87cd33c19..3f00ddf450f8 100644
--- a/sound/pci/aw2/aw2-alsa.c
+++ b/sound/pci/aw2/aw2-alsa.c
@@ -316,6 +316,8 @@ static int __devinit snd_aw2_create(struct snd_card *card,
                return -ENOMEM;
        }
+        /* (2) initialization of the chip hardware */
+        snd_aw2_saa7146_setup(&chip->saa7146, chip->iobase_virt);
        if (request_irq(pci->irq, snd_aw2_saa7146_interrupt,
                        IRQF_SHARED, "Audiowerk2", chip)) {
@@ -329,8 +331,6 @@ static int __devinit snd_aw2_create(struct snd_card *card,
        }
        chip->irq = pci->irq;
-        /* (2) initialization of the chip hardware */
-        snd_aw2_saa7146_setup(&chip->saa7146, chip->iobase_virt);
        err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
        if (err < 0) {
                free_irq(chip->irq, (void *)chip);
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 98778cb69c6e..1dcf9f3d1107 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -269,28 +269,9 @@ void kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
        }
 }
-static int get_eoi_gsi(struct kvm_ioapic *ioapic, int vector)
+static void __kvm_ioapic_update_eoi(struct kvm_ioapic *ioapic, int gsi)
 {
-        int i;
-        for (i = 0; i < IOAPIC_NUM_PINS; i++)
-                if (ioapic->redirtbl[i].fields.vector == vector)
-                        return i;
-        return -1;
-}
-void kvm_ioapic_update_eoi(struct kvm *kvm, int vector)
-{
-        struct kvm_ioapic *ioapic = kvm->arch.vioapic;
        union ioapic_redir_entry *ent;
-        int gsi;
-        gsi = get_eoi_gsi(ioapic, vector);
-        if (gsi == -1) {
-                printk(KERN_WARNING "Can't find redir item for %d EOI\n",
-                       vector);
-                return;
-        }
        ent = &ioapic->redirtbl[gsi];
        ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
@@ -300,6 +281,16 @@ void kvm_ioapic_update_eoi(struct kvm *kvm, int vector)
                ioapic_deliver(ioapic, gsi);
 }
+void kvm_ioapic_update_eoi(struct kvm *kvm, int vector)
+{
+        struct kvm_ioapic *ioapic = kvm->arch.vioapic;
+        int i;
+        for (i = 0; i < IOAPIC_NUM_PINS; i++)
+                if (ioapic->redirtbl[i].fields.vector == vector)
+                        __kvm_ioapic_update_eoi(ioapic, i);
+}
 static int ioapic_in_range(struct kvm_io_device *this, gpa_t addr)
 {
        struct kvm_ioapic *ioapic = (struct kvm_ioapic *)this->private;