379 files changed, 4286 insertions, 2498 deletions

diff --git a/Documentation/cpu-freq/user-guide.txt b/Documentation/cpu-freq/user-guide.txt
index 7fedc00c3d30..555c8cf3650a 100644
--- a/Documentation/cpu-freq/user-guide.txt
+++ b/Documentation/cpu-freq/user-guide.txt
@@ -153,10 +153,13 @@ scaling_governor,		and by "echoing" the name of another
                                 that some governors won't load - they only
                                 work on some specific architectures or
                                 processors.
-scaling_min_freq and 
+scaling_min_freq and
 scaling_max_freq                show the current "policy limits" (in
                                 kHz). By echoing new values into these
                                 files, you can change these limits.
+                                NOTE: when setting a policy you need to
+                                first set scaling_max_freq, then
+                                scaling_min_freq.
 
 
 If you have selected the "userspace" governor which allows you to
diff --git a/Documentation/fb/imacfb.txt b/Documentation/fb/imacfb.txt
new file mode 100644
index 000000000000..759028545a7e
--- /dev/null
+++ b/Documentation/fb/imacfb.txt
@@ -0,0 +1,31 @@
+
+What is imacfb?
+===============
+
+This is a generic EFI platform driver for Intel based Apple computers.
+Imacfb is only for EFI booted Intel Macs.
+
+Supported Hardware
+==================
+
+iMac 17"/20"
+Macbook
+Macbook Pro 15"/17"
+MacMini
+
+How to use it?
+==============
+
+Imacfb does not have any kind of autodetection of your machine.
+You have to add the fillowing kernel parameters in your elilo.conf:
+        Macbook :
+                video=imacfb:macbook
+        MacMini :
+                video=imacfb:mini
+        Macbook Pro 15", iMac 17" :
+                video=imacfb:i17
+        Macbook Pro 17", iMac 20" :
+                video=imacfb:i20
+
+--
+Edgar Hucek <gimli@dark-green.com>
diff --git a/Documentation/infiniband/ipoib.txt b/Documentation/infiniband/ipoib.txt
index 187035560d7f..864ff3283780 100644
--- a/Documentation/infiniband/ipoib.txt
+++ b/Documentation/infiniband/ipoib.txt
@@ -51,8 +51,6 @@ Debugging Information
 
 References
 
-  IETF IP over InfiniBand (ipoib) Working Group
-    http://ietf.org/html.charters/ipoib-charter.html
   Transmission of IP over InfiniBand (IPoIB) (RFC 4391)
     http://ietf.org/rfc/rfc4391.txt 
   IP over InfiniBand (IPoIB) Architecture (RFC 4392)
diff --git a/Documentation/kobject.txt b/Documentation/kobject.txt
index 8d9bffbd192c..949f7b5a2053 100644
--- a/Documentation/kobject.txt
+++ b/Documentation/kobject.txt
@@ -247,7 +247,7 @@ the object-specific fields, which include:
 - default_attrs: Default attributes to be exported via sysfs when the
   object is registered.Note that the last attribute has to be
   initialized to NULL ! You can find a complete implementation
-  in drivers/block/genhd.c
+  in block/genhd.c
 
 
 Instances of struct kobj_type are not registered; only referenced by
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index b0c7ab93dcb9..7345c338080a 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -211,9 +211,8 @@ Controls the kernel's behaviour when an oops or BUG is encountered.
 
 0: try to continue operation
 
-1: delay a few seconds (to give klogd time to record the oops output) and
-   then panic.  If the `panic' sysctl is also non-zero then the machine will
-   be rebooted.
+1: panic immediatly.  If the `panic' sysctl is also non-zero then the
+   machine will be rebooted.
 
 ==============================================================
 
diff --git a/Documentation/usb/proc_usb_info.txt b/Documentation/usb/proc_usb_info.txt
index f86550fe38ee..22c5331260ca 100644
--- a/Documentation/usb/proc_usb_info.txt
+++ b/Documentation/usb/proc_usb_info.txt
@@ -59,7 +59,7 @@ bind to an interface (or perhaps several) using an ioctl call.  You
 would issue more ioctls to the device to communicate to it using
 control, bulk, or other kinds of USB transfers.  The IOCTLs are
 listed in the <linux/usbdevice_fs.h> file, and at this writing the
-source code (linux/drivers/usb/devio.c) is the primary reference
+source code (linux/drivers/usb/core/devio.c) is the primary reference
 for how to access devices through those files.
 
 Note that since by default these BBB/DDD files are writable only by
diff --git a/Documentation/usb/usb-help.txt b/Documentation/usb/usb-help.txt
index b7c324973695..a7408593829f 100644
--- a/Documentation/usb/usb-help.txt
+++ b/Documentation/usb/usb-help.txt
@@ -5,8 +5,7 @@ For USB help other than the readme files that are located in
 Documentation/usb/*, see the following:
 
 Linux-USB project:  http://www.linux-usb.org
-  mirrors at        http://www.suse.cz/development/linux-usb/
-         and        http://usb.in.tum.de/linux-usb/
+  mirrors at        http://usb.in.tum.de/linux-usb/
          and        http://it.linux-usb.org
 Linux USB Guide:    http://linux-usb.sourceforge.net
 Linux-USB device overview (working devices and drivers):
diff --git a/MAINTAINERS b/MAINTAINERS
index 32aa30d1504a..21116cc3b4a5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -214,6 +214,12 @@ W:	http://acpi.sourceforge.net/
 T:      git kernel.org:/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6.git
 S:      Maintained
 
+ACPI PCI HOTPLUG DRIVER
+P:      Kristen Carlson Accardi
+M:      kristen.c.accardi@intel.com
+L:      pcihpd-discuss@lists.sourceforge.net
+S:      Maintained
+
 AD1816 SOUND DRIVER
 P:      Thorsten Knabe
 M:      Thorsten Knabe <linux@thorsten-knabe.de>
@@ -292,6 +298,13 @@ L:	info-linux@geode.amd.com
 W:      http://www.amd.com/us-en/ConnectivitySolutions/TechnicalResources/0,,50_2334_2452_11363,00.html
 S:      Supported
 
+AOA (Apple Onboard Audio) ALSA DRIVER
+P:      Johannes Berg
+M:      johannes@sipsolutions.net
+L:      linuxppc-dev@ozlabs.org
+L:      alsa-devel@alsa-project.org
+S:      Maintained
+
 APM DRIVER
 P:      Stephen Rothwell
 M:      sfr@canb.auug.org.au
@@ -2635,6 +2648,22 @@ M:	dbrownell@users.sourceforge.net
 L:      spi-devel-general@lists.sourceforge.net
 S:      Maintained
 
+STABLE BRANCH:
+P:      Greg Kroah-Hartman
+M:      greg@kroah.com
+P:      Chris Wright
+M:      chrisw@sous-sol.org
+L:      stable@kernel.org
+S:      Maintained
+
+STABLE BRANCH:
+P:      Greg Kroah-Hartman
+M:      greg@kroah.com
+P:      Chris Wright
+M:      chrisw@sous-sol.org
+L:      stable@kernel.org
+S:      Maintained
+
 TPM DEVICE DRIVER
 P:      Kylene Hall
 M:      kjhall@us.ibm.com
diff --git a/Makefile b/Makefile
index 1589085e000a..8406d02c6385 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 18
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME=Crazed Snow-Weasel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/common/gic.c b/arch/arm/common/gic.c
index f3c1ebfdd0aa..f3e020f2227f 100644
--- a/arch/arm/common/gic.c
+++ b/arch/arm/common/gic.c
@@ -95,7 +95,8 @@ static void gic_set_cpu(unsigned int irq, cpumask_t mask_val)
 }
 #endif
 
-static struct irqchip gic_chip = {
+static struct irq_chip gic_chip = {
+        .name           = "GIC",
         .ack            = gic_ack_irq,
         .mask           = gic_mask_irq,
         .unmask         = gic_unmask_irq,
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 04de83f4f008..4e0dcaef6eb2 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -204,7 +204,8 @@ static void locomo_unmask_irq(unsigned int irq)
         locomo_writel(r, mapbase + LOCOMO_ICR);
 }
 
-static struct irqchip locomo_chip = {
+static struct irq_chip locomo_chip = {
+        .name   = "LOCOMO",
         .ack    = locomo_ack_irq,
         .mask   = locomo_mask_irq,
         .unmask = locomo_unmask_irq,
@@ -249,7 +250,8 @@ static void locomo_key_unmask_irq(unsigned int irq)
         locomo_writel(r, mapbase + LOCOMO_KEYBOARD + LOCOMO_KIC);
 }
 
-static struct irqchip locomo_key_chip = {
+static struct irq_chip locomo_key_chip = {
+        .name   = "LOCOMO-key",
         .ack    = locomo_key_ack_irq,
         .mask   = locomo_key_mask_irq,
         .unmask = locomo_key_unmask_irq,
@@ -312,7 +314,8 @@ static void locomo_gpio_unmask_irq(unsigned int irq)
         locomo_writel(r, mapbase + LOCOMO_GIE);
 }
 
-static struct irqchip locomo_gpio_chip = {
+static struct irq_chip locomo_gpio_chip = {
+        .name   = "LOCOMO-gpio",
         .ack    = locomo_gpio_ack_irq,
         .mask   = locomo_gpio_mask_irq,
         .unmask = locomo_gpio_unmask_irq,
@@ -357,7 +360,8 @@ static void locomo_lt_unmask_irq(unsigned int irq)
         locomo_writel(r, mapbase + LOCOMO_LTINT);
 }
 
-static struct irqchip locomo_lt_chip = {
+static struct irq_chip locomo_lt_chip = {
+        .name   = "LOCOMO-lt",
         .ack    = locomo_lt_ack_irq,
         .mask   = locomo_lt_mask_irq,
         .unmask = locomo_lt_unmask_irq,
@@ -418,7 +422,8 @@ static void locomo_spi_unmask_irq(unsigned int irq)
         locomo_writel(r, mapbase + LOCOMO_SPIIE);
 }
 
-static struct irqchip locomo_spi_chip = {
+static struct irq_chip locomo_spi_chip = {
+        .name   = "LOCOMO-spi",
         .ack    = locomo_spi_ack_irq,
         .mask   = locomo_spi_mask_irq,
         .unmask = locomo_spi_unmask_irq,
diff --git a/arch/arm/common/rtctime.c b/arch/arm/common/rtctime.c
index 35c9a64ac14c..4e5445cfb0ea 100644
--- a/arch/arm/common/rtctime.c
+++ b/arch/arm/common/rtctime.c
@@ -68,6 +68,7 @@ void rtc_next_alarm_time(struct rtc_time *next, struct rtc_time *now, struct rtc
                 rtc_time_to_tm(next_time, next);
         }
 }
+EXPORT_SYMBOL(rtc_next_alarm_time);
 
 static inline int rtc_arm_read_time(struct rtc_ops *ops, struct rtc_time *tm)
 {
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index 1cdb26a47e1f..a331c12cead9 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -272,7 +272,8 @@ static int sa1111_wake_lowirq(unsigned int irq, unsigned int on)
         return 0;
 }
 
-static struct irqchip sa1111_low_chip = {
+static struct irq_chip sa1111_low_chip = {
+        .name           = "SA1111-l",
         .ack            = sa1111_ack_irq,
         .mask           = sa1111_mask_lowirq,
         .unmask         = sa1111_unmask_lowirq,
@@ -368,7 +369,8 @@ static int sa1111_wake_highirq(unsigned int irq, unsigned int on)
         return 0;
 }
 
-static struct irqchip sa1111_high_chip = {
+static struct irq_chip sa1111_high_chip = {
+        .name           = "SA1111-h",
         .ack            = sa1111_ack_irq,
         .mask           = sa1111_mask_highirq,
         .unmask         = sa1111_unmask_highirq,
diff --git a/arch/arm/common/vic.c b/arch/arm/common/vic.c
index a19bc4a6196d..43d278134521 100644
--- a/arch/arm/common/vic.c
+++ b/arch/arm/common/vic.c
@@ -39,7 +39,8 @@ static void vic_unmask_irq(unsigned int irq)
         writel(1 << irq, base + VIC_INT_ENABLE);
 }
 
-static struct irqchip vic_chip = {
+static struct irq_chip vic_chip = {
+        .name   = "VIC",
         .ack    = vic_mask_irq,
         .mask   = vic_mask_irq,
         .unmask = vic_unmask_irq,
diff --git a/arch/arm/kernel/ecard.c b/arch/arm/kernel/ecard.c
index b9a74a741d00..eca248d9eba4 100644
--- a/arch/arm/kernel/ecard.c
+++ b/arch/arm/kernel/ecard.c
@@ -470,7 +470,8 @@ static void ecard_irq_mask(unsigned int irqnr)
         }
 }
 
-static struct irqchip ecard_chip = {
+static struct irq_chip ecard_chip = {
+        .name   = "ECARD",
         .ack    = ecard_irq_mask,
         .mask   = ecard_irq_mask,
         .unmask = ecard_irq_unmask,
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 626feeec0ade..2e1bf830fe11 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -77,6 +77,7 @@ int show_interrupts(struct seq_file *p, void *v)
                 seq_printf(p, "%3d: ", i);
                 for_each_present_cpu(cpu)
                         seq_printf(p, "%10u ", kstat_cpu(cpu).irqs[i]);
+                seq_printf(p, " %10s", irq_desc[i].chip->name ? : "-");
                 seq_printf(p, "  %s", action->name);
                 for (action = action->next; action; action = action->next)
                         seq_printf(p, ", %s", action->name);
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 4e29dd03e582..aeeed806f991 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -233,7 +233,7 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
         spin_unlock_irq(&die_lock);
 
         if (panic_on_oops)
-                panic("Fatal exception: panic_on_oops");
+                panic("Fatal exception");
 
         do_exit(SIGSEGV);
 }
diff --git a/arch/arm/mach-at91rm9200/gpio.c b/arch/arm/mach-at91rm9200/gpio.c
index 5783c282ae7b..cec199fd6721 100644
--- a/arch/arm/mach-at91rm9200/gpio.c
+++ b/arch/arm/mach-at91rm9200/gpio.c
@@ -327,7 +327,8 @@ static int gpio_irq_type(unsigned pin, unsigned type)
         return (type == IRQT_BOTHEDGE) ? 0 : -EINVAL;
 }
 
-static struct irqchip gpio_irqchip = {
+static struct irq_chip gpio_irqchip = {
+        .name           = "GPIO",
         .mask           = gpio_irq_mask,
         .unmask         = gpio_irq_unmask,
         .set_type       = gpio_irq_type,
diff --git a/arch/arm/mach-at91rm9200/irq.c b/arch/arm/mach-at91rm9200/irq.c
index 9b0911320417..c3a5e777f9f8 100644
--- a/arch/arm/mach-at91rm9200/irq.c
+++ b/arch/arm/mach-at91rm9200/irq.c
@@ -114,7 +114,8 @@ void at91_irq_resume(void)
 #define at91_aic_set_wake       NULL
 #endif
 
-static struct irqchip at91_aic_chip = {
+static struct irq_chip at91_aic_chip = {
+        .name           = "AIC",
         .ack            = at91_aic_mask_irq,
         .mask           = at91_aic_mask_irq,
         .unmask         = at91_aic_unmask_irq,
diff --git a/arch/arm/mach-imx/irq.c b/arch/arm/mach-imx/irq.c
index a5de5f1da9f2..2688bd82c2a2 100644
--- a/arch/arm/mach-imx/irq.c
+++ b/arch/arm/mach-imx/irq.c
@@ -204,13 +204,15 @@ imx_gpiod_demux_handler(unsigned int irq_unused, struct irqdesc *desc,
         imx_gpio_handler(mask, irq, desc, regs);
 }
 
-static struct irqchip imx_internal_chip = {
+static struct irq_chip imx_internal_chip = {
+        .name = "MPU",
         .ack = imx_mask_irq,
         .mask = imx_mask_irq,
         .unmask = imx_unmask_irq,
 };
 
-static struct irqchip imx_gpio_chip = {
+static struct irq_chip imx_gpio_chip = {
+        .name = "GPIO",
         .ack = imx_gpio_ack_irq,
         .mask = imx_gpio_mask_irq,
         .unmask = imx_gpio_unmask_irq,
diff --git a/arch/arm/mach-integrator/integrator_ap.c b/arch/arm/mach-integrator/integrator_ap.c
index 6d65c96ebfd2..191c57a3b997 100644
--- a/arch/arm/mach-integrator/integrator_ap.c
+++ b/arch/arm/mach-integrator/integrator_ap.c
@@ -161,7 +161,8 @@ static void sc_unmask_irq(unsigned int irq)
         writel(1 << irq, VA_IC_BASE + IRQ_ENABLE_SET);
 }
 
-static struct irqchip sc_chip = {
+static struct irq_chip sc_chip = {
+        .name   = "SC",
         .ack    = sc_mask_irq,
         .mask   = sc_mask_irq,
         .unmask = sc_unmask_irq,
diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
index 9f55f5ae1044..678b6ba2b463 100644
--- a/arch/arm/mach-integrator/integrator_cp.c
+++ b/arch/arm/mach-integrator/integrator_cp.c
@@ -156,7 +156,8 @@ static void cic_unmask_irq(unsigned int irq)
         cic_writel(1 << irq, INTCP_VA_CIC_BASE + IRQ_ENABLE_SET);
 }
 
-static struct irqchip cic_chip = {
+static struct irq_chip cic_chip = {
+        .name   = "CIC",
         .ack    = cic_mask_irq,
         .mask   = cic_mask_irq,
         .unmask = cic_unmask_irq,
@@ -174,7 +175,8 @@ static void pic_unmask_irq(unsigned int irq)
         pic_writel(1 << irq, INTCP_VA_PIC_BASE + IRQ_ENABLE_SET);
 }
 
-static struct irqchip pic_chip = {
+static struct irq_chip pic_chip = {
+        .name   = "PIC",
         .ack    = pic_mask_irq,
         .mask   = pic_mask_irq,
         .unmask = pic_unmask_irq,
@@ -192,7 +194,8 @@ static void sic_unmask_irq(unsigned int irq)
         sic_writel(1 << irq, INTCP_VA_SIC_BASE + IRQ_ENABLE_SET);
 }
 
-static struct irqchip sic_chip = {
+static struct irq_chip sic_chip = {
+        .name   = "SIC",
         .ack    = sic_mask_irq,
         .mask   = sic_mask_irq,
         .unmask = sic_unmask_irq,
diff --git a/arch/arm/mach-iop3xx/iop321-irq.c b/arch/arm/mach-iop3xx/iop321-irq.c
index d42aae6aef03..88ac333472c8 100644
--- a/arch/arm/mach-iop3xx/iop321-irq.c
+++ b/arch/arm/mach-iop3xx/iop321-irq.c
@@ -52,7 +52,8 @@ iop321_irq_unmask (unsigned int irq)
         intctl_write(iop321_mask);
 }
 
-struct irqchip ext_chip = {
+struct irq_chip ext_chip = {
+        .name   = "IOP",
         .ack    = iop321_irq_mask,
         .mask   = iop321_irq_mask,
         .unmask = iop321_irq_unmask,
diff --git a/arch/arm/mach-iop3xx/iop331-irq.c b/arch/arm/mach-iop3xx/iop331-irq.c
index f4d4321737a4..cab11722ced2 100644
--- a/arch/arm/mach-iop3xx/iop331-irq.c
+++ b/arch/arm/mach-iop3xx/iop331-irq.c
@@ -77,13 +77,15 @@ iop331_irq_unmask2(unsigned int irq)
         intctl_write1(iop331_mask1);
 }
 
-struct irqchip iop331_irqchip1 = {
+struct irq_chip iop331_irqchip1 = {
+        .name   = "IOP-1",
         .ack    = iop331_irq_mask1,
         .mask   = iop331_irq_mask1,
         .unmask = iop331_irq_unmask1,
 };
 
-struct irqchip iop331_irqchip2 = {
+struct irq_chip iop331_irqchip2 = {
+        .name   = "IOP-2",
         .ack    = iop331_irq_mask2,
         .mask   = iop331_irq_mask2,
         .unmask = iop331_irq_unmask2,
diff --git a/arch/arm/mach-ixp4xx/common-pci.c b/arch/arm/mach-ixp4xx/common-pci.c
index 2d40fe1145f0..9562177b5fe1 100644
--- a/arch/arm/mach-ixp4xx/common-pci.c
+++ b/arch/arm/mach-ixp4xx/common-pci.c
@@ -532,8 +532,6 @@ pci_set_consistent_dma_mask(struct pci_dev *dev, u64 mask)
         return -EIO;
 }
 
-EXPORT_SYMBOL(pci_set_dma_mask);
-EXPORT_SYMBOL(pci_set_consistent_dma_mask);
 EXPORT_SYMBOL(ixp4xx_pci_read);
 EXPORT_SYMBOL(ixp4xx_pci_write);
 
diff --git a/arch/arm/mach-ixp4xx/gtwx5715-setup.c b/arch/arm/mach-ixp4xx/gtwx5715-setup.c
index 654e2eed81fb..30f1300e0e21 100644
--- a/arch/arm/mach-ixp4xx/gtwx5715-setup.c
+++ b/arch/arm/mach-ixp4xx/gtwx5715-setup.c
@@ -107,9 +107,9 @@ static struct flash_platform_data gtwx5715_flash_data = {
         .width          = 2,
 };
 
-static struct gtw5715_flash_resource = {
+static struct resource gtwx5715_flash_resource = {
         .flags          = IORESOURCE_MEM,
-}
+};
 
 static struct platform_device gtwx5715_flash = {
         .name           = "IXP4XX-Flash",
@@ -130,9 +130,6 @@ static void __init gtwx5715_init(void)
 {
         ixp4xx_sys_init();
 
-        if (!flash_resource)
-                printk(KERN_ERR "Could not allocate flash resource\n");
-
         gtwx5715_flash_resource.start = IXP4XX_EXP_BUS_BASE(0);
         gtwx5715_flash_resource.end = IXP4XX_EXP_BUS_BASE(0) + SZ_8M - 1;
 
diff --git a/arch/arm/mach-lh7a40x/arch-kev7a400.c b/arch/arm/mach-lh7a40x/arch-kev7a400.c
index 2cccc27c62e4..4f2ab48800a5 100644
--- a/arch/arm/mach-lh7a40x/arch-kev7a400.c
+++ b/arch/arm/mach-lh7a40x/arch-kev7a400.c
@@ -63,7 +63,8 @@ static void kev7a400_unmask_cpld_irq (u32 irq)
         CPLD_WR_PB_INT_MASK = CPLD_IRQ_mask;
 }
 
-static struct irqchip kev7a400_cpld_chip = {
+static struct irq_chip kev7a400_cpld_chip = {
+        .name   = "CPLD",
         .ack    = kev7a400_ack_cpld_irq,
         .mask   = kev7a400_mask_cpld_irq,
         .unmask = kev7a400_unmask_cpld_irq,
diff --git a/arch/arm/mach-lh7a40x/arch-lpd7a40x.c b/arch/arm/mach-lh7a40x/arch-lpd7a40x.c
index 35c3606a2079..a6910114b24c 100644
--- a/arch/arm/mach-lh7a40x/arch-lpd7a40x.c
+++ b/arch/arm/mach-lh7a40x/arch-lpd7a40x.c
@@ -200,7 +200,8 @@ static void lh7a40x_unmask_cpld_irq (u32 irq)
         }
 }
 
-static struct irqchip lpd7a40x_cpld_chip = {
+static struct irq_chip lpd7a40x_cpld_chip = {
+        .name   = "CPLD",
         .ack    = lh7a40x_ack_cpld_irq,
         .mask   = lh7a40x_mask_cpld_irq,
         .unmask = lh7a40x_unmask_cpld_irq,
diff --git a/arch/arm/mach-lh7a40x/irq-kev7a400.c b/arch/arm/mach-lh7a40x/irq-kev7a400.c
index 8535764d89ca..f9b3fe9174a5 100644
--- a/arch/arm/mach-lh7a40x/irq-kev7a400.c
+++ b/arch/arm/mach-lh7a40x/irq-kev7a400.c
@@ -43,7 +43,8 @@ lh7a400_unmask_cpld_irq (u32 irq)
 }
 
 static struct
-irqchip lh7a400_cpld_chip = {
+irq_chip lh7a400_cpld_chip = {
+        .name   = "CPLD",
         .ack    = lh7a400_ack_cpld_irq,
         .mask   = lh7a400_mask_cpld_irq,
         .unmask = lh7a400_unmask_cpld_irq,
diff --git a/arch/arm/mach-lh7a40x/irq-lh7a400.c b/arch/arm/mach-lh7a40x/irq-lh7a400.c
index f9fdefef6d6f..091b2dc58d25 100644
--- a/arch/arm/mach-lh7a40x/irq-lh7a400.c
+++ b/arch/arm/mach-lh7a40x/irq-lh7a400.c
@@ -38,13 +38,15 @@ static void lh7a400_ack_gpio_irq (u32 irq)
         INTC_INTENC = (1 << irq);
 }
 
-static struct irqchip lh7a400_internal_chip = {
+static struct irq_chip lh7a400_internal_chip = {
+        .name   = "MPU",
         .ack    = lh7a400_mask_irq, /* Level triggering -> mask is ack */
         .mask   = lh7a400_mask_irq,
         .unmask = lh7a400_unmask_irq,
 };
 
-static struct irqchip lh7a400_gpio_chip = {
+static struct irq_chip lh7a400_gpio_chip = {
+        .name   = "GPIO",
         .ack    = lh7a400_ack_gpio_irq,
         .mask   = lh7a400_mask_irq,
         .unmask = lh7a400_unmask_irq,
diff --git a/arch/arm/mach-lh7a40x/irq-lh7a404.c b/arch/arm/mach-lh7a40x/irq-lh7a404.c
index 2685a81454d2..7059b983724f 100644
--- a/arch/arm/mach-lh7a40x/irq-lh7a404.c
+++ b/arch/arm/mach-lh7a40x/irq-lh7a404.c
@@ -76,25 +76,29 @@ static void lh7a404_vic2_ack_gpio_irq (u32 irq)
         VIC2_INTENCLR = (1 << irq);
 }
 
-static struct irqchip lh7a404_vic1_chip = {
+static struct irq_chip lh7a404_vic1_chip = {
+        .name   = "VIC1",
         .ack    = lh7a404_vic1_mask_irq, /* Because level-triggered */
         .mask   = lh7a404_vic1_mask_irq,
         .unmask = lh7a404_vic1_unmask_irq,
 };
 
-static struct irqchip lh7a404_vic2_chip = {
+static struct irq_chip lh7a404_vic2_chip = {
+        .name   = "VIC2",
         .ack    = lh7a404_vic2_mask_irq, /* Because level-triggered */
         .mask   = lh7a404_vic2_mask_irq,
         .unmask = lh7a404_vic2_unmask_irq,
 };
 
-static struct irqchip lh7a404_gpio_vic1_chip = {
+static struct irq_chip lh7a404_gpio_vic1_chip = {
+        .name   = "GPIO-VIC1",
         .ack    = lh7a404_vic1_ack_gpio_irq,
         .mask   = lh7a404_vic1_mask_irq,
         .unmask = lh7a404_vic1_unmask_irq,
 };
 
-static struct irqchip lh7a404_gpio_vic2_chip = {
+static struct irq_chip lh7a404_gpio_vic2_chip = {
+        .name   = "GPIO-VIC2",
         .ack    = lh7a404_vic2_ack_gpio_irq,
         .mask   = lh7a404_vic2_mask_irq,
         .unmask = lh7a404_vic2_unmask_irq,
diff --git a/arch/arm/mach-lh7a40x/irq-lpd7a40x.c b/arch/arm/mach-lh7a40x/irq-lpd7a40x.c
index dcb4e17b9419..d6055dde6468 100644
--- a/arch/arm/mach-lh7a40x/irq-lpd7a40x.c
+++ b/arch/arm/mach-lh7a40x/irq-lpd7a40x.c
@@ -50,7 +50,8 @@ static void lh7a40x_unmask_cpld_irq (u32 irq)
         }
 }
 
-static struct irqchip lh7a40x_cpld_chip = {
+static struct irq_chip lh7a40x_cpld_chip = {
+        .name   = "CPLD",
         .ack    = lh7a40x_ack_cpld_irq,
         .mask   = lh7a40x_mask_cpld_irq,
         .unmask = lh7a40x_unmask_cpld_irq,
diff --git a/arch/arm/mach-omap1/fpga.c b/arch/arm/mach-omap1/fpga.c
index 34eb79ee6e61..efe9bfc6e55f 100644
--- a/arch/arm/mach-omap1/fpga.c
+++ b/arch/arm/mach-omap1/fpga.c
@@ -106,14 +106,16 @@ void innovator_fpga_IRQ_demux(unsigned int irq, struct irqdesc *desc,
         }
 }
 
-static struct irqchip omap_fpga_irq_ack = {
+static struct irq_chip omap_fpga_irq_ack = {
+        .name           = "FPGA-ack",
         .ack            = fpga_mask_ack_irq,
         .mask           = fpga_mask_irq,
         .unmask         = fpga_unmask_irq,
 };
 
 
-static struct irqchip omap_fpga_irq = {
+static struct irq_chip omap_fpga_irq = {
+        .name           = "FPGA",
         .ack            = fpga_ack_irq,
         .mask           = fpga_mask_irq,
         .unmask         = fpga_unmask_irq,
diff --git a/arch/arm/mach-omap1/irq.c b/arch/arm/mach-omap1/irq.c
index 9e039845b50e..3ea140bb9eba 100644
--- a/arch/arm/mach-omap1/irq.c
+++ b/arch/arm/mach-omap1/irq.c
@@ -168,7 +168,8 @@ static struct omap_irq_bank omap1610_irq_banks[] = {
 };
 #endif
 
-static struct irqchip omap_irq_chip = {
+static struct irq_chip omap_irq_chip = {
+        .name           = "MPU",
         .ack            = omap_mask_ack_irq,
         .mask           = omap_mask_irq,
         .unmask         = omap_unmask_irq,
diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
index 3eed6a737bf8..dfc3b35cc1ff 100644
--- a/arch/arm/mach-omap2/irq.c
+++ b/arch/arm/mach-omap2/irq.c
@@ -94,7 +94,8 @@ static void omap_mask_ack_irq(unsigned int irq)
         omap_ack_irq(irq);
 }
 
-static struct irqchip omap_irq_chip = {
+static struct irq_chip omap_irq_chip = {
+        .name   = "INTC",
         .ack    = omap_mask_ack_irq,
         .mask   = omap_mask_irq,
         .unmask = omap_unmask_irq,
diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c
index d9635ff4b10c..12141e2a50cc 100644
--- a/arch/arm/mach-pxa/irq.c
+++ b/arch/arm/mach-pxa/irq.c
@@ -39,7 +39,8 @@ static void pxa_unmask_low_irq(unsigned int irq)
         ICMR |= (1 << (irq + PXA_IRQ_SKIP));
 }
 
-static struct irqchip pxa_internal_chip_low = {
+static struct irq_chip pxa_internal_chip_low = {
+        .name           = "SC",
         .ack            = pxa_mask_low_irq,
         .mask           = pxa_mask_low_irq,
         .unmask         = pxa_unmask_low_irq,
@@ -61,7 +62,8 @@ static void pxa_unmask_high_irq(unsigned int irq)
         ICMR2 |= (1 << (irq - 32 + PXA_IRQ_SKIP));
 }
 
-static struct irqchip pxa_internal_chip_high = {
+static struct irq_chip pxa_internal_chip_high = {
+        .name           = "SC-hi",
         .ack            = pxa_mask_high_irq,
         .mask           = pxa_mask_high_irq,
         .unmask         = pxa_unmask_high_irq,
@@ -129,7 +131,8 @@ static void pxa_ack_low_gpio(unsigned int irq)
         GEDR0 = (1 << (irq - IRQ_GPIO0));
 }
 
-static struct irqchip pxa_low_gpio_chip = {
+static struct irq_chip pxa_low_gpio_chip = {
+        .name           = "GPIO-l",
         .ack            = pxa_ack_low_gpio,
         .mask           = pxa_mask_low_irq,
         .unmask         = pxa_unmask_low_irq,
@@ -237,7 +240,8 @@ static void pxa_unmask_muxed_gpio(unsigned int irq)
         GFER(gpio) = GPIO_IRQ_falling_edge[idx] & GPIO_IRQ_mask[idx];
 }
 
-static struct irqchip pxa_muxed_gpio_chip = {
+static struct irq_chip pxa_muxed_gpio_chip = {
+        .name           = "GPIO",
         .ack            = pxa_ack_muxed_gpio,
         .mask           = pxa_mask_muxed_gpio,
         .unmask         = pxa_unmask_muxed_gpio,
diff --git a/arch/arm/mach-pxa/lpd270.c b/arch/arm/mach-pxa/lpd270.c
index 1a5f5c21481e..12479ae26db2 100644
--- a/arch/arm/mach-pxa/lpd270.c
+++ b/arch/arm/mach-pxa/lpd270.c
@@ -68,7 +68,8 @@ static void lpd270_unmask_irq(unsigned int irq)
         __raw_writew(lpd270_irq_enabled, LPD270_INT_MASK);
 }
 
-static struct irqchip lpd270_irq_chip = {
+static struct irq_chip lpd270_irq_chip = {
+        .name           = "CPLD",
         .ack            = lpd270_mask_irq,
         .mask           = lpd270_mask_irq,
         .unmask         = lpd270_unmask_irq,
diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
index 6a9a669d60de..83ff5cee64d9 100644
--- a/arch/arm/mach-pxa/lubbock.c
+++ b/arch/arm/mach-pxa/lubbock.c
@@ -78,7 +78,8 @@ static void lubbock_unmask_irq(unsigned int irq)
         LUB_IRQ_MASK_EN = (lubbock_irq_enabled |= (1 << lubbock_irq));
 }
 
-static struct irqchip lubbock_irq_chip = {
+static struct irq_chip lubbock_irq_chip = {
+        .name           = "FPGA",
         .ack            = lubbock_mask_irq,
         .mask           = lubbock_mask_irq,
         .unmask         = lubbock_unmask_irq,
diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c
index 21ddf3de2f6e..a7e9b96f258a 100644
--- a/arch/arm/mach-pxa/mainstone.c
+++ b/arch/arm/mach-pxa/mainstone.c
@@ -64,7 +64,8 @@ static void mainstone_unmask_irq(unsigned int irq)
         MST_INTMSKENA = (mainstone_irq_enabled |= (1 << mainstone_irq));
 }
 
-static struct irqchip mainstone_irq_chip = {
+static struct irq_chip mainstone_irq_chip = {
+        .name           = "FPGA",
         .ack            = mainstone_mask_irq,
         .mask           = mainstone_mask_irq,
         .unmask         = mainstone_unmask_irq,
diff --git a/arch/arm/mach-sa1100/irq.c b/arch/arm/mach-sa1100/irq.c
index 2891b8ca86dd..b55b90a2e8fe 100644
--- a/arch/arm/mach-sa1100/irq.c
+++ b/arch/arm/mach-sa1100/irq.c
@@ -95,7 +95,8 @@ static int sa1100_low_gpio_wake(unsigned int irq, unsigned int on)
         return 0;
 }
 
-static struct irqchip sa1100_low_gpio_chip = {
+static struct irq_chip sa1100_low_gpio_chip = {
+        .name           = "GPIO-l",
         .ack            = sa1100_low_gpio_ack,
         .mask           = sa1100_low_gpio_mask,
         .unmask         = sa1100_low_gpio_unmask,
@@ -178,7 +179,8 @@ static int sa1100_high_gpio_wake(unsigned int irq, unsigned int on)
         return 0;
 }
 
-static struct irqchip sa1100_high_gpio_chip = {
+static struct irq_chip sa1100_high_gpio_chip = {
+        .name           = "GPIO-h",
         .ack            = sa1100_high_gpio_ack,
         .mask           = sa1100_high_gpio_mask,
         .unmask         = sa1100_high_gpio_unmask,
@@ -215,7 +217,8 @@ static int sa1100_set_wake(unsigned int irq, unsigned int on)
         return -EINVAL;
 }
 
-static struct irqchip sa1100_normal_chip = {
+static struct irq_chip sa1100_normal_chip = {
+        .name           = "SC",
         .ack            = sa1100_mask_irq,
         .mask           = sa1100_mask_irq,
         .unmask         = sa1100_unmask_irq,
diff --git a/arch/arm/mach-shark/irq.c b/arch/arm/mach-shark/irq.c
index 6cb67bd3dfd3..b227052296cf 100644
--- a/arch/arm/mach-shark/irq.c
+++ b/arch/arm/mach-shark/irq.c
@@ -69,7 +69,8 @@ static irqreturn_t bogus_int(int irq, void *dev_id, struct pt_regs *regs)
 
 static struct irqaction cascade;
 
-static struct irqchip fb_chip = {
+static struct irq_chip fb_chip = {
+        .name   = "XT-PIC",
         .ack    = shark_ack_8259A_irq,
         .mask   = shark_disable_8259A_irq,
         .unmask = shark_enable_8259A_irq,
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index 864377176015..c4e3f8c68479 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -69,7 +69,8 @@ static void sic_unmask_irq(unsigned int irq)
         writel(1 << irq, VA_SIC_BASE + SIC_IRQ_ENABLE_SET);
 }
 
-static struct irqchip sic_chip = {
+static struct irq_chip sic_chip = {
+        .name   = "SIC",
         .ack    = sic_mask_irq,
         .mask   = sic_mask_irq,
         .unmask = sic_unmask_irq,
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index fec7970e564d..cd7f973fb286 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -944,7 +944,8 @@ static void mpuio_unmask_irq(unsigned int irq)
         _set_gpio_irqenable(bank, gpio, 1);
 }
 
-static struct irqchip gpio_irq_chip = {
+static struct irq_chip gpio_irq_chip = {
+        .name           = "GPIO",
         .ack            = gpio_ack_irq,
         .mask           = gpio_mask_irq,
         .unmask         = gpio_unmask_irq,
@@ -952,10 +953,11 @@ static struct irqchip gpio_irq_chip = {
         .set_wake       = gpio_wake_enable,
 };
 
-static struct irqchip mpuio_irq_chip = {
+static struct irq_chip mpuio_irq_chip = {
+        .name   = "MPUIO",
         .ack    = mpuio_ack_irq,
         .mask   = mpuio_mask_irq,
-        .unmask = mpuio_unmask_irq
+        .unmask = mpuio_unmask_irq
 };
 
 static int initialized;
diff --git a/arch/i386/kernel/cpu/cpufreq/Kconfig b/arch/i386/kernel/cpu/cpufreq/Kconfig
index e44a4c6a4fe5..ccc1edff5c97 100644
--- a/arch/i386/kernel/cpu/cpufreq/Kconfig
+++ b/arch/i386/kernel/cpu/cpufreq/Kconfig
@@ -96,6 +96,7 @@ config X86_POWERNOW_K8_ACPI
 
 config X86_GX_SUSPMOD
         tristate "Cyrix MediaGX/NatSemi Geode Suspend Modulation"
+        depends on PCI
         help
          This add the CPUFreq driver for NatSemi Geode processors which
          support suspend modulation.
@@ -202,7 +203,7 @@ config X86_LONGRUN
 config X86_LONGHAUL
         tristate "VIA Cyrix III Longhaul"
         select CPU_FREQ_TABLE
-        depends on BROKEN
+        depends on ACPI_PROCESSOR
         help
           This adds the CPUFreq driver for VIA Samuel/CyrixIII,
           VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T
diff --git a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
index 567b39bea07e..efb41e81351c 100644
--- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -384,8 +384,7 @@ static int acpi_cpufreq_early_init_acpi(void)
         }
 
         /* Do initialization in ACPI core */
-        acpi_processor_preregister_performance(acpi_perf_data);
-        return 0;
+        return acpi_processor_preregister_performance(acpi_perf_data);
 }
 
 static int
diff --git a/arch/i386/kernel/cpu/cpufreq/longhaul.c b/arch/i386/kernel/cpu/cpufreq/longhaul.c
index 146f607e9c44..4f2c3aeef724 100644
--- a/arch/i386/kernel/cpu/cpufreq/longhaul.c
+++ b/arch/i386/kernel/cpu/cpufreq/longhaul.c
@@ -29,11 +29,13 @@
 #include <linux/cpufreq.h>
 #include <linux/slab.h>
 #include <linux/string.h>
-#include <linux/pci.h>
 
 #include <asm/msr.h>
 #include <asm/timex.h>
 #include <asm/io.h>
+#include <asm/acpi.h>
+#include <linux/acpi.h>
+#include <acpi/processor.h>
 
 #include "longhaul.h"
 
@@ -56,6 +58,8 @@ static int minvid, maxvid;
 static unsigned int minmult, maxmult;
 static int can_scale_voltage;
 static int vrmrev;
+static struct acpi_processor *pr = NULL;
+static struct acpi_processor_cx *cx = NULL;
 
 /* Module parameters */
 static int dont_scale_voltage;
@@ -118,84 +122,65 @@ static int longhaul_get_cpu_mult(void)
         return eblcr_table[invalue];
 }
 
+/* For processor with BCR2 MSR */
 
-static void do_powersaver(union msr_longhaul *longhaul,
-                        unsigned int clock_ratio_index)
+static void do_longhaul1(int cx_address, unsigned int clock_ratio_index)
 {
-        struct pci_dev *dev;
-        unsigned long flags;
-        unsigned int tmp_mask;
-        int version;
-        int i;
-        u16 pci_cmd;
-        u16 cmd_state[64];
+        union msr_bcr2 bcr2;
+        u32 t;
 
-        switch (cpu_model) {
-        case CPU_EZRA_T:
-                version = 3;
-                break;
-        case CPU_NEHEMIAH:
-                version = 0xf;
-                break;
-        default:
-                return;
-        }
+        rdmsrl(MSR_VIA_BCR2, bcr2.val);
+        /* Enable software clock multiplier */
+        bcr2.bits.ESOFTBF = 1;
+        bcr2.bits.CLOCKMUL = clock_ratio_index;
 
-        rdmsrl(MSR_VIA_LONGHAUL, longhaul->val);
-        longhaul->bits.SoftBusRatio = clock_ratio_index & 0xf;
-        longhaul->bits.SoftBusRatio4 = (clock_ratio_index & 0x10) >> 4;
-        longhaul->bits.EnableSoftBusRatio = 1;
-        longhaul->bits.RevisionKey = 0;
+        /* Sync to timer tick */
+        safe_halt();
+        ACPI_FLUSH_CPU_CACHE();
+        /* Change frequency on next halt or sleep */
+        wrmsrl(MSR_VIA_BCR2, bcr2.val);
+        /* Invoke C3 */
+        inb(cx_address);
+        /* Dummy op - must do something useless after P_LVL3 read */
+        t = inl(acpi_fadt.xpm_tmr_blk.address);
+
+        /* Disable software clock multiplier */
+        local_irq_disable();
+        rdmsrl(MSR_VIA_BCR2, bcr2.val);
+        bcr2.bits.ESOFTBF = 0;
+        wrmsrl(MSR_VIA_BCR2, bcr2.val);
+}
 
-        preempt_disable();
-        local_irq_save(flags);
+/* For processor with Longhaul MSR */
 
-        /*
-         * get current pci bus master state for all devices
-         * and clear bus master bit
-         */
-        dev = NULL;
-        i = 0;
-        do {
-                dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev);
-                if (dev != NULL) {
-                        pci_read_config_word(dev, PCI_COMMAND, &pci_cmd);
-                        cmd_state[i++] = pci_cmd;
-                        pci_cmd &= ~PCI_COMMAND_MASTER;
-                        pci_write_config_word(dev, PCI_COMMAND, pci_cmd);
-                }
-        } while (dev != NULL);
+static void do_powersaver(int cx_address, unsigned int clock_ratio_index)
+{
+        union msr_longhaul longhaul;
+        u32 t;
 
-        tmp_mask=inb(0x21);     /* works on C3. save mask. */
-        outb(0xFE,0x21);        /* TMR0 only */
-        outb(0xFF,0x80);        /* delay */
+        rdmsrl(MSR_VIA_LONGHAUL, longhaul.val);
+        longhaul.bits.RevisionKey = longhaul.bits.RevisionID;
+        longhaul.bits.SoftBusRatio = clock_ratio_index & 0xf;
+        longhaul.bits.SoftBusRatio4 = (clock_ratio_index & 0x10) >> 4;
+        longhaul.bits.EnableSoftBusRatio = 1;
 
+        /* Sync to timer tick */
         safe_halt();
-        wrmsrl(MSR_VIA_LONGHAUL, longhaul->val);
-        halt();
-
+        ACPI_FLUSH_CPU_CACHE();
+        /* Change frequency on next halt or sleep */
+        wrmsrl(MSR_VIA_LONGHAUL, longhaul.val);
+        /* Invoke C3 */
+        inb(cx_address);
+        /* Dummy op - must do something useless after P_LVL3 read */
+        t = inl(acpi_fadt.xpm_tmr_blk.address);
+
+        /* Disable bus ratio bit */
         local_irq_disable();
-
-        outb(tmp_mask,0x21);    /* restore mask */
-
-        /* restore pci bus master state for all devices */
-        dev = NULL;
-        i = 0;
-        do {
-                dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev);
-                if (dev != NULL) {
-                        pci_cmd = cmd_state[i++];
-                        pci_write_config_byte(dev, PCI_COMMAND, pci_cmd);
-                }
-        } while (dev != NULL);
-        local_irq_restore(flags);
-        preempt_enable();
-
-        /* disable bus ratio bit */
-        rdmsrl(MSR_VIA_LONGHAUL, longhaul->val);
-        longhaul->bits.EnableSoftBusRatio = 0;
-        longhaul->bits.RevisionKey = version;
-        wrmsrl(MSR_VIA_LONGHAUL, longhaul->val);
+        longhaul.bits.RevisionKey = longhaul.bits.RevisionID;
+        longhaul.bits.EnableSoftBusRatio = 0;
+        longhaul.bits.EnableSoftBSEL = 0;
+        longhaul.bits.EnableSoftVID = 0;
+        wrmsrl(MSR_VIA_LONGHAUL, longhaul.val);
 }
 
 /**
@@ -209,9 +194,9 @@ static void longhaul_setstate(unsigned int clock_ratio_index)
 {
         int speed, mult;
         struct cpufreq_freqs freqs;
-        union msr_longhaul longhaul;
-        union msr_bcr2 bcr2;
         static unsigned int old_ratio=-1;
+        unsigned long flags;
+        unsigned int pic1_mask, pic2_mask;
 
         if (old_ratio == clock_ratio_index)
                 return;
@@ -234,6 +219,20 @@ static void longhaul_setstate(unsigned int clock_ratio_index)
         dprintk ("Setting to FSB:%dMHz Mult:%d.%dx (%s)\n",
                         fsb, mult/10, mult%10, print_speed(speed/1000));
 
+        preempt_disable();
+        local_irq_save(flags);
+
+        pic2_mask = inb(0xA1);
+        pic1_mask = inb(0x21);  /* works on C3. save mask. */
+        outb(0xFF,0xA1);        /* Overkill */
+        outb(0xFE,0x21);        /* TMR0 only */
+
+        /* Disable bus master arbitration */
+        if (pr->flags.bm_check) {
+                acpi_set_register(ACPI_BITREG_ARB_DISABLE, 1,
+                                  ACPI_MTX_DO_NOT_LOCK);
+        }
+
         switch (longhaul_version) {
 
         /*
@@ -245,20 +244,7 @@ static void longhaul_setstate(unsigned int clock_ratio_index)
          */
         case TYPE_LONGHAUL_V1:
         case TYPE_LONGHAUL_V2:
-                rdmsrl (MSR_VIA_BCR2, bcr2.val);
-                /* Enable software clock multiplier */
-                bcr2.bits.ESOFTBF = 1;
-                bcr2.bits.CLOCKMUL = clock_ratio_index;
-                local_irq_disable();
-                wrmsrl (MSR_VIA_BCR2, bcr2.val);
-                safe_halt();
-
-                /* Disable software clock multiplier */
-                rdmsrl (MSR_VIA_BCR2, bcr2.val);
-                bcr2.bits.ESOFTBF = 0;
-                local_irq_disable();
-                wrmsrl (MSR_VIA_BCR2, bcr2.val);
-                local_irq_enable();
+                do_longhaul1(cx->address, clock_ratio_index);
                 break;
 
         /*
@@ -273,10 +259,22 @@ static void longhaul_setstate(unsigned int clock_ratio_index)
          * to work in practice.
          */
         case TYPE_POWERSAVER:
-                do_powersaver(&longhaul, clock_ratio_index);
+                do_powersaver(cx->address, clock_ratio_index);
                 break;
         }
 
+        /* Enable bus master arbitration */
+        if (pr->flags.bm_check) {
+                acpi_set_register(ACPI_BITREG_ARB_DISABLE, 0,
+                                  ACPI_MTX_DO_NOT_LOCK);
+        }
+
+        outb(pic2_mask,0xA1);   /* restore mask */
+        outb(pic1_mask,0x21);
+
+        local_irq_restore(flags);
+        preempt_enable();
+
         cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
 }
 
@@ -324,9 +322,11 @@ static int guess_fsb(void)
 static int __init longhaul_get_ranges(void)
 {
         unsigned long invalue;
-        unsigned int multipliers[32]= {
-                50,30,40,100,55,35,45,95,90,70,80,60,120,75,85,65,
-                -1,110,120,-1,135,115,125,105,130,150,160,140,-1,155,-1,145 };
+        unsigned int ezra_t_multipliers[32]= {
+                        90,  30,  40, 100,  55,  35,  45,  95,
+                        50,  70,  80,  60, 120,  75,  85,  65,
+                        -1, 110, 120,  -1, 135, 115, 125, 105,
+                        130, 150, 160, 140,  -1, 155,  -1, 145 };
         unsigned int j, k = 0;
         union msr_longhaul longhaul;
         unsigned long lo, hi;
@@ -355,13 +355,13 @@ static int __init longhaul_get_ranges(void)
                         invalue = longhaul.bits.MaxMHzBR;
                         if (longhaul.bits.MaxMHzBR4)
                                 invalue += 16;
-                        maxmult=multipliers[invalue];
+                        maxmult=ezra_t_multipliers[invalue];
 
                         invalue = longhaul.bits.MinMHzBR;
                         if (longhaul.bits.MinMHzBR4 == 1)
                                 minmult = 30;
                         else
-                                minmult = multipliers[invalue];
+                                minmult = ezra_t_multipliers[invalue];
                         fsb = eblcr_fsb_table_v2[longhaul.bits.MaxMHzFSB];
                         break;
                 }
@@ -527,6 +527,18 @@ static unsigned int longhaul_get(unsigned int cpu)
         return calc_speed(longhaul_get_cpu_mult());
 }
 
+static acpi_status longhaul_walk_callback(acpi_handle obj_handle,
+                                          u32 nesting_level,
+                                          void *context, void **return_value)
+{
+        struct acpi_device *d;
+
+        if ( acpi_bus_get_device(obj_handle, &d) ) {
+                return 0;
+        }
+        *return_value = (void *)acpi_driver_data(d);
+        return 1;
+}
 
 static int __init longhaul_cpu_init(struct cpufreq_policy *policy)
 {
@@ -534,6 +546,15 @@ static int __init longhaul_cpu_init(struct cpufreq_policy *policy)
         char *cpuname=NULL;
         int ret;
 
+        /* Check ACPI support for C3 state */
+        acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
+                         &longhaul_walk_callback, NULL, (void *)&pr);
+        if (pr == NULL) goto err_acpi;
+
+        cx = &pr->power.states[ACPI_STATE_C3];
+        if (cx->address == 0 || cx->latency > 1000) goto err_acpi;
+
+        /* Now check what we have on this motherboard */
         switch (c->x86_model) {
         case 6:
                 cpu_model = CPU_SAMUEL;
@@ -634,6 +655,10 @@ static int __init longhaul_cpu_init(struct cpufreq_policy *policy)
         cpufreq_frequency_table_get_attr(longhaul_table, policy->cpu);
 
         return 0;
+
+err_acpi:
+        printk(KERN_ERR PFX "No ACPI support for CPU frequency changes.\n");
+        return -ENODEV;
 }
 
 static int __devexit longhaul_cpu_exit(struct cpufreq_policy *policy)
@@ -666,6 +691,18 @@ static int __init longhaul_init(void)
         if (c->x86_vendor != X86_VENDOR_CENTAUR || c->x86 != 6)
                 return -ENODEV;
 
+#ifdef CONFIG_SMP
+        if (num_online_cpus() > 1) {
+                return -ENODEV;
+                printk(KERN_ERR PFX "More than 1 CPU detected, longhaul disabled.\n");
+        }
+#endif
+#ifdef CONFIG_X86_IO_APIC
+        if (cpu_has_apic) {
+                printk(KERN_ERR PFX "APIC detected. Longhaul is currently broken in this configuration.\n");
+                return -ENODEV;
+        }
+#endif
         switch (c->x86_model) {
         case 6 ... 9:
                 return cpufreq_register_driver(&longhaul_driver);
@@ -699,6 +736,6 @@ MODULE_AUTHOR ("Dave Jones <davej@codemonkey.org.uk>");
 MODULE_DESCRIPTION ("Longhaul driver for VIA Cyrix processors.");
 MODULE_LICENSE ("GPL");
 
-module_init(longhaul_init);
+late_initcall(longhaul_init);
 module_exit(longhaul_exit);
 
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 0d4005dc06c5..82e0fd02af1c 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -454,7 +454,7 @@ void die(const char * str, struct pt_regs * regs, long err)
                 panic("Fatal exception in interrupt");
 
         if (panic_on_oops)
-                panic("Fatal exception: panic_on_oops");
+                panic("Fatal exception");
 
         oops_exit();
         do_exit(SIGSEGV);
diff --git a/arch/ia64/hp/sim/simscsi.c b/arch/ia64/hp/sim/simscsi.c
index a3fe97531134..8a4f0d0d17a3 100644
--- a/arch/ia64/hp/sim/simscsi.c
+++ b/arch/ia64/hp/sim/simscsi.c
@@ -151,7 +151,7 @@ static void
 simscsi_sg_readwrite (struct scsi_cmnd *sc, int mode, unsigned long offset)
 {
         int list_len = sc->use_sg;
-        struct scatterlist *sl = (struct scatterlist *)sc->buffer;
+        struct scatterlist *sl = (struct scatterlist *)sc->request_buffer;
         struct disk_stat stat;
         struct disk_req req;
 
@@ -244,7 +244,7 @@ static void simscsi_fillresult(struct scsi_cmnd *sc, char *buf, unsigned len)
 
         if (scatterlen == 0)
                 memcpy(sc->request_buffer, buf, len);
-        else for (slp = (struct scatterlist *)sc->buffer; scatterlen-- > 0 && len > 0; slp++) {
+        else for (slp = (struct scatterlist *)sc->request_buffer; scatterlen-- > 0 && len > 0; slp++) {
                 unsigned thislen = min(len, slp->length);
 
                 memcpy(page_address(slp->page) + slp->offset, buf, thislen);
diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
index e4bfa9dafbce..bb8770a177b5 100644
--- a/arch/ia64/kernel/efi.c
+++ b/arch/ia64/kernel/efi.c
@@ -632,7 +632,7 @@ kern_memory_descriptor (unsigned long phys_addr)
                 if (phys_addr - md->start < (md->num_pages << EFI_PAGE_SHIFT))
                          return md;
         }
-        return 0;
+        return NULL;
 }
 
 static efi_memory_desc_t *
@@ -652,7 +652,7 @@ efi_memory_descriptor (unsigned long phys_addr)
                 if (phys_addr - md->phys_addr < (md->num_pages << EFI_PAGE_SHIFT))
                          return md;
         }
-        return 0;
+        return NULL;
 }
 
 u32
@@ -923,7 +923,7 @@ find_memmap_space (void)
 void
 efi_memmap_init(unsigned long *s, unsigned long *e)
 {
-        struct kern_memdesc *k, *prev = 0;
+        struct kern_memdesc *k, *prev = NULL;
         u64     contig_low=0, contig_high=0;
         u64     as, ae, lim;
         void *efi_map_start, *efi_map_end, *p, *q;
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 561b8f1d3bc7..29236f0c62b5 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -853,7 +853,6 @@ END(__ia64_init_fpu)
  */
 GLOBAL_ENTRY(ia64_switch_mode_phys)
  {
-        alloc r2=ar.pfs,0,0,0,0
         rsm psr.i | psr.ic              // disable interrupts and interrupt collection
         mov r15=ip
  }
@@ -902,7 +901,6 @@ END(ia64_switch_mode_phys)
  */
 GLOBAL_ENTRY(ia64_switch_mode_virt)
  {
-        alloc r2=ar.pfs,0,0,0,0
         rsm psr.i | psr.ic              // disable interrupts and interrupt collection
         mov r15=ip
  }
diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c
index b7cf651ceb14..3ead20fb6f4b 100644
--- a/arch/ia64/kernel/ia64_ksyms.c
+++ b/arch/ia64/kernel/ia64_ksyms.c
@@ -62,7 +62,7 @@ EXPORT_SYMBOL(__udivdi3);
 EXPORT_SYMBOL(__moddi3);
 EXPORT_SYMBOL(__umoddi3);
 
-#if defined(CONFIG_MD_RAID5) || defined(CONFIG_MD_RAID5_MODULE)
+#if defined(CONFIG_MD_RAID456) || defined(CONFIG_MD_RAID456_MODULE)
 extern void xor_ia64_2(void);
 extern void xor_ia64_3(void);
 extern void xor_ia64_4(void);
diff --git a/arch/ia64/kernel/pal.S b/arch/ia64/kernel/pal.S
index 5018c7f2e7a8..ebaf1e685f5e 100644
--- a/arch/ia64/kernel/pal.S
+++ b/arch/ia64/kernel/pal.S
@@ -217,12 +217,7 @@ GLOBAL_ENTRY(ia64_pal_call_phys_stacked)
         .body
         ;;
         ld8 loc2 = [loc2]               // loc2 <- entry point
-        mov out0 = in0          // first argument
-        mov out1 = in1          // copy arg2
-        mov out2 = in2          // copy arg3
-        mov out3 = in3          // copy arg3
-        ;;
-        mov loc3 = psr          // save psr
+        mov loc3 = psr                  // save psr
         ;;
         mov loc4=ar.rsc                 // save RSE configuration
         dep.z loc2=loc2,0,61            // convert pal entry point to physical
@@ -236,18 +231,23 @@ GLOBAL_ENTRY(ia64_pal_call_phys_stacked)
         ;;
         andcm r16=loc3,r16              // removes bits to clear from psr
         br.call.sptk.many rp=ia64_switch_mode_phys
-.ret6:
+
+        mov out0 = in0                  // first argument
+        mov out1 = in1                  // copy arg2
+        mov out2 = in2                  // copy arg3
+        mov out3 = in3                  // copy arg3
         mov loc5 = r19
         mov loc6 = r20
+
         br.call.sptk.many rp=b7         // now make the call
-.ret7:
+
         mov ar.rsc=0                    // put RSE in enforced lazy, LE mode
         mov r16=loc3                    // r16= original psr
         mov r19=loc5
         mov r20=loc6
         br.call.sptk.many rp=ia64_switch_mode_virt      // return to virtual mode
 
-.ret8:  mov psr.l  = loc3               // restore init PSR
+        mov psr.l  = loc3               // restore init PSR
         mov ar.pfs = loc1
         mov rp = loc0
         ;;
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
index ab5b52413e91..0b546e2b36ac 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
@@ -566,29 +566,23 @@ version_info(char *page)
         pal_version_u_t min_ver, cur_ver;
         char *p = page;
 
-        /* The PAL_VERSION call is advertised as being able to support
-         * both physical and virtual mode calls. This seems to be a documentation
-         * bug rather than firmware bug. In fact, it does only support physical mode.
-         * So now the code reflects this fact and the pal_version() has been updated
-         * accordingly.
-         */
-        if (ia64_pal_version(&min_ver, &cur_ver) != 0) return 0;
+        if (ia64_pal_version(&min_ver, &cur_ver) != 0)
+                return 0;
 
         p += sprintf(p,
                      "PAL_vendor : 0x%02x (min=0x%02x)\n"
-                     "PAL_A      : %x.%x.%x (min=%x.%x.%x)\n"
-                     "PAL_B      : %x.%x.%x (min=%x.%x.%x)\n",
-                     cur_ver.pal_version_s.pv_pal_vendor, min_ver.pal_version_s.pv_pal_vendor,
-
-                     cur_ver.pal_version_s.pv_pal_a_model>>4,
-                     cur_ver.pal_version_s.pv_pal_a_model&0xf, cur_ver.pal_version_s.pv_pal_a_rev,
-                     min_ver.pal_version_s.pv_pal_a_model>>4,
-                     min_ver.pal_version_s.pv_pal_a_model&0xf, min_ver.pal_version_s.pv_pal_a_rev,
-
-                     cur_ver.pal_version_s.pv_pal_b_model>>4,
-                     cur_ver.pal_version_s.pv_pal_b_model&0xf, cur_ver.pal_version_s.pv_pal_b_rev,
-                     min_ver.pal_version_s.pv_pal_b_model>>4,
-                     min_ver.pal_version_s.pv_pal_b_model&0xf, min_ver.pal_version_s.pv_pal_b_rev);
+                     "PAL_A      : %02x.%02x (min=%02x.%02x)\n"
+                     "PAL_B      : %02x.%02x (min=%02x.%02x)\n",
+                     cur_ver.pal_version_s.pv_pal_vendor,
+                     min_ver.pal_version_s.pv_pal_vendor,
+                     cur_ver.pal_version_s.pv_pal_a_model,
+                     cur_ver.pal_version_s.pv_pal_a_rev,
+                     min_ver.pal_version_s.pv_pal_a_model,
+                     min_ver.pal_version_s.pv_pal_a_rev,
+                     cur_ver.pal_version_s.pv_pal_b_model,
+                     cur_ver.pal_version_s.pv_pal_b_rev,
+                     min_ver.pal_version_s.pv_pal_b_model,
+                     min_ver.pal_version_s.pv_pal_b_rev);
         return p - page;
 }
 
diff --git a/arch/ia64/kernel/traps.c b/arch/ia64/kernel/traps.c
index 5a0420464c6c..fffa9e0826bc 100644
--- a/arch/ia64/kernel/traps.c
+++ b/arch/ia64/kernel/traps.c
@@ -118,7 +118,7 @@ die (const char *str, struct pt_regs *regs, long err)
         spin_unlock_irq(&die.lock);
 
         if (panic_on_oops)
-                panic("Fatal exception: panic_on_oops");
+                panic("Fatal exception");
 
         do_exit(SIGSEGV);
 }
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index 5f03b9e524dd..4c73a6763669 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -32,32 +32,38 @@
 
 extern void __init efi_memmap_walk_uc(efi_freemem_callback_t, void *);
 
-#define MAX_UNCACHED_GRANULES   5
-static int allocated_granules;
+struct uncached_pool {
+        struct gen_pool *pool;
+        struct mutex add_chunk_mutex;   /* serialize adding a converted chunk */
+        int nchunks_added;              /* #of converted chunks added to pool */
+        atomic_t status;                /* smp called function's return status*/
+};
+
+#define MAX_CONVERTED_CHUNKS_PER_NODE   2
 
-struct gen_pool *uncached_pool[MAX_NUMNODES];
+struct uncached_pool uncached_pools[MAX_NUMNODES];
 
 
 static void uncached_ipi_visibility(void *data)
 {
         int status;
+        struct uncached_pool *uc_pool = (struct uncached_pool *)data;
 
         status = ia64_pal_prefetch_visibility(PAL_VISIBILITY_PHYSICAL);
         if ((status != PAL_VISIBILITY_OK) &&
             (status != PAL_VISIBILITY_OK_REMOTE_NEEDED))
-                printk(KERN_DEBUG "pal_prefetch_visibility() returns %i on "
-                       "CPU %i\n", status, raw_smp_processor_id());
+                atomic_inc(&uc_pool->status);
 }
 
 
 static void uncached_ipi_mc_drain(void *data)
 {
         int status;
+        struct uncached_pool *uc_pool = (struct uncached_pool *)data;
 
         status = ia64_pal_mc_drain();
-        if (status)
-                printk(KERN_WARNING "ia64_pal_mc_drain() failed with %i on "
-                       "CPU %i\n", status, raw_smp_processor_id());
+        if (status != PAL_STATUS_SUCCESS)
+                atomic_inc(&uc_pool->status);
 }
 
 
@@ -70,21 +76,34 @@ static void uncached_ipi_mc_drain(void *data)
  * This is accomplished by first allocating a granule of cached memory pages
  * and then converting them to uncached memory pages.
  */
-static int uncached_add_chunk(struct gen_pool *pool, int nid)
+static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
 {
         struct page *page;
-        int status, i;
+        int status, i, nchunks_added = uc_pool->nchunks_added;
         unsigned long c_addr, uc_addr;
 
-        if (allocated_granules >= MAX_UNCACHED_GRANULES)
+        if (mutex_lock_interruptible(&uc_pool->add_chunk_mutex) != 0)
+                return -1;      /* interrupted by a signal */
+
+        if (uc_pool->nchunks_added > nchunks_added) {
+                /* someone added a new chunk while we were waiting */
+                mutex_unlock(&uc_pool->add_chunk_mutex);
+                return 0;
+        }
+
+        if (uc_pool->nchunks_added >= MAX_CONVERTED_CHUNKS_PER_NODE) {
+                mutex_unlock(&uc_pool->add_chunk_mutex);
                 return -1;
+        }
 
         /* attempt to allocate a granule's worth of cached memory pages */
 
         page = alloc_pages_node(nid, GFP_KERNEL | __GFP_ZERO,
                                 IA64_GRANULE_SHIFT-PAGE_SHIFT);
-        if (!page)
+        if (!page) {
+                mutex_unlock(&uc_pool->add_chunk_mutex);
                 return -1;
+        }
 
         /* convert the memory pages from cached to uncached */
 
@@ -102,11 +121,14 @@ static int uncached_add_chunk(struct gen_pool *pool, int nid)
         flush_tlb_kernel_range(uc_addr, uc_adddr + IA64_GRANULE_SIZE);
 
         status = ia64_pal_prefetch_visibility(PAL_VISIBILITY_PHYSICAL);
-        if (!status) {
-                status = smp_call_function(uncached_ipi_visibility, NULL, 0, 1);
-                if (status)
+        if (status == PAL_VISIBILITY_OK_REMOTE_NEEDED) {
+                atomic_set(&uc_pool->status, 0);
+                status = smp_call_function(uncached_ipi_visibility, uc_pool,
+                                           0, 1);
+                if (status || atomic_read(&uc_pool->status))
                         goto failed;
-        }
+        } else if (status != PAL_VISIBILITY_OK)
+                goto failed;
 
         preempt_disable();
 
@@ -120,20 +142,24 @@ static int uncached_add_chunk(struct gen_pool *pool, int nid)
 
         preempt_enable();
 
-        ia64_pal_mc_drain();
-        status = smp_call_function(uncached_ipi_mc_drain, NULL, 0, 1);
-        if (status)
+        status = ia64_pal_mc_drain();
+        if (status != PAL_STATUS_SUCCESS)
+                goto failed;
+        atomic_set(&uc_pool->status, 0);
+        status = smp_call_function(uncached_ipi_mc_drain, uc_pool, 0, 1);
+        if (status || atomic_read(&uc_pool->status))
                 goto failed;
 
         /*
          * The chunk of memory pages has been converted to uncached so now we
          * can add it to the pool.
          */
-        status = gen_pool_add(pool, uc_addr, IA64_GRANULE_SIZE, nid);
+        status = gen_pool_add(uc_pool->pool, uc_addr, IA64_GRANULE_SIZE, nid);
         if (status)
                 goto failed;
 
-        allocated_granules++;
+        uc_pool->nchunks_added++;
+        mutex_unlock(&uc_pool->add_chunk_mutex);
         return 0;
 
         /* failed to convert or add the chunk so give it back to the kernel */
@@ -142,6 +168,7 @@ failed:
                 ClearPageUncached(&page[i]);
 
         free_pages(c_addr, IA64_GRANULE_SHIFT-PAGE_SHIFT);
+        mutex_unlock(&uc_pool->add_chunk_mutex);
         return -1;
 }
 
@@ -158,7 +185,7 @@ failed:
 unsigned long uncached_alloc_page(int starting_nid)
 {
         unsigned long uc_addr;
-        struct gen_pool *pool;
+        struct uncached_pool *uc_pool;
         int nid;
 
         if (unlikely(starting_nid >= MAX_NUMNODES))
@@ -171,14 +198,14 @@ unsigned long uncached_alloc_page(int starting_nid)
         do {
                 if (!node_online(nid))
                         continue;
-                pool = uncached_pool[nid];
-                if (pool == NULL)
+                uc_pool = &uncached_pools[nid];
+                if (uc_pool->pool == NULL)
                         continue;
                 do {
-                        uc_addr = gen_pool_alloc(pool, PAGE_SIZE);
+                        uc_addr = gen_pool_alloc(uc_pool->pool, PAGE_SIZE);
                         if (uc_addr != 0)
                                 return uc_addr;
-                } while (uncached_add_chunk(pool, nid) == 0);
+                } while (uncached_add_chunk(uc_pool, nid) == 0);
 
         } while ((nid = (nid + 1) % MAX_NUMNODES) != starting_nid);
 
@@ -197,7 +224,7 @@ EXPORT_SYMBOL(uncached_alloc_page);
 void uncached_free_page(unsigned long uc_addr)
 {
         int nid = paddr_to_nid(uc_addr - __IA64_UNCACHED_OFFSET);
-        struct gen_pool *pool = uncached_pool[nid];
+        struct gen_pool *pool = uncached_pools[nid].pool;
 
         if (unlikely(pool == NULL))
                 return;
@@ -224,7 +251,7 @@ static int __init uncached_build_memmap(unsigned long uc_start,
                                         unsigned long uc_end, void *arg)
 {
         int nid = paddr_to_nid(uc_start - __IA64_UNCACHED_OFFSET);
-        struct gen_pool *pool = uncached_pool[nid];
+        struct gen_pool *pool = uncached_pools[nid].pool;
         size_t size = uc_end - uc_start;
 
         touch_softlockup_watchdog();
@@ -242,7 +269,8 @@ static int __init uncached_init(void)
         int nid;
 
         for_each_online_node(nid) {
-                uncached_pool[nid] = gen_pool_create(PAGE_SHIFT, nid);
+                uncached_pools[nid].pool = gen_pool_create(PAGE_SHIFT, nid);
+                mutex_init(&uncached_pools[nid].add_chunk_mutex);
         }
 
         efi_memmap_walk_uc(uncached_build_memmap, NULL);
diff --git a/arch/ia64/lib/Makefile b/arch/ia64/lib/Makefile
index d8536a2c22a9..38fa6e49e791 100644
--- a/arch/ia64/lib/Makefile
+++ b/arch/ia64/lib/Makefile
@@ -14,7 +14,7 @@ lib-y := __divsi3.o __udivsi3.o __modsi3.o __umodsi3.o			\
 lib-$(CONFIG_ITANIUM)   += copy_page.o copy_user.o memcpy.o
 lib-$(CONFIG_MCKINLEY)  += copy_page_mck.o memcpy_mck.o
 lib-$(CONFIG_PERFMON)   += carta_random.o
-lib-$(CONFIG_MD_RAID5)  += xor.o
+lib-$(CONFIG_MD_RAID456)        += xor.o
 
 AFLAGS___divdi3.o       =
 AFLAGS___udivdi3.o      = -DUNSIGNED
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index 2a88cdd6d924..e004143ba86b 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -27,6 +27,7 @@
 
 #ifdef CONFIG_VIRTUAL_MEM_MAP
 static unsigned long num_dma_physpages;
+static unsigned long max_gap;
 #endif
 
 /**
@@ -45,9 +46,15 @@ show_mem (void)
 
         printk("Free swap:       %6ldkB\n", nr_swap_pages<<(PAGE_SHIFT-10));
         i = max_mapnr;
-        while (i-- > 0) {
-                if (!pfn_valid(i))
+        for (i = 0; i < max_mapnr; i++) {
+                if (!pfn_valid(i)) {
+#ifdef CONFIG_VIRTUAL_MEM_MAP
+                        if (max_gap < LARGE_GAP)
+                                continue;
+                        i = vmemmap_find_next_valid_pfn(0, i) - 1;
+#endif
                         continue;
+                }
                 total++;
                 if (PageReserved(mem_map+i))
                         reserved++;
@@ -234,7 +241,6 @@ paging_init (void)
         unsigned long zones_size[MAX_NR_ZONES];
 #ifdef CONFIG_VIRTUAL_MEM_MAP
         unsigned long zholes_size[MAX_NR_ZONES];
-        unsigned long max_gap;
 #endif
 
         /* initialize mem_map[] */
@@ -266,7 +272,6 @@ paging_init (void)
                 }
         }
 
-        max_gap = 0;
         efi_memmap_walk(find_largest_hole, (u64 *)&max_gap);
         if (max_gap < LARGE_GAP) {
                 vmem_map = (struct page *) 0;
@@ -277,7 +282,8 @@ paging_init (void)
 
                 /* allocate virtual_mem_map */
 
-                map_size = PAGE_ALIGN(max_low_pfn * sizeof(struct page));
+                map_size = PAGE_ALIGN(ALIGN(max_low_pfn, MAX_ORDER_NR_PAGES) *
+                        sizeof(struct page));
                 vmalloc_end -= map_size;
                 vmem_map = (struct page *) vmalloc_end;
                 efi_memmap_walk(create_mem_map_page_table, NULL);
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index 99bd9e30db96..d260bffa01ab 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -534,68 +534,6 @@ void __cpuinit *per_cpu_init(void)
 }
 #endif /* CONFIG_SMP */
 
-#ifdef CONFIG_VIRTUAL_MEM_MAP
-static inline int find_next_valid_pfn_for_pgdat(pg_data_t *pgdat, int i)
-{
-        unsigned long end_address, hole_next_pfn;
-        unsigned long stop_address;
-
-        end_address = (unsigned long) &vmem_map[pgdat->node_start_pfn + i];
-        end_address = PAGE_ALIGN(end_address);
-
-        stop_address = (unsigned long) &vmem_map[
-                pgdat->node_start_pfn + pgdat->node_spanned_pages];
-
-        do {
-                pgd_t *pgd;
-                pud_t *pud;
-                pmd_t *pmd;
-                pte_t *pte;
-
-                pgd = pgd_offset_k(end_address);
-                if (pgd_none(*pgd)) {
-                        end_address += PGDIR_SIZE;
-                        continue;
-                }
-
-                pud = pud_offset(pgd, end_address);
-                if (pud_none(*pud)) {
-                        end_address += PUD_SIZE;
-                        continue;
-                }
-
-                pmd = pmd_offset(pud, end_address);
-                if (pmd_none(*pmd)) {
-                        end_address += PMD_SIZE;
-                        continue;
-                }
-
-                pte = pte_offset_kernel(pmd, end_address);
-retry_pte:
-                if (pte_none(*pte)) {
-                        end_address += PAGE_SIZE;
-                        pte++;
-                        if ((end_address < stop_address) &&
-                            (end_address != ALIGN(end_address, 1UL << PMD_SHIFT)))
-                                goto retry_pte;
-                        continue;
-                }
-                /* Found next valid vmem_map page */
-                break;
-        } while (end_address < stop_address);
-
-        end_address = min(end_address, stop_address);
-        end_address = end_address - (unsigned long) vmem_map + sizeof(struct page) - 1;
-        hole_next_pfn = end_address / sizeof(struct page);
-        return hole_next_pfn - pgdat->node_start_pfn;
-}
-#else
-static inline int find_next_valid_pfn_for_pgdat(pg_data_t *pgdat, int i)
-{
-        return i + 1;
-}
-#endif
-
 /**
  * show_mem - give short summary of memory stats
  *
@@ -625,7 +563,8 @@ void show_mem(void)
                         if (pfn_valid(pgdat->node_start_pfn + i))
                                 page = pfn_to_page(pgdat->node_start_pfn + i);
                         else {
-                                i = find_next_valid_pfn_for_pgdat(pgdat, i) - 1;
+                                i = vmemmap_find_next_valid_pfn(pgdat->node_id,
+                                         i) - 1;
                                 continue;
                         }
                         if (PageReserved(page))
@@ -751,7 +690,8 @@ void __init paging_init(void)
         efi_memmap_walk(filter_rsvd_memory, count_node_pages);
 
 #ifdef CONFIG_VIRTUAL_MEM_MAP
-        vmalloc_end -= PAGE_ALIGN(max_low_pfn * sizeof(struct page));
+        vmalloc_end -= PAGE_ALIGN(ALIGN(max_low_pfn, MAX_ORDER_NR_PAGES) *
+                sizeof(struct page));
         vmem_map = (struct page *) vmalloc_end;
         efi_memmap_walk(create_mem_map_page_table, NULL);
         printk("Virtual mem_map starts at 0x%p\n", vmem_map);
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index 2f50c064513c..30617ccb4f7e 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -415,6 +415,61 @@ ia64_mmu_init (void *my_cpu_data)
 }
 
 #ifdef CONFIG_VIRTUAL_MEM_MAP
+int vmemmap_find_next_valid_pfn(int node, int i)
+{
+        unsigned long end_address, hole_next_pfn;
+        unsigned long stop_address;
+        pg_data_t *pgdat = NODE_DATA(node);
+
+        end_address = (unsigned long) &vmem_map[pgdat->node_start_pfn + i];
+        end_address = PAGE_ALIGN(end_address);
+
+        stop_address = (unsigned long) &vmem_map[
+                pgdat->node_start_pfn + pgdat->node_spanned_pages];
+
+        do {
+                pgd_t *pgd;
+                pud_t *pud;
+                pmd_t *pmd;
+                pte_t *pte;
+
+                pgd = pgd_offset_k(end_address);
+                if (pgd_none(*pgd)) {
+                        end_address += PGDIR_SIZE;
+                        continue;
+                }
+
+                pud = pud_offset(pgd, end_address);
+                if (pud_none(*pud)) {
+                        end_address += PUD_SIZE;
+                        continue;
+                }
+
+                pmd = pmd_offset(pud, end_address);
+                if (pmd_none(*pmd)) {
+                        end_address += PMD_SIZE;
+                        continue;
+                }
+
+                pte = pte_offset_kernel(pmd, end_address);
+retry_pte:
+                if (pte_none(*pte)) {
+                        end_address += PAGE_SIZE;
+                        pte++;
+                        if ((end_address < stop_address) &&
+                            (end_address != ALIGN(end_address, 1UL << PMD_SHIFT)))
+                                goto retry_pte;
+                        continue;
+                }
+                /* Found next valid vmem_map page */
+                break;
+        } while (end_address < stop_address);
+
+        end_address = min(end_address, stop_address);
+        end_address = end_address - (unsigned long) vmem_map + sizeof(struct page) - 1;
+        hole_next_pfn = end_address / sizeof(struct page);
+        return hole_next_pfn - pgdat->node_start_pfn;
+}
 
 int __init
 create_mem_map_page_table (u64 start, u64 end, void *arg)
diff --git a/arch/ia64/mm/ioremap.c b/arch/ia64/mm/ioremap.c
index 07bd02b6c372..4280c074d64e 100644
--- a/arch/ia64/mm/ioremap.c
+++ b/arch/ia64/mm/ioremap.c
@@ -32,7 +32,7 @@ ioremap (unsigned long offset, unsigned long size)
          */
         attr = kern_mem_attribute(offset, size);
         if (attr & EFI_MEMORY_WB)
-                return phys_to_virt(offset);
+                return (void __iomem *) phys_to_virt(offset);
         else if (attr & EFI_MEMORY_UC)
                 return __ioremap(offset, size);
 
@@ -43,7 +43,7 @@ ioremap (unsigned long offset, unsigned long size)
         gran_base = GRANULEROUNDDOWN(offset);
         gran_size = GRANULEROUNDUP(offset + size) - gran_base;
         if (efi_mem_attribute(gran_base, gran_size) & EFI_MEMORY_WB)
-                return phys_to_virt(offset);
+                return (void __iomem *) phys_to_virt(offset);
 
         return __ioremap(offset, size);
 }
@@ -53,7 +53,7 @@ void __iomem *
 ioremap_nocache (unsigned long offset, unsigned long size)
 {
         if (kern_mem_attribute(offset, size) & EFI_MEMORY_WB)
-                return 0;
+                return NULL;
 
         return __ioremap(offset, size);
 }
diff --git a/arch/ia64/sn/kernel/xpc_main.c b/arch/ia64/sn/kernel/xpc_main.c
index 99b123a6421a..5e8e59efb347 100644
--- a/arch/ia64/sn/kernel/xpc_main.c
+++ b/arch/ia64/sn/kernel/xpc_main.c
@@ -480,7 +480,7 @@ xpc_activating(void *__partid)
         partid_t partid = (u64) __partid;
         struct xpc_partition *part = &xpc_partitions[partid];
         unsigned long irq_flags;
-        struct sched_param param = { sched_priority: MAX_RT_PRIO - 1 };
+        struct sched_param param = { .sched_priority = MAX_RT_PRIO - 1 };
         int ret;
 
 
diff --git a/arch/ia64/sn/pci/tioce_provider.c b/arch/ia64/sn/pci/tioce_provider.c
index 17cd34284886..af7171adcd2c 100644
--- a/arch/ia64/sn/pci/tioce_provider.c
+++ b/arch/ia64/sn/pci/tioce_provider.c
@@ -74,7 +74,7 @@ tioce_mmr_war_pre(struct tioce_kernel *kern, void *mmr_addr)
                 else
                         mmr_war_offset = 0x158;
 
-                readq_relaxed((void *)(mmr_base + mmr_war_offset));
+                readq_relaxed((void __iomem *)(mmr_base + mmr_war_offset));
         }
 }
 
@@ -92,8 +92,8 @@ tioce_mmr_war_post(struct tioce_kernel *kern, void *mmr_addr)
 
         if (mmr_offset < 0x45000) {
                 if (mmr_offset == 0x100)
-                        readq_relaxed((void *)(mmr_base + 0x38));
-                readq_relaxed((void *)(mmr_base + 0xb050));
+                        readq_relaxed((void __iomem *)(mmr_base + 0x38));
+                readq_relaxed((void __iomem *)(mmr_base + 0xb050));
         }
 }
 
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 2105767fcc57..05682a24b210 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -151,7 +151,7 @@ int die(const char *str, struct pt_regs *regs, long err)
                 panic("Fatal exception in interrupt");
 
         if (panic_on_oops)
-                panic("Fatal exception: panic_on_oops");
+                panic("Fatal exception");
 
         do_exit(err);
 
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 6a4b5f9715c9..a0a94e0ef8d1 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -618,7 +618,7 @@ appldata_offline_cpu(int cpu)
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-static int
+static int __cpuinit
 appldata_cpu_notify(struct notifier_block *self,
                     unsigned long action, void *hcpu)
 {
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index eb6ebfef134a..6e6b6de77770 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -129,7 +129,7 @@ void __init paging_init(void)
                 /*
                  * pg_table is physical at this point
                  */
-                pg_table = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
+                pg_table = (pte_t *) alloc_bootmem_pages(PAGE_SIZE);
 
                 pg_dir->pgd0 =  (_PAGE_TABLE | __pa(pg_table));
                 pg_dir->pgd1 =  (_PAGE_TABLE | (__pa(pg_table)+1024));
@@ -219,7 +219,7 @@ void __init paging_init(void)
                         continue;
                 }          
         
-                pm_dir = (pmd_t *) alloc_bootmem_low_pages(PAGE_SIZE*4);
+                pm_dir = (pmd_t *) alloc_bootmem_pages(PAGE_SIZE * 4);
                 pgd_populate(&init_mm, pg_dir, pm_dir);
 
                 for (j = 0 ; j < PTRS_PER_PMD ; j++,pm_dir++) {
@@ -228,7 +228,7 @@ void __init paging_init(void)
                                 continue; 
                         }          
                         
-                        pt_dir = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
+                        pt_dir = (pte_t *) alloc_bootmem_pages(PAGE_SIZE);
                         pmd_populate_kernel(&init_mm, pm_dir, pt_dir);
         
                         for (k = 0 ; k < PTRS_PER_PTE ; k++,pt_dir++) {
diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
index 781dbb11c038..b09805f3ee23 100644
--- a/arch/sh/kernel/cpu/sh4/sq.c
+++ b/arch/sh/kernel/cpu/sh4/sq.c
@@ -421,18 +421,22 @@ static struct miscdevice sq_dev = {
 
 static int __init sq_api_init(void)
 {
+        int ret;
         printk(KERN_NOTICE "sq: Registering store queue API.\n");
 
-#ifdef CONFIG_PROC_FS
         create_proc_read_entry("sq_mapping", 0, 0, sq_mapping_read_proc, 0);
-#endif
 
-        return misc_register(&sq_dev);
+        ret = misc_register(&sq_dev);
+        if (ret)
+                remove_proc_entry("sq_mapping", NULL);
+
+        return ret;
 }
 
 static void __exit sq_api_exit(void)
 {
         misc_deregister(&sq_dev);
+        remove_proc_entry("sq_mapping", NULL);
 }
 
 module_init(sq_api_init);
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index d464dded68c0..6f810424df44 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -513,6 +513,7 @@ END(stub_rt_sigreturn)
         swapgs  
 1:      incl    %gs:pda_irqcount        # RED-PEN should check preempt count
         cmoveq %gs:pda_irqstackptr,%rsp
+        push    %rbp                    # backlink for old unwinder
         /*
          * We entered an interrupt context - irqs are off:
          */
@@ -1139,18 +1140,21 @@ ENTRY(machine_check)
 END(machine_check)
 #endif
 
+/* Call softirq on interrupt stack. Interrupts are off. */
 ENTRY(call_softirq)
         CFI_STARTPROC
-        movq %gs:pda_irqstackptr,%rax
-        movq %rsp,%rdx
-        CFI_DEF_CFA_REGISTER    rdx
+        push %rbp
+        CFI_ADJUST_CFA_OFFSET   8
+        CFI_REL_OFFSET rbp,0
+        mov  %rsp,%rbp
+        CFI_DEF_CFA_REGISTER rbp
         incl %gs:pda_irqcount
-        cmove %rax,%rsp
-        pushq %rdx
-        /*todo CFI_DEF_CFA_EXPRESSION ...*/
+        cmove %gs:pda_irqstackptr,%rsp
+        push  %rbp                      # backlink for old unwinder
         call __do_softirq
-        popq %rsp
+        leaveq
         CFI_DEF_CFA_REGISTER    rsp
+        CFI_ADJUST_CFA_OFFSET   -8
         decl %gs:pda_irqcount
         ret
         CFI_ENDPROC
diff --git a/arch/x86_64/kernel/pci-nommu.c b/arch/x86_64/kernel/pci-nommu.c
index c4c3cc36ac5b..aad7609d8e92 100644
--- a/arch/x86_64/kernel/pci-nommu.c
+++ b/arch/x86_64/kernel/pci-nommu.c
@@ -92,5 +92,7 @@ void __init no_iommu_init(void)
 {
         if (dma_ops)
                 return;
+
+        force_iommu = 0; /* no HW IOMMU */
         dma_ops = &nommu_dma_ops;
 }
diff --git a/arch/x86_64/kernel/smp.c b/arch/x86_64/kernel/smp.c
index 5a1c0a3bf872..06af6ca60129 100644
--- a/arch/x86_64/kernel/smp.c
+++ b/arch/x86_64/kernel/smp.c
@@ -203,7 +203,7 @@ int __cpuinit init_smp_flush(void)
 {
         int i;
         for_each_cpu_mask(i, cpu_possible_map) {
-                spin_lock_init(&per_cpu(flush_state.tlbstate_lock, i));
+                spin_lock_init(&per_cpu(flush_state, i).tlbstate_lock);
         }
         return 0;
 }
diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
index 4e9938dee060..14052f089814 100644
--- a/arch/x86_64/kernel/traps.c
+++ b/arch/x86_64/kernel/traps.c
@@ -529,7 +529,7 @@ void __kprobes oops_end(unsigned long flags)
                 /* Nest count reaches zero, release the lock. */
                 spin_unlock_irqrestore(&die_lock, flags);
         if (panic_on_oops)
-                panic("Fatal exception: panic_on_oops");
+                panic("Fatal exception");
 }
 
 void __kprobes __die(const char * str, struct pt_regs * regs, long err)
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index 9734960a2451..ce077d6bf3a0 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -488,7 +488,7 @@ void die(const char * str, struct pt_regs * regs, long err)
                 panic("Fatal exception in interrupt");
 
         if (panic_on_oops)
-                panic("Fatal exception: panic_on_oops");
+                panic("Fatal exception");
 
         do_exit(err);
 }
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index 81e970adeab3..b0d4b147b19e 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -129,11 +129,15 @@ acpi_memory_get_device_resources(struct acpi_memory_device *mem_device)
         struct acpi_memory_info *info, *n;
 
 
+        if (!list_empty(&mem_device->res_list))
+                return 0;
+
         status = acpi_walk_resources(mem_device->device->handle, METHOD_NAME__CRS,
                                      acpi_memory_get_resource, mem_device);
         if (ACPI_FAILURE(status)) {
                 list_for_each_entry_safe(info, n, &mem_device->res_list, list)
                         kfree(info);
+                INIT_LIST_HEAD(&mem_device->res_list);
                 return -EINVAL;
         }
 
@@ -230,17 +234,10 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
          * (i.e. memory-hot-remove function)
          */
         list_for_each_entry(info, &mem_device->res_list, list) {
-                u64 start_pfn, end_pfn;
-
-                start_pfn = info->start_addr >> PAGE_SHIFT;
-                end_pfn = (info->start_addr + info->length - 1) >> PAGE_SHIFT;
-
-                if (pfn_valid(start_pfn) || pfn_valid(end_pfn)) {
-                        /* already enabled. try next area */
+                if (info->enabled) { /* just sanity check...*/
                         num_enabled++;
                         continue;
                 }
-
                 result = add_memory(node, info->start_addr, info->length);
                 if (result)
                         continue;
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 1c0a39d8b04e..578b99b71d9c 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -58,8 +58,8 @@ struct dock_dependent_device {
 };
 
 #define DOCK_DOCKING    0x00000001
-#define DOCK_EVENT      KOBJ_DOCK
-#define UNDOCK_EVENT    KOBJ_UNDOCK
+#define DOCK_EVENT      3
+#define UNDOCK_EVENT    2
 
 static struct dock_station *dock_station;
 
@@ -322,11 +322,10 @@ static void hotplug_dock_devices(struct dock_station *ds, u32 event)
 
 static void dock_event(struct dock_station *ds, u32 event, int num)
 {
-        struct acpi_device *device;
-
-        device = dock_create_acpi_device(ds->handle);
-        if (device)
-                kobject_uevent(&device->kobj, num);
+        /*
+         * we don't do events until someone tells me that
+         * they would like to have them.
+         */
 }
 
 /**
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index 41db8060e8f7..017f755632a3 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -311,7 +311,8 @@ static void hvsi_recv_control(struct hvsi_struct *hp, uint8_t *packet,
                                 /* CD went away; no more connection */
                                 pr_debug("hvsi%i: CD dropped\n", hp->index);
                                 hp->mctrl &= TIOCM_CD;
-                                if (!(hp->tty->flags & CLOCAL))
+                                /* If userland hasn't done an open(2) yet, hp->tty is NULL. */
+                                if (hp->tty && !(hp->tty->flags & CLOCAL))
                                         *to_hangup = hp->tty;
                         }
                         break;
@@ -986,10 +987,7 @@ static void hvsi_write_worker(void *arg)
                 start_j = 0;
 #endif /* DEBUG */
                 wake_up_all(&hp->emptyq);
-                if (test_bit(TTY_DO_WRITE_WAKEUP, &hp->tty->flags)
-                                && hp->tty->ldisc.write_wakeup)
-                        hp->tty->ldisc.write_wakeup(hp->tty);
-                wake_up_interruptible(&hp->tty->write_wait);
+                tty_wakeup(hp->tty);
         }
 
 out:
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 819516b35a79..a01d796d1eeb 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -25,12 +25,12 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/random.h>
+#include <linux/clk.h>
 #include <linux/err.h>
-#include <linux/device.h>
+#include <linux/platform_device.h>
 #include <linux/hw_random.h>
 
 #include <asm/io.h>
-#include <asm/hardware/clock.h>
 
 #define RNG_OUT_REG             0x00            /* Output register */
 #define RNG_STAT_REG            0x04            /* Status register
@@ -52,7 +52,7 @@
 
 static void __iomem *rng_base;
 static struct clk *rng_ick;
-static struct device *rng_dev;
+static struct platform_device *rng_dev;
 
 static u32 omap_rng_read_reg(int reg)
 {
@@ -83,9 +83,8 @@ static struct hwrng omap_rng_ops = {
         .data_read      = omap_rng_data_read,
 };
 
-static int __init omap_rng_probe(struct device *dev)
+static int __init omap_rng_probe(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
         struct resource *res, *mem;
         int ret;
 
@@ -95,16 +94,14 @@ static int __init omap_rng_probe(struct device *dev)
          */
         BUG_ON(rng_dev);
 
-        if (cpu_is_omap24xx()) {
+        if (cpu_is_omap24xx()) {
                 rng_ick = clk_get(NULL, "rng_ick");
                 if (IS_ERR(rng_ick)) {
-                        dev_err(dev, "Could not get rng_ick\n");
+                        dev_err(&pdev->dev, "Could not get rng_ick\n");
                         ret = PTR_ERR(rng_ick);
                         return ret;
-                }
-                else {
-                        clk_use(rng_ick);
-                }
+                } else
+                        clk_enable(rng_ick);
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -117,7 +114,7 @@ static int __init omap_rng_probe(struct device *dev)
         if (mem == NULL)
                 return -EBUSY;
 
-        dev_set_drvdata(dev, mem);
+        dev_set_drvdata(&pdev->dev, mem);
         rng_base = (u32 __iomem *)io_p2v(res->start);
 
         ret = hwrng_register(&omap_rng_ops);
@@ -127,25 +124,25 @@ static int __init omap_rng_probe(struct device *dev)
                 return ret;
         }
 
-        dev_info(dev, "OMAP Random Number Generator ver. %02x\n",
+        dev_info(&pdev->dev, "OMAP Random Number Generator ver. %02x\n",
                 omap_rng_read_reg(RNG_REV_REG));
         omap_rng_write_reg(RNG_MASK_REG, 0x1);
 
-        rng_dev = dev;
+        rng_dev = pdev;
 
         return 0;
 }
 
-static int __exit omap_rng_remove(struct device *dev)
+static int __exit omap_rng_remove(struct platform_device *pdev)
 {
-        struct resource *mem = dev_get_drvdata(dev);
+        struct resource *mem = dev_get_drvdata(&pdev->dev);
 
         hwrng_unregister(&omap_rng_ops);
 
         omap_rng_write_reg(RNG_MASK_REG, 0x0);
 
         if (cpu_is_omap24xx()) {
-                clk_unuse(rng_ick);
+                clk_disable(rng_ick);
                 clk_put(rng_ick);
         }
 
@@ -157,18 +154,16 @@ static int __exit omap_rng_remove(struct device *dev)
 
 #ifdef CONFIG_PM
 
-static int omap_rng_suspend(struct device *dev, pm_message_t message, u32 level)
+static int omap_rng_suspend(struct platform_device *pdev, pm_message_t message)
 {
         omap_rng_write_reg(RNG_MASK_REG, 0x0);
-
         return 0;
 }
 
-static int omap_rng_resume(struct device *dev, pm_message_t message, u32 level)
+static int omap_rng_resume(struct platform_device *pdev)
 {
         omap_rng_write_reg(RNG_MASK_REG, 0x1);
-
-        return 1;
+        return 0;
 }
 
 #else
@@ -179,9 +174,11 @@ static int omap_rng_resume(struct device *dev, pm_message_t message, u32 level)
 #endif
 
 
-static struct device_driver omap_rng_driver = {
-        .name           = "omap_rng",
-        .bus            = &platform_bus_type,
+static struct platform_driver omap_rng_driver = {
+        .driver = {
+                .name           = "omap_rng",
+                .owner          = THIS_MODULE,
+        },
         .probe          = omap_rng_probe,
         .remove         = __exit_p(omap_rng_remove),
         .suspend        = omap_rng_suspend,
@@ -193,12 +190,12 @@ static int __init omap_rng_init(void)
         if (!cpu_is_omap16xx() && !cpu_is_omap24xx())
                 return -ENODEV;
 
-        return driver_register(&omap_rng_driver);
+        return platform_driver_register(&omap_rng_driver);
 }
 
 static void __exit omap_rng_exit(void)
 {
-        driver_unregister(&omap_rng_driver);
+        platform_driver_unregister(&omap_rng_driver);
 }
 
 module_init(omap_rng_init);
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 056ebe84b81d..3e90aac37510 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -107,7 +107,6 @@ const int NR_TYPES = ARRAY_SIZE(max_vals);
 
 struct kbd_struct kbd_table[MAX_NR_CONSOLES];
 static struct kbd_struct *kbd = kbd_table;
-static struct kbd_struct kbd0;
 
 int spawnpid, spawnsig;
 
@@ -223,13 +222,13 @@ static void kd_nosound(unsigned long ignored)
 {
         struct list_head *node;
 
-        list_for_each(node,&kbd_handler.h_list) {
+        list_for_each(node, &kbd_handler.h_list) {
                 struct input_handle *handle = to_handle_h(node);
                 if (test_bit(EV_SND, handle->dev->evbit)) {
                         if (test_bit(SND_TONE, handle->dev->sndbit))
-                                input_event(handle->dev, EV_SND, SND_TONE, 0);
+                                input_inject_event(handle, EV_SND, SND_TONE, 0);
                         if (test_bit(SND_BELL, handle->dev->sndbit))
-                                input_event(handle->dev, EV_SND, SND_BELL, 0);
+                                input_inject_event(handle, EV_SND, SND_BELL, 0);
                 }
         }
 }
@@ -247,11 +246,11 @@ void kd_mksound(unsigned int hz, unsigned int ticks)
                         struct input_handle *handle = to_handle_h(node);
                         if (test_bit(EV_SND, handle->dev->evbit)) {
                                 if (test_bit(SND_TONE, handle->dev->sndbit)) {
-                                        input_event(handle->dev, EV_SND, SND_TONE, hz);
+                                        input_inject_event(handle, EV_SND, SND_TONE, hz);
                                         break;
                                 }
                                 if (test_bit(SND_BELL, handle->dev->sndbit)) {
-                                        input_event(handle->dev, EV_SND, SND_BELL, 1);
+                                        input_inject_event(handle, EV_SND, SND_BELL, 1);
                                         break;
                                 }
                         }
@@ -272,15 +271,15 @@ int kbd_rate(struct kbd_repeat *rep)
         unsigned int d = 0;
         unsigned int p = 0;
 
-        list_for_each(node,&kbd_handler.h_list) {
+        list_for_each(node, &kbd_handler.h_list) {
                 struct input_handle *handle = to_handle_h(node);
                 struct input_dev *dev = handle->dev;
 
                 if (test_bit(EV_REP, dev->evbit)) {
                         if (rep->delay > 0)
-                                input_event(dev, EV_REP, REP_DELAY, rep->delay);
+                                input_inject_event(handle, EV_REP, REP_DELAY, rep->delay);
                         if (rep->period > 0)
-                                input_event(dev, EV_REP, REP_PERIOD, rep->period);
+                                input_inject_event(handle, EV_REP, REP_PERIOD, rep->period);
                         d = dev->rep[REP_DELAY];
                         p = dev->rep[REP_PERIOD];
                 }
@@ -988,7 +987,7 @@ static inline unsigned char getleds(void)
  * interrupt routines for this thing allows us to easily mask
  * this when we don't want any of the above to happen.
  * This allows for easy and efficient race-condition prevention
- * for kbd_refresh_leds => input_event(dev, EV_LED, ...) => ...
+ * for kbd_start => input_inject_event(dev, EV_LED, ...) => ...
  */
 
 static void kbd_bh(unsigned long dummy)
@@ -998,11 +997,11 @@ static void kbd_bh(unsigned long dummy)
 
         if (leds != ledstate) {
                 list_for_each(node, &kbd_handler.h_list) {
-                        struct input_handle * handle = to_handle_h(node);
-                        input_event(handle->dev, EV_LED, LED_SCROLLL, !!(leds & 0x01));
-                        input_event(handle->dev, EV_LED, LED_NUML,    !!(leds & 0x02));
-                        input_event(handle->dev, EV_LED, LED_CAPSL,   !!(leds & 0x04));
-                        input_sync(handle->dev);
+                        struct input_handle *handle = to_handle_h(node);
+                        input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
+                        input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
+                        input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
+                        input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
                 }
         }
 
@@ -1011,23 +1010,6 @@ static void kbd_bh(unsigned long dummy)
 
 DECLARE_TASKLET_DISABLED(keyboard_tasklet, kbd_bh, 0);
 
-/*
- * This allows a newly plugged keyboard to pick the LED state.
- */
-static void kbd_refresh_leds(struct input_handle *handle)
-{
-        unsigned char leds = ledstate;
-
-        tasklet_disable(&keyboard_tasklet);
-        if (leds != 0xff) {
-                input_event(handle->dev, EV_LED, LED_SCROLLL, !!(leds & 0x01));
-                input_event(handle->dev, EV_LED, LED_NUML,    !!(leds & 0x02));
-                input_event(handle->dev, EV_LED, LED_CAPSL,   !!(leds & 0x04));
-                input_sync(handle->dev);
-        }
-        tasklet_enable(&keyboard_tasklet);
-}
-
 #if defined(CONFIG_X86) || defined(CONFIG_IA64) || defined(CONFIG_ALPHA) ||\
     defined(CONFIG_MIPS) || defined(CONFIG_PPC) || defined(CONFIG_SPARC) ||\
     defined(CONFIG_PARISC) || defined(CONFIG_SUPERH) ||\
@@ -1043,7 +1025,7 @@ static const unsigned short x86_keycodes[256] =
          48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63,
          64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79,
          80, 81, 82, 83, 84,118, 86, 87, 88,115,120,119,121,112,123, 92,
-        284,285,309,298,312, 91,327,328,329,331,333,335,336,337,338,339,
+        284,285,309,  0,312, 91,327,328,329,331,333,335,336,337,338,339,
         367,288,302,304,350, 89,334,326,267,126,268,269,125,347,348,349,
         360,261,262,263,268,376,100,101,321,316,373,286,289,102,351,355,
         103,104,105,275,287,279,306,106,274,107,294,364,358,363,362,361,
@@ -1065,38 +1047,55 @@ extern void sun_do_break(void);
 static int emulate_raw(struct vc_data *vc, unsigned int keycode,
                        unsigned char up_flag)
 {
-        if (keycode > 255 || !x86_keycodes[keycode])
-                return -1;
+        int code;
 
         switch (keycode) {
                 case KEY_PAUSE:
                         put_queue(vc, 0xe1);
                         put_queue(vc, 0x1d | up_flag);
                         put_queue(vc, 0x45 | up_flag);
-                        return 0;
+                        break;
+
                 case KEY_HANGEUL:
                         if (!up_flag)
                                 put_queue(vc, 0xf2);
-                        return 0;
+                        break;
+
                 case KEY_HANJA:
                         if (!up_flag)
                                 put_queue(vc, 0xf1);
-                        return 0;
-        }
+                        break;
 
-        if (keycode == KEY_SYSRQ && sysrq_alt) {
-                put_queue(vc, 0x54 | up_flag);
-                return 0;
-        }
+                case KEY_SYSRQ:
+                        /*
+                         * Real AT keyboards (that's what we're trying
+                         * to emulate here emit 0xe0 0x2a 0xe0 0x37 when
+                         * pressing PrtSc/SysRq alone, but simply 0x54
+                         * when pressing Alt+PrtSc/SysRq.
+                         */
+                        if (sysrq_alt) {
+                                put_queue(vc, 0x54 | up_flag);
+                        } else {
+                                put_queue(vc, 0xe0);
+                                put_queue(vc, 0x2a | up_flag);
+                                put_queue(vc, 0xe0);
+                                put_queue(vc, 0x37 | up_flag);
+                        }
+                        break;
+
+                default:
+                        if (keycode > 255)
+                                return -1;
 
-        if (x86_keycodes[keycode] & 0x100)
-                put_queue(vc, 0xe0);
+                        code = x86_keycodes[keycode];
+                        if (!code)
+                                return -1;
 
-        put_queue(vc, (x86_keycodes[keycode] & 0x7f) | up_flag);
+                        if (code & 0x100)
+                                put_queue(vc, 0xe0);
+                        put_queue(vc, (code & 0x7f) | up_flag);
 
-        if (keycode == KEY_SYSRQ) {
-                put_queue(vc, 0xe0);
-                put_queue(vc, 0x37 | up_flag);
+                        break;
         }
 
         return 0;
@@ -1298,16 +1297,15 @@ static struct input_handle *kbd_connect(struct input_handler *handler,
         if (i == BTN_MISC && !test_bit(EV_SND, dev->evbit))
                 return NULL;
 
-        if (!(handle = kmalloc(sizeof(struct input_handle), GFP_KERNEL)))
+        handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
+        if (!handle)
                 return NULL;
-        memset(handle, 0, sizeof(struct input_handle));
 
         handle->dev = dev;
         handle->handler = handler;
         handle->name = "kbd";
 
         input_open_device(handle);
-        kbd_refresh_leds(handle);
 
         return handle;
 }
@@ -1318,6 +1316,24 @@ static void kbd_disconnect(struct input_handle *handle)
         kfree(handle);
 }
 
+/*
+ * Start keyboard handler on the new keyboard by refreshing LED state to
+ * match the rest of the system.
+ */
+static void kbd_start(struct input_handle *handle)
+{
+        unsigned char leds = ledstate;
+
+        tasklet_disable(&keyboard_tasklet);
+        if (leds != 0xff) {
+                input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
+                input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
+                input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
+                input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
+        }
+        tasklet_enable(&keyboard_tasklet);
+}
+
 static struct input_device_id kbd_ids[] = {
         {
                 .flags = INPUT_DEVICE_ID_MATCH_EVBIT,
@@ -1338,6 +1354,7 @@ static struct input_handler kbd_handler = {
         .event          = kbd_event,
         .connect        = kbd_connect,
         .disconnect     = kbd_disconnect,
+        .start          = kbd_start,
         .name           = "kbd",
         .id_table       = kbd_ids,
 };
@@ -1346,15 +1363,15 @@ int __init kbd_init(void)
 {
         int i;
 
-        kbd0.ledflagstate = kbd0.default_ledflagstate = KBD_DEFLEDS;
-        kbd0.ledmode = LED_SHOW_FLAGS;
-        kbd0.lockstate = KBD_DEFLOCK;
-        kbd0.slockstate = 0;
-        kbd0.modeflags = KBD_DEFMODE;
-        kbd0.kbdmode = VC_XLATE;
-
-        for (i = 0 ; i < MAX_NR_CONSOLES ; i++)
-                kbd_table[i] = kbd0;
+        for (i = 0; i < MAX_NR_CONSOLES; i++) {
+                kbd_table[i].ledflagstate = KBD_DEFLEDS;
+                kbd_table[i].default_ledflagstate = KBD_DEFLEDS;
+                kbd_table[i].ledmode = LED_SHOW_FLAGS;
+                kbd_table[i].lockstate = KBD_DEFLOCK;
+                kbd_table[i].slockstate = 0;
+                kbd_table[i].modeflags = KBD_DEFMODE;
+                kbd_table[i].kbdmode = VC_XLATE;
+        }
 
         input_register_handler(&kbd_handler);
 
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index afc6eda602f7..07e0b75f2338 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -374,7 +374,12 @@ scdrv_init(void)
         struct sysctl_data_s *scd;
         void *salbuf;
         dev_t first_dev, dev;
-        nasid_t event_nasid = ia64_sn_get_console_nasid();
+        nasid_t event_nasid;
+
+        if (!ia64_platform_is("sn2"))
+                return -ENODEV;
+
+        event_nasid = ia64_sn_get_console_nasid();
 
         if (alloc_chrdev_region(&first_dev, 0, num_cnodes,
                                 SYSCTL_BASENAME) < 0) {
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index d53f664a4dd8..fff89c2d88fd 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -45,7 +45,7 @@ config WATCHDOG_NOWAYOUT
 comment "Watchdog Device Drivers"
         depends on WATCHDOG
 
-# Architecture Independant
+# Architecture Independent
 
 config SOFT_WATCHDOG
         tristate "Software watchdog"
@@ -127,7 +127,7 @@ config S3C2410_WATCHDOG
           enabled.
 
           The driver is limited by the speed of the system's PCLK
-          signal, so with reasonbaly fast systems (PCLK around 50-66MHz)
+          signal, so with reasonably fast systems (PCLK around 50-66MHz)
           then watchdog intervals of over approximately 20seconds are
           unavailable.
 
@@ -423,7 +423,7 @@ config SBC_EPX_C3_WATCHDOG
           is no way to know if writing to its IO address will corrupt
           your system or have any real effect.  The only way to be sure
           that this driver does what you want is to make sure you
-          are runnning it on an EPX-C3 from Winsystems with the watchdog
+          are running it on an EPX-C3 from Winsystems with the watchdog
           timer at IO address 0x1ee and 0x1ef.  It will write to both those
           IO ports.  Basically, the assumption is made that if you compile
           this driver into your kernel and/or load it as a module, that you
@@ -472,7 +472,7 @@ config INDYDOG
         tristate "Indy/I2 Hardware Watchdog"
         depends on WATCHDOG && SGI_IP22
         help
-          Hardwaredriver for the Indy's/I2's watchdog. This is a
+          Hardware driver for the Indy's/I2's watchdog. This is a
           watchdog timer that will reboot the machine after a 60 second
           timer expired and no process has written to /dev/watchdog during
           that time.
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index bc1088d9b379..b3df613ae4ec 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -284,39 +284,69 @@ EXPORT_SYMBOL_GPL(cpufreq_notify_transition);
  *                          SYSFS INTERFACE                          *
  *********************************************************************/
 
+static struct cpufreq_governor *__find_governor(const char *str_governor)
+{
+        struct cpufreq_governor *t;
+
+        list_for_each_entry(t, &cpufreq_governor_list, governor_list)
+                if (!strnicmp(str_governor,t->name,CPUFREQ_NAME_LEN))
+                        return t;
+
+        return NULL;
+}
+
 /**
  * cpufreq_parse_governor - parse a governor string
  */
 static int cpufreq_parse_governor (char *str_governor, unsigned int *policy,
                                 struct cpufreq_governor **governor)
 {
+        int err = -EINVAL;
+
         if (!cpufreq_driver)
-                return -EINVAL;
+                goto out;
+
         if (cpufreq_driver->setpolicy) {
                 if (!strnicmp(str_governor, "performance", CPUFREQ_NAME_LEN)) {
                         *policy = CPUFREQ_POLICY_PERFORMANCE;
-                        return 0;
+                        err = 0;
                 } else if (!strnicmp(str_governor, "powersave", CPUFREQ_NAME_LEN)) {
                         *policy = CPUFREQ_POLICY_POWERSAVE;
-                        return 0;
+                        err = 0;
                 }
-                return -EINVAL;
-        } else {
+        } else if (cpufreq_driver->target) {
                 struct cpufreq_governor *t;
+
                 mutex_lock(&cpufreq_governor_mutex);
-                if (!cpufreq_driver || !cpufreq_driver->target)
-                        goto out;
-                list_for_each_entry(t, &cpufreq_governor_list, governor_list) {
-                        if (!strnicmp(str_governor,t->name,CPUFREQ_NAME_LEN)) {
-                                *governor = t;
+
+                t = __find_governor(str_governor);
+
+                if (t == NULL) {
+                        char *name = kasprintf(GFP_KERNEL, "cpufreq_%s", str_governor);
+
+                        if (name) {
+                                int ret;
+
                                 mutex_unlock(&cpufreq_governor_mutex);
-                                return 0;
+                                ret = request_module(name);
+                                mutex_lock(&cpufreq_governor_mutex);
+
+                                if (ret == 0)
+                                        t = __find_governor(str_governor);
                         }
+
+                        kfree(name);
                 }
-out:
+
+                if (t != NULL) {
+                        *governor = t;
+                        err = 0;
+                }
+
                 mutex_unlock(&cpufreq_governor_mutex);
         }
-        return -EINVAL;
+  out:
+        return err;
 }
 
 
@@ -1265,23 +1295,21 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 
 int cpufreq_register_governor(struct cpufreq_governor *governor)
 {
-        struct cpufreq_governor *t;
+        int err;
 
         if (!governor)
                 return -EINVAL;
 
         mutex_lock(&cpufreq_governor_mutex);
 
-        list_for_each_entry(t, &cpufreq_governor_list, governor_list) {
-                if (!strnicmp(governor->name,t->name,CPUFREQ_NAME_LEN)) {
-                        mutex_unlock(&cpufreq_governor_mutex);
-                        return -EBUSY;
-                }
+        err = -EBUSY;
+        if (__find_governor(governor->name) == NULL) {
+                err = 0;
+                list_add(&governor->governor_list, &cpufreq_governor_list);
         }
-        list_add(&governor->governor_list, &cpufreq_governor_list);
 
         mutex_unlock(&cpufreq_governor_mutex);
-        return 0;
+        return err;
 }
 EXPORT_SYMBOL_GPL(cpufreq_register_governor);
 
@@ -1343,6 +1371,11 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_poli
 
         memcpy(&policy->cpuinfo, &data->cpuinfo, sizeof(struct cpufreq_cpuinfo));
 
+        if (policy->min > data->min && policy->min > policy->max) {
+                ret = -EINVAL;
+                goto error_out;
+        }
+
         /* verify the cpu speed can be set within this limit */
         ret = cpufreq_driver->verify(policy);
         if (ret)
diff --git a/drivers/edac/edac_mc.h b/drivers/edac/edac_mc.h
index bf6ab8a8d5ed..a1cfd4e3c97d 100644
--- a/drivers/edac/edac_mc.h
+++ b/drivers/edac/edac_mc.h
@@ -29,6 +29,7 @@
 #include <linux/rcupdate.h>
 #include <linux/completion.h>
 #include <linux/kobject.h>
+#include <linux/platform_device.h>
 
 #define EDAC_MC_LABEL_LEN       31
 #define MC_PROC_NAME_MAX_LEN 7
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index ced309ff056f..eae9e81be375 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -232,7 +232,7 @@ static void scx200_acb_poll(struct scx200_acb_iface *iface)
         unsigned long timeout;
 
         timeout = jiffies + POLL_TIMEOUT;
-        while (time_before(jiffies, timeout)) {
+        while (1) {
                 status = inb(ACBST);
 
                 /* Reset the status register to avoid the hang */
@@ -242,7 +242,10 @@ static void scx200_acb_poll(struct scx200_acb_iface *iface)
                         scx200_acb_machine(iface, status);
                         return;
                 }
-                yield();
+                if (time_after(jiffies, timeout))
+                        break;
+                cpu_relax();
+                cond_resched();
         }
 
         dev_err(&iface->adapter.dev, "timeout in state %s\n",
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index 2f962cfa3f7f..78810ba982e9 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -180,6 +180,36 @@ static ide_pci_device_t generic_chipsets[] __devinitdata = {
                 .channels       = 2,
                 .autodma        = AUTODMA,
                 .bootable       = OFF_BOARD,
+        },{     /* 15 */
+                .name           = "JMB361",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 16 */
+                .name           = "JMB363",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 17 */
+                .name           = "JMB365",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 18 */
+                .name           = "JMB366",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
+        },{     /* 19 */
+                .name           = "JMB368",
+                .init_hwif      = init_hwif_generic,
+                .channels       = 2,
+                .autodma        = AUTODMA,
+                .bootable       = OFF_BOARD,
         }
 };
 
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index aaa74f293aaf..b08755e2e68f 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -2515,6 +2515,9 @@ static int sbp2scsi_slave_configure(struct scsi_device *sdev)
                 sdev->skip_ms_page_8 = 1;
         if (scsi_id->workarounds & SBP2_WORKAROUND_FIX_CAPACITY)
                 sdev->fix_capacity = 1;
+        if (scsi_id->ne->guid_vendor_id == 0x0010b9 && /* Maxtor's OUI */
+            (sdev->type == TYPE_DISK || sdev->type == TYPE_RBC))
+                sdev->allow_restart = 1;
         return 0;
 }
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index d294bbc42f09..1205e8027829 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -35,6 +35,7 @@
 #include <net/arp.h>
 #include <net/neighbour.h>
 #include <net/route.h>
+#include <net/netevent.h>
 #include <rdma/ib_addr.h>
 
 MODULE_AUTHOR("Sean Hefty");
@@ -326,25 +327,22 @@ void rdma_addr_cancel(struct rdma_dev_addr *addr)
 }
 EXPORT_SYMBOL(rdma_addr_cancel);
 
-static int addr_arp_recv(struct sk_buff *skb, struct net_device *dev,
-                         struct packet_type *pkt, struct net_device *orig_dev)
+static int netevent_callback(struct notifier_block *self, unsigned long event, 
+        void *ctx)
 {
-        struct arphdr *arp_hdr;
+        if (event == NETEVENT_NEIGH_UPDATE) {  
+                struct neighbour *neigh = ctx;
 
-        arp_hdr = (struct arphdr *) skb->nh.raw;
-
-        if (arp_hdr->ar_op == htons(ARPOP_REQUEST) ||
-            arp_hdr->ar_op == htons(ARPOP_REPLY))
-                set_timeout(jiffies);
-
-        kfree_skb(skb);
+                if (neigh->dev->type == ARPHRD_INFINIBAND &&
+                    (neigh->nud_state & NUD_VALID)) {
+                        set_timeout(jiffies);
+                }
+        }
         return 0;
 }
 
-static struct packet_type addr_arp = {
-        .type           = __constant_htons(ETH_P_ARP),
-        .func           = addr_arp_recv,
-        .af_packet_priv = (void*) 1,
+static struct notifier_block nb = {
+        .notifier_call = netevent_callback
 };
 
 static int addr_init(void)
@@ -353,13 +351,13 @@ static int addr_init(void)
         if (!addr_wq)
                 return -ENOMEM;
 
-        dev_add_pack(&addr_arp);
+        register_netevent_notifier(&nb);
         return 0;
 }
 
 static void addr_cleanup(void)
 {
-        dev_remove_pack(&addr_arp);
+        unregister_netevent_notifier(&nb);
         destroy_workqueue(addr_wq);
 }
 
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index f85c97f7500a..0de335b7bfc2 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -975,8 +975,10 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 
         cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
                                                             id.local_id);
-        if (IS_ERR(cm_id_priv->timewait_info))
+        if (IS_ERR(cm_id_priv->timewait_info)) {
+                ret = PTR_ERR(cm_id_priv->timewait_info);
                 goto out;
+        }
 
         ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
         if (ret)
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bb9bee56a824..102a59c033ff 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -42,6 +42,7 @@
 #include <linux/kref.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
+#include <linux/completion.h>
 
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
@@ -69,6 +70,7 @@
 
 struct ib_uverbs_device {
         struct kref                             ref;
+        struct completion                       comp;
         int                                     devnum;
         struct cdev                            *dev;
         struct class_device                    *class_dev;
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index e725cccc7cde..4e16314e8e6d 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -122,7 +122,7 @@ static void ib_uverbs_release_dev(struct kref *ref)
         struct ib_uverbs_device *dev =
                 container_of(ref, struct ib_uverbs_device, ref);
 
-        kfree(dev);
+        complete(&dev->comp);
 }
 
 void ib_uverbs_release_ucq(struct ib_uverbs_file *file,
@@ -740,6 +740,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
                 return;
 
         kref_init(&uverbs_dev->ref);
+        init_completion(&uverbs_dev->comp);
 
         spin_lock(&map_lock);
         uverbs_dev->devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -793,6 +794,8 @@ err_cdev:
 
 err:
         kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+        wait_for_completion(&uverbs_dev->comp);
+        kfree(uverbs_dev);
         return;
 }
 
@@ -812,7 +815,10 @@ static void ib_uverbs_remove_one(struct ib_device *device)
         spin_unlock(&map_lock);
 
         clear_bit(uverbs_dev->devnum, dev_map);
+
         kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+        wait_for_completion(&uverbs_dev->comp);
+        kfree(uverbs_dev);
 }
 
 static int uverbs_event_get_sb(struct file_system_type *fs_type, int flags,
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index 9ba3211cef7c..25157f57a6d0 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -108,14 +108,15 @@ void mthca_alloc_cleanup(struct mthca_alloc *alloc)
  * serialize access to the array.
  */
 
+#define MTHCA_ARRAY_MASK (PAGE_SIZE / sizeof (void *) - 1)
+
 void *mthca_array_get(struct mthca_array *array, int index)
 {
         int p = (index * sizeof (void *)) >> PAGE_SHIFT;
 
-        if (array->page_list[p].page) {
-                int i = index & (PAGE_SIZE / sizeof (void *) - 1);
-                return array->page_list[p].page[i];
-        } else
+        if (array->page_list[p].page)
+                return array->page_list[p].page[index & MTHCA_ARRAY_MASK];
+        else
                 return NULL;
 }
 
@@ -130,8 +131,7 @@ int mthca_array_set(struct mthca_array *array, int index, void *value)
         if (!array->page_list[p].page)
                 return -ENOMEM;
 
-        array->page_list[p].page[index & (PAGE_SIZE / sizeof (void *) - 1)] =
-                value;
+        array->page_list[p].page[index & MTHCA_ARRAY_MASK] = value;
         ++array->page_list[p].used;
 
         return 0;
@@ -144,7 +144,8 @@ void mthca_array_clear(struct mthca_array *array, int index)
         if (--array->page_list[p].used == 0) {
                 free_page((unsigned long) array->page_list[p].page);
                 array->page_list[p].page = NULL;
-        }
+        } else
+                array->page_list[p].page[index & MTHCA_ARRAY_MASK] = NULL;
 
         if (array->page_list[p].used < 0)
                 pr_debug("Array %p index %d page %d with ref count %d < 0\n",
diff --git a/drivers/infiniband/ulp/ipoib/Kconfig b/drivers/infiniband/ulp/ipoib/Kconfig
index 13d6d01c72c0..d74653d7de1c 100644
--- a/drivers/infiniband/ulp/ipoib/Kconfig
+++ b/drivers/infiniband/ulp/ipoib/Kconfig
@@ -6,8 +6,7 @@ config INFINIBAND_IPOIB
           transports IP packets over InfiniBand so you can use your IB
           device as a fancy NIC.
 
-          The IPoIB protocol is defined by the IETF ipoib working
-          group: <http://www.ietf.org/html.charters/ipoib-charter.html>.
+          See Documentation/infiniband/ipoib.txt for more information
 
 config INFINIBAND_IPOIB_DEBUG
         bool "IP-over-InfiniBand debugging" if EMBEDDED
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 8f472e7113b4..8257d5a2c8f8 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -77,6 +77,14 @@ MODULE_PARM_DESC(topspin_workarounds,
 
 static const u8 topspin_oui[3] = { 0x00, 0x05, 0xad };
 
+static int mellanox_workarounds = 1;
+
+module_param(mellanox_workarounds, int, 0444);
+MODULE_PARM_DESC(mellanox_workarounds,
+                 "Enable workarounds for Mellanox SRP target bugs if != 0");
+
+static const u8 mellanox_oui[3] = { 0x00, 0x02, 0xc9 };
+
 static void srp_add_one(struct ib_device *device);
 static void srp_remove_one(struct ib_device *device);
 static void srp_completion(struct ib_cq *cq, void *target_ptr);
@@ -526,8 +534,10 @@ static int srp_reconnect_target(struct srp_target_port *target)
         while (ib_poll_cq(target->cq, 1, &wc) > 0)
                 ; /* nothing */
 
+        spin_lock_irq(target->scsi_host->host_lock);
         list_for_each_entry_safe(req, tmp, &target->req_queue, list)
                 srp_reset_req(target, req);
+        spin_unlock_irq(target->scsi_host->host_lock);
 
         target->rx_head  = 0;
         target->tx_head  = 0;
@@ -567,7 +577,7 @@ err:
         return ret;
 }
 
-static int srp_map_fmr(struct srp_device *dev, struct scatterlist *scat,
+static int srp_map_fmr(struct srp_target_port *target, struct scatterlist *scat,
                        int sg_cnt, struct srp_request *req,
                        struct srp_direct_buf *buf)
 {
@@ -577,10 +587,15 @@ static int srp_map_fmr(struct srp_device *dev, struct scatterlist *scat,
         int page_cnt;
         int i, j;
         int ret;
+        struct srp_device *dev = target->srp_host->dev;
 
         if (!dev->fmr_pool)
                 return -ENODEV;
 
+        if ((sg_dma_address(&scat[0]) & ~dev->fmr_page_mask) &&
+            mellanox_workarounds && !memcmp(&target->ioc_guid, mellanox_oui, 3))
+                return -EINVAL;
+
         len = page_cnt = 0;
         for (i = 0; i < sg_cnt; ++i) {
                 if (sg_dma_address(&scat[i]) & ~dev->fmr_page_mask) {
@@ -683,7 +698,7 @@ static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_target_port *target,
                 buf->va  = cpu_to_be64(sg_dma_address(scat));
                 buf->key = cpu_to_be32(target->srp_host->dev->mr->rkey);
                 buf->len = cpu_to_be32(sg_dma_len(scat));
-        } else if (srp_map_fmr(target->srp_host->dev, scat, count, req,
+        } else if (srp_map_fmr(target, scat, count, req,
                                (void *) cmd->add_data)) {
                 /*
                  * FMR mapping failed, and the scatterlist has more
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index a29d5ceb00cf..4bf48188cc91 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -127,14 +127,10 @@ static int evdev_open(struct inode * inode, struct file * file)
 {
         struct evdev_list *list;
         int i = iminor(inode) - EVDEV_MINOR_BASE;
-        int accept_err;
 
         if (i >= EVDEV_MINORS || !evdev_table[i] || !evdev_table[i]->exist)
                 return -ENODEV;
 
-        if ((accept_err = input_accept_process(&(evdev_table[i]->handle), file)))
-                return accept_err;
-
         if (!(list = kzalloc(sizeof(struct evdev_list), GFP_KERNEL)))
                 return -ENOMEM;
 
@@ -260,7 +256,7 @@ static ssize_t evdev_write(struct file * file, const char __user * buffer, size_
 
                 if (evdev_event_from_user(buffer + retval, &event))
                         return -EFAULT;
-                input_event(list->evdev->handle.dev, event.type, event.code, event.value);
+                input_inject_event(&list->evdev->handle, event.type, event.code, event.value);
                 retval += evdev_event_size();
         }
 
@@ -428,8 +424,8 @@ static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
                         if (get_user(v, ip + 1))
                                 return -EFAULT;
 
-                        input_event(dev, EV_REP, REP_DELAY, u);
-                        input_event(dev, EV_REP, REP_PERIOD, v);
+                        input_inject_event(&evdev->handle, EV_REP, REP_DELAY, u);
+                        input_inject_event(&evdev->handle, EV_REP, REP_PERIOD, v);
 
                         return 0;
 
diff --git a/drivers/input/gameport/fm801-gp.c b/drivers/input/gameport/fm801-gp.c
index 47e93daa0fa7..90de5afe03c2 100644
--- a/drivers/input/gameport/fm801-gp.c
+++ b/drivers/input/gameport/fm801-gp.c
@@ -106,10 +106,10 @@ static int __devinit fm801_gp_probe(struct pci_dev *pci, const struct pci_device
         gp->gameport = port;
         gp->res_port = request_region(port->io, 0x10, "FM801 GP");
         if (!gp->res_port) {
-                kfree(gp);
-                gameport_free_port(port);
                 printk(KERN_DEBUG "fm801-gp: unable to grab region 0x%x-0x%x\n",
                         port->io, port->io + 0x0f);
+                gameport_free_port(port);
+                kfree(gp);
                 return -EBUSY;
         }
 
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index 36644bff379d..3f47ae55c6f3 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -53,6 +53,7 @@ static LIST_HEAD(gameport_list);
 
 static struct bus_type gameport_bus;
 
+static void gameport_add_driver(struct gameport_driver *drv);
 static void gameport_add_port(struct gameport *gameport);
 static void gameport_destroy_port(struct gameport *gameport);
 static void gameport_reconnect_port(struct gameport *gameport);
@@ -211,8 +212,14 @@ static void gameport_release_driver(struct gameport *gameport)
 
 static void gameport_find_driver(struct gameport *gameport)
 {
+        int error;
+
         down_write(&gameport_bus.subsys.rwsem);
-        device_attach(&gameport->dev);
+        error = device_attach(&gameport->dev);
+        if (error < 0)
+                printk(KERN_WARNING
+                        "gameport: device_attach() failed for %s (%s), error: %d\n",
+                        gameport->phys, gameport->name, error);
         up_write(&gameport_bus.subsys.rwsem);
 }
 
@@ -316,7 +323,6 @@ static void gameport_remove_duplicate_events(struct gameport_event *event)
         spin_unlock_irqrestore(&gameport_event_lock, flags);
 }
 
-
 static struct gameport_event *gameport_get_event(void)
 {
         struct gameport_event *event;
@@ -342,7 +348,6 @@ static struct gameport_event *gameport_get_event(void)
 static void gameport_handle_event(void)
 {
         struct gameport_event *event;
-        struct gameport_driver *gameport_drv;
 
         mutex_lock(&gameport_mutex);
 
@@ -369,8 +374,7 @@ static void gameport_handle_event(void)
                                 break;
 
                         case GAMEPORT_REGISTER_DRIVER:
-                                gameport_drv = event->object;
-                                driver_register(&gameport_drv->driver);
+                                gameport_add_driver(event->object);
                                 break;
 
                         default:
@@ -532,6 +536,7 @@ static void gameport_init_port(struct gameport *gameport)
         if (gameport->parent)
                 gameport->dev.parent = &gameport->parent->dev;
 
+        INIT_LIST_HEAD(&gameport->node);
         spin_lock_init(&gameport->timer_lock);
         init_timer(&gameport->poll_timer);
         gameport->poll_timer.function = gameport_run_poll_handler;
@@ -544,6 +549,8 @@ static void gameport_init_port(struct gameport *gameport)
  */
 static void gameport_add_port(struct gameport *gameport)
 {
+        int error;
+
         if (gameport->parent)
                 gameport->parent->child = gameport;
 
@@ -558,8 +565,13 @@ static void gameport_add_port(struct gameport *gameport)
                 printk(KERN_INFO "gameport: %s is %s, speed %dkHz\n",
                         gameport->name, gameport->phys, gameport->speed);
 
-        device_add(&gameport->dev);
-        gameport->registered = 1;
+        error = device_add(&gameport->dev);
+        if (error)
+                printk(KERN_ERR
+                        "gameport: device_add() failed for %s (%s), error: %d\n",
+                        gameport->phys, gameport->name, error);
+        else
+                gameport->registered = 1;
 }
 
 /*
@@ -583,10 +595,11 @@ static void gameport_destroy_port(struct gameport *gameport)
 
         if (gameport->registered) {
                 device_del(&gameport->dev);
-                list_del_init(&gameport->node);
                 gameport->registered = 0;
         }
 
+        list_del_init(&gameport->node);
+
         gameport_remove_pending_events(gameport);
         put_device(&gameport->dev);
 }
@@ -704,11 +717,22 @@ static int gameport_driver_remove(struct device *dev)
 }
 
 static struct bus_type gameport_bus = {
-        .name = "gameport",
-        .probe = gameport_driver_probe,
-        .remove = gameport_driver_remove,
+        .name   = "gameport",
+        .probe  = gameport_driver_probe,
+        .remove = gameport_driver_remove,
 };
 
+static void gameport_add_driver(struct gameport_driver *drv)
+{
+        int error;
+
+        error = driver_register(&drv->driver);
+        if (error)
+                printk(KERN_ERR
+                        "gameport: driver_register() failed for %s, error: %d\n",
+                        drv->driver.name, error);
+}
+
 void __gameport_register_driver(struct gameport_driver *drv, struct module *owner)
 {
         drv->driver.bus = &gameport_bus;
@@ -778,16 +802,24 @@ void gameport_close(struct gameport *gameport)
 
 static int __init gameport_init(void)
 {
-        gameport_task = kthread_run(gameport_thread, NULL, "kgameportd");
-        if (IS_ERR(gameport_task)) {
-                printk(KERN_ERR "gameport: Failed to start kgameportd\n");
-                return PTR_ERR(gameport_task);
-        }
+        int error;
 
         gameport_bus.dev_attrs = gameport_device_attrs;
         gameport_bus.drv_attrs = gameport_driver_attrs;
         gameport_bus.match = gameport_bus_match;
-        bus_register(&gameport_bus);
+        error = bus_register(&gameport_bus);
+        if (error) {
+                printk(KERN_ERR "gameport: failed to register gameport bus, error: %d\n", error);
+                return error;
+        }
+
+        gameport_task = kthread_run(gameport_thread, NULL, "kgameportd");
+        if (IS_ERR(gameport_task)) {
+                bus_unregister(&gameport_bus);
+                error = PTR_ERR(gameport_task);
+                printk(KERN_ERR "gameport: Failed to start kgameportd, error: %d\n", error);
+                return error;
+        }
 
         return 0;
 }
diff --git a/drivers/input/input.c b/drivers/input/input.c
index a90486f5e491..9cb4b9a54f01 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -35,6 +35,16 @@ static LIST_HEAD(input_handler_list);
 
 static struct input_handler *input_table[8];
 
+/**
+ * input_event() - report new input event
+ * @handle: device that generated the event
+ * @type: type of the event
+ * @code: event code
+ * @value: value of the event
+ *
+ * This function should be used by drivers implementing various input devices
+ * See also input_inject_event()
+ */
 void input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 {
         struct input_handle *handle;
@@ -183,6 +193,23 @@ void input_event(struct input_dev *dev, unsigned int type, unsigned int code, in
 }
 EXPORT_SYMBOL(input_event);
 
+/**
+ * input_inject_event() - send input event from input handler
+ * @handle: input handle to send event through
+ * @type: type of the event
+ * @code: event code
+ * @value: value of the event
+ *
+ * Similar to input_event() but will ignore event if device is "grabbed" and handle
+ * injecting event is not the one that owns the device.
+ */
+void input_inject_event(struct input_handle *handle, unsigned int type, unsigned int code, int value)
+{
+        if (!handle->dev->grab || handle->dev->grab == handle)
+                input_event(handle->dev, type, code, value);
+}
+EXPORT_SYMBOL(input_inject_event);
+
 static void input_repeat_key(unsigned long data)
 {
         struct input_dev *dev = (void *) data;
@@ -197,15 +224,6 @@ static void input_repeat_key(unsigned long data)
                 mod_timer(&dev->timer, jiffies + msecs_to_jiffies(dev->rep[REP_PERIOD]));
 }
 
-int input_accept_process(struct input_handle *handle, struct file *file)
-{
-        if (handle->dev->accept)
-                return handle->dev->accept(handle->dev, file);
-
-        return 0;
-}
-EXPORT_SYMBOL(input_accept_process);
-
 int input_grab_device(struct input_handle *handle)
 {
         if (handle->dev->grab)
@@ -218,8 +236,15 @@ EXPORT_SYMBOL(input_grab_device);
 
 void input_release_device(struct input_handle *handle)
 {
-        if (handle->dev->grab == handle)
-                handle->dev->grab = NULL;
+        struct input_dev *dev = handle->dev;
+
+        if (dev->grab == handle) {
+                dev->grab = NULL;
+
+                list_for_each_entry(handle, &dev->h_list, d_node)
+                        if (handle->handler->start)
+                                handle->handler->start(handle);
+        }
 }
 EXPORT_SYMBOL(input_release_device);
 
@@ -963,8 +988,11 @@ int input_register_device(struct input_dev *dev)
         list_for_each_entry(handler, &input_handler_list, node)
                 if (!handler->blacklist || !input_match_device(handler->blacklist, dev))
                         if ((id = input_match_device(handler->id_table, dev)))
-                                if ((handle = handler->connect(handler, dev, id)))
+                                if ((handle = handler->connect(handler, dev, id))) {
                                         input_link_handle(handle);
+                                        if (handler->start)
+                                                handler->start(handle);
+                                }
 
         input_wakeup_procfs_readers();
 
@@ -1028,8 +1056,11 @@ void input_register_handler(struct input_handler *handler)
         list_for_each_entry(dev, &input_dev_list, node)
                 if (!handler->blacklist || !input_match_device(handler->blacklist, dev))
                         if ((id = input_match_device(handler->id_table, dev)))
-                                if ((handle = handler->connect(handler, dev, id)))
+                                if ((handle = handler->connect(handler, dev, id))) {
                                         input_link_handle(handle);
+                                        if (handler->start)
+                                                handler->start(handle);
+                                }
 
         input_wakeup_procfs_readers();
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index 6d99e3c37884..b4914e7231f8 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -79,6 +79,7 @@ static struct iforce_device iforce_device[] = {
         { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
+        { 0x06d6, 0x29bc, "Trust Force Feedback Race Master",           btn_wheel, abs_wheel, ff_iforce },
         { 0x0000, 0x0000, "Unknown I-Force Device [%04x:%04x]",         btn_joystick, abs_joystick, ff_iforce }
 };
 
@@ -222,22 +223,22 @@ static int iforce_erase_effect(struct input_dev *dev, int effect_id)
         int err = 0;
         struct iforce_core_effect* core_effect;
 
-        /* Check who is trying to erase this effect */
-        if (iforce->core_effects[effect_id].owner != current->pid) {
-                printk(KERN_WARNING "iforce-main.c: %d tried to erase an effect belonging to %d\n", current->pid, iforce->core_effects[effect_id].owner);
-                return -EACCES;
-        }
-
         if (effect_id < 0 || effect_id >= FF_EFFECTS_MAX)
                 return -EINVAL;
 
-        core_effect = iforce->core_effects + effect_id;
+        core_effect = &iforce->core_effects[effect_id];
+
+        /* Check who is trying to erase this effect */
+        if (core_effect->owner != current->pid) {
+                printk(KERN_WARNING "iforce-main.c: %d tried to erase an effect belonging to %d\n", current->pid, core_effect->owner);
+                return -EACCES;
+        }
 
         if (test_bit(FF_MOD1_IS_USED, core_effect->flags))
-                err = release_resource(&(iforce->core_effects[effect_id].mod1_chunk));
+                err = release_resource(&core_effect->mod1_chunk);
 
         if (!err && test_bit(FF_MOD2_IS_USED, core_effect->flags))
-                err = release_resource(&(iforce->core_effects[effect_id].mod2_chunk));
+                err = release_resource(&core_effect->mod2_chunk);
 
         /*TODO: remember to change that if more FF_MOD* bits are added */
         core_effect->flags[0] = 0;
diff --git a/drivers/input/joystick/spaceball.c b/drivers/input/joystick/spaceball.c
index 75eb5ca59992..7a19ee052972 100644
--- a/drivers/input/joystick/spaceball.c
+++ b/drivers/input/joystick/spaceball.c
@@ -50,7 +50,7 @@ MODULE_LICENSE("GPL");
  */
 
 #define SPACEBALL_MAX_LENGTH    128
-#define SPACEBALL_MAX_ID        8
+#define SPACEBALL_MAX_ID        9
 
 #define SPACEBALL_1003      1
 #define SPACEBALL_2003B     3
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index ce1f10e8984b..6bfa0cf4b1d2 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -482,13 +482,7 @@ out:
         return IRQ_HANDLED;
 }
 
-/*
- * atkbd_event_work() is used to complete processing of events that
- * can not be processed by input_event() which is often called from
- * interrupt context.
- */
-
-static void atkbd_event_work(void *data)
+static int atkbd_set_repeat_rate(struct atkbd *atkbd)
 {
         const short period[32] =
                 { 33,  37,  42,  46,  50,  54,  58,  63,  67,  75,  83,  92, 100, 109, 116, 125,
@@ -496,41 +490,64 @@ static void atkbd_event_work(void *data)
         const short delay[4] =
                 { 250, 500, 750, 1000 };
 
-        struct atkbd *atkbd = data;
+        struct input_dev *dev = atkbd->dev;
+        unsigned char param;
+        int i = 0, j = 0;
+
+        while (i < ARRAY_SIZE(period) - 1 && period[i] < dev->rep[REP_PERIOD])
+                i++;
+        dev->rep[REP_PERIOD] = period[i];
+
+        while (j < ARRAY_SIZE(period) - 1 && delay[j] < dev->rep[REP_DELAY])
+                j++;
+        dev->rep[REP_DELAY] = delay[j];
+
+        param = i | (j << 5);
+        return ps2_command(&atkbd->ps2dev, &param, ATKBD_CMD_SETREP);
+}
+
+static int atkbd_set_leds(struct atkbd *atkbd)
+{
         struct input_dev *dev = atkbd->dev;
         unsigned char param[2];
-        int i, j;
 
-        mutex_lock(&atkbd->event_mutex);
+        param[0] = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
+                 | (test_bit(LED_NUML,    dev->led) ? 2 : 0)
+                 | (test_bit(LED_CAPSL,   dev->led) ? 4 : 0);
+        if (ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETLEDS))
+                return -1;
 
-        if (test_and_clear_bit(ATKBD_LED_EVENT_BIT, &atkbd->event_mask)) {
-                param[0] = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
-                         | (test_bit(LED_NUML,    dev->led) ? 2 : 0)
-                         | (test_bit(LED_CAPSL,   dev->led) ? 4 : 0);
-                ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETLEDS);
-
-                if (atkbd->extra) {
-                        param[0] = 0;
-                        param[1] = (test_bit(LED_COMPOSE, dev->led) ? 0x01 : 0)
-                                 | (test_bit(LED_SLEEP,   dev->led) ? 0x02 : 0)
-                                 | (test_bit(LED_SUSPEND, dev->led) ? 0x04 : 0)
-                                 | (test_bit(LED_MISC,    dev->led) ? 0x10 : 0)
-                                 | (test_bit(LED_MUTE,    dev->led) ? 0x20 : 0);
-                        ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_EX_SETLEDS);
-                }
+        if (atkbd->extra) {
+                param[0] = 0;
+                param[1] = (test_bit(LED_COMPOSE, dev->led) ? 0x01 : 0)
+                         | (test_bit(LED_SLEEP,   dev->led) ? 0x02 : 0)
+                         | (test_bit(LED_SUSPEND, dev->led) ? 0x04 : 0)
+                         | (test_bit(LED_MISC,    dev->led) ? 0x10 : 0)
+                         | (test_bit(LED_MUTE,    dev->led) ? 0x20 : 0);
+                if (ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_EX_SETLEDS))
+                        return -1;
         }
 
-        if (test_and_clear_bit(ATKBD_REP_EVENT_BIT, &atkbd->event_mask)) {
-                i = j = 0;
-                while (i < 31 && period[i] < dev->rep[REP_PERIOD])
-                        i++;
-                while (j < 3 && delay[j] < dev->rep[REP_DELAY])
-                        j++;
-                dev->rep[REP_PERIOD] = period[i];
-                dev->rep[REP_DELAY] = delay[j];
-                param[0] = i | (j << 5);
-                ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETREP);
-        }
+        return 0;
+}
+
+/*
+ * atkbd_event_work() is used to complete processing of events that
+ * can not be processed by input_event() which is often called from
+ * interrupt context.
+ */
+
+static void atkbd_event_work(void *data)
+{
+        struct atkbd *atkbd = data;
+
+        mutex_lock(&atkbd->event_mutex);
+
+        if (test_and_clear_bit(ATKBD_LED_EVENT_BIT, &atkbd->event_mask))
+                atkbd_set_leds(atkbd);
+
+        if (test_and_clear_bit(ATKBD_REP_EVENT_BIT, &atkbd->event_mask))
+                atkbd_set_repeat_rate(atkbd);
 
         mutex_unlock(&atkbd->event_mutex);
 }
@@ -975,7 +992,6 @@ static int atkbd_reconnect(struct serio *serio)
 {
         struct atkbd *atkbd = serio_get_drvdata(serio);
         struct serio_driver *drv = serio->drv;
-        unsigned char param[1];
 
         if (!atkbd || !drv) {
                 printk(KERN_DEBUG "atkbd: reconnect request, but serio is disconnected, ignoring...\n");
@@ -985,10 +1001,6 @@ static int atkbd_reconnect(struct serio *serio)
         atkbd_disable(atkbd);
 
         if (atkbd->write) {
-                param[0] = (test_bit(LED_SCROLLL, atkbd->dev->led) ? 1 : 0)
-                         | (test_bit(LED_NUML,    atkbd->dev->led) ? 2 : 0)
-                         | (test_bit(LED_CAPSL,   atkbd->dev->led) ? 4 : 0);
-
                 if (atkbd_probe(atkbd))
                         return -1;
                 if (atkbd->set != atkbd_select_set(atkbd, atkbd->set, atkbd->extra))
@@ -996,8 +1008,13 @@ static int atkbd_reconnect(struct serio *serio)
 
                 atkbd_activate(atkbd);
 
-                if (ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETLEDS))
-                        return -1;
+/*
+ * Restore repeat rate and LEDs (that were reset by atkbd_activate)
+ * to pre-resume state
+ */
+                if (!atkbd->softrepeat)
+                        atkbd_set_repeat_rate(atkbd);
+                atkbd_set_leds(atkbd);
         }
 
         atkbd_enable(atkbd);
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index ccf0faeee5c1..a8efc1af36cb 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -94,7 +94,7 @@ static void call_bios(struct regs *regs)
 
 static ssize_t __init locate_wistron_bios(void __iomem *base)
 {
-        static const unsigned char __initdata signature[] =
+        static unsigned char __initdata signature[] =
                 { 0x42, 0x21, 0x55, 0x30 };
         ssize_t offset;
 
@@ -259,11 +259,11 @@ static int __init dmi_matched(struct dmi_system_id *dmi)
         return 1;
 }
 
-static struct key_entry keymap_empty[] = {
+static struct key_entry keymap_empty[] __initdata = {
         { KE_END, 0 }
 };
 
-static struct key_entry keymap_fs_amilo_pro_v2000[] = {
+static struct key_entry keymap_fs_amilo_pro_v2000[] __initdata = {
         { KE_KEY,  0x01, KEY_HELP },
         { KE_KEY,  0x11, KEY_PROG1 },
         { KE_KEY,  0x12, KEY_PROG2 },
@@ -273,7 +273,7 @@ static struct key_entry keymap_fs_amilo_pro_v2000[] = {
         { KE_END,  0 }
 };
 
-static struct key_entry keymap_fujitsu_n3510[] = {
+static struct key_entry keymap_fujitsu_n3510[] __initdata = {
         { KE_KEY, 0x11, KEY_PROG1 },
         { KE_KEY, 0x12, KEY_PROG2 },
         { KE_KEY, 0x36, KEY_WWW },
@@ -285,7 +285,7 @@ static struct key_entry keymap_fujitsu_n3510[] = {
         { KE_END, 0 }
 };
 
-static struct key_entry keymap_wistron_ms2111[] = {
+static struct key_entry keymap_wistron_ms2111[] __initdata = {
         { KE_KEY,  0x11, KEY_PROG1 },
         { KE_KEY,  0x12, KEY_PROG2 },
         { KE_KEY,  0x13, KEY_PROG3 },
@@ -294,7 +294,7 @@ static struct key_entry keymap_wistron_ms2111[] = {
         { KE_END,  0 }
 };
 
-static struct key_entry keymap_wistron_ms2141[] = {
+static struct key_entry keymap_wistron_ms2141[] __initdata = {
         { KE_KEY,  0x11, KEY_PROG1 },
         { KE_KEY,  0x12, KEY_PROG2 },
         { KE_WIFI, 0x30, 0 },
@@ -307,7 +307,7 @@ static struct key_entry keymap_wistron_ms2141[] = {
         { KE_END,  0 }
 };
 
-static struct key_entry keymap_acer_aspire_1500[] = {
+static struct key_entry keymap_acer_aspire_1500[] __initdata = {
         { KE_KEY, 0x11, KEY_PROG1 },
         { KE_KEY, 0x12, KEY_PROG2 },
         { KE_WIFI, 0x30, 0 },
@@ -317,7 +317,7 @@ static struct key_entry keymap_acer_aspire_1500[] = {
         { KE_END, 0 }
 };
 
-static struct key_entry keymap_acer_travelmate_240[] = {
+static struct key_entry keymap_acer_travelmate_240[] __initdata = {
         { KE_KEY, 0x31, KEY_MAIL },
         { KE_KEY, 0x36, KEY_WWW },
         { KE_KEY, 0x11, KEY_PROG1 },
@@ -327,7 +327,7 @@ static struct key_entry keymap_acer_travelmate_240[] = {
         { KE_END, 0 }
 };
 
-static struct key_entry keymap_aopen_1559as[] = {
+static struct key_entry keymap_aopen_1559as[] __initdata = {
         { KE_KEY,  0x01, KEY_HELP },
         { KE_KEY,  0x06, KEY_PROG3 },
         { KE_KEY,  0x11, KEY_PROG1 },
@@ -343,7 +343,7 @@ static struct key_entry keymap_aopen_1559as[] = {
  * a list of buttons and their key codes (reported when loading this module
  * with force=1) and the output of dmidecode to $MODULE_AUTHOR.
  */
-static struct dmi_system_id dmi_ids[] = {
+static struct dmi_system_id dmi_ids[] __initdata = {
         {
                 .callback = dmi_matched,
                 .ident = "Fujitsu-Siemens Amilo Pro V2000",
diff --git a/drivers/input/mouse/logips2pp.c b/drivers/input/mouse/logips2pp.c
index 2f0d28840810..54b696cfe1e3 100644
--- a/drivers/input/mouse/logips2pp.c
+++ b/drivers/input/mouse/logips2pp.c
@@ -238,8 +238,7 @@ static struct ps2pp_info *get_model_info(unsigned char model)
                 { 100,  PS2PP_KIND_MX,                                  /* MX510 */
                                 PS2PP_WHEEL | PS2PP_SIDE_BTN | PS2PP_TASK_BTN |
                                 PS2PP_EXTRA_BTN | PS2PP_NAV_BTN },
-                { 111,  PS2PP_KIND_MX,                                  /* MX300 */
-                                PS2PP_WHEEL | PS2PP_EXTRA_BTN | PS2PP_TASK_BTN },
+                { 111,  PS2PP_KIND_MX,  PS2PP_WHEEL | PS2PP_SIDE_BTN }, /* MX300 reports task button as side */
                 { 112,  PS2PP_KIND_MX,                                  /* MX500 */
                                 PS2PP_WHEEL | PS2PP_SIDE_BTN | PS2PP_TASK_BTN |
                                 PS2PP_EXTRA_BTN | PS2PP_NAV_BTN },
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index 6d9ec9ab1b90..ae5871a0e060 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -183,21 +183,26 @@ static struct attribute_group trackpoint_attr_group = {
         .attrs = trackpoint_attrs,
 };
 
-static void trackpoint_disconnect(struct psmouse *psmouse)
+static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *firmware_id)
 {
-        sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj, &trackpoint_attr_group);
+        unsigned char param[2] = { 0 };
 
-        kfree(psmouse->private);
-        psmouse->private = NULL;
+        if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
+                return -1;
+
+        if (param[0] != TP_MAGIC_IDENT)
+                return -1;
+
+        if (firmware_id)
+                *firmware_id = param[1];
+
+        return 0;
 }
 
 static int trackpoint_sync(struct psmouse *psmouse)
 {
-        unsigned char toggle;
         struct trackpoint_data *tp = psmouse->private;
-
-        if (!tp)
-                return -1;
+        unsigned char toggle;
 
         /* Disable features that may make device unusable with this driver */
         trackpoint_read(&psmouse->ps2dev, TP_TOGGLE_TWOHAND, &toggle);
@@ -263,27 +268,38 @@ static void trackpoint_defaults(struct trackpoint_data *tp)
         tp->ext_dev = TP_DEF_EXT_DEV;
 }
 
+static void trackpoint_disconnect(struct psmouse *psmouse)
+{
+        sysfs_remove_group(&psmouse->ps2dev.serio->dev.kobj, &trackpoint_attr_group);
+
+        kfree(psmouse->private);
+        psmouse->private = NULL;
+}
+
+static int trackpoint_reconnect(struct psmouse *psmouse)
+{
+        if (trackpoint_start_protocol(psmouse, NULL))
+                return -1;
+
+        if (trackpoint_sync(psmouse))
+                return -1;
+
+        return 0;
+}
+
 int trackpoint_detect(struct psmouse *psmouse, int set_properties)
 {
         struct trackpoint_data *priv;
         struct ps2dev *ps2dev = &psmouse->ps2dev;
         unsigned char firmware_id;
         unsigned char button_info;
-        unsigned char param[2];
-
-        param[0] = param[1] = 0;
 
-        if (ps2_command(ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
-                return -1;
-
-        if (param[0] != TP_MAGIC_IDENT)
+        if (trackpoint_start_protocol(psmouse, &firmware_id))
                 return -1;
 
         if (!set_properties)
                 return 0;
 
-        firmware_id = param[1];
-
         if (trackpoint_read(&psmouse->ps2dev, TP_EXT_BTN, &button_info)) {
                 printk(KERN_WARNING "trackpoint.c: failed to get extended button data\n");
                 button_info = 0;
@@ -296,7 +312,7 @@ int trackpoint_detect(struct psmouse *psmouse, int set_properties)
         psmouse->vendor = "IBM";
         psmouse->name = "TrackPoint";
 
-        psmouse->reconnect = trackpoint_sync;
+        psmouse->reconnect = trackpoint_reconnect;
         psmouse->disconnect = trackpoint_disconnect;
 
         trackpoint_defaults(priv);
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index 61a6f977846f..ed202f2f251a 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -177,6 +177,11 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
                 return -1;
         }
 
+        if (send && !param) {
+                WARN_ON(1);
+                return -1;
+        }
+
         mutex_lock_nested(&ps2dev->cmd_mutex, SINGLE_DEPTH_NESTING);
 
         serio_pause_rx(ps2dev->serio);
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 6521034bc933..3e76ad71c9a0 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -62,6 +62,7 @@ static LIST_HEAD(serio_list);
 
 static struct bus_type serio_bus;
 
+static void serio_add_driver(struct serio_driver *drv);
 static void serio_add_port(struct serio *serio);
 static void serio_destroy_port(struct serio *serio);
 static void serio_reconnect_port(struct serio *serio);
@@ -140,8 +141,14 @@ static void serio_release_driver(struct serio *serio)
 
 static void serio_find_driver(struct serio *serio)
 {
+        int error;
+
         down_write(&serio_bus.subsys.rwsem);
-        device_attach(&serio->dev);
+        error = device_attach(&serio->dev);
+        if (error < 0)
+                printk(KERN_WARNING
+                        "serio: device_attach() failed for %s (%s), error: %d\n",
+                        serio->phys, serio->name, error);
         up_write(&serio_bus.subsys.rwsem);
 }
 
@@ -272,7 +279,6 @@ static struct serio_event *serio_get_event(void)
 static void serio_handle_event(void)
 {
         struct serio_event *event;
-        struct serio_driver *serio_drv;
 
         mutex_lock(&serio_mutex);
 
@@ -304,8 +310,7 @@ static void serio_handle_event(void)
                                 break;
 
                         case SERIO_REGISTER_DRIVER:
-                                serio_drv = event->object;
-                                driver_register(&serio_drv->driver);
+                                serio_add_driver(event->object);
                                 break;
 
                         default:
@@ -525,6 +530,7 @@ static void serio_init_port(struct serio *serio)
 
         __module_get(THIS_MODULE);
 
+        INIT_LIST_HEAD(&serio->node);
         spin_lock_init(&serio->lock);
         mutex_init(&serio->drv_mutex);
         device_initialize(&serio->dev);
@@ -542,6 +548,8 @@ static void serio_init_port(struct serio *serio)
  */
 static void serio_add_port(struct serio *serio)
 {
+        int error;
+
         if (serio->parent) {
                 serio_pause_rx(serio->parent);
                 serio->parent->child = serio;
@@ -551,9 +559,19 @@ static void serio_add_port(struct serio *serio)
         list_add_tail(&serio->node, &serio_list);
         if (serio->start)
                 serio->start(serio);
-        device_add(&serio->dev);
-        sysfs_create_group(&serio->dev.kobj, &serio_id_attr_group);
-        serio->registered = 1;
+        error = device_add(&serio->dev);
+        if (error)
+                printk(KERN_ERR
+                        "serio: device_add() failed for %s (%s), error: %d\n",
+                        serio->phys, serio->name, error);
+        else {
+                serio->registered = 1;
+                error = sysfs_create_group(&serio->dev.kobj, &serio_id_attr_group);
+                if (error)
+                        printk(KERN_ERR
+                                "serio: sysfs_create_group() failed for %s (%s), error: %d\n",
+                                serio->phys, serio->name, error);
+        }
 }
 
 /*
@@ -583,10 +601,10 @@ static void serio_destroy_port(struct serio *serio)
         if (serio->registered) {
                 sysfs_remove_group(&serio->dev.kobj, &serio_id_attr_group);
                 device_del(&serio->dev);
-                list_del_init(&serio->node);
                 serio->registered = 0;
         }
 
+        list_del_init(&serio->node);
         serio_remove_pending_events(serio);
         put_device(&serio->dev);
 }
@@ -756,6 +774,17 @@ static struct bus_type serio_bus = {
         .remove = serio_driver_remove,
 };
 
+static void serio_add_driver(struct serio_driver *drv)
+{
+        int error;
+
+        error = driver_register(&drv->driver);
+        if (error)
+                printk(KERN_ERR
+                        "serio: driver_register() failed for %s, error: %d\n",
+                        drv->driver.name, error);
+}
+
 void __serio_register_driver(struct serio_driver *drv, struct module *owner)
 {
         drv->driver.bus = &serio_bus;
@@ -903,18 +932,26 @@ irqreturn_t serio_interrupt(struct serio *serio,
 
 static int __init serio_init(void)
 {
-        serio_task = kthread_run(serio_thread, NULL, "kseriod");
-        if (IS_ERR(serio_task)) {
-                printk(KERN_ERR "serio: Failed to start kseriod\n");
-                return PTR_ERR(serio_task);
-        }
+        int error;
 
         serio_bus.dev_attrs = serio_device_attrs;
         serio_bus.drv_attrs = serio_driver_attrs;
         serio_bus.match = serio_bus_match;
         serio_bus.uevent = serio_uevent;
         serio_bus.resume = serio_resume;
-        bus_register(&serio_bus);
+        error = bus_register(&serio_bus);
+        if (error) {
+                printk(KERN_ERR "serio: failed to register serio bus, error: %d\n", error);
+                return error;
+        }
+
+        serio_task = kthread_run(serio_thread, NULL, "kseriod");
+        if (IS_ERR(serio_task)) {
+                bus_unregister(&serio_bus);
+                error = PTR_ERR(serio_task);
+                printk(KERN_ERR "serio: Failed to start kseriod, error: %d\n", error);
+                return error;
+        }
 
         return 0;
 }
diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
index 0a5be7f969f2..af3eb9e795b5 100644
--- a/drivers/isdn/hardware/eicon/divasync.h
+++ b/drivers/isdn/hardware/eicon/divasync.h
@@ -256,7 +256,6 @@ typedef struct
 #define NO_ORDER_CHECK_MASK 0x00000010
 #define LOW_CHANNEL_MASK 0x00000020
 #define NO_HSCX30_MASK  0x00000040
-#define MODE_MASK   0x00000080
 #define SET_BOARD   0x00001000
 #define SET_CRC4   0x00030000
 #define SET_L1_TRISTATE  0x00040000
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 217615b33223..93f701ea87bc 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -710,6 +710,8 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
                 return -EINVAL;
         }
 
+        m->ti = ti;
+
         r = parse_features(&as, m, ti);
         if (r)
                 goto bad;
@@ -751,7 +753,6 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
         }
 
         ti->private = m;
-        m->ti = ti;
 
         return 0;
 
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index ff83c9b5979e..b99c19c7eb22 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -162,7 +162,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
                 goto out;
         }
 
-        min_spacing = mddev->array_size;
+        min_spacing = conf->array_size;
         sector_div(min_spacing, PAGE_SIZE/sizeof(struct dev_info *));
 
         /* min_spacing is the minimum spacing that will fit the hash
@@ -171,7 +171,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
          * that is larger than min_spacing as use the size of that as
          * the actual spacing
          */
-        conf->hash_spacing = mddev->array_size;
+        conf->hash_spacing = conf->array_size;
         for (i=0; i < cnt-1 ; i++) {
                 sector_t sz = 0;
                 int j;
@@ -228,7 +228,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
         curr_offset = 0;
         i = 0;
         for (curr_offset = 0;
-             curr_offset < mddev->array_size;
+             curr_offset < conf->array_size;
              curr_offset += conf->hash_spacing) {
 
                 while (i < mddev->raid_disks-1 &&
diff --git a/drivers/media/dvb/bt8xx/dst.c b/drivers/media/dvb/bt8xx/dst.c
index d687a14ec0a7..06ac899a9a26 100644
--- a/drivers/media/dvb/bt8xx/dst.c
+++ b/drivers/media/dvb/bt8xx/dst.c
@@ -393,7 +393,7 @@ static int dst_set_bandwidth(struct dst_state *state, fe_bandwidth_t bandwidth)
         state->bandwidth = bandwidth;
 
         if (state->dst_type != DST_TYPE_IS_TERR)
-                return 0;
+                return -EOPNOTSUPP;
 
         switch (bandwidth) {
         case BANDWIDTH_6_MHZ:
@@ -462,7 +462,7 @@ static int dst_set_symbolrate(struct dst_state *state, u32 srate)
 
         state->symbol_rate = srate;
         if (state->dst_type == DST_TYPE_IS_TERR) {
-                return 0;
+                return -EOPNOTSUPP;
         }
         dprintk(verbose, DST_INFO, 1, "set symrate %u", srate);
         srate /= 1000;
@@ -504,7 +504,7 @@ static int dst_set_symbolrate(struct dst_state *state, u32 srate)
 static int dst_set_modulation(struct dst_state *state, fe_modulation_t modulation)
 {
         if (state->dst_type != DST_TYPE_IS_CABLE)
-                return 0;
+                return -EOPNOTSUPP;
 
         state->modulation = modulation;
         switch (modulation) {
@@ -1234,7 +1234,7 @@ int dst_command(struct dst_state *state, u8 *data, u8 len)
                 goto error;
         }
         if (write_dst(state, data, len)) {
-                dprintk(verbose, DST_INFO, 1, "Tring to recover.. ");
+                dprintk(verbose, DST_INFO, 1, "Trying to recover.. ");
                 if ((dst_error_recovery(state)) < 0) {
                         dprintk(verbose, DST_ERROR, 1, "Recovery Failed.");
                         goto error;
@@ -1328,15 +1328,13 @@ static int dst_tone_power_cmd(struct dst_state *state)
 {
         u8 paket[8] = { 0x00, 0x09, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00 };
 
-        if (state->dst_type == DST_TYPE_IS_TERR)
-                return 0;
+        if (state->dst_type != DST_TYPE_IS_SAT)
+                return -EOPNOTSUPP;
         paket[4] = state->tx_tuna[4];
         paket[2] = state->tx_tuna[2];
         paket[3] = state->tx_tuna[3];
         paket[7] = dst_check_sum (paket, 7);
-        dst_command(state, paket, 8);
-
-        return 0;
+        return dst_command(state, paket, 8);
 }
 
 static int dst_get_tuna(struct dst_state *state)
@@ -1465,7 +1463,7 @@ static int dst_set_diseqc(struct dvb_frontend *fe, struct dvb_diseqc_master_cmd
         u8 paket[8] = { 0x00, 0x08, 0x04, 0xe0, 0x10, 0x38, 0xf0, 0xec };
 
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
         if (cmd->msg_len > 0 && cmd->msg_len < 5)
                 memcpy(&paket[3], cmd->msg, cmd->msg_len);
         else if (cmd->msg_len == 5 && state->dst_hw_cap & DST_TYPE_HAS_DISEQC5)
@@ -1473,18 +1471,17 @@ static int dst_set_diseqc(struct dvb_frontend *fe, struct dvb_diseqc_master_cmd
         else
                 return -EINVAL;
         paket[7] = dst_check_sum(&paket[0], 7);
-        dst_command(state, paket, 8);
-        return 0;
+        return dst_command(state, paket, 8);
 }
 
 static int dst_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
 {
-        int need_cmd;
+        int need_cmd, retval = 0;
         struct dst_state *state = fe->demodulator_priv;
 
         state->voltage = voltage;
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
 
         need_cmd = 0;
 
@@ -1506,9 +1503,9 @@ static int dst_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
         }
 
         if (need_cmd)
-                dst_tone_power_cmd(state);
+                retval = dst_tone_power_cmd(state);
 
-        return 0;
+        return retval;
 }
 
 static int dst_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
@@ -1517,7 +1514,7 @@ static int dst_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
 
         state->tone = tone;
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
 
         switch (tone) {
         case SEC_TONE_OFF:
@@ -1533,9 +1530,7 @@ static int dst_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
         default:
                 return -EINVAL;
         }
-        dst_tone_power_cmd(state);
-
-        return 0;
+        return dst_tone_power_cmd(state);
 }
 
 static int dst_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t minicmd)
@@ -1543,7 +1538,7 @@ static int dst_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t minicmd)
         struct dst_state *state = fe->demodulator_priv;
 
         if (state->dst_type != DST_TYPE_IS_SAT)
-                return 0;
+                return -EOPNOTSUPP;
         state->minicmd = minicmd;
         switch (minicmd) {
         case SEC_MINI_A:
@@ -1553,9 +1548,7 @@ static int dst_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t minicmd)
                 state->tx_tuna[3] = 0xff;
                 break;
         }
-        dst_tone_power_cmd(state);
-
-        return 0;
+        return dst_tone_power_cmd(state);
 }
 
 
@@ -1608,28 +1601,31 @@ static int dst_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
 {
         struct dst_state *state = fe->demodulator_priv;
 
-        dst_get_signal(state);
+        int retval = dst_get_signal(state);
         *strength = state->decode_strength;
 
-        return 0;
+        return retval;
 }
 
 static int dst_read_snr(struct dvb_frontend *fe, u16 *snr)
 {
         struct dst_state *state = fe->demodulator_priv;
 
-        dst_get_signal(state);
+        int retval = dst_get_signal(state);
         *snr = state->decode_snr;
 
-        return 0;
+        return retval;
 }
 
 static int dst_set_frontend(struct dvb_frontend *fe, struct dvb_frontend_parameters *p)
 {
+        int retval = -EINVAL;
         struct dst_state *state = fe->demodulator_priv;
 
         if (p != NULL) {
-                dst_set_freq(state, p->frequency);
+                retval = dst_set_freq(state, p->frequency);
+                if(retval != 0)
+                        return retval;
                 dprintk(verbose, DST_DEBUG, 1, "Set Frequency=[%d]", p->frequency);
 
                 if (state->dst_type == DST_TYPE_IS_SAT) {
@@ -1647,10 +1643,10 @@ static int dst_set_frontend(struct dvb_frontend *fe, struct dvb_frontend_paramet
                         dst_set_symbolrate(state, p->u.qam.symbol_rate);
                         dst_set_modulation(state, p->u.qam.modulation);
                 }
-                dst_write_tuna(fe);
+                retval = dst_write_tuna(fe);
         }
 
-        return 0;
+        return retval;
 }
 
 static int dst_tune_frontend(struct dvb_frontend* fe,
diff --git a/drivers/media/dvb/dvb-core/Makefile b/drivers/media/dvb/dvb-core/Makefile
index 11054657fdb5..0b5182835cc8 100644
--- a/drivers/media/dvb/dvb-core/Makefile
+++ b/drivers/media/dvb/dvb-core/Makefile
@@ -2,8 +2,8 @@
 # Makefile for the kernel DVB device drivers.
 #
 
-dvb-core-objs = dvbdev.o dmxdev.o dvb_demux.o dvb_filter.o      \
-                dvb_ca_en50221.o dvb_frontend.o                 \
-                dvb_net.o dvb_ringbuffer.o dvb_math.o
+dvb-core-objs := dvbdev.o dmxdev.o dvb_demux.o dvb_filter.o     \
+                 dvb_ca_en50221.o dvb_frontend.o                \
+                 dvb_net.o dvb_ringbuffer.o dvb_math.o
 
 obj-$(CONFIG_DVB_CORE) += dvb-core.o
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 59ac35ddd51e..57b34cda99f5 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -526,7 +526,9 @@ static int dvb_frontend_thread(void *data)
         fepriv->delay = 3*HZ;
         fepriv->status = 0;
         fepriv->wakeup = 0;
-        fepriv->reinitialise = 1;
+        fepriv->reinitialise = 0;
+
+        dvb_frontend_init(fe);
 
         while (1) {
                 up(&fepriv->sem);           /* is locked when we enter the thread... */
@@ -1013,17 +1015,18 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
                 return ret;
 
         if ((file->f_flags & O_ACCMODE) != O_RDONLY) {
+
+                /* normal tune mode when opened R/W */
+                fepriv->tune_mode_flags &= ~FE_TUNE_MODE_ONESHOT;
+                fepriv->tone = -1;
+                fepriv->voltage = -1;
+
                 ret = dvb_frontend_start (fe);
                 if (ret)
                         dvb_generic_release (inode, file);
 
                 /*  empty event queue */
                 fepriv->events.eventr = fepriv->events.eventw = 0;
-
-                /* normal tune mode when opened R/W */
-                fepriv->tune_mode_flags &= ~FE_TUNE_MODE_ONESHOT;
-                fepriv->tone = -1;
-                fepriv->voltage = -1;
         }
 
         return ret;
diff --git a/drivers/media/dvb/frontends/dvb-pll.c b/drivers/media/dvb/frontends/dvb-pll.c
index a189683454b7..2be33f27c69f 100644
--- a/drivers/media/dvb/frontends/dvb-pll.c
+++ b/drivers/media/dvb/frontends/dvb-pll.c
@@ -194,11 +194,11 @@ struct dvb_pll_desc dvb_pll_tda665x = {
                 {  253834000, 36249333, 166667, 0xca, 0x62 /* 011 0 0 0  10 */ },
                 {  383834000, 36249333, 166667, 0xca, 0xa2 /* 101 0 0 0  10 */ },
                 {  443834000, 36249333, 166667, 0xca, 0xc2 /* 110 0 0 0  10 */ },
-                {  444000000, 36249333, 166667, 0xca, 0xc3 /* 110 0 0 0  11 */ },
-                {  583834000, 36249333, 166667, 0xca, 0x63 /* 011 0 0 0  11 */ },
-                {  793834000, 36249333, 166667, 0xca, 0xa3 /* 101 0 0 0  11 */ },
-                {  444834000, 36249333, 166667, 0xca, 0xc3 /* 110 0 0 0  11 */ },
-                {  861000000, 36249333, 166667, 0xca, 0xe3 /* 111 0 0 0  11 */ },
+                {  444000000, 36249333, 166667, 0xca, 0xc4 /* 110 0 0 1  00 */ },
+                {  583834000, 36249333, 166667, 0xca, 0x64 /* 011 0 0 1  00 */ },
+                {  793834000, 36249333, 166667, 0xca, 0xa4 /* 101 0 0 1  00 */ },
+                {  444834000, 36249333, 166667, 0xca, 0xc4 /* 110 0 0 1  00 */ },
+                {  861000000, 36249333, 166667, 0xca, 0xe4 /* 111 0 0 1  00 */ },
         }
 };
 EXPORT_SYMBOL(dvb_pll_tda665x);
@@ -613,7 +613,21 @@ static struct dvb_tuner_ops dvb_pll_tuner_ops = {
 
 int dvb_pll_attach(struct dvb_frontend *fe, int pll_addr, struct i2c_adapter *i2c, struct dvb_pll_desc *desc)
 {
+        u8 b1 [] = { 0 };
+        struct i2c_msg msg = { .addr = pll_addr, .flags = I2C_M_RD, .buf = b1, .len = 1 };
         struct dvb_pll_priv *priv = NULL;
+        int ret;
+
+        if (i2c != NULL) {
+                if (fe->ops.i2c_gate_ctrl)
+                        fe->ops.i2c_gate_ctrl(fe, 1);
+
+                ret = i2c_transfer (i2c, &msg, 1);
+                if (ret != 1)
+                        return -1;
+                if (fe->ops.i2c_gate_ctrl)
+                             fe->ops.i2c_gate_ctrl(fe, 0);
+        }
 
         priv = kzalloc(sizeof(struct dvb_pll_priv), GFP_KERNEL);
         if (priv == NULL)
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 500f15c10aaf..4506165c5de2 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -2203,8 +2203,8 @@ static int frontend_init(struct av7110 *av7110)
                                 av7110->fe->ops.tuner_ops.set_params = nexusca_stv0297_tuner_set_params;
 
                                 /* set TDA9819 into DVB mode */
-                                saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9198 pin9(STD)
-                                saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9198 pin30(VIF)
+                                saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9819 pin9(STD)
+                                saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9819 pin30(VIF)
 
                                 /* tuner on this needs a slower i2c bus speed */
                                 av7110->dev->i2c_bitrate = SAA7146_I2C_BUS_BIT_RATE_240;
diff --git a/drivers/media/dvb/ttpci/av7110_v4l.c b/drivers/media/dvb/ttpci/av7110_v4l.c
index 64055461559d..6ffe53fdcf57 100644
--- a/drivers/media/dvb/ttpci/av7110_v4l.c
+++ b/drivers/media/dvb/ttpci/av7110_v4l.c
@@ -272,8 +272,8 @@ static int av7110_dvb_c_switch(struct saa7146_fh *fh)
                                 if (ves1820_writereg(dev, 0x09, 0x0f, 0x60))
                                         dprintk(1, "setting band in demodulator failed.\n");
                         } else if (av7110->analog_tuner_flags & ANALOG_TUNER_STV0297) {
-                                saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTHI); // TDA9198 pin9(STD)
-                                saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTHI); // TDA9198 pin30(VIF)
+                                saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTHI); // TDA9819 pin9(STD)
+                                saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTHI); // TDA9819 pin30(VIF)
                         }
                         if (i2c_writereg(av7110, 0x48, 0x02, 0xd0) != 1)
                                 dprintk(1, "saa7113 write failed @ card %d", av7110->dvb_adapter.num);
@@ -308,8 +308,8 @@ static int av7110_dvb_c_switch(struct saa7146_fh *fh)
                         if (ves1820_writereg(dev, 0x09, 0x0f, 0x20))
                                 dprintk(1, "setting band in demodulator failed.\n");
                 } else if (av7110->analog_tuner_flags & ANALOG_TUNER_STV0297) {
-                        saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTLO); // TDA9198 pin9(STD)
-                        saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTLO); // TDA9198 pin30(VIF)
+                        saa7146_setgpio(dev, 1, SAA7146_GPIO_OUTLO); // TDA9819 pin9(STD)
+                        saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTLO); // TDA9819 pin30(VIF)
                 }
         }
 
@@ -750,8 +750,8 @@ int av7110_init_analog_module(struct av7110 *av7110)
                         if (ves1820_writereg(av7110->dev, 0x09, 0x0f, 0x20))
                                 dprintk(1, "setting band in demodulator failed.\n");
                 } else if (av7110->analog_tuner_flags & ANALOG_TUNER_STV0297) {
-                        saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9198 pin9(STD)
-                        saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9198 pin30(VIF)
+                        saa7146_setgpio(av7110->dev, 1, SAA7146_GPIO_OUTLO); // TDA9819 pin9(STD)
+                        saa7146_setgpio(av7110->dev, 3, SAA7146_GPIO_OUTLO); // TDA9819 pin30(VIF)
                 }
 
                 /* init the saa7113 */
diff --git a/drivers/media/dvb/ttpci/budget-av.c b/drivers/media/dvb/ttpci/budget-av.c
index 5f111d407730..2d21fec23b4d 100644
--- a/drivers/media/dvb/ttpci/budget-av.c
+++ b/drivers/media/dvb/ttpci/budget-av.c
@@ -1303,6 +1303,9 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
         budget_av->budget.dvb_adapter.priv = budget_av;
         frontend_init(budget_av);
         ciintf_init(budget_av);
+
+        ttpci_budget_init_hooks(&budget_av->budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget-ci.c b/drivers/media/dvb/ttpci/budget-ci.c
index 4b966eea3834..ffbbb3e34be4 100644
--- a/drivers/media/dvb/ttpci/budget-ci.c
+++ b/drivers/media/dvb/ttpci/budget-ci.c
@@ -1101,6 +1101,8 @@ static int budget_ci_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
         budget_ci->budget.dvb_adapter.priv = budget_ci;
         frontend_init(budget_ci);
 
+        ttpci_budget_init_hooks(&budget_ci->budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget-core.c b/drivers/media/dvb/ttpci/budget-core.c
index e4cf7775e07f..e15562f81664 100644
--- a/drivers/media/dvb/ttpci/budget-core.c
+++ b/drivers/media/dvb/ttpci/budget-core.c
@@ -63,9 +63,6 @@ static int stop_ts_capture(struct budget *budget)
 {
         dprintk(2, "budget: %p\n", budget);
 
-        if (--budget->feeding)
-                return budget->feeding;
-
         saa7146_write(budget->dev, MC1, MASK_20);       // DMA3 off
         SAA7146_IER_DISABLE(budget->dev, MASK_10);
         return 0;
@@ -77,8 +74,8 @@ static int start_ts_capture(struct budget *budget)
 
         dprintk(2, "budget: %p\n", budget);
 
-        if (budget->feeding)
-                return ++budget->feeding;
+        if (!budget->feeding || !budget->fe_synced)
+                return 0;
 
         saa7146_write(dev, MC1, MASK_20);       // DMA3 off
 
@@ -139,7 +136,33 @@ static int start_ts_capture(struct budget *budget)
         SAA7146_IER_ENABLE(budget->dev, MASK_10);       /* VPE */
         saa7146_write(dev, MC1, (MASK_04 | MASK_20));   /* DMA3 on */
 
-        return ++budget->feeding;
+        return 0;
+}
+
+static int budget_read_fe_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+        struct budget *budget = (struct budget *) fe->dvb->priv;
+        int synced;
+        int ret;
+
+        if (budget->read_fe_status)
+                ret = budget->read_fe_status(fe, status);
+        else
+                ret = -EINVAL;
+
+        if (!ret) {
+                synced = (*status & FE_HAS_LOCK);
+                if (synced != budget->fe_synced) {
+                        budget->fe_synced = synced;
+                        spin_lock(&budget->feedlock);
+                        if (synced)
+                                start_ts_capture(budget);
+                        else
+                                stop_ts_capture(budget);
+                        spin_unlock(&budget->feedlock);
+                }
+        }
+        return ret;
 }
 
 static void vpeirq(unsigned long data)
@@ -267,7 +290,7 @@ static int budget_start_feed(struct dvb_demux_feed *feed)
 {
         struct dvb_demux *demux = feed->demux;
         struct budget *budget = (struct budget *) demux->priv;
-        int status;
+        int status = 0;
 
         dprintk(2, "budget: %p\n", budget);
 
@@ -276,7 +299,8 @@ static int budget_start_feed(struct dvb_demux_feed *feed)
 
         spin_lock(&budget->feedlock);
         feed->pusi_seen = 0; /* have a clean section start */
-        status = start_ts_capture(budget);
+        if (budget->feeding++ == 0)
+                status = start_ts_capture(budget);
         spin_unlock(&budget->feedlock);
         return status;
 }
@@ -285,12 +309,13 @@ static int budget_stop_feed(struct dvb_demux_feed *feed)
 {
         struct dvb_demux *demux = feed->demux;
         struct budget *budget = (struct budget *) demux->priv;
-        int status;
+        int status = 0;
 
         dprintk(2, "budget: %p\n", budget);
 
         spin_lock(&budget->feedlock);
-        status = stop_ts_capture(budget);
+        if (--budget->feeding == 0)
+                status = stop_ts_capture(budget);
         spin_unlock(&budget->feedlock);
         return status;
 }
@@ -470,6 +495,14 @@ err:
         return ret;
 }
 
+void ttpci_budget_init_hooks(struct budget *budget)
+{
+        if (budget->dvb_frontend && !budget->read_fe_status) {
+                budget->read_fe_status = budget->dvb_frontend->ops.read_status;
+                budget->dvb_frontend->ops.read_status = budget_read_fe_status;
+        }
+}
+
 int ttpci_budget_deinit(struct budget *budget)
 {
         struct saa7146_dev *dev = budget->dev;
@@ -508,11 +541,8 @@ void ttpci_budget_set_video_port(struct saa7146_dev *dev, int video_port)
         spin_lock(&budget->feedlock);
         budget->video_port = video_port;
         if (budget->feeding) {
-                int oldfeeding = budget->feeding;
-                budget->feeding = 1;
                 stop_ts_capture(budget);
                 start_ts_capture(budget);
-                budget->feeding = oldfeeding;
         }
         spin_unlock(&budget->feedlock);
 }
@@ -520,6 +550,7 @@ void ttpci_budget_set_video_port(struct saa7146_dev *dev, int video_port)
 EXPORT_SYMBOL_GPL(ttpci_budget_debiread);
 EXPORT_SYMBOL_GPL(ttpci_budget_debiwrite);
 EXPORT_SYMBOL_GPL(ttpci_budget_init);
+EXPORT_SYMBOL_GPL(ttpci_budget_init_hooks);
 EXPORT_SYMBOL_GPL(ttpci_budget_deinit);
 EXPORT_SYMBOL_GPL(ttpci_budget_irq10_handler);
 EXPORT_SYMBOL_GPL(ttpci_budget_set_video_port);
diff --git a/drivers/media/dvb/ttpci/budget-patch.c b/drivers/media/dvb/ttpci/budget-patch.c
index ee60ce90a400..57227441891e 100644
--- a/drivers/media/dvb/ttpci/budget-patch.c
+++ b/drivers/media/dvb/ttpci/budget-patch.c
@@ -617,6 +617,8 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
         budget->dvb_adapter.priv = budget;
         frontend_init(budget);
 
+        ttpci_budget_init_hooks(budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 35761f13c12b..863dffb4ed8e 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -375,9 +375,6 @@ static void frontend_init(struct budget *budget)
                 if (budget->dvb_frontend) {
                         budget->dvb_frontend->ops.tuner_ops.set_params = alps_bsru6_tuner_set_params;
                         budget->dvb_frontend->tuner_priv = &budget->i2c_adap;
-                        budget->dvb_frontend->ops.diseqc_send_master_cmd = budget_diseqc_send_master_cmd;
-                        budget->dvb_frontend->ops.diseqc_send_burst = budget_diseqc_send_burst;
-                        budget->dvb_frontend->ops.set_tone = budget_set_tone;
                         break;
                 }
                 break;
@@ -474,6 +471,8 @@ static int budget_attach (struct saa7146_dev* dev, struct saa7146_pci_extension_
         budget->dvb_adapter.priv = budget;
         frontend_init(budget);
 
+        ttpci_budget_init_hooks(budget);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ttpci/budget.h b/drivers/media/dvb/ttpci/budget.h
index ecea3a13030e..e8a5c79178e1 100644
--- a/drivers/media/dvb/ttpci/budget.h
+++ b/drivers/media/dvb/ttpci/budget.h
@@ -52,9 +52,6 @@ struct budget {
         struct dmx_frontend hw_frontend;
         struct dmx_frontend mem_frontend;
 
-        int fe_synced;
-        struct mutex pid_mutex;
-
         int ci_present;
         int video_port;
 
@@ -74,6 +71,9 @@ struct budget {
 
         struct dvb_adapter dvb_adapter;
         struct dvb_frontend *dvb_frontend;
+        int (*read_fe_status)(struct dvb_frontend *fe, fe_status_t *status);
+        int fe_synced;
+
         void *priv;
 };
 
@@ -106,6 +106,7 @@ static struct saa7146_pci_extension_data x_var = { \
 extern int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
                              struct saa7146_pci_extension_data *info,
                              struct module *owner);
+extern void ttpci_budget_init_hooks(struct budget *budget);
 extern int ttpci_budget_deinit(struct budget *budget);
 extern void ttpci_budget_irq10_handler(struct saa7146_dev *dev, u32 * isr);
 extern void ttpci_budget_set_video_port(struct saa7146_dev *dev, int video_port);
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index de3128a31de8..220076b1b956 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -350,5 +350,15 @@ config RADIO_ZOLTRIX_PORT
         help
           Enter the I/O port of your Zoltrix radio card.
 
-endmenu
+config USB_DSBR
+        tristate "D-Link USB FM radio support (EXPERIMENTAL)"
+        depends on USB && VIDEO_V4L1 && EXPERIMENTAL
+        ---help---
+          Say Y here if you want to connect this type of radio to your
+          computer's USB port. Note that the audio is not digital, and
+          you must connect the line out connector to a sound card or a
+          set of speakers.
 
+          To compile this driver as a module, choose M here: the
+          module will be called dsbr100.
+endmenu
diff --git a/drivers/media/radio/Makefile b/drivers/media/radio/Makefile
index e95b6805e002..cf55a18e3ddf 100644
--- a/drivers/media/radio/Makefile
+++ b/drivers/media/radio/Makefile
@@ -20,5 +20,6 @@ obj-$(CONFIG_RADIO_GEMTEK) += radio-gemtek.o
 obj-$(CONFIG_RADIO_GEMTEK_PCI) += radio-gemtek-pci.o
 obj-$(CONFIG_RADIO_TRUST) += radio-trust.o
 obj-$(CONFIG_RADIO_MAESTRO) += radio-maestro.o
+obj-$(CONFIG_USB_DSBR) += dsbr100.o
 
 EXTRA_CFLAGS += -Isound
diff --git a/drivers/media/video/dsbr100.c b/drivers/media/radio/dsbr100.c
index f7e33f9ee8e9..f7e33f9ee8e9 100644
--- a/drivers/media/video/dsbr100.c
+++ b/drivers/media/radio/dsbr100.c
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 6d532f170ce5..732bf1e7c326 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -145,7 +145,7 @@ config VIDEO_SAA5246A
 
 config VIDEO_SAA5249
         tristate "SAA5249 Teletext processor"
-        depends on VIDEO_DEV && I2C
+        depends on VIDEO_DEV && I2C && VIDEO_V4L1
         help
           Support for I2C bus based teletext using the SAA5249 chip. At the
           moment this is only useful on some European WinTV cards.
@@ -155,7 +155,7 @@ config VIDEO_SAA5249
 
 config TUNER_3036
         tristate "SAB3036 tuner"
-        depends on VIDEO_DEV && I2C
+        depends on VIDEO_DEV && I2C && VIDEO_V4L1
         help
           Say Y here to include support for Philips SAB3036 compatible tuners.
           If in doubt, say N.
@@ -449,18 +449,6 @@ source "drivers/media/video/pvrusb2/Kconfig"
 
 source "drivers/media/video/em28xx/Kconfig"
 
-config USB_DSBR
-        tristate "D-Link USB FM radio support (EXPERIMENTAL)"
-        depends on USB && VIDEO_V4L1 && EXPERIMENTAL
-        ---help---
-          Say Y here if you want to connect this type of radio to your
-          computer's USB port. Note that the audio is not digital, and
-          you must connect the line out connector to a sound card or a
-          set of speakers.
-
-          To compile this driver as a module, choose M here: the
-          module will be called dsbr100.
-
 source "drivers/media/video/usbvideo/Kconfig"
 
 source "drivers/media/video/et61x251/Kconfig"
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index 353d61cfac1b..e82e511f2a72 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -77,7 +77,6 @@ obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o
 obj-$(CONFIG_VIDEO_CX2341X) += cx2341x.o
 
 obj-$(CONFIG_USB_DABUSB)        += dabusb.o
-obj-$(CONFIG_USB_DSBR)          += dsbr100.o
 obj-$(CONFIG_USB_OV511)         += ov511.o
 obj-$(CONFIG_USB_SE401)         += se401.o
 obj-$(CONFIG_USB_STV680)        += stv680.o
@@ -91,6 +90,7 @@ obj-$(CONFIG_USB_ZC0301)        += zc0301/
 obj-$(CONFIG_USB_IBMCAM)        += usbvideo/
 obj-$(CONFIG_USB_KONICAWC)      += usbvideo/
 obj-$(CONFIG_USB_VICAM)         += usbvideo/
+obj-$(CONFIG_USB_QUICKCAM_MESSENGER)    += usbvideo/
 
 obj-$(CONFIG_VIDEO_VIVI) += vivi.o
 
diff --git a/drivers/media/video/bt8xx/Kconfig b/drivers/media/video/bt8xx/Kconfig
index 153f6a4a96c9..cdcf55650714 100644
--- a/drivers/media/video/bt8xx/Kconfig
+++ b/drivers/media/video/bt8xx/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_BT848
         tristate "BT848 Video For Linux"
-        depends on VIDEO_DEV && PCI && I2C && VIDEO_V4L2
+        depends on VIDEO_DEV && PCI && I2C && VIDEO_V4L1
         select I2C_ALGOBIT
         select FW_LOADER
         select VIDEO_BTCX
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 5764a89d3562..20dff7c316eb 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3923,7 +3923,12 @@ static int __devinit bttv_register_video(struct bttv *btv)
                 goto err;
         printk(KERN_INFO "bttv%d: registered device video%d\n",
                btv->c.nr,btv->video_dev->minor & 0x1f);
-        video_device_create_file(btv->video_dev, &class_device_attr_card);
+        if (class_device_create_file(&btv->video_dev->class_dev,
+                                     &class_device_attr_card)<0) {
+                printk(KERN_ERR "bttv%d: class_device_create_file 'card' "
+                       "failed\n", btv->c.nr);
+                goto err;
+        }
 
         /* vbi */
         btv->vbi_dev = vdev_init(btv, &bttv_vbi_template, "vbi");
@@ -4287,6 +4292,8 @@ static struct pci_driver bttv_pci_driver = {
 
 static int bttv_init_module(void)
 {
+        int ret;
+
         bttv_num = 0;
 
         printk(KERN_INFO "bttv: driver version %d.%d.%d loaded\n",
@@ -4308,7 +4315,11 @@ static int bttv_init_module(void)
 
         bttv_check_chipset();
 
-        bus_register(&bttv_sub_bus_type);
+        ret = bus_register(&bttv_sub_bus_type);
+        if (ret < 0) {
+                printk(KERN_WARNING "bttv: bus_register error: %d\n", ret);
+                return ret;
+        }
         return pci_register_driver(&bttv_pci_driver);
 }
 
diff --git a/drivers/media/video/bt8xx/bttv-vbi.c b/drivers/media/video/bt8xx/bttv-vbi.c
index 8c9f0f7cf467..63676e7bd635 100644
--- a/drivers/media/video/bt8xx/bttv-vbi.c
+++ b/drivers/media/video/bt8xx/bttv-vbi.c
@@ -31,11 +31,16 @@
 #include <asm/io.h>
 #include "bttvp.h"
 
-/* Offset from line sync pulse leading edge (0H) in 1 / sampling_rate:
-   bt8x8 /HRESET pulse starts at 0H and has length 64 / fCLKx1 (E|O_VTC
-   HSFMT = 0). VBI_HDELAY (always 0) is an offset from the trailing edge
-   of /HRESET in 1 / fCLKx1, and the sampling_rate tvnorm->Fsc is fCLKx2. */
-#define VBI_OFFSET ((64 + 0) * 2)
+/* Offset from line sync pulse leading edge (0H) to start of VBI capture,
+   in fCLKx2 pixels.  According to the datasheet, VBI capture starts
+   VBI_HDELAY fCLKx1 pixels from the tailing edgeof /HRESET, and /HRESET
+   is 64 fCLKx1 pixels wide.  VBI_HDELAY is set to 0, so this should be
+   (64 + 0) * 2 = 128 fCLKx2 pixels.  But it's not!  The datasheet is
+   Just Plain Wrong.  The real value appears to be different for
+   different revisions of the bt8x8 chips, and to be affected by the
+   horizontal scaling factor.  Experimentally, the value is measured
+   to be about 244.  */
+#define VBI_OFFSET 244
 
 #define VBI_DEFLINES 16
 #define VBI_MAXLINES 32
diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
index 353d02b67c33..b69ee1194815 100644
--- a/drivers/media/video/compat_ioctl32.c
+++ b/drivers/media/video/compat_ioctl32.c
@@ -21,7 +21,7 @@
 
 #ifdef CONFIG_COMPAT
 
-
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 struct video_tuner32 {
         compat_int_t tuner;
         char name[32];
@@ -107,6 +107,7 @@ struct video_window32 {
         compat_caddr_t clips;
         compat_int_t clipcount;
 };
+#endif
 
 static int native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
@@ -124,6 +125,7 @@ static int native_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 }
 
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 /* You get back everything except the clips... */
 static int put_video_window32(struct video_window *kp, struct video_window32 __user *up)
 {
@@ -138,6 +140,7 @@ static int put_video_window32(struct video_window *kp, struct video_window32 __u
                         return -EFAULT;
         return 0;
 }
+#endif
 
 struct v4l2_clip32
 {
@@ -490,6 +493,24 @@ static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user
         return 0;
 }
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
+struct video_code32
+{
+        char            loadwhat[16];   /* name or tag of file being passed */
+        compat_int_t    datasize;
+        unsigned char   *data;
+};
+
+static inline int microcode32(struct video_code *kp, struct video_code32 __user *up)
+{
+        if(!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
+                copy_from_user(kp->loadwhat, up->loadwhat, sizeof (up->loadwhat)) ||
+                get_user(kp->datasize, &up->datasize) ||
+                copy_from_user(kp->data, up->data, up->datasize))
+                        return -EFAULT;
+        return 0;
+}
+
 #define VIDIOCGTUNER32          _IOWR('v',4, struct video_tuner32)
 #define VIDIOCSTUNER32          _IOW('v',5, struct video_tuner32)
 #define VIDIOCGWIN32            _IOR('v',9, struct video_window32)
@@ -498,6 +519,9 @@ static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user
 #define VIDIOCSFBUF32           _IOW('v',12, struct video_buffer32)
 #define VIDIOCGFREQ32           _IOR('v',14, u32)
 #define VIDIOCSFREQ32           _IOW('v',15, u32)
+#define VIDIOCSMICROCODE32      _IOW('v',27, struct video_code32)
+
+#endif
 
 /* VIDIOC_ENUMINPUT32 is VIDIOC_ENUMINPUT minus 4 bytes of padding alignement */
 #define VIDIOC_ENUMINPUT32      VIDIOC_ENUMINPUT - _IOC(0, 0, 0, 4)
@@ -519,6 +543,7 @@ static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user
 #define VIDIOC_S_INPUT32        _IOWR ('V', 39, compat_int_t)
 #define VIDIOC_TRY_FMT32        _IOWR ('V', 64, struct v4l2_format32)
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 enum {
         MaxClips = (~0U-sizeof(struct video_window))/sizeof(struct video_clip)
 };
@@ -583,13 +608,17 @@ static int do_set_window(struct file *file, unsigned int cmd, unsigned long arg)
 
         return native_ioctl(file, VIDIOCSWIN, (unsigned long)vw);
 }
+#endif
 
 static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         union {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
                 struct video_tuner vt;
                 struct video_buffer vb;
                 struct video_window vw;
+                struct video_code vc;
+#endif
                 struct v4l2_format v2f;
                 struct v4l2_buffer v2b;
                 struct v4l2_framebuffer v2fb;
@@ -605,6 +634,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
 
         /* First, convert the command. */
         switch(cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGTUNER32: cmd = VIDIOCGTUNER; break;
         case VIDIOCSTUNER32: cmd = VIDIOCSTUNER; break;
         case VIDIOCGWIN32: cmd = VIDIOCGWIN; break;
@@ -612,6 +642,8 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
         case VIDIOCSFBUF32: cmd = VIDIOCSFBUF; break;
         case VIDIOCGFREQ32: cmd = VIDIOCGFREQ; break;
         case VIDIOCSFREQ32: cmd = VIDIOCSFREQ; break;
+        case VIDIOCSMICROCODE32: cmd = VIDIOCSMICROCODE; break;
+#endif
         case VIDIOC_G_FMT32: cmd = VIDIOC_G_FMT; break;
         case VIDIOC_S_FMT32: cmd = VIDIOC_S_FMT; break;
         case VIDIOC_QUERYBUF32: cmd = VIDIOC_QUERYBUF; break;
@@ -631,6 +663,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
         };
 
         switch(cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCSTUNER:
         case VIDIOCGTUNER:
                 err = get_video_tuner32(&karg.vt, up);
@@ -644,6 +677,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 break;
 
         case VIDIOCSFREQ:
+#endif
         case VIDIOC_S_INPUT:
         case VIDIOC_OVERLAY:
         case VIDIOC_STREAMON:
@@ -697,14 +731,21 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 compatible_arg = 0;
                 break;
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGWIN:
         case VIDIOCGFBUF:
         case VIDIOCGFREQ:
+#endif
         case VIDIOC_G_FBUF:
         case VIDIOC_G_INPUT:
                 compatible_arg = 0;
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
+        case VIDIOCSMICROCODE:
+                err = microcode32(&karg.vc, up);
+                compatible_arg = 0;
+                break;
+#endif
         };
-
         if(err)
                 goto out;
 
@@ -719,6 +760,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
         }
         if(err == 0) {
                 switch(cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
                 case VIDIOCGTUNER:
                         err = put_video_tuner32(&karg.vt, up);
                         break;
@@ -730,7 +772,7 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                 case VIDIOCGFBUF:
                         err = put_video_buffer32(&karg.vb, up);
                         break;
-
+#endif
                 case VIDIOC_G_FBUF:
                         err = put_v4l2_framebuffer32(&karg.v2fb, up);
                         break;
@@ -768,7 +810,9 @@ static int do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg
                         err = put_v4l2_input32(&karg.v2i, up);
                         break;
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
                 case VIDIOCGFREQ:
+#endif
                 case VIDIOC_G_INPUT:
                         err = put_user(((u32)karg.vx), (u32 __user *)up);
                         break;
@@ -786,6 +830,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
                 return ret;
 
         switch (cmd) {
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCSWIN32:
                 ret = do_set_window(file, cmd, arg);
                 break;
@@ -796,6 +841,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case VIDIOCSFBUF32:
         case VIDIOCGFREQ32:
         case VIDIOCSFREQ32:
+#endif
         case VIDIOC_QUERYCAP:
         case VIDIOC_ENUM_FMT:
         case VIDIOC_G_FMT32:
@@ -827,6 +873,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
                 ret = do_video_ioctl(file, cmd, arg);
                 break;
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         /* Little v, the video4linux ioctls (conflict?) */
         case VIDIOCGCAP:
         case VIDIOCGCHAN:
@@ -855,6 +902,7 @@ long v4l_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
         case _IOR('v' , BASE_VIDIOCPRIVATE+7, int):
                 ret = native_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
                 break;
+#endif
         default:
                 v4l_print_ioctl("compat_ioctl32", cmd);
         }
diff --git a/drivers/media/video/cpia2/Kconfig b/drivers/media/video/cpia2/Kconfig
index 513cc0927389..e39a96152004 100644
--- a/drivers/media/video/cpia2/Kconfig
+++ b/drivers/media/video/cpia2/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_CPIA2
         tristate "CPiA2 Video For Linux"
-        depends on VIDEO_DEV && USB
+        depends on VIDEO_DEV && USB && VIDEO_V4L1
         ---help---
           This is the video4linux driver for cameras based on Vision's CPiA2
           (Colour Processor Interface ASIC), such as the Digital Blue QX5
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 5c2036b40ea1..7bb7589a07c3 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -104,8 +104,8 @@ u32 cx25840_read4(struct i2c_client * client, u16 addr)
         if (i2c_master_recv(client, buffer, 4) < 4)
                 return 0;
 
-        return (buffer[0] << 24) | (buffer[1] << 16) |
-            (buffer[2] << 8) | buffer[3];
+        return (buffer[3] << 24) | (buffer[2] << 16) |
+            (buffer[1] << 8) | buffer[0];
 }
 
 int cx25840_and_or(struct i2c_client *client, u16 addr, unsigned and_mask,
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index 72b630a91f41..c25564648993 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -89,7 +89,7 @@ static void cx88_ir_handle_key(struct cx88_IR *ir)
 
                 auxgpio = cx_read(MO_GP1_IO);
                 /* Take out the parity part */
-                gpio+=(gpio & 0x7fd) + (auxgpio & 0xef);
+                gpio=(gpio & 0x7fd) + (auxgpio & 0xef);
         } else
                 auxgpio = gpio;
 
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 2225d4b94140..94c92bacc342 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -1180,7 +1180,6 @@ static int video_do_ioctl(struct inode *inode, struct file *file,
                         V4L2_CAP_READWRITE     |
                         V4L2_CAP_STREAMING     |
                         V4L2_CAP_VBI_CAPTURE   |
-                        V4L2_CAP_VIDEO_OVERLAY |
                         0;
                 if (UNSET != core->tuner_type)
                         cap->capabilities |= V4L2_CAP_TUNER;
@@ -1226,7 +1225,7 @@ static int video_do_ioctl(struct inode *inode, struct file *file,
                 struct v4l2_format *f = arg;
                 return cx8800_try_fmt(dev,fh,f);
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         /* --- streaming capture ------------------------------------- */
         case VIDIOCGMBUF:
         {
@@ -1585,7 +1584,7 @@ static int radio_do_ioctl(struct inode *inode, struct file *file,
                 *id = 0;
                 return 0;
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCSTUNER:
         {
                 struct video_tuner *v = arg;
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index dbb75a7db199..56246b8578f3 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -362,7 +362,7 @@ int msp_sleep(struct msp_state *state, int timeout)
 }
 
 /* ------------------------------------------------------------------------ */
-
+#ifdef CONFIG_VIDEO_V4L1
 static int msp_mode_v4l2_to_v4l1(int rxsubchans, int audmode)
 {
         if (rxsubchans == V4L2_TUNER_SUB_MONO)
@@ -384,6 +384,7 @@ static int msp_mode_v4l1_to_v4l2(int mode)
                 return V4L2_TUNER_MODE_LANG1;
         return V4L2_TUNER_MODE_MONO;
 }
+#endif
 
 static int msp_get_ctrl(struct i2c_client *client, struct v4l2_control *ctrl)
 {
@@ -509,6 +510,7 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
         /* --- v4l ioctls --- */
         /* take care: bttv does userspace copying, we'll get a
            kernel pointer here... */
+#ifdef CONFIG_VIDEO_V4L1
         case VIDIOCGAUDIO:
         {
                 struct video_audio *va = arg;
@@ -577,6 +579,12 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
         }
 
         case VIDIOCSFREQ:
+        {
+                /* new channel -- kick audio carrier scan */
+                msp_wake_thread(client);
+                break;
+        }
+#endif
         case VIDIOC_S_FREQUENCY:
         {
                 /* new channel -- kick audio carrier scan */
diff --git a/drivers/media/video/msp3400-kthreads.c b/drivers/media/video/msp3400-kthreads.c
index f2fd9195b3ac..ed02ff811388 100644
--- a/drivers/media/video/msp3400-kthreads.c
+++ b/drivers/media/video/msp3400-kthreads.c
@@ -961,10 +961,10 @@ int msp34xxg_thread(void *data)
                 /* setup the chip*/
                 msp34xxg_reset(client);
                 state->std = state->radio ? 0x40 : msp_standard;
-                if (state->std != 1)
-                        goto unmute;
                 /* start autodetect */
                 msp_write_dem(client, 0x20, state->std);
+                if (state->std != 1)
+                        goto unmute;
 
                 /* watch autodetect */
                 v4l_dbg(1, msp_debug, client, "started autodetect, waiting for result\n");
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index 9b48abcf6089..be1e5cc78081 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -852,7 +852,6 @@ unsigned long pvr2_hdw_get_sn(struct pvr2_hdw *hdw)
         return hdw->serial_number;
 }
 
-
 int pvr2_hdw_get_unit_number(struct pvr2_hdw *hdw)
 {
         return hdw->unit_number;
@@ -2318,7 +2317,6 @@ void pvr2_hdw_poll_trigger_unlocked(struct pvr2_hdw *hdw)
         }
 }
 
-
 /* Return name for this driver instance */
 const char *pvr2_hdw_get_driver_name(struct pvr2_hdw *hdw)
 {
@@ -2542,6 +2540,10 @@ static void pvr2_ctl_timeout(unsigned long data)
 }
 
 
+/* Issue a command and get a response from the device.  This extended
+   version includes a probe flag (which if set means that device errors
+   should not be logged or treated as fatal) and a timeout in jiffies.
+   This can be used to non-lethally probe the health of endpoint 1. */
 static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
                                 unsigned int timeout,int probe_fl,
                                 void *write_data,unsigned int write_len,
@@ -2970,6 +2972,7 @@ int pvr2_hdw_cmd_decoder_reset(struct pvr2_hdw *hdw)
 }
 
 
+/* Stop / start video stream transport */
 static int pvr2_hdw_cmd_usbstream(struct pvr2_hdw *hdw,int runFl)
 {
         int status;
@@ -3068,6 +3071,7 @@ int pvr2_hdw_gpio_chg_out(struct pvr2_hdw *hdw,u32 msk,u32 val)
 }
 
 
+/* Find I2C address of eeprom */
 static int pvr2_hdw_get_eeprom_addr(struct pvr2_hdw *hdw)
 {
         int result;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-io.c b/drivers/media/video/pvrusb2/pvrusb2-io.c
index 681f79c8064e..1e393762546c 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-io.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-io.c
@@ -26,6 +26,8 @@
 #include <linux/slab.h>
 #include <linux/mutex.h>
 
+static const char *pvr2_buffer_state_decode(enum pvr2_buffer_state);
+
 #define BUFFER_SIG 0x47653271
 
 // #define SANITY_CHECK_BUFFERS
@@ -515,6 +517,10 @@ void pvr2_stream_set_callback(struct pvr2_stream *sp,
 }
 
 /* Query / set the nominal buffer count */
+int pvr2_stream_get_buffer_count(struct pvr2_stream *sp)
+{
+        return sp->buffer_target_count;
+}
 
 int pvr2_stream_set_buffer_count(struct pvr2_stream *sp,unsigned int cnt)
 {
@@ -553,7 +559,6 @@ int pvr2_stream_get_ready_count(struct pvr2_stream *sp)
         return sp->r_count;
 }
 
-
 void pvr2_stream_kill(struct pvr2_stream *sp)
 {
         struct pvr2_buffer *bp;
@@ -607,7 +612,6 @@ int pvr2_buffer_queue(struct pvr2_buffer *bp)
         return ret;
 }
 
-
 int pvr2_buffer_set_buffer(struct pvr2_buffer *bp,void *ptr,unsigned int cnt)
 {
         int ret = 0;
@@ -646,7 +650,6 @@ int pvr2_buffer_get_status(struct pvr2_buffer *bp)
         return bp->status;
 }
 
-
 int pvr2_buffer_get_id(struct pvr2_buffer *bp)
 {
         return bp->id;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-io.h b/drivers/media/video/pvrusb2/pvrusb2-io.h
index 96285ad234a6..93279cc2a35e 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-io.h
+++ b/drivers/media/video/pvrusb2/pvrusb2-io.h
@@ -47,6 +47,7 @@ void pvr2_stream_set_callback(struct pvr2_stream *,
                               void *data);
 
 /* Query / set the nominal buffer count */
+int pvr2_stream_get_buffer_count(struct pvr2_stream *);
 int pvr2_stream_set_buffer_count(struct pvr2_stream *,unsigned int);
 
 /* Get a pointer to a buffer that is either idle, ready, or is specified
@@ -58,6 +59,7 @@ struct pvr2_buffer *pvr2_stream_get_buffer(struct pvr2_stream *sp,int id);
 /* Find out how many buffers are idle or ready */
 int pvr2_stream_get_ready_count(struct pvr2_stream *);
 
+
 /* Kill all pending buffers and throw away any ready buffers as well */
 void pvr2_stream_kill(struct pvr2_stream *);
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ioread.c b/drivers/media/video/pvrusb2/pvrusb2-ioread.c
index f7a2e225a002..b71f9a961f8a 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ioread.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ioread.c
@@ -213,7 +213,9 @@ int pvr2_ioread_setup(struct pvr2_ioread *cp,struct pvr2_stream *sp)
                                    " pvr2_ioread_setup (tear-down) id=%p",cp);
                         pvr2_ioread_stop(cp);
                         pvr2_stream_kill(cp->stream);
-                        pvr2_stream_set_buffer_count(cp->stream,0);
+                        if (pvr2_stream_get_buffer_count(cp->stream)) {
+                                pvr2_stream_set_buffer_count(cp->stream,0);
+                        }
                         cp->stream = NULL;
                 }
                 if (sp) {
@@ -251,7 +253,6 @@ int pvr2_ioread_set_enabled(struct pvr2_ioread *cp,int fl)
         return ret;
 }
 
-
 static int pvr2_ioread_get_buffer(struct pvr2_ioread *cp)
 {
         int stat;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-sysfs.c b/drivers/media/video/pvrusb2/pvrusb2-sysfs.c
index 6af55a8b6f05..d1dda5caf406 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-sysfs.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-sysfs.c
@@ -44,12 +44,16 @@ struct pvr2_sysfs {
         struct kobj_type ktype;
         struct class_device_attribute attr_v4l_minor_number;
         struct class_device_attribute attr_unit_number;
+        int v4l_minor_number_created_ok;
+        int unit_number_created_ok;
 };
 
 #ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
 struct pvr2_sysfs_debugifc {
         struct class_device_attribute attr_debugcmd;
         struct class_device_attribute attr_debuginfo;
+        int debugcmd_created_ok;
+        int debuginfo_created_ok;
 };
 #endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
 
@@ -67,6 +71,7 @@ struct pvr2_sysfs_ctl_item {
         struct pvr2_sysfs_ctl_item *item_next;
         struct attribute *attr_gen[7];
         struct attribute_group grp;
+        int created_ok;
         char name[80];
 };
 
@@ -487,6 +492,7 @@ static void pvr2_sysfs_add_control(struct pvr2_sysfs *sfp,int ctl_id)
         struct pvr2_sysfs_func_set *fp;
         struct pvr2_ctrl *cptr;
         unsigned int cnt,acnt;
+        int ret;
 
         if ((ctl_id < 0) || (ctl_id >= (sizeof(funcs)/sizeof(funcs[0])))) {
                 return;
@@ -589,7 +595,13 @@ static void pvr2_sysfs_add_control(struct pvr2_sysfs *sfp,int ctl_id)
         cip->grp.name = cip->name;
         cip->grp.attrs = cip->attr_gen;
 
-        sysfs_create_group(&sfp->class_dev->kobj,&cip->grp);
+        ret = sysfs_create_group(&sfp->class_dev->kobj,&cip->grp);
+        if (ret) {
+                printk(KERN_WARNING "%s: sysfs_create_group error: %d\n",
+                       __FUNCTION__, ret);
+                return;
+        }
+        cip->created_ok = !0;
 }
 
 #ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
@@ -600,6 +612,8 @@ static ssize_t debugcmd_store(struct class_device *,const char *,size_t count);
 static void pvr2_sysfs_add_debugifc(struct pvr2_sysfs *sfp)
 {
         struct pvr2_sysfs_debugifc *dip;
+        int ret;
+
         dip = kmalloc(sizeof(*dip),GFP_KERNEL);
         if (!dip) return;
         memset(dip,0,sizeof(*dip));
@@ -613,17 +627,34 @@ static void pvr2_sysfs_add_debugifc(struct pvr2_sysfs *sfp)
         dip->attr_debuginfo.attr.mode = S_IRUGO;
         dip->attr_debuginfo.show = debuginfo_show;
         sfp->debugifc = dip;
-        class_device_create_file(sfp->class_dev,&dip->attr_debugcmd);
-        class_device_create_file(sfp->class_dev,&dip->attr_debuginfo);
+        ret = class_device_create_file(sfp->class_dev,&dip->attr_debugcmd);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                dip->debugcmd_created_ok = !0;
+        }
+        ret = class_device_create_file(sfp->class_dev,&dip->attr_debuginfo);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                dip->debuginfo_created_ok = !0;
+        }
 }
 
 
 static void pvr2_sysfs_tear_down_debugifc(struct pvr2_sysfs *sfp)
 {
         if (!sfp->debugifc) return;
-        class_device_remove_file(sfp->class_dev,
-                                 &sfp->debugifc->attr_debuginfo);
-        class_device_remove_file(sfp->class_dev,&sfp->debugifc->attr_debugcmd);
+        if (sfp->debugifc->debuginfo_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->debugifc->attr_debuginfo);
+        }
+        if (sfp->debugifc->debugcmd_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->debugifc->attr_debugcmd);
+        }
         kfree(sfp->debugifc);
         sfp->debugifc = NULL;
 }
@@ -645,7 +676,9 @@ static void pvr2_sysfs_tear_down_controls(struct pvr2_sysfs *sfp)
         struct pvr2_sysfs_ctl_item *cip1,*cip2;
         for (cip1 = sfp->item_first; cip1; cip1 = cip2) {
                 cip2 = cip1->item_next;
-                sysfs_remove_group(&sfp->class_dev->kobj,&cip1->grp);
+                if (cip1->created_ok) {
+                        sysfs_remove_group(&sfp->class_dev->kobj,&cip1->grp);
+                }
                 pvr2_sysfs_trace("Destroying pvr2_sysfs_ctl_item id=%p",cip1);
                 kfree(cip1);
         }
@@ -675,8 +708,14 @@ static void class_dev_destroy(struct pvr2_sysfs *sfp)
         pvr2_sysfs_tear_down_debugifc(sfp);
 #endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
         pvr2_sysfs_tear_down_controls(sfp);
-        class_device_remove_file(sfp->class_dev,&sfp->attr_v4l_minor_number);
-        class_device_remove_file(sfp->class_dev,&sfp->attr_unit_number);
+        if (sfp->v4l_minor_number_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->attr_v4l_minor_number);
+        }
+        if (sfp->unit_number_created_ok) {
+                class_device_remove_file(sfp->class_dev,
+                                         &sfp->attr_unit_number);
+        }
         pvr2_sysfs_trace("Destroying class_dev id=%p",sfp->class_dev);
         sfp->class_dev->class_data = NULL;
         class_device_unregister(sfp->class_dev);
@@ -709,6 +748,8 @@ static void class_dev_create(struct pvr2_sysfs *sfp,
 {
         struct usb_device *usb_dev;
         struct class_device *class_dev;
+        int ret;
+
         usb_dev = pvr2_hdw_get_dev(sfp->channel.hdw);
         if (!usb_dev) return;
         class_dev = kmalloc(sizeof(*class_dev),GFP_KERNEL);
@@ -733,20 +774,40 @@ static void class_dev_create(struct pvr2_sysfs *sfp,
 
         sfp->class_dev = class_dev;
         class_dev->class_data = sfp;
-        class_device_register(class_dev);
+        ret = class_device_register(class_dev);
+        if (ret) {
+                printk(KERN_ERR "%s: class_device_register failed\n",
+                       __FUNCTION__);
+                kfree(class_dev);
+                return;
+        }
 
         sfp->attr_v4l_minor_number.attr.owner = THIS_MODULE;
         sfp->attr_v4l_minor_number.attr.name = "v4l_minor_number";
         sfp->attr_v4l_minor_number.attr.mode = S_IRUGO;
         sfp->attr_v4l_minor_number.show = v4l_minor_number_show;
         sfp->attr_v4l_minor_number.store = NULL;
-        class_device_create_file(sfp->class_dev,&sfp->attr_v4l_minor_number);
+        ret = class_device_create_file(sfp->class_dev,
+                                       &sfp->attr_v4l_minor_number);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                sfp->v4l_minor_number_created_ok = !0;
+        }
+
         sfp->attr_unit_number.attr.owner = THIS_MODULE;
         sfp->attr_unit_number.attr.name = "unit_number";
         sfp->attr_unit_number.attr.mode = S_IRUGO;
         sfp->attr_unit_number.show = unit_number_show;
         sfp->attr_unit_number.store = NULL;
-        class_device_create_file(sfp->class_dev,&sfp->attr_unit_number);
+        ret = class_device_create_file(sfp->class_dev,&sfp->attr_unit_number);
+        if (ret < 0) {
+                printk(KERN_WARNING "%s: class_device_create_file error: %d\n",
+                       __FUNCTION__, ret);
+        } else {
+                sfp->unit_number_created_ok = !0;
+        }
 
         pvr2_sysfs_add_controls(sfp);
 #ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
diff --git a/drivers/media/video/pwc/Kconfig b/drivers/media/video/pwc/Kconfig
index 697145e0bf15..8fdf7101d3bf 100644
--- a/drivers/media/video/pwc/Kconfig
+++ b/drivers/media/video/pwc/Kconfig
@@ -30,7 +30,7 @@ config USB_PWC
 
 config USB_PWC_DEBUG
         bool "USB Philips Cameras verbose debug"
-        depends USB_PWC
+        depends on USB_PWC
         help
           Say Y here in order to have the pwc driver generate verbose debugging
           messages.
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 47d0d83a0264..d4703944df9c 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -160,6 +160,7 @@ static struct file_operations pwc_fops = {
         .poll =         pwc_video_poll,
         .mmap =         pwc_video_mmap,
         .ioctl =        pwc_video_ioctl,
+        .compat_ioctl = v4l_compat_ioctl32,
         .llseek =       no_llseek,
 };
 static struct video_device pwc_template = {
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index f1fd69e7f119..d73cff1970ae 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -997,9 +997,9 @@ static int saa7134_alsa_init(void)
         struct saa7134_dev *dev = NULL;
         struct list_head *list;
 
-        if (!dmasound_init && !dmasound_exit) {
-                dmasound_init = alsa_device_init;
-                dmasound_exit = alsa_device_exit;
+        if (!saa7134_dmasound_init && !saa7134_dmasound_exit) {
+                saa7134_dmasound_init = alsa_device_init;
+                saa7134_dmasound_exit = alsa_device_exit;
         } else {
                 printk(KERN_WARNING "saa7134 ALSA: can't load, DMA sound handler already assigned (probably to OSS)\n");
                 return -EBUSY;
@@ -1036,8 +1036,8 @@ static void saa7134_alsa_exit(void)
                 snd_card_free(snd_saa7134_cards[idx]);
         }
 
-        dmasound_init = NULL;
-        dmasound_exit = NULL;
+        saa7134_dmasound_init = NULL;
+        saa7134_dmasound_exit = NULL;
         printk(KERN_INFO "saa7134 ALSA driver for DMA sound unloaded\n");
 
         return;
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index 6e97cc84ba89..be3a81fc90a2 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -95,8 +95,8 @@ LIST_HEAD(saa7134_devlist);
 static LIST_HEAD(mops_list);
 static unsigned int saa7134_devcount;
 
-int (*dmasound_init)(struct saa7134_dev *dev);
-int (*dmasound_exit)(struct saa7134_dev *dev);
+int (*saa7134_dmasound_init)(struct saa7134_dev *dev);
+int (*saa7134_dmasound_exit)(struct saa7134_dev *dev);
 
 #define dprintk(fmt, arg...)    if (core_debug) \
         printk(KERN_DEBUG "%s/core: " fmt, dev->name , ## arg)
@@ -1008,8 +1008,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
         /* check for signal */
         saa7134_irq_video_intl(dev);
 
-        if (dmasound_init && !dev->dmasound.priv_data) {
-                dmasound_init(dev);
+        if (saa7134_dmasound_init && !dev->dmasound.priv_data) {
+                saa7134_dmasound_init(dev);
         }
 
         return 0;
@@ -1036,8 +1036,8 @@ static void __devexit saa7134_finidev(struct pci_dev *pci_dev)
         struct saa7134_mpeg_ops *mops;
 
         /* Release DMA sound modules if present */
-        if (dmasound_exit && dev->dmasound.priv_data) {
-                dmasound_exit(dev);
+        if (saa7134_dmasound_exit && dev->dmasound.priv_data) {
+                saa7134_dmasound_exit(dev);
         }
 
         /* debugging ... */
@@ -1169,8 +1169,8 @@ EXPORT_SYMBOL(saa7134_boards);
 
 /* ----------------- for the DMA sound modules --------------- */
 
-EXPORT_SYMBOL(dmasound_init);
-EXPORT_SYMBOL(dmasound_exit);
+EXPORT_SYMBOL(saa7134_dmasound_init);
+EXPORT_SYMBOL(saa7134_dmasound_exit);
 EXPORT_SYMBOL(saa7134_pgtable_free);
 EXPORT_SYMBOL(saa7134_pgtable_build);
 EXPORT_SYMBOL(saa7134_pgtable_alloc);
diff --git a/drivers/media/video/saa7134/saa7134-oss.c b/drivers/media/video/saa7134/saa7134-oss.c
index 3895d05804ae..2e3ba5f31453 100644
--- a/drivers/media/video/saa7134/saa7134-oss.c
+++ b/drivers/media/video/saa7134/saa7134-oss.c
@@ -993,9 +993,9 @@ static int saa7134_oss_init(void)
         struct saa7134_dev *dev = NULL;
         struct list_head *list;
 
-        if (!dmasound_init && !dmasound_exit) {
-                dmasound_init = oss_device_init;
-                dmasound_exit = oss_device_exit;
+        if (!saa7134_dmasound_init && !saa7134_dmasound_exit) {
+                saa7134_dmasound_init = oss_device_init;
+                saa7134_dmasound_exit = oss_device_exit;
         } else {
                 printk(KERN_WARNING "saa7134 OSS: can't load, DMA sound handler already assigned (probably to ALSA)\n");
                 return -EBUSY;
@@ -1037,8 +1037,8 @@ static void saa7134_oss_exit(void)
 
         }
 
-        dmasound_init = NULL;
-        dmasound_exit = NULL;
+        saa7134_dmasound_init = NULL;
+        saa7134_dmasound_exit = NULL;
 
         printk(KERN_INFO "saa7134 OSS driver for DMA sound unloaded\n");
 
diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c
index e4156ec9c6d7..2c171af9a9f2 100644
--- a/drivers/media/video/saa7134/saa7134-video.c
+++ b/drivers/media/video/saa7134/saa7134-video.c
@@ -40,7 +40,7 @@
 
 static unsigned int video_debug   = 0;
 static unsigned int gbuffers      = 8;
-static unsigned int noninterlaced = 0;
+static unsigned int noninterlaced = 1;
 static unsigned int gbufsize      = 720*576*4;
 static unsigned int gbufsize_max  = 720*576*4;
 module_param(video_debug, int, 0644);
@@ -48,7 +48,7 @@ MODULE_PARM_DESC(video_debug,"enable debug messages [video]");
 module_param(gbuffers, int, 0444);
 MODULE_PARM_DESC(gbuffers,"number of capture buffers, range 2-32");
 module_param(noninterlaced, int, 0644);
-MODULE_PARM_DESC(noninterlaced,"video input is noninterlaced");
+MODULE_PARM_DESC(noninterlaced,"capture non interlaced video");
 
 #define dprintk(fmt, arg...)    if (video_debug) \
         printk(KERN_DEBUG "%s/video: " fmt, dev->name , ## arg)
@@ -2087,7 +2087,7 @@ static int video_do_ioctl(struct inode *inode, struct file *file,
                 struct v4l2_format *f = arg;
                 return saa7134_try_fmt(dev,fh,f);
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGMBUF:
         {
                 struct video_mbuf *mbuf = arg;
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index d5ee99c574cc..c04ce6152fd5 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -586,8 +586,8 @@ void saa7134_dma_free(struct videobuf_queue *q,struct saa7134_buf *buf);
 
 int saa7134_set_dmabits(struct saa7134_dev *dev);
 
-extern int (*dmasound_init)(struct saa7134_dev *dev);
-extern int (*dmasound_exit)(struct saa7134_dev *dev);
+extern int (*saa7134_dmasound_init)(struct saa7134_dev *dev);
+extern int (*saa7134_dmasound_exit)(struct saa7134_dev *dev);
 
 
 /* ----------------------------------------------------------- */
diff --git a/drivers/media/video/stradis.c b/drivers/media/video/stradis.c
index b36ba9fa3a28..5686547ba76a 100644
--- a/drivers/media/video/stradis.c
+++ b/drivers/media/video/stradis.c
@@ -2181,7 +2181,6 @@ static struct pci_device_id stradis_pci_tbl[] = {
         { 0 }
 };
 
-MODULE_DEVICE_TABLE(pci, stradis_pci_tbl);
 
 static struct pci_driver stradis_driver = {
         .name = "stradis",
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index f7eb402d5f2b..40590bae5ff7 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -196,14 +196,6 @@ static void set_type(struct i2c_client *c, unsigned int type,
                 i2c_master_send(c, buffer, 4);
                 default_tuner_init(c);
                 break;
-        case TUNER_LG_TDVS_H06XF:
-                /* Set the Auxiliary Byte. */
-                buffer[2] &= ~0x20;
-                buffer[2] |= 0x18;
-                buffer[3] = 0x20;
-                i2c_master_send(c, buffer, 4);
-                default_tuner_init(c);
-                break;
         case TUNER_PHILIPS_TD1316:
                 buffer[0] = 0x0b;
                 buffer[1] = 0xdc;
@@ -598,6 +590,7 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 if (t->standby)
                         t->standby (client);
                 break;
+#ifdef CONFIG_VIDEO_V4L1
         case VIDIOCSAUDIO:
                 if (check_mode(t, "VIDIOCSAUDIO") == EINVAL)
                         return 0;
@@ -607,17 +600,6 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 /* Should be implemented, since bttv calls it */
                 tuner_dbg("VIDIOCSAUDIO not implemented.\n");
                 break;
-        case TDA9887_SET_CONFIG:
-                if (t->type == TUNER_TDA9887) {
-                        int *i = arg;
-
-                        t->tda9887_config = *i;
-                        set_freq(client, t->tv_freq);
-                }
-                break;
-        /* --- v4l ioctls --- */
-        /* take care: bttv does userspace copying, we'll get a
-           kernel pointer here... */
         case VIDIOCSCHAN:
                 {
                         static const v4l2_std_id map[] = {
@@ -701,7 +683,18 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                                     ? VIDEO_SOUND_STEREO : VIDEO_SOUND_MONO;
                         return 0;
                 }
+#endif
+        case TDA9887_SET_CONFIG:
+                if (t->type == TUNER_TDA9887) {
+                        int *i = arg;
 
+                        t->tda9887_config = *i;
+                        set_freq(client, t->tv_freq);
+                }
+                break;
+        /* --- v4l ioctls --- */
+        /* take care: bttv does userspace copying, we'll get a
+           kernel pointer here... */
         case VIDIOC_S_STD:
                 {
                         v4l2_std_id *id = arg;
diff --git a/drivers/media/video/tuner-simple.c b/drivers/media/video/tuner-simple.c
index d071c5cbf013..abe37cf632c6 100644
--- a/drivers/media/video/tuner-simple.c
+++ b/drivers/media/video/tuner-simple.c
@@ -339,7 +339,20 @@ static void default_set_tv_freq(struct i2c_client *c, unsigned int freq)
         if (4 != (rc = i2c_master_send(c,buffer,4)))
                 tuner_warn("i2c i/o error: rc == %d (should be 4)\n",rc);
 
-        if (t->type == TUNER_MICROTUNE_4042FI5) {
+        switch (t->type) {
+        case TUNER_LG_TDVS_H06XF:
+                /* Set the Auxiliary Byte. */
+                buffer[0] = buffer[2];
+                buffer[0] &= ~0x20;
+                buffer[0] |= 0x18;
+                buffer[1] = 0x20;
+                tuner_dbg("tv 0x%02x 0x%02x\n",buffer[0],buffer[1]);
+
+                if (2 != (rc = i2c_master_send(c,buffer,2)))
+                        tuner_warn("i2c i/o error: rc == %d (should be 2)\n",rc);
+                break;
+        case TUNER_MICROTUNE_4042FI5:
+        {
                 // FIXME - this may also work for other tuners
                 unsigned long timeout = jiffies + msecs_to_jiffies(1);
                 u8 status_byte = 0;
@@ -364,10 +377,12 @@ static void default_set_tv_freq(struct i2c_client *c, unsigned int freq)
                 buffer[2] = config;
                 buffer[3] = cb;
                 tuner_dbg("tv 0x%02x 0x%02x 0x%02x 0x%02x\n",
-                       buffer[0],buffer[1],buffer[2],buffer[3]);
+                          buffer[0],buffer[1],buffer[2],buffer[3]);
 
                 if (4 != (rc = i2c_master_send(c,buffer,4)))
                         tuner_warn("i2c i/o error: rc == %d (should be 4)\n",rc);
+                break;
+        }
         }
 }
 
diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
index a167e17c6dcd..d7eadc2c298d 100644
--- a/drivers/media/video/tuner-types.c
+++ b/drivers/media/video/tuner-types.c
@@ -1027,10 +1027,11 @@ static struct tuner_params tuner_tnf_5335mf_params[] = {
 /* 70-79 */
 /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
 
+/* '+ 4' turns on the Low Noise Amplifier */
 static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
-        { 16 * 130.00 /*MHz*/, 0xce, 0x01, },
-        { 16 * 364.50 /*MHz*/, 0xce, 0x02, },
-        { 16 * 999.99        , 0xce, 0x08, },
+        { 16 * 130.00 /*MHz*/, 0xce, 0x01 + 4, },
+        { 16 * 364.50 /*MHz*/, 0xce, 0x02 + 4, },
+        { 16 * 999.99        , 0xce, 0x08 + 4, },
 };
 
 static struct tuner_params tuner_samsung_tcpn_2121p30a_params[] = {
@@ -1060,10 +1061,11 @@ static struct tuner_params tuner_thomson_fe6600_params[] = {
 
 /* ------------ TUNER_SAMSUNG_TCPG_6121P30A - Samsung PAL ------------ */
 
+/* '+ 4' turns on the Low Noise Amplifier */
 static struct tuner_range tuner_samsung_tcpg_6121p30a_pal_ranges[] = {
-        { 16 * 146.25 /*MHz*/, 0xce, 0x01, },
-        { 16 * 428.50 /*MHz*/, 0xce, 0x02, },
-        { 16 * 999.99        , 0xce, 0x08, },
+        { 16 * 146.25 /*MHz*/, 0xce, 0x01 + 4, },
+        { 16 * 428.50 /*MHz*/, 0xce, 0x02 + 4, },
+        { 16 * 999.99        , 0xce, 0x08 + 4, },
 };
 
 static struct tuner_params tuner_samsung_tcpg_6121p30a_params[] = {
diff --git a/drivers/media/video/usbvideo/Kconfig b/drivers/media/video/usbvideo/Kconfig
index 59fb899f31f3..a0fd82b924f2 100644
--- a/drivers/media/video/usbvideo/Kconfig
+++ b/drivers/media/video/usbvideo/Kconfig
@@ -3,7 +3,7 @@ config VIDEO_USBVIDEO
 
 config USB_VICAM
         tristate "USB 3com HomeConnect (aka vicam) support (EXPERIMENTAL)"
-        depends on USB && VIDEO_V4L1 && EXPERIMENTAL
+        depends on USB && VIDEO_DEV && VIDEO_V4L1 && EXPERIMENTAL
         select VIDEO_USBVIDEO
         ---help---
           Say Y here if you have 3com homeconnect camera (vicam).
@@ -13,7 +13,7 @@ config USB_VICAM
 
 config USB_IBMCAM
         tristate "USB IBM (Xirlink) C-it Camera support"
-        depends on USB && VIDEO_V4L1
+        depends on USB && VIDEO_DEV && VIDEO_V4L1
         select VIDEO_USBVIDEO
         ---help---
           Say Y here if you want to connect a IBM "C-It" camera, also known as
@@ -28,7 +28,7 @@ config USB_IBMCAM
 
 config USB_KONICAWC
         tristate "USB Konica Webcam support"
-        depends on USB && VIDEO_V4L1
+        depends on USB && VIDEO_DEV && VIDEO_V4L1
         select VIDEO_USBVIDEO
         ---help---
           Say Y here if you want support for webcams based on a Konica
@@ -39,7 +39,7 @@ config USB_KONICAWC
 
 config USB_QUICKCAM_MESSENGER
         tristate "USB Logitech Quickcam Messenger"
-        depends on USB && VIDEO_DEV
+        depends on USB && VIDEO_DEV && VIDEO_V4L1
         select VIDEO_USBVIDEO
         ---help---
           Say Y or M here to enable support for the USB Logitech Quickcam
diff --git a/drivers/media/video/v4l1-compat.c b/drivers/media/video/v4l1-compat.c
index d83a2c84d233..d7c3fcbc80f7 100644
--- a/drivers/media/video/v4l1-compat.c
+++ b/drivers/media/video/v4l1-compat.c
@@ -599,6 +599,10 @@ v4l_compat_translate_ioctl(struct inode         *inode,
                         dprintk("VIDIOCGPICT / VIDIOC_G_FMT: %d\n",err);
                         break;
                 }
+
+                pict->depth   = ((fmt2->fmt.pix.bytesperline<<3)
+                                 + (fmt2->fmt.pix.width-1) )
+                                 /fmt2->fmt.pix.width;
                 pict->palette = pixelformat_to_palette(
                         fmt2->fmt.pix.pixelformat);
                 break;
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index f06dc19e504a..8d972ffdaf98 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -202,7 +202,7 @@ static char *v4l2_memory_names[] = {
 /* ------------------------------------------------------------------ */
 /* debug help functions                                               */
 
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 static const char *v4l1_ioctls[] = {
         [_IOC_NR(VIDIOCGCAP)]       = "VIDIOCGCAP",
         [_IOC_NR(VIDIOCGCHAN)]      = "VIDIOCGCHAN",
@@ -301,7 +301,7 @@ static const char *v4l2_ioctls[] = {
 #define V4L2_IOCTLS ARRAY_SIZE(v4l2_ioctls)
 
 static const char *v4l2_int_ioctls[] = {
-#ifdef HAVE_VIDEO_DECODER
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         [_IOC_NR(DECODER_GET_CAPABILITIES)]    = "DECODER_GET_CAPABILITIES",
         [_IOC_NR(DECODER_GET_STATUS)]          = "DECODER_GET_STATUS",
         [_IOC_NR(DECODER_SET_NORM)]            = "DECODER_SET_NORM",
@@ -367,7 +367,7 @@ void v4l_printk_ioctl(unsigned int cmd)
                        (_IOC_NR(cmd) < V4L2_INT_IOCTLS) ?
                        v4l2_int_ioctls[_IOC_NR(cmd)] : "UNKNOWN", dir, cmd);
                 break;
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case 'v':
                 printk("v4l1 ioctl %s, dir=%s (0x%08x)\n",
                        (_IOC_NR(cmd) < V4L1_IOCTLS) ?
@@ -414,6 +414,7 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                 printk ("%s: tuner type=%d\n", s, *p);
                 break;
         }
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case DECODER_SET_VBI_BYPASS:
         case DECODER_ENABLE_OUTPUT:
         case DECODER_GET_STATUS:
@@ -424,6 +425,7 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
         case VIDIOCCAPTURE:
         case VIDIOCSYNC:
         case VIDIOCSWRITEMODE:
+#endif
         case TUNER_SET_TYPE_ADDR:
         case TUNER_SET_STANDBY:
         case TDA9887_SET_CONFIG:
@@ -755,6 +757,7 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                                 p->afc);
                 break;
         }
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         case VIDIOCGVBIFMT:
         case VIDIOCSVBIFMT:
         {
@@ -924,6 +927,14 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                                 p->clipcount);
                 break;
         }
+        case VIDIOCGFREQ:
+        case VIDIOCSFREQ:
+        {
+                unsigned long *p=arg;
+                printk ("%s: value=%lu\n", s, *p);
+                break;
+        }
+#endif
         case VIDIOC_INT_AUDIO_CLOCK_FREQ:
         case VIDIOC_INT_I2S_CLOCK_FREQ:
         case VIDIOC_INT_S_STANDBY:
@@ -933,13 +944,6 @@ void v4l_printk_ioctl_arg(char *s,unsigned int cmd, void *arg)
                 printk ("%s: value=%d\n", s, *p);
                 break;
         }
-        case VIDIOCGFREQ:
-        case VIDIOCSFREQ:
-        {
-                unsigned long *p=arg;
-                printk ("%s: value=%lu\n", s, *p);
-                break;
-        }
         case VIDIOC_G_STD:
         case VIDIOC_S_STD:
         case VIDIOC_QUERYSTD:
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index b26ebaff226f..88bf2af2a0e7 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -760,7 +760,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                 ret=vfd->vidioc_overlay(file, fh, *i);
                 break;
         }
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         /* --- streaming capture ------------------------------------- */
         case VIDIOCGMBUF:
         {
@@ -1512,6 +1512,7 @@ int video_register_device(struct video_device *vfd, int type, int nr)
         int i=0;
         int base;
         int end;
+        int ret;
         char *name_base;
 
         switch(type)
@@ -1537,6 +1538,8 @@ int video_register_device(struct video_device *vfd, int type, int nr)
                         name_base = "radio";
                         break;
                 default:
+                        printk(KERN_ERR "%s called with unknown type: %d\n",
+                               __FUNCTION__, type);
                         return -1;
         }
 
@@ -1571,9 +1574,18 @@ int video_register_device(struct video_device *vfd, int type, int nr)
         vfd->class_dev.class       = &video_class;
         vfd->class_dev.devt        = MKDEV(VIDEO_MAJOR, vfd->minor);
         sprintf(vfd->class_dev.class_id, "%s%d", name_base, i - base);
-        class_device_register(&vfd->class_dev);
-        class_device_create_file(&vfd->class_dev,
-                                &class_device_attr_name);
+        ret = class_device_register(&vfd->class_dev);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: class_device_register failed\n",
+                       __FUNCTION__);
+                goto fail_minor;
+        }
+        ret = class_device_create_file(&vfd->class_dev, &class_device_attr_name);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: class_device_create_file 'name' failed\n",
+                       __FUNCTION__);
+                goto fail_classdev;
+        }
 
 #if 1
         /* needed until all drivers are fixed */
@@ -1583,6 +1595,15 @@ int video_register_device(struct video_device *vfd, int type, int nr)
                        "http://lwn.net/Articles/36850/\n", vfd->name);
 #endif
         return 0;
+
+fail_classdev:
+        class_device_unregister(&vfd->class_dev);
+fail_minor:
+        mutex_lock(&videodev_lock);
+        video_device[vfd->minor] = NULL;
+        vfd->minor = -1;
+        mutex_unlock(&videodev_lock);
+        return ret;
 }
 
 /**
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index 41d23c8acbd8..841884af0cc0 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -986,7 +986,7 @@ static int vidioc_dqbuf (struct file *file, void *priv, struct v4l2_buffer *p)
                                 file->f_flags & O_NONBLOCK));
 }
 
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 static int vidiocgmbuf (struct file *file, void *priv, struct video_mbuf *mbuf)
 {
         struct vivi_fh  *fh=priv;
@@ -1328,7 +1328,7 @@ static struct video_device vivi = {
         .vidioc_s_ctrl        = vidioc_s_ctrl,
         .vidioc_streamon      = vidioc_streamon,
         .vidioc_streamoff     = vidioc_streamoff,
-#ifdef HAVE_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
         .vidiocgmbuf          = vidiocgmbuf,
 #endif
         .tvnorms              = tvnorms,
diff --git a/drivers/mmc/mmc_queue.c b/drivers/mmc/mmc_queue.c
index 0b9682e9a357..74f8cdeeff0f 100644
--- a/drivers/mmc/mmc_queue.c
+++ b/drivers/mmc/mmc_queue.c
@@ -79,7 +79,8 @@ static int mmc_queue_thread(void *d)
                 spin_lock_irq(q->queue_lock);
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (!blk_queue_plugged(q))
-                        mq->req = req = elv_next_request(q);
+                        req = elv_next_request(q);
+                mq->req = req;
                 spin_unlock_irq(q->queue_lock);
 
                 if (!req) {
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 8a30ef3ae419..c351c6d1a18a 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -41,7 +41,7 @@
 #include "wbsd.h"
 
 #define DRIVER_NAME "wbsd"
-#define DRIVER_VERSION "1.5"
+#define DRIVER_VERSION "1.6"
 
 #define DBG(x...) \
         pr_debug(DRIVER_NAME ": " x)
@@ -1439,13 +1439,13 @@ static int __devinit wbsd_scan(struct wbsd_host *host)
 
 static int __devinit wbsd_request_region(struct wbsd_host *host, int base)
 {
-        if (io & 0x7)
+        if (base & 0x7)
                 return -EINVAL;
 
         if (!request_region(base, 8, DRIVER_NAME))
                 return -EIO;
 
-        host->base = io;
+        host->base = base;
 
         return 0;
 }
@@ -1773,7 +1773,7 @@ static int __devinit wbsd_init(struct device *dev, int base, int irq, int dma,
         /*
          * Request resources.
          */
-        ret = wbsd_request_resources(host, io, irq, dma);
+        ret = wbsd_request_resources(host, base, irq, dma);
         if (ret) {
                 wbsd_release_resources(host);
                 wbsd_free_mmc(dev);
@@ -1861,6 +1861,7 @@ static void __devexit wbsd_shutdown(struct device *dev, int pnp)
 
 static int __devinit wbsd_probe(struct platform_device *dev)
 {
+        /* Use the module parameters for resources */
         return wbsd_init(&dev->dev, io, irq, dma, 0);
 }
 
diff --git a/drivers/net/appletalk/Kconfig b/drivers/net/appletalk/Kconfig
index b14e89004c3a..0a0e0cd81a23 100644
--- a/drivers/net/appletalk/Kconfig
+++ b/drivers/net/appletalk/Kconfig
@@ -29,7 +29,7 @@ config ATALK
           even politically correct people are allowed to say Y here.
 
 config DEV_APPLETALK
-        bool "Appletalk interfaces support"
+        tristate "Appletalk interfaces support"
         depends on ATALK
         help
           AppleTalk is the protocol that Apple computers can use to communicate
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index da62db897426..627f224d78bc 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3127,7 +3127,7 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 break;
         }
 
-        /* NOTE: dev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+        /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
          * means we reserve 2 more, this pushes us to allocate from the next
          * larger slab size
          * i.e. RXBUFFER_2048 --> size-4096 slab */
@@ -3708,7 +3708,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
 #define E1000_CB_LENGTH 256
                 if (length < E1000_CB_LENGTH) {
                         struct sk_buff *new_skb =
-                            dev_alloc_skb(length + NET_IP_ALIGN);
+                            netdev_alloc_skb(netdev, length + NET_IP_ALIGN);
                         if (new_skb) {
                                 skb_reserve(new_skb, NET_IP_ALIGN);
                                 new_skb->dev = netdev;
@@ -3979,7 +3979,7 @@ e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
 
         while (cleaned_count--) {
                 if (!(skb = buffer_info->skb))
-                        skb = dev_alloc_skb(bufsz);
+                        skb = netdev_alloc_skb(netdev, bufsz);
                 else {
                         skb_trim(skb, 0);
                         goto map_skb;
@@ -3997,7 +3997,7 @@ e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                         DPRINTK(RX_ERR, ERR, "skb align check failed: %u bytes "
                                              "at %p\n", bufsz, skb->data);
                         /* Try again, without freeing the previous */
-                        skb = dev_alloc_skb(bufsz);
+                        skb = netdev_alloc_skb(netdev, bufsz);
                         /* Failed allocation, critical failure */
                         if (!skb) {
                                 dev_kfree_skb(oldskb);
@@ -4121,7 +4121,8 @@ e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                                 rx_desc->read.buffer_addr[j+1] = ~0;
                 }
 
-                skb = dev_alloc_skb(adapter->rx_ps_bsize0 + NET_IP_ALIGN);
+                skb = netdev_alloc_skb(netdev,
+                                       adapter->rx_ps_bsize0 + NET_IP_ALIGN);
 
                 if (unlikely(!skb)) {
                         adapter->alloc_rx_buff_failed++;
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index c3e52c806b13..9bdd43ab3573 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -177,6 +177,7 @@ struct myri10ge_priv {
         struct work_struct watchdog_work;
         struct timer_list watchdog_timer;
         int watchdog_tx_done;
+        int watchdog_tx_req;
         int watchdog_resets;
         int tx_linearized;
         int pause;
@@ -448,6 +449,7 @@ static int myri10ge_load_hotplug_firmware(struct myri10ge_priv *mgp, u32 * size)
         struct mcp_gen_header *hdr;
         size_t hdr_offset;
         int status;
+        unsigned i;
 
         if ((status = request_firmware(&fw, mgp->fw_name, dev)) < 0) {
                 dev_err(dev, "Unable to load %s firmware image via hotplug\n",
@@ -479,18 +481,12 @@ static int myri10ge_load_hotplug_firmware(struct myri10ge_priv *mgp, u32 * size)
                 goto abort_with_fw;
 
         crc = crc32(~0, fw->data, fw->size);
-        if (mgp->tx.boundary == 2048) {
-                /* Avoid PCI burst on chipset with unaligned completions. */
-                int i;
-                __iomem u32 *ptr = (__iomem u32 *) (mgp->sram +
-                                                    MYRI10GE_FW_OFFSET);
-                for (i = 0; i < fw->size / 4; i++) {
-                        __raw_writel(((u32 *) fw->data)[i], ptr + i);
-                        wmb();
-                }
-        } else {
-                myri10ge_pio_copy(mgp->sram + MYRI10GE_FW_OFFSET, fw->data,
-                                  fw->size);
+        for (i = 0; i < fw->size; i += 256) {
+                myri10ge_pio_copy(mgp->sram + MYRI10GE_FW_OFFSET + i,
+                                  fw->data + i,
+                                  min(256U, (unsigned)(fw->size - i)));
+                mb();
+                readb(mgp->sram);
         }
         /* corruption checking is good for parity recovery and buggy chipset */
         memcpy_fromio(fw->data, mgp->sram + MYRI10GE_FW_OFFSET, fw->size);
@@ -2429,7 +2425,7 @@ static int myri10ge_resume(struct pci_dev *pdev)
         }
 
         myri10ge_reset(mgp);
-        myri10ge_dummy_rdma(mgp, mgp->tx.boundary != 4096);
+        myri10ge_dummy_rdma(mgp, 1);
 
         /* Save configuration space to be restored if the
          * nic resets due to a parity error */
@@ -2547,7 +2543,8 @@ static void myri10ge_watchdog_timer(unsigned long arg)
 
         mgp = (struct myri10ge_priv *)arg;
         if (mgp->tx.req != mgp->tx.done &&
-            mgp->tx.done == mgp->watchdog_tx_done)
+            mgp->tx.done == mgp->watchdog_tx_done &&
+            mgp->watchdog_tx_req != mgp->watchdog_tx_done)
                 /* nic seems like it might be stuck.. */
                 schedule_work(&mgp->watchdog_work);
         else
@@ -2556,6 +2553,7 @@ static void myri10ge_watchdog_timer(unsigned long arg)
                           jiffies + myri10ge_watchdog_timeout * HZ);
 
         mgp->watchdog_tx_done = mgp->tx.done;
+        mgp->watchdog_tx_req = mgp->tx.req;
 }
 
 static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 7d5c2233c252..f5aad77288f9 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -419,9 +419,8 @@ void phy_start_machine(struct phy_device *phydev,
 
 /* phy_stop_machine
  *
- * description: Stops the state machine timer, sets the state to
- *   UP (unless it wasn't up yet), and then frees the interrupt,
- *   if it is in use. This function must be called BEFORE
+ * description: Stops the state machine timer, sets the state to UP
+ *   (unless it wasn't up yet). This function must be called BEFORE
  *   phy_detach.
  */
 void phy_stop_machine(struct phy_device *phydev)
@@ -433,9 +432,6 @@ void phy_stop_machine(struct phy_device *phydev)
                 phydev->state = PHY_UP;
         spin_unlock(&phydev->lock);
 
-        if (phydev->irq != PHY_POLL)
-                phy_stop_interrupts(phydev);
-
         phydev->adjust_state = NULL;
 }
 
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index e1fe3a0a7b0b..132ed32bce1a 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -76,7 +76,7 @@
 #include "s2io.h"
 #include "s2io-regs.h"
 
-#define DRV_VERSION "2.0.14.2"
+#define DRV_VERSION "2.0.15.2"
 
 /* S2io Driver name & version. */
 static char s2io_driver_name[] = "Neterion";
@@ -370,38 +370,50 @@ static const u64 fix_mac[] = {
         END_SIGN
 };
 
+MODULE_AUTHOR("Raghavendra Koushik <raghavendra.koushik@neterion.com>");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+
+
 /* Module Loadable parameters. */
-static unsigned int tx_fifo_num = 1;
-static unsigned int tx_fifo_len[MAX_TX_FIFOS] =
-    {DEFAULT_FIFO_0_LEN, [1 ...(MAX_TX_FIFOS - 1)] = DEFAULT_FIFO_1_7_LEN};
-static unsigned int rx_ring_num = 1;
-static unsigned int rx_ring_sz[MAX_RX_RINGS] =
-    {[0 ...(MAX_RX_RINGS - 1)] = SMALL_BLK_CNT};
-static unsigned int rts_frm_len[MAX_RX_RINGS] =
-    {[0 ...(MAX_RX_RINGS - 1)] = 0 };
-static unsigned int rx_ring_mode = 1;
-static unsigned int use_continuous_tx_intrs = 1;
-static unsigned int rmac_pause_time = 0x100;
-static unsigned int mc_pause_threshold_q0q3 = 187;
-static unsigned int mc_pause_threshold_q4q7 = 187;
-static unsigned int shared_splits;
-static unsigned int tmac_util_period = 5;
-static unsigned int rmac_util_period = 5;
-static unsigned int bimodal = 0;
-static unsigned int l3l4hdr_size = 128;
-#ifndef CONFIG_S2IO_NAPI
-static unsigned int indicate_max_pkts;
-#endif
+S2IO_PARM_INT(tx_fifo_num, 1);
+S2IO_PARM_INT(rx_ring_num, 1);
+
+
+S2IO_PARM_INT(rx_ring_mode, 1);
+S2IO_PARM_INT(use_continuous_tx_intrs, 1);
+S2IO_PARM_INT(rmac_pause_time, 0x100);
+S2IO_PARM_INT(mc_pause_threshold_q0q3, 187);
+S2IO_PARM_INT(mc_pause_threshold_q4q7, 187);
+S2IO_PARM_INT(shared_splits, 0);
+S2IO_PARM_INT(tmac_util_period, 5);
+S2IO_PARM_INT(rmac_util_period, 5);
+S2IO_PARM_INT(bimodal, 0);
+S2IO_PARM_INT(l3l4hdr_size, 128);
 /* Frequency of Rx desc syncs expressed as power of 2 */
-static unsigned int rxsync_frequency = 3;
+S2IO_PARM_INT(rxsync_frequency, 3);
 /* Interrupt type. Values can be 0(INTA), 1(MSI), 2(MSI_X) */
-static unsigned int intr_type = 0;
+S2IO_PARM_INT(intr_type, 0);
 /* Large receive offload feature */
-static unsigned int lro = 0;
+S2IO_PARM_INT(lro, 0);
 /* Max pkts to be aggregated by LRO at one time. If not specified,
  * aggregation happens until we hit max IP pkt size(64K)
  */
-static unsigned int lro_max_pkts = 0xFFFF;
+S2IO_PARM_INT(lro_max_pkts, 0xFFFF);
+#ifndef CONFIG_S2IO_NAPI
+S2IO_PARM_INT(indicate_max_pkts, 0);
+#endif
+
+static unsigned int tx_fifo_len[MAX_TX_FIFOS] =
+    {DEFAULT_FIFO_0_LEN, [1 ...(MAX_TX_FIFOS - 1)] = DEFAULT_FIFO_1_7_LEN};
+static unsigned int rx_ring_sz[MAX_RX_RINGS] =
+    {[0 ...(MAX_RX_RINGS - 1)] = SMALL_BLK_CNT};
+static unsigned int rts_frm_len[MAX_RX_RINGS] =
+    {[0 ...(MAX_RX_RINGS - 1)] = 0 };
+
+module_param_array(tx_fifo_len, uint, NULL, 0);
+module_param_array(rx_ring_sz, uint, NULL, 0);
+module_param_array(rts_frm_len, uint, NULL, 0);
 
 /*
  * S2IO device table.
@@ -464,10 +476,9 @@ static int init_shared_mem(struct s2io_nic *nic)
                 size += config->tx_cfg[i].fifo_len;
         }
         if (size > MAX_AVAILABLE_TXDS) {
-                DBG_PRINT(ERR_DBG, "%s: Requested TxDs too high, ",
-                          __FUNCTION__);
+                DBG_PRINT(ERR_DBG, "s2io: Requested TxDs too high, ");
                 DBG_PRINT(ERR_DBG, "Requested: %d, max supported: 8192\n", size);
-                return FAILURE;
+                return -EINVAL;
         }
 
         lst_size = (sizeof(TxD_t) * config->max_txds);
@@ -547,6 +558,7 @@ static int init_shared_mem(struct s2io_nic *nic)
         nic->ufo_in_band_v = kmalloc((sizeof(u64) * size), GFP_KERNEL);
         if (!nic->ufo_in_band_v)
                 return -ENOMEM;
+        memset(nic->ufo_in_band_v, 0, size);
 
         /* Allocation and initialization of RXDs in Rings */
         size = 0;
@@ -1213,7 +1225,7 @@ static int init_nic(struct s2io_nic *nic)
                 break;
         }
 
-        /* Enable Tx FIFO partition 0. */
+        /* Enable all configured Tx FIFO partitions */
         val64 = readq(&bar0->tx_fifo_partition_0);
         val64 |= (TX_FIFO_PARTITION_EN);
         writeq(val64, &bar0->tx_fifo_partition_0);
@@ -1650,7 +1662,7 @@ static void en_dis_able_nic_intrs(struct s2io_nic *nic, u16 mask, int flag)
                         writeq(temp64, &bar0->general_int_mask);
                         /*
                          * If Hercules adapter enable GPIO otherwise
-                         * disabled all PCIX, Flash, MDIO, IIC and GPIO
+                         * disable all PCIX, Flash, MDIO, IIC and GPIO
                          * interrupts for now.
                          * TODO
                          */
@@ -2119,7 +2131,7 @@ static struct sk_buff *s2io_txdl_getskb(fifo_info_t *fifo_data, TxD_t *txdlp, in
                                        frag->size, PCI_DMA_TODEVICE);
                 }
         }
-        txdlp->Host_Control = 0;
+        memset(txdlp,0, (sizeof(TxD_t) * fifo_data->max_txds));
         return(skb);
 }
 
@@ -2371,9 +2383,14 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                         skb->data = (void *) (unsigned long)tmp;
                         skb->tail = (void *) (unsigned long)tmp;
 
-                        ((RxD3_t*)rxdp)->Buffer0_ptr =
-                            pci_map_single(nic->pdev, ba->ba_0, BUF0_LEN,
+                        if (!(((RxD3_t*)rxdp)->Buffer0_ptr))
+                                ((RxD3_t*)rxdp)->Buffer0_ptr =
+                                   pci_map_single(nic->pdev, ba->ba_0, BUF0_LEN,
                                            PCI_DMA_FROMDEVICE);
+                        else
+                                pci_dma_sync_single_for_device(nic->pdev,
+                                    (dma_addr_t) ((RxD3_t*)rxdp)->Buffer0_ptr,
+                                    BUF0_LEN, PCI_DMA_FROMDEVICE);
                         rxdp->Control_2 = SET_BUFFER0_SIZE_3(BUF0_LEN);
                         if (nic->rxd_mode == RXD_MODE_3B) {
                                 /* Two buffer mode */
@@ -2386,10 +2403,13 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                                 (nic->pdev, skb->data, dev->mtu + 4,
                                                 PCI_DMA_FROMDEVICE);
 
-                                /* Buffer-1 will be dummy buffer not used */
-                                ((RxD3_t*)rxdp)->Buffer1_ptr =
-                                pci_map_single(nic->pdev, ba->ba_1, BUF1_LEN,
-                                        PCI_DMA_FROMDEVICE);
+                                /* Buffer-1 will be dummy buffer. Not used */
+                                if (!(((RxD3_t*)rxdp)->Buffer1_ptr)) {
+                                        ((RxD3_t*)rxdp)->Buffer1_ptr =
+                                                pci_map_single(nic->pdev, 
+                                                ba->ba_1, BUF1_LEN,
+                                                PCI_DMA_FROMDEVICE);
+                                }
                                 rxdp->Control_2 |= SET_BUFFER1_SIZE_3(1);
                                 rxdp->Control_2 |= SET_BUFFER2_SIZE_3
                                                                 (dev->mtu + 4);
@@ -2614,23 +2634,23 @@ no_rx:
 }
 #endif
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
 /**
- * s2io_netpoll - Rx interrupt service handler for netpoll support
+ * s2io_netpoll - netpoll event handler entry point
  * @dev : pointer to the device structure.
  * Description:
- * Polling 'interrupt' - used by things like netconsole to send skbs
- * without having to re-enable interrupts. It's not called while
- * the interrupt routine is executing.
+ *      This function will be called by upper layer to check for events on the
+ * interface in situations where interrupts are disabled. It is used for
+ * specific in-kernel networking tasks, such as remote consoles and kernel
+ * debugging over the network (example netdump in RedHat).
  */
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
 static void s2io_netpoll(struct net_device *dev)
 {
         nic_t *nic = dev->priv;
         mac_info_t *mac_control;
         struct config_param *config;
         XENA_dev_config_t __iomem *bar0 = nic->bar0;
-        u64 val64;
+        u64 val64 = 0xFFFFFFFFFFFFFFFFULL;
         int i;
 
         disable_irq(dev->irq);
@@ -2639,9 +2659,17 @@ static void s2io_netpoll(struct net_device *dev)
         mac_control = &nic->mac_control;
         config = &nic->config;
 
-        val64 = readq(&bar0->rx_traffic_int);
         writeq(val64, &bar0->rx_traffic_int);
+        writeq(val64, &bar0->tx_traffic_int);
 
+        /* we need to free up the transmitted skbufs or else netpoll will 
+         * run out of skbs and will fail and eventually netpoll application such
+         * as netdump will fail.
+         */
+        for (i = 0; i < config->tx_fifo_num; i++)
+                tx_intr_handler(&mac_control->fifos[i]);
+
+        /* check for received packet and indicate up to network */
         for (i = 0; i < config->rx_ring_num; i++)
                 rx_intr_handler(&mac_control->rings[i]);
 
@@ -2708,7 +2736,7 @@ static void rx_intr_handler(ring_info_t *ring_data)
                 /* If your are next to put index then it's FIFO full condition */
                 if ((get_block == put_block) &&
                     (get_info.offset + 1) == put_info.offset) {
-                        DBG_PRINT(ERR_DBG, "%s: Ring Full\n",dev->name);
+                        DBG_PRINT(INTR_DBG, "%s: Ring Full\n",dev->name);
                         break;
                 }
                 skb = (struct sk_buff *) ((unsigned long)rxdp->Host_Control);
@@ -2728,18 +2756,15 @@ static void rx_intr_handler(ring_info_t *ring_data)
                                  HEADER_SNAP_SIZE,
                                  PCI_DMA_FROMDEVICE);
                 } else if (nic->rxd_mode == RXD_MODE_3B) {
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
+                        pci_dma_sync_single_for_cpu(nic->pdev, (dma_addr_t)
                                  ((RxD3_t*)rxdp)->Buffer0_ptr,
                                  BUF0_LEN, PCI_DMA_FROMDEVICE);
                         pci_unmap_single(nic->pdev, (dma_addr_t)
-                                 ((RxD3_t*)rxdp)->Buffer1_ptr,
-                                 BUF1_LEN, PCI_DMA_FROMDEVICE);
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
                                  ((RxD3_t*)rxdp)->Buffer2_ptr,
                                  dev->mtu + 4,
                                  PCI_DMA_FROMDEVICE);
                 } else {
-                        pci_unmap_single(nic->pdev, (dma_addr_t)
+                        pci_dma_sync_single_for_cpu(nic->pdev, (dma_addr_t)
                                          ((RxD3_t*)rxdp)->Buffer0_ptr, BUF0_LEN,
                                          PCI_DMA_FROMDEVICE);
                         pci_unmap_single(nic->pdev, (dma_addr_t)
@@ -3327,7 +3352,7 @@ static void s2io_reset(nic_t * sp)
 
         /* Clear certain PCI/PCI-X fields after reset */
         if (sp->device_type == XFRAME_II_DEVICE) {
-                /* Clear parity err detect bit */
+                /* Clear "detected parity error" bit */
                 pci_write_config_word(sp->pdev, PCI_STATUS, 0x8000);
 
                 /* Clearing PCIX Ecc status register */
@@ -3528,7 +3553,7 @@ static void restore_xmsi_data(nic_t *nic)
         u64 val64;
         int i;
 
-        for (i=0; i< nic->avail_msix_vectors; i++) {
+        for (i=0; i < MAX_REQUESTED_MSI_X; i++) {
                 writeq(nic->msix_info[i].addr, &bar0->xmsi_address);
                 writeq(nic->msix_info[i].data, &bar0->xmsi_data);
                 val64 = (BIT(7) | BIT(15) | vBIT(i, 26, 6));
@@ -3547,7 +3572,7 @@ static void store_xmsi_data(nic_t *nic)
         int i;
 
         /* Store and display */
-        for (i=0; i< nic->avail_msix_vectors; i++) {
+        for (i=0; i < MAX_REQUESTED_MSI_X; i++) {
                 val64 = (BIT(15) | vBIT(i, 26, 6));
                 writeq(val64, &bar0->xmsi_access);
                 if (wait_for_msix_trans(nic, i)) {
@@ -3808,13 +3833,11 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         TxD_t *txdp;
         TxFIFO_element_t __iomem *tx_fifo;
         unsigned long flags;
-#ifdef NETIF_F_TSO
-        int mss;
-#endif
         u16 vlan_tag = 0;
         int vlan_priority = 0;
         mac_info_t *mac_control;
         struct config_param *config;
+        int offload_type;
 
         mac_control = &sp->mac_control;
         config = &sp->config;
@@ -3862,13 +3885,11 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                 return 0;
         }
 
-        txdp->Control_1 = 0;
-        txdp->Control_2 = 0;
+        offload_type = s2io_offload_type(skb);
 #ifdef NETIF_F_TSO
-        mss = skb_shinfo(skb)->gso_size;
-        if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+        if (offload_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
                 txdp->Control_1 |= TXD_TCP_LSO_EN;
-                txdp->Control_1 |= TXD_TCP_LSO_MSS(mss);
+                txdp->Control_1 |= TXD_TCP_LSO_MSS(s2io_tcp_mss(skb));
         }
 #endif
         if (skb->ip_summed == CHECKSUM_HW) {
@@ -3886,10 +3907,10 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         frg_len = skb->len - skb->data_len;
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP) {
+        if (offload_type == SKB_GSO_UDP) {
                 int ufo_size;
 
-                ufo_size = skb_shinfo(skb)->gso_size;
+                ufo_size = s2io_udp_mss(skb);
                 ufo_size &= ~7;
                 txdp->Control_1 |= TXD_UFO_EN;
                 txdp->Control_1 |= TXD_UFO_MSS(ufo_size);
@@ -3906,16 +3927,13 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                                         sp->ufo_in_band_v,
                                         sizeof(u64), PCI_DMA_TODEVICE);
                 txdp++;
-                txdp->Control_1 = 0;
-                txdp->Control_2 = 0;
         }
 
         txdp->Buffer_Pointer = pci_map_single
             (sp->pdev, skb->data, frg_len, PCI_DMA_TODEVICE);
         txdp->Host_Control = (unsigned long) skb;
         txdp->Control_1 |= TXD_BUFFER0_SIZE(frg_len);
-
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+        if (offload_type == SKB_GSO_UDP)
                 txdp->Control_1 |= TXD_UFO_EN;
 
         frg_cnt = skb_shinfo(skb)->nr_frags;
@@ -3930,12 +3948,12 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
                     (sp->pdev, frag->page, frag->page_offset,
                      frag->size, PCI_DMA_TODEVICE);
                 txdp->Control_1 = TXD_BUFFER0_SIZE(frag->size);
-                if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+                if (offload_type == SKB_GSO_UDP)
                         txdp->Control_1 |= TXD_UFO_EN;
         }
         txdp->Control_1 |= TXD_GATHER_CODE_LAST;
 
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+        if (offload_type == SKB_GSO_UDP)
                 frg_cnt++; /* as Txd0 was used for inband header */
 
         tx_fifo = mac_control->tx_FIFO_start[queue];
@@ -3944,13 +3962,9 @@ static int s2io_xmit(struct sk_buff *skb, struct net_device *dev)
 
         val64 = (TX_FIFO_LAST_TXD_NUM(frg_cnt) | TX_FIFO_FIRST_LIST |
                  TX_FIFO_LAST_LIST);
-
-#ifdef NETIF_F_TSO
-        if (mss)
-                val64 |= TX_FIFO_SPECIAL_FUNC;
-#endif
-        if (skb_shinfo(skb)->gso_type == SKB_GSO_UDP)
+        if (offload_type)
                 val64 |= TX_FIFO_SPECIAL_FUNC;
+
         writeq(val64, &tx_fifo->List_Control);
 
         mmiowb();
@@ -3984,13 +3998,41 @@ s2io_alarm_handle(unsigned long data)
         mod_timer(&sp->alarm_timer, jiffies + HZ / 2);
 }
 
+static int s2io_chk_rx_buffers(nic_t *sp, int rng_n)
+{
+        int rxb_size, level;
+
+        if (!sp->lro) {
+                rxb_size = atomic_read(&sp->rx_bufs_left[rng_n]);
+                level = rx_buffer_level(sp, rxb_size, rng_n);
+
+                if ((level == PANIC) && (!TASKLET_IN_USE)) {
+                        int ret;
+                        DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", __FUNCTION__);
+                        DBG_PRINT(INTR_DBG, "PANIC levels\n");
+                        if ((ret = fill_rx_buffers(sp, rng_n)) == -ENOMEM) {
+                                DBG_PRINT(ERR_DBG, "Out of memory in %s",
+                                          __FUNCTION__);
+                                clear_bit(0, (&sp->tasklet_status));
+                                return -1;
+                        }
+                        clear_bit(0, (&sp->tasklet_status));
+                } else if (level == LOW)
+                        tasklet_schedule(&sp->task);
+
+        } else if (fill_rx_buffers(sp, rng_n) == -ENOMEM) {
+                        DBG_PRINT(ERR_DBG, "%s:Out of memory", sp->dev->name);
+                        DBG_PRINT(ERR_DBG, " in Rx Intr!!\n");
+        }
+        return 0;
+}
+
 static irqreturn_t
 s2io_msi_handle(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
         nic_t *sp = dev->priv;
         int i;
-        int ret;
         mac_info_t *mac_control;
         struct config_param *config;
 
@@ -4012,35 +4054,8 @@ s2io_msi_handle(int irq, void *dev_id, struct pt_regs *regs)
          * reallocate the buffers from the interrupt handler itself,
          * else schedule a tasklet to reallocate the buffers.
          */
-        for (i = 0; i < config->rx_ring_num; i++) {
-                if (!sp->lro) {
-                        int rxb_size = atomic_read(&sp->rx_bufs_left[i]);
-                        int level = rx_buffer_level(sp, rxb_size, i);
-
-                        if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                                DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", 
-                                                        dev->name);
-                                DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                                if ((ret = fill_rx_buffers(sp, i)) == -ENOMEM) {
-                                        DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                  dev->name);
-                                        DBG_PRINT(ERR_DBG, " in ISR!!\n");
-                                        clear_bit(0, (&sp->tasklet_status));
-                                        atomic_dec(&sp->isr_cnt);
-                                        return IRQ_HANDLED;
-                                }
-                                clear_bit(0, (&sp->tasklet_status));
-                        } else if (level == LOW) {
-                                tasklet_schedule(&sp->task);
-                        }
-                }
-                else if (fill_rx_buffers(sp, i) == -ENOMEM) {
-                                DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                        dev->name);
-                                DBG_PRINT(ERR_DBG, " in Rx Intr!!\n");
-                                break;
-                }
-        }
+        for (i = 0; i < config->rx_ring_num; i++)
+                s2io_chk_rx_buffers(sp, i);
 
         atomic_dec(&sp->isr_cnt);
         return IRQ_HANDLED;
@@ -4051,39 +4066,13 @@ s2io_msix_ring_handle(int irq, void *dev_id, struct pt_regs *regs)
 {
         ring_info_t *ring = (ring_info_t *)dev_id;
         nic_t *sp = ring->nic;
-        struct net_device *dev = (struct net_device *) dev_id;
-        int rxb_size, level, rng_n;
 
         atomic_inc(&sp->isr_cnt);
-        rx_intr_handler(ring);
-
-        rng_n = ring->ring_no;
-        if (!sp->lro) {
-                rxb_size = atomic_read(&sp->rx_bufs_left[rng_n]);
-                level = rx_buffer_level(sp, rxb_size, rng_n);
 
-                if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                        int ret;
-                        DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", __FUNCTION__);
-                        DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                        if ((ret = fill_rx_buffers(sp, rng_n)) == -ENOMEM) {
-                                DBG_PRINT(ERR_DBG, "Out of memory in %s",
-                                          __FUNCTION__);
-                                clear_bit(0, (&sp->tasklet_status));
-                                return IRQ_HANDLED;
-                        }
-                        clear_bit(0, (&sp->tasklet_status));
-                } else if (level == LOW) {
-                        tasklet_schedule(&sp->task);
-                }
-        }
-        else if (fill_rx_buffers(sp, rng_n) == -ENOMEM) {
-                        DBG_PRINT(ERR_DBG, "%s:Out of memory", dev->name);
-                        DBG_PRINT(ERR_DBG, " in Rx Intr!!\n");
-        }
+        rx_intr_handler(ring);
+        s2io_chk_rx_buffers(sp, ring->ring_no);
 
         atomic_dec(&sp->isr_cnt);
-
         return IRQ_HANDLED;
 }
 
@@ -4248,37 +4237,8 @@ static irqreturn_t s2io_isr(int irq, void *dev_id, struct pt_regs *regs)
          * else schedule a tasklet to reallocate the buffers.
          */
 #ifndef CONFIG_S2IO_NAPI
-        for (i = 0; i < config->rx_ring_num; i++) {
-                if (!sp->lro) {
-                        int ret;
-                        int rxb_size = atomic_read(&sp->rx_bufs_left[i]);
-                        int level = rx_buffer_level(sp, rxb_size, i);
-
-                        if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                                DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", 
-                                                        dev->name);
-                                DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                                if ((ret = fill_rx_buffers(sp, i)) == -ENOMEM) {
-                                        DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                  dev->name);
-                                        DBG_PRINT(ERR_DBG, " in ISR!!\n");
-                                        clear_bit(0, (&sp->tasklet_status));
-                                        atomic_dec(&sp->isr_cnt);
-                                        writeq(org_mask, &bar0->general_int_mask);
-                                        return IRQ_HANDLED;
-                                }
-                                clear_bit(0, (&sp->tasklet_status));
-                        } else if (level == LOW) {
-                                tasklet_schedule(&sp->task);
-                        }
-                }
-                else if (fill_rx_buffers(sp, i) == -ENOMEM) {
-                                DBG_PRINT(ERR_DBG, "%s:Out of memory",
-                                                        dev->name);
-                                DBG_PRINT(ERR_DBG, " in Rx intr!!\n");
-                                break;
-                }
-        }
+        for (i = 0; i < config->rx_ring_num; i++)
+                s2io_chk_rx_buffers(sp, i);
 #endif
         writeq(org_mask, &bar0->general_int_mask);
         atomic_dec(&sp->isr_cnt);
@@ -4308,6 +4268,8 @@ static void s2io_updt_stats(nic_t *sp)
                         if (cnt == 5)
                                 break; /* Updt failed */
                 } while(1);
+        } else {
+                memset(sp->mac_control.stats_info, 0, sizeof(StatInfo_t));
         }
 }
 
@@ -4942,7 +4904,8 @@ static int write_eeprom(nic_t * sp, int off, u64 data, int cnt)
 }
 static void s2io_vpd_read(nic_t *nic)
 {
-        u8 vpd_data[256],data;
+        u8 *vpd_data;
+        u8 data;
         int i=0, cnt, fail = 0;
         int vpd_addr = 0x80;
 
@@ -4955,6 +4918,10 @@ static void s2io_vpd_read(nic_t *nic)
                 vpd_addr = 0x50;
         }
 
+        vpd_data = kmalloc(256, GFP_KERNEL);
+        if (!vpd_data)
+                return;
+
         for (i = 0; i < 256; i +=4 ) {
                 pci_write_config_byte(nic->pdev, (vpd_addr + 2), i);
                 pci_read_config_byte(nic->pdev,  (vpd_addr + 2), &data);
@@ -4977,6 +4944,7 @@ static void s2io_vpd_read(nic_t *nic)
                 memset(nic->product_name, 0, vpd_data[1]);
                 memcpy(nic->product_name, &vpd_data[3], vpd_data[1]);
         }
+        kfree(vpd_data);
 }
 
 /**
@@ -5295,7 +5263,7 @@ static int s2io_link_test(nic_t * sp, uint64_t * data)
         else
                 *data = 0;
 
-        return 0;
+        return *data;
 }
 
 /**
@@ -5753,6 +5721,19 @@ static int s2io_ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
         return 0;
 }
 
+static u32 s2io_ethtool_op_get_tso(struct net_device *dev)
+{
+        return (dev->features & NETIF_F_TSO) != 0;
+}
+static int s2io_ethtool_op_set_tso(struct net_device *dev, u32 data)
+{
+        if (data)
+                dev->features |= (NETIF_F_TSO | NETIF_F_TSO6);
+        else
+                dev->features &= ~(NETIF_F_TSO | NETIF_F_TSO6);
+
+        return 0;
+}
 
 static struct ethtool_ops netdev_ethtool_ops = {
         .get_settings = s2io_ethtool_gset,
@@ -5773,8 +5754,8 @@ static struct ethtool_ops netdev_ethtool_ops = {
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
 #ifdef NETIF_F_TSO
-        .get_tso = ethtool_op_get_tso,
-        .set_tso = ethtool_op_set_tso,
+        .get_tso = s2io_ethtool_op_get_tso,
+        .set_tso = s2io_ethtool_op_set_tso,
 #endif
         .get_ufo = ethtool_op_get_ufo,
         .set_ufo = ethtool_op_set_ufo,
@@ -6337,7 +6318,7 @@ static int s2io_card_up(nic_t * sp)
         s2io_set_multicast(dev);
 
         if (sp->lro) {
-                /* Initialize max aggregatable pkts based on MTU */
+                /* Initialize max aggregatable pkts per session based on MTU */
                 sp->lro_max_aggr_per_sess = ((1<<16) - 1) / dev->mtu;
                 /* Check if we can use(if specified) user provided value */
                 if (lro_max_pkts < sp->lro_max_aggr_per_sess)
@@ -6438,7 +6419,7 @@ static void s2io_tx_watchdog(struct net_device *dev)
  *   @cksum : FCS checksum of the frame.
  *   @ring_no : the ring from which this RxD was extracted.
  *   Description:
- *   This function is called by the Tx interrupt serivce routine to perform
+ *   This function is called by the Rx interrupt serivce routine to perform
  *   some OS related operations on the SKB before passing it to the upper
  *   layers. It mainly checks if the checksum is OK, if so adds it to the
  *   SKBs cksum variable, increments the Rx packet count and passes the SKB
@@ -6698,33 +6679,6 @@ static void s2io_init_pci(nic_t * sp)
         pci_read_config_word(sp->pdev, PCI_COMMAND, &pci_cmd);
 }
 
-MODULE_AUTHOR("Raghavendra Koushik <raghavendra.koushik@neterion.com>");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(DRV_VERSION);
-
-module_param(tx_fifo_num, int, 0);
-module_param(rx_ring_num, int, 0);
-module_param(rx_ring_mode, int, 0);
-module_param_array(tx_fifo_len, uint, NULL, 0);
-module_param_array(rx_ring_sz, uint, NULL, 0);
-module_param_array(rts_frm_len, uint, NULL, 0);
-module_param(use_continuous_tx_intrs, int, 1);
-module_param(rmac_pause_time, int, 0);
-module_param(mc_pause_threshold_q0q3, int, 0);
-module_param(mc_pause_threshold_q4q7, int, 0);
-module_param(shared_splits, int, 0);
-module_param(tmac_util_period, int, 0);
-module_param(rmac_util_period, int, 0);
-module_param(bimodal, bool, 0);
-module_param(l3l4hdr_size, int , 0);
-#ifndef CONFIG_S2IO_NAPI
-module_param(indicate_max_pkts, int, 0);
-#endif
-module_param(rxsync_frequency, int, 0);
-module_param(intr_type, int, 0);
-module_param(lro, int, 0);
-module_param(lro_max_pkts, int, 0);
-
 static int s2io_verify_parm(struct pci_dev *pdev, u8 *dev_intr_type)
 {
         if ( tx_fifo_num > 8) {
@@ -6832,8 +6786,8 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         }
         if (dev_intr_type != MSI_X) {
                 if (pci_request_regions(pdev, s2io_driver_name)) {
-                        DBG_PRINT(ERR_DBG, "Request Regions failed\n"),
-                            pci_disable_device(pdev);
+                        DBG_PRINT(ERR_DBG, "Request Regions failed\n");
+                        pci_disable_device(pdev);
                         return -ENODEV;
                 }
         }
@@ -6957,7 +6911,7 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         /*  initialize the shared memory used by the NIC and the host */
         if (init_shared_mem(sp)) {
                 DBG_PRINT(ERR_DBG, "%s: Memory allocation failed\n",
-                          __FUNCTION__);
+                          dev->name);
                 ret = -ENOMEM;
                 goto mem_alloc_failed;
         }
@@ -7094,6 +7048,9 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         dev->addr_len = ETH_ALEN;
         memcpy(dev->dev_addr, sp->def_mac_addr, ETH_ALEN);
 
+        /* reset Nic and bring it to known state */
+        s2io_reset(sp);
+
         /*
          * Initialize the tasklet status and link state flags
          * and the card state parameter
@@ -7131,11 +7088,11 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
                 goto register_failed;
         }
         s2io_vpd_read(sp);
-        DBG_PRINT(ERR_DBG, "%s: Neterion %s",dev->name, sp->product_name);
-        DBG_PRINT(ERR_DBG, "(rev %d), Driver version %s\n",
-                                get_xena_rev_id(sp->pdev),
-                                s2io_driver_version);
         DBG_PRINT(ERR_DBG, "Copyright(c) 2002-2005 Neterion Inc.\n");
+        DBG_PRINT(ERR_DBG, "%s: Neterion %s (rev %d)\n",dev->name,
+                  sp->product_name, get_xena_rev_id(sp->pdev));
+        DBG_PRINT(ERR_DBG, "%s: Driver version %s\n", dev->name,
+                  s2io_driver_version);
         DBG_PRINT(ERR_DBG, "%s: MAC ADDR: "
                           "%02x:%02x:%02x:%02x:%02x:%02x\n", dev->name,
                           sp->def_mac_addr[0].mac_addr[0],
@@ -7436,8 +7393,13 @@ static int verify_l3_l4_lro_capable(lro_t *l_lro, struct iphdr *ip,
         if (ip->ihl != 5) /* IP has options */
                 return -1;
 
+        /* If we see CE codepoint in IP header, packet is not mergeable */
+        if (INET_ECN_is_ce(ipv4_get_dsfield(ip)))
+                return -1;
+
+        /* If we see ECE or CWR flags in TCP header, packet is not mergeable */
         if (tcp->urg || tcp->psh || tcp->rst || tcp->syn || tcp->fin ||
-                                                                !tcp->ack) {
+                                    tcp->ece || tcp->cwr || !tcp->ack) {
                 /*
                  * Currently recognize only the ack control word and
                  * any other control field being set would result in
@@ -7591,18 +7553,16 @@ static void queue_rx_frame(struct sk_buff *skb)
 static void lro_append_pkt(nic_t *sp, lro_t *lro, struct sk_buff *skb,
                            u32 tcp_len)
 {
-        struct sk_buff *tmp, *first = lro->parent;
+        struct sk_buff *first = lro->parent;
 
         first->len += tcp_len;
         first->data_len = lro->frags_len;
         skb_pull(skb, (skb->len - tcp_len));
-        if ((tmp = skb_shinfo(first)->frag_list)) {
-                while (tmp->next)
-                        tmp = tmp->next;
-                tmp->next = skb;
-        }
+        if (skb_shinfo(first)->frag_list)
+                lro->last_frag->next = skb;
         else
                 skb_shinfo(first)->frag_list = skb;
+        lro->last_frag = skb;
         sp->mac_control.stats_info->sw_stat.clubbed_frms_cnt++;
         return;
 }
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 217097bc22f1..5ed49c3be1e9 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -719,6 +719,7 @@ struct msix_info_st {
 /* Data structure to represent a LRO session */
 typedef struct lro {
         struct sk_buff  *parent;
+        struct sk_buff  *last_frag;
         u8              *l2h;
         struct iphdr    *iph;
         struct tcphdr   *tcph;
@@ -1011,4 +1012,13 @@ static void clear_lro_session(lro_t *lro);
 static void queue_rx_frame(struct sk_buff *skb);
 static void update_L3L4_header(nic_t *sp, lro_t *lro);
 static void lro_append_pkt(nic_t *sp, lro_t *lro, struct sk_buff *skb, u32 tcp_len);
+
+#define s2io_tcp_mss(skb) skb_shinfo(skb)->gso_size
+#define s2io_udp_mss(skb) skb_shinfo(skb)->gso_size
+#define s2io_offload_type(skb) skb_shinfo(skb)->gso_type
+
+#define S2IO_PARM_INT(X, def_val) \
+        static unsigned int X = def_val;\
+                module_param(X , uint, 0);
+
 #endif                          /* _S2IO_H */
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 1b8138f641e3..eafabb253f08 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.63"
-#define DRV_MODULE_RELDATE      "July 25, 2006"
+#define DRV_MODULE_VERSION      "3.65"
+#define DRV_MODULE_RELDATE      "August 07, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -123,9 +123,6 @@
                                    TG3_RX_RCB_RING_SIZE(tp))
 #define TG3_TX_RING_BYTES       (sizeof(struct tg3_tx_buffer_desc) * \
                                  TG3_TX_RING_SIZE)
-#define TX_BUFFS_AVAIL(TP)                                              \
-        ((TP)->tx_pending -                                             \
-         (((TP)->tx_prod - (TP)->tx_cons) & (TG3_TX_RING_SIZE - 1)))
 #define NEXT_TX(N)              (((N) + 1) & (TG3_TX_RING_SIZE - 1))
 
 #define RX_PKT_BUF_SZ           (1536 + tp->rx_offset + 64)
@@ -2987,6 +2984,13 @@ static void tg3_tx_recover(struct tg3 *tp)
         spin_unlock(&tp->lock);
 }
 
+static inline u32 tg3_tx_avail(struct tg3 *tp)
+{
+        smp_mb();
+        return (tp->tx_pending -
+                ((tp->tx_prod - tp->tx_cons) & (TG3_TX_RING_SIZE - 1)));
+}
+
 /* Tigon3 never reports partial packet sends.  So we do not
  * need special logic to handle SKBs that have not had all
  * of their frags sent yet, like SunGEM does.
@@ -3038,12 +3042,20 @@ static void tg3_tx(struct tg3 *tp)
 
         tp->tx_cons = sw_idx;
 
-        if (unlikely(netif_queue_stopped(tp->dev))) {
-                spin_lock(&tp->tx_lock);
+        /* Need to make the tx_cons update visible to tg3_start_xmit()
+         * before checking for netif_queue_stopped().  Without the
+         * memory barrier, there is a small possibility that tg3_start_xmit()
+         * will miss it and cause the queue to be stopped forever.
+         */
+        smp_mb();
+
+        if (unlikely(netif_queue_stopped(tp->dev) &&
+                     (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH))) {
+                netif_tx_lock(tp->dev);
                 if (netif_queue_stopped(tp->dev) &&
-                    (TX_BUFFS_AVAIL(tp) > TG3_TX_WAKEUP_THRESH))
+                    (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH))
                         netif_wake_queue(tp->dev);
-                spin_unlock(&tp->tx_lock);
+                netif_tx_unlock(tp->dev);
         }
 }
 
@@ -3097,11 +3109,10 @@ static int tg3_alloc_rx_skb(struct tg3 *tp, u32 opaque_key,
          * Callers depend upon this behavior and assume that
          * we leave everything unchanged if we fail.
          */
-        skb = dev_alloc_skb(skb_size);
+        skb = netdev_alloc_skb(tp->dev, skb_size);
         if (skb == NULL)
                 return -ENOMEM;
 
-        skb->dev = tp->dev;
         skb_reserve(skb, tp->rx_offset);
 
         mapping = pci_map_single(tp->pdev, skb->data,
@@ -3270,11 +3281,10 @@ static int tg3_rx(struct tg3 *tp, int budget)
                         tg3_recycle_rx(tp, opaque_key,
                                        desc_idx, *post_ptr);
 
-                        copy_skb = dev_alloc_skb(len + 2);
+                        copy_skb = netdev_alloc_skb(tp->dev, len + 2);
                         if (copy_skb == NULL)
                                 goto drop_it_no_recycle;
 
-                        copy_skb->dev = tp->dev;
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
@@ -3797,7 +3807,7 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * interrupt.  Furthermore, IRQ processing runs lockless so we have
          * no IRQ context deadlocks to worry about either.  Rejoice!
          */
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
+        if (unlikely(tg3_tx_avail(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
 
@@ -3893,12 +3903,10 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tw32_tx_mbox((MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW), entry);
 
         tp->tx_prod = entry;
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (MAX_SKB_FRAGS + 1))) {
-                spin_lock(&tp->tx_lock);
+        if (unlikely(tg3_tx_avail(tp) <= (MAX_SKB_FRAGS + 1))) {
                 netif_stop_queue(dev);
-                if (TX_BUFFS_AVAIL(tp) > TG3_TX_WAKEUP_THRESH)
+                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH)
                         netif_wake_queue(tp->dev);
-                spin_unlock(&tp->tx_lock);
         }
 
 out_unlock:
@@ -3920,7 +3928,7 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
         struct sk_buff *segs, *nskb;
 
         /* Estimate the number of fragments in the worst case */
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->gso_segs * 3))) {
+        if (unlikely(tg3_tx_avail(tp) <= (skb_shinfo(skb)->gso_segs * 3))) {
                 netif_stop_queue(tp->dev);
                 return NETDEV_TX_BUSY;
         }
@@ -3960,7 +3968,7 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
          * interrupt.  Furthermore, IRQ processing runs lockless so we have
          * no IRQ context deadlocks to worry about either.  Rejoice!
          */
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
+        if (unlikely(tg3_tx_avail(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
 
@@ -4110,12 +4118,10 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
         tw32_tx_mbox((MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW), entry);
 
         tp->tx_prod = entry;
-        if (unlikely(TX_BUFFS_AVAIL(tp) <= (MAX_SKB_FRAGS + 1))) {
-                spin_lock(&tp->tx_lock);
+        if (unlikely(tg3_tx_avail(tp) <= (MAX_SKB_FRAGS + 1))) {
                 netif_stop_queue(dev);
-                if (TX_BUFFS_AVAIL(tp) > TG3_TX_WAKEUP_THRESH)
+                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH)
                         netif_wake_queue(tp->dev);
-                spin_unlock(&tp->tx_lock);
         }
 
 out_unlock:
@@ -8618,7 +8624,7 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
         err = -EIO;
 
         tx_len = 1514;
-        skb = dev_alloc_skb(tx_len);
+        skb = netdev_alloc_skb(tp->dev, tx_len);
         if (!skb)
                 return -ENOMEM;
 
@@ -11474,7 +11480,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         tp->grc_mode |= GRC_MODE_BSWAP_NONFRM_DATA;
 #endif
         spin_lock_init(&tp->lock);
-        spin_lock_init(&tp->tx_lock);
         spin_lock_init(&tp->indirect_lock);
         INIT_WORK(&tp->reset_task, tg3_reset_task, tp);
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index ba2c98711c88..3ecf356cfb08 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2079,9 +2079,9 @@ struct tg3 {
          * lock: Held during reset, PHY access, timer, and when
          *       updating tg3_flags and tg3_flags2.
          *
-         * tx_lock: Held during tg3_start_xmit and tg3_tx only
-         *          when calling netif_[start|stop]_queue.
-         *          tg3_start_xmit is protected by netif_tx_lock.
+         * netif_tx_lock: Held during tg3_start_xmit. tg3_tx holds
+         *                netif_tx_lock when it needs to call
+         *                netif_wake_queue.
          *
          * Both of these locks are to be held with BH safety.
          *
@@ -2118,8 +2118,6 @@ struct tg3 {
         u32                             tx_cons;
         u32                             tx_pending;
 
-        spinlock_t                      tx_lock;
-
         struct tg3_tx_buffer_desc       *tx_ring;
         struct tx_ring_info             *tx_buffers;
         dma_addr_t                      tx_desc_mapping;
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index efc9c4bd826f..da9d06bdb818 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -797,7 +797,7 @@ static int zd1211_hw_init_hmac(struct zd_chip *chip)
                 { CR_ADDA_MBIAS_WARMTIME,       0x30000808 },
                 { CR_ZD1211_RETRY_MAX,          0x2 },
                 { CR_SNIFFER_ON,                0 },
-                { CR_RX_FILTER,                 AP_RX_FILTER },
+                { CR_RX_FILTER,                 STA_RX_FILTER },
                 { CR_GROUP_HASH_P1,             0x00 },
                 { CR_GROUP_HASH_P2,             0x80000000 },
                 { CR_REG1,                      0xa4 },
@@ -844,7 +844,7 @@ static int zd1211b_hw_init_hmac(struct zd_chip *chip)
                 { CR_ZD1211B_AIFS_CTL2,         0x008C003C },
                 { CR_ZD1211B_TXOP,              0x01800824 },
                 { CR_SNIFFER_ON,                0 },
-                { CR_RX_FILTER,                 AP_RX_FILTER },
+                { CR_RX_FILTER,                 STA_RX_FILTER },
                 { CR_GROUP_HASH_P1,             0x00 },
                 { CR_GROUP_HASH_P2,             0x80000000 },
                 { CR_REG1,                      0xa4 },
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 805121093ab5..069d2b467339 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -461,10 +461,15 @@
 
 #define CR_RX_FILTER                    CTL_REG(0x068c)
 #define RX_FILTER_ASSOC_RESPONSE        0x0002
+#define RX_FILTER_REASSOC_RESPONSE      0x0008
 #define RX_FILTER_PROBE_RESPONSE        0x0020
 #define RX_FILTER_BEACON                0x0100
+#define RX_FILTER_DISASSOC              0x0400
 #define RX_FILTER_AUTH                  0x0800
-/* Sniff modus sets filter to 0xfffff */
+#define AP_RX_FILTER                    0x0400feff
+#define STA_RX_FILTER                   0x0000ffff
+
+/* Monitor mode sets filter to 0xfffff */
 
 #define CR_ACK_TIMEOUT_EXT              CTL_REG(0x0690)
 #define CR_BCN_FIFO_SEMAPHORE           CTL_REG(0x0694)
@@ -546,9 +551,6 @@
 #define CR_ZD1211B_TXOP                 CTL_REG(0x0b20)
 #define CR_ZD1211B_RETRY_MAX            CTL_REG(0x0b28)
 
-#define AP_RX_FILTER                    0x0400feff
-#define STA_RX_FILTER                   0x0000ffff
-
 #define CWIN_SIZE                       0x007f043f
 
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 3bdc54d128d0..d6f3e02a0b54 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -108,7 +108,9 @@ int zd_mac_init_hw(struct zd_mac *mac, u8 device_type)
         if (r)
                 goto disable_int;
 
-        r = zd_set_encryption_type(chip, NO_WEP);
+        /* We must inform the device that we are doing encryption/decryption in
+         * software at the moment. */
+        r = zd_set_encryption_type(chip, ENC_SNIFFER);
         if (r)
                 goto disable_int;
 
@@ -136,10 +138,8 @@ static int reset_mode(struct zd_mac *mac)
 {
         struct ieee80211_device *ieee = zd_mac_to_ieee80211(mac);
         struct zd_ioreq32 ioreqs[3] = {
-                { CR_RX_FILTER, RX_FILTER_BEACON|RX_FILTER_PROBE_RESPONSE|
-                                RX_FILTER_AUTH|RX_FILTER_ASSOC_RESPONSE },
+                { CR_RX_FILTER, STA_RX_FILTER },
                 { CR_SNIFFER_ON, 0U },
-                { CR_ENCRYPTION_TYPE, NO_WEP },
         };
 
         if (ieee->iw_mode == IW_MODE_MONITOR) {
@@ -713,10 +713,10 @@ static int zd_mac_tx(struct zd_mac *mac, struct ieee80211_txb *txb, int pri)
 struct zd_rt_hdr {
         struct ieee80211_radiotap_header rt_hdr;
         u8  rt_flags;
+        u8  rt_rate;
         u16 rt_channel;
         u16 rt_chbitmask;
-        u16 rt_rate;
-};
+} __attribute__((packed));
 
 static void fill_rt_header(void *buffer, struct zd_mac *mac,
                            const struct ieee80211_rx_stats *stats,
@@ -735,14 +735,14 @@ static void fill_rt_header(void *buffer, struct zd_mac *mac,
         if (status->decryption_type & (ZD_RX_WEP64|ZD_RX_WEP128|ZD_RX_WEP256))
                 hdr->rt_flags |= IEEE80211_RADIOTAP_F_WEP;
 
+        hdr->rt_rate = stats->rate / 5;
+
         /* FIXME: 802.11a */
         hdr->rt_channel = cpu_to_le16(ieee80211chan2mhz(
                                              _zd_chip_get_channel(&mac->chip)));
         hdr->rt_chbitmask = cpu_to_le16(IEEE80211_CHAN_2GHZ |
                 ((status->frame_status & ZD_RX_FRAME_MODULATION_MASK) ==
                 ZD_RX_OFDM ? IEEE80211_CHAN_OFDM : IEEE80211_CHAN_CCK));
-
-        hdr->rt_rate = stats->rate / 5;
 }
 
 /* Returns 1 if the data packet is for us and 0 otherwise. */
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 72f90525bf68..6320984126c7 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -323,7 +323,6 @@ static void disable_read_regs_int(struct zd_usb *usb)
 {
         struct zd_usb_interrupt *intr = &usb->intr;
 
-        ZD_ASSERT(in_interrupt());
         spin_lock(&intr->lock);
         intr->read_regs_enabled = 0;
         spin_unlock(&intr->lock);
@@ -545,11 +544,11 @@ static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
          * be padded. Unaligned access might also happen if the length_info
          * structure is not present.
          */
-        if (get_unaligned(&length_info->tag) == RX_LENGTH_INFO_TAG) {
+        if (get_unaligned(&length_info->tag) == cpu_to_le16(RX_LENGTH_INFO_TAG))
+        {
                 unsigned int l, k, n;
                 for (i = 0, l = 0;; i++) {
-                        k = le16_to_cpu(get_unaligned(
-                                &length_info->length[i]));
+                        k = le16_to_cpu(get_unaligned(&length_info->length[i]));
                         n = l+k;
                         if (n > length)
                                 return;
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index 3fae77ffb2fa..3c148eaf2f4d 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -153,13 +153,6 @@ config HOTPLUG_PCI_SHPC_POLL_EVENT_MODE
 
           When in doubt, say N.
 
-config HOTPLUG_PCI_SHPC_PHPRM_LEGACY
-        bool "For AMD SHPC only: Use $HRT for resource/configuration"
-        depends on HOTPLUG_PCI_SHPC && !ACPI 
-        help
-          Say Y here for AMD SHPC. You have to select this option if you are 
-          using this driver on platform with AMD SHPC.
-
 config HOTPLUG_PCI_RPA
         tristate "RPA PCI Hotplug driver"
         depends on HOTPLUG_PCI && PPC_PSERIES && PPC64 && !HOTPLUG_PCI_FAKE
diff --git a/drivers/pci/hotplug/acpiphp_core.c b/drivers/pci/hotplug/acpiphp_core.c
index 34de5697983d..e2fef60c2d06 100644
--- a/drivers/pci/hotplug/acpiphp_core.c
+++ b/drivers/pci/hotplug/acpiphp_core.c
@@ -27,8 +27,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <gregkh@us.ibm.com>,
- *                  <t-kochi@bq.jp.nec.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index ef95d12fb32c..ae67a8f55ba1 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -26,7 +26,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <t-kochi@bq.jp.nec.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index ce89f5815861..eaea9d36a1bb 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -279,6 +279,11 @@ struct hpc_ops {
 
 
 #ifdef CONFIG_ACPI
+#include <acpi/acpi.h>
+#include <acpi/acpi_bus.h>
+#include <acpi/actypes.h>
+#include <linux/pci-acpi.h>
+
 #define pciehp_get_hp_hw_control_from_firmware(dev) \
         pciehp_acpi_get_hp_hw_control_from_firmware(dev)
 static inline int pciehp_get_hp_params_from_firmware(struct pci_dev *dev,
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 0d8fb6e607a1..6ab3b6cd2b54 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -38,10 +38,6 @@
 
 #include "../pci.h"
 #include "pciehp.h"
-#include <acpi/acpi.h>
-#include <acpi/acpi_bus.h>
-#include <acpi/actypes.h>
-#include <linux/pci-acpi.h>
 #ifdef DEBUG
 #define DBG_K_TRACE_ENTRY      ((unsigned int)0x00000001)       /* On function entry */
 #define DBG_K_TRACE_EXIT       ((unsigned int)0x00000002)       /* On function exit */
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 50bfc1b2f3bf..478d0d28f7ad 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -30,23 +30,6 @@ MODULE_LICENSE("GPL");
 /* global data */
 static const char device_name[] = "pcieport-driver";
 
-static int pcie_portdrv_save_config(struct pci_dev *dev)
-{
-        return pci_save_state(dev);
-}
-
-static int pcie_portdrv_restore_config(struct pci_dev *dev)
-{
-        int retval;
-
-        pci_restore_state(dev);
-        retval = pci_enable_device(dev);
-        if (retval)
-                return retval;
-        pci_set_master(dev);
-        return 0;
-}
-
 /*
  * pcie_portdrv_probe - Probe PCI-Express port devices
  * @dev: PCI-Express port device being probed
@@ -73,8 +56,10 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
                 "%s->Dev[%04x:%04x] has invalid IRQ. Check vendor BIOS\n", 
                 __FUNCTION__, dev->device, dev->vendor);
         }
-        if (pcie_port_device_register(dev)) 
+        if (pcie_port_device_register(dev)) {
+                pci_disable_device(dev);
                 return -ENOMEM;
+        }
 
         return 0;
 }
@@ -86,6 +71,23 @@ static void pcie_portdrv_remove (struct pci_dev *dev)
 }
 
 #ifdef CONFIG_PM
+static int pcie_portdrv_save_config(struct pci_dev *dev)
+{
+        return pci_save_state(dev);
+}
+
+static int pcie_portdrv_restore_config(struct pci_dev *dev)
+{
+        int retval;
+
+        pci_restore_state(dev);
+        retval = pci_enable_device(dev);
+        if (retval)
+                return retval;
+        pci_set_master(dev);
+        return 0;
+}
+
 static int pcie_portdrv_suspend (struct pci_dev *dev, pm_message_t state)
 {
         int ret = pcie_port_device_suspend(dev, state);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index e3c78c39b7e4..fb08bc951ac0 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -990,6 +990,11 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
                         case 0x8070: /* P4G8X Deluxe */
                                 asus_hides_smbus = 1;
                         }
+                if (dev->device == PCI_DEVICE_ID_INTEL_E7501_MCH)
+                        switch (dev->subsystem_device) {
+                        case 0x80c9: /* PU-DLS */
+                                asus_hides_smbus = 1;
+                        }
                 if (dev->device == PCI_DEVICE_ID_INTEL_82855GM_HB)
                         switch (dev->subsystem_device) {
                         case 0x1751: /* M2N notebook */
@@ -1058,6 +1063,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82845G_HB,	asu
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82850_HB,   asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82865_HB,   asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_7205_0,     asus_hides_smbus_hostbridge );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_E7501_MCH,  asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82855PM_HB, asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82855GM_HB, asus_hides_smbus_hostbridge );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82915GM_HB, asus_hides_smbus_hostbridge );
@@ -1081,6 +1087,7 @@ static void __init asus_hides_smbus_lpc(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801BA_0,  asus_hides_smbus_lpc );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_0,  asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801CA_12, asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801DB_12, asus_hides_smbus_lpc );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82801EB_0,  asus_hides_smbus_lpc );
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index f8ae2b7db0a7..d529462d1b53 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -41,7 +41,7 @@ pci_do_find_bus(struct pci_bus* bus, unsigned char busnr)
  * in the global list of PCI buses.  If the bus is found, a pointer to its
  * data structure is returned.  If no bus is found, %NULL is returned.
  */
-struct pci_bus * __devinit pci_find_bus(int domain, int busnr)
+struct pci_bus * pci_find_bus(int domain, int busnr)
 {
         struct pci_bus *bus = NULL;
         struct pci_bus *tmp_bus;
diff --git a/drivers/pnp/interface.c b/drivers/pnp/interface.c
index 3163e3d73da1..9d8b415eca79 100644
--- a/drivers/pnp/interface.c
+++ b/drivers/pnp/interface.c
@@ -265,8 +265,8 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," 0x%llx-0x%llx\n",
-                                                pnp_port_start(dev, i),
-                                                pnp_port_end(dev, i));
+                                        (unsigned long long)pnp_port_start(dev, i),
+                                        (unsigned long long)pnp_port_end(dev, i));
                 }
         }
         for (i = 0; i < PNP_MAX_MEM; i++) {
@@ -276,8 +276,8 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," 0x%llx-0x%llx\n",
-                                                pnp_mem_start(dev, i),
-                                                pnp_mem_end(dev, i));
+                                        (unsigned long long)pnp_mem_start(dev, i),
+                                        (unsigned long long)pnp_mem_end(dev, i));
                 }
         }
         for (i = 0; i < PNP_MAX_IRQ; i++) {
@@ -287,7 +287,7 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," %lld\n",
-                                                pnp_irq(dev, i));
+                                        (unsigned long long)pnp_irq(dev, i));
                 }
         }
         for (i = 0; i < PNP_MAX_DMA; i++) {
@@ -297,7 +297,7 @@ static ssize_t pnp_show_current_resources(struct device *dmdev, struct device_at
                                 pnp_printf(buffer," disabled\n");
                         else
                                 pnp_printf(buffer," %lld\n",
-                                                pnp_dma(dev, i));
+                                        (unsigned long long)pnp_dma(dev, i));
                 }
         }
         ret = (buffer->curr - buf);
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 212268881857..dc79b0a0059f 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -173,6 +173,9 @@ pnpacpi_parse_allocated_address_space(struct pnp_resource_table *res_table,
                 return;
         }
 
+        if (p->producer_consumer == ACPI_PRODUCER)
+                return;
+
         if (p->resource_type == ACPI_MEMORY_RANGE)
                 pnpacpi_parse_allocated_memresource(res_table,
                                 p->minimum, p->address_length);
@@ -252,9 +255,14 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_ADDRESS64:
+                if (res->data.ext_address64.producer_consumer == ACPI_PRODUCER)
+                        return AE_OK;
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
+                if (res->data.extended_irq.producer_consumer == ACPI_PRODUCER)
+                        return AE_OK;
+
                 for (i = 0; i < res->data.extended_irq.interrupt_count; i++) {
                         pnpacpi_parse_allocated_irqresource(res_table,
                                 res->data.extended_irq.interrupts[i],
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4bf03fb67f8d..d8e9b95f0a1a 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1730,8 +1730,8 @@ dasd_flush_request_queue(struct dasd_device * device)
                 req = elv_next_request(device->request_queue);
                 if (req == NULL)
                         break;
-                dasd_end_request(req, 0);
                 blkdev_dequeue_request(req);
+                dasd_end_request(req, 0);
         }
         spin_unlock_irq(&device->request_queue_lock);
 }
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 7f6fdac74706..9d0c6e1a0e66 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -48,18 +48,20 @@ struct dasd_devmap {
 };
 
 /*
- * dasd_servermap is used to store the server_id of all storage servers
- * accessed by DASD device driver.
+ * dasd_server_ssid_map contains a globally unique storage server subsystem ID.
+ * dasd_server_ssid_list contains the list of all subsystem IDs accessed by
+ * the DASD device driver.
  */
-struct dasd_servermap {
+struct dasd_server_ssid_map {
         struct list_head list;
         struct server_id {
                 char vendor[4];
                 char serial[15];
         } sid;
+        __u16 ssid;
 };
 
-static struct list_head dasd_serverlist;
+static struct list_head dasd_server_ssid_list;
 
 /*
  * Parameter parsing functions for dasd= parameter. The syntax is:
@@ -89,7 +91,7 @@ static char *dasd[256];
 module_param_array(dasd, charp, NULL, 0);
 
 /*
- * Single spinlock to protect devmap structures and lists.
+ * Single spinlock to protect devmap and servermap structures and lists.
  */
 static DEFINE_SPINLOCK(dasd_devmap_lock);
 
@@ -264,8 +266,9 @@ dasd_parse_keyword( char *parsestring ) {
                 if (dasd_page_cache)
                         return residual_str;
                 dasd_page_cache =
-                        kmem_cache_create("dasd_page_cache", PAGE_SIZE, 0,
-                                          SLAB_CACHE_DMA, NULL, NULL );
+                        kmem_cache_create("dasd_page_cache", PAGE_SIZE,
+                                          PAGE_SIZE, SLAB_CACHE_DMA,
+                                          NULL, NULL );
                 if (!dasd_page_cache)
                         MESSAGE(KERN_WARNING, "%s", "Failed to create slab, "
                                 "fixed buffer mode disabled.");
@@ -859,39 +862,6 @@ static struct attribute_group dasd_attr_group = {
 };
 
 /*
- * Check if the related storage server is already contained in the
- * dasd_serverlist. If server is not contained, create new entry.
- * Return 0 if server was already in serverlist,
- *        1 if the server was added successfully
- *       <0 in case of error.
- */
-static int
-dasd_add_server(struct dasd_uid *uid)
-{
-        struct dasd_servermap *new, *tmp;
-
-        /* check if server is already contained */
-        list_for_each_entry(tmp, &dasd_serverlist, list)
-          // normale cmp?
-                if (strncmp(tmp->sid.vendor, uid->vendor,
-                            sizeof(tmp->sid.vendor)) == 0
-                    && strncmp(tmp->sid.serial, uid->serial,
-                               sizeof(tmp->sid.serial)) == 0)
-                        return 0;
-
-        new = (struct dasd_servermap *)
-                kzalloc(sizeof(struct dasd_servermap), GFP_KERNEL);
-        if (!new)
-                return -ENOMEM;
-
-        strncpy(new->sid.vendor, uid->vendor, sizeof(new->sid.vendor));
-        strncpy(new->sid.serial, uid->serial, sizeof(new->sid.serial));
-        list_add(&new->list, &dasd_serverlist);
-        return 1;
-}
-
-
-/*
  * Return copy of the device unique identifier.
  */
 int
@@ -910,6 +880,9 @@ dasd_get_uid(struct ccw_device *cdev, struct dasd_uid *uid)
 
 /*
  * Register the given device unique identifier into devmap struct.
+ * In addition check if the related storage server subsystem ID is already
+ * contained in the dasd_server_ssid_list. If subsystem ID is not contained,
+ * create new entry.
  * Return 0 if server was already in serverlist,
  *        1 if the server was added successful
  *       <0 in case of error.
@@ -918,16 +891,39 @@ int
 dasd_set_uid(struct ccw_device *cdev, struct dasd_uid *uid)
 {
         struct dasd_devmap *devmap;
-        int rc;
+        struct dasd_server_ssid_map *srv, *tmp;
 
         devmap = dasd_find_busid(cdev->dev.bus_id);
         if (IS_ERR(devmap))
                 return PTR_ERR(devmap);
+
+        /* generate entry for server_ssid_map */
+        srv = (struct dasd_server_ssid_map *)
+                kzalloc(sizeof(struct dasd_server_ssid_map), GFP_KERNEL);
+        if (!srv)
+                return -ENOMEM;
+        strncpy(srv->sid.vendor, uid->vendor, sizeof(srv->sid.vendor) - 1);
+        strncpy(srv->sid.serial, uid->serial, sizeof(srv->sid.serial) - 1);
+        srv->ssid = uid->ssid;
+
+        /* server is already contained ? */
         spin_lock(&dasd_devmap_lock);
         devmap->uid = *uid;
-        rc = dasd_add_server(uid);
+        list_for_each_entry(tmp, &dasd_server_ssid_list, list) {
+                if (!memcmp(&srv->sid, &tmp->sid,
+                            sizeof(struct dasd_server_ssid_map))) {
+                        kfree(srv);
+                        srv = NULL;
+                        break;
+                }
+        }
+
+        /* add servermap to serverlist */
+        if (srv)
+                list_add(&srv->list, &dasd_server_ssid_list);
         spin_unlock(&dasd_devmap_lock);
-        return rc;
+
+        return (srv ? 1 : 0);
 }
 EXPORT_SYMBOL_GPL(dasd_set_uid);
 
@@ -995,7 +991,7 @@ dasd_devmap_init(void)
                 INIT_LIST_HEAD(&dasd_hashlists[i]);
 
         /* Initialize servermap structure. */
-        INIT_LIST_HEAD(&dasd_serverlist);
+        INIT_LIST_HEAD(&dasd_server_ssid_list);
         return 0;
 }
 
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 39c2281371b5..957ed5db98e4 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -468,11 +468,11 @@ dasd_eckd_generate_uid(struct dasd_device *device, struct dasd_uid *uid)
                 return -ENODEV;
 
         memset(uid, 0, sizeof(struct dasd_uid));
-        strncpy(uid->vendor, confdata->ned1.HDA_manufacturer,
-                sizeof(uid->vendor) - 1);
+        memcpy(uid->vendor, confdata->ned1.HDA_manufacturer,
+               sizeof(uid->vendor) - 1);
         EBCASC(uid->vendor, sizeof(uid->vendor) - 1);
-        strncpy(uid->serial, confdata->ned1.HDA_location,
-                sizeof(uid->serial) - 1);
+        memcpy(uid->serial, confdata->ned1.HDA_location,
+               sizeof(uid->serial) - 1);
         EBCASC(uid->serial, sizeof(uid->serial) - 1);
         uid->ssid = confdata->neq.subsystemID;
         if (confdata->ned2.sneq.flags == 0x40) {
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index 1140302ff11d..ca7d51f7eccc 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -48,15 +48,6 @@
 #define PRINT_ERR(x...)         printk(KERN_ERR XPRAM_NAME " error:" x)
 
 
-static struct sysdev_class xpram_sysclass = {
-        set_kset_name("xpram"),
-};
-
-static struct sys_device xpram_sys_device = {
-        .id     = 0,
-        .cls    = &xpram_sysclass,
-}; 
-
 typedef struct {
         unsigned int    size;           /* size of xpram segment in pages */
         unsigned int    offset;         /* start page of xpram segment */
@@ -451,8 +442,6 @@ static void __exit xpram_exit(void)
         }
         unregister_blkdev(XPRAM_MAJOR, XPRAM_NAME);
         blk_cleanup_queue(xpram_queue);
-        sysdev_unregister(&xpram_sys_device);
-        sysdev_class_unregister(&xpram_sysclass);
 }
 
 static int __init xpram_init(void)
@@ -470,19 +459,7 @@ static int __init xpram_init(void)
         rc = xpram_setup_sizes(xpram_pages);
         if (rc)
                 return rc;
-        rc = sysdev_class_register(&xpram_sysclass);
-        if (rc)
-                return rc;
-
-        rc = sysdev_register(&xpram_sys_device);
-        if (rc) {
-                sysdev_class_unregister(&xpram_sysclass);
-                return rc;
-        }
-        rc = xpram_setup_blkdev();
-        if (rc)
-                sysdev_unregister(&xpram_sys_device);
-        return rc;
+        return xpram_setup_blkdev();
 }
 
 module_init(xpram_init);
diff --git a/drivers/s390/char/tape_class.c b/drivers/s390/char/tape_class.c
index 643b6d078563..56b87618b100 100644
--- a/drivers/s390/char/tape_class.c
+++ b/drivers/s390/char/tape_class.c
@@ -76,7 +76,7 @@ struct tape_class_device *register_tape_dev(
                                 device,
                                 "%s", tcd->device_name
                         );
-        rc = PTR_ERR(tcd->class_device);
+        rc = IS_ERR(tcd->class_device) ? PTR_ERR(tcd->class_device) : 0;
         if (rc)
                 goto fail_with_cdev;
         rc = sysfs_create_link(
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 7a39e0b0386c..6d91c2eb205b 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -772,6 +772,7 @@ ccw_device_online_verify(struct ccw_device *cdev, enum dev_event dev_event)
         stsch(sch->schid, &sch->schib);
 
         if (sch->schib.scsw.actl != 0 ||
+            (sch->schib.scsw.stctl & SCSW_STCTL_STATUS_PEND) ||
             (cdev->private->irb.scsw.stctl & SCSW_STCTL_STATUS_PEND)) {
                 /*
                  * No final status yet or final status not yet delivered
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index a60124264bee..9e3de0bd59b5 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -263,6 +263,9 @@ ccw_device_wake_up(struct ccw_device *cdev, unsigned long ip, struct irb *irb)
         /* Abuse intparm for error reporting. */
         if (IS_ERR(irb))
                 cdev->private->intparm = -EIO;
+        else if (irb->scsw.cc == 1)
+                /* Retry for deferred condition code. */
+                cdev->private->intparm = -EAGAIN;
         else if ((irb->scsw.dstat !=
                   (DEV_STAT_CHN_END|DEV_STAT_DEV_END)) ||
                  (irb->scsw.cstat != 0)) {
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index 77e7202a0eba..904c25fb4ba4 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -940,14 +940,8 @@ static void ahci_host_intr(struct ata_port *ap)
                 return;
 
         /* ignore interim PIO setup fis interrupts */
-        if (ata_tag_valid(ap->active_tag)) {
-                struct ata_queued_cmd *qc =
-                        ata_qc_from_tag(ap, ap->active_tag);
-
-                if (qc && qc->tf.protocol == ATA_PROT_PIO &&
-                    (status & PORT_IRQ_PIOS_FIS))
-                        return;
-        }
+        if (ata_tag_valid(ap->active_tag) && (status & PORT_IRQ_PIOS_FIS)) 
+                return;
 
         if (ata_ratelimit())
                 ata_port_printk(ap, KERN_INFO, "spurious interrupt "
diff --git a/drivers/scsi/arm/Kconfig b/drivers/scsi/arm/Kconfig
index 06d7601cdf56..d006a8cb4a74 100644
--- a/drivers/scsi/arm/Kconfig
+++ b/drivers/scsi/arm/Kconfig
@@ -69,6 +69,7 @@ comment "The following drivers are not fully supported"
 config SCSI_CUMANA_1
         tristate "CumanaSCSI I support (EXPERIMENTAL)"
         depends on ARCH_ACORN && EXPERIMENTAL && SCSI
+        select SCSI_SPI_ATTRS
         help
           This enables support for the Cumana SCSI I card. If you have an
           Acorn system with one of these, say Y. If unsure, say N.
@@ -76,6 +77,7 @@ config SCSI_CUMANA_1
 config SCSI_ECOSCSI
         tristate "EcoScsi support (EXPERIMENTAL)"
         depends on ARCH_ACORN && EXPERIMENTAL && (ARCH_ARC || ARCH_A5K) && SCSI
+        select SCSI_SPI_ATTRS
         help
           This enables support for the EcoSCSI card -- a small card that sits
           in the Econet socket. If you have an Acorn system with one of these,
@@ -84,6 +86,7 @@ config SCSI_ECOSCSI
 config SCSI_OAK1
         tristate "Oak SCSI support (EXPERIMENTAL)"
         depends on ARCH_ACORN && EXPERIMENTAL && SCSI
+        select SCSI_SPI_ATTRS
         help
           This enables support for the Oak SCSI card. If you have an Acorn
           system with one of these, say Y. If unsure, say N.
diff --git a/drivers/scsi/arm/scsi.h b/drivers/scsi/arm/scsi.h
index 6dd544a5eb56..8c2600ffc6af 100644
--- a/drivers/scsi/arm/scsi.h
+++ b/drivers/scsi/arm/scsi.h
@@ -74,7 +74,7 @@ static inline void init_SCp(Scsi_Cmnd *SCpnt)
                 unsigned long len = 0;
                 int buf;
 
-                SCpnt->SCp.buffer = (struct scatterlist *) SCpnt->buffer;
+                SCpnt->SCp.buffer = (struct scatterlist *) SCpnt->request_buffer;
                 SCpnt->SCp.buffers_residual = SCpnt->use_sg - 1;
                 SCpnt->SCp.ptr = (char *)
                          (page_address(SCpnt->SCp.buffer->page) +
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 19745a31072b..5e8afc876980 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -567,8 +567,8 @@ static int piix_sata_prereset(struct ata_port *ap)
                         present = 1;
         }
 
-        DPRINTK("ata%u: LEAVE, pcs=0x%x present_mask=0x%x\n",
-                ap->id, pcs, present_mask);
+        DPRINTK("ata%u: LEAVE, pcs=0x%x present=0x%x\n",
+                ap->id, pcs, present);
 
         if (!present) {
                 ata_port_printk(ap, KERN_INFO, "SATA port has no device.\n");
@@ -828,6 +828,7 @@ static void __devinit piix_init_sata_map(struct pci_dev *pdev,
                 case IDE:
                         WARN_ON((i & 1) || map[i + 1] != IDE);
                         pinfo[i / 2] = piix_port_info[ich5_pata];
+                        pinfo[i / 2].private_data = hpriv;
                         i++;
                         printk(" IDE IDE");
                         break;
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 386e5f21e191..16fc2dd8f2f7 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -5185,28 +5185,6 @@ void ata_host_stop (struct ata_host_set *host_set)
                 iounmap(host_set->mmio_base);
 }
 
-
-/**
- *      ata_host_remove - Unregister SCSI host structure with upper layers
- *      @ap: Port to unregister
- *      @do_unregister: 1 if we fully unregister, 0 to just stop the port
- *
- *      LOCKING:
- *      Inherited from caller.
- */
-
-static void ata_host_remove(struct ata_port *ap, unsigned int do_unregister)
-{
-        struct Scsi_Host *sh = ap->host;
-
-        DPRINTK("ENTER\n");
-
-        if (do_unregister)
-                scsi_remove_host(sh);
-
-        ap->ops->port_stop(ap);
-}
-
 /**
  *      ata_dev_init - Initialize an ata_device structure
  *      @dev: Device structure to initialize
@@ -5532,8 +5510,11 @@ int ata_device_add(const struct ata_probe_ent *ent)
 
 err_out:
         for (i = 0; i < count; i++) {
-                ata_host_remove(host_set->ports[i], 1);
-                scsi_host_put(host_set->ports[i]->host);
+                struct ata_port *ap = host_set->ports[i];
+                if (ap) {
+                        ap->ops->port_stop(ap);
+                        scsi_host_put(ap->host);
+                }
         }
 err_free_ret:
         kfree(host_set);
@@ -5558,7 +5539,7 @@ void ata_port_detach(struct ata_port *ap)
         int i;
 
         if (!ap->ops->error_handler)
-                return;
+                goto skip_eh;
 
         /* tell EH we're leaving & flush EH */
         spin_lock_irqsave(ap->lock, flags);
@@ -5594,6 +5575,7 @@ void ata_port_detach(struct ata_port *ap)
         cancel_delayed_work(&ap->hotplug_task);
         flush_workqueue(ata_aux_wq);
 
+ skip_eh:
         /* remove the associated SCSI host */
         scsi_remove_host(ap->host);
 }
@@ -5662,7 +5644,7 @@ int ata_scsi_release(struct Scsi_Host *host)
         DPRINTK("ENTER\n");
 
         ap->ops->port_disable(ap);
-        ata_host_remove(ap, 0);
+        ap->ops->port_stop(ap);
 
         DPRINTK("EXIT\n");
         return 1;
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 7ced41ecde86..e92c31d698ff 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -2353,6 +2353,19 @@ static void atapi_qc_complete(struct ata_queued_cmd *qc)
                         ata_gen_ata_desc_sense(qc);
                 }
 
+                /* SCSI EH automatically locks door if sdev->locked is
+                 * set.  Sometimes door lock request continues to
+                 * fail, for example, when no media is present.  This
+                 * creates a loop - SCSI EH issues door lock which
+                 * fails and gets invoked again to acquire sense data
+                 * for the failed command.
+                 *
+                 * If door lock fails, always clear sdev->locked to
+                 * avoid this infinite loop.
+                 */
+                if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)
+                        qc->dev->sdev->locked = 0;
+
                 qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;
                 qc->scsidone(cmd);
                 ata_qc_free(qc);
diff --git a/drivers/scsi/sata_sil24.c b/drivers/scsi/sata_sil24.c
index 2e0f4a4076af..3f368c7d3ef9 100644
--- a/drivers/scsi/sata_sil24.c
+++ b/drivers/scsi/sata_sil24.c
@@ -1106,7 +1106,6 @@ static int sil24_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         probe_ent->irq = pdev->irq;
         probe_ent->irq_flags = IRQF_SHARED;
-        probe_ent->mmio_base = port_base;
         probe_ent->private_data = hpriv;
 
         hpriv->host_base = host_base;
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 2ee742d40c43..005043197527 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -24,7 +24,7 @@ config USB_ARCH_HAS_OHCI
         default y if ARCH_S3C2410
         default y if PXA27x
         default y if ARCH_EP93XX
-        default y if ARCH_AT91RM9200
+        default y if (ARCH_AT91RM9200 || ARCH_AT91SAM9261)
         # PPC:
         default y if STB03xxx
         default y if PPC_MPC52xx
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index f7bdd94b3aa8..218621b9958e 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -517,19 +517,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsig
 
 static struct usb_device *usbdev_lookup_minor(int minor)
 {
-        struct device *device;
-        struct usb_device *udev = NULL;
+        struct class_device *class_dev;
+        struct usb_device *dev = NULL;
 
         down(&usb_device_class->sem);
-        list_for_each_entry(device, &usb_device_class->devices, node) {
-                if (device->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
-                        udev = device->platform_data;
+        list_for_each_entry(class_dev, &usb_device_class->children, node) {
+                if (class_dev->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
+                        dev = class_dev->class_data;
                         break;
                 }
         }
         up(&usb_device_class->sem);
 
-        return udev;
+        return dev;
 };
 
 /*
@@ -1580,16 +1580,16 @@ static void usbdev_add(struct usb_device *dev)
 {
         int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
 
-        dev->usbfs_dev = device_create(usb_device_class, &dev->dev,
-                                MKDEV(USB_DEVICE_MAJOR, minor),
+        dev->class_dev = class_device_create(usb_device_class, NULL,
+                                MKDEV(USB_DEVICE_MAJOR, minor), &dev->dev,
                                 "usbdev%d.%d", dev->bus->busnum, dev->devnum);
 
-        dev->usbfs_dev->platform_data = dev;
+        dev->class_dev->class_data = dev;
 }
 
 static void usbdev_remove(struct usb_device *dev)
 {
-        device_unregister(dev->usbfs_dev);
+        class_device_unregister(dev->class_dev);
 }
 
 static int usbdev_notify(struct notifier_block *self, unsigned long action,
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index abee0f5b6a66..8de4f8c99d61 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -194,13 +194,14 @@ int usb_register_dev(struct usb_interface *intf,
                 ++temp;
         else
                 temp = name;
-        intf->usb_dev = device_create(usb_class->class, &intf->dev,
-                                      MKDEV(USB_MAJOR, minor), "%s", temp);
-        if (IS_ERR(intf->usb_dev)) {
+        intf->class_dev = class_device_create(usb_class->class, NULL,
+                                              MKDEV(USB_MAJOR, minor),
+                                              &intf->dev, "%s", temp);
+        if (IS_ERR(intf->class_dev)) {
                 spin_lock (&minor_lock);
                 usb_minors[intf->minor] = NULL;
                 spin_unlock (&minor_lock);
-                retval = PTR_ERR(intf->usb_dev);
+                retval = PTR_ERR(intf->class_dev);
         }
 exit:
         return retval;
@@ -241,8 +242,8 @@ void usb_deregister_dev(struct usb_interface *intf,
         spin_unlock (&minor_lock);
 
         snprintf(name, BUS_ID_SIZE, class_driver->name, intf->minor - minor_base);
-        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
-        intf->usb_dev = NULL;
+        class_device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
+        intf->class_dev = NULL;
         intf->minor = -1;
         destroy_usb_class();
 }
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 363b2ad74ae6..1a32d96774b4 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -207,7 +207,7 @@ config USB_AT91
 
 config USB_GADGET_DUMMY_HCD
         boolean "Dummy HCD (DEVELOPMENT)"
-        depends on USB && EXPERIMENTAL
+        depends on (USB=y || (USB=m && USB_GADGET=m)) && EXPERIMENTAL
         select USB_GADGET_DUALSPEED
         help
           This host controller driver emulates USB, looping all data transfer
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 1c459ff037ce..cfebca05ead5 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -57,19 +57,23 @@
 
 /*
  * This controller is simple and PIO-only.  It's used in many AT91-series
- * ARMv4T controllers, including the at91rm9200 (arm920T, with MMU),
- * at91sam9261 (arm926ejs, with MMU), and several no-mmu versions.
+ * full speed USB controllers, including the at91rm9200 (arm920T, with MMU),
+ * at91sam926x (arm926ejs, with MMU), and several no-mmu versions.
  *
  * This driver expects the board has been wired with two GPIOs suppporting
  * a VBUS sensing IRQ, and a D+ pullup.  (They may be omitted, but the
- * testing hasn't covered such cases.)  The pullup is most important; it
+ * testing hasn't covered such cases.)
+ *
+ * The pullup is most important (so it's integrated on sam926x parts).  It
  * provides software control over whether the host enumerates the device.
+ *
  * The VBUS sensing helps during enumeration, and allows both USB clocks
  * (and the transceiver) to stay gated off until they're necessary, saving
- * power.  During USB suspend, the 48 MHz clock is gated off.
+ * power.  During USB suspend, the 48 MHz clock is gated off in hardware;
+ * it may also be gated off by software during some Linux sleep states.
  */
 
-#define DRIVER_VERSION  "8 March 2005"
+#define DRIVER_VERSION  "3 May 2006"
 
 static const char driver_name [] = "at91_udc";
 static const char ep0name[] = "ep0";
@@ -316,9 +320,15 @@ static void done(struct at91_ep *ep, struct at91_request *req, int status)
  *
  * There are also state bits like FORCESTALL, EPEDS, DIR, and EPTYPE
  * that shouldn't normally be changed.
+ *
+ * NOTE at91sam9260 docs mention synch between UDPCK and MCK clock domains,
+ * implying a need to wait for one write to complete (test relevant bits)
+ * before starting the next write.  This shouldn't be an issue given how
+ * infrequently we write, except maybe for write-then-read idioms.
  */
 #define SET_FX  (AT91_UDP_TXPKTRDY)
-#define CLR_FX  (RX_DATA_READY | AT91_UDP_RXSETUP | AT91_UDP_STALLSENT | AT91_UDP_TXCOMP)
+#define CLR_FX  (RX_DATA_READY | AT91_UDP_RXSETUP \
+                | AT91_UDP_STALLSENT | AT91_UDP_TXCOMP)
 
 /* pull OUT packet data from the endpoint's fifo */
 static int read_fifo (struct at91_ep *ep, struct at91_request *req)
@@ -472,7 +482,8 @@ static void nuke(struct at91_ep *ep, int status)
 
 /*-------------------------------------------------------------------------*/
 
-static int at91_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
+static int at91_ep_enable(struct usb_ep *_ep,
+                                const struct usb_endpoint_descriptor *desc)
 {
         struct at91_ep  *ep = container_of(_ep, struct at91_ep, ep);
         struct at91_udc *dev = ep->udc;
@@ -582,11 +593,12 @@ static int at91_ep_disable (struct usb_ep * _ep)
  * interesting for request or buffer allocation.
  */
 
-static struct usb_request *at91_ep_alloc_request (struct usb_ep *_ep, unsigned int gfp_flags)
+static struct usb_request *
+at91_ep_alloc_request(struct usb_ep *_ep, unsigned int gfp_flags)
 {
         struct at91_request *req;
 
-        req = kcalloc(1, sizeof (struct at91_request), SLAB_KERNEL);
+        req = kcalloc(1, sizeof (struct at91_request), gfp_flags);
         if (!req)
                 return NULL;
 
@@ -862,6 +874,7 @@ static void stop_activity(struct at91_udc *udc)
         if (udc->gadget.speed == USB_SPEED_UNKNOWN)
                 driver = NULL;
         udc->gadget.speed = USB_SPEED_UNKNOWN;
+        udc->suspended = 0;
 
         for (i = 0; i < NUM_ENDPOINTS; i++) {
                 struct at91_ep *ep = &udc->ep[i];
@@ -889,8 +902,8 @@ static void clk_off(struct at91_udc *udc)
                 return;
         udc->clocked = 0;
         udc->gadget.speed = USB_SPEED_UNKNOWN;
-        clk_disable(udc->iclk);
         clk_disable(udc->fclk);
+        clk_disable(udc->iclk);
 }
 
 /*
@@ -911,9 +924,6 @@ static void pullup(struct at91_udc *udc, int is_on)
                 at91_udp_write(AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
                 at91_set_gpio_value(udc->board.pullup_pin, 0);
                 clk_off(udc);
-
-                // REVISIT:  with transceiver disabled, will D- float
-                // so that a host would falsely detect a device?
         }
 }
 
@@ -1290,7 +1300,8 @@ static void handle_ep0(struct at91_udc *udc)
                         if (udc->wait_for_addr_ack) {
                                 u32     tmp;
 
-                                at91_udp_write(AT91_UDP_FADDR, AT91_UDP_FEN | udc->addr);
+                                at91_udp_write(AT91_UDP_FADDR,
+                                                AT91_UDP_FEN | udc->addr);
                                 tmp = at91_udp_read(AT91_UDP_GLB_STAT);
                                 tmp &= ~AT91_UDP_FADDEN;
                                 if (udc->addr)
@@ -1361,9 +1372,10 @@ static irqreturn_t at91_udc_irq (int irq, void *_udc, struct pt_regs *r)
         u32                     rescans = 5;
 
         while (rescans--) {
-                u32     status = at91_udp_read(AT91_UDP_ISR);
+                u32 status;
 
-                status &= at91_udp_read(AT91_UDP_IMR);
+                status = at91_udp_read(AT91_UDP_ISR)
+                        & at91_udp_read(AT91_UDP_IMR);
                 if (!status)
                         break;
 
@@ -1379,18 +1391,17 @@ static irqreturn_t at91_udc_irq (int irq, void *_udc, struct pt_regs *r)
                         stop_activity(udc);
 
                         /* enable ep0 */
-                        at91_udp_write(AT91_UDP_CSR(0), AT91_UDP_EPEDS | AT91_UDP_EPTYPE_CTRL);
+                        at91_udp_write(AT91_UDP_CSR(0),
+                                        AT91_UDP_EPEDS | AT91_UDP_EPTYPE_CTRL);
                         udc->gadget.speed = USB_SPEED_FULL;
                         udc->suspended = 0;
                         at91_udp_write(AT91_UDP_IER, AT91_UDP_EP(0));
 
                         /*
                          * NOTE:  this driver keeps clocks off unless the
-                         * USB host is present.  That saves power, and also
-                         * eliminates IRQs (reset, resume, suspend) that can
-                         * otherwise flood from the controller.  If your
-                         * board doesn't support VBUS detection, suspend and
-                         * resume irq logic may need more attention...
+                         * USB host is present.  That saves power, but for
+                         * boards that don't support VBUS detection, both
+                         * clocks need to be active most of the time.
                          */
 
                 /* host initiated suspend (3+ms bus idle) */
@@ -1452,13 +1463,19 @@ static irqreturn_t at91_udc_irq (int irq, void *_udc, struct pt_regs *r)
 
 /*-------------------------------------------------------------------------*/
 
+static void nop_release(struct device *dev)
+{
+        /* nothing to free */
+}
+
 static struct at91_udc controller = {
         .gadget = {
-                .ops = &at91_udc_ops,
-                .ep0 = &controller.ep[0].ep,
-                .name = driver_name,
-                .dev = {
-                        .bus_id = "gadget"
+                .ops    = &at91_udc_ops,
+                .ep0    = &controller.ep[0].ep,
+                .name   = driver_name,
+                .dev    = {
+                        .bus_id = "gadget",
+                        .release = nop_release,
                 }
         },
         .ep[0] = {
@@ -1468,7 +1485,8 @@ static struct at91_udc controller = {
                 },
                 .udc            = &controller,
                 .maxpacket      = 8,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(0)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(0)),
                 .int_mask       = 1 << 0,
         },
         .ep[1] = {
@@ -1479,7 +1497,8 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 64,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(1)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(1)),
                 .int_mask       = 1 << 1,
         },
         .ep[2] = {
@@ -1490,7 +1509,8 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 64,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(2)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(2)),
                 .int_mask       = 1 << 2,
         },
         .ep[3] = {
@@ -1501,7 +1521,8 @@ static struct at91_udc controller = {
                 },
                 .udc            = &controller,
                 .maxpacket      = 8,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(3)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(3)),
                 .int_mask       = 1 << 3,
         },
         .ep[4] = {
@@ -1512,7 +1533,8 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 256,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(4)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(4)),
                 .int_mask       = 1 << 4,
         },
         .ep[5] = {
@@ -1523,10 +1545,11 @@ static struct at91_udc controller = {
                 .udc            = &controller,
                 .is_pingpong    = 1,
                 .maxpacket      = 256,
-                .creg           = (void __iomem *)(AT91_VA_BASE_UDP + AT91_UDP_CSR(5)),
+                .creg           = (void __iomem *)(AT91_VA_BASE_UDP
+                                        + AT91_UDP_CSR(5)),
                 .int_mask       = 1 << 5,
         },
-        /* ep6 and ep7 are also reserved */
+        /* ep6 and ep7 are also reserved (custom silicon might use them) */
 };
 
 static irqreturn_t at91_vbus_irq(int irq, void *_udc, struct pt_regs *r)
@@ -1593,6 +1616,7 @@ int usb_gadget_unregister_driver (struct usb_gadget_driver *driver)
 
         local_irq_disable();
         udc->enabled = 0;
+        at91_udp_write(AT91_UDP_IDR, ~0);
         pullup(udc, 0);
         local_irq_enable();
 
@@ -1624,6 +1648,16 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        if (pdev->num_resources != 2) {
+                DBG("invalid num_resources");
+                return -ENODEV;
+        }
+        if ((pdev->resource[0].flags != IORESOURCE_MEM)
+                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+                DBG("invalid resource type");
+                return -ENODEV;
+        }
+
         if (!request_mem_region(AT91_BASE_UDP, SZ_16K, driver_name)) {
                 DBG("someone's using UDC memory\n");
                 return -EBUSY;
@@ -1649,19 +1683,26 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
         if (retval < 0)
                 goto fail0;
 
-        /* disable everything until there's a gadget driver and vbus */
-        pullup(udc, 0);
+        /* don't do anything until we have both gadget driver and VBUS */
+        clk_enable(udc->iclk);
+        at91_udp_write(AT91_UDP_TXVC, AT91_UDP_TXVC_TXVDIS);
+        at91_udp_write(AT91_UDP_IDR, 0xffffffff);
+        clk_disable(udc->iclk);
 
         /* request UDC and maybe VBUS irqs */
-        if (request_irq(AT91_ID_UDP, at91_udc_irq, IRQF_DISABLED, driver_name, udc)) {
-                DBG("request irq %d failed\n", AT91_ID_UDP);
+        udc->udp_irq = platform_get_irq(pdev, 0);
+        if (request_irq(udc->udp_irq, at91_udc_irq,
+                        IRQF_DISABLED, driver_name, udc)) {
+                DBG("request irq %d failed\n", udc->udp_irq);
                 retval = -EBUSY;
                 goto fail1;
         }
         if (udc->board.vbus_pin > 0) {
-                if (request_irq(udc->board.vbus_pin, at91_vbus_irq, IRQF_DISABLED, driver_name, udc)) {
-                        DBG("request vbus irq %d failed\n", udc->board.vbus_pin);
-                        free_irq(AT91_ID_UDP, udc);
+                if (request_irq(udc->board.vbus_pin, at91_vbus_irq,
+                                IRQF_DISABLED, driver_name, udc)) {
+                        DBG("request vbus irq %d failed\n",
+                                        udc->board.vbus_pin);
+                        free_irq(udc->udp_irq, udc);
                         retval = -EBUSY;
                         goto fail1;
                 }
@@ -1670,6 +1711,7 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
                 udc->vbus = 1;
         }
         dev_set_drvdata(dev, udc);
+        device_init_wakeup(dev, 1);
         create_debug_file(udc);
 
         INFO("%s version %s\n", driver_name, DRIVER_VERSION);
@@ -1678,14 +1720,14 @@ static int __devinit at91udc_probe(struct platform_device *pdev)
 fail1:
         device_unregister(&udc->gadget.dev);
 fail0:
-        release_mem_region(AT91_VA_BASE_UDP, SZ_16K);
+        release_mem_region(AT91_BASE_UDP, SZ_16K);
         DBG("%s probe failed, %d\n", driver_name, retval);
         return retval;
 }
 
-static int __devexit at91udc_remove(struct platform_device *dev)
+static int __devexit at91udc_remove(struct platform_device *pdev)
 {
-        struct at91_udc *udc = platform_get_drvdata(dev);
+        struct at91_udc *udc = platform_get_drvdata(pdev);
 
         DBG("remove\n");
 
@@ -1694,10 +1736,11 @@ static int __devexit at91udc_remove(struct platform_device *dev)
         if (udc->driver != 0)
                 usb_gadget_unregister_driver(udc->driver);
 
+        device_init_wakeup(&pdev->dev, 0);
         remove_debug_file(udc);
         if (udc->board.vbus_pin > 0)
                 free_irq(udc->board.vbus_pin, udc);
-        free_irq(AT91_ID_UDP, udc);
+        free_irq(udc->udp_irq, udc);
         device_unregister(&udc->gadget.dev);
         release_mem_region(AT91_BASE_UDP, SZ_16K);
 
@@ -1708,31 +1751,36 @@ static int __devexit at91udc_remove(struct platform_device *dev)
 }
 
 #ifdef CONFIG_PM
-static int at91udc_suspend(struct platform_device *dev, pm_message_t mesg)
+static int at91udc_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-        struct at91_udc *udc = platform_get_drvdata(dev);
+        struct at91_udc *udc = platform_get_drvdata(pdev);
+        int             wake = udc->driver && device_may_wakeup(&pdev->dev);
 
-        /*
-         * The "safe" suspend transitions are opportunistic ... e.g. when
-         * the USB link is suspended (48MHz clock autogated off), or when
-         * it's disconnected (programmatically gated off, elsewhere).
-         * Then we can suspend, and the chip can enter slow clock mode.
-         *
-         * The problem case is some component (user mode?) suspending this
-         * device while it's active, with the 48 MHz clock in use.  There
-         * are two basic approaches:  (a) veto suspend levels involving slow
-         * clock mode, (b) disconnect, so 48 MHz will no longer be in use
-         * and we can enter slow clock mode.  This uses (b) for now, since
-         * it's simplest until AT91 PM exists and supports the other option.
+        /* Unless we can act normally to the host (letting it wake us up
+         * whenever it has work for us) force disconnect.  Wakeup requires
+         * PLLB for USB events (signaling for reset, wakeup, or incoming
+         * tokens) and VBUS irqs (on systems which support them).
          */
-        if (udc->vbus && !udc->suspended)
+        if ((!udc->suspended && udc->addr)
+                        || !wake
+                        || at91_suspend_entering_slow_clock()) {
                 pullup(udc, 0);
+                disable_irq_wake(udc->udp_irq);
+        } else
+                enable_irq_wake(udc->udp_irq);
+
+        if (udc->board.vbus_pin > 0) {
+                if (wake)
+                        enable_irq_wake(udc->board.vbus_pin);
+                else
+                        disable_irq_wake(udc->board.vbus_pin);
+        }
         return 0;
 }
 
-static int at91udc_resume(struct platform_device *dev)
+static int at91udc_resume(struct platform_device *pdev)
 {
-        struct at91_udc *udc = platform_get_drvdata(dev);
+        struct at91_udc *udc = platform_get_drvdata(pdev);
 
         /* maybe reconnect to host; if so, clocks on */
         pullup(udc, 1);
@@ -1748,7 +1796,7 @@ static struct platform_driver at91_udc = {
         .remove         = __devexit_p(at91udc_remove),
         .shutdown       = at91udc_shutdown,
         .suspend        = at91udc_suspend,
-        .resume         = at91udc_resume,
+        .resume         = at91udc_resume,
         .driver         = {
                 .name   = (char *) driver_name,
                 .owner  = THIS_MODULE,
@@ -1767,6 +1815,6 @@ static void __devexit udc_exit_module(void)
 }
 module_exit(udc_exit_module);
 
-MODULE_DESCRIPTION("AT91RM9200 udc driver");
+MODULE_DESCRIPTION("AT91 udc driver");
 MODULE_AUTHOR("Thomas Rathbone, David Brownell");
 MODULE_LICENSE("GPL");
diff --git a/drivers/usb/gadget/at91_udc.h b/drivers/usb/gadget/at91_udc.h
index 5a4799cedd19..882af42e86cc 100644
--- a/drivers/usb/gadget/at91_udc.h
+++ b/drivers/usb/gadget/at91_udc.h
@@ -141,6 +141,7 @@ struct at91_udc {
         struct clk                      *iclk, *fclk;
         struct platform_device          *pdev;
         struct proc_dir_entry           *pde;
+        int                             udp_irq;
 };
 
 static inline struct at91_udc *to_udc(struct usb_gadget *g)
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 4be47195bd38..7d1c22c34957 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -609,7 +609,8 @@ static int dummy_dequeue (struct usb_ep *_ep, struct usb_request *_req)
         if (!dum->driver)
                 return -ESHUTDOWN;
 
-        spin_lock_irqsave (&dum->lock, flags);
+        local_irq_save (flags);
+        spin_lock (&dum->lock);
         list_for_each_entry (req, &ep->queue, queue) {
                 if (&req->req == _req) {
                         list_del_init (&req->queue);
@@ -618,7 +619,7 @@ static int dummy_dequeue (struct usb_ep *_ep, struct usb_request *_req)
                         break;
                 }
         }
-        spin_unlock_irqrestore (&dum->lock, flags);
+        spin_unlock (&dum->lock);
 
         if (retval == 0) {
                 dev_dbg (udc_dev(dum),
@@ -626,6 +627,7 @@ static int dummy_dequeue (struct usb_ep *_ep, struct usb_request *_req)
                                 req, _ep->name, _req->length, _req->buf);
                 _req->complete (_ep, _req);
         }
+        local_irq_restore (flags);
         return retval;
 }
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 85b0b4ad4c16..d63177a8eaea 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -892,7 +892,7 @@ MODULE_LICENSE ("GPL");
 #define PCI_DRIVER              ehci_pci_driver
 #endif
 
-#ifdef CONFIG_PPC_83xx
+#ifdef CONFIG_MPC834x
 #include "ehci-fsl.c"
 #define PLATFORM_DRIVER         ehci_fsl_driver
 #endif
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index cdbafb710000..85cc059705a6 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -4,7 +4,7 @@
  *  Copyright (C) 2004 SAN People (Pty) Ltd.
  *  Copyright (C) 2005 Thibaut VARENE <varenet@parisc-linux.org>
  *
- * AT91RM9200 Bus Glue
+ * AT91 Bus Glue
  *
  * Based on fragments of 2.4 driver by Rick Bronson.
  * Based on ohci-omap.c
@@ -19,12 +19,13 @@
 #include <asm/hardware.h>
 #include <asm/arch/board.h>
 
-#ifndef CONFIG_ARCH_AT91RM9200
-#error "CONFIG_ARCH_AT91RM9200 must be defined."
+#ifndef CONFIG_ARCH_AT91
+#error "CONFIG_ARCH_AT91 must be defined."
 #endif
 
 /* interface and function clocks */
 static struct clk *iclk, *fclk;
+static int clocked;
 
 extern int usb_disabled(void);
 
@@ -35,13 +36,14 @@ static void at91_start_hc(struct platform_device *pdev)
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct ohci_regs __iomem *regs = hcd->regs;
 
-        dev_dbg(&pdev->dev, "starting AT91RM9200 OHCI USB Controller\n");
+        dev_dbg(&pdev->dev, "start\n");
 
         /*
          * Start the USB clocks.
          */
         clk_enable(iclk);
         clk_enable(fclk);
+        clocked = 1;
 
         /*
          * The USB host controller must remain in reset.
@@ -54,7 +56,7 @@ static void at91_stop_hc(struct platform_device *pdev)
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct ohci_regs __iomem *regs = hcd->regs;
 
-        dev_dbg(&pdev->dev, "stopping AT91RM9200 OHCI USB Controller\n");
+        dev_dbg(&pdev->dev, "stop\n");
 
         /*
          * Put the USB host controller into reset.
@@ -66,6 +68,7 @@ static void at91_stop_hc(struct platform_device *pdev)
          */
         clk_disable(fclk);
         clk_disable(iclk);
+        clocked = 0;
 }
 
 
@@ -78,14 +81,15 @@ static int usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
 
 
 /**
- * usb_hcd_at91_probe - initialize AT91RM9200-based HCDs
+ * usb_hcd_at91_probe - initialize AT91-based HCDs
  * Context: !in_interrupt()
  *
  * Allocates basic resources for this USB host controller, and
  * then invokes the start() method for the HCD associated with it
  * through the hotplug entry's driver_data.
  */
-int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *pdev)
+static int usb_hcd_at91_probe(const struct hc_driver *driver,
+                        struct platform_device *pdev)
 {
         int retval;
         struct usb_hcd *hcd = NULL;
@@ -95,12 +99,13 @@ int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *
                 return -ENODEV;
         }
 
-        if ((pdev->resource[0].flags != IORESOURCE_MEM) || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+        if ((pdev->resource[0].flags != IORESOURCE_MEM)
+                        || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
                 pr_debug("hcd probe: invalid resource type\n");
                 return -ENODEV;
         }
 
-        hcd = usb_create_hcd(driver, &pdev->dev, "at91rm9200");
+        hcd = usb_create_hcd(driver, &pdev->dev, "at91");
         if (!hcd)
                 return -ENOMEM;
         hcd->rsrc_start = pdev->resource[0].start;
@@ -149,21 +154,23 @@ int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *
 /* may be called with controller, bus, and devices active */
 
 /**
- * usb_hcd_at91_remove - shutdown processing for AT91RM9200-based HCDs
+ * usb_hcd_at91_remove - shutdown processing for AT91-based HCDs
  * @dev: USB Host Controller being removed
  * Context: !in_interrupt()
  *
  * Reverses the effect of usb_hcd_at91_probe(), first invoking
  * the HCD's stop() method.  It is always called from a thread
- * context, normally "rmmod", "apmd", or something similar.
+ * context, "rmmod" or something similar.
  *
  */
-static int usb_hcd_at91_remove (struct usb_hcd *hcd, struct platform_device *pdev)
+static int usb_hcd_at91_remove(struct usb_hcd *hcd,
+                                struct platform_device *pdev)
 {
         usb_remove_hcd(hcd);
         at91_stop_hc(pdev);
         iounmap(hcd->regs);
         release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        disable_irq_wake(hcd->irq);
 
         clk_put(fclk);
         clk_put(iclk);
@@ -178,19 +185,21 @@ static int usb_hcd_at91_remove (struct usb_hcd *hcd, struct platform_device *pde
 static int __devinit
 ohci_at91_start (struct usb_hcd *hcd)
 {
-//      struct at91_ohci_data   *board = hcd->self.controller->platform_data;
+        struct at91_usbh_data   *board = hcd->self.controller->platform_data;
         struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
+        struct usb_device       *root = hcd->self.root_hub;
         int                     ret;
 
         if ((ret = ohci_init(ohci)) < 0)
                 return ret;
 
+        root->maxchild = board->ports;
+
         if ((ret = ohci_run(ohci)) < 0) {
                 err("can't start %s", hcd->self.bus_name);
                 ohci_stop(hcd);
                 return ret;
         }
-//      hcd->self.root_hub->maxchild = board->ports;
         return 0;
 }
 
@@ -198,7 +207,7 @@ ohci_at91_start (struct usb_hcd *hcd)
 
 static const struct hc_driver ohci_at91_hc_driver = {
         .description =          hcd_name,
-        .product_desc =         "AT91RM9200 OHCI",
+        .product_desc =         "AT91 OHCI",
         .hcd_priv_size =        sizeof(struct ohci_hcd),
 
         /*
@@ -240,33 +249,54 @@ static const struct hc_driver ohci_at91_hc_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int ohci_hcd_at91_drv_probe(struct platform_device *dev)
+static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
 {
-        return usb_hcd_at91_probe(&ohci_at91_hc_driver, dev);
+        device_init_wakeup(&pdev->dev, 1);
+        return usb_hcd_at91_probe(&ohci_at91_hc_driver, pdev);
 }
 
-static int ohci_hcd_at91_drv_remove(struct platform_device *dev)
+static int ohci_hcd_at91_drv_remove(struct platform_device *pdev)
 {
-        return usb_hcd_at91_remove(platform_get_drvdata(dev), dev);
+        device_init_wakeup(&pdev->dev, 0);
+        return usb_hcd_at91_remove(platform_get_drvdata(pdev), pdev);
 }
 
 #ifdef CONFIG_PM
 
-/* REVISIT suspend/resume look "too" simple here */
-
 static int
-ohci_hcd_at91_drv_suspend(struct platform_device *dev, pm_message_t mesg)
+ohci_hcd_at91_drv_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-        clk_disable(fclk);
-        clk_disable(iclk);
+        struct usb_hcd  *hcd = platform_get_drvdata(pdev);
+        struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+
+        if (device_may_wakeup(&pdev->dev))
+                enable_irq_wake(hcd->irq);
+        else
+                disable_irq_wake(hcd->irq);
+
+        /*
+         * The integrated transceivers seem unable to notice disconnect,
+         * reconnect, or wakeup without the 48 MHz clock active.  so for
+         * correctness, always discard connection state (using reset).
+         *
+         * REVISIT: some boards will be able to turn VBUS off...
+         */
+        if (at91_suspend_entering_slow_clock()) {
+                ohci_usb_reset (ohci);
+                clk_disable(fclk);
+                clk_disable(iclk);
+                clocked = 0;
+        }
 
         return 0;
 }
 
-static int ohci_hcd_at91_drv_resume(struct platform_device *dev)
+static int ohci_hcd_at91_drv_resume(struct platform_device *pdev)
 {
-        clk_enable(iclk);
-        clk_enable(fclk);
+        if (!clocked) {
+                clk_enable(iclk);
+                clk_enable(fclk);
+        }
 
         return 0;
 }
@@ -275,7 +305,7 @@ static int ohci_hcd_at91_drv_resume(struct platform_device *dev)
 #define ohci_hcd_at91_drv_resume  NULL
 #endif
 
-MODULE_ALIAS("at91rm9200-ohci");
+MODULE_ALIAS("at91_ohci");
 
 static struct platform_driver ohci_hcd_at91_driver = {
         .probe          = ohci_hcd_at91_drv_probe,
@@ -283,7 +313,7 @@ static struct platform_driver ohci_hcd_at91_driver = {
         .suspend        = ohci_hcd_at91_drv_suspend,
         .resume         = ohci_hcd_at91_drv_resume,
         .driver         = {
-                .name   = "at91rm9200-ohci",
+                .name   = "at91_ohci",
                 .owner  = THIS_MODULE,
         },
 };
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index 822914e2f43b..f7a975d5db09 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -110,7 +110,6 @@ static void au1xxx_start_ohc(struct platform_device *dev)
 
         printk(KERN_DEBUG __FILE__
         ": Clock to USB host has been enabled \n");
-#endif
 }
 
 static void au1xxx_stop_ohc(struct platform_device *dev)
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index afef5ac35b4a..94d8cf4b36c1 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -913,7 +913,7 @@ MODULE_LICENSE ("GPL");
 #include "ohci-ppc-soc.c"
 #endif
 
-#ifdef CONFIG_ARCH_AT91RM9200
+#if defined(CONFIG_ARCH_AT91RM9200) || defined(CONFIG_ARCH_AT91SAM9261)
 #include "ohci-at91.c"
 #endif
 
@@ -927,6 +927,7 @@ MODULE_LICENSE ("GPL");
       || defined (CONFIG_SOC_AU1X00) \
       || defined (CONFIG_USB_OHCI_HCD_PPC_SOC) \
       || defined (CONFIG_ARCH_AT91RM9200) \
+      || defined (CONFIG_ARCH_AT91SAM9261) \
         )
 #error "missing bus glue for ohci-hcd"
 #endif
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index c9d72ac0a1d7..66c3f61bc9d1 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -943,7 +943,9 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
                         /* We received a short packet */
                         if (urb->transfer_flags & URB_SHORT_NOT_OK)
                                 ret = -EREMOTEIO;
-                        else if (ctrlstat & TD_CTRL_SPD)
+
+                        /* Fixup needed only if this isn't the URB's last TD */
+                        else if (&td->list != urbp->td_list.prev)
                                 ret = 1;
                 }
 
diff --git a/drivers/usb/input/appletouch.c b/drivers/usb/input/appletouch.c
index 9e3f13903371..044faa07e297 100644
--- a/drivers/usb/input/appletouch.c
+++ b/drivers/usb/input/appletouch.c
@@ -597,9 +597,9 @@ static void atp_disconnect(struct usb_interface *iface)
         if (dev) {
                 usb_kill_urb(dev->urb);
                 input_unregister_device(dev->input);
-                usb_free_urb(dev->urb);
                 usb_buffer_free(dev->udev, dev->datalen,
                                 dev->data, dev->urb->transfer_dma);
+                usb_free_urb(dev->urb);
                 kfree(dev);
         }
         printk(KERN_INFO "input: appletouch disconnected\n");
diff --git a/drivers/usb/input/ati_remote.c b/drivers/usb/input/ati_remote.c
index 05d2d6012eb2..3719fcb04b8f 100644
--- a/drivers/usb/input/ati_remote.c
+++ b/drivers/usb/input/ati_remote.c
@@ -111,14 +111,28 @@
 #define NAME_BUFSIZE      80    /* size of product name, path buffers */
 #define DATA_BUFSIZE      63    /* size of URB data buffers */
 
+/*
+ * Duplicate event filtering time.
+ * Sequential, identical KIND_FILTERED inputs with less than
+ * FILTER_TIME milliseconds between them are considered as repeat
+ * events. The hardware generates 5 events for the first keypress
+ * and we have to take this into account for an accurate repeat
+ * behaviour.
+ */
+#define FILTER_TIME     60 /* msec */
+
 static unsigned long channel_mask;
-module_param(channel_mask, ulong, 0444);
+module_param(channel_mask, ulong, 0644);
 MODULE_PARM_DESC(channel_mask, "Bitmask of remote control channels to ignore");
 
 static int debug;
-module_param(debug, int, 0444);
+module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Enable extra debug messages and information");
 
+static int repeat_filter = FILTER_TIME;
+module_param(repeat_filter, int, 0644);
+MODULE_PARM_DESC(repeat_filter, "Repeat filter time, default = 60 msec");
+
 #define dbginfo(dev, format, arg...) do { if (debug) dev_info(dev , format , ## arg); } while (0)
 #undef err
 #define err(format, arg...) printk(KERN_ERR format , ## arg)
@@ -143,19 +157,6 @@ MODULE_DEVICE_TABLE(usb, ati_remote_table);
 static char init1[] = { 0x01, 0x00, 0x20, 0x14 };
 static char init2[] = { 0x01, 0x00, 0x20, 0x14, 0x20, 0x20, 0x20 };
 
-/* Acceleration curve for directional control pad */
-static const char accel[] = { 1, 2, 4, 6, 9, 13, 20 };
-
-/* Duplicate event filtering time.
- * Sequential, identical KIND_FILTERED inputs with less than
- * FILTER_TIME jiffies between them are considered as repeat
- * events. The hardware generates 5 events for the first keypress
- * and we have to take this into account for an accurate repeat
- * behaviour.
- * (HZ / 20) == 50 ms and works well for me.
- */
-#define FILTER_TIME (HZ / 20)
-
 struct ati_remote {
         struct input_dev *idev;
         struct usb_device *udev;
@@ -413,6 +414,43 @@ static int ati_remote_event_lookup(int rem, unsigned char d1, unsigned char d2)
 }
 
 /*
+ *      ati_remote_compute_accel
+ *
+ * Implements acceleration curve for directional control pad
+ * If elapsed time since last event is > 1/4 second, user "stopped",
+ * so reset acceleration. Otherwise, user is probably holding the control
+ * pad down, so we increase acceleration, ramping up over two seconds to
+ * a maximum speed.
+ */
+static int ati_remote_compute_accel(struct ati_remote *ati_remote)
+{
+        static const char accel[] = { 1, 2, 4, 6, 9, 13, 20 };
+        unsigned long now = jiffies;
+        int acc;
+
+        if (time_after(now, ati_remote->old_jiffies + msecs_to_jiffies(250))) {
+                acc = 1;
+                ati_remote->acc_jiffies = now;
+        }
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(125)))
+                acc = accel[0];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(250)))
+                acc = accel[1];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(500)))
+                acc = accel[2];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(1000)))
+                acc = accel[3];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(1500)))
+                acc = accel[4];
+        else if (time_before(now, ati_remote->acc_jiffies + msecs_to_jiffies(2000)))
+                acc = accel[5];
+        else
+                acc = accel[6];
+
+        return acc;
+}
+
+/*
  *      ati_remote_report_input
  */
 static void ati_remote_input_report(struct urb *urb, struct pt_regs *regs)
@@ -465,9 +503,9 @@ static void ati_remote_input_report(struct urb *urb, struct pt_regs *regs)
 
         if (ati_remote_tbl[index].kind == KIND_FILTERED) {
                 /* Filter duplicate events which happen "too close" together. */
-                if ((ati_remote->old_data[0] == data[1]) &&
-                        (ati_remote->old_data[1] == data[2]) &&
-                        time_before(jiffies, ati_remote->old_jiffies + FILTER_TIME)) {
+                if (ati_remote->old_data[0] == data[1] &&
+                    ati_remote->old_data[1] == data[2] &&
+                    time_before(jiffies, ati_remote->old_jiffies + msecs_to_jiffies(repeat_filter))) {
                         ati_remote->repeat_count++;
                 } else {
                         ati_remote->repeat_count = 0;
@@ -477,75 +515,61 @@ static void ati_remote_input_report(struct urb *urb, struct pt_regs *regs)
                 ati_remote->old_data[1] = data[2];
                 ati_remote->old_jiffies = jiffies;
 
-                if ((ati_remote->repeat_count > 0)
-                    && (ati_remote->repeat_count < 5))
+                if (ati_remote->repeat_count > 0 &&
+                    ati_remote->repeat_count < 5)
                         return;
 
 
                 input_regs(dev, regs);
                 input_event(dev, ati_remote_tbl[index].type,
                         ati_remote_tbl[index].code, 1);
+                input_sync(dev);
                 input_event(dev, ati_remote_tbl[index].type,
                         ati_remote_tbl[index].code, 0);
                 input_sync(dev);
 
-                return;
-        }
+        } else {
 
-        /*
-         * Other event kinds are from the directional control pad, and have an
-         * acceleration factor applied to them.  Without this acceleration, the
-         * control pad is mostly unusable.
-         *
-         * If elapsed time since last event is > 1/4 second, user "stopped",
-         * so reset acceleration. Otherwise, user is probably holding the control
-         * pad down, so we increase acceleration, ramping up over two seconds to
-         * a maximum speed.  The acceleration curve is #defined above.
-         */
-        if (time_after(jiffies, ati_remote->old_jiffies + (HZ >> 2))) {
-                acc = 1;
-                ati_remote->acc_jiffies = jiffies;
-        }
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ >> 3)))  acc = accel[0];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ >> 2)))  acc = accel[1];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ >> 1)))  acc = accel[2];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + HZ))         acc = accel[3];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + HZ+(HZ>>1))) acc = accel[4];
-        else if (time_before(jiffies, ati_remote->acc_jiffies + (HZ << 1)))  acc = accel[5];
-        else acc = accel[6];
-
-        input_regs(dev, regs);
-        switch (ati_remote_tbl[index].kind) {
-        case KIND_ACCEL:
-                input_event(dev, ati_remote_tbl[index].type,
-                        ati_remote_tbl[index].code,
-                        ati_remote_tbl[index].value * acc);
-                break;
-        case KIND_LU:
-                input_report_rel(dev, REL_X, -acc);
-                input_report_rel(dev, REL_Y, -acc);
-                break;
-        case KIND_RU:
-                input_report_rel(dev, REL_X, acc);
-                input_report_rel(dev, REL_Y, -acc);
-                break;
-        case KIND_LD:
-                input_report_rel(dev, REL_X, -acc);
-                input_report_rel(dev, REL_Y, acc);
-                break;
-        case KIND_RD:
-                input_report_rel(dev, REL_X, acc);
-                input_report_rel(dev, REL_Y, acc);
-                break;
-        default:
-                dev_dbg(&ati_remote->interface->dev, "ati_remote kind=%d\n",
-                        ati_remote_tbl[index].kind);
-        }
-        input_sync(dev);
+                /*
+                 * Other event kinds are from the directional control pad, and have an
+                 * acceleration factor applied to them.  Without this acceleration, the
+                 * control pad is mostly unusable.
+                 */
+                acc = ati_remote_compute_accel(ati_remote);
+
+                input_regs(dev, regs);
+                switch (ati_remote_tbl[index].kind) {
+                case KIND_ACCEL:
+                        input_event(dev, ati_remote_tbl[index].type,
+                                ati_remote_tbl[index].code,
+                                ati_remote_tbl[index].value * acc);
+                        break;
+                case KIND_LU:
+                        input_report_rel(dev, REL_X, -acc);
+                        input_report_rel(dev, REL_Y, -acc);
+                        break;
+                case KIND_RU:
+                        input_report_rel(dev, REL_X, acc);
+                        input_report_rel(dev, REL_Y, -acc);
+                        break;
+                case KIND_LD:
+                        input_report_rel(dev, REL_X, -acc);
+                        input_report_rel(dev, REL_Y, acc);
+                        break;
+                case KIND_RD:
+                        input_report_rel(dev, REL_X, acc);
+                        input_report_rel(dev, REL_Y, acc);
+                        break;
+                default:
+                        dev_dbg(&ati_remote->interface->dev, "ati_remote kind=%d\n",
+                                ati_remote_tbl[index].kind);
+                }
+                input_sync(dev);
 
-        ati_remote->old_jiffies = jiffies;
-        ati_remote->old_data[0] = data[1];
-        ati_remote->old_data[1] = data[2];
+                ati_remote->old_jiffies = jiffies;
+                ati_remote->old_data[0] = data[1];
+                ati_remote->old_data[1] = data[2];
+        }
 }
 
 /*
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 028e1ad89f5d..7208839f2dbf 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -607,7 +607,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
 
         }
 
-        if (usage->hat_min < usage->hat_max || usage->hat_dir) {
+        if (usage->type == EV_ABS &&
+            (usage->hat_min < usage->hat_max || usage->hat_dir)) {
                 int i;
                 for (i = usage->code; i < usage->code + 2 && i <= max; i++) {
                         input_set_abs_params(input, i, -1, 1, 0, 0);
diff --git a/drivers/usb/input/hiddev.c b/drivers/usb/input/hiddev.c
index 70477f02cc29..f6b839c257a7 100644
--- a/drivers/usb/input/hiddev.c
+++ b/drivers/usb/input/hiddev.c
@@ -49,7 +49,7 @@ struct hiddev {
         int open;
         wait_queue_head_t wait;
         struct hid_device *hid;
-        struct hiddev_list *list;
+        struct list_head list;
 };
 
 struct hiddev_list {
@@ -59,7 +59,7 @@ struct hiddev_list {
         unsigned flags;
         struct fasync_struct *fasync;
         struct hiddev *hiddev;
-        struct hiddev_list *next;
+        struct list_head node;
 };
 
 static struct hiddev *hiddev_table[HIDDEV_MINORS];
@@ -73,12 +73,15 @@ static struct hiddev *hiddev_table[HIDDEV_MINORS];
 static struct hid_report *
 hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
 {
-        unsigned flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
+        unsigned int flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
+        unsigned int rid = rinfo->report_id & HID_REPORT_ID_MASK;
         struct hid_report_enum *report_enum;
+        struct hid_report *report;
         struct list_head *list;
 
         if (rinfo->report_type < HID_REPORT_TYPE_MIN ||
-            rinfo->report_type > HID_REPORT_TYPE_MAX) return NULL;
+            rinfo->report_type > HID_REPORT_TYPE_MAX)
+                return NULL;
 
         report_enum = hid->report_enum +
                 (rinfo->report_type - HID_REPORT_TYPE_MIN);
@@ -88,21 +91,25 @@ hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
                 break;
 
         case HID_REPORT_ID_FIRST:
-                list = report_enum->report_list.next;
-                if (list == &report_enum->report_list)
+                if (list_empty(&report_enum->report_list))
                         return NULL;
-                rinfo->report_id = ((struct hid_report *) list)->id;
+
+                list = report_enum->report_list.next;
+                report = list_entry(list, struct hid_report, list);
+                rinfo->report_id = report->id;
                 break;
 
         case HID_REPORT_ID_NEXT:
-                list = (struct list_head *)
-                        report_enum->report_id_hash[rinfo->report_id & HID_REPORT_ID_MASK];
-                if (list == NULL)
+                report = report_enum->report_id_hash[rid];
+                if (!report)
                         return NULL;
-                list = list->next;
+
+                list = report->list.next;
                 if (list == &report_enum->report_list)
                         return NULL;
-                rinfo->report_id = ((struct hid_report *) list)->id;
+
+                report = list_entry(list, struct hid_report, list);
+                rinfo->report_id = report->id;
                 break;
 
         default:
@@ -125,12 +132,13 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
         struct hid_field *field;
 
         if (uref->report_type < HID_REPORT_TYPE_MIN ||
-            uref->report_type > HID_REPORT_TYPE_MAX) return NULL;
+            uref->report_type > HID_REPORT_TYPE_MAX)
+                return NULL;
 
         report_enum = hid->report_enum +
                 (uref->report_type - HID_REPORT_TYPE_MIN);
 
-        list_for_each_entry(report, &report_enum->report_list, list)
+        list_for_each_entry(report, &report_enum->report_list, list) {
                 for (i = 0; i < report->maxfield; i++) {
                         field = report->field[i];
                         for (j = 0; j < field->maxusage; j++) {
@@ -142,6 +150,7 @@ hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
                                 }
                         }
                 }
+        }
 
         return NULL;
 }
@@ -150,9 +159,9 @@ static void hiddev_send_event(struct hid_device *hid,
                               struct hiddev_usage_ref *uref)
 {
         struct hiddev *hiddev = hid->hiddev;
-        struct hiddev_list *list = hiddev->list;
+        struct hiddev_list *list;
 
-        while (list) {
+        list_for_each_entry(list, &hiddev->list, node) {
                 if (uref->field_index != HID_FIELD_INDEX_NONE ||
                     (list->flags & HIDDEV_FLAG_REPORT) != 0) {
                         list->buffer[list->head] = *uref;
@@ -160,8 +169,6 @@ static void hiddev_send_event(struct hid_device *hid,
                                 (HIDDEV_BUFFER_SIZE - 1);
                         kill_fasync(&list->fasync, SIGIO, POLL_IN);
                 }
-
-                list = list->next;
         }
 
         wake_up_interruptible(&hiddev->wait);
@@ -180,7 +187,7 @@ void hiddev_hid_event(struct hid_device *hid, struct hid_field *field,
         uref.report_type =
           (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
           ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
-           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE:0));
+           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
         uref.report_id = field->report->id;
         uref.field_index = field->index;
         uref.usage_index = (usage - field->usage);
@@ -200,7 +207,7 @@ void hiddev_report_event(struct hid_device *hid, struct hid_report *report)
         uref.report_type =
           (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
           ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
-           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE:0));
+           ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
         uref.report_id = report->id;
         uref.field_index = HID_FIELD_INDEX_NONE;
 
@@ -213,7 +220,9 @@ static int hiddev_fasync(int fd, struct file *file, int on)
 {
         int retval;
         struct hiddev_list *list = file->private_data;
+
         retval = fasync_helper(fd, file, on, &list->fasync);
+
         return retval < 0 ? retval : 0;
 }
 
@@ -224,14 +233,9 @@ static int hiddev_fasync(int fd, struct file *file, int on)
 static int hiddev_release(struct inode * inode, struct file * file)
 {
         struct hiddev_list *list = file->private_data;
-        struct hiddev_list **listptr;
 
-        listptr = &list->hiddev->list;
         hiddev_fasync(-1, file, 0);
-
-        while (*listptr && (*listptr != list))
-                listptr = &((*listptr)->next);
-        *listptr = (*listptr)->next;
+        list_del(&list->node);
 
         if (!--list->hiddev->open) {
                 if (list->hiddev->exist)
@@ -248,7 +252,8 @@ static int hiddev_release(struct inode * inode, struct file * file)
 /*
  * open file op
  */
-static int hiddev_open(struct inode * inode, struct file * file) {
+static int hiddev_open(struct inode *inode, struct file *file)
+{
         struct hiddev_list *list;
 
         int i = iminor(inode) - HIDDEV_MINOR_BASE;
@@ -260,9 +265,7 @@ static int hiddev_open(struct inode * inode, struct file * file) {
                 return -ENOMEM;
 
         list->hiddev = hiddev_table[i];
-        list->next = hiddev_table[i]->list;
-        hiddev_table[i]->list = list;
-
+        list_add_tail(&list->node, &hiddev_table[i]->list);
         file->private_data = list;
 
         if (!list->hiddev->open++)
@@ -362,6 +365,7 @@ static ssize_t hiddev_read(struct file * file, char __user * buffer, size_t coun
 static unsigned int hiddev_poll(struct file *file, poll_table *wait)
 {
         struct hiddev_list *list = file->private_data;
+
         poll_wait(file, &list->hiddev->wait, wait);
         if (list->head != list->tail)
                 return POLLIN | POLLRDNORM;
@@ -382,7 +386,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
         struct hiddev_collection_info cinfo;
         struct hiddev_report_info rinfo;
         struct hiddev_field_info finfo;
-        struct hiddev_usage_ref_multi *uref_multi=NULL;
+        struct hiddev_usage_ref_multi *uref_multi = NULL;
         struct hiddev_usage_ref *uref;
         struct hiddev_devinfo dinfo;
         struct hid_report *report;
@@ -764,15 +768,15 @@ int hiddev_connect(struct hid_device *hid)
         }
 
         init_waitqueue_head(&hiddev->wait);
-
-        hiddev_table[hid->intf->minor - HIDDEV_MINOR_BASE] = hiddev;
-
+        INIT_LIST_HEAD(&hiddev->list);
         hiddev->hid = hid;
         hiddev->exist = 1;
 
         hid->minor = hid->intf->minor;
         hid->hiddev = hiddev;
 
+        hiddev_table[hid->intf->minor - HIDDEV_MINOR_BASE] = hiddev;
+
         return 0;
 }
 
diff --git a/drivers/usb/misc/cypress_cy7c63.c b/drivers/usb/misc/cypress_cy7c63.c
index e091d327bd9e..a4062a6adbb8 100644
--- a/drivers/usb/misc/cypress_cy7c63.c
+++ b/drivers/usb/misc/cypress_cy7c63.c
@@ -12,8 +12,13 @@
 *       the single I/O ports of the device.
 *
 *       Supported vendors:      AK Modul-Bus Computer GmbH
-*       Supported devices:      CY7C63001A-PC (to be continued...)
-*       Supported functions:    Read/Write Ports (to be continued...)
+*                               (Firmware "Port-Chip")
+*
+*       Supported devices:      CY7C63001A-PC
+*                               CY7C63001C-PXC
+*                               CY7C63001C-SXC
+*
+*       Supported functions:    Read/Write Ports
 *
 *
 *       This program is free software; you can redistribute it and/or
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 786e1dbe88ec..983e104dd452 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -1242,11 +1242,12 @@ done:
 static int ctrl_out (struct usbtest_dev *dev,
                 unsigned count, unsigned length, unsigned vary)
 {
-        unsigned                i, j, len, retval;
+        unsigned                i, j, len;
+        int                     retval;
         u8                      *buf;
         char                    *what = "?";
         struct usb_device       *udev;
-        
+
         if (length < 1 || length > 0xffff || vary >= length)
                 return -EINVAL;
 
diff --git a/drivers/usb/net/rtl8150.c b/drivers/usb/net/rtl8150.c
index e5e6e4f3ef87..bd09232ce13c 100644
--- a/drivers/usb/net/rtl8150.c
+++ b/drivers/usb/net/rtl8150.c
@@ -175,6 +175,8 @@ static inline struct sk_buff *pull_skb(rtl8150_t *);
 static void rtl8150_disconnect(struct usb_interface *intf);
 static int rtl8150_probe(struct usb_interface *intf,
                            const struct usb_device_id *id);
+static int rtl8150_suspend(struct usb_interface *intf, pm_message_t message);
+static int rtl8150_resume(struct usb_interface *intf);
 
 static const char driver_name [] = "rtl8150";
 
@@ -183,6 +185,8 @@ static struct usb_driver rtl8150_driver = {
         .probe =        rtl8150_probe,
         .disconnect =   rtl8150_disconnect,
         .id_table =     rtl8150_table,
+        .suspend =      rtl8150_suspend,
+        .resume =       rtl8150_resume
 };
 
 /*
@@ -238,9 +242,11 @@ static int async_set_registers(rtl8150_t * dev, u16 indx, u16 size)
         usb_fill_control_urb(dev->ctrl_urb, dev->udev,
                          usb_sndctrlpipe(dev->udev, 0), (char *) &dev->dr,
                          &dev->rx_creg, size, ctrl_callback, dev);
-        if ((ret = usb_submit_urb(dev->ctrl_urb, GFP_ATOMIC)))
+        if ((ret = usb_submit_urb(dev->ctrl_urb, GFP_ATOMIC))) {
+                if (ret == -ENODEV)
+                        netif_device_detach(dev->netdev);
                 err("control request submission failed: %d", ret);
-        else
+        } else
                 set_bit(RX_REG_SET, &dev->flags);
 
         return ret;
@@ -416,6 +422,7 @@ static void read_bulk_callback(struct urb *urb, struct pt_regs *regs)
         struct sk_buff *skb;
         struct net_device *netdev;
         u16 rx_stat;
+        int status;
 
         dev = urb->context;
         if (!dev)
@@ -465,7 +472,10 @@ static void read_bulk_callback(struct urb *urb, struct pt_regs *regs)
 goon:
         usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
                       dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
-        if (usb_submit_urb(dev->rx_urb, GFP_ATOMIC)) {
+        status = usb_submit_urb(dev->rx_urb, GFP_ATOMIC);
+        if (status == -ENODEV)
+                netif_device_detach(dev->netdev);
+        else if (status) {
                 set_bit(RX_URB_FAIL, &dev->flags);
                 goto resched;
         } else {
@@ -481,6 +491,7 @@ static void rx_fixup(unsigned long data)
 {
         rtl8150_t *dev;
         struct sk_buff *skb;
+        int status;
 
         dev = (rtl8150_t *)data;
 
@@ -499,10 +510,13 @@ static void rx_fixup(unsigned long data)
         usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
                       dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
 try_again:
-        if (usb_submit_urb(dev->rx_urb, GFP_ATOMIC)) {
+        status = usb_submit_urb(dev->rx_urb, GFP_ATOMIC);
+        if (status == -ENODEV) {
+                netif_device_detach(dev->netdev);
+        } else if (status) {
                 set_bit(RX_URB_FAIL, &dev->flags);
                 goto tlsched;
-         } else {
+        } else {
                 clear_bit(RX_URB_FAIL, &dev->flags);
         }
 
@@ -574,12 +588,43 @@ static void intr_callback(struct urb *urb, struct pt_regs *regs)
 
 resubmit:
         status = usb_submit_urb (urb, SLAB_ATOMIC);
-        if (status)
+        if (status == -ENODEV)
+                netif_device_detach(dev->netdev);
+        else if (status)
                 err ("can't resubmit intr, %s-%s/input0, status %d",
                                 dev->udev->bus->bus_name,
                                 dev->udev->devpath, status);
 }
 
+static int rtl8150_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        rtl8150_t *dev = usb_get_intfdata(intf);
+
+        netif_device_detach(dev->netdev);
+
+        if (netif_running(dev->netdev)) {
+                usb_kill_urb(dev->rx_urb);
+                usb_kill_urb(dev->intr_urb);
+        }
+        return 0;
+}
+
+static int rtl8150_resume(struct usb_interface *intf)
+{
+        rtl8150_t *dev = usb_get_intfdata(intf);
+
+        netif_device_attach(dev->netdev);
+        if (netif_running(dev->netdev)) {
+                dev->rx_urb->status = 0;
+                dev->rx_urb->actual_length = 0;
+                read_bulk_callback(dev->rx_urb, NULL);
+
+                dev->intr_urb->status = 0;
+                dev->intr_urb->actual_length = 0;
+                intr_callback(dev->intr_urb, NULL);
+        }
+        return 0;
+}
 
 /*
 **
@@ -690,9 +735,14 @@ static int rtl8150_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2),
                       skb->data, count, write_bulk_callback, dev);
         if ((res = usb_submit_urb(dev->tx_urb, GFP_ATOMIC))) {
-                warn("failed tx_urb %d\n", res);
-                dev->stats.tx_errors++;
-                netif_start_queue(netdev);
+                /* Can we get/handle EPIPE here? */
+                if (res == -ENODEV)
+                        netif_device_detach(dev->netdev);
+                else {
+                        warn("failed tx_urb %d\n", res);
+                        dev->stats.tx_errors++;
+                        netif_start_queue(netdev);
+                }
         } else {
                 dev->stats.tx_packets++;
                 dev->stats.tx_bytes += skb->len;
@@ -729,16 +779,25 @@ static int rtl8150_open(struct net_device *netdev)
         
         usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
                       dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
-        if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL)))
+        if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL))) {
+                if (res == -ENODEV)
+                        netif_device_detach(dev->netdev);
                 warn("%s: rx_urb submit failed: %d", __FUNCTION__, res);
+                return res;
+        }
         usb_fill_int_urb(dev->intr_urb, dev->udev, usb_rcvintpipe(dev->udev, 3),
                      dev->intr_buff, INTBUFSIZE, intr_callback,
                      dev, dev->intr_interval);
-        if ((res = usb_submit_urb(dev->intr_urb, GFP_KERNEL)))
+        if ((res = usb_submit_urb(dev->intr_urb, GFP_KERNEL))) {
+                if (res == -ENODEV)
+                        netif_device_detach(dev->netdev);
                 warn("%s: intr_urb submit failed: %d", __FUNCTION__, res);
-        netif_start_queue(netdev);
+                usb_kill_urb(dev->rx_urb);
+                return res;
+        }
         enable_net_traffic(dev);
         set_carrier(netdev);
+        netif_start_queue(netdev);
 
         return res;
 }
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index ac33bd47cfce..f5b9438c94f0 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -62,15 +62,6 @@ config USB_SERIAL_AIRPRIME
           To compile this driver as a module, choose M here: the
           module will be called airprime.
 
-config USB_SERIAL_ANYDATA
-        tristate "USB AnyData CDMA Wireless Driver"
-        depends on USB_SERIAL
-        help
-          Say Y here if you want to use a AnyData CDMA device.
-
-          To compile this driver as a module, choose M here: the
-          module will be called anydata.
-
 config USB_SERIAL_ARK3116
         tristate "USB ARK Micro 3116 USB Serial Driver (EXPERIMENTAL)"
         depends on USB_SERIAL && EXPERIMENTAL
@@ -502,15 +493,18 @@ config USB_SERIAL_XIRCOM
           module will be called keyspan_pda.
 
 config USB_SERIAL_OPTION
-        tristate "USB driver for GSM modems"
+        tristate "USB driver for GSM and CDMA modems"
         depends on USB_SERIAL
         help
-          Say Y here if you have an "Option" GSM PCMCIA card
-          (or an OEM version: branded Huawei, Audiovox, or Novatel).
+          Say Y here if you have a GSM or CDMA modem that's connected to USB.
+
+          This driver also supports several PCMCIA cards which have a
+          built-in OHCI-USB adapter and an internally-connected GSM modem.
+          The USB bus on these cards is not accessible externally.
 
-          These cards feature a built-in OHCI-USB adapter and an
-          internally-connected GSM modem. The USB bus is not
-          accessible externally.
+          Supported devices include (some of?) those made by:
+          Option, Huawei, Audiovox, Sierra Wireless, Novatel Wireless, or
+          Anydata.
 
           To compile this driver as a module, choose M here: the
           module will be called option.
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index 35d4acc7f1d3..8efed2ce1ba3 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -12,7 +12,6 @@ usbserial-obj-$(CONFIG_USB_EZUSB)		+= ezusb.o
 usbserial-objs  := usb-serial.o generic.o bus.o $(usbserial-obj-y)
 
 obj-$(CONFIG_USB_SERIAL_AIRPRIME)               += airprime.o
-obj-$(CONFIG_USB_SERIAL_ANYDATA)                += anydata.o
 obj-$(CONFIG_USB_SERIAL_ARK3116)                += ark3116.o
 obj-$(CONFIG_USB_SERIAL_BELKIN)                 += belkin_sa.o
 obj-$(CONFIG_USB_SERIAL_CP2101)                 += cp2101.o
diff --git a/drivers/usb/serial/anydata.c b/drivers/usb/serial/anydata.c
deleted file mode 100644
index 01843ef8c11e..000000000000
--- a/drivers/usb/serial/anydata.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * AnyData CDMA Serial USB driver
- *
- * Copyright (C) 2005 Greg Kroah-Hartman <gregkh@suse.de>
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License version
- *      2 as published by the Free Software Foundation.
- */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/tty.h>
-#include <linux/module.h>
-#include <linux/usb.h>
-#include <linux/usb/serial.h>
-
-static struct usb_device_id id_table [] = {
-        { USB_DEVICE(0x16d5, 0x6501) }, /* AirData CDMA device */
-        { },
-};
-MODULE_DEVICE_TABLE(usb, id_table);
-
-/* if overridden by the user, then use their value for the size of the
- * read and write urbs */
-static int buffer_size;
-static int debug;
-
-static struct usb_driver anydata_driver = {
-        .name =         "anydata",
-        .probe =        usb_serial_probe,
-        .disconnect =   usb_serial_disconnect,
-        .id_table =     id_table,
-        .no_dynamic_id =        1,
-};
-
-static int anydata_open(struct usb_serial_port *port, struct file *filp)
-{
-        char *buffer;
-        int result = 0;
-
-        dbg("%s - port %d", __FUNCTION__, port->number);
-
-        if (buffer_size) {
-                /* override the default buffer sizes */
-                buffer = kmalloc(buffer_size, GFP_KERNEL);
-                if (!buffer) {
-                        dev_err(&port->dev, "%s - out of memory.\n",
-                                __FUNCTION__);
-                        return -ENOMEM;
-                }
-                kfree (port->read_urb->transfer_buffer);
-                port->read_urb->transfer_buffer = buffer;
-                port->read_urb->transfer_buffer_length = buffer_size;
-
-                buffer = kmalloc(buffer_size, GFP_KERNEL);
-                if (!buffer) {
-                        dev_err(&port->dev, "%s - out of memory.\n",
-                                __FUNCTION__);
-                        return -ENOMEM;
-                }
-                kfree (port->write_urb->transfer_buffer);
-                port->write_urb->transfer_buffer = buffer;
-                port->write_urb->transfer_buffer_length = buffer_size;
-                port->bulk_out_size = buffer_size;
-        }
-
-        /* Start reading from the device */
-        usb_fill_bulk_urb(port->read_urb, port->serial->dev,
-                          usb_rcvbulkpipe(port->serial->dev,
-                                          port->bulk_in_endpointAddress),
-                          port->read_urb->transfer_buffer,
-                          port->read_urb->transfer_buffer_length,
-                          usb_serial_generic_read_bulk_callback, port);
-        result = usb_submit_urb(port->read_urb, GFP_KERNEL);
-        if (result)
-                dev_err(&port->dev,
-                        "%s - failed submitting read urb, error %d\n",
-                        __FUNCTION__, result);
-
-        return result;
-}
-
-static struct usb_serial_driver anydata_device = {
-        .driver = {
-                .owner =        THIS_MODULE,
-                .name =         "anydata",
-        },
-        .id_table =             id_table,
-        .num_interrupt_in =     NUM_DONT_CARE,
-        .num_bulk_in =          NUM_DONT_CARE,
-        .num_bulk_out =         NUM_DONT_CARE,
-        .num_ports =            1,
-        .open =                 anydata_open,
-};
-
-static int __init anydata_init(void)
-{
-        int retval;
-
-        retval = usb_serial_register(&anydata_device);
-        if (retval)
-                return retval;
-        retval = usb_register(&anydata_driver);
-        if (retval)
-                usb_serial_deregister(&anydata_device);
-        return retval;
-}
-
-static void __exit anydata_exit(void)
-{
-        usb_deregister(&anydata_driver);
-        usb_serial_deregister(&anydata_device);
-}
-
-module_init(anydata_init);
-module_exit(anydata_exit);
-MODULE_LICENSE("GPL");
-
-module_param(debug, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(debug, "Debug enabled or not");
-module_param(buffer_size, int, 0);
-MODULE_PARM_DESC(buffer_size, "Size of the transfer buffers");
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index b458aedc5fb6..15945e806f03 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -306,6 +306,8 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 
 
 static struct usb_device_id id_table_combined [] = {
+        { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
@@ -337,6 +339,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2101_PID) },
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2102_PID) },
         { USB_DEVICE(SEALEVEL_VID, SEALEVEL_2103_PID) },
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 04ef90fcb876..8888cd80a491 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -32,6 +32,12 @@
 #define FTDI_NF_RIC_PID 0x0001  /* Product Id */
 
 
+/* www.canusb.com Lawicel CANUSB device */
+#define FTDI_CANUSB_PID 0xFFA8 /* Product Id */
+
+/* AlphaMicro Components AMC-232USB01 device */
+#define FTDI_AMC232_PID 0xFF00 /* Product Id */
+
 /* ACT Solutions HomePro ZWave interface (http://www.act-solutions.com/HomePro.htm) */
 #define FTDI_ACTZWAVE_PID       0xF2D0
 
@@ -182,6 +188,10 @@
 /* http://home.earthlink.net/~jrhees/USBUIRT/index.htm */
 #define FTDI_USB_UIRT_PID       0xF850  /* Product Id */
 
+/* TNC-X USB-to-packet-radio adapter, versions prior to 3.0 (DLP module) */
+
+#define FTDI_TNC_X_PID          0xEBE0
+
 /*
  * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
  * All of these devices use FTDI's vendor ID (0x0403).
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 59c5d999009a..9840bade79f9 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -250,6 +250,9 @@ static struct usb_device_id ipaq_id_table [] = {
         { USB_DEVICE(0x04C5, 0x1058) }, /* FUJITSU USB Sync */
         { USB_DEVICE(0x04C5, 0x1079) }, /* FUJITSU USB Sync */
         { USB_DEVICE(0x04DA, 0x2500) }, /* Panasonic USB Sync */
+        { USB_DEVICE(0x04DD, 0x9102) }, /* SHARP WS003SH USB Modem */
+        { USB_DEVICE(0x04DD, 0x9121) }, /* SHARP WS004SH USB Modem */
+        { USB_DEVICE(0x04DD, 0x9123) }, /* SHARP WS007SH USB Modem */
         { USB_DEVICE(0x04E8, 0x5F00) }, /* Samsung NEXiO USB Sync */
         { USB_DEVICE(0x04E8, 0x5F01) }, /* Samsung NEXiO USB Sync */
         { USB_DEVICE(0x04E8, 0x5F02) }, /* Samsung NEXiO USB Sync */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f0530c1d7b7a..c856e6f40e22 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -9,40 +9,14 @@
 
   Portions copied from the Keyspan driver by Hugh Blemings <hugh@blemings.org>
 
-  History:
-
-  2005-05-19  v0.1   Initial version, based on incomplete docs
-                     and analysis of misbehavior with the standard driver
-  2005-05-20  v0.2   Extended the input buffer to avoid losing
-                     random 64-byte chunks of data
-  2005-05-21  v0.3   implemented chars_in_buffer()
-                     turned on low_latency
-                     simplified the code somewhat
-  2005-05-24  v0.4   option_write() sometimes deadlocked under heavy load
-                     removed some dead code
-                     added sponsor notice
-                     coding style clean-up
-  2005-06-20  v0.4.1 add missing braces :-/
-                     killed end-of-line whitespace
-  2005-07-15  v0.4.2 rename WLAN product to FUSION, add FUSION2
-  2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
-  2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
-                     wants to send >2000 bytes.
-  2006-04-10  v0.5   fixed two array overrun errors :-/
-  2006-04-21  v0.5.1 added support for Sierra Wireless MC8755
-  2006-05-15  v0.6   re-enable multi-port support
-  2006-06-01  v0.6.1 add COBRA
-  2006-06-01  v0.6.2 add backwards-compatibility stuff
-  2006-06-01  v0.6.3 add Novatel Wireless
-  2006-06-01  v0.7   Option => GSM
-  2006-06-01  v0.7.1 add COBRA2
+  History: see the git log.
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
   This driver exists because the "normal" serial driver doesn't work too well
   with GSM modems. Issues:
   - data loss -- one single Receive URB is not nearly enough
-  - nonstandard flow (Option devices) and multiplex (Sierra) control
+  - nonstandard flow (Option devices) control
   - controlling the baud rate doesn't make sense
 
   This driver is named "option" because the most common device it's
@@ -96,8 +70,8 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define OPTION_VENDOR_ID                0x0AF0
 #define HUAWEI_VENDOR_ID                0x12D1
 #define AUDIOVOX_VENDOR_ID              0x0F3D
-#define SIERRAWIRELESS_VENDOR_ID        0x1199
 #define NOVATELWIRELESS_VENDOR_ID       0x1410
+#define ANYDATA_VENDOR_ID               0x16d5
 
 #define OPTION_PRODUCT_OLD              0x5000
 #define OPTION_PRODUCT_FUSION           0x6000
@@ -106,8 +80,8 @@ static int  option_send_setup(struct usb_serial_port *port);
 #define OPTION_PRODUCT_COBRA2           0x6600
 #define HUAWEI_PRODUCT_E600             0x1001
 #define AUDIOVOX_PRODUCT_AIRCARD        0x0112
-#define SIERRAWIRELESS_PRODUCT_MC8755   0x6802
 #define NOVATELWIRELESS_PRODUCT_U740    0x1400
+#define ANYDATA_PRODUCT_ID              0x6501
 
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
@@ -117,8 +91,8 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA2) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
-        { USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ID) },
         { } /* Terminating entry */
 };
 
@@ -131,10 +105,7 @@ static struct usb_device_id option_ids1[] = {
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
-        { } /* Terminating entry */
-};
-static struct usb_device_id option_ids3[] = {
-        { USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
+        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ID) },
         { } /* Terminating entry */
 };
 
@@ -151,37 +122,11 @@ static struct usb_driver option_driver = {
 /* The card has three separate interfaces, which the serial driver
  * recognizes separately, thus num_port=1.
  */
-static struct usb_serial_driver option_3port_device = {
-        .driver = {
-                .owner =        THIS_MODULE,
-                .name =         "option",
-        },
-        .description       = "GSM modem (3-port)",
-        .id_table          = option_ids3,
-        .num_interrupt_in  = NUM_DONT_CARE,
-        .num_bulk_in       = NUM_DONT_CARE,
-        .num_bulk_out      = NUM_DONT_CARE,
-        .num_ports         = 3,
-        .open              = option_open,
-        .close             = option_close,
-        .write             = option_write,
-        .write_room        = option_write_room,
-        .chars_in_buffer   = option_chars_in_buffer,
-        .throttle          = option_rx_throttle,
-        .unthrottle        = option_rx_unthrottle,
-        .set_termios       = option_set_termios,
-        .break_ctl         = option_break_ctl,
-        .tiocmget          = option_tiocmget,
-        .tiocmset          = option_tiocmset,
-        .attach            = option_startup,
-        .shutdown          = option_shutdown,
-        .read_int_callback = option_instat_callback,
-};
 
 static struct usb_serial_driver option_1port_device = {
         .driver = {
                 .owner =        THIS_MODULE,
-                .name =         "option",
+                .name =         "option1",
         },
         .description       = "GSM modem (1-port)",
         .id_table          = option_ids1,
@@ -245,9 +190,6 @@ static int __init option_init(void)
         retval = usb_serial_register(&option_1port_device);
         if (retval)
                 goto failed_1port_device_register;
-        retval = usb_serial_register(&option_3port_device);
-        if (retval)
-                goto failed_3port_device_register;
         retval = usb_register(&option_driver);
         if (retval)
                 goto failed_driver_register;
@@ -257,8 +199,6 @@ static int __init option_init(void)
         return 0;
 
 failed_driver_register:
-        usb_serial_deregister (&option_3port_device);
-failed_3port_device_register:
         usb_serial_deregister (&option_1port_device);
 failed_1port_device_register:
         return retval;
@@ -267,7 +207,6 @@ failed_1port_device_register:
 static void __exit option_exit(void)
 {
         usb_deregister (&option_driver);
-        usb_serial_deregister (&option_3port_device);
         usb_serial_deregister (&option_1port_device);
 }
 
@@ -656,7 +595,6 @@ static void option_setup_urbs(struct usb_serial *serial)
 
         dbg("%s", __FUNCTION__);
 
-
         for (i = 0; i < serial->num_ports; i++) {
                 port = serial->port[i];
                 portdata = usb_get_serial_port_data(port);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 259db31b65c1..efbbc0adb89a 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -81,6 +81,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(SPEEDDRAGON_VENDOR_ID, SPEEDDRAGON_PRODUCT_ID) },
         { USB_DEVICE(OTI_VENDOR_ID, OTI_PRODUCT_ID) },
         { USB_DEVICE(DATAPILOT_U2_VENDOR_ID, DATAPILOT_U2_PRODUCT_ID) },
+        { USB_DEVICE(BELKIN_VENDOR_ID, BELKIN_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index d9c1e6e0b4b3..a692ac66ca6c 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -89,3 +89,7 @@
 /* DATAPILOT Universal-2 Phone Cable */
 #define DATAPILOT_U2_VENDOR_ID  0x0731
 #define DATAPILOT_U2_PRODUCT_ID 0x2003
+
+/* Belkin "F5U257" Serial Adapter */
+#define BELKIN_VENDOR_ID        0x050d
+#define BELKIN_PRODUCT_ID       0x0257
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index a5ca449f6e64..fd158e063c06 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -145,6 +145,13 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Mario Rettig <mariorettig@web.de> */
+UNUSUAL_DEV(  0x0421, 0x042e, 0x0100, 0x0100,
+                "Nokia",
+                "Nokia 3250",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
+
 /* Reported by Sumedha Swamy <sumedhaswamy@gmail.com> and
  * Einar Th. Einarsson <einarthered@gmail.com> */
 UNUSUAL_DEV(  0x0421, 0x0444, 0x0100, 0x0100,
@@ -627,18 +634,6 @@ UNUSUAL_DEV(  0x0595, 0x4343, 0x0000, 0x2210,
                 "Digital Camera EX-20 DSC",
                 US_SC_8070, US_PR_DEVICE, NULL, 0 ),
 
-/* The entry was here before I took over, and had US_SC_RBC. It turns
- * out that isn't needed. Additionally, Torsten Eriksson
- * <Torsten.Eriksson@bergianska.se> is able to use his device fine
- * without this entry at all - but I don't suspect that will be true
- * for all users (the protocol is likely needed), so is staying at
- * this time. - Phil Dibowitz <phil@ipom.com>
- */
-UNUSUAL_DEV(  0x059f, 0xa601, 0x0200, 0x0200, 
-                "LaCie",
-                "USB Hard Disk",
-                US_SC_DEVICE, US_PR_CB, NULL, 0 ),
-
 /* Submitted by Joel Bourquard <numlock@freesurf.ch>
  * Some versions of this device need the SubClass and Protocol overrides
  * while others don't.
@@ -1106,7 +1101,15 @@ UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xffff,
                 "Optio S/S4",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
-                
+
+/* This is a virtual windows driver CD, which the zd1211rw driver automatically
+ * converts into a WLAN device. */
+UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,
+                "ZyXEL",
+                "G-220F USB-WLAN Install",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_DEVICE ),
+
 #ifdef CONFIG_USB_STORAGE_ISD200
 UNUSUAL_DEV(  0x0bf6, 0xa001, 0x0100, 0x0110,
                 "ATI",
@@ -1237,6 +1240,16 @@ UNUSUAL_DEV(  0x0ed1, 0x7636, 0x0103, 0x0103,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE | US_FL_GO_SLOW | US_FL_MAX_SECTORS_64),
 
+/* David Kuehling <dvdkhlng@gmx.de>:
+ * for MP3-Player AVOX WSX-300ER (bought in Japan).  Reports lots of SCSI
+ * errors when trying to write.
+ */
+UNUSUAL_DEV(  0x0f19, 0x0105, 0x0100, 0x0100,
+                "C-MEX",
+                "A-VOX",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Michael Stattmann <michael@stattmann.com> */
 UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
                 "Sony Ericsson",
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 5ee19be52f65..8d7bdcb5924d 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -483,7 +483,7 @@ static struct us_unusual_dev *find_unusual(const struct usb_device_id *id)
 }
 
 /* Get the unusual_devs entries and the string descriptors */
-static void get_device_info(struct us_data *us, const struct usb_device_id *id)
+static int get_device_info(struct us_data *us, const struct usb_device_id *id)
 {
         struct usb_device *dev = us->pusb_dev;
         struct usb_interface_descriptor *idesc =
@@ -500,6 +500,11 @@ static void get_device_info(struct us_data *us, const struct usb_device_id *id)
                         unusual_dev->useTransport;
         us->flags = USB_US_ORIG_FLAGS(id->driver_info);
 
+        if (us->flags & US_FL_IGNORE_DEVICE) {
+                printk(KERN_INFO USB_STORAGE "device ignored\n");
+                return -ENODEV;
+        }
+
         /*
          * This flag is only needed when we're in high-speed, so let's
          * disable it if we're in full-speed
@@ -541,6 +546,8 @@ static void get_device_info(struct us_data *us, const struct usb_device_id *id)
                                 msgs[msg],
                                 UTS_RELEASE);
         }
+
+        return 0;
 }
 
 /* Get the transport settings */
@@ -969,7 +976,9 @@ static int storage_probe(struct usb_interface *intf,
          * of the match from the usb_device_id table, so we can find the
          * corresponding entry in the private table.
          */
-        get_device_info(us, id);
+        result = get_device_info(us, id);
+        if (result)
+                goto BadDevice;
 
         /* Get the transport, protocol, and pipe settings */
         result = get_transport(us);
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index c40b9b8b1e7e..702eb933cf88 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -554,7 +554,7 @@ config FB_VESA
 
 config FB_IMAC
         bool "Intel-based Macintosh Framebuffer Support"
-        depends on (FB = y) && X86
+        depends on (FB = y) && X86 && EFI
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index 8b08121b390b..3e827e04a2aa 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1913,9 +1913,6 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         u8 chip_rev;
         u32 dac;
 
-        if (!par->vram_size)    /* may have already been probed */
-                par->vram_size = aty_ld_le32(CONFIG_MEMSIZE) & 0x03FFFFFF;
-
         /* Get the chip revision */
         chip_rev = (aty_ld_le32(CONFIG_CNTL) >> 16) & 0x1F;
 
@@ -2028,9 +2025,6 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
 
         aty128_init_engine(par);
 
-        if (register_framebuffer(info) < 0)
-                return 0;
-
         par->pm_reg = pci_find_capability(pdev, PCI_CAP_ID_PM);
         par->pdev = pdev;
         par->asleep = 0;
@@ -2040,6 +2034,9 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         aty128_bl_init(par);
 #endif
 
+        if (register_framebuffer(info) < 0)
+                return 0;
+
         printk(KERN_INFO "fb%d: %s frame buffer device on %s\n",
                info->node, info->fix.id, video_card);
 
@@ -2089,7 +2086,6 @@ static int __devinit aty128_probe(struct pci_dev *pdev, const struct pci_device_
         par = info->par;
 
         info->pseudo_palette = par->pseudo_palette;
-        info->fix = aty128fb_fix;
 
         /* Virtualize mmio region */
         info->fix.mmio_start = reg_addr;
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index a92a91fef16f..f25d5d648333 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -156,7 +156,7 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 
                         info->fix.visual = FB_VISUAL_TRUECOLOR;
                         info->fix.line_length = info->var.xres_virtual << 1; /* depth=16 */
-        }
+                }
         } else {
                 /* mono */
                 info->fix.visual = FB_VISUAL_MONO10;
@@ -164,20 +164,16 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
         }
 
         info->screen_size = info->fix.line_length * info->var.yres_virtual;
+        info->var.rotate = ((fbdev->panel->control_base&LCD_CONTROL_SM_MASK) \
+                                >> LCD_CONTROL_SM_BIT) * 90;
 
         /* Determine BPP mode and format */
-        fbdev->regs->lcd_control = fbdev->panel->control_base |
-                            ((info->var.rotate/90) << LCD_CONTROL_SM_BIT);
-
-        fbdev->regs->lcd_intenable = 0;
-        fbdev->regs->lcd_intstatus = 0;
-
+        fbdev->regs->lcd_control = fbdev->panel->control_base;
         fbdev->regs->lcd_horztiming = fbdev->panel->horztiming;
-
         fbdev->regs->lcd_verttiming = fbdev->panel->verttiming;
-
         fbdev->regs->lcd_clkcontrol = fbdev->panel->clkcontrol_base;
-
+        fbdev->regs->lcd_intenable = 0;
+        fbdev->regs->lcd_intstatus = 0;
         fbdev->regs->lcd_dmaaddr0 = LCD_DMA_SA_N(fbdev->fb_phys);
 
         if (panel_is_dual(fbdev->panel)) {
@@ -206,6 +202,8 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 
         /* Resume controller */
         fbdev->regs->lcd_control |= LCD_CONTROL_GO;
+        mdelay(10);
+        au1100fb_fb_blank(VESA_NO_BLANKING, info);
 
         return 0;
 }
diff --git a/drivers/video/imacfb.c b/drivers/video/imacfb.c
index ff233b84dec4..b485bece5fc9 100644
--- a/drivers/video/imacfb.c
+++ b/drivers/video/imacfb.c
@@ -18,6 +18,8 @@
 #include <linux/screen_info.h>
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <linux/dmi.h>
+#include <linux/efi.h>
 
 #include <asm/io.h>
 
@@ -28,7 +30,7 @@ typedef enum _MAC_TYPE {
         M_I20,
         M_MINI,
         M_MACBOOK,
-        M_NEW
+        M_UNKNOWN
 } MAC_TYPE;
 
 /* --------------------------------------------------------------------- */
@@ -52,10 +54,36 @@ static struct fb_fix_screeninfo imacfb_fix __initdata = {
 };
 
 static int inverse;
-static int model                = M_NEW;
+static int model                = M_UNKNOWN;
 static int manual_height;
 static int manual_width;
 
+static int set_system(struct dmi_system_id *id)
+{
+        printk(KERN_INFO "imacfb: %s detected - set system to %ld\n",
+                id->ident, (long)id->driver_data);
+
+        model = (long)id->driver_data;
+
+        return 0;
+}
+
+static struct dmi_system_id __initdata dmi_system_table[] = {
+        { set_system, "iMac4,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_BIOS_VERSION,"iMac4,1") }, (void*)M_I17},
+        { set_system, "MacBookPro1,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_BIOS_VERSION,"MacBookPro1,1") }, (void*)M_I17},
+        { set_system, "MacBook1,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"MacBook1,1")}, (void *)M_MACBOOK},
+        { set_system, "Macmini1,1", {
+          DMI_MATCH(DMI_BIOS_VENDOR,"Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"Macmini1,1")}, (void *)M_MINI},
+        {},
+};
+
 #define DEFAULT_FB_MEM  1024*1024*16
 
 /* --------------------------------------------------------------------- */
@@ -149,7 +177,6 @@ static int __init imacfb_probe(struct platform_device *dev)
                 screen_info.lfb_linelength = 1472 * 4;
                 screen_info.lfb_base = 0x80010000;
                 break;
-        case M_NEW:
         case M_I20:
                 screen_info.lfb_width = 1680;
                 screen_info.lfb_height = 1050;
@@ -207,6 +234,10 @@ static int __init imacfb_probe(struct platform_device *dev)
                 size_remap = size_total;
         imacfb_fix.smem_len = size_remap;
 
+#ifndef __i386__
+        screen_info.imacpm_seg = 0;
+#endif
+
         if (!request_mem_region(imacfb_fix.smem_start, size_total, "imacfb")) {
                 printk(KERN_WARNING
                        "imacfb: cannot reserve video memory at 0x%lx\n",
@@ -324,8 +355,16 @@ static int __init imacfb_init(void)
         int ret;
         char *option = NULL;
 
-        /* ignore error return of fb_get_options */
-        fb_get_options("imacfb", &option);
+        if (!efi_enabled)
+                return -ENODEV;
+        if (!dmi_check_system(dmi_system_table))
+                return -ENODEV;
+        if (model == M_UNKNOWN)
+                return -ENODEV;
+
+        if (fb_get_options("imacfb", &option))
+                return -ENODEV;
+
         imacfb_setup(option);
         ret = platform_driver_register(&imacfb_driver);
 
diff --git a/fs/adfs/super.c b/fs/adfs/super.c
index ba1c88af49fe..82011019494c 100644
--- a/fs/adfs/super.c
+++ b/fs/adfs/super.c
@@ -308,7 +308,7 @@ static struct adfs_discmap *adfs_read_map(struct super_block *sb, struct adfs_di
         if (adfs_checkmap(sb, dm))
                 return dm;
 
-        adfs_error(sb, NULL, "map corrupted");
+        adfs_error(sb, "map corrupted");
 
 error_free:
         while (--zone >= 0)
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index fcaeead9696b..50cfca5c7efd 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -512,7 +512,11 @@ befs_utf2nls(struct super_block *sb, const char *in,
         wchar_t uni;
         int unilen, utflen;
         char *result;
-        int maxlen = in_len; /* The utf8->nls conversion can't make more chars */
+        /* The utf8->nls conversion won't make the final nls string bigger
+         * than the utf one, but if the string is pure ascii they'll have the
+         * same width and an extra char is needed to save the additional \0
+         */
+        int maxlen = in_len + 1;
 
         befs_debug(sb, "---> utf2nls()");
 
@@ -588,7 +592,10 @@ befs_nls2utf(struct super_block *sb, const char *in,
         wchar_t uni;
         int unilen, utflen;
         char *result;
-        int maxlen = 3 * in_len;
+        /* There're nls characters that will translate to 3-chars-wide UTF-8
+         * characters, a additional byte is needed to save the final \0
+         * in special cases */
+        int maxlen = (3 * in_len) + 1;
 
         befs_debug(sb, "---> nls2utf()\n");
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 63614ed16336..5c4fcd1dbf59 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -395,14 +395,16 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
         struct fuse_readpages_data data;
         int err;
 
+        err = -EIO;
         if (is_bad_inode(inode))
-                return -EIO;
+                goto clean_pages_up;
 
         data.file = file;
         data.inode = inode;
         data.req = fuse_get_req(fc);
+        err = PTR_ERR(data.req);
         if (IS_ERR(data.req))
-                return PTR_ERR(data.req);
+                goto clean_pages_up;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
         if (!err) {
@@ -412,6 +414,10 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                         fuse_put_request(fc, data.req);
         }
         return err;
+
+clean_pages_up:
+        put_pages_list(pages);
+        return err;
 }
 
 static size_t fuse_send_write(struct fuse_req *req, struct file *file,
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 43e3f566aad6..a223cf4faa9b 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -168,16 +168,15 @@ void jfs_dirty_inode(struct inode *inode)
         set_cflag(COMMIT_Dirty, inode);
 }
 
-static int
-jfs_get_blocks(struct inode *ip, sector_t lblock, unsigned long max_blocks,
-                        struct buffer_head *bh_result, int create)
+int jfs_get_block(struct inode *ip, sector_t lblock,
+                  struct buffer_head *bh_result, int create)
 {
         s64 lblock64 = lblock;
         int rc = 0;
         xad_t xad;
         s64 xaddr;
         int xflag;
-        s32 xlen = max_blocks;
+        s32 xlen = bh_result->b_size >> ip->i_blkbits;
 
         /*
          * Take appropriate lock on inode
@@ -188,7 +187,7 @@ jfs_get_blocks(struct inode *ip, sector_t lblock, unsigned long max_blocks,
                 IREAD_LOCK(ip);
 
         if (((lblock64 << ip->i_sb->s_blocksize_bits) < ip->i_size) &&
-            (!xtLookup(ip, lblock64, max_blocks, &xflag, &xaddr, &xlen, 0)) &&
+            (!xtLookup(ip, lblock64, xlen, &xflag, &xaddr, &xlen, 0)) &&
             xaddr) {
                 if (xflag & XAD_NOTRECORDED) {
                         if (!create)
@@ -255,13 +254,6 @@ jfs_get_blocks(struct inode *ip, sector_t lblock, unsigned long max_blocks,
         return rc;
 }
 
-static int jfs_get_block(struct inode *ip, sector_t lblock,
-                         struct buffer_head *bh_result, int create)
-{
-        return jfs_get_blocks(ip, lblock, bh_result->b_size >> ip->i_blkbits,
-                        bh_result, create);
-}
-
 static int jfs_writepage(struct page *page, struct writeback_control *wbc)
 {
         return nobh_writepage(page, jfs_get_block, wbc);
diff --git a/fs/jfs/jfs_inode.h b/fs/jfs/jfs_inode.h
index b5c7da6190dc..1fc48df670c8 100644
--- a/fs/jfs/jfs_inode.h
+++ b/fs/jfs/jfs_inode.h
@@ -32,6 +32,7 @@ extern void jfs_truncate_nolock(struct inode *, loff_t);
 extern void jfs_free_zero_link(struct inode *);
 extern struct dentry *jfs_get_parent(struct dentry *dentry);
 extern void jfs_set_inode_flags(struct inode *);
+extern int jfs_get_block(struct inode *, sector_t, struct buffer_head *, int);
 
 extern const struct address_space_operations jfs_aops;
 extern struct inode_operations jfs_dir_inode_operations;
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 4f6cfebc82db..143bcd1d5eaa 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -26,6 +26,7 @@
 #include <linux/moduleparam.h>
 #include <linux/kthread.h>
 #include <linux/posix_acl.h>
+#include <linux/buffer_head.h>
 #include <asm/uaccess.h>
 #include <linux/seq_file.h>
 
@@ -298,7 +299,7 @@ static int parse_options(char *options, struct super_block *sb, s64 *newLVSize,
                         break;
                 }
 
-#if defined(CONFIG_QUOTA)
+#ifdef CONFIG_QUOTA
                 case Opt_quota:
                 case Opt_usrquota:
                         *flag |= JFS_USRQUOTA;
@@ -597,7 +598,7 @@ static int jfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
         if (sbi->flag & JFS_NOINTEGRITY)
                 seq_puts(seq, ",nointegrity");
 
-#if defined(CONFIG_QUOTA)
+#ifdef CONFIG_QUOTA
         if (sbi->flag & JFS_USRQUOTA)
                 seq_puts(seq, ",usrquota");
 
@@ -608,6 +609,113 @@ static int jfs_show_options(struct seq_file *seq, struct vfsmount *vfs)
         return 0;
 }
 
+#ifdef CONFIG_QUOTA
+
+/* Read data from quotafile - avoid pagecache and such because we cannot afford
+ * acquiring the locks... As quota files are never truncated and quota code
+ * itself serializes the operations (and noone else should touch the files)
+ * we don't have to be afraid of races */
+static ssize_t jfs_quota_read(struct super_block *sb, int type, char *data,
+                              size_t len, loff_t off)
+{
+        struct inode *inode = sb_dqopt(sb)->files[type];
+        sector_t blk = off >> sb->s_blocksize_bits;
+        int err = 0;
+        int offset = off & (sb->s_blocksize - 1);
+        int tocopy;
+        size_t toread;
+        struct buffer_head tmp_bh;
+        struct buffer_head *bh;
+        loff_t i_size = i_size_read(inode);
+
+        if (off > i_size)
+                return 0;
+        if (off+len > i_size)
+                len = i_size-off;
+        toread = len;
+        while (toread > 0) {
+                tocopy = sb->s_blocksize - offset < toread ?
+                                sb->s_blocksize - offset : toread;
+
+                tmp_bh.b_state = 0;
+                tmp_bh.b_size = 1 << inode->i_blkbits;
+                err = jfs_get_block(inode, blk, &tmp_bh, 0);
+                if (err)
+                        return err;
+                if (!buffer_mapped(&tmp_bh))    /* A hole? */
+                        memset(data, 0, tocopy);
+                else {
+                        bh = sb_bread(sb, tmp_bh.b_blocknr);
+                        if (!bh)
+                                return -EIO;
+                        memcpy(data, bh->b_data+offset, tocopy);
+                        brelse(bh);
+                }
+                offset = 0;
+                toread -= tocopy;
+                data += tocopy;
+                blk++;
+        }
+        return len;
+}
+
+/* Write to quotafile */
+static ssize_t jfs_quota_write(struct super_block *sb, int type,
+                               const char *data, size_t len, loff_t off)
+{
+        struct inode *inode = sb_dqopt(sb)->files[type];
+        sector_t blk = off >> sb->s_blocksize_bits;
+        int err = 0;
+        int offset = off & (sb->s_blocksize - 1);
+        int tocopy;
+        size_t towrite = len;
+        struct buffer_head tmp_bh;
+        struct buffer_head *bh;
+
+        mutex_lock(&inode->i_mutex);
+        while (towrite > 0) {
+                tocopy = sb->s_blocksize - offset < towrite ?
+                                sb->s_blocksize - offset : towrite;
+
+                tmp_bh.b_state = 0;
+                tmp_bh.b_size = 1 << inode->i_blkbits;
+                err = jfs_get_block(inode, blk, &tmp_bh, 1);
+                if (err)
+                        goto out;
+                if (offset || tocopy != sb->s_blocksize)
+                        bh = sb_bread(sb, tmp_bh.b_blocknr);
+                else
+                        bh = sb_getblk(sb, tmp_bh.b_blocknr);
+                if (!bh) {
+                        err = -EIO;
+                        goto out;
+                }
+                lock_buffer(bh);
+                memcpy(bh->b_data+offset, data, tocopy);
+                flush_dcache_page(bh->b_page);
+                set_buffer_uptodate(bh);
+                mark_buffer_dirty(bh);
+                unlock_buffer(bh);
+                brelse(bh);
+                offset = 0;
+                towrite -= tocopy;
+                data += tocopy;
+                blk++;
+        }
+out:
+        if (len == towrite)
+                return err;
+        if (inode->i_size < off+len-towrite)
+                i_size_write(inode, off+len-towrite);
+        inode->i_version++;
+        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        mark_inode_dirty(inode);
+        mutex_unlock(&inode->i_mutex);
+        return len - towrite;
+}
+
+#endif
+
 static struct super_operations jfs_super_operations = {
         .alloc_inode    = jfs_alloc_inode,
         .destroy_inode  = jfs_destroy_inode,
@@ -621,7 +729,11 @@ static struct super_operations jfs_super_operations = {
         .unlockfs       = jfs_unlockfs,
         .statfs         = jfs_statfs,
         .remount_fs     = jfs_remount,
-        .show_options   = jfs_show_options
+        .show_options   = jfs_show_options,
+#ifdef CONFIG_QUOTA
+        .quota_read     = jfs_quota_read,
+        .quota_write    = jfs_quota_write,
+#endif
 };
 
 static struct export_operations jfs_export_operations = {
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index baf5ae513481..c9d419703cf3 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -638,9 +638,6 @@ static void nlmsvc_grant_callback(struct rpc_task *task, void *data)
         if (task->tk_status < 0) {
                 /* RPC error: Re-insert for retransmission */
                 timeout = 10 * HZ;
-        } else if (block->b_done) {
-                /* Block already removed, kill it for real */
-                timeout = 0;
         } else {
                 /* Call was successful, now wait for client callback */
                 timeout = 60 * HZ;
@@ -709,13 +706,10 @@ nlmsvc_retry_blocked(void)
                         break;
                 if (time_after(block->b_when,jiffies))
                         break;
-                dprintk("nlmsvc_retry_blocked(%p, when=%ld, done=%d)\n",
-                        block, block->b_when, block->b_done);
+                dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
+                        block, block->b_when);
                 kref_get(&block->b_count);
-                if (block->b_done)
-                        nlmsvc_unlink_block(block);
-                else
-                        nlmsvc_grant_blocked(block);
+                nlmsvc_grant_blocked(block);
                 nlmsvc_release_block(block);
         }
 
diff --git a/fs/locks.c b/fs/locks.c
index b0b41a64e10b..d7c53392cac1 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1421,8 +1421,9 @@ static int __setlease(struct file *filp, long arg, struct file_lock **flp)
         if (!leases_enable)
                 goto out;
 
-        error = lease_alloc(filp, arg, &fl);
-        if (error)
+        error = -ENOMEM;
+        fl = locks_alloc_lock();
+        if (fl == NULL)
                 goto out;
 
         locks_copy_lock(fl, lease);
@@ -1430,6 +1431,7 @@ static int __setlease(struct file *filp, long arg, struct file_lock **flp)
         locks_insert_lock(before, fl);
 
         *flp = fl;
+        error = 0;
 out:
         return error;
 }
diff --git a/fs/namei.c b/fs/namei.c
index e01070d7bf58..55a131230f94 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -159,7 +159,7 @@ char * getname(const char __user * filename)
 #ifdef CONFIG_AUDITSYSCALL
 void putname(const char *name)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 audit_putname(name);
         else
                 __putname(name);
@@ -1125,7 +1125,7 @@ static int fastcall do_path_lookup(int dfd, const char *name,
         retval = link_path_walk(name, nd);
 out:
         if (likely(retval == 0)) {
-                if (unlikely(current->audit_context && nd && nd->dentry &&
+                if (unlikely(!audit_dummy_context() && nd && nd->dentry &&
                                 nd->dentry->d_inode))
                 audit_inode(name, nd->dentry->d_inode);
         }
@@ -1357,7 +1357,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
                 return -ENOENT;
 
         BUG_ON(victim->d_parent->d_inode != dir);
-        audit_inode_child(victim->d_name.name, victim->d_inode, dir->i_ino);
+        audit_inode_child(victim->d_name.name, victim->d_inode, dir);
 
         error = permission(dir,MAY_WRITE | MAY_EXEC, NULL);
         if (error)
@@ -1659,6 +1659,7 @@ do_last:
          * It already exists.
          */
         mutex_unlock(&dir->d_inode->i_mutex);
+        audit_inode_update(path.dentry->d_inode);
 
         error = -EEXIST;
         if (flag & O_EXCL)
@@ -1669,6 +1670,7 @@ do_last:
                 if (flag & O_NOFOLLOW)
                         goto exit_dput;
         }
+
         error = -ENOENT;
         if (!path.dentry->d_inode)
                 goto exit_dput;
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 19b98ca468eb..86b3169c8cac 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -51,7 +51,7 @@ char *nfs_path(const char *base, const struct dentry *dentry,
                 namelen = dentry->d_name.len;
                 buflen -= namelen + 1;
                 if (buflen < 0)
-                        goto Elong;
+                        goto Elong_unlock;
                 end -= namelen;
                 memcpy(end, dentry->d_name.name, namelen);
                 *--end = '/';
@@ -68,6 +68,8 @@ char *nfs_path(const char *base, const struct dentry *dentry,
         end -= namelen;
         memcpy(end, base, namelen);
         return end;
+Elong_unlock:
+        spin_unlock(&dcache_lock);
 Elong:
         return ERR_PTR(-ENAMETOOLONG);
 }
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 52bf634260a1..65c0c5b32351 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -63,7 +63,7 @@ struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
         return p;
 }
 
-void nfs_readdata_free(struct nfs_read_data *p)
+static void nfs_readdata_free(struct nfs_read_data *p)
 {
         if (p && (p->pagevec != &p->page_array[0]))
                 kfree(p->pagevec);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 86bac6a5008e..50774991f8d5 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -137,7 +137,7 @@ struct nfs_write_data *nfs_writedata_alloc(unsigned int pagecount)
         return p;
 }
 
-void nfs_writedata_free(struct nfs_write_data *p)
+static void nfs_writedata_free(struct nfs_write_data *p)
 {
         if (p && (p->pagevec != &p->page_array[0]))
                 kfree(p->pagevec);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 1b8346dd0572..9503240ef0e5 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -2375,7 +2375,6 @@ leave:
         mlog(0, "returning %d\n", ret);
         return ret;
 }
-EXPORT_SYMBOL_GPL(dlm_migrate_lockres);
 
 int dlm_lock_basts_flushed(struct dlm_ctxt *dlm, struct dlm_lock *lock)
 {
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index b0c3134f4f70..37be4b2e0d4a 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -155,7 +155,7 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
         else
                 status = dlm_get_unlock_actions(dlm, res, lock, lksb, &actions);
 
-        if (status != DLM_NORMAL)
+        if (status != DLM_NORMAL && (status != DLM_CANCELGRANT || !master_node))
                 goto leave;
 
         /* By now this has been masked out of cancel requests. */
@@ -183,8 +183,7 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                 spin_lock(&lock->spinlock);
                 /* if the master told us the lock was already granted,
                  * let the ast handle all of these actions */
-                if (status == DLM_NORMAL &&
-                    lksb->status == DLM_CANCELGRANT) {
+                if (status == DLM_CANCELGRANT) {
                         actions &= ~(DLM_UNLOCK_REMOVE_LOCK|
                                      DLM_UNLOCK_REGRANT_LOCK|
                                      DLM_UNLOCK_CLEAR_CONVERT_TYPE);
@@ -349,14 +348,9 @@ static enum dlm_status dlm_send_remote_unlock_request(struct dlm_ctxt *dlm,
                                         vec, veclen, owner, &status);
         if (tmpret >= 0) {
                 // successfully sent and received
-                if (status == DLM_CANCELGRANT)
-                        ret = DLM_NORMAL;
-                else if (status == DLM_FORWARD) {
+                if (status == DLM_FORWARD)
                         mlog(0, "master was in-progress.  retry\n");
-                        ret = DLM_FORWARD;
-                } else
-                        ret = status;
-                lksb->status = status;
+                ret = status;
         } else {
                 mlog_errno(tmpret);
                 if (dlm_is_host_down(tmpret)) {
@@ -372,7 +366,6 @@ static enum dlm_status dlm_send_remote_unlock_request(struct dlm_ctxt *dlm,
                         /* something bad.  this will BUG in ocfs2 */
                         ret = dlm_err_to_dlm_status(tmpret);
                 }
-                lksb->status = ret;
         }
 
         return ret;
@@ -483,6 +476,10 @@ int dlm_unlock_lock_handler(struct o2net_msg *msg, u32 len, void *data)
 
         /* lock was found on queue */
         lksb = lock->lksb;
+        if (flags & (LKM_VALBLK|LKM_PUT_LVB) &&
+            lock->ml.type != LKM_EXMODE)
+                flags &= ~(LKM_VALBLK|LKM_PUT_LVB);
+
         /* unlockast only called on originating node */
         if (flags & LKM_PUT_LVB) {
                 lksb->flags |= DLM_LKSB_PUT_LVB;
@@ -507,11 +504,8 @@ not_found:
                                "cookie=%u:%llu\n",
                                dlm_get_lock_cookie_node(unlock->cookie),
                                dlm_get_lock_cookie_seq(unlock->cookie));
-        else {
-                /* send the lksb->status back to the other node */
-                status = lksb->status;
+        else
                 dlm_lock_put(lock);
-        }
 
 leave:
         if (res)
@@ -533,26 +527,22 @@ static enum dlm_status dlm_get_cancel_actions(struct dlm_ctxt *dlm,
 
         if (dlm_lock_on_list(&res->blocked, lock)) {
                 /* cancel this outright */
-                lksb->status = DLM_NORMAL;
                 status = DLM_NORMAL;
                 *actions = (DLM_UNLOCK_CALL_AST |
                             DLM_UNLOCK_REMOVE_LOCK);
         } else if (dlm_lock_on_list(&res->converting, lock)) {
                 /* cancel the request, put back on granted */
-                lksb->status = DLM_NORMAL;
                 status = DLM_NORMAL;
                 *actions = (DLM_UNLOCK_CALL_AST |
                             DLM_UNLOCK_REMOVE_LOCK |
                             DLM_UNLOCK_REGRANT_LOCK |
                             DLM_UNLOCK_CLEAR_CONVERT_TYPE);
         } else if (dlm_lock_on_list(&res->granted, lock)) {
-                /* too late, already granted.  DLM_CANCELGRANT */
-                lksb->status = DLM_CANCELGRANT;
-                status = DLM_NORMAL;
+                /* too late, already granted. */
+                status = DLM_CANCELGRANT;
                 *actions = DLM_UNLOCK_CALL_AST;
         } else {
                 mlog(ML_ERROR, "lock to cancel is not on any list!\n");
-                lksb->status = DLM_IVLOCKID;
                 status = DLM_IVLOCKID;
                 *actions = 0;
         }
@@ -569,13 +559,11 @@ static enum dlm_status dlm_get_unlock_actions(struct dlm_ctxt *dlm,
 
         /* unlock request */
         if (!dlm_lock_on_list(&res->granted, lock)) {
-                lksb->status = DLM_DENIED;
                 status = DLM_DENIED;
                 dlm_error(status);
                 *actions = 0;
         } else {
                 /* unlock granted lock */
-                lksb->status = DLM_NORMAL;
                 status = DLM_NORMAL;
                 *actions = (DLM_UNLOCK_FREE_LOCK |
                             DLM_UNLOCK_CALL_AST |
@@ -632,6 +620,8 @@ retry:
 
         spin_lock(&res->spinlock);
         is_master = (res->owner == dlm->node_num);
+        if (flags & LKM_VALBLK && lock->ml.type != LKM_EXMODE)
+                flags &= ~LKM_VALBLK;
         spin_unlock(&res->spinlock);
 
         if (is_master) {
@@ -665,7 +655,7 @@ retry:
         }
 
         if (call_ast) {
-                mlog(0, "calling unlockast(%p, %d)\n", data, lksb->status);
+                mlog(0, "calling unlockast(%p, %d)\n", data, status);
                 if (is_master) {
                         /* it is possible that there is one last bast 
                          * pending.  make sure it is flushed, then
@@ -677,9 +667,12 @@ retry:
                         wait_event(dlm->ast_wq, 
                                    dlm_lock_basts_flushed(dlm, lock));
                 }
-                (*unlockast)(data, lksb->status);
+                (*unlockast)(data, status);
         }
 
+        if (status == DLM_CANCELGRANT)
+                status = DLM_NORMAL;
+
         if (status == DLM_NORMAL) {
                 mlog(0, "kicking the thread\n");
                 dlm_kick_thread(dlm, res);
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index 0d1973ea32b0..1f17a4d08287 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -840,6 +840,12 @@ static int ocfs2_local_alloc_new_window(struct ocfs2_super *osb,
 
         mlog(0, "Allocating %u clusters for a new window.\n",
              ocfs2_local_alloc_window_bits(osb));
+
+        /* Instruct the allocation code to try the most recently used
+         * cluster group. We'll re-record the group used this pass
+         * below. */
+        ac->ac_last_group = osb->la_last_gd;
+
         /* we used the generic suballoc reserve function, but we set
          * everything up nicely, so there's no reason why we can't use
          * the more specific cluster api to claim bits. */
@@ -852,6 +858,8 @@ static int ocfs2_local_alloc_new_window(struct ocfs2_super *osb,
                 goto bail;
         }
 
+        osb->la_last_gd = ac->ac_last_group;
+
         la->la_bm_off = cpu_to_le32(cluster_off);
         alloc->id1.bitmap1.i_total = cpu_to_le32(cluster_count);
         /* just in case... In the future when we find space ourselves,
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index cd4a6f253d13..0462a7f4e21b 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -197,7 +197,6 @@ struct ocfs2_super
         struct ocfs2_node_map recovery_map;
         struct ocfs2_node_map umount_map;
 
-        u32 num_clusters;
         u64 root_blkno;
         u64 system_dir_blkno;
         u64 bitmap_blkno;
@@ -237,6 +236,7 @@ struct ocfs2_super
 
         enum ocfs2_local_alloc_state local_alloc_state;
         struct buffer_head *local_alloc_bh;
+        u64 la_last_gd;
 
         /* Next two fields are for local node slot recovery during
          * mount. */
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 195523090c87..9d91e66f51a9 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -70,12 +70,6 @@ static int ocfs2_block_group_search(struct inode *inode,
                                     struct buffer_head *group_bh,
                                     u32 bits_wanted, u32 min_bits,
                                     u16 *bit_off, u16 *bits_found);
-static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
-                              u32 bits_wanted,
-                              u32 min_bits,
-                              u16 *bit_off,
-                              unsigned int *num_bits,
-                              u64 *bg_blkno);
 static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
                                      struct ocfs2_alloc_context *ac,
                                      u32 bits_wanted,
@@ -85,11 +79,6 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
                                      u64 *bg_blkno);
 static int ocfs2_test_bg_bit_allocatable(struct buffer_head *bg_bh,
                                          int nr);
-static int ocfs2_block_group_find_clear_bits(struct ocfs2_super *osb,
-                                             struct buffer_head *bg_bh,
-                                             unsigned int bits_wanted,
-                                             u16 *bit_off,
-                                             u16 *bits_found);
 static inline int ocfs2_block_group_set_bits(struct ocfs2_journal_handle *handle,
                                              struct inode *alloc_inode,
                                              struct ocfs2_group_desc *bg,
@@ -143,6 +132,64 @@ static u32 ocfs2_bits_per_group(struct ocfs2_chain_list *cl)
         return (u32)le16_to_cpu(cl->cl_cpg) * (u32)le16_to_cpu(cl->cl_bpc);
 }
 
+/* somewhat more expensive than our other checks, so use sparingly. */
+static int ocfs2_check_group_descriptor(struct super_block *sb,
+                                        struct ocfs2_dinode *di,
+                                        struct ocfs2_group_desc *gd)
+{
+        unsigned int max_bits;
+
+        if (!OCFS2_IS_VALID_GROUP_DESC(gd)) {
+                OCFS2_RO_ON_INVALID_GROUP_DESC(sb, gd);
+                return -EIO;
+        }
+
+        if (di->i_blkno != gd->bg_parent_dinode) {
+                ocfs2_error(sb, "Group descriptor # %llu has bad parent "
+                            "pointer (%llu, expected %llu)",
+                            (unsigned long long)le64_to_cpu(gd->bg_blkno),
+                            (unsigned long long)le64_to_cpu(gd->bg_parent_dinode),
+                            (unsigned long long)le64_to_cpu(di->i_blkno));
+                return -EIO;
+        }
+
+        max_bits = le16_to_cpu(di->id2.i_chain.cl_cpg) * le16_to_cpu(di->id2.i_chain.cl_bpc);
+        if (le16_to_cpu(gd->bg_bits) > max_bits) {
+                ocfs2_error(sb, "Group descriptor # %llu has bit count of %u",
+                            (unsigned long long)le64_to_cpu(gd->bg_blkno),
+                            le16_to_cpu(gd->bg_bits));
+                return -EIO;
+        }
+
+        if (le16_to_cpu(gd->bg_chain) >=
+            le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) {
+                ocfs2_error(sb, "Group descriptor # %llu has bad chain %u",
+                            (unsigned long long)le64_to_cpu(gd->bg_blkno),
+                            le16_to_cpu(gd->bg_chain));
+                return -EIO;
+        }
+
+        if (le16_to_cpu(gd->bg_free_bits_count) > le16_to_cpu(gd->bg_bits)) {
+                ocfs2_error(sb, "Group descriptor # %llu has bit count %u but "
+                            "claims that %u are free",
+                            (unsigned long long)le64_to_cpu(gd->bg_blkno),
+                            le16_to_cpu(gd->bg_bits),
+                            le16_to_cpu(gd->bg_free_bits_count));
+                return -EIO;
+        }
+
+        if (le16_to_cpu(gd->bg_bits) > (8 * le16_to_cpu(gd->bg_size))) {
+                ocfs2_error(sb, "Group descriptor # %llu has bit count %u but "
+                            "max bitmap bits of %u",
+                            (unsigned long long)le64_to_cpu(gd->bg_blkno),
+                            le16_to_cpu(gd->bg_bits),
+                            8 * le16_to_cpu(gd->bg_size));
+                return -EIO;
+        }
+
+        return 0;
+}
+
 static int ocfs2_block_group_fill(struct ocfs2_journal_handle *handle,
                                   struct inode *alloc_inode,
                                   struct buffer_head *bg_bh,
@@ -663,6 +710,7 @@ static int ocfs2_test_bg_bit_allocatable(struct buffer_head *bg_bh,
 static int ocfs2_block_group_find_clear_bits(struct ocfs2_super *osb,
                                              struct buffer_head *bg_bh,
                                              unsigned int bits_wanted,
+                                             unsigned int total_bits,
                                              u16 *bit_off,
                                              u16 *bits_found)
 {
@@ -679,10 +727,8 @@ static int ocfs2_block_group_find_clear_bits(struct ocfs2_super *osb,
         found = start = best_offset = best_size = 0;
         bitmap = bg->bg_bitmap;
 
-        while((offset = ocfs2_find_next_zero_bit(bitmap,
-                                                 le16_to_cpu(bg->bg_bits),
-                                                 start)) != -1) {
-                if (offset == le16_to_cpu(bg->bg_bits))
+        while((offset = ocfs2_find_next_zero_bit(bitmap, total_bits, start)) != -1) {
+                if (offset == total_bits)
                         break;
 
                 if (!ocfs2_test_bg_bit_allocatable(bg_bh, offset)) {
@@ -911,14 +957,35 @@ static int ocfs2_cluster_group_search(struct inode *inode,
 {
         int search = -ENOSPC;
         int ret;
-        struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) group_bh->b_data;
+        struct ocfs2_group_desc *gd = (struct ocfs2_group_desc *) group_bh->b_data;
         u16 tmp_off, tmp_found;
+        unsigned int max_bits, gd_cluster_off;
 
         BUG_ON(!ocfs2_is_cluster_bitmap(inode));
 
-        if (bg->bg_free_bits_count) {
+        if (gd->bg_free_bits_count) {
+                max_bits = le16_to_cpu(gd->bg_bits);
+
+                /* Tail groups in cluster bitmaps which aren't cpg
+                 * aligned are prone to partial extention by a failed
+                 * fs resize. If the file system resize never got to
+                 * update the dinode cluster count, then we don't want
+                 * to trust any clusters past it, regardless of what
+                 * the group descriptor says. */
+                gd_cluster_off = ocfs2_blocks_to_clusters(inode->i_sb,
+                                                          le64_to_cpu(gd->bg_blkno));
+                if ((gd_cluster_off + max_bits) >
+                    OCFS2_I(inode)->ip_clusters) {
+                        max_bits = OCFS2_I(inode)->ip_clusters - gd_cluster_off;
+                        mlog(0, "Desc %llu, bg_bits %u, clusters %u, use %u\n",
+                             (unsigned long long)le64_to_cpu(gd->bg_blkno),
+                             le16_to_cpu(gd->bg_bits),
+                             OCFS2_I(inode)->ip_clusters, max_bits);
+                }
+
                 ret = ocfs2_block_group_find_clear_bits(OCFS2_SB(inode->i_sb),
                                                         group_bh, bits_wanted,
+                                                        max_bits,
                                                         &tmp_off, &tmp_found);
                 if (ret)
                         return ret;
@@ -951,17 +1018,109 @@ static int ocfs2_block_group_search(struct inode *inode,
         if (bg->bg_free_bits_count)
                 ret = ocfs2_block_group_find_clear_bits(OCFS2_SB(inode->i_sb),
                                                         group_bh, bits_wanted,
+                                                        le16_to_cpu(bg->bg_bits),
                                                         bit_off, bits_found);
 
         return ret;
 }
 
+static int ocfs2_alloc_dinode_update_counts(struct inode *inode,
+                                       struct ocfs2_journal_handle *handle,
+                                       struct buffer_head *di_bh,
+                                       u32 num_bits,
+                                       u16 chain)
+{
+        int ret;
+        u32 tmp_used;
+        struct ocfs2_dinode *di = (struct ocfs2_dinode *) di_bh->b_data;
+        struct ocfs2_chain_list *cl = (struct ocfs2_chain_list *) &di->id2.i_chain;
+
+        ret = ocfs2_journal_access(handle, inode, di_bh,
+                                   OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret < 0) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        tmp_used = le32_to_cpu(di->id1.bitmap1.i_used);
+        di->id1.bitmap1.i_used = cpu_to_le32(num_bits + tmp_used);
+        le32_add_cpu(&cl->cl_recs[chain].c_free, -num_bits);
+
+        ret = ocfs2_journal_dirty(handle, di_bh);
+        if (ret < 0)
+                mlog_errno(ret);
+
+out:
+        return ret;
+}
+
+static int ocfs2_search_one_group(struct ocfs2_alloc_context *ac,
+                                  u32 bits_wanted,
+                                  u32 min_bits,
+                                  u16 *bit_off,
+                                  unsigned int *num_bits,
+                                  u64 gd_blkno,
+                                  u16 *bits_left)
+{
+        int ret;
+        u16 found;
+        struct buffer_head *group_bh = NULL;
+        struct ocfs2_group_desc *gd;
+        struct inode *alloc_inode = ac->ac_inode;
+        struct ocfs2_journal_handle *handle = ac->ac_handle;
+
+        ret = ocfs2_read_block(OCFS2_SB(alloc_inode->i_sb), gd_blkno,
+                               &group_bh, OCFS2_BH_CACHED, alloc_inode);
+        if (ret < 0) {
+                mlog_errno(ret);
+                return ret;
+        }
+
+        gd = (struct ocfs2_group_desc *) group_bh->b_data;
+        if (!OCFS2_IS_VALID_GROUP_DESC(gd)) {
+                OCFS2_RO_ON_INVALID_GROUP_DESC(alloc_inode->i_sb, gd);
+                ret = -EIO;
+                goto out;
+        }
+
+        ret = ac->ac_group_search(alloc_inode, group_bh, bits_wanted, min_bits,
+                                  bit_off, &found);
+        if (ret < 0) {
+                if (ret != -ENOSPC)
+                        mlog_errno(ret);
+                goto out;
+        }
+
+        *num_bits = found;
+
+        ret = ocfs2_alloc_dinode_update_counts(alloc_inode, handle, ac->ac_bh,
+                                               *num_bits,
+                                               le16_to_cpu(gd->bg_chain));
+        if (ret < 0) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_block_group_set_bits(handle, alloc_inode, gd, group_bh,
+                                         *bit_off, *num_bits);
+        if (ret < 0)
+                mlog_errno(ret);
+
+        *bits_left = le16_to_cpu(gd->bg_free_bits_count);
+
+out:
+        brelse(group_bh);
+
+        return ret;
+}
+
 static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
                               u32 bits_wanted,
                               u32 min_bits,
                               u16 *bit_off,
                               unsigned int *num_bits,
-                              u64 *bg_blkno)
+                              u64 *bg_blkno,
+                              u16 *bits_left)
 {
         int status;
         u16 chain, tmp_bits;
@@ -988,9 +1147,9 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
                 goto bail;
         }
         bg = (struct ocfs2_group_desc *) group_bh->b_data;
-        if (!OCFS2_IS_VALID_GROUP_DESC(bg)) {
-                OCFS2_RO_ON_INVALID_GROUP_DESC(alloc_inode->i_sb, bg);
-                status = -EIO;
+        status = ocfs2_check_group_descriptor(alloc_inode->i_sb, fe, bg);
+        if (status) {
+                mlog_errno(status);
                 goto bail;
         }
 
@@ -1018,9 +1177,9 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
                         goto bail;
                 }
                 bg = (struct ocfs2_group_desc *) group_bh->b_data;
-                if (!OCFS2_IS_VALID_GROUP_DESC(bg)) {
-                        OCFS2_RO_ON_INVALID_GROUP_DESC(alloc_inode->i_sb, bg);
-                        status = -EIO;
+                status = ocfs2_check_group_descriptor(alloc_inode->i_sb, fe, bg);
+                if (status) {
+                        mlog_errno(status);
                         goto bail;
                 }
         }
@@ -1099,6 +1258,7 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac,
              (unsigned long long)fe->i_blkno);
 
         *bg_blkno = le64_to_cpu(bg->bg_blkno);
+        *bits_left = le16_to_cpu(bg->bg_free_bits_count);
 bail:
         if (group_bh)
                 brelse(group_bh);
@@ -1120,6 +1280,8 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
 {
         int status;
         u16 victim, i;
+        u16 bits_left = 0;
+        u64 hint_blkno = ac->ac_last_group;
         struct ocfs2_chain_list *cl;
         struct ocfs2_dinode *fe;
 
@@ -1146,6 +1308,28 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
                 goto bail;
         }
 
+        if (hint_blkno) {
+                /* Attempt to short-circuit the usual search mechanism
+                 * by jumping straight to the most recently used
+                 * allocation group. This helps us mantain some
+                 * contiguousness across allocations. */
+                status = ocfs2_search_one_group(ac, bits_wanted, min_bits,
+                                                bit_off, num_bits,
+                                                hint_blkno, &bits_left);
+                if (!status) {
+                        /* Be careful to update *bg_blkno here as the
+                         * caller is expecting it to be filled in, and
+                         * ocfs2_search_one_group() won't do that for
+                         * us. */
+                        *bg_blkno = hint_blkno;
+                        goto set_hint;
+                }
+                if (status < 0 && status != -ENOSPC) {
+                        mlog_errno(status);
+                        goto bail;
+                }
+        }
+
         cl = (struct ocfs2_chain_list *) &fe->id2.i_chain;
 
         victim = ocfs2_find_victim_chain(cl);
@@ -1153,9 +1337,9 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
         ac->ac_allow_chain_relink = 1;
 
         status = ocfs2_search_chain(ac, bits_wanted, min_bits, bit_off,
-                                    num_bits, bg_blkno);
+                                    num_bits, bg_blkno, &bits_left);
         if (!status)
-                goto bail;
+                goto set_hint;
         if (status < 0 && status != -ENOSPC) {
                 mlog_errno(status);
                 goto bail;
@@ -1177,8 +1361,8 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
 
                 ac->ac_chain = i;
                 status = ocfs2_search_chain(ac, bits_wanted, min_bits,
-                                            bit_off, num_bits,
-                                            bg_blkno);
+                                            bit_off, num_bits, bg_blkno,
+                                            &bits_left);
                 if (!status)
                         break;
                 if (status < 0 && status != -ENOSPC) {
@@ -1186,8 +1370,19 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_super *osb,
                         goto bail;
                 }
         }
-bail:
 
+set_hint:
+        if (status != -ENOSPC) {
+                /* If the next search of this group is not likely to
+                 * yield a suitable extent, then we reset the last
+                 * group hint so as to not waste a disk read */
+                if (bits_left < min_bits)
+                        ac->ac_last_group = 0;
+                else
+                        ac->ac_last_group = *bg_blkno;
+        }
+
+bail:
         mlog_exit(status);
         return status;
 }
@@ -1341,7 +1536,7 @@ int ocfs2_claim_clusters(struct ocfs2_super *osb,
 {
         int status;
         unsigned int bits_wanted = ac->ac_bits_wanted - ac->ac_bits_given;
-        u64 bg_blkno;
+        u64 bg_blkno = 0;
         u16 bg_bit_off;
 
         mlog_entry_void();
@@ -1494,9 +1689,9 @@ static int ocfs2_free_suballoc_bits(struct ocfs2_journal_handle *handle,
         }
 
         group = (struct ocfs2_group_desc *) group_bh->b_data;
-        if (!OCFS2_IS_VALID_GROUP_DESC(group)) {
-                OCFS2_RO_ON_INVALID_GROUP_DESC(alloc_inode->i_sb, group);
-                status = -EIO;
+        status = ocfs2_check_group_descriptor(alloc_inode->i_sb, fe, group);
+        if (status) {
+                mlog_errno(status);
                 goto bail;
         }
         BUG_ON((count + start_bit) > le16_to_cpu(group->bg_bits));
diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h
index a76c82a7ceac..c787838d1052 100644
--- a/fs/ocfs2/suballoc.h
+++ b/fs/ocfs2/suballoc.h
@@ -49,6 +49,8 @@ struct ocfs2_alloc_context {
         u16    ac_chain;
         int    ac_allow_chain_relink;
         group_search_t *ac_group_search;
+
+        u64    ac_last_group;
 };
 
 void ocfs2_free_alloc_context(struct ocfs2_alloc_context *ac);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 382706a67ffd..d17e33e66a1e 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1442,8 +1442,13 @@ static int ocfs2_initialize_super(struct super_block *sb,
 
         osb->bitmap_blkno = OCFS2_I(inode)->ip_blkno;
 
+        /* We don't have a cluster lock on the bitmap here because
+         * we're only interested in static information and the extra
+         * complexity at mount time isn't worht it. Don't pass the
+         * inode in to the read function though as we don't want it to
+         * be put in the cache. */
         status = ocfs2_read_block(osb, osb->bitmap_blkno, &bitmap_bh, 0,
-                                  inode);
+                                  NULL);
         iput(inode);
         if (status < 0) {
                 mlog_errno(status);
@@ -1452,7 +1457,6 @@ static int ocfs2_initialize_super(struct super_block *sb,
 
         di = (struct ocfs2_dinode *) bitmap_bh->b_data;
         osb->bitmap_cpg = le16_to_cpu(di->id2.i_chain.cl_cpg);
-        osb->num_clusters = le32_to_cpu(di->id1.bitmap1.i_total);
         brelse(bitmap_bh);
         mlog(0, "cluster bitmap inode: %llu, clusters per group: %u\n",
              (unsigned long long)osb->bitmap_blkno, osb->bitmap_cpg);
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index f318b58510fd..1627edd50810 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -48,8 +48,8 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
                 return 0;
         }
 
-        reiserfs_write_lock(inode->i_sb);
         mutex_lock(&inode->i_mutex);
+        reiserfs_write_lock(inode->i_sb);
         /* freeing preallocation only involves relogging blocks that
          * are already in the current transaction.  preallocation gets
          * freed at the end of each transaction, so it is impossible for
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 12dfdcfbee3d..52f1e2136546 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -39,14 +39,10 @@ void reiserfs_delete_inode(struct inode *inode)
 
         /* The = 0 happens when we abort creating a new inode for some reason like lack of space.. */
         if (!(inode->i_state & I_NEW) && INODE_PKEY(inode)->k_objectid != 0) {  /* also handles bad_inode case */
-                mutex_lock(&inode->i_mutex);
-
                 reiserfs_delete_xattrs(inode);
 
-                if (journal_begin(&th, inode->i_sb, jbegin_count)) {
-                        mutex_unlock(&inode->i_mutex);
+                if (journal_begin(&th, inode->i_sb, jbegin_count))
                         goto out;
-                }
                 reiserfs_update_inode_transaction(inode);
 
                 err = reiserfs_delete_object(&th, inode);
@@ -57,12 +53,8 @@ void reiserfs_delete_inode(struct inode *inode)
                 if (!err) 
                         DQUOT_FREE_INODE(inode);
 
-                if (journal_end(&th, inode->i_sb, jbegin_count)) {
-                        mutex_unlock(&inode->i_mutex);
+                if (journal_end(&th, inode->i_sb, jbegin_count))
                         goto out;
-                }
-
-                mutex_unlock(&inode->i_mutex);
 
                 /* check return value from reiserfs_delete_object after
                  * ending the transaction
@@ -2348,6 +2340,7 @@ static int reiserfs_write_full_page(struct page *page,
         unsigned long end_index = inode->i_size >> PAGE_CACHE_SHIFT;
         int error = 0;
         unsigned long block;
+        sector_t last_block;
         struct buffer_head *head, *bh;
         int partial = 0;
         int nr = 0;
@@ -2395,10 +2388,19 @@ static int reiserfs_write_full_page(struct page *page,
         }
         bh = head;
         block = page->index << (PAGE_CACHE_SHIFT - s->s_blocksize_bits);
+        last_block = (i_size_read(inode) - 1) >> inode->i_blkbits;
         /* first map all the buffers, logging any direct items we find */
         do {
-                if ((checked || buffer_dirty(bh)) && (!buffer_mapped(bh) ||
-                                                      (buffer_mapped(bh)
+                if (block > last_block) {
+                        /*
+                         * This can happen when the block size is less than
+                         * the page size.  The corresponding bytes in the page
+                         * were zero filled above
+                         */
+                        clear_buffer_dirty(bh);
+                        set_buffer_uptodate(bh);
+                } else if ((checked || buffer_dirty(bh)) &&
+                           (!buffer_mapped(bh) || (buffer_mapped(bh)
                                                        && bh->b_blocknr ==
                                                        0))) {
                         /* not mapped yet, or it points to a direct item, search
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index 745c88100895..a986b5e1e288 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -116,12 +116,12 @@ static int reiserfs_unpack(struct inode *inode, struct file *filp)
         if (REISERFS_I(inode)->i_flags & i_nopack_mask) {
                 return 0;
         }
-        reiserfs_write_lock(inode->i_sb);
 
         /* we need to make sure nobody is changing the file size beneath
          ** us
          */
         mutex_lock(&inode->i_mutex);
+        reiserfs_write_lock(inode->i_sb);
 
         write_from = inode->i_size & (blocksize - 1);
         /* if we are on a block boundary, we are already unpacked.  */
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 3873c672cb4c..33323473e3c4 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -75,6 +75,12 @@ struct inode * udf_new_inode (struct inode *dir, int mode, int * err)
         }
         *err = -ENOSPC;
 
+        UDF_I_UNIQUE(inode) = 0;
+        UDF_I_LENEXTENTS(inode) = 0;
+        UDF_I_NEXT_ALLOC_BLOCK(inode) = 0;
+        UDF_I_NEXT_ALLOC_GOAL(inode) = 0;
+        UDF_I_STRAT4096(inode) = 0;
+
         block = udf_new_block(dir->i_sb, NULL, UDF_I_LOCATION(dir).partitionReferenceNum,
                 start, err);
         if (*err)
@@ -84,11 +90,6 @@ struct inode * udf_new_inode (struct inode *dir, int mode, int * err)
         }
 
         mutex_lock(&sbi->s_alloc_mutex);
-        UDF_I_UNIQUE(inode) = 0;
-        UDF_I_LENEXTENTS(inode) = 0;
-        UDF_I_NEXT_ALLOC_BLOCK(inode) = 0;
-        UDF_I_NEXT_ALLOC_GOAL(inode) = 0;
-        UDF_I_STRAT4096(inode) = 0;
         if (UDF_SB_LVIDBH(sb))
         {
                 struct logicalVolHeaderDesc *lvhd;
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 4df822c881b6..7de172efa084 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -115,6 +115,13 @@ static struct inode *udf_alloc_inode(struct super_block *sb)
         ei = (struct udf_inode_info *)kmem_cache_alloc(udf_inode_cachep, SLAB_KERNEL);
         if (!ei)
                 return NULL;
+
+        ei->i_unique = 0;
+        ei->i_lenExtents = 0;
+        ei->i_next_alloc_block = 0;
+        ei->i_next_alloc_goal = 0;
+        ei->i_strat4096 = 0;
+
         return &ei->vfs_inode;
 }
 
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index b01804baa120..b82381475779 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -248,7 +248,7 @@ static void ufs_change_blocknr(struct inode *inode, unsigned int baseblk,
 
                 if (likely(cur_index != index)) {
                         page = ufs_get_locked_page(mapping, index);
-                        if (IS_ERR(page))
+                        if (!page || IS_ERR(page)) /* it was truncated or EIO */
                                 continue;
                 } else
                         page = locked_page;
diff --git a/fs/ufs/util.c b/fs/ufs/util.c
index 337cf2c46d10..22f820a9b15c 100644
--- a/fs/ufs/util.c
+++ b/fs/ufs/util.c
@@ -251,12 +251,12 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
 {
         struct page *page;
 
-try_again:
         page = find_lock_page(mapping, index);
         if (!page) {
                 page = read_cache_page(mapping, index,
                                        (filler_t*)mapping->a_ops->readpage,
                                        NULL);
+
                 if (IS_ERR(page)) {
                         printk(KERN_ERR "ufs_change_blocknr: "
                                "read_cache_page error: ino %lu, index: %lu\n",
@@ -266,6 +266,14 @@ try_again:
 
                 lock_page(page);
 
+                if (unlikely(page->mapping == NULL)) {
+                        /* Truncate got there first */
+                        unlock_page(page);
+                        page_cache_release(page);
+                        page = NULL;
+                        goto out;
+                }
+
                 if (!PageUptodate(page) || PageError(page)) {
                         unlock_page(page);
                         page_cache_release(page);
@@ -275,15 +283,8 @@ try_again:
                                mapping->host->i_ino, index);
 
                         page = ERR_PTR(-EIO);
-                        goto out;
                 }
         }
-
-        if (unlikely(!page->mapping || !page_has_buffers(page))) {
-                unlock_page(page);
-                page_cache_release(page);
-                goto try_again;/*we really need these buffers*/
-        }
 out:
         return page;
 }
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index eef6763f3a67..d2bbcd882a69 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1835,40 +1835,47 @@ xfs_alloc_fix_freelist(
                                 &agbp)))
                         return error;
                 if (!pag->pagf_init) {
+                        ASSERT(flags & XFS_ALLOC_FLAG_TRYLOCK);
+                        ASSERT(!(flags & XFS_ALLOC_FLAG_FREEING));
                         args->agbp = NULL;
                         return 0;
                 }
         } else
                 agbp = NULL;
 
-        /* If this is a metadata preferred pag and we are user data
+        /*
+         * If this is a metadata preferred pag and we are user data
          * then try somewhere else if we are not being asked to
          * try harder at this point
          */
-        if (pag->pagf_metadata && args->userdata && flags) {
+        if (pag->pagf_metadata && args->userdata &&
+            (flags & XFS_ALLOC_FLAG_TRYLOCK)) {
+                ASSERT(!(flags & XFS_ALLOC_FLAG_FREEING));
                 args->agbp = NULL;
                 return 0;
         }
 
-        need = XFS_MIN_FREELIST_PAG(pag, mp);
-        delta = need > pag->pagf_flcount ? need - pag->pagf_flcount : 0;
-        /*
-         * If it looks like there isn't a long enough extent, or enough
-         * total blocks, reject it.
-         */
-        longest = (pag->pagf_longest > delta) ?
-                (pag->pagf_longest - delta) :
-                (pag->pagf_flcount > 0 || pag->pagf_longest > 0);
-        if (args->minlen + args->alignment + args->minalignslop - 1 > longest ||
-            (!(flags & XFS_ALLOC_FLAG_FREEING) &&
-             (int)(pag->pagf_freeblks + pag->pagf_flcount -
-                   need - args->total) <
-             (int)args->minleft)) {
-                if (agbp)
-                        xfs_trans_brelse(tp, agbp);
-                args->agbp = NULL;
-                return 0;
+        if (!(flags & XFS_ALLOC_FLAG_FREEING)) {
+                need = XFS_MIN_FREELIST_PAG(pag, mp);
+                delta = need > pag->pagf_flcount ? need - pag->pagf_flcount : 0;
+                /*
+                 * If it looks like there isn't a long enough extent, or enough
+                 * total blocks, reject it.
+                 */
+                longest = (pag->pagf_longest > delta) ?
+                        (pag->pagf_longest - delta) :
+                        (pag->pagf_flcount > 0 || pag->pagf_longest > 0);
+                if ((args->minlen + args->alignment + args->minalignslop - 1) >
+                                longest ||
+                    ((int)(pag->pagf_freeblks + pag->pagf_flcount -
+                           need - args->total) < (int)args->minleft)) {
+                        if (agbp)
+                                xfs_trans_brelse(tp, agbp);
+                        args->agbp = NULL;
+                        return 0;
+                }
         }
+
         /*
          * Get the a.g. freespace buffer.
          * Can fail if we're not blocking on locks, and it's held.
@@ -1878,6 +1885,8 @@ xfs_alloc_fix_freelist(
                                 &agbp)))
                         return error;
                 if (agbp == NULL) {
+                        ASSERT(flags & XFS_ALLOC_FLAG_TRYLOCK);
+                        ASSERT(!(flags & XFS_ALLOC_FLAG_FREEING));
                         args->agbp = NULL;
                         return 0;
                 }
@@ -1887,22 +1896,24 @@ xfs_alloc_fix_freelist(
          */
         agf = XFS_BUF_TO_AGF(agbp);
         need = XFS_MIN_FREELIST(agf, mp);
-        delta = need > be32_to_cpu(agf->agf_flcount) ?
-                (need - be32_to_cpu(agf->agf_flcount)) : 0;
         /*
          * If there isn't enough total or single-extent, reject it.
          */
-        longest = be32_to_cpu(agf->agf_longest);
-        longest = (longest > delta) ? (longest - delta) :
-                (be32_to_cpu(agf->agf_flcount) > 0 || longest > 0);
-        if (args->minlen + args->alignment + args->minalignslop - 1 > longest ||
-             (!(flags & XFS_ALLOC_FLAG_FREEING) &&
-                (int)(be32_to_cpu(agf->agf_freeblks) +
-                   be32_to_cpu(agf->agf_flcount) - need - args->total) <
-             (int)args->minleft)) {
-                xfs_trans_brelse(tp, agbp);
-                args->agbp = NULL;
-                return 0;
+        if (!(flags & XFS_ALLOC_FLAG_FREEING)) {
+                delta = need > be32_to_cpu(agf->agf_flcount) ?
+                        (need - be32_to_cpu(agf->agf_flcount)) : 0;
+                longest = be32_to_cpu(agf->agf_longest);
+                longest = (longest > delta) ? (longest - delta) :
+                        (be32_to_cpu(agf->agf_flcount) > 0 || longest > 0);
+                if ((args->minlen + args->alignment + args->minalignslop - 1) >
+                                longest ||
+                    ((int)(be32_to_cpu(agf->agf_freeblks) +
+                     be32_to_cpu(agf->agf_flcount) - need - args->total) <
+                                (int)args->minleft)) {
+                        xfs_trans_brelse(tp, agbp);
+                        args->agbp = NULL;
+                        return 0;
+                }
         }
         /*
          * Make the freelist shorter if it's too long.
@@ -1950,12 +1961,11 @@ xfs_alloc_fix_freelist(
                  * on a completely full ag.
                  */
                 if (targs.agbno == NULLAGBLOCK) {
-                        if (!(flags & XFS_ALLOC_FLAG_FREEING)) {
-                                xfs_trans_brelse(tp, agflbp);
-                                args->agbp = NULL;
-                                return 0;
-                        }
-                        break;
+                        if (flags & XFS_ALLOC_FLAG_FREEING)
+                                break;
+                        xfs_trans_brelse(tp, agflbp);
+                        args->agbp = NULL;
+                        return 0;
                 }
                 /*
                  * Put each allocated block on the list.
@@ -2442,31 +2452,26 @@ xfs_free_extent(
         xfs_fsblock_t   bno,    /* starting block number of extent */
         xfs_extlen_t    len)    /* length of extent */
 {
-#ifdef DEBUG
-        xfs_agf_t       *agf;   /* a.g. freespace header */
-#endif
-        xfs_alloc_arg_t args;   /* allocation argument structure */
+        xfs_alloc_arg_t args;
         int             error;
 
         ASSERT(len != 0);
+        memset(&args, 0, sizeof(xfs_alloc_arg_t));
         args.tp = tp;
         args.mp = tp->t_mountp;
         args.agno = XFS_FSB_TO_AGNO(args.mp, bno);
         ASSERT(args.agno < args.mp->m_sb.sb_agcount);
         args.agbno = XFS_FSB_TO_AGBNO(args.mp, bno);
-        args.alignment = 1;
-        args.minlen = args.minleft = args.minalignslop = 0;
         down_read(&args.mp->m_peraglock);
         args.pag = &args.mp->m_perag[args.agno];
         if ((error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING)))
                 goto error0;
 #ifdef DEBUG
         ASSERT(args.agbp != NULL);
-        agf = XFS_BUF_TO_AGF(args.agbp);
-        ASSERT(args.agbno + len <= be32_to_cpu(agf->agf_length));
+        ASSERT((args.agbno + len) <=
+                be32_to_cpu(XFS_BUF_TO_AGF(args.agbp)->agf_length));
 #endif
-        error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno,
-                len, 0);
+        error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno, len, 0);
 error0:
         up_read(&args.mp->m_peraglock);
         return error;
diff --git a/include/asm-arm/arch-omap/clock.h b/include/asm-arm/arch-omap/clock.h
index 3c4eb9fbe48a..f83003f5287b 100644
--- a/include/asm-arm/arch-omap/clock.h
+++ b/include/asm-arm/arch-omap/clock.h
@@ -48,8 +48,6 @@ struct clk_functions {
 };
 
 extern unsigned int mpurate;
-extern struct list_head clocks;
-extern spinlock_t clockfw_lock;
 
 extern int clk_init(struct clk_functions * custom_clocks);
 extern int clk_register(struct clk *clk);
diff --git a/include/asm-ia64/meminit.h b/include/asm-ia64/meminit.h
index 894bc4d89dc0..6a33a07b3f1d 100644
--- a/include/asm-ia64/meminit.h
+++ b/include/asm-ia64/meminit.h
@@ -56,6 +56,11 @@ extern void efi_memmap_init(unsigned long *, unsigned long *);
   extern struct page *vmem_map;
   extern int find_largest_hole (u64 start, u64 end, void *arg);
   extern int create_mem_map_page_table (u64 start, u64 end, void *arg);
+  extern int vmemmap_find_next_valid_pfn(int, int);
+#else
+static inline int vmemmap_find_next_valid_pfn(int node, int i)
+{
+        return i + 1;
+}
 #endif
-
 #endif /* meminit_h */
diff --git a/include/asm-ia64/pal.h b/include/asm-ia64/pal.h
index 37e52a2836b0..20a8d618c845 100644
--- a/include/asm-ia64/pal.h
+++ b/include/asm-ia64/pal.h
@@ -1433,7 +1433,12 @@ typedef union  pal_version_u {
 } pal_version_u_t;
 
 
-/* Return PAL version information */
+/*
+ * Return PAL version information.  While the documentation states that
+ * PAL_VERSION can be called in either physical or virtual mode, some
+ * implementations only allow physical calls.  We don't call it very often,
+ * so the overhead isn't worth eliminating.
+ */
 static inline s64
 ia64_pal_version (pal_version_u_t *pal_min_version, pal_version_u_t *pal_cur_version)
 {
diff --git a/include/asm-ia64/sn/xpc.h b/include/asm-ia64/sn/xpc.h
index 8406f1ef4caf..b72af597878d 100644
--- a/include/asm-ia64/sn/xpc.h
+++ b/include/asm-ia64/sn/xpc.h
@@ -1124,8 +1124,8 @@ xpc_notify_IRQ_send_local(struct xpc_channel *ch, u8 ipi_flag,
 #define XPC_GET_IPI_FLAGS(_amo, _c)     ((u8) (((_amo) >> ((_c) * 8)) & 0xff))
 #define XPC_SET_IPI_FLAGS(_amo, _c, _f) (_amo) |= ((u64) (_f) << ((_c) * 8))
 
-#define XPC_ANY_OPENCLOSE_IPI_FLAGS_SET(_amo) ((_amo) & 0x0f0f0f0f0f0f0f0f)
-#define XPC_ANY_MSG_IPI_FLAGS_SET(_amo)       ((_amo) & 0x1010101010101010)
+#define XPC_ANY_OPENCLOSE_IPI_FLAGS_SET(_amo) ((_amo) & __IA64_UL_CONST(0x0f0f0f0f0f0f0f0f))
+#define XPC_ANY_MSG_IPI_FLAGS_SET(_amo)       ((_amo) & __IA64_UL_CONST(0x1010101010101010))
 
 
 static inline void
diff --git a/include/asm-ia64/system.h b/include/asm-ia64/system.h
index fc9677bc87ee..384fbf7f2a0f 100644
--- a/include/asm-ia64/system.h
+++ b/include/asm-ia64/system.h
@@ -24,7 +24,7 @@
  * 0xa000000000000000+2*PERCPU_PAGE_SIZE
  * - 0xa000000000000000+3*PERCPU_PAGE_SIZE remain unmapped (guard page)
  */
-#define KERNEL_START             (GATE_ADDR+0x100000000)
+#define KERNEL_START             (GATE_ADDR+__IA64_UL_CONST(0x100000000))
 #define PERCPU_ADDR             (-PERCPU_PAGE_SIZE)
 
 #ifndef __ASSEMBLY__
diff --git a/include/linux/audit.h b/include/linux/audit.h
index b27d7debc5a1..64f9f9e56ac5 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -327,21 +327,31 @@ extern void __audit_getname(const char *name);
 extern void audit_putname(const char *name);
 extern void __audit_inode(const char *name, const struct inode *inode);
 extern void __audit_inode_child(const char *dname, const struct inode *inode,
-                                unsigned long pino);
+                                const struct inode *parent);
+extern void __audit_inode_update(const struct inode *inode);
+static inline int audit_dummy_context(void)
+{
+        void *p = current->audit_context;
+        return !p || *(int *)p;
+}
 static inline void audit_getname(const char *name)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 __audit_getname(name);
 }
 static inline void audit_inode(const char *name, const struct inode *inode) {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 __audit_inode(name, inode);
 }
 static inline void audit_inode_child(const char *dname, 
-                                     const struct inode *inode, 
-                                     unsigned long pino) {
-        if (unlikely(current->audit_context))
-                __audit_inode_child(dname, inode, pino);
+                                     const struct inode *inode,
+                                     const struct inode *parent) {
+        if (unlikely(!audit_dummy_context()))
+                __audit_inode_child(dname, inode, parent);
+}
+static inline void audit_inode_update(const struct inode *inode) {
+        if (unlikely(!audit_dummy_context()))
+                __audit_inode_update(inode);
 }
 
                                 /* Private API (for audit.c only) */
@@ -365,57 +375,61 @@ extern int __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat);
 
 static inline int audit_ipc_obj(struct kern_ipc_perm *ipcp)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_ipc_obj(ipcp);
         return 0;
 }
 static inline int audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, mode_t mode)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_ipc_set_perm(qbytes, uid, gid, mode);
         return 0;
 }
 static inline int audit_mq_open(int oflag, mode_t mode, struct mq_attr __user *u_attr)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_mq_open(oflag, mode, u_attr);
         return 0;
 }
 static inline int audit_mq_timedsend(mqd_t mqdes, size_t msg_len, unsigned int msg_prio, const struct timespec __user *u_abs_timeout)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_mq_timedsend(mqdes, msg_len, msg_prio, u_abs_timeout);
         return 0;
 }
 static inline int audit_mq_timedreceive(mqd_t mqdes, size_t msg_len, unsigned int __user *u_msg_prio, const struct timespec __user *u_abs_timeout)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_mq_timedreceive(mqdes, msg_len, u_msg_prio, u_abs_timeout);
         return 0;
 }
 static inline int audit_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_mq_notify(mqdes, u_notification);
         return 0;
 }
 static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
 {
-        if (unlikely(current->audit_context))
+        if (unlikely(!audit_dummy_context()))
                 return __audit_mq_getsetattr(mqdes, mqstat);
         return 0;
 }
+extern int audit_n_rules;
 #else
 #define audit_alloc(t) ({ 0; })
 #define audit_free(t) do { ; } while (0)
 #define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0)
 #define audit_syscall_exit(f,r) do { ; } while (0)
+#define audit_dummy_context() 1
 #define audit_getname(n) do { ; } while (0)
 #define audit_putname(n) do { ; } while (0)
 #define __audit_inode(n,i) do { ; } while (0)
 #define __audit_inode_child(d,i,p) do { ; } while (0)
+#define __audit_inode_update(i) do { ; } while (0)
 #define audit_inode(n,i) do { ; } while (0)
 #define audit_inode_child(d,i,p) do { ; } while (0)
+#define audit_inode_update(i) do { ; } while (0)
 #define auditsc_get_stamp(c,t,s) do { BUG(); } while (0)
 #define audit_get_loginuid(c) ({ -1; })
 #define audit_ipc_obj(i) ({ 0; })
@@ -430,6 +444,7 @@ static inline int audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat)
 #define audit_mq_timedreceive(d,l,p,t) ({ 0; })
 #define audit_mq_notify(d,n) ({ 0; })
 #define audit_mq_getsetattr(d,s) ({ 0; })
+#define audit_n_rules 0
 #endif
 
 #ifdef CONFIG_AUDIT
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index 6a7047851e48..88dafa246d87 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -1,6 +1,8 @@
 #ifndef __LINUX_DEBUG_LOCKING_H
 #define __LINUX_DEBUG_LOCKING_H
 
+struct task_struct;
+
 extern int debug_locks;
 extern int debug_locks_silent;
 
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 4ad0673b1995..2f335e966011 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -1,7 +1,6 @@
 #ifndef _LINUX_FB_H
 #define _LINUX_FB_H
 
-#include <linux/backlight.h>
 #include <asm/types.h>
 
 /* Definitions of frame buffers                                         */
@@ -381,6 +380,7 @@ struct fb_cursor {
 #include <linux/workqueue.h>
 #include <linux/notifier.h>
 #include <linux/list.h>
+#include <linux/backlight.h>
 #include <asm/io.h>
 
 struct vm_area_struct;
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index cc5dec70c32c..d4f219ffaa5d 100644
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -67,7 +67,7 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
         if (source) {
                 inotify_inode_queue_event(source, IN_MOVE_SELF, 0, NULL, NULL);
         }
-        audit_inode_child(new_name, source, new_dir->i_ino);
+        audit_inode_child(new_name, source, new_dir);
 }
 
 /*
@@ -98,7 +98,7 @@ static inline void fsnotify_create(struct inode *inode, struct dentry *dentry)
         inode_dir_notify(inode, DN_CREATE);
         inotify_inode_queue_event(inode, IN_CREATE, 0, dentry->d_name.name,
                                   dentry->d_inode);
-        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode->i_ino);
+        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode);
 }
 
 /*
@@ -109,7 +109,7 @@ static inline void fsnotify_mkdir(struct inode *inode, struct dentry *dentry)
         inode_dir_notify(inode, DN_CREATE);
         inotify_inode_queue_event(inode, IN_CREATE | IN_ISDIR, 0, 
                                   dentry->d_name.name, dentry->d_inode);
-        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode->i_ino);
+        audit_inode_child(dentry->d_name.name, dentry->d_inode, inode);
 }
 
 /*
diff --git a/include/linux/input.h b/include/linux/input.h
index 56f1e0e1e598..b3253ab72ff7 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -893,7 +893,6 @@ struct input_dev {
 
         int (*open)(struct input_dev *dev);
         void (*close)(struct input_dev *dev);
-        int (*accept)(struct input_dev *dev, struct file *file);
         int (*flush)(struct input_dev *dev, struct file *file);
         int (*event)(struct input_dev *dev, unsigned int type, unsigned int code, int value);
         int (*upload_effect)(struct input_dev *dev, struct ff_effect *effect);
@@ -961,6 +960,26 @@ struct input_dev {
 
 struct input_handle;
 
+/**
+ * struct input_handler - implements one of interfaces for input devices
+ * @private: driver-specific data
+ * @event: event handler
+ * @connect: called when attaching a handler to an input device
+ * @disconnect: disconnects a handler from input device
+ * @start: starts handler for given handle. This function is called by
+ *      input core right after connect() method and also when a process
+ *      that "grabbed" a device releases it
+ * @fops: file operations this driver implements
+ * @minor: beginning of range of 32 minors for devices this driver
+ *      can provide
+ * @name: name of the handler, to be shown in /proc/bus/input/handlers
+ * @id_table: pointer to a table of input_device_ids this driver can
+ *      handle
+ * @blacklist: prointer to a table of input_device_ids this driver should
+ *      ignore even if they match @id_table
+ * @h_list: list of input handles associated with the handler
+ * @node: for placing the driver onto input_handler_list
+ */
 struct input_handler {
 
         void *private;
@@ -968,6 +987,7 @@ struct input_handler {
         void (*event)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
         struct input_handle* (*connect)(struct input_handler *handler, struct input_dev *dev, struct input_device_id *id);
         void (*disconnect)(struct input_handle *handle);
+        void (*start)(struct input_handle *handle);
 
         const struct file_operations *fops;
         int minor;
@@ -1030,10 +1050,10 @@ void input_release_device(struct input_handle *);
 int input_open_device(struct input_handle *);
 void input_close_device(struct input_handle *);
 
-int input_accept_process(struct input_handle *handle, struct file *file);
 int input_flush_device(struct input_handle* handle, struct file* file);
 
 void input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value);
+void input_inject_event(struct input_handle *handle, unsigned int type, unsigned int code, int value);
 
 static inline void input_report_key(struct input_dev *dev, unsigned int code, int value)
 {
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 181c69cad4e3..851aa1bcfc1a 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -210,6 +210,7 @@ extern enum system_states {
 extern void dump_stack(void);
 
 #ifdef DEBUG
+/* If you are writing a driver, please use dev_dbg instead */
 #define pr_debug(fmt,arg...) \
         printk(KERN_DEBUG fmt,##arg)
 #else
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index 0503b2ed8bae..2d229327959e 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -46,8 +46,6 @@ enum kobject_action {
         KOBJ_UMOUNT     = (__force kobject_action_t) 0x05,      /* umount event for block devices (broken) */
         KOBJ_OFFLINE    = (__force kobject_action_t) 0x06,      /* device offline */
         KOBJ_ONLINE     = (__force kobject_action_t) 0x07,      /* device online */
-        KOBJ_UNDOCK     = (__force kobject_action_t) 0x08,      /* undocking */
-        KOBJ_DOCK       = (__force kobject_action_t) 0x09,      /* dock */
 };
 
 struct kobject {
diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
index aa4fe905bb4d..0d92c468d55a 100644
--- a/include/linux/lockd/lockd.h
+++ b/include/linux/lockd/lockd.h
@@ -123,7 +123,6 @@ struct nlm_block {
         unsigned int            b_id;           /* block id */
         unsigned char           b_queued;       /* re-queued */
         unsigned char           b_granted;      /* VFS granted lock */
-        unsigned char           b_done;         /* callback complete */
         struct nlm_file *       b_file;         /* file in question */
 };
 
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 990957e0929f..f0b135cd86da 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -336,6 +336,7 @@ static inline void init_page_count(struct page *page)
 }
 
 void put_page(struct page *page);
+void put_pages_list(struct list_head *pages);
 
 void split_page(struct page *page, unsigned int order);
 
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 31f02ba036ce..10c13dc4665b 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -6,7 +6,6 @@
 
 #include <linux/netfilter.h>
 #if defined(__KERNEL__) && defined(CONFIG_BRIDGE_NETFILTER)
-#include <asm/atomic.h>
 #include <linux/if_ether.h>
 #endif
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 55ea853d57bc..247434553ae8 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -476,10 +476,9 @@ static inline int nfs_wb_page(struct inode *inode, struct page* page)
 }
 
 /*
- * Allocate and free nfs_write_data structures
+ * Allocate nfs_write_data structures
  */
 extern struct nfs_write_data *nfs_writedata_alloc(unsigned int pagecount);
-extern void nfs_writedata_free(struct nfs_write_data *p);
 
 /*
  * linux/fs/nfs/read.c
@@ -491,10 +490,9 @@ extern int  nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
 extern void nfs_readdata_release(void *data);
 
 /*
- * Allocate and free nfs_read_data structures
+ * Allocate nfs_read_data structures
  */
 extern struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount);
-extern void nfs_readdata_free(struct nfs_read_data *p);
 
 /*
  * linux/fs/nfs3proc.c
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index c09396d2c77b..4eae06b08cf2 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2142,6 +2142,7 @@
 #define PCI_DEVICE_ID_INTEL_82820_UP_HB 0x2501
 #define PCI_DEVICE_ID_INTEL_82850_HB    0x2530
 #define PCI_DEVICE_ID_INTEL_82860_HB    0x2531
+#define PCI_DEVICE_ID_INTEL_E7501_MCH   0x254c
 #define PCI_DEVICE_ID_INTEL_82845G_HB   0x2560
 #define PCI_DEVICE_ID_INTEL_82845G_IG   0x2562
 #define PCI_DEVICE_ID_INTEL_82865_HB    0x2570
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6afa72e080cb..6674fc1e51bf 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1558,6 +1558,14 @@ static inline void freeze(struct task_struct *p)
 }
 
 /*
+ * Sometimes we may need to cancel the previous 'freeze' request
+ */
+static inline void do_not_freeze(struct task_struct *p)
+{
+        p->flags &= ~PF_FREEZE;
+}
+
+/*
  * Wake up a frozen process
  */
 static inline int thaw_process(struct task_struct *p)
diff --git a/include/linux/security.h b/include/linux/security.h
index f75303831d09..6bc2aad494ff 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1109,6 +1109,16 @@ struct swap_info_struct;
  *      @name contains the name of the security module being unstacked.
  *      @ops contains a pointer to the struct security_operations of the module to unstack.
  * 
+ * @secid_to_secctx:
+ *      Convert secid to security context.
+ *      @secid contains the security ID.
+ *      @secdata contains the pointer that stores the converted security context.
+ *
+ * @release_secctx:
+ *      Release the security context.
+ *      @secdata contains the security context.
+ *      @seclen contains the length of the security context.
+ *
  * This is the main security structure.
  */
 struct security_operations {
@@ -1289,6 +1299,8 @@ struct security_operations {
 
         int (*getprocattr)(struct task_struct *p, char *name, void *value, size_t size);
         int (*setprocattr)(struct task_struct *p, char *name, void *value, size_t size);
+        int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen);
+        void (*release_secctx)(char *secdata, u32 seclen);
 
 #ifdef CONFIG_SECURITY_NETWORK
         int (*unix_stream_connect) (struct socket * sock,
@@ -1317,7 +1329,7 @@ struct security_operations {
         int (*socket_shutdown) (struct socket * sock, int how);
         int (*socket_sock_rcv_skb) (struct sock * sk, struct sk_buff * skb);
         int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);
-        int (*socket_getpeersec_dgram) (struct sk_buff *skb, char **secdata, u32 *seclen);
+        int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);
         int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
         void (*sk_free_security) (struct sock *sk);
         unsigned int (*sk_getsid) (struct sock *sk, struct flowi *fl, u8 dir);
@@ -2059,6 +2071,16 @@ static inline int security_netlink_recv(struct sk_buff * skb, int cap)
         return security_ops->netlink_recv(skb, cap);
 }
 
+static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+{
+        return security_ops->secid_to_secctx(secid, secdata, seclen);
+}
+
+static inline void security_release_secctx(char *secdata, u32 seclen)
+{
+        return security_ops->release_secctx(secdata, seclen);
+}
+
 /* prototypes */
 extern int security_init        (void);
 extern int register_security    (struct security_operations *ops);
@@ -2725,6 +2747,14 @@ static inline void securityfs_remove(struct dentry *dentry)
 {
 }
 
+static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline void security_release_secctx(char *secdata, u32 seclen)
+{
+}
 #endif  /* CONFIG_SECURITY */
 
 #ifdef CONFIG_SECURITY_NETWORK
@@ -2840,10 +2870,9 @@ static inline int security_socket_getpeersec_stream(struct socket *sock, char __
         return security_ops->socket_getpeersec_stream(sock, optval, optlen, len);
 }
 
-static inline int security_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata,
-                                                   u32 *seclen)
+static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
 {
-        return security_ops->socket_getpeersec_dgram(skb, secdata, seclen);
+        return security_ops->socket_getpeersec_dgram(sock, skb, secid);
 }
 
 static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
@@ -2968,8 +2997,7 @@ static inline int security_socket_getpeersec_stream(struct socket *sock, char __
         return -ENOPROTOOPT;
 }
 
-static inline int security_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata,
-                                                   u32 *seclen)
+static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
 {
         return -ENOPROTOOPT;
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 4307e764ef0a..755e9cddac47 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -604,12 +604,17 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_)
         return list_->qlen;
 }
 
-extern struct lock_class_key skb_queue_lock_key;
-
+/*
+ * This function creates a split out lock class for each invocation;
+ * this is needed for now since a whole lot of users of the skb-queue
+ * infrastructure in drivers have different locking usage (in hardirq)
+ * than the networking core (in softirq only). In the long run either the
+ * network layer or drivers should need annotation to consolidate the
+ * main types of usage into 3 classes.
+ */
 static inline void skb_queue_head_init(struct sk_buff_head *list)
 {
         spin_lock_init(&list->lock);
-        lockdep_set_class(&list->lock, &skb_queue_lock_key);
         list->prev = list->next = (struct sk_buff *)list;
         list->qlen = 0;
 }
@@ -1035,6 +1040,21 @@ static inline int pskb_trim(struct sk_buff *skb, unsigned int len)
 }
 
 /**
+ *      pskb_trim_unique - remove end from a paged unique (not cloned) buffer
+ *      @skb: buffer to alter
+ *      @len: new length
+ *
+ *      This is identical to pskb_trim except that the caller knows that
+ *      the skb is not cloned so we should never get an error due to out-
+ *      of-memory.
+ */
+static inline void pskb_trim_unique(struct sk_buff *skb, unsigned int len)
+{
+        int err = pskb_trim(skb, len);
+        BUG_ON(err);
+}
+
+/**
  *      skb_orphan - orphan a buffer
  *      @skb: buffer to orphan
  *
@@ -1076,7 +1096,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list)
  *      the headroom they think they need without accounting for the
  *      built in space. The built in space is used for optimisations.
  *
- *      %NULL is returned in there is no free memory.
+ *      %NULL is returned if there is no free memory.
  */
 static inline struct sk_buff *__dev_alloc_skb(unsigned int length,
                                               gfp_t gfp_mask)
@@ -1096,7 +1116,7 @@ static inline struct sk_buff *__dev_alloc_skb(unsigned int length,
  *      the headroom they think they need without accounting for the
  *      built in space. The built in space is used for optimisations.
  *
- *      %NULL is returned in there is no free memory. Although this function
+ *      %NULL is returned if there is no free memory. Although this function
  *      allocates memory it can be called from an interrupt.
  */
 static inline struct sk_buff *dev_alloc_skb(unsigned int length)
@@ -1104,6 +1124,28 @@ static inline struct sk_buff *dev_alloc_skb(unsigned int length)
         return __dev_alloc_skb(length, GFP_ATOMIC);
 }
 
+extern struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
+                unsigned int length, gfp_t gfp_mask);
+
+/**
+ *      netdev_alloc_skb - allocate an skbuff for rx on a specific device
+ *      @dev: network device to receive on
+ *      @length: length to allocate
+ *
+ *      Allocate a new &sk_buff and assign it a usage count of one. The
+ *      buffer has unspecified headroom built in. Users should allocate
+ *      the headroom they think they need without accounting for the
+ *      built in space. The built in space is used for optimisations.
+ *
+ *      %NULL is returned if there is no free memory. Although this function
+ *      allocates memory it can be called from an interrupt.
+ */
+static inline struct sk_buff *netdev_alloc_skb(struct net_device *dev,
+                unsigned int length)
+{
+        return __netdev_alloc_skb(dev, length, GFP_ATOMIC);
+}
+
 /**
  *      skb_cow - copy header of skb when it is required
  *      @skb: buffer to cow
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index e8bbe8118de8..840e47a4ccc5 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -229,7 +229,7 @@ int			xprt_reserve_xprt(struct rpc_task *task);
 int                     xprt_reserve_xprt_cong(struct rpc_task *task);
 int                     xprt_prepare_transmit(struct rpc_task *task);
 void                    xprt_transmit(struct rpc_task *task);
-void                    xprt_abort_transmit(struct rpc_task *task);
+void                    xprt_end_transmit(struct rpc_task *task);
 int                     xprt_adjust_timeout(struct rpc_rqst *req);
 void                    xprt_release_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
 void                    xprt_release_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
diff --git a/include/linux/usb.h b/include/linux/usb.h
index c944e8f06a4a..d2bd0c8e0154 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -103,8 +103,7 @@ enum usb_interface_condition {
  * @condition: binding state of the interface: not bound, binding
  *      (in probe()), bound to a driver, or unbinding (in disconnect())
  * @dev: driver model's view of this device
- * @usb_dev: if an interface is bound to the USB major, this will point
- *      to the sysfs representation for that device.
+ * @class_dev: driver model's class view of this device.
  *
  * USB device drivers attach to interfaces on a physical device.  Each
  * interface encapsulates a single high level function, such as feeding
@@ -144,7 +143,7 @@ struct usb_interface {
                                          * bound to */
         enum usb_interface_condition condition;         /* state of binding */
         struct device dev;              /* interface specific device info */
-        struct device *usb_dev;         /* pointer to the usb class's device, if any */
+        struct class_device *class_dev;
 };
 #define to_usb_interface(d) container_of(d, struct usb_interface, dev)
 #define interface_to_usbdev(intf) \
@@ -361,7 +360,7 @@ struct usb_device {
         char *serial;                   /* iSerialNumber string, if present */
 
         struct list_head filelist;
-        struct device *usbfs_dev;
+        struct class_device *class_dev;
         struct dentry *usbfs_dentry;    /* usbfs dentry entry for the device */
 
         /*
diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
index f38f43f20fae..e7fc5fed5b98 100644
--- a/include/linux/usb_usual.h
+++ b/include/linux/usb_usual.h
@@ -44,7 +44,9 @@
         US_FLAG(NO_WP_DETECT,   0x00000200)                     \
                 /* Don't check for write-protect */             \
         US_FLAG(MAX_SECTORS_64, 0x00000400)                     \
-                /* Sets max_sectors to 64    */
+                /* Sets max_sectors to 64    */                 \
+        US_FLAG(IGNORE_DEVICE,  0x00000800)                     \
+                /* Don't claim device */
 
 #define US_FLAG(name, value)    US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };
diff --git a/include/linux/videodev.h b/include/linux/videodev.h
index 41bc7e9603cd..518c7a32175e 100644
--- a/include/linux/videodev.h
+++ b/include/linux/videodev.h
@@ -12,10 +12,11 @@
 #ifndef __LINUX_VIDEODEV_H
 #define __LINUX_VIDEODEV_H
 
-#define HAVE_V4L1 1
-
 #include <linux/videodev2.h>
 
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
+#define HAVE_V4L1 1
+
 struct video_capability
 {
         char name[32];
@@ -336,6 +337,8 @@ struct video_code
 #define VID_HARDWARE_SN9C102    38
 #define VID_HARDWARE_ARV        39
 
+#endif /* CONFIG_VIDEO_V4L1_COMPAT */
+
 #endif /* __LINUX_VIDEODEV_H */
 
 /*
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index a62673dad76e..b7146956a929 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -716,7 +716,7 @@ struct v4l2_ext_control
                 __s64 value64;
                 void *reserved;
         };
-};
+} __attribute__ ((packed));
 
 struct v4l2_ext_controls
 {
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 1ab806c47514..2d9b1b60798a 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -41,23 +41,23 @@ DECLARE_PER_CPU(struct vm_event_state, vm_event_states);
 
 static inline void __count_vm_event(enum vm_event_item item)
 {
-        __get_cpu_var(vm_event_states.event[item])++;
+        __get_cpu_var(vm_event_states).event[item]++;
 }
 
 static inline void count_vm_event(enum vm_event_item item)
 {
-        get_cpu_var(vm_event_states.event[item])++;
+        get_cpu_var(vm_event_states).event[item]++;
         put_cpu();
 }
 
 static inline void __count_vm_events(enum vm_event_item item, long delta)
 {
-        __get_cpu_var(vm_event_states.event[item]) += delta;
+        __get_cpu_var(vm_event_states).event[item] += delta;
 }
 
 static inline void count_vm_events(enum vm_event_item item, long delta)
 {
-        get_cpu_var(vm_event_states.event[item]) += delta;
+        get_cpu_var(vm_event_states).event[item] += delta;
         put_cpu();
 }
 
diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
index 62dae1a8c441..600d61d7d2ab 100644
--- a/include/media/v4l2-dev.h
+++ b/include/media/v4l2-dev.h
@@ -16,7 +16,7 @@
 #include <linux/device.h>
 #include <linux/mutex.h>
 #include <linux/compiler.h> /* need __user */
-#ifdef CONFIG_VIDEO_V4L1
+#ifdef CONFIG_VIDEO_V4L1_COMPAT
 #include <linux/videodev.h>
 #else
 #include <linux/videodev2.h>
@@ -341,11 +341,14 @@ extern int video_usercopy(struct inode *inode, struct file *file,
 extern struct video_device* video_devdata(struct file*);
 
 #define to_video_device(cd) container_of(cd, struct video_device, class_dev)
-static inline void
+static inline int
 video_device_create_file(struct video_device *vfd,
                          struct class_device_attribute *attr)
 {
-        class_device_create_file(&vfd->class_dev, attr);
+        int ret = class_device_create_file(&vfd->class_dev, attr);
+        if (ret < 0)
+                printk(KERN_WARNING "%s error: %d\n", __FUNCTION__, ret);
+        return ret;
 }
 static inline void
 video_device_remove_file(struct video_device *vfd,
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 2fec827c8801..c0398f5a8cb9 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -54,15 +54,13 @@ struct unix_skb_parms {
         struct ucred            creds;          /* Skb credentials      */
         struct scm_fp_list      *fp;            /* Passed files         */
 #ifdef CONFIG_SECURITY_NETWORK
-        char                    *secdata;       /* Security context     */
-        u32                     seclen;         /* Security length      */
+        u32                     secid;          /* Security ID          */
 #endif
 };
 
 #define UNIXCB(skb)     (*(struct unix_skb_parms*)&((skb)->cb))
 #define UNIXCREDS(skb)  (&UNIXCB((skb)).creds)
-#define UNIXSECDATA(skb)        (&UNIXCB((skb)).secdata)
-#define UNIXSECLEN(skb)         (&UNIXCB((skb)).seclen)
+#define UNIXSID(skb)    (&UNIXCB((skb)).secid)
 
 #define unix_state_rlock(s)     spin_lock(&unix_sk(s)->lock)
 #define unix_state_runlock(s)   spin_unlock(&unix_sk(s)->lock)
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index ab29dafb1a6a..96b0e66406ec 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -139,16 +139,22 @@ extern rwlock_t rt6_lock;
 /*
  *      Store a destination cache entry in a socket
  */
-static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
-                                     struct in6_addr *daddr)
+static inline void __ip6_dst_store(struct sock *sk, struct dst_entry *dst,
+                                   struct in6_addr *daddr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct rt6_info *rt = (struct rt6_info *) dst;
 
-        write_lock(&sk->sk_dst_lock);
         sk_setup_caps(sk, dst);
         np->daddr_cache = daddr;
         np->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+}
+
+static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
+                                 struct in6_addr *daddr)
+{
+        write_lock(&sk->sk_dst_lock);
+        __ip6_dst_store(sk, dst, daddr);
         write_unlock(&sk->sk_dst_lock);
 }
 
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index a8fdf7970b37..ece7e8a84ffd 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -468,6 +468,9 @@ extern void			ip6_flush_pending_frames(struct sock *sk);
 extern int                      ip6_dst_lookup(struct sock *sk,
                                                struct dst_entry **dst,
                                                struct flowi *fl);
+extern int                      ip6_sk_dst_lookup(struct sock *sk,
+                                                  struct dst_entry **dst,
+                                                  struct flowi *fl);
 
 /*
  *      skb processing functions
diff --git a/include/net/netdma.h b/include/net/netdma.h
index ceae5ee85c04..7f53cd1d8b1e 100644
--- a/include/net/netdma.h
+++ b/include/net/netdma.h
@@ -29,7 +29,7 @@ static inline struct dma_chan *get_softnet_dma(void)
 {
         struct dma_chan *chan;
         rcu_read_lock();
-        chan = rcu_dereference(__get_cpu_var(softnet_data.net_dma));
+        chan = rcu_dereference(__get_cpu_var(softnet_data).net_dma);
         if (chan)
                 dma_chan_get(chan);
         rcu_read_unlock();
diff --git a/include/net/netevent.h b/include/net/netevent.h
new file mode 100644
index 000000000000..e5d216241423
--- /dev/null
+++ b/include/net/netevent.h
@@ -0,0 +1,33 @@
+#ifndef _NET_EVENT_H
+#define _NET_EVENT_H
+
+/*
+ *      Generic netevent notifiers
+ *
+ *      Authors:
+ *      Tom Tucker              <tom@opengridcomputing.com>
+ *      Steve Wise              <swise@opengridcomputing.com>
+ *
+ *      Changes:
+ */
+#ifdef __KERNEL__
+
+#include <net/dst.h>
+
+struct netevent_redirect {
+        struct dst_entry *old;
+        struct dst_entry *new;
+};
+
+enum netevent_notif_type {
+        NETEVENT_NEIGH_UPDATE = 1, /* arg is struct neighbour ptr */
+        NETEVENT_PMTU_UPDATE,      /* arg is struct dst_entry ptr */
+        NETEVENT_REDIRECT,         /* arg is struct netevent_redirect ptr */
+};
+
+extern int register_netevent_notifier(struct notifier_block *nb);
+extern int unregister_netevent_notifier(struct notifier_block *nb);
+extern int call_netevent_notifiers(unsigned long val, void *v);
+
+#endif
+#endif
diff --git a/include/net/red.h b/include/net/red.h
index 5ccdbb3d4722..a4eb37946f2c 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -212,7 +212,7 @@ static inline unsigned long red_calc_qavg_from_idle_time(struct red_parms *p)
                  * Seems, it is the best solution to
                  * problem of too coarse exponent tabulation.
                  */
-                us_idle = (p->qavg * us_idle) >> p->Scell_log;
+                us_idle = (p->qavg * (u64)us_idle) >> p->Scell_log;
 
                 if (us_idle < (p->qavg >> 1))
                         return p->qavg - us_idle;
diff --git a/include/net/scm.h b/include/net/scm.h
index 02daa097cdcd..5637d5e22d5f 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -3,6 +3,7 @@
 
 #include <linux/limits.h>
 #include <linux/net.h>
+#include <linux/security.h>
 
 /* Well, we should have at least one descriptor open
  * to accept passed FDs 8)
@@ -20,8 +21,7 @@ struct scm_cookie
         struct ucred            creds;          /* Skb credentials      */
         struct scm_fp_list      *fp;            /* Passed files         */
 #ifdef CONFIG_SECURITY_NETWORK
-        char                    *secdata;       /* Security context     */
-        u32                     seclen;         /* Security length      */
+        u32                     secid;          /* Passed security ID   */
 #endif
         unsigned long           seq;            /* Connection seqno     */
 };
@@ -32,6 +32,16 @@ extern int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie
 extern void __scm_destroy(struct scm_cookie *scm);
 extern struct scm_fp_list * scm_fp_dup(struct scm_fp_list *fpl);
 
+#ifdef CONFIG_SECURITY_NETWORK
+static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
+{
+        security_socket_getpeersec_dgram(sock, NULL, &scm->secid);
+}
+#else
+static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
+{ }
+#endif /* CONFIG_SECURITY_NETWORK */
+
 static __inline__ void scm_destroy(struct scm_cookie *scm)
 {
         if (scm && scm->fp)
@@ -47,6 +57,7 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
         scm->creds.pid = p->tgid;
         scm->fp = NULL;
         scm->seq = 0;
+        unix_get_peersec_dgram(sock, scm);
         if (msg->msg_controllen <= 0)
                 return 0;
         return __scm_send(sock, msg, scm);
@@ -55,8 +66,18 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
 #ifdef CONFIG_SECURITY_NETWORK
 static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
 {
-        if (test_bit(SOCK_PASSSEC, &sock->flags) && scm->secdata != NULL)
-                put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, scm->seclen, scm->secdata);
+        char *secdata;
+        u32 seclen;
+        int err;
+
+        if (test_bit(SOCK_PASSSEC, &sock->flags)) {
+                err = security_secid_to_secctx(scm->secid, &secdata, &seclen);
+
+                if (!err) {
+                        put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata);
+                        security_release_secctx(secdata, seclen);
+                }
+        }
 }
 #else
 static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 0720bddff1e9..7a093d0aa0fe 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -914,6 +914,9 @@ static inline void tcp_set_state(struct sock *sk, int state)
 
 static inline void tcp_done(struct sock *sk)
 {
+        if(sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
+                TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
+
         tcp_set_state(sk, TCP_CLOSE);
         tcp_clear_xmit_timers(sk);
 
diff --git a/kernel/audit.c b/kernel/audit.c
index d417ca1db79b..0a36091ed712 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -690,9 +690,7 @@ static const struct inotify_operations audit_inotify_ops = {
 /* Initialize audit support at boot time. */
 static int __init audit_init(void)
 {
-#ifdef CONFIG_AUDITSYSCALL
         int i;
-#endif
 
         printk(KERN_INFO "audit: initializing netlink socket (%s)\n",
                audit_default ? "enabled" : "disabled");
@@ -717,10 +715,10 @@ static int __init audit_init(void)
         audit_ih = inotify_init(&audit_inotify_ops);
         if (IS_ERR(audit_ih))
                 audit_panic("cannot initialize inotify handle");
+#endif
 
         for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                 INIT_LIST_HEAD(&audit_inode_hash[i]);
-#endif
 
         return 0;
 }
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 5b4e16276ca0..6a9a5c5a4e7d 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -442,6 +442,7 @@ static struct audit_entry *audit_rule_to_entry(struct audit_rule *rule)
                 case AUDIT_EQUAL:
                         break;
                 default:
+                        err = -EINVAL;
                         goto exit_free;
                 }
         }
@@ -579,6 +580,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
                 case AUDIT_EQUAL:
                         break;
                 default:
+                        err = -EINVAL;
                         goto exit_free;
                 }
         }
@@ -1134,6 +1136,14 @@ static inline int audit_add_rule(struct audit_entry *entry,
         struct audit_watch *watch = entry->rule.watch;
         struct nameidata *ndp, *ndw;
         int h, err, putnd_needed = 0;
+#ifdef CONFIG_AUDITSYSCALL
+        int dont_count = 0;
+
+        /* If either of these, don't count towards total */
+        if (entry->rule.listnr == AUDIT_FILTER_USER ||
+                entry->rule.listnr == AUDIT_FILTER_TYPE)
+                dont_count = 1;
+#endif
 
         if (inode_f) {
                 h = audit_hash_ino(inode_f->val);
@@ -1174,6 +1184,10 @@ static inline int audit_add_rule(struct audit_entry *entry,
         } else {
                 list_add_tail_rcu(&entry->list, list);
         }
+#ifdef CONFIG_AUDITSYSCALL
+        if (!dont_count)
+                audit_n_rules++;
+#endif
         mutex_unlock(&audit_filter_mutex);
 
         if (putnd_needed)
@@ -1198,6 +1212,14 @@ static inline int audit_del_rule(struct audit_entry *entry,
         struct audit_watch *watch, *tmp_watch = entry->rule.watch;
         LIST_HEAD(inotify_list);
         int h, ret = 0;
+#ifdef CONFIG_AUDITSYSCALL
+        int dont_count = 0;
+
+        /* If either of these, don't count towards total */
+        if (entry->rule.listnr == AUDIT_FILTER_USER ||
+                entry->rule.listnr == AUDIT_FILTER_TYPE)
+                dont_count = 1;
+#endif
 
         if (inode_f) {
                 h = audit_hash_ino(inode_f->val);
@@ -1235,6 +1257,10 @@ static inline int audit_del_rule(struct audit_entry *entry,
         list_del_rcu(&e->list);
         call_rcu(&e->rcu, audit_free_rule_rcu);
 
+#ifdef CONFIG_AUDITSYSCALL
+        if (!dont_count)
+                audit_n_rules--;
+#endif
         mutex_unlock(&audit_filter_mutex);
 
         if (!list_empty(&inotify_list))
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ae40ac8c39e7..efc1b74bebf3 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -85,6 +85,9 @@ extern int audit_enabled;
 /* Indicates that audit should log the full pathname. */
 #define AUDIT_NAME_FULL -1
 
+/* number of audit rules */
+int audit_n_rules;
+
 /* When fs/namei.c:getname() is called, we store the pointer in name and
  * we don't let putname() free it (instead we free all of the saved
  * pointers at syscall exit time).
@@ -174,6 +177,7 @@ struct audit_aux_data_path {
 
 /* The per-task audit context. */
 struct audit_context {
+        int                 dummy;      /* must be the first element */
         int                 in_syscall; /* 1 if task is in a syscall */
         enum audit_state    state;
         unsigned int        serial;     /* serial number for record */
@@ -514,7 +518,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
         context->return_valid = return_valid;
         context->return_code  = return_code;
 
-        if (context->in_syscall && !context->auditable) {
+        if (context->in_syscall && !context->dummy && !context->auditable) {
                 enum audit_state state;
 
                 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_EXIT]);
@@ -530,17 +534,7 @@ static inline struct audit_context *audit_get_context(struct task_struct *tsk,
         }
 
 get_context:
-        context->pid = tsk->pid;
-        context->ppid = sys_getppid();  /* sic.  tsk == current in all cases */
-        context->uid = tsk->uid;
-        context->gid = tsk->gid;
-        context->euid = tsk->euid;
-        context->suid = tsk->suid;
-        context->fsuid = tsk->fsuid;
-        context->egid = tsk->egid;
-        context->sgid = tsk->sgid;
-        context->fsgid = tsk->fsgid;
-        context->personality = tsk->personality;
+
         tsk->audit_context = NULL;
         return context;
 }
@@ -749,6 +743,17 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
         const char *tty;
 
         /* tsk == current */
+        context->pid = tsk->pid;
+        context->ppid = sys_getppid();  /* sic.  tsk == current in all cases */
+        context->uid = tsk->uid;
+        context->gid = tsk->gid;
+        context->euid = tsk->euid;
+        context->suid = tsk->suid;
+        context->fsuid = tsk->fsuid;
+        context->egid = tsk->egid;
+        context->sgid = tsk->sgid;
+        context->fsgid = tsk->fsgid;
+        context->personality = tsk->personality;
 
         ab = audit_log_start(context, GFP_KERNEL, AUDIT_SYSCALL);
         if (!ab)
@@ -1066,7 +1071,8 @@ void audit_syscall_entry(int arch, int major,
         context->argv[3]    = a4;
 
         state = context->state;
-        if (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT)
+        context->dummy = !audit_n_rules;
+        if (!context->dummy && (state == AUDIT_SETUP_CONTEXT || state == AUDIT_BUILD_CONTEXT))
                 state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
         if (likely(state == AUDIT_DISABLED))
                 return;
@@ -1199,14 +1205,18 @@ void audit_putname(const char *name)
 #endif
 }
 
-static void audit_inode_context(int idx, const struct inode *inode)
+/* Copy inode data into an audit_names. */
+static void audit_copy_inode(struct audit_names *name, const struct inode *inode)
 {
-        struct audit_context *context = current->audit_context;
-
-        selinux_get_inode_sid(inode, &context->names[idx].osid);
+        name->ino   = inode->i_ino;
+        name->dev   = inode->i_sb->s_dev;
+        name->mode  = inode->i_mode;
+        name->uid   = inode->i_uid;
+        name->gid   = inode->i_gid;
+        name->rdev  = inode->i_rdev;
+        selinux_get_inode_sid(inode, &name->osid);
 }
 
-
 /**
  * audit_inode - store the inode and device from a lookup
  * @name: name being audited
@@ -1240,20 +1250,14 @@ void __audit_inode(const char *name, const struct inode *inode)
                 ++context->ino_count;
 #endif
         }
-        context->names[idx].ino   = inode->i_ino;
-        context->names[idx].dev   = inode->i_sb->s_dev;
-        context->names[idx].mode  = inode->i_mode;
-        context->names[idx].uid   = inode->i_uid;
-        context->names[idx].gid   = inode->i_gid;
-        context->names[idx].rdev  = inode->i_rdev;
-        audit_inode_context(idx, inode);
+        audit_copy_inode(&context->names[idx], inode);
 }
 
 /**
  * audit_inode_child - collect inode info for created/removed objects
  * @dname: inode's dentry name
  * @inode: inode being audited
- * @pino: inode number of dentry parent
+ * @parent: inode of dentry parent
  *
  * For syscalls that create or remove filesystem objects, audit_inode
  * can only collect information for the filesystem object's parent.
@@ -1264,7 +1268,7 @@ void __audit_inode(const char *name, const struct inode *inode)
  * unsuccessful attempts.
  */
 void __audit_inode_child(const char *dname, const struct inode *inode,
-                         unsigned long pino)
+                         const struct inode *parent)
 {
         int idx;
         struct audit_context *context = current->audit_context;
@@ -1278,7 +1282,7 @@ void __audit_inode_child(const char *dname, const struct inode *inode,
         if (!dname)
                 goto update_context;
         for (idx = 0; idx < context->name_count; idx++)
-                if (context->names[idx].ino == pino) {
+                if (context->names[idx].ino == parent->i_ino) {
                         const char *name = context->names[idx].name;
 
                         if (!name)
@@ -1302,16 +1306,47 @@ update_context:
         context->names[idx].name_len = AUDIT_NAME_FULL;
         context->names[idx].name_put = 0;       /* don't call __putname() */
 
-        if (inode) {
-                context->names[idx].ino   = inode->i_ino;
-                context->names[idx].dev   = inode->i_sb->s_dev;
-                context->names[idx].mode  = inode->i_mode;
-                context->names[idx].uid   = inode->i_uid;
-                context->names[idx].gid   = inode->i_gid;
-                context->names[idx].rdev  = inode->i_rdev;
-                audit_inode_context(idx, inode);
-        } else
-                context->names[idx].ino   = (unsigned long)-1;
+        if (!inode)
+                context->names[idx].ino = (unsigned long)-1;
+        else
+                audit_copy_inode(&context->names[idx], inode);
+
+        /* A parent was not found in audit_names, so copy the inode data for the
+         * provided parent. */
+        if (!found_name) {
+                idx = context->name_count++;
+#if AUDIT_DEBUG
+                context->ino_count++;
+#endif
+                audit_copy_inode(&context->names[idx], parent);
+        }
+}
+
+/**
+ * audit_inode_update - update inode info for last collected name
+ * @inode: inode being audited
+ *
+ * When open() is called on an existing object with the O_CREAT flag, the inode
+ * data audit initially collects is incorrect.  This additional hook ensures
+ * audit has the inode data for the actual object to be opened.
+ */
+void __audit_inode_update(const struct inode *inode)
+{
+        struct audit_context *context = current->audit_context;
+        int idx;
+
+        if (!context->in_syscall || !inode)
+                return;
+
+        if (context->name_count == 0) {
+                context->name_count++;
+#if AUDIT_DEBUG
+                context->ino_count++;
+#endif
+        }
+        idx = context->name_count - 1;
+
+        audit_copy_inode(&context->names[idx], inode);
 }
 
 /**
@@ -1642,7 +1677,7 @@ int audit_bprm(struct linux_binprm *bprm)
         unsigned long p, next;
         void *to;
 
-        if (likely(!audit_enabled || !context))
+        if (likely(!audit_enabled || !context || context->dummy))
                 return 0;
 
         ax = kmalloc(sizeof(*ax) + PAGE_SIZE * MAX_ARG_PAGES - bprm->p,
@@ -1680,7 +1715,7 @@ int audit_socketcall(int nargs, unsigned long *args)
         struct audit_aux_data_socketcall *ax;
         struct audit_context *context = current->audit_context;
 
-        if (likely(!context))
+        if (likely(!context || context->dummy))
                 return 0;
 
         ax = kmalloc(sizeof(*ax) + nargs * sizeof(unsigned long), GFP_KERNEL);
@@ -1708,7 +1743,7 @@ int audit_sockaddr(int len, void *a)
         struct audit_aux_data_sockaddr *ax;
         struct audit_context *context = current->audit_context;
 
-        if (likely(!context))
+        if (likely(!context || context->dummy))
                 return 0;
 
         ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
diff --git a/kernel/fork.c b/kernel/fork.c
index 1b0f7b1e0881..aa36c43783cc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1387,8 +1387,10 @@ long do_fork(unsigned long clone_flags,
 
                 if (clone_flags & CLONE_VFORK) {
                         wait_for_completion(&vfork);
-                        if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE))
+                        if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE)) {
+                                current->ptrace_message = nr;
                                 ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP);
+                        }
                 }
         } else {
                 free_pid(pid);
diff --git a/kernel/futex.c b/kernel/futex.c
index dda2049692a2..d4633c588f33 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -297,7 +297,7 @@ static int futex_handle_fault(unsigned long address, int attempt)
         struct vm_area_struct * vma;
         struct mm_struct *mm = current->mm;
 
-        if (attempt >= 2 || !(vma = find_vma(mm, address)) ||
+        if (attempt > 2 || !(vma = find_vma(mm, address)) ||
             vma->vm_start > address || !(vma->vm_flags & VM_WRITE))
                 return -EFAULT;
 
@@ -747,8 +747,10 @@ retry:
                  */
                 if (attempt++) {
                         if (futex_handle_fault((unsigned long)uaddr2,
-                                               attempt))
+                                                attempt)) {
+                                ret = -EFAULT;
                                 goto out;
+                        }
                         goto retry;
                 }
 
@@ -948,6 +950,7 @@ static int unqueue_me(struct futex_q *q)
         /* In the common case we don't take the spinlock, which is nice. */
  retry:
         lock_ptr = q->lock_ptr;
+        barrier();
         if (lock_ptr != 0) {
                 spin_lock(lock_ptr);
                 /*
@@ -1321,9 +1324,10 @@ static int do_futex_lock_pi(u32 __user *uaddr, int detect, int trylock,
          * still holding the mmap_sem.
          */
         if (attempt++) {
-                if (futex_handle_fault((unsigned long)uaddr, attempt))
+                if (futex_handle_fault((unsigned long)uaddr, attempt)) {
+                        ret = -EFAULT;
                         goto out_unlock_release_sem;
-
+                }
                 goto retry_locked;
         }
 
@@ -1505,9 +1509,10 @@ pi_faulted:
          * still holding the mmap_sem.
          */
         if (attempt++) {
-                if (futex_handle_fault((unsigned long)uaddr, attempt))
+                if (futex_handle_fault((unsigned long)uaddr, attempt)) {
+                        ret = -EFAULT;
                         goto out_unlock;
-
+                }
                 goto retry_locked;
         }
 
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d1aab1a452cc..c5cca3f65cb7 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -39,7 +39,7 @@ void compat_exit_robust_list(struct task_struct *curr)
 {
         struct compat_robust_list_head __user *head = curr->compat_robust_list;
         struct robust_list __user *entry, *pending;
-        unsigned int limit = ROBUST_LIST_LIMIT, pi;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
         compat_uptr_t uentry, upending;
         compat_long_t futex_offset;
 
@@ -59,10 +59,10 @@ void compat_exit_robust_list(struct task_struct *curr)
          * if it exists:
          */
         if (fetch_robust_entry(&upending, &pending,
-                               &head->list_op_pending, &pi))
+                               &head->list_op_pending, &pip))
                 return;
         if (upending)
-                handle_futex_death((void *)pending + futex_offset, curr, pi);
+                handle_futex_death((void *)pending + futex_offset, curr, pip);
 
         while (compat_ptr(uentry) != &head->list) {
                 /*
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index be989efc7856..21c38a7e666b 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -187,7 +187,7 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_base *base)
 {
         struct hrtimer_base *new_base;
 
-        new_base = &__get_cpu_var(hrtimer_bases[base->index]);
+        new_base = &__get_cpu_var(hrtimer_bases)[base->index];
 
         if (base != new_base) {
                 /*
diff --git a/kernel/panic.c b/kernel/panic.c
index d8a0bca21233..9b8dcfd1ca93 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -18,6 +18,7 @@
 #include <linux/interrupt.h>
 #include <linux/nmi.h>
 #include <linux/kexec.h>
+#include <linux/debug_locks.h>
 
 int panic_on_oops;
 int tainted;
diff --git a/kernel/power/process.c b/kernel/power/process.c
index b2a5f671d6cd..72e72d2c61e6 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -66,13 +66,25 @@ static inline void freeze_process(struct task_struct *p)
         }
 }
 
+static void cancel_freezing(struct task_struct *p)
+{
+        unsigned long flags;
+
+        if (freezing(p)) {
+                pr_debug("  clean up: %s\n", p->comm);
+                do_not_freeze(p);
+                spin_lock_irqsave(&p->sighand->siglock, flags);
+                recalc_sigpending_tsk(p);
+                spin_unlock_irqrestore(&p->sighand->siglock, flags);
+        }
+}
+
 /* 0 = success, else # of processes that we failed to stop */
 int freeze_processes(void)
 {
         int todo, nr_user, user_frozen;
         unsigned long start_time;
         struct task_struct *g, *p;
-        unsigned long flags;
 
         printk( "Stopping tasks: " );
         start_time = jiffies;
@@ -85,6 +97,10 @@ int freeze_processes(void)
                                 continue;
                         if (frozen(p))
                                 continue;
+                        if (p->state == TASK_TRACED && frozen(p->parent)) {
+                                cancel_freezing(p);
+                                continue;
+                        }
                         if (p->mm && !(p->flags & PF_BORROWED_MM)) {
                                 /* The task is a user-space one.
                                  * Freeze it unless there's a vfork completion
@@ -126,13 +142,7 @@ int freeze_processes(void)
                 do_each_thread(g, p) {
                         if (freezeable(p) && !frozen(p))
                                 printk(KERN_ERR "  %s\n", p->comm);
-                        if (freezing(p)) {
-                                pr_debug("  clean up: %s\n", p->comm);
-                                p->flags &= ~PF_FREEZE;
-                                spin_lock_irqsave(&p->sighand->siglock, flags);
-                                recalc_sigpending_tsk(p);
-                                spin_unlock_irqrestore(&p->sighand->siglock, flags);
-                        }
+                        cancel_freezing(p);
                 } while_each_thread(g, p);
                 read_unlock(&tasklist_lock);
                 return todo;
diff --git a/kernel/printk.c b/kernel/printk.c
index 65ca0688f86f..1149365e989e 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -799,6 +799,9 @@ void release_console_sem(void)
                 up(&secondary_console_sem);
                 return;
         }
+
+        console_may_schedule = 0;
+
         for ( ; ; ) {
                 spin_lock_irqsave(&logbuf_lock, flags);
                 wake_klogd |= log_start - log_end;
@@ -812,7 +815,6 @@ void release_console_sem(void)
                 local_irq_restore(flags);
         }
         console_locked = 0;
-        console_may_schedule = 0;
         up(&console_sem);
         spin_unlock_irqrestore(&logbuf_lock, flags);
         if (wake_klogd && !oops_in_progress && waitqueue_active(&log_wait)) {
diff --git a/kernel/resource.c b/kernel/resource.c
index 0dd3a857579e..46286434af80 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -244,6 +244,7 @@ int find_next_system_ram(struct resource *res)
 
         start = res->start;
         end = res->end;
+        BUG_ON(start >= end);
 
         read_lock(&resource_lock);
         for (p = iomem_resource.child; p ; p = p->sibling) {
@@ -254,15 +255,17 @@ int find_next_system_ram(struct resource *res)
                         p = NULL;
                         break;
                 }
-                if (p->start >= start)
+                if ((p->end >= start) && (p->start < end))
                         break;
         }
         read_unlock(&resource_lock);
         if (!p)
                 return -1;
         /* copy data */
-        res->start = p->start;
-        res->end = p->end;
+        if (res->start < p->start)
+                res->start = p->start;
+        if (res->end > p->end)
+                res->end = p->end;
         return 0;
 }
 #endif
diff --git a/kernel/signal.c b/kernel/signal.c
index 7fe874d12fae..bfdb5686fa3e 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -791,22 +791,31 @@ out:
 /*
  * Force a signal that the process can't ignore: if necessary
  * we unblock the signal and change any SIG_IGN to SIG_DFL.
+ *
+ * Note: If we unblock the signal, we always reset it to SIG_DFL,
+ * since we do not want to have a signal handler that was blocked
+ * be invoked when user space had explicitly blocked it.
+ *
+ * We don't want to have recursive SIGSEGV's etc, for example.
  */
-
 int
 force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
 {
         unsigned long int flags;
-        int ret;
+        int ret, blocked, ignored;
+        struct k_sigaction *action;
 
         spin_lock_irqsave(&t->sighand->siglock, flags);
-        if (t->sighand->action[sig-1].sa.sa_handler == SIG_IGN) {
-                t->sighand->action[sig-1].sa.sa_handler = SIG_DFL;
-        }
-        if (sigismember(&t->blocked, sig)) {
-                sigdelset(&t->blocked, sig);
+        action = &t->sighand->action[sig-1];
+        ignored = action->sa.sa_handler == SIG_IGN;
+        blocked = sigismember(&t->blocked, sig);
+        if (blocked || ignored) {
+                action->sa.sa_handler = SIG_DFL;
+                if (blocked) {
+                        sigdelset(&t->blocked, sig);
+                        recalc_sigpending_tsk(t);
+                }
         }
-        recalc_sigpending_tsk(t);
         ret = specific_send_sig_info(sig, info, t);
         spin_unlock_irqrestore(&t->sighand->siglock, flags);
 
diff --git a/kernel/timer.c b/kernel/timer.c
index b650f04888ed..1d7dd6267c2d 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1324,46 +1324,19 @@ asmlinkage long sys_getpid(void)
 }
 
 /*
- * Accessing ->group_leader->real_parent is not SMP-safe, it could
- * change from under us. However, rather than getting any lock
- * we can use an optimistic algorithm: get the parent
- * pid, and go back and check that the parent is still
- * the same. If it has changed (which is extremely unlikely
- * indeed), we just try again..
- *
- * NOTE! This depends on the fact that even if we _do_
- * get an old value of "parent", we can happily dereference
- * the pointer (it was and remains a dereferencable kernel pointer
- * no matter what): we just can't necessarily trust the result
- * until we know that the parent pointer is valid.
- *
- * NOTE2: ->group_leader never changes from under us.
+ * Accessing ->real_parent is not SMP-safe, it could
+ * change from under us. However, we can use a stale
+ * value of ->real_parent under rcu_read_lock(), see
+ * release_task()->call_rcu(delayed_put_task_struct).
  */
 asmlinkage long sys_getppid(void)
 {
         int pid;
-        struct task_struct *me = current;
-        struct task_struct *parent;
 
-        parent = me->group_leader->real_parent;
-        for (;;) {
-                pid = parent->tgid;
-#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT)
-{
-                struct task_struct *old = parent;
+        rcu_read_lock();
+        pid = rcu_dereference(current->real_parent)->tgid;
+        rcu_read_unlock();
 
-                /*
-                 * Make sure we read the pid before re-reading the
-                 * parent pointer:
-                 */
-                smp_rmb();
-                parent = me->group_leader->real_parent;
-                if (old != parent)
-                        continue;
-}
-#endif
-                break;
-        }
         return pid;
 }
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 448e8f7b342d..835fe28b87a8 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -68,7 +68,7 @@ struct workqueue_struct {
 
 /* All the per-cpu workqueues on the system, for hotplug cpu to add/remove
    threads to each one as cpus come/go. */
-static DEFINE_SPINLOCK(workqueue_lock);
+static DEFINE_MUTEX(workqueue_mutex);
 static LIST_HEAD(workqueues);
 
 static int singlethread_cpu;
@@ -320,10 +320,10 @@ void fastcall flush_workqueue(struct workqueue_struct *wq)
         } else {
                 int cpu;
 
-                lock_cpu_hotplug();
+                mutex_lock(&workqueue_mutex);
                 for_each_online_cpu(cpu)
                         flush_cpu_workqueue(per_cpu_ptr(wq->cpu_wq, cpu));
-                unlock_cpu_hotplug();
+                mutex_unlock(&workqueue_mutex);
         }
 }
 EXPORT_SYMBOL_GPL(flush_workqueue);
@@ -371,8 +371,7 @@ struct workqueue_struct *__create_workqueue(const char *name,
         }
 
         wq->name = name;
-        /* We don't need the distraction of CPUs appearing and vanishing. */
-        lock_cpu_hotplug();
+        mutex_lock(&workqueue_mutex);
         if (singlethread) {
                 INIT_LIST_HEAD(&wq->list);
                 p = create_workqueue_thread(wq, singlethread_cpu);
@@ -381,9 +380,7 @@ struct workqueue_struct *__create_workqueue(const char *name,
                 else
                         wake_up_process(p);
         } else {
-                spin_lock(&workqueue_lock);
                 list_add(&wq->list, &workqueues);
-                spin_unlock(&workqueue_lock);
                 for_each_online_cpu(cpu) {
                         p = create_workqueue_thread(wq, cpu);
                         if (p) {
@@ -393,7 +390,7 @@ struct workqueue_struct *__create_workqueue(const char *name,
                                 destroy = 1;
                 }
         }
-        unlock_cpu_hotplug();
+        mutex_unlock(&workqueue_mutex);
 
         /*
          * Was there any error during startup? If yes then clean up:
@@ -434,17 +431,15 @@ void destroy_workqueue(struct workqueue_struct *wq)
         flush_workqueue(wq);
 
         /* We don't need the distraction of CPUs appearing and vanishing. */
-        lock_cpu_hotplug();
+        mutex_lock(&workqueue_mutex);
         if (is_single_threaded(wq))
                 cleanup_workqueue_thread(wq, singlethread_cpu);
         else {
                 for_each_online_cpu(cpu)
                         cleanup_workqueue_thread(wq, cpu);
-                spin_lock(&workqueue_lock);
                 list_del(&wq->list);
-                spin_unlock(&workqueue_lock);
         }
-        unlock_cpu_hotplug();
+        mutex_unlock(&workqueue_mutex);
         free_percpu(wq->cpu_wq);
         kfree(wq);
 }
@@ -515,11 +510,13 @@ int schedule_on_each_cpu(void (*func)(void *info), void *info)
         if (!works)
                 return -ENOMEM;
 
+        mutex_lock(&workqueue_mutex);
         for_each_online_cpu(cpu) {
                 INIT_WORK(per_cpu_ptr(works, cpu), func, info);
                 __queue_work(per_cpu_ptr(keventd_wq->cpu_wq, cpu),
                                 per_cpu_ptr(works, cpu));
         }
+        mutex_unlock(&workqueue_mutex);
         flush_workqueue(keventd_wq);
         free_percpu(works);
         return 0;
@@ -635,6 +632,7 @@ static int __devinit workqueue_cpu_callback(struct notifier_block *nfb,
 
         switch (action) {
         case CPU_UP_PREPARE:
+                mutex_lock(&workqueue_mutex);
                 /* Create a new workqueue thread for it. */
                 list_for_each_entry(wq, &workqueues, list) {
                         if (!create_workqueue_thread(wq, hotcpu)) {
@@ -653,6 +651,7 @@ static int __devinit workqueue_cpu_callback(struct notifier_block *nfb,
                         kthread_bind(cwq->thread, hotcpu);
                         wake_up_process(cwq->thread);
                 }
+                mutex_unlock(&workqueue_mutex);
                 break;
 
         case CPU_UP_CANCELED:
@@ -664,6 +663,15 @@ static int __devinit workqueue_cpu_callback(struct notifier_block *nfb,
                                      any_online_cpu(cpu_online_map));
                         cleanup_workqueue_thread(wq, hotcpu);
                 }
+                mutex_unlock(&workqueue_mutex);
+                break;
+
+        case CPU_DOWN_PREPARE:
+                mutex_lock(&workqueue_mutex);
+                break;
+
+        case CPU_DOWN_FAILED:
+                mutex_unlock(&workqueue_mutex);
                 break;
 
         case CPU_DEAD:
@@ -671,6 +679,7 @@ static int __devinit workqueue_cpu_callback(struct notifier_block *nfb,
                         cleanup_workqueue_thread(wq, hotcpu);
                 list_for_each_entry(wq, &workqueues, list)
                         take_over_work(wq, hotcpu);
+                mutex_unlock(&workqueue_mutex);
                 break;
         }
 
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 2b1530fc573b..7f20e7b857cb 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -50,10 +50,6 @@ static char *action_to_string(enum kobject_action action)
                 return "offline";
         case KOBJ_ONLINE:
                 return "online";
-        case KOBJ_DOCK:
-                return "dock";
-        case KOBJ_UNDOCK:
-                return "undock";
         default:
                 return NULL;
         }
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index 3d9c4dc965ed..58c577dd82e5 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -162,6 +162,7 @@ static void rwlock_bug(rwlock_t *lock, const char *msg)
 
 #define RWLOCK_BUG_ON(cond, lock, msg) if (unlikely(cond)) rwlock_bug(lock, msg)
 
+#if 0           /* __write_lock_debug() can lock up - maybe this can too? */
 static void __read_lock_debug(rwlock_t *lock)
 {
         int print_once = 1;
@@ -184,12 +185,12 @@ static void __read_lock_debug(rwlock_t *lock)
                 }
         }
 }
+#endif
 
 void _raw_read_lock(rwlock_t *lock)
 {
         RWLOCK_BUG_ON(lock->magic != RWLOCK_MAGIC, lock, "bad magic");
-        if (unlikely(!__raw_read_trylock(&lock->raw_lock)))
-                __read_lock_debug(lock);
+        __raw_read_lock(&lock->raw_lock);
 }
 
 int _raw_read_trylock(rwlock_t *lock)
@@ -235,6 +236,7 @@ static inline void debug_write_unlock(rwlock_t *lock)
         lock->owner_cpu = -1;
 }
 
+#if 0           /* This can cause lockups */
 static void __write_lock_debug(rwlock_t *lock)
 {
         int print_once = 1;
@@ -257,12 +259,12 @@ static void __write_lock_debug(rwlock_t *lock)
                 }
         }
 }
+#endif
 
 void _raw_write_lock(rwlock_t *lock)
 {
         debug_write_lock_before(lock);
-        if (unlikely(!__raw_write_trylock(&lock->raw_lock)))
-                __write_lock_debug(lock);
+        __raw_write_lock(&lock->raw_lock);
         debug_write_lock_after(lock);
 }
 
diff --git a/mm/fadvise.c b/mm/fadvise.c
index 60a5d55e51d9..168c78a121bb 100644
--- a/mm/fadvise.c
+++ b/mm/fadvise.c
@@ -73,7 +73,6 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
                 file->f_ra.ra_pages = bdi->ra_pages * 2;
                 break;
         case POSIX_FADV_WILLNEED:
-        case POSIX_FADV_NOREUSE:
                 if (!mapping->a_ops->readpage) {
                         ret = -EINVAL;
                         break;
@@ -94,6 +93,8 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
                 if (ret > 0)
                         ret = 0;
                 break;
+        case POSIX_FADV_NOREUSE:
+                break;
         case POSIX_FADV_DONTNEED:
                 if (!bdi_write_congested(mapping->backing_dev_info))
                         filemap_flush(mapping);
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 01c9fb97c619..c37319542b70 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -52,6 +52,9 @@ static int __add_section(struct zone *zone, unsigned long phys_start_pfn)
         int nr_pages = PAGES_PER_SECTION;
         int ret;
 
+        if (pfn_valid(phys_start_pfn))
+                return -EEXIST;
+
         ret = sparse_add_one_section(zone, phys_start_pfn, nr_pages);
 
         if (ret < 0)
@@ -76,15 +79,22 @@ int __add_pages(struct zone *zone, unsigned long phys_start_pfn,
 {
         unsigned long i;
         int err = 0;
+        int start_sec, end_sec;
+        /* during initialize mem_map, align hot-added range to section */
+        start_sec = pfn_to_section_nr(phys_start_pfn);
+        end_sec = pfn_to_section_nr(phys_start_pfn + nr_pages - 1);
 
-        for (i = 0; i < nr_pages; i += PAGES_PER_SECTION) {
-                err = __add_section(zone, phys_start_pfn + i);
+        for (i = start_sec; i <= end_sec; i++) {
+                err = __add_section(zone, i << PFN_SECTION_SHIFT);
 
-                /* We want to keep adding the rest of the
-                 * sections if the first ones already exist
+                /*
+                 * EEXIST is finally dealed with by ioresource collision
+                 * check. see add_memory() => register_memory_resource()
+                 * Warning will be printed if there is collision.
                  */
                 if (err && (err != -EEXIST))
                         break;
+                err = 0;
         }
 
         return err;
@@ -156,7 +166,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
         res.flags = IORESOURCE_MEM; /* we just need system ram */
         section_end = res.end;
 
-        while (find_next_system_ram(&res) >= 0) {
+        while ((res.start < res.end) && (find_next_system_ram(&res) >= 0)) {
                 start_pfn = (unsigned long)(res.start >> PAGE_SHIFT);
                 nr_pages = (unsigned long)
                            ((res.end + 1 - res.start) >> PAGE_SHIFT);
@@ -213,10 +223,9 @@ static void rollback_node_hotadd(int nid, pg_data_t *pgdat)
 }
 
 /* add this memory to iomem resource */
-static void register_memory_resource(u64 start, u64 size)
+static struct resource *register_memory_resource(u64 start, u64 size)
 {
         struct resource *res;
-
         res = kzalloc(sizeof(struct resource), GFP_KERNEL);
         BUG_ON(!res);
 
@@ -228,7 +237,18 @@ static void register_memory_resource(u64 start, u64 size)
                 printk("System RAM resource %llx - %llx cannot be added\n",
                 (unsigned long long)res->start, (unsigned long long)res->end);
                 kfree(res);
+                res = NULL;
         }
+        return res;
+}
+
+static void release_memory_resource(struct resource *res)
+{
+        if (!res)
+                return;
+        release_resource(res);
+        kfree(res);
+        return;
 }
 
 
@@ -237,8 +257,13 @@ int add_memory(int nid, u64 start, u64 size)
 {
         pg_data_t *pgdat = NULL;
         int new_pgdat = 0;
+        struct resource *res;
         int ret;
 
+        res = register_memory_resource(start, size);
+        if (!res)
+                return -EEXIST;
+
         if (!node_online(nid)) {
                 pgdat = hotadd_new_pgdat(nid, start);
                 if (!pgdat)
@@ -268,14 +293,13 @@ int add_memory(int nid, u64 start, u64 size)
                 BUG_ON(ret);
         }
 
-        /* register this memory as resource */
-        register_memory_resource(start, size);
-
         return ret;
 error:
         /* rollback pgdat allocation and others */
         if (new_pgdat)
                 rollback_node_hotadd(nid, pgdat);
+        if (res)
+                release_memory_resource(res);
 
         return ret;
 }
diff --git a/mm/swap.c b/mm/swap.c
index 8fd095c4ae51..687686a61f7c 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -54,6 +54,26 @@ void put_page(struct page *page)
 }
 EXPORT_SYMBOL(put_page);
 
+/**
+ * put_pages_list(): release a list of pages
+ *
+ * Release a list of pages which are strung together on page.lru.  Currently
+ * used by read_cache_pages() and related error recovery code.
+ *
+ * @pages: list of pages threaded on page->lru
+ */
+void put_pages_list(struct list_head *pages)
+{
+        while (!list_empty(pages)) {
+                struct page *victim;
+
+                victim = list_entry(pages->prev, struct page, lru);
+                list_del(&victim->lru);
+                page_cache_release(victim);
+        }
+}
+EXPORT_SYMBOL(put_pages_list);
+
 /*
  * Writeback is about to end against a page which has been marked for immediate
  * reclaim.  If it still appears to be reclaimable, move it to the tail of the
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 06abb6634f5b..53086fb75089 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -85,7 +85,7 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
                 goto err_out;
 
         err = br_fill_ifinfo(skb, port, current->pid, 0, event, 0);
-        if (err)
+        if (err < 0)
                 goto err_kfree;
 
         NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 02693a230dc1..9f950db3b76f 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -74,6 +74,9 @@ static void ulog_send(unsigned int nlgroup)
         if (timer_pending(&ub->timer))
                 del_timer(&ub->timer);
 
+        if (!ub->skb)
+                return;
+
         /* last nlmsg needs NLMSG_DONE */
         if (ub->qlen > 1)
                 ub->lastnlh->nlmsg_type = NLMSG_DONE;
diff --git a/net/core/Makefile b/net/core/Makefile
index e9bd2467d5a9..2645ba428d48 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -7,7 +7,7 @@ obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
 
-obj-y                += dev.o ethtool.o dev_mcast.o dst.o \
+obj-y                += dev.o ethtool.o dev_mcast.o dst.o netevent.o \
                         neighbour.o rtnetlink.o utils.o link_watch.o filter.o
 
 obj-$(CONFIG_XFRM) += flow.o
diff --git a/net/core/dev.c b/net/core/dev.c
index 4d2b5167d7f5..d95e2626d944 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1166,11 +1166,6 @@ int skb_checksum_help(struct sk_buff *skb, int inward)
                 goto out_set_summed;
 
         if (unlikely(skb_shinfo(skb)->gso_size)) {
-                static int warned;
-
-                WARN_ON(!warned);
-                warned = 1;
-
                 /* Let GSO fix up the checksum. */
                 goto out_set_summed;
         }
@@ -1220,11 +1215,6 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb, int features)
         __skb_pull(skb, skb->mac_len);
 
         if (unlikely(skb->ip_summed != CHECKSUM_HW)) {
-                static int warned;
-
-                WARN_ON(!warned);
-                warned = 1;
-
                 if (skb_header_cloned(skb) &&
                     (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
                         return ERR_PTR(err);
@@ -3429,12 +3419,9 @@ static void net_dma_rebalance(void)
         unsigned int cpu, i, n;
         struct dma_chan *chan;
 
-        lock_cpu_hotplug();
-
         if (net_dma_count == 0) {
                 for_each_online_cpu(cpu)
-                        rcu_assign_pointer(per_cpu(softnet_data.net_dma, cpu), NULL);
-                unlock_cpu_hotplug();
+                        rcu_assign_pointer(per_cpu(softnet_data, cpu).net_dma, NULL);
                 return;
         }
 
@@ -3447,15 +3434,13 @@ static void net_dma_rebalance(void)
                    + (i < (num_online_cpus() % net_dma_count) ? 1 : 0));
 
                 while(n) {
-                        per_cpu(softnet_data.net_dma, cpu) = chan;
+                        per_cpu(softnet_data, cpu).net_dma = chan;
                         cpu = next_cpu(cpu, cpu_online_map);
                         n--;
                 }
                 i++;
         }
         rcu_read_unlock();
-
-        unlock_cpu_hotplug();
 }
 
 /**
diff --git a/net/core/dst.c b/net/core/dst.c
index 470c05bc4cb2..1a5e49da0e77 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -95,12 +95,11 @@ static void dst_run_gc(unsigned long dummy)
                 dst_gc_timer_inc = DST_GC_INC;
                 dst_gc_timer_expires = DST_GC_MIN;
         }
-        dst_gc_timer.expires = jiffies + dst_gc_timer_expires;
 #if RT_CACHE_DEBUG >= 2
         printk("dst_total: %d/%d %ld\n",
                atomic_read(&dst_total), delayed,  dst_gc_timer_expires);
 #endif
-        add_timer(&dst_gc_timer);
+        mod_timer(&dst_gc_timer, jiffies + dst_gc_timer_expires);
 
 out:
         spin_unlock(&dst_lock);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 7ad681f5e712..5130d2efdbbe 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -29,6 +29,7 @@
 #include <net/neighbour.h>
 #include <net/dst.h>
 #include <net/sock.h>
+#include <net/netevent.h>
 #include <linux/rtnetlink.h>
 #include <linux/random.h>
 #include <linux/string.h>
@@ -754,6 +755,7 @@ static void neigh_timer_handler(unsigned long arg)
                         neigh->nud_state = NUD_STALE;
                         neigh->updated = jiffies;
                         neigh_suspect(neigh);
+                        notify = 1;
                 }
         } else if (state & NUD_DELAY) {
                 if (time_before_eq(now, 
@@ -762,6 +764,7 @@ static void neigh_timer_handler(unsigned long arg)
                         neigh->nud_state = NUD_REACHABLE;
                         neigh->updated = jiffies;
                         neigh_connect(neigh);
+                        notify = 1;
                         next = neigh->confirmed + neigh->parms->reachable_time;
                 } else {
                         NEIGH_PRINTK2("neigh %p is probed.\n", neigh);
@@ -819,6 +822,8 @@ static void neigh_timer_handler(unsigned long arg)
 out:
                 write_unlock(&neigh->lock);
         }
+        if (notify)
+                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 
 #ifdef CONFIG_ARPD
         if (notify && neigh->parms->app_probes)
@@ -926,9 +931,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 {
         u8 old;
         int err;
-#ifdef CONFIG_ARPD
         int notify = 0;
-#endif
         struct net_device *dev;
         int update_isrouter = 0;
 
@@ -948,9 +951,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                         neigh_suspect(neigh);
                 neigh->nud_state = new;
                 err = 0;
-#ifdef CONFIG_ARPD
                 notify = old & NUD_VALID;
-#endif
                 goto out;
         }
 
@@ -1022,9 +1023,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 if (!(new & NUD_CONNECTED))
                         neigh->confirmed = jiffies -
                                       (neigh->parms->base_reachable_time << 1);
-#ifdef CONFIG_ARPD
                 notify = 1;
-#endif
         }
         if (new == old)
                 goto out;
@@ -1056,6 +1055,9 @@ out:
                         (neigh->flags & ~NTF_ROUTER);
         }
         write_unlock_bh(&neigh->lock);
+
+        if (notify)
+                call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, neigh);
 #ifdef CONFIG_ARPD
         if (notify && neigh->parms->app_probes)
                 neigh_app_notify(neigh);
diff --git a/net/core/netevent.c b/net/core/netevent.c
new file mode 100644
index 000000000000..35d02c38554e
--- /dev/null
+++ b/net/core/netevent.c
@@ -0,0 +1,69 @@
+/*
+ *      Network event notifiers
+ *
+ *      Authors:
+ *      Tom Tucker             <tom@opengridcomputing.com>
+ *      Steve Wise             <swise@opengridcomputing.com>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      Fixes:
+ */
+
+#include <linux/rtnetlink.h>
+#include <linux/notifier.h>
+
+static ATOMIC_NOTIFIER_HEAD(netevent_notif_chain);
+
+/**
+ *      register_netevent_notifier - register a netevent notifier block
+ *      @nb: notifier
+ *
+ *      Register a notifier to be called when a netevent occurs.
+ *      The notifier passed is linked into the kernel structures and must
+ *      not be reused until it has been unregistered. A negative errno code
+ *      is returned on a failure.
+ */
+int register_netevent_notifier(struct notifier_block *nb)
+{
+        int err;
+
+        err = atomic_notifier_chain_register(&netevent_notif_chain, nb);
+        return err;
+}
+
+/**
+ *      netevent_unregister_notifier - unregister a netevent notifier block
+ *      @nb: notifier
+ *
+ *      Unregister a notifier previously registered by
+ *      register_neigh_notifier(). The notifier is unlinked into the
+ *      kernel structures and may then be reused. A negative errno code
+ *      is returned on a failure.
+ */
+
+int unregister_netevent_notifier(struct notifier_block *nb)
+{
+        return atomic_notifier_chain_unregister(&netevent_notif_chain, nb);
+}
+
+/**
+ *      call_netevent_notifiers - call all netevent notifier blocks
+ *      @val: value passed unmodified to notifier function
+ *      @v:   pointer passed unmodified to notifier function
+ *
+ *      Call all neighbour notifier blocks.  Parameters and return value
+ *      are as for notifier_call_chain().
+ */
+
+int call_netevent_notifiers(unsigned long val, void *v)
+{
+        return atomic_notifier_call_chain(&netevent_notif_chain, val, v);
+}
+
+EXPORT_SYMBOL_GPL(register_netevent_notifier);
+EXPORT_SYMBOL_GPL(unregister_netevent_notifier);
+EXPORT_SYMBOL_GPL(call_netevent_notifiers);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 67ed14ddabd2..6a7320b39ed0 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2149,6 +2149,8 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         skb->mac.raw = ((u8 *) iph) - 14 - pkt_dev->nr_labels*sizeof(u32);
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
+        skb->nh.iph = iph;
+        skb->h.uh = udph;
 
         if (pkt_dev->nfrags <= 0)
                 pgh = (struct pktgen_hdr *)skb_put(skb, datalen);
@@ -2460,6 +2462,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         skb->protocol = protocol;
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
+        skb->nh.ipv6h = iph;
+        skb->h.uh = udph;
 
         if (pkt_dev->nfrags <= 0)
                 pgh = (struct pktgen_hdr *)skb_put(skb, datalen);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 20e5bb73f147..30cc1ba6ed5c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -394,6 +394,9 @@ static int do_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         }
 
         if (ida[IFLA_ADDRESS - 1]) {
+                struct sockaddr *sa;
+                int len;
+
                 if (!dev->set_mac_address) {
                         err = -EOPNOTSUPP;
                         goto out;
@@ -405,7 +408,17 @@ static int do_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 if (ida[IFLA_ADDRESS - 1]->rta_len != RTA_LENGTH(dev->addr_len))
                         goto out;
 
-                err = dev->set_mac_address(dev, RTA_DATA(ida[IFLA_ADDRESS - 1]));
+                len = sizeof(sa_family_t) + dev->addr_len;
+                sa = kmalloc(len, GFP_KERNEL);
+                if (!sa) {
+                        err = -ENOMEM;
+                        goto out;
+                }
+                sa->sa_family = dev->type;
+                memcpy(sa->sa_data, RTA_DATA(ida[IFLA_ADDRESS - 1]),
+                       dev->addr_len);
+                err = dev->set_mac_address(dev, sa);
+                kfree(sa);
                 if (err)
                         goto out;
                 send_addr_notify = 1;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 476aa3978504..c54f3664bce5 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -71,13 +71,6 @@ static kmem_cache_t *skbuff_head_cache __read_mostly;
 static kmem_cache_t *skbuff_fclone_cache __read_mostly;
 
 /*
- * lockdep: lock class key used by skb_queue_head_init():
- */
-struct lock_class_key skb_queue_lock_key;
-
-EXPORT_SYMBOL(skb_queue_lock_key);
-
-/*
  *      Keep out-of-line to prevent kernel bloat.
  *      __builtin_return_address is not used because it is not always
  *      reliable.
@@ -256,6 +249,31 @@ nodata:
         goto out;
 }
 
+/**
+ *      __netdev_alloc_skb - allocate an skbuff for rx on a specific device
+ *      @dev: network device to receive on
+ *      @length: length to allocate
+ *      @gfp_mask: get_free_pages mask, passed to alloc_skb
+ *
+ *      Allocate a new &sk_buff and assign it a usage count of one. The
+ *      buffer has unspecified headroom built in. Users should allocate
+ *      the headroom they think they need without accounting for the
+ *      built in space. The built in space is used for optimisations.
+ *
+ *      %NULL is returned if there is no free memory.
+ */
+struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
+                unsigned int length, gfp_t gfp_mask)
+{
+        struct sk_buff *skb;
+
+        skb = alloc_skb(length + NET_SKB_PAD, gfp_mask);
+        if (likely(skb)) {
+                skb_reserve(skb, NET_SKB_PAD);
+                skb->dev = dev;
+        }
+        return skb;
+}
 
 static void skb_drop_list(struct sk_buff **listp)
 {
@@ -846,7 +864,11 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len)
             unlikely((err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC))))
                 return err;
 
-        for (i = 0; i < nfrags; i++) {
+        i = 0;
+        if (offset >= len)
+                goto drop_pages;
+
+        for (; i < nfrags; i++) {
                 int end = offset + skb_shinfo(skb)->frags[i].size;
 
                 if (end < len) {
@@ -854,9 +876,9 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len)
                         continue;
                 }
 
-                if (len > offset)
-                        skb_shinfo(skb)->frags[i++].size = len - offset;
+                skb_shinfo(skb)->frags[i++].size = len - offset;
 
+drop_pages:
                 skb_shinfo(skb)->nr_frags = i;
 
                 for (; i < nfrags; i++)
@@ -864,7 +886,7 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len)
 
                 if (skb_shinfo(skb)->frag_list)
                         skb_drop_fraglist(skb);
-                break;
+                goto done;
         }
 
         for (fragp = &skb_shinfo(skb)->frag_list; (frag = *fragp);
@@ -879,6 +901,7 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len)
                                 return -ENOMEM;
 
                         nfrag->next = frag->next;
+                        kfree_skb(frag);
                         frag = nfrag;
                         *fragp = frag;
                 }
@@ -897,6 +920,7 @@ int ___pskb_trim(struct sk_buff *skb, unsigned int len)
                 break;
         }
 
+done:
         if (len > skb_headlen(skb)) {
                 skb->data_len -= skb->len - len;
                 skb->len       = len;
@@ -2042,6 +2066,7 @@ EXPORT_SYMBOL(__kfree_skb);
 EXPORT_SYMBOL(kfree_skb);
 EXPORT_SYMBOL(__pskb_pull_tail);
 EXPORT_SYMBOL(__alloc_skb);
+EXPORT_SYMBOL(__netdev_alloc_skb);
 EXPORT_SYMBOL(pskb_copy);
 EXPORT_SYMBOL(pskb_expand_head);
 EXPORT_SYMBOL(skb_checksum);
diff --git a/net/core/wireless.c b/net/core/wireless.c
index d2bc72d318f7..de0bde4b51dd 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -82,6 +82,7 @@
 #include <linux/init.h>                 /* for __init */
 #include <linux/if_arp.h>               /* ARPHRD_ETHER */
 #include <linux/etherdevice.h>          /* compare_ether_addr */
+#include <linux/interrupt.h>
 
 #include <linux/wireless.h>             /* Pretty obvious */
 #include <net/iw_handler.h>             /* New driver API */
@@ -1842,6 +1843,18 @@ int wireless_rtnetlink_set(struct net_device *	dev,
  */
 
 #ifdef WE_EVENT_RTNETLINK
+static struct sk_buff_head wireless_nlevent_queue;
+
+static void wireless_nlevent_process(unsigned long data)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_dequeue(&wireless_nlevent_queue)))
+                netlink_broadcast(rtnl, skb, 0, RTNLGRP_LINK, GFP_ATOMIC);
+}
+
+static DECLARE_TASKLET(wireless_nlevent_tasklet, wireless_nlevent_process, 0);
+
 /* ---------------------------------------------------------------- */
 /*
  * Fill a rtnetlink message with our event data.
@@ -1904,8 +1917,17 @@ static inline void rtmsg_iwinfo(struct net_device *	dev,
                 return;
         }
         NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
-        netlink_broadcast(rtnl, skb, 0, RTNLGRP_LINK, GFP_ATOMIC);
+        skb_queue_tail(&wireless_nlevent_queue, skb);
+        tasklet_schedule(&wireless_nlevent_tasklet);
+}
+
+static int __init wireless_nlevent_init(void)
+{
+        skb_queue_head_init(&wireless_nlevent_queue);
+        return 0;
 }
+
+subsys_initcall(wireless_nlevent_init);
 #endif  /* WE_EVENT_RTNETLINK */
 
 /* ---------------------------------------------------------------- */
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9f3d4d7cd0bf..610c722ac27f 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -230,7 +230,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         ipv6_addr_copy(&np->saddr, saddr);
         inet->rcv_saddr = LOOPBACK4_IPV6;
 
-        ip6_dst_store(sk, dst, NULL);
+        __ip6_dst_store(sk, dst, NULL);
 
         icsk->icsk_ext_hdr_len = 0;
         if (np->opt != NULL)
@@ -863,7 +863,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
          * comment in that function for the gory details. -acme
          */
 
-        ip6_dst_store(newsk, dst, NULL);
+        __ip6_dst_store(newsk, dst, NULL);
         newsk->sk_route_caps = dst->dev->features & ~(NETIF_F_IP_CSUM |
                                                       NETIF_F_TSO);
         newdp6 = (struct dccp6_sock *)newsk;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1355614ec11b..743e9fcf7c5a 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -925,8 +925,13 @@ static int dn_route_output_slow(struct dst_entry **pprt, const struct flowi *old
                 for(dev_out = dev_base; dev_out; dev_out = dev_out->next) {
                         if (!dev_out->dn_ptr)
                                 continue;
-                        if (dn_dev_islocal(dev_out, oldflp->fld_src))
-                                break;
+                        if (!dn_dev_islocal(dev_out, oldflp->fld_src))
+                                continue;
+                        if ((dev_out->flags & IFF_LOOPBACK) &&
+                            oldflp->fld_dst &&
+                            !dn_dev_islocal(dev_out, oldflp->fld_dst))
+                                continue;
+                        break;
                 }
                 read_unlock(&dev_base_lock);
                 if (dev_out == NULL)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7c9f9a6421b8..4c20f5546893 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -526,6 +526,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
 
                         err = output(skb);
 
+                        if (!err)
+                                IP_INC_STATS(IPSTATS_MIB_FRAGCREATES);
                         if (err || !frag)
                                 break;
 
@@ -649,9 +651,6 @@ slow_path:
                 /*
                  *      Put this fragment into the sending queue.
                  */
-
-                IP_INC_STATS(IPSTATS_MIB_FRAGCREATES);
-
                 iph->tot_len = htons(len + hlen);
 
                 ip_send_check(iph);
@@ -659,6 +658,8 @@ slow_path:
                 err = output(skb2);
                 if (err)
                         goto fail;
+
+                IP_INC_STATS(IPSTATS_MIB_FRAGCREATES);
         }
         kfree_skb(skb);
         IP_INC_STATS(IPSTATS_MIB_FRAGOKS);
@@ -946,7 +947,7 @@ alloc_new_skb:
                                 skb_prev->csum = csum_sub(skb_prev->csum,
                                                           skb->csum);
                                 data += fraggap;
-                                skb_trim(skb_prev, maxfraglen);
+                                pskb_trim_unique(skb_prev, maxfraglen);
                         }
 
                         copy = datalen - transhdrlen - fraggap;
@@ -1141,7 +1142,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
                                         data, fraggap, 0);
                                 skb_prev->csum = csum_sub(skb_prev->csum,
                                                           skb->csum);
-                                skb_trim(skb_prev, maxfraglen);
+                                pskb_trim_unique(skb_prev, maxfraglen);
                         }
 
                         /*
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 84f43a3c9098..2d05c4133d3e 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -112,14 +112,19 @@ static void ip_cmsg_recv_retopts(struct msghdr *msg, struct sk_buff *skb)
 static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
 {
         char *secdata;
-        u32 seclen;
+        u32 seclen, secid;
         int err;
 
-        err = security_socket_getpeersec_dgram(skb, &secdata, &seclen);
+        err = security_socket_getpeersec_dgram(NULL, skb, &secid);
+        if (err)
+                return;
+
+        err = security_secid_to_secctx(secid, &secdata, &seclen);
         if (err)
                 return;
 
         put_cmsg(msg, SOL_IP, SCM_SECURITY, seclen, secdata);
+        security_release_secctx(secdata, seclen);
 }
 
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 80c73ca90116..df4854cf598b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1170,21 +1170,34 @@ static int __init arp_tables_init(void)
 {
         int ret;
 
-        xt_proto_init(NF_ARP);
+        ret = xt_proto_init(NF_ARP);
+        if (ret < 0)
+                goto err1;
 
         /* Noone else will be downing sem now, so we won't sleep */
-        xt_register_target(&arpt_standard_target);
-        xt_register_target(&arpt_error_target);
+        ret = xt_register_target(&arpt_standard_target);
+        if (ret < 0)
+                goto err2;
+        ret = xt_register_target(&arpt_error_target);
+        if (ret < 0)
+                goto err3;
 
         /* Register setsockopt */
         ret = nf_register_sockopt(&arpt_sockopts);
-        if (ret < 0) {
-                duprintf("Unable to register sockopts.\n");
-                return ret;
-        }
+        if (ret < 0)
+                goto err4;
 
         printk("arp_tables: (C) 2002 David S. Miller\n");
         return 0;
+
+err4:
+        xt_unregister_target(&arpt_error_target);
+err3:
+        xt_unregister_target(&arpt_standard_target);
+err2:
+        xt_proto_fini(NF_ARP);
+err1:
+        return ret;
 }
 
 static void __exit arp_tables_fini(void)
diff --git a/net/ipv4/netfilter/ip_conntrack_sip.c b/net/ipv4/netfilter/ip_conntrack_sip.c
index fc87ce0da40d..4f222d6be009 100644
--- a/net/ipv4/netfilter/ip_conntrack_sip.c
+++ b/net/ipv4/netfilter/ip_conntrack_sip.c
@@ -442,7 +442,7 @@ static int __init init(void)
                 sip[i].tuple.src.u.udp.port = htons(ports[i]);
                 sip[i].mask.src.u.udp.port = 0xFFFF;
                 sip[i].mask.dst.protonum = 0xFF;
-                sip[i].max_expected = 1;
+                sip[i].max_expected = 2;
                 sip[i].timeout = 3 * 60; /* 3 minutes */
                 sip[i].me = THIS_MODULE;
                 sip[i].help = sip_help;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index fc5bdd5eb7d3..f316ff5fd8a6 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2239,22 +2239,39 @@ static int __init ip_tables_init(void)
 {
         int ret;
 
-        xt_proto_init(AF_INET);
+        ret = xt_proto_init(AF_INET);
+        if (ret < 0)
+                goto err1;
 
         /* Noone else will be downing sem now, so we won't sleep */
-        xt_register_target(&ipt_standard_target);
-        xt_register_target(&ipt_error_target);
-        xt_register_match(&icmp_matchstruct);
+        ret = xt_register_target(&ipt_standard_target);
+        if (ret < 0)
+                goto err2;
+        ret = xt_register_target(&ipt_error_target);
+        if (ret < 0)
+                goto err3;
+        ret = xt_register_match(&icmp_matchstruct);
+        if (ret < 0)
+                goto err4;
 
         /* Register setsockopt */
         ret = nf_register_sockopt(&ipt_sockopts);
-        if (ret < 0) {
-                duprintf("Unable to register sockopts.\n");
-                return ret;
-        }
+        if (ret < 0)
+                goto err5;
 
         printk("ip_tables: (C) 2000-2006 Netfilter Core Team\n");
         return 0;
+
+err5:
+        xt_unregister_match(&icmp_matchstruct);
+err4:
+        xt_unregister_target(&ipt_error_target);
+err3:
+        xt_unregister_target(&ipt_standard_target);
+err2:
+        xt_proto_fini(AF_INET);
+err1:
+        return ret;
 }
 
 static void __exit ip_tables_fini(void)
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index d7dd7fe7051c..d46fd677fa11 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -115,6 +115,11 @@ static void ulog_send(unsigned int nlgroupnum)
                 del_timer(&ub->timer);
         }
 
+        if (!ub->skb) {
+                DEBUGP("ipt_ULOG: ulog_send: nothing to send\n");
+                return;
+        }
+
         /* last nlmsg needs NLMSG_DONE */
         if (ub->qlen > 1)
                 ub->lastnlh->nlmsg_type = NLMSG_DONE;
diff --git a/net/ipv4/netfilter/ipt_hashlimit.c b/net/ipv4/netfilter/ipt_hashlimit.c
index 92980ab8ce48..3bd2368e1fc9 100644
--- a/net/ipv4/netfilter/ipt_hashlimit.c
+++ b/net/ipv4/netfilter/ipt_hashlimit.c
@@ -454,15 +454,12 @@ hashlimit_match(const struct sk_buff *skb,
                 dh->rateinfo.credit_cap = user2credits(hinfo->cfg.avg * 
                                                         hinfo->cfg.burst);
                 dh->rateinfo.cost = user2credits(hinfo->cfg.avg);
-
-                spin_unlock_bh(&hinfo->lock);
-                return 1;
+        } else {
+                /* update expiration timeout */
+                dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
+                rateinfo_recalc(dh, now);
         }
 
-        /* update expiration timeout */
-        dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
-
-        rateinfo_recalc(dh, now);
         if (dh->rateinfo.credit >= dh->rateinfo.cost) {
                 /* We're underlimit. */
                 dh->rateinfo.credit -= dh->rateinfo.cost;
@@ -508,6 +505,9 @@ hashlimit_checkentry(const char *tablename,
         if (!r->cfg.expire)
                 return 0;
 
+        if (r->name[sizeof(r->name) - 1] != '\0')
+                return 0;
+
         /* This is the best we've got: We cannot release and re-grab lock,
          * since checkentry() is called before ip_tables.c grabs ipt_mutex.  
          * We also cannot grab the hashtable spinlock, since htable_create will 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 2dc6dbb28467..b873cbcdd0b8 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -104,6 +104,7 @@
 #include <net/icmp.h>
 #include <net/xfrm.h>
 #include <net/ip_mp_alg.h>
+#include <net/netevent.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -1125,6 +1126,7 @@ void ip_rt_redirect(u32 old_gw, u32 daddr, u32 new_gw,
         struct rtable *rth, **rthp;
         u32  skeys[2] = { saddr, 0 };
         int  ikeys[2] = { dev->ifindex, 0 };
+        struct netevent_redirect netevent;
 
         if (!in_dev)
                 return;
@@ -1216,6 +1218,11 @@ void ip_rt_redirect(u32 old_gw, u32 daddr, u32 new_gw,
                                         rt_drop(rt);
                                         goto do_next;
                                 }
+                                
+                                netevent.old = &rth->u.dst;
+                                netevent.new = &rt->u.dst;
+                                call_netevent_notifiers(NETEVENT_REDIRECT, 
+                                                        &netevent);
 
                                 rt_del(hash, rth);
                                 if (!rt_intern_hash(hash, rt, &rt))
@@ -1452,6 +1459,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
                 }
                 dst->metrics[RTAX_MTU-1] = mtu;
                 dst_set_expires(dst, ip_rt_mtu_expires);
+                call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
         }
 }
 
@@ -3149,7 +3157,7 @@ int __init ip_rt_init(void)
                                         rhash_entries,
                                         (num_physpages >= 128 * 1024) ?
                                         15 : 17,
-                                        HASH_HIGHMEM,
+                                        0,
                                         &rt_hash_log,
                                         &rt_hash_mask,
                                         0);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f6a2d9223d07..934396bb1376 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1132,7 +1132,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         tp->ucopy.dma_chan = NULL;
         preempt_disable();
         if ((len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
-            !sysctl_tcp_low_latency && __get_cpu_var(softnet_data.net_dma)) {
+            !sysctl_tcp_low_latency && __get_cpu_var(softnet_data).net_dma) {
                 preempt_enable_no_resched();
                 tp->ucopy.pinned_list = dma_pin_iovec_pages(msg->msg_iov, len);
         } else
@@ -1659,7 +1659,8 @@ adjudge_to_death:
                         const int tmo = tcp_fin_time(sk);
 
                         if (tmo > TCP_TIMEWAIT_LEN) {
-                                inet_csk_reset_keepalive_timer(sk, tcp_fin_time(sk));
+                                inet_csk_reset_keepalive_timer(sk,
+                                                tmo - TCP_TIMEWAIT_LEN);
                         } else {
                                 tcp_time_wait(sk, TCP_FIN_WAIT2, tmo);
                                 goto out;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 738dad9f7d49..104af5d5bcbc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3541,7 +3541,8 @@ void tcp_cwnd_application_limited(struct sock *sk)
         if (inet_csk(sk)->icsk_ca_state == TCP_CA_Open &&
             sk->sk_socket && !test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
                 /* Limited by application or receiver window. */
-                u32 win_used = max(tp->snd_cwnd_used, 2U);
+                u32 init_win = tcp_init_cwnd(tp, __sk_dst_get(sk));
+                u32 win_used = max(tp->snd_cwnd_used, init_win);
                 if (win_used < tp->snd_cwnd) {
                         tp->snd_ssthresh = tcp_current_ssthresh(sk);
                         tp->snd_cwnd = (tp->snd_cwnd + win_used) >> 1;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index f6f39e814291..4b04c3edd4a9 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -438,7 +438,6 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                                It can f.e. if SYNs crossed.
                              */
                 if (!sock_owned_by_user(sk)) {
-                        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
                         sk->sk_err = err;
 
                         sk->sk_error_report(sk);
@@ -874,7 +873,6 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 drop_and_free:
         reqsk_free(req);
 drop:
-        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
         return 0;
 }
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 0ccb7cb22b15..624e2b2c7f53 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -589,8 +589,10 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                 /* RFC793: "second check the RST bit" and
                  *         "fourth, check the SYN bit"
                  */
-                if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN))
+                if (flg & (TCP_FLAG_RST|TCP_FLAG_SYN)) {
+                        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
                         goto embryonic_reset;
+                }
 
                 /* ACK sequence verified above, just make sure ACK is
                  * set.  If ACK not set, just silently drop the packet.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5c08ea20a18d..507adefbc17c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -466,7 +466,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         if (skb->len != tcp_header_size)
                 tcp_event_data_sent(tp, skb, sk);
 
-        TCP_INC_STATS(TCP_MIB_OUTSEGS);
+        if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
+                TCP_INC_STATS(TCP_MIB_OUTSEGS);
 
         err = icsk->icsk_af_ops->queue_xmit(skb, 0);
         if (likely(err <= 0))
@@ -2157,10 +2158,9 @@ int tcp_connect(struct sock *sk)
         skb_shinfo(buff)->gso_size = 0;
         skb_shinfo(buff)->gso_type = 0;
         buff->csum = 0;
+        tp->snd_nxt = tp->write_seq;
         TCP_SKB_CB(buff)->seq = tp->write_seq++;
         TCP_SKB_CB(buff)->end_seq = tp->write_seq;
-        tp->snd_nxt = tp->write_seq;
-        tp->pushed_seq = tp->write_seq;
 
         /* Send it off. */
         TCP_SKB_CB(buff)->when = tcp_time_stamp;
@@ -2170,6 +2170,12 @@ int tcp_connect(struct sock *sk)
         sk_charge_skb(sk, buff);
         tp->packets_out += tcp_skb_pcount(buff);
         tcp_transmit_skb(sk, buff, 1, GFP_KERNEL);
+
+        /* We change tp->snd_nxt after the tcp_transmit_skb() call
+         * in order to make this packet get counted in tcpOutSegs.
+         */
+        tp->snd_nxt = tp->write_seq;
+        tp->pushed_seq = tp->write_seq;
         TCP_INC_STATS(TCP_MIB_ACTIVEOPENS);
 
         /* Timer for repeating the SYN until an answer. */
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index d7d517a3a238..dab37d2f65fc 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -114,7 +114,7 @@ static int tcpprobe_open(struct inode * inode, struct file * file)
 static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                              size_t len, loff_t *ppos)
 {
-        int error = 0, cnt;
+        int error = 0, cnt = 0;
         unsigned char *tbuf;
 
         if (!buf || len < 0)
@@ -130,11 +130,12 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
         error = wait_event_interruptible(tcpw.wait,
                                          __kfifo_len(tcpw.fifo) != 0);
         if (error)
-                return error;
+                goto out_free;
 
         cnt = kfifo_get(tcpw.fifo, tbuf, len);
         error = copy_to_user(buf, tbuf, cnt);
 
+out_free:
         vfree(tbuf);
 
         return error ? error : cnt;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2316a4315a18..0c5042e7380d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1869,15 +1869,21 @@ err_exit:
 /*
  *      Manual configuration of address on an interface
  */
-static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen)
+static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen,
+                          __u32 prefered_lft, __u32 valid_lft)
 {
         struct inet6_ifaddr *ifp;
         struct inet6_dev *idev;
         struct net_device *dev;
+        __u8 ifa_flags = 0;
         int scope;
 
         ASSERT_RTNL();
         
+        /* check the lifetime */
+        if (!valid_lft || prefered_lft > valid_lft)
+                return -EINVAL;
+
         if ((dev = __dev_get_by_index(ifindex)) == NULL)
                 return -ENODEV;
         
@@ -1889,10 +1895,29 @@ static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen)
 
         scope = ipv6_addr_scope(pfx);
 
-        ifp = ipv6_add_addr(idev, pfx, plen, scope, IFA_F_PERMANENT);
+        if (valid_lft == INFINITY_LIFE_TIME)
+                ifa_flags |= IFA_F_PERMANENT;
+        else if (valid_lft >= 0x7FFFFFFF/HZ)
+                valid_lft = 0x7FFFFFFF/HZ;
+
+        if (prefered_lft == 0)
+                ifa_flags |= IFA_F_DEPRECATED;
+        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                 (prefered_lft != INFINITY_LIFE_TIME))
+                prefered_lft = 0x7FFFFFFF/HZ;
+
+        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
+
         if (!IS_ERR(ifp)) {
+                spin_lock_bh(&ifp->lock);
+                ifp->valid_lft = valid_lft;
+                ifp->prefered_lft = prefered_lft;
+                ifp->tstamp = jiffies;
+                spin_unlock_bh(&ifp->lock);
+
                 addrconf_dad_start(ifp, 0);
                 in6_ifa_put(ifp);
+                addrconf_verify(0);
                 return 0;
         }
 
@@ -1945,7 +1970,8 @@ int addrconf_add_ifaddr(void __user *arg)
                 return -EFAULT;
 
         rtnl_lock();
-        err = inet6_addr_add(ireq.ifr6_ifindex, &ireq.ifr6_addr, ireq.ifr6_prefixlen);
+        err = inet6_addr_add(ireq.ifr6_ifindex, &ireq.ifr6_addr, ireq.ifr6_prefixlen,
+                             INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
         rtnl_unlock();
         return err;
 }
@@ -2771,12 +2797,16 @@ restart:
                                         ifp->idev->nd_parms->retrans_time / HZ;
 #endif
 
-                        if (age >= ifp->valid_lft) {
+                        if (ifp->valid_lft != INFINITY_LIFE_TIME &&
+                            age >= ifp->valid_lft) {
                                 spin_unlock(&ifp->lock);
                                 in6_ifa_hold(ifp);
                                 read_unlock(&addrconf_hash_lock);
                                 ipv6_del_addr(ifp);
                                 goto restart;
+                        } else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
+                                spin_unlock(&ifp->lock);
+                                continue;
                         } else if (age >= ifp->prefered_lft) {
                                 /* jiffies - ifp->tsamp > age >= ifp->prefered_lft */
                                 int deprecate = 0;
@@ -2853,7 +2883,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
         }
         if (rta[IFA_LOCAL-1]) {
-                if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))
+                if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||
+                    (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))
                         return -EINVAL;
                 pfx = RTA_DATA(rta[IFA_LOCAL-1]);
         }
@@ -2864,11 +2895,61 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 }
 
 static int
+inet6_addr_modify(int ifindex, struct in6_addr *pfx,
+                  __u32 prefered_lft, __u32 valid_lft)
+{
+        struct inet6_ifaddr *ifp = NULL;
+        struct net_device *dev;
+        int ifa_flags = 0;
+
+        if ((dev = __dev_get_by_index(ifindex)) == NULL)
+                return -ENODEV;
+
+        if (!(dev->flags&IFF_UP))
+                return -ENETDOWN;
+
+        if (!valid_lft || (prefered_lft > valid_lft))
+                return -EINVAL;
+
+        ifp = ipv6_get_ifaddr(pfx, dev, 1);
+        if (ifp == NULL)
+                return -ENOENT;
+
+        if (valid_lft == INFINITY_LIFE_TIME)
+                ifa_flags = IFA_F_PERMANENT;
+        else if (valid_lft >= 0x7FFFFFFF/HZ)
+                valid_lft = 0x7FFFFFFF/HZ;
+
+        if (prefered_lft == 0)
+                ifa_flags = IFA_F_DEPRECATED;
+        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                 (prefered_lft != INFINITY_LIFE_TIME))
+                prefered_lft = 0x7FFFFFFF/HZ;
+
+        spin_lock_bh(&ifp->lock);
+        ifp->flags = (ifp->flags & ~(IFA_F_DEPRECATED|IFA_F_PERMANENT)) | ifa_flags;
+
+        ifp->tstamp = jiffies;
+        ifp->valid_lft = valid_lft;
+        ifp->prefered_lft = prefered_lft;
+
+        spin_unlock_bh(&ifp->lock);
+        if (!(ifp->flags&IFA_F_TENTATIVE))
+                ipv6_ifa_notify(0, ifp);
+        in6_ifa_put(ifp);
+
+        addrconf_verify(0);
+
+        return 0;
+}
+
+static int
 inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
         struct rtattr  **rta = arg;
         struct ifaddrmsg *ifm = NLMSG_DATA(nlh);
         struct in6_addr *pfx;
+        __u32 valid_lft = INFINITY_LIFE_TIME, prefered_lft = INFINITY_LIFE_TIME;
 
         pfx = NULL;
         if (rta[IFA_ADDRESS-1]) {
@@ -2877,14 +2958,34 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
                 pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
         }
         if (rta[IFA_LOCAL-1]) {
-                if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))
+                if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||
+                    (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))
                         return -EINVAL;
                 pfx = RTA_DATA(rta[IFA_LOCAL-1]);
         }
         if (pfx == NULL)
                 return -EINVAL;
 
-        return inet6_addr_add(ifm->ifa_index, pfx, ifm->ifa_prefixlen);
+        if (rta[IFA_CACHEINFO-1]) {
+                struct ifa_cacheinfo *ci;
+                if (RTA_PAYLOAD(rta[IFA_CACHEINFO-1]) < sizeof(*ci))
+                        return -EINVAL;
+                ci = RTA_DATA(rta[IFA_CACHEINFO-1]);
+                valid_lft = ci->ifa_valid;
+                prefered_lft = ci->ifa_prefered;
+        }
+
+        if (nlh->nlmsg_flags & NLM_F_REPLACE) {
+                int ret;
+                ret = inet6_addr_modify(ifm->ifa_index, pfx,
+                                        prefered_lft, valid_lft);
+                if (ret == 0 || !(nlh->nlmsg_flags & NLM_F_CREATE))
+                        return ret;
+        }
+
+        return inet6_addr_add(ifm->ifa_index, pfx, ifm->ifa_prefixlen,
+                              prefered_lft, valid_lft);
+
 }
 
 /* Maximum length of ifa_cacheinfo attributes */
@@ -3121,6 +3222,62 @@ static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
         return inet6_dump_addr(skb, cb, type);
 }
 
+static int inet6_rtm_getaddr(struct sk_buff *in_skb,
+                struct nlmsghdr* nlh, void *arg)
+{
+        struct rtattr **rta = arg;
+        struct ifaddrmsg *ifm = NLMSG_DATA(nlh);
+        struct in6_addr *addr = NULL;
+        struct net_device *dev = NULL;
+        struct inet6_ifaddr *ifa;
+        struct sk_buff *skb;
+        int size = NLMSG_SPACE(sizeof(struct ifaddrmsg) + INET6_IFADDR_RTA_SPACE);
+        int err;
+
+        if (rta[IFA_ADDRESS-1]) {
+                if (RTA_PAYLOAD(rta[IFA_ADDRESS-1]) < sizeof(*addr))
+                        return -EINVAL;
+                addr = RTA_DATA(rta[IFA_ADDRESS-1]);
+        }
+        if (rta[IFA_LOCAL-1]) {
+                if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*addr) ||
+                    (addr && memcmp(addr, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*addr))))
+                        return -EINVAL;
+                addr = RTA_DATA(rta[IFA_LOCAL-1]);
+        }
+        if (addr == NULL)
+                return -EINVAL;
+
+        if (ifm->ifa_index)
+                dev = __dev_get_by_index(ifm->ifa_index);
+
+        if ((ifa = ipv6_get_ifaddr(addr, dev, 1)) == NULL)
+                return -EADDRNOTAVAIL;
+
+        if ((skb = alloc_skb(size, GFP_KERNEL)) == NULL) {
+                err = -ENOBUFS;
+                goto out;
+        }
+
+        NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid;
+        err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).pid,
+                                nlh->nlmsg_seq, RTM_NEWADDR, 0);
+        if (err < 0) {
+                err = -EMSGSIZE;
+                goto out_free;
+        }
+
+        err = netlink_unicast(rtnl, skb, NETLINK_CB(in_skb).pid, MSG_DONTWAIT);
+        if (err > 0)
+                err = 0;
+out:
+        in6_ifa_put(ifa);
+        return err;
+out_free:
+        kfree_skb(skb);
+        goto out;
+}
+
 static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
 {
         struct sk_buff *skb;
@@ -3363,7 +3520,8 @@ static struct rtnetlink_link inet6_rtnetlink_table[RTM_NR_MSGTYPES] = {
         [RTM_GETLINK - RTM_BASE] = { .dumpit    = inet6_dump_ifinfo, },
         [RTM_NEWADDR - RTM_BASE] = { .doit      = inet6_rtm_newaddr, },
         [RTM_DELADDR - RTM_BASE] = { .doit      = inet6_rtm_deladdr, },
-        [RTM_GETADDR - RTM_BASE] = { .dumpit    = inet6_dump_ifaddr, },
+        [RTM_GETADDR - RTM_BASE] = { .doit      = inet6_rtm_getaddr,
+                                     .dumpit    = inet6_dump_ifaddr, },
         [RTM_GETMULTICAST - RTM_BASE] = { .dumpit = inet6_dump_ifmcaddr, },
         [RTM_GETANYCAST - RTM_BASE] = { .dumpit = inet6_dump_ifacaddr, },
         [RTM_NEWROUTE - RTM_BASE] = { .doit     = inet6_rtm_newroute, },
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 5a0ba58b86cc..ac85e9c532c2 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -658,7 +658,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                         return err;
                 }
 
-                ip6_dst_store(sk, dst, NULL);
+                __ip6_dst_store(sk, dst, NULL);
         }
 
         return 0;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 5c950cc79d80..bf491077b822 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -185,7 +185,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
                         return err;
                 }
 
-                ip6_dst_store(sk, dst, NULL);
+                __ip6_dst_store(sk, dst, NULL);
         }
 
         skb->dst = dst_clone(dst);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3bc74ce78800..4fb47a252913 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -356,6 +356,7 @@ int ip6_forward(struct sk_buff *skb)
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
                             0, skb->dev);
+                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 
                 kfree_skb(skb);
                 return -ETIMEDOUT;
@@ -595,6 +596,9 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         }
                         
                         err = output(skb);
+                        if(!err)
+                                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
+
                         if (err || !frag)
                                 break;
 
@@ -706,12 +710,11 @@ slow_path:
                 /*
                  *      Put this fragment into the sending queue.
                  */
-
-                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
-
                 err = output(frag);
                 if (err)
                         goto fail;
+
+                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
         }
         kfree_skb(skb);
         IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
@@ -723,48 +726,51 @@ fail:
         return err;
 }
 
-int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
+                                          struct dst_entry *dst,
+                                          struct flowi *fl)
 {
-        int err = 0;
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct rt6_info *rt = (struct rt6_info *)dst;
 
-        *dst = NULL;
-        if (sk) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
-        
-                *dst = sk_dst_check(sk, np->dst_cookie);
-                if (*dst) {
-                        struct rt6_info *rt = (struct rt6_info*)*dst;
-        
-                        /* Yes, checking route validity in not connected
-                         * case is not very simple. Take into account,
-                         * that we do not support routing by source, TOS,
-                         * and MSG_DONTROUTE            --ANK (980726)
-                         *
-                         * 1. If route was host route, check that
-                         *    cached destination is current.
-                         *    If it is network route, we still may
-                         *    check its validity using saved pointer
-                         *    to the last used address: daddr_cache.
-                         *    We do not want to save whole address now,
-                         *    (because main consumer of this service
-                         *    is tcp, which has not this problem),
-                         *    so that the last trick works only on connected
-                         *    sockets.
-                         * 2. oif also should be the same.
-                         */
-                        if (((rt->rt6i_dst.plen != 128 ||
-                              !ipv6_addr_equal(&fl->fl6_dst,
-                                               &rt->rt6i_dst.addr))
-                             && (np->daddr_cache == NULL ||
-                                 !ipv6_addr_equal(&fl->fl6_dst,
-                                                  np->daddr_cache)))
-                            || (fl->oif && fl->oif != (*dst)->dev->ifindex)) {
-                                dst_release(*dst);
-                                *dst = NULL;
-                        }
-                }
+        if (!dst)
+                goto out;
+
+        /* Yes, checking route validity in not connected
+         * case is not very simple. Take into account,
+         * that we do not support routing by source, TOS,
+         * and MSG_DONTROUTE            --ANK (980726)
+         *
+         * 1. If route was host route, check that
+         *    cached destination is current.
+         *    If it is network route, we still may
+         *    check its validity using saved pointer
+         *    to the last used address: daddr_cache.
+         *    We do not want to save whole address now,
+         *    (because main consumer of this service
+         *    is tcp, which has not this problem),
+         *    so that the last trick works only on connected
+         *    sockets.
+         * 2. oif also should be the same.
+         */
+        if (((rt->rt6i_dst.plen != 128 ||
+              !ipv6_addr_equal(&fl->fl6_dst, &rt->rt6i_dst.addr))
+             && (np->daddr_cache == NULL ||
+                 !ipv6_addr_equal(&fl->fl6_dst, np->daddr_cache)))
+            || (fl->oif && fl->oif != dst->dev->ifindex)) {
+                dst_release(dst);
+                dst = NULL;
         }
 
+out:
+        return dst;
+}
+
+static int ip6_dst_lookup_tail(struct sock *sk,
+                               struct dst_entry **dst, struct flowi *fl)
+{
+        int err;
+
         if (*dst == NULL)
                 *dst = ip6_route_output(sk, fl);
 
@@ -773,7 +779,6 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
 
         if (ipv6_addr_any(&fl->fl6_src)) {
                 err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
-
                 if (err)
                         goto out_err_release;
         }
@@ -786,8 +791,48 @@ out_err_release:
         return err;
 }
 
+/**
+ *      ip6_dst_lookup - perform route lookup on flow
+ *      @sk: socket which provides route info
+ *      @dst: pointer to dst_entry * for result
+ *      @fl: flow to lookup
+ *
+ *      This function performs a route lookup on the given flow.
+ *
+ *      It returns zero on success, or a standard errno code on error.
+ */
+int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+{
+        *dst = NULL;
+        return ip6_dst_lookup_tail(sk, dst, fl);
+}
 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 
+/**
+ *      ip6_sk_dst_lookup - perform socket cached route lookup on flow
+ *      @sk: socket which provides the dst cache and route info
+ *      @dst: pointer to dst_entry * for result
+ *      @fl: flow to lookup
+ *
+ *      This function performs a route lookup on the given flow with the
+ *      possibility of using the cached route in the socket if it is valid.
+ *      It will take the socket dst lock when operating on the dst cache.
+ *      As a result, this function can only be used in process context.
+ *
+ *      It returns zero on success, or a standard errno code on error.
+ */
+int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+{
+        *dst = NULL;
+        if (sk) {
+                *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
+                *dst = ip6_sk_dst_check(sk, *dst, fl);
+        }
+
+        return ip6_dst_lookup_tail(sk, dst, fl);
+}
+EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
+
 static inline int ip6_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
                         int odd, struct sk_buff *skb),
@@ -1050,7 +1095,7 @@ alloc_new_skb:
                                 skb_prev->csum = csum_sub(skb_prev->csum,
                                                           skb->csum);
                                 data += fraggap;
-                                skb_trim(skb_prev, maxfraglen);
+                                pskb_trim_unique(skb_prev, maxfraglen);
                         }
                         copy = datalen - transhdrlen - fraggap;
                         if (copy < 0) {
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index f26898b00347..c9d6b23cd3f7 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1398,23 +1398,39 @@ static int __init ip6_tables_init(void)
 {
         int ret;
 
-        xt_proto_init(AF_INET6);
+        ret = xt_proto_init(AF_INET6);
+        if (ret < 0)
+                goto err1;
 
         /* Noone else will be downing sem now, so we won't sleep */
-        xt_register_target(&ip6t_standard_target);
-        xt_register_target(&ip6t_error_target);
-        xt_register_match(&icmp6_matchstruct);
+        ret = xt_register_target(&ip6t_standard_target);
+        if (ret < 0)
+                goto err2;
+        ret = xt_register_target(&ip6t_error_target);
+        if (ret < 0)
+                goto err3;
+        ret = xt_register_match(&icmp6_matchstruct);
+        if (ret < 0)
+                goto err4;
 
         /* Register setsockopt */
         ret = nf_register_sockopt(&ip6t_sockopts);
-        if (ret < 0) {
-                duprintf("Unable to register sockopts.\n");
-                xt_proto_fini(AF_INET6);
-                return ret;
-        }
+        if (ret < 0)
+                goto err5;
 
         printk("ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
         return 0;
+
+err5:
+        xt_unregister_match(&icmp6_matchstruct);
+err4:
+        xt_unregister_target(&ip6t_error_target);
+err3:
+        xt_unregister_target(&ip6t_standard_target);
+err2:
+        xt_proto_fini(AF_INET6);
+err1:
+        return ret;
 }
 
 static void __exit ip6_tables_fini(void)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 87c39c978cd0..4b163711f3a8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -53,6 +53,7 @@
 #include <linux/rtnetlink.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
+#include <net/netevent.h>
 
 #include <asm/uaccess.h>
 
@@ -742,6 +743,7 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
                         dst->metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
                 }
                 dst->metrics[RTAX_MTU-1] = mtu;
+                call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
         }
 }
 
@@ -1155,6 +1157,7 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *saddr,
         struct rt6_info *rt, *nrt = NULL;
         int strict;
         struct fib6_node *fn;
+        struct netevent_redirect netevent;
 
         /*
          * Get the "current" route for this destination and
@@ -1252,6 +1255,10 @@ restart:
         if (ip6_ins_rt(nrt, NULL, NULL, NULL))
                 goto out;
 
+        netevent.old = &rt->u.dst;
+        netevent.new = &nrt->u.dst;
+        call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
+
         if (rt->rt6i_flags&RTF_CACHE) {
                 ip6_del_rt(rt, NULL, NULL, NULL);
                 return;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 923989d0520d..b843a650be71 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -270,7 +270,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         inet->rcv_saddr = LOOPBACK4_IPV6;
 
         sk->sk_gso_type = SKB_GSO_TCPV6;
-        ip6_dst_store(sk, dst, NULL);
+        __ip6_dst_store(sk, dst, NULL);
 
         icsk->icsk_ext_hdr_len = 0;
         if (np->opt)
@@ -427,7 +427,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         case TCP_SYN_RECV:  /* Cannot happen.
                                It can, it SYNs are crossed. --ANK */ 
                 if (!sock_owned_by_user(sk)) {
-                        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
                         sk->sk_err = err;
                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 
@@ -831,7 +830,6 @@ drop:
         if (req)
                 reqsk_free(req);
 
-        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
         return 0; /* don't send reset */
 }
 
@@ -947,7 +945,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
          */
 
         sk->sk_gso_type = SKB_GSO_TCPV6;
-        ip6_dst_store(newsk, dst, NULL);
+        __ip6_dst_store(newsk, dst, NULL);
 
         newtcp6sk = (struct tcp6_sock *)newsk;
         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index ccc57f434cd3..3d54f246411e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -782,7 +782,7 @@ do_udp_sendmsg:
                 connected = 0;
         }
 
-        err = ip6_dst_lookup(sk, &dst, fl);
+        err = ip6_sk_dst_lookup(sk, &dst, fl);
         if (err)
                 goto out;
         if (final_p)
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 0eea60ea9ebc..c8c8b44a0f58 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -125,7 +125,7 @@ static int xfrm6_output_finish(struct sk_buff *skb)
         if (!skb_is_gso(skb))
                 return xfrm6_output_finish2(skb);
 
-        skb->protocol = htons(ETH_P_IP);
+        skb->protocol = htons(ETH_P_IPV6);
         segs = skb_gso_segment(skb, 0);
         kfree_skb(skb);
         if (unlikely(IS_ERR(segs)))
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index aa34ff4b707c..bef3f61569f7 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1642,13 +1642,17 @@ static int ipx_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty
         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
                 goto out;
 
-        ipx             = ipx_hdr(skb);
-        ipx_pktsize     = ntohs(ipx->ipx_pktsize);
+        if (!pskb_may_pull(skb, sizeof(struct ipxhdr)))
+                goto drop;
+
+        ipx_pktsize = ntohs(ipx_hdr(skb)->ipx_pktsize);
         
         /* Too small or invalid header? */
-        if (ipx_pktsize < sizeof(struct ipxhdr) || ipx_pktsize > skb->len)
+        if (ipx_pktsize < sizeof(struct ipxhdr) ||
+            !pskb_may_pull(skb, ipx_pktsize))
                 goto drop;
                         
+        ipx = ipx_hdr(skb);
         if (ipx->ipx_checksum != IPX_NO_CHECKSUM &&
            ipx->ipx_checksum != ipx_cksum(ipx, ipx_pktsize))
                 goto drop;
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index d504eed416f6..7e6bc41eeb21 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -238,11 +238,13 @@ int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms)
                 goto out_put;
 
         if (lapb->state == LAPB_STATE_0) {
-                if (((parms->mode & LAPB_EXTENDED) &&
-                     (parms->window < 1 || parms->window > 127)) ||
-                    (parms->window < 1 || parms->window > 7))
-                        goto out_put;
-
+                if (parms->mode & LAPB_EXTENDED) {
+                        if (parms->window < 1 || parms->window > 127)
+                                goto out_put;
+                } else {
+                        if (parms->window < 1 || parms->window > 7)
+                                goto out_put;
+                }
                 lapb->mode    = parms->mode;
                 lapb->window  = parms->window;
         }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index d6cfe84d521b..2652ead96c64 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -784,24 +784,20 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                 copied += used;
                 len -= used;
 
-                if (used + offset < skb->len)
-                        continue;
-
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, 0);
                         *seq = 0;
                 }
+
+                /* For non stream protcols we get one packet per recvmsg call */
+                if (sk->sk_type != SOCK_STREAM)
+                        goto copy_uaddr;
+
+                /* Partial read */
+                if (used + offset < skb->len)
+                        continue;
         } while (len > 0);
 
-        /* 
-         * According to UNIX98, msg_name/msg_namelen are ignored
-         * on connected socket. -ANK
-         * But... af_llc still doesn't have separate sets of methods for
-         * SOCK_DGRAM and SOCK_STREAM :-( So we have to do this test, will
-         * eventually fix this tho :-) -acme
-         */
-        if (sk->sk_type == SOCK_DGRAM)
-                goto copy_uaddr;
 out:
         release_sock(sk);
         return copied;
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 20c4eb5c1ac6..61cb8cf7d153 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -51,10 +51,10 @@ void llc_save_primitive(struct sock *sk, struct sk_buff* skb, u8 prim)
 {
         struct sockaddr_llc *addr;
 
-        if (skb->sk->sk_type == SOCK_STREAM) /* See UNIX98 */
-                return;
        /* save primitive for use by the user. */
         addr              = llc_ui_skb_cb(skb);
+
+        memset(addr, 0, sizeof(*addr));
         addr->sllc_family = sk->sk_family;
         addr->sllc_arphrd = skb->dev->type;
         addr->sllc_test   = prim == LLC_TEST_PRIM;
@@ -330,6 +330,9 @@ static void llc_sap_mcast(struct llc_sap *sap,
                 if (llc->laddr.lsap != laddr->lsap)
                         continue;
 
+                if (llc->dev != skb->dev)
+                        continue;
+
                 skb1 = skb_clone(skb, GFP_ATOMIC);
                 if (!skb1)
                         break;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 61cdda4e5d3b..b59d3b2bde21 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -366,6 +366,9 @@ __nfulnl_send(struct nfulnl_instance *inst)
         if (timer_pending(&inst->timer))
                 del_timer(&inst->timer);
 
+        if (!inst->skb)
+                return 0;
+
         if (inst->qlen > 1)
                 inst->lastnlh->nlmsg_type = NLMSG_DONE;
 
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index c2ce9c4011cc..de9537ad9a7c 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -57,6 +57,8 @@ static int checkentry_selinux(struct xt_secmark_target_info *info)
 {
         int err;
         struct xt_secmark_target_selinux_info *sel = &info->u.sel;
+        
+        sel->selctx[SECMARK_SELCTX_MAX - 1] = '\0';
 
         err = selinux_string_to_sid(sel->selctx, &sel->selsid);
         if (err) {
diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c
index 0ebb6ac2c8c7..275330fcdaaa 100644
--- a/net/netfilter/xt_string.c
+++ b/net/netfilter/xt_string.c
@@ -37,7 +37,7 @@ static int match(const struct sk_buff *skb,
 
         return (skb_find_text((struct sk_buff *)skb, conf->from_offset, 
                              conf->to_offset, conf->config, &state) 
-                             != UINT_MAX) && !conf->invert;
+                             != UINT_MAX) ^ conf->invert;
 }
 
 #define STRING_TEXT_PRIV(m) ((struct xt_string_info *) m)
@@ -55,7 +55,10 @@ static int checkentry(const char *tablename,
         /* Damn, can't handle this case properly with iptables... */
         if (conf->from_offset > conf->to_offset)
                 return 0;
-
+        if (conf->algo[XT_STRING_MAX_ALGO_NAME_SIZE - 1] != '\0')
+                return 0;
+        if (conf->patlen > XT_STRING_MAX_PATTERN_SIZE)
+                return 0;
         ts_conf = textsearch_prepare(conf->algo, conf->pattern, conf->patlen,
                                      GFP_KERNEL, TS_AUTOLOAD);
         if (IS_ERR(ts_conf))
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c7844bacbbcb..a19eff12cf78 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -430,7 +430,7 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
         }
 #endif
 
-        err = -EINVAL;
+        err = -ENOENT;
         if (ops == NULL)
                 goto err_out;
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 7026b0866b7b..00cb388ece03 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -71,7 +71,12 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
         new = detail->alloc();
         if (!new)
                 return NULL;
+        /* must fully initialise 'new', else
+         * we might get lose if we need to
+         * cache_put it soon.
+         */
         cache_init(new);
+        detail->init(new, key);
 
         write_lock(&detail->hash_lock);
 
@@ -85,7 +90,6 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
                         return tmp;
                 }
         }
-        detail->init(new, key);
         new->next = *head;
         *head = new;
         detail->entries++;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 4ba271f892c8..d6409e757219 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -921,26 +921,43 @@ call_transmit(struct rpc_task *task)
         task->tk_status = xprt_prepare_transmit(task);
         if (task->tk_status != 0)
                 return;
+        task->tk_action = call_transmit_status;
         /* Encode here so that rpcsec_gss can use correct sequence number. */
         if (rpc_task_need_encode(task)) {
-                task->tk_rqstp->rq_bytes_sent = 0;
+                BUG_ON(task->tk_rqstp->rq_bytes_sent != 0);
                 call_encode(task);
                 /* Did the encode result in an error condition? */
                 if (task->tk_status != 0)
-                        goto out_nosend;
+                        return;
         }
-        task->tk_action = call_transmit_status;
         xprt_transmit(task);
         if (task->tk_status < 0)
                 return;
-        if (!task->tk_msg.rpc_proc->p_decode) {
-                task->tk_action = rpc_exit_task;
-                rpc_wake_up_task(task);
-        }
-        return;
-out_nosend:
-        /* release socket write lock before attempting to handle error */
-        xprt_abort_transmit(task);
+        /*
+         * On success, ensure that we call xprt_end_transmit() before sleeping
+         * in order to allow access to the socket to other RPC requests.
+         */
+        call_transmit_status(task);
+        if (task->tk_msg.rpc_proc->p_decode != NULL)
+                return;
+        task->tk_action = rpc_exit_task;
+        rpc_wake_up_task(task);
+}
+
+/*
+ * 5a.  Handle cleanup after a transmission
+ */
+static void
+call_transmit_status(struct rpc_task *task)
+{
+        task->tk_action = call_status;
+        /*
+         * Special case: if we've been waiting on the socket's write_space()
+         * callback, then don't call xprt_end_transmit().
+         */
+        if (task->tk_status == -EAGAIN)
+                return;
+        xprt_end_transmit(task);
         rpc_task_force_reencode(task);
 }
 
@@ -992,18 +1009,7 @@ call_status(struct rpc_task *task)
 }
 
 /*
- * 6a.  Handle transmission errors.
- */
-static void
-call_transmit_status(struct rpc_task *task)
-{
-        if (task->tk_status != -EAGAIN)
-                rpc_task_force_reencode(task);
-        call_status(task);
-}
-
-/*
- * 6b.  Handle RPC timeout
+ * 6a.  Handle RPC timeout
  *      We do not release the request slot, so we keep using the
  *      same XID for all retransmits.
  */
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index dc6cb93c8830..a3bd2db2e024 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -667,10 +667,11 @@ rpc_mkdir(char *path, struct rpc_clnt *rpc_client)
                         RPCAUTH_info, RPCAUTH_EOF);
         if (error)
                 goto err_depopulate;
+        dget(dentry);
 out:
         mutex_unlock(&dir->i_mutex);
         rpc_release_path(&nd);
-        return dget(dentry);
+        return dentry;
 err_depopulate:
         rpc_depopulate(dentry);
         __rpc_rmdir(dir, dentry);
@@ -731,10 +732,11 @@ rpc_mkpipe(char *path, void *private, struct rpc_pipe_ops *ops, int flags)
         rpci->flags = flags;
         rpci->ops = ops;
         inode_dir_notify(dir, DN_CREATE);
+        dget(dentry);
 out:
         mutex_unlock(&dir->i_mutex);
         rpc_release_path(&nd);
-        return dget(dentry);
+        return dentry;
 err_dput:
         dput(dentry);
         dentry = ERR_PTR(-ENOMEM);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 313b68d892c6..e8c2bc4977f3 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -707,12 +707,9 @@ out_unlock:
         return err;
 }
 
-void
-xprt_abort_transmit(struct rpc_task *task)
+void xprt_end_transmit(struct rpc_task *task)
 {
-        struct rpc_xprt *xprt = task->tk_xprt;
-
-        xprt_release_write(xprt, task);
+        xprt_release_write(task->tk_xprt, task);
 }
 
 /**
@@ -761,8 +758,6 @@ void xprt_transmit(struct rpc_task *task)
                         task->tk_status = -ENOTCONN;
                 else if (!req->rq_received)
                         rpc_sleep_on(&xprt->pending, task, NULL, xprt_timer);
-
-                xprt->ops->release_xprt(xprt, task);
                 spin_unlock_bh(&xprt->transport_lock);
                 return;
         }
@@ -772,18 +767,8 @@ void xprt_transmit(struct rpc_task *task)
          *       schedq, and being picked up by a parallel run of rpciod().
          */
         task->tk_status = status;
-
-        switch (status) {
-        case -ECONNREFUSED:
+        if (status == -ECONNREFUSED)
                 rpc_sleep_on(&xprt->sending, task, NULL, NULL);
-        case -EAGAIN:
-        case -ENOTCONN:
-                return;
-        default:
-                break;
-        }
-        xprt_release_write(xprt, task);
-        return;
 }
 
 static inline void do_xprt_reserve(struct rpc_task *task)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index ee678ed13b6f..441bd53f5eca 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -414,6 +414,33 @@ static int xs_tcp_send_request(struct rpc_task *task)
 }
 
 /**
+ * xs_tcp_release_xprt - clean up after a tcp transmission
+ * @xprt: transport
+ * @task: rpc task
+ *
+ * This cleans up if an error causes us to abort the transmission of a request.
+ * In this case, the socket may need to be reset in order to avoid confusing
+ * the server.
+ */
+static void xs_tcp_release_xprt(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+        struct rpc_rqst *req;
+
+        if (task != xprt->snd_task)
+                return;
+        if (task == NULL)
+                goto out_release;
+        req = task->tk_rqstp;
+        if (req->rq_bytes_sent == 0)
+                goto out_release;
+        if (req->rq_bytes_sent == req->rq_snd_buf.len)
+                goto out_release;
+        set_bit(XPRT_CLOSE_WAIT, &task->tk_xprt->state);
+out_release:
+        xprt_release_xprt(xprt, task);
+}
+
+/**
  * xs_close - close a socket
  * @xprt: transport
  *
@@ -1250,7 +1277,7 @@ static struct rpc_xprt_ops xs_udp_ops = {
 
 static struct rpc_xprt_ops xs_tcp_ops = {
         .reserve_xprt           = xprt_reserve_xprt,
-        .release_xprt           = xprt_release_xprt,
+        .release_xprt           = xs_tcp_release_xprt,
         .set_port               = xs_set_port,
         .connect                = xs_connect,
         .buf_alloc              = rpc_malloc,
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6f2909279268..de6ec519272e 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -128,23 +128,17 @@ static atomic_t unix_nr_socks = ATOMIC_INIT(0);
 #define UNIX_ABSTRACT(sk)       (unix_sk(sk)->addr->hash != UNIX_HASH_SIZE)
 
 #ifdef CONFIG_SECURITY_NETWORK
-static void unix_get_peersec_dgram(struct sk_buff *skb)
+static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 {
-        int err;
-
-        err = security_socket_getpeersec_dgram(skb, UNIXSECDATA(skb),
-                                               UNIXSECLEN(skb));
-        if (err)
-                *(UNIXSECDATA(skb)) = NULL;
+        memcpy(UNIXSID(skb), &scm->secid, sizeof(u32));
 }
 
 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 {
-        scm->secdata = *UNIXSECDATA(skb);
-        scm->seclen = *UNIXSECLEN(skb);
+        scm->secid = *UNIXSID(skb);
 }
 #else
-static inline void unix_get_peersec_dgram(struct sk_buff *skb)
+static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb)
 { }
 
 static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
@@ -1322,8 +1316,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
         if (siocb->scm->fp)
                 unix_attach_fds(siocb->scm, skb);
-
-        unix_get_peersec_dgram(skb);
+        unix_get_secdata(siocb->scm, skb);
 
         skb->h.raw = skb->data;
         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index f35bc676128c..3da67ca2c3ce 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1134,12 +1134,33 @@ int __xfrm_route_forward(struct sk_buff *skb, unsigned short family)
 }
 EXPORT_SYMBOL(__xfrm_route_forward);
 
+/* Optimize later using cookies and generation ids. */
+
 static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        /* If it is marked obsolete, which is how we even get here,
-         * then we have purged it from the policy bundle list and we
-         * did that for a good reason.
+        /* Code (such as __xfrm4_bundle_create()) sets dst->obsolete
+         * to "-1" to force all XFRM destinations to get validated by
+         * dst_ops->check on every use.  We do this because when a
+         * normal route referenced by an XFRM dst is obsoleted we do
+         * not go looking around for all parent referencing XFRM dsts
+         * so that we can invalidate them.  It is just too much work.
+         * Instead we make the checks here on every use.  For example:
+         *
+         *      XFRM dst A --> IPv4 dst X
+         *
+         * X is the "xdst->route" of A (X is also the "dst->path" of A
+         * in this example).  If X is marked obsolete, "A" will not
+         * notice.  That's what we are validating here via the
+         * stale_bundle() check.
+         *
+         * When a policy's bundle is pruned, we dst_free() the XFRM
+         * dst which causes it's ->obsolete field to be set to a
+         * positive non-zero integer.  If an XFRM dst has been pruned
+         * like this, we want to force a new route lookup.
          */
+        if (dst->obsolete < 0 && !stale_bundle(dst))
+                return dst;
+
         return NULL;
 }
 
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 44312926b849..e2de650d3dbf 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -391,7 +391,7 @@ static void do_input(char *alias,
         unsigned int i;
 
         for (i = min; i < max; i++)
-                if (arr[i / BITS_PER_LONG] & (1 << (i%BITS_PER_LONG)))
+                if (arr[i / BITS_PER_LONG] & (1L << (i%BITS_PER_LONG)))
                         sprintf(alias + strlen(alias), "%X,*", i);
 }
 
diff --git a/security/dummy.c b/security/dummy.c
index bbbfda70e131..58c6d399c844 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -791,8 +791,7 @@ static int dummy_socket_getpeersec_stream(struct socket *sock, char __user *optv
         return -ENOPROTOOPT;
 }
 
-static int dummy_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata,
-                                         u32 *seclen)
+static int dummy_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
 {
         return -ENOPROTOOPT;
 }
@@ -876,6 +875,15 @@ static int dummy_setprocattr(struct task_struct *p, char *name, void *value, siz
         return -EINVAL;
 }
 
+static int dummy_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+{
+        return -EOPNOTSUPP;
+}
+
+static void dummy_release_secctx(char *secdata, u32 seclen)
+{
+}
+
 #ifdef CONFIG_KEYS
 static inline int dummy_key_alloc(struct key *key, struct task_struct *ctx,
                                   unsigned long flags)
@@ -1028,6 +1036,8 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, d_instantiate);
         set_to_dummy_if_null(ops, getprocattr);
         set_to_dummy_if_null(ops, setprocattr);
+        set_to_dummy_if_null(ops, secid_to_secctx);
+        set_to_dummy_if_null(ops, release_secctx);
 #ifdef CONFIG_SECURITY_NETWORK
         set_to_dummy_if_null(ops, unix_stream_connect);
         set_to_dummy_if_null(ops, unix_may_send);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a91c961ba38b..5d1b8c733199 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3524,25 +3524,21 @@ out:
         return err;
 }
 
-static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
+static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
 {
+        u32 peer_secid = SECSID_NULL;
         int err = 0;
-        u32 peer_sid;
 
-        if (skb->sk->sk_family == PF_UNIX)
-                selinux_get_inode_sid(SOCK_INODE(skb->sk->sk_socket),
-                                      &peer_sid);
-        else
-                peer_sid = selinux_socket_getpeer_dgram(skb);
-
-        if (peer_sid == SECSID_NULL)
-                return -EINVAL;
+        if (sock && (sock->sk->sk_family == PF_UNIX))
+                selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
+        else if (skb)
+                peer_secid = selinux_socket_getpeer_dgram(skb);
 
-        err = security_sid_to_context(peer_sid, secdata, seclen);
-        if (err)
-                return err;
+        if (peer_secid == SECSID_NULL)
+                err = -EINVAL;
+        *secid = peer_secid;
 
-        return 0;
+        return err;
 }
 
 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
@@ -4407,6 +4403,17 @@ static int selinux_setprocattr(struct task_struct *p,
         return size;
 }
 
+static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+{
+        return security_sid_to_context(secid, secdata, seclen);
+}
+
+static void selinux_release_secctx(char *secdata, u32 seclen)
+{
+        if (secdata)
+                kfree(secdata);
+}
+
 #ifdef CONFIG_KEYS
 
 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
@@ -4587,6 +4594,9 @@ static struct security_operations selinux_ops = {
         .getprocattr =                  selinux_getprocattr,
         .setprocattr =                  selinux_setprocattr,
 
+        .secid_to_secctx =              selinux_secid_to_secctx,
+        .release_secctx =               selinux_release_secctx,
+
         .unix_stream_connect =          selinux_socket_unix_stream_connect,
         .unix_may_send =                selinux_socket_unix_may_send,
 
diff --git a/sound/aoa/codecs/snd-aoa-codec-toonie.c b/sound/aoa/codecs/snd-aoa-codec-toonie.c
index bcc555647e79..3c7d1d8a9a6f 100644
--- a/sound/aoa/codecs/snd-aoa-codec-toonie.c
+++ b/sound/aoa/codecs/snd-aoa-codec-toonie.c
@@ -51,6 +51,13 @@ static struct transfer_info toonie_transfers[] = {
         {}
 };
 
+static int toonie_usable(struct codec_info_item *cii,
+                         struct transfer_info *ti,
+                         struct transfer_info *out)
+{
+        return 1;
+}
+
 #ifdef CONFIG_PM
 static int toonie_suspend(struct codec_info_item *cii, pm_message_t state)
 {
@@ -69,6 +76,7 @@ static struct codec_info toonie_codec_info = {
         .sysclock_factor = 256,
         .bus_factor = 64,
         .owner = THIS_MODULE,
+        .usable = toonie_usable,
 #ifdef CONFIG_PM
         .suspend = toonie_suspend,
         .resume = toonie_resume,
@@ -79,19 +87,20 @@ static int toonie_init_codec(struct aoa_codec *codec)
 {
         struct toonie *toonie = codec_to_toonie(codec);
 
+        /* nothing connected? what a joke! */
+        if (toonie->codec.connected != 1)
+                return -ENOTCONN;
+
         if (aoa_snd_device_new(SNDRV_DEV_LOWLEVEL, toonie, &ops)) {
                 printk(KERN_ERR PFX "failed to create toonie snd device!\n");
                 return -ENODEV;
         }
 
-        /* nothing connected? what a joke! */
-        if (toonie->codec.connected != 1)
-                return -ENOTCONN;
-
         if (toonie->codec.soundbus_dev->attach_codec(toonie->codec.soundbus_dev,
                                                      aoa_get_card(),
                                                      &toonie_codec_info, toonie)) {
                 printk(KERN_ERR PFX "error creating toonie pcm\n");
+                snd_device_free(aoa_get_card(), toonie);
                 return -ENODEV;
         }
 
diff --git a/sound/aoa/core/snd-aoa-gpio-feature.c b/sound/aoa/core/snd-aoa-gpio-feature.c
index 7ae0c0bdfad8..f69d33357a28 100644
--- a/sound/aoa/core/snd-aoa-gpio-feature.c
+++ b/sound/aoa/core/snd-aoa-gpio-feature.c
@@ -112,7 +112,10 @@ static struct device_node *get_gpio(char *name,
 
 static void get_irq(struct device_node * np, int *irqptr)
 {
-        *irqptr = irq_of_parse_and_map(np, 0);
+        if (np)
+                *irqptr = irq_of_parse_and_map(np, 0);
+        else
+                *irqptr = NO_IRQ;
 }
 
 /* 0x4 is outenable, 0x1 is out, thus 4 or 5 */
@@ -322,7 +325,7 @@ static int ftr_set_notify(struct gpio_runtime *rt,
                 return -EINVAL;
         }
 
-        if (irq == -1)
+        if (irq == NO_IRQ)
                 return -ENODEV;
 
         mutex_lock(&notif->mutex);
diff --git a/sound/aoa/core/snd-aoa-gpio-pmf.c b/sound/aoa/core/snd-aoa-gpio-pmf.c
index 3d57fd1aec4b..2836c3218391 100644
--- a/sound/aoa/core/snd-aoa-gpio-pmf.c
+++ b/sound/aoa/core/snd-aoa-gpio-pmf.c
@@ -18,7 +18,7 @@ static void pmf_gpio_set_##name(struct gpio_runtime *rt, int on)\
                                                         \
         if (unlikely(!rt)) return;                              \
         rc = pmf_call_function(rt->node, #name "-mute", &args); \
-        if (rc)                                                 \
+        if (rc && rc != -ENODEV)                                \
                 printk(KERN_WARNING "pmf_gpio_set_" #name       \
                 " failed, rc: %d\n", rc);                       \
         rt->implementation_private &= ~(1<<bit);                \
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 71b5080fa66d..75a9505c7445 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -988,13 +988,12 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer, struct snd_mix
         if (ptr->index == 0 && (kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0)) != NULL) {
                 struct snd_ctl_elem_info *uinfo;
 
-                uinfo = kmalloc(sizeof(*uinfo), GFP_KERNEL);
+                uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
                 if (! uinfo) {
                         up_read(&mixer->card->controls_rwsem);
                         return -ENOMEM;
                 }
                         
-                memset(uinfo, 0, sizeof(*uinfo));
                 if (kctl->info(kctl, uinfo)) {
                         up_read(&mixer->card->controls_rwsem);
                         return 0;
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f5ff4f4a16ee..472fce0ee0e8 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2228,6 +2228,8 @@ static int snd_pcm_oss_open_file(struct file *file,
         for (idx = 0; idx < 2; idx++) {
                 if (setup[idx].disable)
                         continue;
+                if (! pcm->streams[idx].substream_count)
+                        continue; /* no matching substream */
                 if (idx == SNDRV_PCM_STREAM_PLAYBACK) {
                         if (! (f_mode & FMODE_WRITE))
                                 continue;
diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
index 4260de90f36f..102ff548ce69 100644
--- a/sound/core/seq/seq_device.c
+++ b/sound/core/seq/seq_device.c
@@ -372,10 +372,9 @@ static struct ops_list * create_driver(char *id)
 {
         struct ops_list *ops;
 
-        ops = kmalloc(sizeof(*ops), GFP_KERNEL);
+        ops = kzalloc(sizeof(*ops), GFP_KERNEL);
         if (ops == NULL)
                 return ops;
-        memset(ops, 0, sizeof(*ops));
 
         /* set up driver entry */
         strlcpy(ops->id, id, sizeof(ops->id));
diff --git a/sound/core/sgbuf.c b/sound/core/sgbuf.c
index 6e4d4ab34632..c30669f14ac0 100644
--- a/sound/core/sgbuf.c
+++ b/sound/core/sgbuf.c
@@ -68,21 +68,18 @@ void *snd_malloc_sgbuf_pages(struct device *device,
 
         dmab->area = NULL;
         dmab->addr = 0;
-        dmab->private_data = sgbuf = kmalloc(sizeof(*sgbuf), GFP_KERNEL);
+        dmab->private_data = sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL);
         if (! sgbuf)
                 return NULL;
-        memset(sgbuf, 0, sizeof(*sgbuf));
         sgbuf->dev = device;
         pages = snd_sgbuf_aligned_pages(size);
         sgbuf->tblsize = sgbuf_align_table(pages);
-        sgbuf->table = kmalloc(sizeof(*sgbuf->table) * sgbuf->tblsize, GFP_KERNEL);
+        sgbuf->table = kcalloc(sgbuf->tblsize, sizeof(*sgbuf->table), GFP_KERNEL);
         if (! sgbuf->table)
                 goto _failed;
-        memset(sgbuf->table, 0, sizeof(*sgbuf->table) * sgbuf->tblsize);
-        sgbuf->page_table = kmalloc(sizeof(*sgbuf->page_table) * sgbuf->tblsize, GFP_KERNEL);
+        sgbuf->page_table = kcalloc(sgbuf->tblsize, sizeof(*sgbuf->page_table), GFP_KERNEL);
         if (! sgbuf->page_table)
                 goto _failed;
-        memset(sgbuf->page_table, 0, sizeof(*sgbuf->page_table) * sgbuf->tblsize);
 
         /* allocate each page */
         for (i = 0; i < pages; i++) {
diff --git a/sound/drivers/vx/vx_pcm.c b/sound/drivers/vx/vx_pcm.c
index c4af84995d05..7e65a103fbb2 100644
--- a/sound/drivers/vx/vx_pcm.c
+++ b/sound/drivers/vx/vx_pcm.c
@@ -1252,18 +1252,15 @@ static int vx_init_audio_io(struct vx_core *chip)
         chip->audio_info = rmh.Stat[1];
 
         /* allocate pipes */
-        chip->playback_pipes = kmalloc(sizeof(struct vx_pipe *) * chip->audio_outs, GFP_KERNEL);
+        chip->playback_pipes = kcalloc(chip->audio_outs, sizeof(struct vx_pipe *), GFP_KERNEL);
         if (!chip->playback_pipes)
                 return -ENOMEM;
-        chip->capture_pipes = kmalloc(sizeof(struct vx_pipe *) * chip->audio_ins, GFP_KERNEL);
+        chip->capture_pipes = kcalloc(chip->audio_ins, sizeof(struct vx_pipe *), GFP_KERNEL);
         if (!chip->capture_pipes) {
                 kfree(chip->playback_pipes);
                 return -ENOMEM;
         }
 
-        memset(chip->playback_pipes, 0, sizeof(struct vx_pipe *) * chip->audio_outs);
-        memset(chip->capture_pipes, 0, sizeof(struct vx_pipe *) * chip->audio_ins);
-
         preferred = chip->ibl.size;
         chip->ibl.size = 0;
         vx_set_ibl(chip, &chip->ibl); /* query the info */
diff --git a/sound/oss/Kconfig b/sound/oss/Kconfig
index f4980ca5c05c..1b7c3dfc2b41 100644
--- a/sound/oss/Kconfig
+++ b/sound/oss/Kconfig
@@ -31,7 +31,7 @@ config SOUND_EMU10K1
           For more information on this driver and the degree of support for
           the different card models please check:
 
-                <http://sourceforge.net/projects/emu10k1/>
+                <http://sourceforge.net/projects/emu10k1/>
 
           It is now possible to load dsp microcode patches into the EMU10K1
           chip.  These patches are used to implement real time sound
@@ -140,7 +140,7 @@ config SOUND_TRIDENT
           system support" and "Sysctl support", and after the /proc file
           system has been mounted, executing the command
 
-                command                 what is enabled
+                command                 what is enabled
 
           echo 0>/proc/ALi5451  pcm out is also set to S/PDIF out. (Default).
 
@@ -838,7 +838,7 @@ config SOUND_WAVEARTIST
 
 config SOUND_TVMIXER
         tristate "TV card (bt848) mixer support"
-        depends on SOUND_PRIME && I2C
+        depends on SOUND_PRIME && I2C && VIDEO_V4L1
         help
           Support for audio mixer facilities on the BT848 TV frame-grabber
           card.
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index d7ad32f514da..e49c0fe21b0d 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -16,16 +16,16 @@ config SND_AD1889
           will be called snd-ad1889.
 
 config SND_ALS300
-        tristate "Avance Logic ALS300/ALS300+"
-        depends on SND
-        select SND_PCM
-        select SND_AC97_CODEC
-        select SND_OPL3_LIB
-        help
-          Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+
+        tristate "Avance Logic ALS300/ALS300+"
+        depends on SND
+        select SND_PCM
+        select SND_AC97_CODEC
+        select SND_OPL3_LIB
+        help
+          Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+
 
-          To compile this driver as a module, choose M here: the module
-          will be called snd-als300
+          To compile this driver as a module, choose M here: the module
+          will be called snd-als300
 
 config SND_ALS4000
         tristate "Avance Logic ALS4000"
@@ -78,49 +78,49 @@ config SND_ATIIXP_MODEM
           will be called snd-atiixp-modem.
 
 config SND_AU8810
-        tristate "Aureal Advantage"
-        depends on SND
+        tristate "Aureal Advantage"
+        depends on SND
         select SND_MPU401_UART
         select SND_AC97_CODEC
-        help
+        help
           Say Y here to include support for Aureal Advantage soundcards.
 
           Supported features: Hardware Mixer, SRC, EQ and SPDIF output.
-          3D support code is in place, but not yet useable. For more info, 
-          email the ALSA developer list, or <mjander@users.sourceforge.net>.
+          3D support code is in place, but not yet useable. For more info,
+          email the ALSA developer list, or <mjander@users.sourceforge.net>.
 
           To compile this driver as a module, choose M here: the module
           will be called snd-au8810.
- 
+
 config SND_AU8820
-        tristate "Aureal Vortex"
-        depends on SND
+        tristate "Aureal Vortex"
+        depends on SND
         select SND_MPU401_UART
         select SND_AC97_CODEC
-        help
+        help
           Say Y here to include support for Aureal Vortex soundcards.
 
-          Supported features: Hardware Mixer and SRC. For more info, email 
-          the ALSA developer list, or <mjander@users.sourceforge.net>.
+          Supported features: Hardware Mixer and SRC. For more info, email
+          the ALSA developer list, or <mjander@users.sourceforge.net>.
 
           To compile this driver as a module, choose M here: the module
           will be called snd-au8820.
- 
+
 config SND_AU8830
-        tristate "Aureal Vortex 2"
-        depends on SND
+        tristate "Aureal Vortex 2"
+        depends on SND
         select SND_MPU401_UART
         select SND_AC97_CODEC
-        help
+        help
           Say Y here to include support for Aureal Vortex 2 soundcards.
 
-          Supported features: Hardware Mixer, SRC, EQ and SPDIF output.
-          3D support code is in place, but not yet useable. For more info, 
-          email the ALSA developer list, or <mjander@users.sourceforge.net>.
+          Supported features: Hardware Mixer, SRC, EQ and SPDIF output.
+          3D support code is in place, but not yet useable. For more info,
+          email the ALSA developer list, or <mjander@users.sourceforge.net>.
 
           To compile this driver as a module, choose M here: the module
           will be called snd-au8830.
- 
+
 config SND_AZT3328
         tristate "Aztech AZF3328 / PCI168 (EXPERIMENTAL)"
         depends on SND && EXPERIMENTAL
@@ -135,10 +135,10 @@ config SND_AZT3328
           will be called snd-azt3328.
 
 config SND_BT87X
-        tristate "Bt87x Audio Capture"
-        depends on SND
+        tristate "Bt87x Audio Capture"
+        depends on SND
         select SND_PCM
-        help
+        help
           If you want to record audio from TV cards based on
           Brooktree Bt878/Bt879 chips, say Y here and read
           <file:Documentation/sound/alsa/Bt87x.txt>.
@@ -209,7 +209,7 @@ config SND_CS46XX
 config SND_CS46XX_NEW_DSP
         bool "Cirrus Logic (Sound Fusion) New DSP support"
         depends on SND_CS46XX
-        default y
+        default y
         help
           Say Y here to use a new DSP image for SPDIF and dual codecs.
 
@@ -225,7 +225,7 @@ config SND_CS5535AUDIO
           referred to as NS CS5535 IO or AMD CS5535 IO companion in
           various literature. This driver also supports the CS5536 audio
           device. However, for both chips, on certain boards, you may
-          need to use ac97_quirk=hp_only if your board has physically 
+          need to use ac97_quirk=hp_only if your board has physically
           mapped headphone out to master output. If that works for you,
           send lspci -vvv output to the mailing list so that your board
           can be identified in the quirks list.
@@ -468,11 +468,13 @@ config SND_FM801_TEA575X_BOOL
           FM801 chip with a TEA5757 tuner connected to GPIO1-3 pins (Media
           Forte SF256-PCS-02) into the snd-fm801 driver.
 
+          This will enable support for the old V4L1 API.
+
 config SND_FM801_TEA575X
         tristate
         depends on SND_FM801_TEA575X_BOOL
         default SND_FM801
-        select VIDEO_DEV
+        select VIDEO_V4L1
 
 config SND_HDA_INTEL
         tristate "Intel HD Audio"
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index 27a8dbe6f6a8..c3dafa29054f 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -236,9 +236,9 @@ static int pcm_open(struct snd_pcm_substream *substream,
         chip = snd_pcm_substream_chip(substream);
         runtime = substream->runtime;
 
-        if (!(pipe = kmalloc(sizeof(struct audiopipe), GFP_KERNEL)))
+        pipe = kzalloc(sizeof(struct audiopipe), GFP_KERNEL);
+        if (!pipe)
                 return -ENOMEM;
-        memset(pipe, 0, sizeof(struct audiopipe));
         pipe->index = -1;               /* Not configured yet */
 
         /* Set up hw capabilities and contraints */
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index f9b5c3dc3b34..79f24cdf5fbf 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -936,6 +936,17 @@ static struct snd_emu_chip_details emu_chip_details[] = {
          .ca0151_chip = 1,
          .spk71 = 1,
          .spdif_bug = 1} ,
+        /* Dell OEM/Creative Labs Audigy 2 ZS */
+        /* See ALSA bug#1365 */
+        {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10031102,
+         .driver = "Audigy2", .name = "Audigy 2 ZS [SB0353]",
+         .id = "Audigy2",
+         .emu10k2_chip = 1,
+         .ca0102_chip = 1,
+         .ca0151_chip = 1,
+         .spk71 = 1,
+         .spdif_bug = 1,
+         .ac97_chip = 1} ,
         {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10021102,
          .driver = "Audigy2", .name = "Audigy 2 Platinum [SB0240P]", 
          .id = "Audigy2",
diff --git a/sound/pci/emu10k1/irq.c b/sound/pci/emu10k1/irq.c
index a8b31286b6db..1076af4c3669 100644
--- a/sound/pci/emu10k1/irq.c
+++ b/sound/pci/emu10k1/irq.c
@@ -37,9 +37,13 @@ irqreturn_t snd_emu10k1_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         int handled = 0;
 
         while ((status = inl(emu->port + IPR)) != 0) {
-                //printk("emu10k1 irq - status = 0x%x\n", status);
+                //snd_printk(KERN_INFO "emu10k1 irq - status = 0x%x\n", status);
                 orig_status = status;
                 handled = 1;
+                if ((status & 0xffffffff) == 0xffffffff) {
+                        snd_printk(KERN_INFO "snd-emu10k1: Suspected sound card removal\n");
+                        break;
+                }
                 if (status & IPR_PCIERROR) {
                         snd_printk(KERN_ERR "interrupt: PCI error\n");
                         snd_emu10k1_intr_disable(emu, INTE_PCIERRORENABLE);
diff --git a/sound/ppc/awacs.c b/sound/ppc/awacs.c
index 82d791be7499..05dabe454658 100644
--- a/sound/ppc/awacs.c
+++ b/sound/ppc/awacs.c
@@ -801,11 +801,10 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
         chip->revision = (in_le32(&chip->awacs->codec_stat) >> 12) & 0xf;
 #ifdef PMAC_AMP_AVAIL
         if (chip->revision == 3 && chip->has_iic && CHECK_CUDA_AMP()) {
-                struct awacs_amp *amp = kmalloc(sizeof(*amp), GFP_KERNEL);
+                struct awacs_amp *amp = kzalloc(sizeof(*amp), GFP_KERNEL);
                 if (! amp)
                         return -ENOMEM;
                 chip->mixer_data = amp;
-                memset(amp, 0, sizeof(*amp));
                 chip->mixer_free = awacs_amp_free;
                 awacs_amp_set_vol(amp, 0, 63, 63, 0); /* mute and zero vol */
                 awacs_amp_set_vol(amp, 1, 63, 63, 0);
diff --git a/sound/ppc/daca.c b/sound/ppc/daca.c
index 46eebf5610e3..57202b0f033e 100644
--- a/sound/ppc/daca.c
+++ b/sound/ppc/daca.c
@@ -258,10 +258,9 @@ int __init snd_pmac_daca_init(struct snd_pmac *chip)
                 request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */        
 
-        mix = kmalloc(sizeof(*mix), GFP_KERNEL);
+        mix = kzalloc(sizeof(*mix), GFP_KERNEL);
         if (! mix)
                 return -ENOMEM;
-        memset(mix, 0, sizeof(*mix));
         chip->mixer_data = mix;
         chip->mixer_free = daca_cleanup;
         mix->amp_on = 1; /* default on */
diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c
index fb05938dcbd9..59482a4cd446 100644
--- a/sound/ppc/keywest.c
+++ b/sound/ppc/keywest.c
@@ -64,11 +64,10 @@ static int keywest_attach_adapter(struct i2c_adapter *adapter)
         if (strncmp(i2c_device_name(adapter), "mac-io", 6))
                 return 0; /* ignored */
 
-        new_client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
+        new_client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
         if (! new_client)
                 return -ENOMEM;
 
-        memset(new_client, 0, sizeof(*new_client));
         new_client->addr = keywest_ctx->addr;
         i2c_set_clientdata(new_client, keywest_ctx);
         new_client->adapter = adapter;
diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
index fa9a44ab487e..2264574fa06b 100644
--- a/sound/ppc/powermac.c
+++ b/sound/ppc/powermac.c
@@ -181,21 +181,14 @@ static int __init alsa_card_pmac_init(void)
         if ((err = platform_driver_register(&snd_pmac_driver)) < 0)
                 return err;
         device = platform_device_register_simple(SND_PMAC_DRIVER, -1, NULL, 0);
-        if (!IS_ERR(device)) {
-                if (platform_get_drvdata(device))
-                        return 0;
-                platform_device_unregister(device);
-                err = -ENODEV;
-        } else
-                err = PTR_ERR(device);
-        platform_driver_unregister(&snd_pmac_driver);
-        return err;
+        return 0;
 
 }
 
 static void __exit alsa_card_pmac_exit(void)
 {
-        platform_device_unregister(device);
+        if (!IS_ERR(device))
+                platform_device_unregister(device);
         platform_driver_unregister(&snd_pmac_driver);
 }
 
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 692c61177678..84f6b19c07ca 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -1316,10 +1316,9 @@ int __init snd_pmac_tumbler_init(struct snd_pmac *chip)
                 request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */        
 
-        mix = kmalloc(sizeof(*mix), GFP_KERNEL);
+        mix = kzalloc(sizeof(*mix), GFP_KERNEL);
         if (! mix)
                 return -ENOMEM;
-        memset(mix, 0, sizeof(*mix));
         mix->headphone_irq = -1;
 
         chip->mixer_data = mix;
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index d32d83d970cc..1b7f499c549d 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2260,10 +2260,9 @@ static int add_audio_endpoint(struct snd_usb_audio *chip, int stream, struct aud
         }
 
         /* create a new pcm */
-        as = kmalloc(sizeof(*as), GFP_KERNEL);
+        as = kzalloc(sizeof(*as), GFP_KERNEL);
         if (! as)
                 return -ENOMEM;
-        memset(as, 0, sizeof(*as));
         as->pcm_index = chip->pcm_devs;
         as->chip = chip;
         as->fmt_type = fp->fmt_type;
@@ -2633,13 +2632,12 @@ static int parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
                         csep = NULL;
                 }
 
-                fp = kmalloc(sizeof(*fp), GFP_KERNEL);
+                fp = kzalloc(sizeof(*fp), GFP_KERNEL);
                 if (! fp) {
                         snd_printk(KERN_ERR "cannot malloc\n");
                         return -ENOMEM;
                 }
 
-                memset(fp, 0, sizeof(*fp));
                 fp->iface = iface_no;
                 fp->altsetting = altno;
                 fp->altset_idx = i;