51 files changed, 398 insertions, 257 deletions
diff --git a/Documentation/ABI/obsolete/dv1394 b/Documentation/ABI/obsolete/dv1394
new file mode 100644
index 000000000000..2ee36864ca10
--- /dev/null
+++ b/Documentation/ABI/obsolete/dv1394
@@ -0,0 +1,9 @@
+What:           dv1394 (a.k.a. "OHCI-DV I/O support" for FireWire)
+Contact:        linux1394-devel@lists.sourceforge.net
+Description:
+        New application development should use raw1394 + userspace libraries
+        instead, notably libiec61883 which is functionally equivalent.
+Users:
+        ffmpeg/libavformat (used by a variety of media players)
+        dvgrab v1.x (replaced by dvgrab2 on top of raw1394 and resp. libraries)
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 0bc8b0b2e103..19b4c96b2a49 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -39,17 +39,6 @@ Who:	Dan Dennedy <dan@dennedy.org>, Stefan Richter <stefanr@s5r6.in-berlin.de>
 ---------------------------
-What:   dv1394 driver (CONFIG_IEEE1394_DV1394)
-When:   June 2007
-Why:    Replaced by raw1394 + userspace libraries, notably libiec61883.  This
-        shift of application support has been indicated on www.linux1394.org
-        and developers' mailinglists for quite some time.  Major applications
-        have been converted, with the exception of ffmpeg and hence xine.
-        Piped output of dvgrab2 is a partial equivalent to dv1394.
-Who:    Dan Dennedy <dan@dennedy.org>, Stefan Richter <stefanr@s5r6.in-berlin.de>
---------------------------
 What:   Video4Linux API 1 ioctls and video_decoder.h from Video devices.
 When:   December 2006
 Why:    V4L1 AP1 was replaced by V4L2 API. during migration from 2.4 to 2.6
diff --git a/MAINTAINERS b/MAINTAINERS
index 829407ff41f1..ef84419ade3a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1404,7 +1404,7 @@ M:	hch@infradead.org
 W:      ftp://ftp.openlinux.org/pub/people/hch/vxfs
 S:      Maintained
-FUJITSU FR-V PORT
+FUJITSU FR-V (FRV) PORT
 P:      David Howells
 M:      dhowells@redhat.com
 S:      Maintained
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index e4408ff4e674..b3ab8ffebd27 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -736,7 +736,7 @@ failed:
        return 0;
 }
-int __init irqbalance_disable(char *str)
+int __devinit irqbalance_disable(char *str)
 {
        irqbalance_disabled = 1;
        return 1;
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index fb07a1aad225..edc339fa5038 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -69,6 +69,7 @@ struct {
        void (*flush_tlb)(int);
        void (*set_initial_ap_state)(int, int);
        void (*halt)(void);
+        void (*set_lazy_mode)(int mode);
 } vmi_ops;
 /* XXX move this to alternative.h */
@@ -574,6 +575,26 @@ vmi_startup_ipi_hook(int phys_apicid, unsigned long start_eip,
 }
 #endif
+static void vmi_set_lazy_mode(int mode)
+{
+        static DEFINE_PER_CPU(int, lazy_mode);
+        if (!vmi_ops.set_lazy_mode)
+                return;
+        /* Modes should never nest or overlap */
+        BUG_ON(__get_cpu_var(lazy_mode) && !(mode == PARAVIRT_LAZY_NONE ||
+                                             mode == PARAVIRT_LAZY_FLUSH));
+        if (mode == PARAVIRT_LAZY_FLUSH) {
+                vmi_ops.set_lazy_mode(0);
+                vmi_ops.set_lazy_mode(__get_cpu_var(lazy_mode));
+        } else {
+                vmi_ops.set_lazy_mode(mode);
+                __get_cpu_var(lazy_mode) = mode;
+        }
+}
 static inline int __init check_vmi_rom(struct vrom_header *rom)
 {
        struct pci_header *pci;
@@ -804,7 +825,7 @@ static inline int __init activate_vmi(void)
        para_wrap(load_esp0, vmi_load_esp0, set_kernel_stack, UpdateKernelStack);
        para_fill(set_iopl_mask, SetIOPLMask);
        para_fill(io_delay, IODelay);
-        para_fill(set_lazy_mode, SetLazyMode);
+        para_wrap(set_lazy_mode, vmi_set_lazy_mode, set_lazy_mode, SetLazyMode);
        /* user and kernel flush are just handled with different flags to FlushTLB */
        para_wrap(flush_tlb_user, vmi_flush_tlb_user, flush_tlb, FlushTLB);
diff --git a/arch/i386/mm/highmem.c b/arch/i386/mm/highmem.c
index bb2de1089add..ac70d09df7ee 100644
--- a/arch/i386/mm/highmem.c
+++ b/arch/i386/mm/highmem.c
@@ -42,6 +42,7 @@ void *kmap_atomic(struct page *page, enum km_type type)
        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
        set_pte(kmap_pte-idx, mk_pte(page, kmap_prot));
+        arch_flush_lazy_mmu_mode();
        return (void*) vaddr;
 }
@@ -82,6 +83,7 @@ void *kmap_atomic_pfn(unsigned long pfn, enum km_type type)
        idx = type + KM_TYPE_NR*smp_processor_id();
        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
        set_pte(kmap_pte-idx, pfn_pte(pfn, kmap_prot));
+        arch_flush_lazy_mmu_mode();
        return (void*) vaddr;
 }
diff --git a/arch/ia64/kernel/msi_ia64.c b/arch/ia64/kernel/msi_ia64.c
index ebbeadfee42d..c81080df70df 100644
--- a/arch/ia64/kernel/msi_ia64.c
+++ b/arch/ia64/kernel/msi_ia64.c
@@ -76,7 +76,7 @@ int ia64_setup_msi_irq(struct pci_dev *pdev, struct msi_desc *desc)
        set_irq_msi(irq, desc);
        dest_phys_id = cpu_physical_id(first_cpu(cpu_online_map));
-        vector = irq;
+        vector = irq_to_vector(irq);
        msg.address_hi = 0;
        msg.address_lo =
@@ -110,7 +110,7 @@ static void ia64_ack_msi_irq(unsigned int irq)
 static int ia64_msi_retrigger_irq(unsigned int irq)
 {
-        unsigned int vector = irq;
+        unsigned int vector = irq_to_vector(irq);
        ia64_resend_irq(vector);
        return 1;
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index 69b9bb3fd7c5..dc7dd7648ec5 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -640,7 +640,7 @@ show_cpuinfo (struct seq_file *m, void *v)
                   "features   : %s\n"
                   "cpu number : %lu\n"
                   "cpu regs   : %u\n"
-                   "cpu MHz    : %lu.%06lu\n"
+                   "cpu MHz    : %lu.%03lu\n"
                   "itc MHz    : %lu.%06lu\n"
                   "BogoMIPS   : %lu.%02lu\n",
                   cpunum, c->vendor, c->family, c->model,
diff --git a/arch/ia64/sn/kernel/bte_error.c b/arch/ia64/sn/kernel/bte_error.c
index f1ec1370b3e3..b6fcf8164f2b 100644
--- a/arch/ia64/sn/kernel/bte_error.c
+++ b/arch/ia64/sn/kernel/bte_error.c
@@ -78,7 +78,7 @@ int shub1_bte_error_handler(unsigned long _nodepda)
                 * There are errors which still need to be cleaned up by
                 * hubiio_crb_error_handler
                 */
-                mod_timer(recovery_timer, HZ * 5);
+                mod_timer(recovery_timer, jiffies + (HZ * 5));
                BTE_PRINTK(("eh:%p:%d Marked Giving up\n", err_nodepda,
                            smp_processor_id()));
                return 1;
@@ -95,7 +95,7 @@ int shub1_bte_error_handler(unsigned long _nodepda)
                        icrbd.ii_icrb0_d_regval =
                            REMOTE_HUB_L(nasid, IIO_ICRB_D(i));
                        if (icrbd.d_bteop) {
-                                mod_timer(recovery_timer, HZ * 5);
+                                mod_timer(recovery_timer, jiffies + (HZ * 5));
                                BTE_PRINTK(("eh:%p:%d Valid %d, Giving up\n",
                                            err_nodepda, smp_processor_id(),
                                            i));
@@ -150,7 +150,7 @@ int shub2_bte_error_handler(unsigned long _nodepda)
                status = BTE_LNSTAT_LOAD(bte);
                if ((status & IBLS_ERROR) || !(status & IBLS_BUSY))
                        continue;
-                mod_timer(recovery_timer, HZ * 5);
+                mod_timer(recovery_timer, jiffies + (HZ * 5));
                BTE_PRINTK(("eh:%p:%d Marked Giving up\n", err_nodepda,
                            smp_processor_id()));
                return 1;
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
index 1ee977fb6ebb..95af40cb22f2 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
@@ -96,10 +96,14 @@ pcibr_dmamap_ate32(struct pcidev_info *info,
        }
        /*
-         * If we're mapping for MSI, set the MSI bit in the ATE
+         * If we're mapping for MSI, set the MSI bit in the ATE.  If it's a
+         * TIOCP based pci bus, we also need to set the PIO bit in the ATE.
         */
-        if (dma_flags & SN_DMA_MSI)
+        if (dma_flags & SN_DMA_MSI) {
                ate |= PCI32_ATE_MSI;
+                if (IS_TIOCP_SOFT(pcibus_info))
+                        ate |= PCI32_ATE_PIO;
+        }
        ate_write(pcibus_info, ate_index, ate_count, ate);
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 148c6bcf5bb4..fede55a53995 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -88,7 +88,7 @@ struct chipset {
        void (*f)(void);
 };
-static struct __initdata chipset early_qrk[] = {
+static struct chipset early_qrk[] __initdata = {
        { PCI_VENDOR_ID_NVIDIA, nvidia_bugs },
        { PCI_VENDOR_ID_VIA, via_bugs },
        { PCI_VENDOR_ID_ATI, ati_bugs },
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index e542a628f1c7..55392a45a14b 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -18,11 +18,14 @@
 #define PCI_DEVICE_ID_INTEL_82965Q_IG       0x2992
 #define PCI_DEVICE_ID_INTEL_82965G_HB       0x29A0
 #define PCI_DEVICE_ID_INTEL_82965G_IG       0x29A2
+#define PCI_DEVICE_ID_INTEL_82965GM_HB      0x2A00
+#define PCI_DEVICE_ID_INTEL_82965GM_IG      0x2A02
 #define IS_I965 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82946GZ_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_1_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965Q_HB || \
-                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB)
+                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB || \
+                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965GM_HB)
 extern int agp_memory_reserved;
@@ -428,9 +431,8 @@ static void intel_i830_init_gtt_entries(void)
        if (IS_I965) {
                u32 pgetbl_ctl;
+                pgetbl_ctl = readl(intel_i830_private.registers+I810_PGETBL_CTL);
-                pci_read_config_dword(agp_bridge->dev, I810_PGETBL_CTL,
-                                      &pgetbl_ctl);
                /* The 965 has a field telling us the size of the GTT,
                 * which may be larger than what is necessary to map the
                 * aperture.
@@ -1921,7 +1923,13 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                        bridge->driver = &intel_845_driver;
                name = "965G";
                break;
+        case PCI_DEVICE_ID_INTEL_82965GM_HB:
+                if (find_i830(PCI_DEVICE_ID_INTEL_82965GM_IG))
+                        bridge->driver = &intel_i965_driver;
+                else
+                        bridge->driver = &intel_845_driver;
+                name = "965GM";
+                break;
        case PCI_DEVICE_ID_INTEL_7505_0:
                bridge->driver = &intel_7505_driver;
                name = "E7505";
@@ -2080,6 +2088,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
        ID(PCI_DEVICE_ID_INTEL_82965G_1_HB),
        ID(PCI_DEVICE_ID_INTEL_82965Q_HB),
        ID(PCI_DEVICE_ID_INTEL_82965G_HB),
+        ID(PCI_DEVICE_ID_INTEL_82965GM_HB),
        { }
 };
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 67f3347afcf3..1cca32f46947 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -969,7 +969,7 @@ int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int i
        if (size < rsize) {
                dbg("report %d is too short, (%d < %d)", report->id, size, rsize);
-                return -1;
+                memset(data + size, 0, rsize - size);
        }
        if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 45a928c058cf..638becda81c6 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -735,6 +735,15 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                        cdrom_saw_media_change (drive);
                        /*printk("%s: media changed\n",drive->name);*/
                        return 0;
+                } else if ((sense_key == ILLEGAL_REQUEST) &&
+                           (rq->cmd[0] == GPCMD_START_STOP_UNIT)) {
+                        /*
+                         * Don't print error message for this condition--
+                         * SFF8090i indicates that 5/24/00 is the correct
+                         * response to a request to close the tray if the
+                         * drive doesn't have that capability.
+                         * cdrom_log_sense() knows this!
+                         */
                } else if (!(rq->cmd_flags & REQ_QUIET)) {
                        /* Otherwise, print an error. */
                        ide_dump_status(drive, "packet command error", stat);
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 0e0280076fcd..8670112f1d39 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -1226,6 +1226,7 @@ static void ide_do_request (ide_hwgroup_t *hwgroup, int masked_irq)
 #endif
                                /* so that ide_timer_expiry knows what to do */
                                hwgroup->sleeping = 1;
+                                hwgroup->req_gen_timer = hwgroup->req_gen;
                                mod_timer(&hwgroup->timer, sleep);
                                /* we purposely leave hwgroup->busy==1
                                 * while sleeping */
@@ -1411,7 +1412,8 @@ void ide_timer_expiry (unsigned long data)
        spin_lock_irqsave(&ide_lock, flags);
-        if ((handler = hwgroup->handler) == NULL) {
+        if (((handler = hwgroup->handler) == NULL) ||
+            (hwgroup->req_gen != hwgroup->req_gen_timer)) {
                /*
                 * Either a marginal timeout occurred
                 * (got the interrupt just as timer expired),
@@ -1439,6 +1441,7 @@ void ide_timer_expiry (unsigned long data)
                                if ((wait = expiry(drive)) > 0) {
                                        /* reset timer */
                                        hwgroup->timer.expires  = jiffies + wait;
+                                        hwgroup->req_gen_timer = hwgroup->req_gen;
                                        add_timer(&hwgroup->timer);
                                        spin_unlock_irqrestore(&ide_lock, flags);
                                        return;
@@ -1653,6 +1656,7 @@ irqreturn_t ide_intr (int irq, void *dev_id)
                printk(KERN_ERR "%s: ide_intr: hwgroup->busy was 0 ??\n", drive->name);
        }
        hwgroup->handler = NULL;
+        hwgroup->req_gen++;
        del_timer(&hwgroup->timer);
        spin_unlock(&ide_lock);
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index 1ee53a551c3a..3caa176b3155 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -889,6 +889,7 @@ static void __ide_set_handler (ide_drive_t *drive, ide_handler_t *handler,
        hwgroup->handler        = handler;
        hwgroup->expiry         = expiry;
        hwgroup->timer.expires  = jiffies + timeout;
+        hwgroup->req_gen_timer = hwgroup->req_gen;
        add_timer(&hwgroup->timer);
 }
@@ -929,6 +930,7 @@ void ide_execute_command(ide_drive_t *drive, task_ioreg_t cmd, ide_handler_t *ha
        hwgroup->handler        = handler;
        hwgroup->expiry         = expiry;
        hwgroup->timer.expires  = jiffies + timeout;
+        hwgroup->req_gen_timer = hwgroup->req_gen;
        add_timer(&hwgroup->timer);
        hwif->OUTBSYNC(drive, cmd, IDE_COMMAND_REG);
        /* Drive takes 400nS to respond, we must avoid the IRQ being
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index a6f098fda884..ae5bf2be6f52 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -1962,6 +1962,8 @@ static char *media_string(ide_drive_t *drive)
                return "tape";
        case ide_floppy:
                return "floppy";
+        case ide_optical:
+                return "optical";
        default:
                return "UNKNOWN";
        }
diff --git a/drivers/ieee1394/Kconfig b/drivers/ieee1394/Kconfig
index b8a47342cd2c..cd84a55ecf20 100644
--- a/drivers/ieee1394/Kconfig
+++ b/drivers/ieee1394/Kconfig
@@ -138,9 +138,9 @@ config IEEE1394_DV1394
        tristate "OHCI-DV I/O support (deprecated)"
        depends on IEEE1394 && IEEE1394_OHCI1394
        help
-          The dv1394 driver will be removed from Linux in a future release.
+          The dv1394 driver is unsupported and may be removed from Linux in a
-          Its functionality is now provided by raw1394 together with libraries
+          future release.  Its functionality is now provided by raw1394 together
-          such as libiec61883.
+          with libraries such as libiec61883.
 config IEEE1394_RAWIO
        tristate "Raw IEEE1394 I/O support"
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index dee9529aa8e7..026e38face5c 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -2564,8 +2564,8 @@ static int __init dv1394_init_module(void)
        int ret;
        printk(KERN_WARNING
-               "WARNING: The dv1394 driver is unsupported and will be removed "
+               "NOTE: The dv1394 driver is unsupported and may be removed in a "
-               "from Linux soon. Use raw1394 instead.\n");
+               "future Linux release. Use raw1394 instead.\n");
        cdev_init(&dv1394_cdev, &dv1394_fops);
        dv1394_cdev.owner = THIS_MODULE;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index e70492db74f6..2b242a4823f8 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -131,7 +131,7 @@ static struct sk_buff *ipoib_cm_alloc_rx_skb(struct net_device *dev, int id, int
                skb_fill_page_desc(skb, i, page, 0, PAGE_SIZE);
                mapping[i + 1] = ib_dma_map_page(priv->ca, skb_shinfo(skb)->frags[i].page,
-                                                 0, PAGE_SIZE, DMA_TO_DEVICE);
+                                                 0, PAGE_SIZE, DMA_FROM_DEVICE);
                if (unlikely(ib_dma_mapping_error(priv->ca, mapping[i + 1])))
                        goto partial_error;
        }
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index cae8c96a55f8..8960196ffb0f 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -245,7 +245,6 @@ struct iser_conn {
        wait_queue_head_t            wait;          /* waitq for conn/disconn  */
        atomic_t                     post_recv_buf_count; /* posted rx count   */
        atomic_t                     post_send_buf_count; /* posted tx count   */
-        struct work_struct           comperror_work; /* conn term sleepable ctx*/
        char                         name[ISER_OBJECT_NAME_SIZE];
        struct iser_page_vec         *page_vec;     /* represents SG to fmr maps*
                                                     * maps serialized as tx is*/
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 693b77002897..1fc967464a28 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -48,7 +48,6 @@
 static void iser_cq_tasklet_fn(unsigned long data);
 static void iser_cq_callback(struct ib_cq *cq, void *cq_context);
-static void iser_comp_error_worker(struct work_struct *work);
 static void iser_cq_event_callback(struct ib_event *cause, void *context)
 {
@@ -480,7 +479,6 @@ int iser_conn_init(struct iser_conn **ibconn)
        init_waitqueue_head(&ib_conn->wait);
        atomic_set(&ib_conn->post_recv_buf_count, 0);
        atomic_set(&ib_conn->post_send_buf_count, 0);
-        INIT_WORK(&ib_conn->comperror_work, iser_comp_error_worker);
        INIT_LIST_HEAD(&ib_conn->conn_list);
        spin_lock_init(&ib_conn->lock);
@@ -753,26 +751,6 @@ int iser_post_send(struct iser_desc *tx_desc)
        return ret_val;
 }
-static void iser_comp_error_worker(struct work_struct *work)
-{
-        struct iser_conn *ib_conn =
-                container_of(work, struct iser_conn, comperror_work);
-        /* getting here when the state is UP means that the conn is being *
-         * terminated asynchronously from the iSCSI layer's perspective.  */
-        if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
-                                      ISER_CONN_TERMINATING))
-                iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
-                                        ISCSI_ERR_CONN_FAILED);
-        /* complete the termination process if disconnect event was delivered *
-         * note there are no more non completed posts to the QP               */
-        if (ib_conn->disc_evt_flag) {
-                ib_conn->state = ISER_CONN_DOWN;
-                wake_up_interruptible(&ib_conn->wait);
-        }
-}
 static void iser_handle_comp_error(struct iser_desc *desc)
 {
        struct iser_dto  *dto     = &desc->dto;
@@ -791,8 +769,22 @@ static void iser_handle_comp_error(struct iser_desc *desc)
        }
        if (atomic_read(&ib_conn->post_recv_buf_count) == 0 &&
-            atomic_read(&ib_conn->post_send_buf_count) == 0)
+            atomic_read(&ib_conn->post_send_buf_count) == 0) {
-                schedule_work(&ib_conn->comperror_work);
+                /* getting here when the state is UP means that the conn is *
+                 * being terminated asynchronously from the iSCSI layer's   *
+                 * perspective.                                             */
+                if (iser_conn_state_comp_exch(ib_conn, ISER_CONN_UP,
+                    ISER_CONN_TERMINATING))
+                        iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
+                                           ISCSI_ERR_CONN_FAILED);
+                /* complete the termination process if disconnect event was delivered *
+                 * note there are no more non completed posts to the QP               */
+                if (ib_conn->disc_evt_flag) {
+                        ib_conn->state = ISER_CONN_DOWN;
+                        wake_up_interruptible(&ib_conn->wait);
+                }
+        }
 }
 static void iser_cq_tasklet_fn(unsigned long data)
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index c7db4032ef02..e8606c48c9c3 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -553,6 +553,7 @@ static int ucb1400_ts_remove(struct device *dev)
 }
 static struct device_driver ucb1400_ts_driver = {
+        .name           = "ucb1400_ts",
        .owner          = THIS_MODULE,
        .bus            = &ac97_bus_type,
        .probe          = ucb1400_ts_probe,
diff --git a/drivers/net/cxgb3/common.h b/drivers/net/cxgb3/common.h
index 97128d88eaef..8d1379633698 100644
--- a/drivers/net/cxgb3/common.h
+++ b/drivers/net/cxgb3/common.h
@@ -478,8 +478,11 @@ struct cmac {
        struct adapter *adapter;
        unsigned int offset;
        unsigned int nucast;    /* # of address filters for unicast MACs */
-        unsigned int tcnt;
+        unsigned int tx_tcnt;
-        unsigned int xcnt;
+        unsigned int tx_xcnt;
+        u64 tx_mcnt;
+        unsigned int rx_xcnt;
+        u64 rx_mcnt;
        unsigned int toggle_cnt;
        unsigned int txen;
        struct mac_stats stats;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 26240fd5e768..67b4b219d927 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -194,15 +194,13 @@ void t3_os_link_changed(struct adapter *adapter, int port_id, int link_stat,
        if (link_stat != netif_carrier_ok(dev)) {
                if (link_stat) {
-                        t3_set_reg_field(adapter,
+                        t3_mac_enable(mac, MAC_DIRECTION_RX);
-                                         A_XGM_TXFIFO_CFG + mac->offset,
-                                         F_ENDROPPKT, 0);
                        netif_carrier_on(dev);
                } else {
                        netif_carrier_off(dev);
-                        t3_set_reg_field(adapter,
+                        pi->phy.ops->power_down(&pi->phy, 1);
-                                         A_XGM_TXFIFO_CFG + mac->offset,
+                        t3_mac_disable(mac, MAC_DIRECTION_RX);
-                                         F_ENDROPPKT, F_ENDROPPKT);
+                        t3_link_start(&pi->phy, mac, &pi->link_config);
                }
                link_report(dev);
@@ -772,6 +770,8 @@ static int cxgb_up(struct adapter *adap)
                if (err)
                        goto out;
+                t3_write_reg(adap, A_ULPRX_TDDP_PSZ, V_HPZ0(PAGE_SHIFT - 12));
+                
                err = setup_sge_qsets(adap);
                if (err)
                        goto out;
@@ -2119,7 +2119,9 @@ static void check_t3b2_mac(struct adapter *adapter)
 {
        int i;
-        rtnl_lock();                      /* synchronize with ifdown */
+        if (!rtnl_trylock())    /* synchronize with ifdown */
+                return;
        for_each_port(adapter, i) {
                struct net_device *dev = adapter->port[i];
                struct port_info *p = netdev_priv(dev);
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index eed7a48e3111..48649244673e 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -743,17 +743,6 @@ static int do_act_establish(struct t3cdev *dev, struct sk_buff *skb)
        }
 }
-static int do_set_tcb_rpl(struct t3cdev *dev, struct sk_buff *skb)
-{
-        struct cpl_set_tcb_rpl *rpl = cplhdr(skb);
-        if (rpl->status != CPL_ERR_NONE)
-                printk(KERN_ERR
-                       "Unexpected SET_TCB_RPL status %u for tid %u\n",
-                       rpl->status, GET_TID(rpl));
-        return CPL_RET_BUF_DONE;
-}
 static int do_trace(struct t3cdev *dev, struct sk_buff *skb)
 {
        struct cpl_trace_pkt *p = cplhdr(skb);
@@ -1215,7 +1204,8 @@ void __init cxgb3_offload_init(void)
        t3_register_cpl_handler(CPL_CLOSE_CON_RPL, do_hwtid_rpl);
        t3_register_cpl_handler(CPL_ABORT_REQ_RSS, do_abort_req_rss);
        t3_register_cpl_handler(CPL_ACT_ESTABLISH, do_act_establish);
-        t3_register_cpl_handler(CPL_SET_TCB_RPL, do_set_tcb_rpl);
+        t3_register_cpl_handler(CPL_SET_TCB_RPL, do_hwtid_rpl);
+        t3_register_cpl_handler(CPL_GET_TCB_RPL, do_hwtid_rpl);
        t3_register_cpl_handler(CPL_RDMA_TERMINATE, do_term);
        t3_register_cpl_handler(CPL_RDMA_EC_STATUS, do_hwtid_rpl);
        t3_register_cpl_handler(CPL_TRACE_PKT, do_trace);
diff --git a/drivers/net/cxgb3/regs.h b/drivers/net/cxgb3/regs.h
index f8be41c5a081..e5a553410e24 100644
--- a/drivers/net/cxgb3/regs.h
+++ b/drivers/net/cxgb3/regs.h
@@ -1234,9 +1234,15 @@
 #define A_ULPRX_ISCSI_TAGMASK 0x514
+#define S_HPZ0    0
+#define M_HPZ0    0xf
+#define V_HPZ0(x) ((x) << S_HPZ0)
+#define G_HPZ0(x) (((x) >> S_HPZ0) & M_HPZ0)
 #define A_ULPRX_TDDP_LLIMIT 0x51c
 #define A_ULPRX_TDDP_ULIMIT 0x520
+#define A_ULPRX_TDDP_PSZ 0x528
 #define A_ULPRX_STAG_LLIMIT 0x52c
diff --git a/drivers/net/cxgb3/xgmac.c b/drivers/net/cxgb3/xgmac.c
index 94aaff005a35..a506792f9575 100644
--- a/drivers/net/cxgb3/xgmac.c
+++ b/drivers/net/cxgb3/xgmac.c
@@ -367,7 +367,8 @@ int t3_mac_enable(struct cmac *mac, int which)
        int idx = macidx(mac);
        struct adapter *adap = mac->adapter;
        unsigned int oft = mac->offset;
+        struct mac_stats *s = &mac->stats;
+        
        if (which & MAC_DIRECTION_TX) {
                t3_write_reg(adap, A_XGM_TX_CTRL + oft, F_TXEN);
                t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CFG_CH0 + idx);
@@ -376,10 +377,16 @@ int t3_mac_enable(struct cmac *mac, int which)
                t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 1 << idx);
                t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CNT_CH0 + idx);
-                mac->tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
+                mac->tx_mcnt = s->tx_frames;
-                                                            A_TP_PIO_DATA)));
+                mac->tx_tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
-                mac->xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                        A_TP_PIO_DATA)));
-                                                A_XGM_TX_SPI4_SOP_EOP_CNT)));
+                mac->tx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_TX_SPI4_SOP_EOP_CNT +
+                                                oft)));
+                mac->rx_mcnt = s->rx_frames;
+                mac->rx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_RX_SPI4_SOP_EOP_CNT +
+                                                oft)));
                mac->txen = F_TXEN;
                mac->toggle_cnt = 0;
        }
@@ -392,6 +399,7 @@ int t3_mac_disable(struct cmac *mac, int which)
 {
        int idx = macidx(mac);
        struct adapter *adap = mac->adapter;
+        int val;
        if (which & MAC_DIRECTION_TX) {
                t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
@@ -401,44 +409,89 @@ int t3_mac_disable(struct cmac *mac, int which)
                t3_set_reg_field(adap, A_TP_PIO_DATA, 1 << idx, 1 << idx);
                mac->txen = 0;
        }
-        if (which & MAC_DIRECTION_RX)
+        if (which & MAC_DIRECTION_RX) {
+                t3_set_reg_field(mac->adapter, A_XGM_RESET_CTRL + mac->offset,
+                                 F_PCS_RESET_, 0);
+                msleep(100);
                t3_write_reg(adap, A_XGM_RX_CTRL + mac->offset, 0);
+                val = F_MAC_RESET_;
+                if (is_10G(adap))
+                        val |= F_PCS_RESET_;
+                else if (uses_xaui(adap))
+                        val |= F_PCS_RESET_ | F_XG2G_RESET_;
+                else
+                        val |= F_RGMII_RESET_ | F_XG2G_RESET_;
+                t3_write_reg(mac->adapter, A_XGM_RESET_CTRL + mac->offset, val);
+        }
        return 0;
 }
 int t3b2_mac_watchdog_task(struct cmac *mac)
 {
        struct adapter *adap = mac->adapter;
-        unsigned int tcnt, xcnt;
+        struct mac_stats *s = &mac->stats;
+        unsigned int tx_tcnt, tx_xcnt;
+        unsigned int tx_mcnt = s->tx_frames;
+        unsigned int rx_mcnt = s->rx_frames;
+        unsigned int rx_xcnt;
        int status;
-        t3_write_reg(adap, A_TP_PIO_ADDR, A_TP_TX_DROP_CNT_CH0 + macidx(mac));
+        if (tx_mcnt == mac->tx_mcnt) {
-        tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap, A_TP_PIO_DATA)));
+                tx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
-        xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap, 
+                                                A_XGM_TX_SPI4_SOP_EOP_CNT +
-                                           A_XGM_TX_SPI4_SOP_EOP_CNT +
+                                                mac->offset)));
-                                           mac->offset)));
+                if (tx_xcnt == 0) {
+                        t3_write_reg(adap, A_TP_PIO_ADDR,
-        if (tcnt != mac->tcnt && xcnt == 0 && mac->xcnt == 0) {
+                                     A_TP_TX_DROP_CNT_CH0 + macidx(mac));
-                if (mac->toggle_cnt > 4) {
+                        tx_tcnt = (G_TXDROPCNTCH0RCVD(t3_read_reg(adap,
-                        t3b2_mac_reset(mac);
+                                                      A_TP_PIO_DATA)));
+                } else {
                        mac->toggle_cnt = 0;
+                        return 0;
+                }
+        } else {
+                mac->toggle_cnt = 0;
+                return 0;
+        }
+        if (((tx_tcnt != mac->tx_tcnt) &&
+             (tx_xcnt == 0) && (mac->tx_xcnt == 0)) ||
+            ((mac->tx_mcnt == tx_mcnt) &&
+             (tx_xcnt != 0) && (mac->tx_xcnt != 0))) {
+                if (mac->toggle_cnt > 4)
                        status = 2;
-                } else {
+                else 
-                        t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
-                        t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);
-                        t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset,
-                                     mac->txen);
-                        t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);
-                        mac->toggle_cnt++;
                        status = 1;
-                }       
        } else {
                mac->toggle_cnt = 0;
-                status = 0;
+                return 0;
        }
-        mac->tcnt = tcnt;
-        mac->xcnt = xcnt;
+        if (rx_mcnt != mac->rx_mcnt)
+                rx_xcnt = (G_TXSPI4SOPCNT(t3_read_reg(adap,
+                                                A_XGM_RX_SPI4_SOP_EOP_CNT +
+                                                mac->offset)));
+        else 
+                return 0;
+        if (mac->rx_mcnt != s->rx_frames && rx_xcnt == 0 && mac->rx_xcnt == 0) 
+                status = 2;
+        
+        mac->tx_tcnt = tx_tcnt;
+        mac->tx_xcnt = tx_xcnt;
+        mac->tx_mcnt = s->tx_frames;
+        mac->rx_xcnt = rx_xcnt;
+        mac->rx_mcnt = s->rx_frames;
+        if (status == 1) {
+                t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, 0);
+                t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);  /* flush */
+                t3_write_reg(adap, A_XGM_TX_CTRL + mac->offset, mac->txen);
+                t3_read_reg(adap, A_XGM_TX_CTRL + mac->offset);  /* flush */
+                mac->toggle_cnt++;
+        } else if (status == 2) {
+                t3b2_mac_reset(mac);
+                mac->toggle_cnt = 0;
+        }
        return status;
 }
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index c216e6a5d235..f8efe0e70a6b 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -71,7 +71,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
-#define MYRI10GE_VERSION_STR "1.3.0-1.227"
+#define MYRI10GE_VERSION_STR "1.3.0-1.233"
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -900,19 +900,9 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
        /* try to refill entire ring */
        while (rx->fill_cnt != (rx->cnt + rx->mask + 1)) {
                idx = rx->fill_cnt & rx->mask;
+                if (rx->page_offset + bytes <= MYRI10GE_ALLOC_SIZE) {
-                if ((bytes < MYRI10GE_ALLOC_SIZE / 2) &&
-                    (rx->page_offset + bytes <= MYRI10GE_ALLOC_SIZE)) {
                        /* we can use part of previous page */
                        get_page(rx->page);
-#if MYRI10GE_ALLOC_SIZE > 4096
-                        /* Firmware cannot cross 4K boundary.. */
-                        if ((rx->page_offset >> 12) !=
-                            ((rx->page_offset + bytes - 1) >> 12)) {
-                                rx->page_offset =
-                                    (rx->page_offset + bytes) & ~4095;
-                        }
-#endif
                } else {
                        /* we need a new page */
                        page =
@@ -941,6 +931,13 @@ myri10ge_alloc_rx_pages(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
                /* start next packet on a cacheline boundary */
                rx->page_offset += SKB_DATA_ALIGN(bytes);
+#if MYRI10GE_ALLOC_SIZE > 4096
+                /* don't cross a 4KB boundary */
+                if ((rx->page_offset >> 12) !=
+                    ((rx->page_offset + bytes - 1) >> 12))
+                        rx->page_offset = (rx->page_offset + 4096) & ~4095;
+#endif
                rx->fill_cnt++;
                /* copy 8 descriptors to the firmware at a time */
@@ -2490,6 +2487,10 @@ static void myri10ge_enable_ecrc(struct myri10ge_priv *mgp)
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE23 0x25f7
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE47 0x25fa
+#define PCI_DEVICE_ID_INTEL_6300ESB_PCIEE1 0x3510
+#define PCI_DEVICE_ID_INTEL_6300ESB_PCIEE4 0x351b
+#define PCI_DEVICE_ID_INTEL_E3000_PCIE  0x2779
+#define PCI_DEVICE_ID_INTEL_E3010_PCIE  0x277a
 #define PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_FIRST 0x140
 #define PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_LAST 0x142
@@ -2529,6 +2530,18 @@ static void myri10ge_select_firmware(struct myri10ge_priv *mgp)
                                PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_FIRST
                                && bridge->device <=
                                PCI_DEVICE_ID_SERVERWORKS_HT2100_PCIE_LAST)
+                            /* All Intel E3000/E3010 PCIE ports */
+                            || (bridge->vendor == PCI_VENDOR_ID_INTEL
+                                && (bridge->device ==
+                                    PCI_DEVICE_ID_INTEL_E3000_PCIE
+                                    || bridge->device ==
+                                    PCI_DEVICE_ID_INTEL_E3010_PCIE))
+                            /* All Intel 6310/6311/6321ESB PCIE ports */
+                            || (bridge->vendor == PCI_VENDOR_ID_INTEL
+                                && bridge->device >=
+                                PCI_DEVICE_ID_INTEL_6300ESB_PCIEE1
+                                && bridge->device <=
+                                PCI_DEVICE_ID_INTEL_6300ESB_PCIEE4)
                            /* All Intel E5000 PCIE ports */
                            || (bridge->vendor == PCI_VENDOR_ID_INTEL
                                && bridge->device >=
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 4a926f20b6ea..c32c21af3fdd 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -964,7 +964,7 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
                goto out;
        }
-        spin_lock_bh(&priv->lock);
+        spin_lock(&priv->lock);
        if (unlikely(!netif_carrier_ok(dev))) {
                err = -ENOLINK;
@@ -1005,7 +1005,7 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
                netif_stop_queue(dev);
 out_unlock:
-        spin_unlock_bh(&priv->lock);
+        spin_unlock(&priv->lock);
 out:
        dev_kfree_skb(skb);
@@ -1042,12 +1042,12 @@ static int sc92031_open(struct net_device *dev)
        priv->pm_config = 0;
        /* Interrupts already disabled by sc92031_stop or sc92031_probe */
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
        _sc92031_reset(dev);
        mmiowb();
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
        sc92031_enable_interrupts(dev);
        if (netif_carrier_ok(dev))
@@ -1077,13 +1077,13 @@ static int sc92031_stop(struct net_device *dev)
        /* Disable interrupts, stop Tx and Rx. */
        sc92031_disable_interrupts(dev);
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
        _sc92031_disable_tx_rx(dev);
        _sc92031_tx_clear(dev);
        mmiowb();
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
        free_irq(pdev->irq, dev);
        pci_free_consistent(pdev, TX_BUF_TOT_LEN, priv->tx_bufs,
@@ -1539,13 +1539,13 @@ static int sc92031_suspend(struct pci_dev *pdev, pm_message_t state)
        /* Disable interrupts, stop Tx and Rx. */
        sc92031_disable_interrupts(dev);
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
        _sc92031_disable_tx_rx(dev);
        _sc92031_tx_clear(dev);
        mmiowb();
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
 out:
        pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -1565,12 +1565,12 @@ static int sc92031_resume(struct pci_dev *pdev)
                goto out;
        /* Interrupts already disabled by sc92031_suspend */
-        spin_lock(&priv->lock);
+        spin_lock_bh(&priv->lock);
        _sc92031_reset(dev);
        mmiowb();
-        spin_unlock(&priv->lock);
+        spin_unlock_bh(&priv->lock);
        sc92031_enable_interrupts(dev);
        netif_device_attach(dev);
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 39c6677dff5e..d476a3cc2e94 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -163,27 +163,46 @@ static void skge_wol_init(struct skge_port *skge)
 {
        struct skge_hw *hw = skge->hw;
        int port = skge->port;
-        enum pause_control save_mode;
+        u16 ctrl;
-        u32 ctrl;
-        /* Bring hardware out of reset */
        skge_write16(hw, B0_CTST, CS_RST_CLR);
        skge_write16(hw, SK_REG(port, GMAC_LINK_CTRL), GMLC_RST_CLR);
-        skge_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_CLR);
+        /* Turn on Vaux */
-        skge_write8(hw, SK_REG(port, GMAC_CTRL), GMC_RST_CLR);
+        skge_write8(hw, B0_POWER_CTRL,
+                    PC_VAUX_ENA | PC_VCC_ENA | PC_VAUX_ON | PC_VCC_OFF);
-        /* Force to 10/100 skge_reset will re-enable on resume   */
+        /* WA code for COMA mode -- clear PHY reset */
-        save_mode = skge->flow_control;
+        if (hw->chip_id == CHIP_ID_YUKON_LITE &&
-        skge->flow_control = FLOW_MODE_SYMMETRIC;
+            hw->chip_rev >= CHIP_REV_YU_LITE_A3) {
+                u32 reg = skge_read32(hw, B2_GP_IO);
+                reg |= GP_DIR_9;
+                reg &= ~GP_IO_9;
+                skge_write32(hw, B2_GP_IO, reg);
+        }
-        ctrl = skge->advertising;
+        skge_write32(hw, SK_REG(port, GPHY_CTRL),
-        skge->advertising &= ~(ADVERTISED_1000baseT_Half|ADVERTISED_1000baseT_Full);
+                     GPC_DIS_SLEEP |
+                     GPC_HWCFG_M_3 | GPC_HWCFG_M_2 | GPC_HWCFG_M_1 | GPC_HWCFG_M_0 |
+                     GPC_ANEG_1 | GPC_RST_SET);
-        skge_phy_reset(skge);
+        skge_write32(hw, SK_REG(port, GPHY_CTRL),
+                     GPC_DIS_SLEEP |
+                     GPC_HWCFG_M_3 | GPC_HWCFG_M_2 | GPC_HWCFG_M_1 | GPC_HWCFG_M_0 |
+                     GPC_ANEG_1 | GPC_RST_CLR);
+        skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_RST_CLR);
+        /* Force to 10/100 skge_reset will re-enable on resume   */
+        gm_phy_write(hw, port, PHY_MARV_AUNE_ADV,
+                     PHY_AN_100FULL | PHY_AN_100HALF |
+                     PHY_AN_10FULL | PHY_AN_10HALF| PHY_AN_CSMA);
+        /* no 1000 HD/FD */
+        gm_phy_write(hw, port, PHY_MARV_1000T_CTRL, 0);
+        gm_phy_write(hw, port, PHY_MARV_CTRL,
+                     PHY_CT_RESET | PHY_CT_SPS_LSB | PHY_CT_ANE |
+                     PHY_CT_RE_CFG | PHY_CT_DUP_MD);
-        skge->flow_control = save_mode;
-        skge->advertising = ctrl;
        /* Set GMAC to no flow control and auto update for speed/duplex */
        gma_write16(hw, port, GM_GP_CTRL,
@@ -227,12 +246,10 @@ static int skge_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
        struct skge_port *skge = netdev_priv(dev);
        struct skge_hw *hw = skge->hw;
-        if (wol->wolopts & wol_supported(hw))
+        if (wol->wolopts & ~wol_supported(hw))
                return -EOPNOTSUPP;
        skge->wol = wol->wolopts;
-        if (!netif_running(dev))
-                skge_wol_init(skge);
        return 0;
 }
@@ -2535,10 +2552,12 @@ static int skge_down(struct net_device *dev)
                printk(KERN_INFO PFX "%s: disabling interface\n", dev->name);
        netif_stop_queue(dev);
        if (hw->chip_id == CHIP_ID_GENESIS && hw->phy_type == SK_PHY_XMAC)
                del_timer_sync(&skge->link_timer);
        netif_poll_disable(dev);
+        netif_carrier_off(dev);
        spin_lock_irq(&hw->hw_lock);
        hw->intr_mask &= ~portmask[port];
@@ -3765,21 +3784,6 @@ static void __devexit skge_remove(struct pci_dev *pdev)
 }
 #ifdef CONFIG_PM
-static int vaux_avail(struct pci_dev *pdev)
-{
-        int pm_cap;
-        pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
-        if (pm_cap) {
-                u16 ctl;
-                pci_read_config_word(pdev, pm_cap + PCI_PM_PMC, &ctl);
-                if (ctl & PCI_PM_CAP_AUX_POWER)
-                        return 1;
-        }
-        return 0;
-}
 static int skge_suspend(struct pci_dev *pdev, pm_message_t state)
 {
        struct skge_hw *hw  = pci_get_drvdata(pdev);
@@ -3801,10 +3805,6 @@ static int skge_suspend(struct pci_dev *pdev, pm_message_t state)
                wol |= skge->wol;
        }
-        if (wol && vaux_avail(pdev))
-                skge_write8(hw, B0_POWER_CTRL,
-                            PC_VAUX_ENA | PC_VCC_ENA | PC_VAUX_ON | PC_VCC_OFF);
        skge_write32(hw, B0_IMSK, 0);
        pci_enable_wake(pdev, pci_choose_state(pdev, state), wol);
        pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -3850,6 +3850,28 @@ out:
 }
 #endif
+static void skge_shutdown(struct pci_dev *pdev)
+{
+        struct skge_hw *hw  = pci_get_drvdata(pdev);
+        int i, wol = 0;
+        for (i = 0; i < hw->ports; i++) {
+                struct net_device *dev = hw->dev[i];
+                struct skge_port *skge = netdev_priv(dev);
+                if (skge->wol)
+                        skge_wol_init(skge);
+                wol |= skge->wol;
+        }
+        pci_enable_wake(pdev, PCI_D3hot, wol);
+        pci_enable_wake(pdev, PCI_D3cold, wol);
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
+}
 static struct pci_driver skge_driver = {
        .name =         DRV_NAME,
        .id_table =     skge_id_table,
@@ -3859,6 +3881,7 @@ static struct pci_driver skge_driver = {
        .suspend =      skge_suspend,
        .resume =       skge_resume,
 #endif
+        .shutdown =     skge_shutdown,
 };
 static int __init skge_init_module(void)
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index ab0ab92583fe..4a009b7b1777 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -510,9 +510,9 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                ledover &= ~PHY_M_LED_MO_RX;
        }
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == CHIP_REV_YU_EC_A1) {
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U &&
+            hw->chip_rev == CHIP_REV_YU_EC_U_A1) {
                /* apply fixes in PHY AFE */
-                pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 255);
                /* increase differential signal amplitude in 10BASE-T */
@@ -524,7 +524,7 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                gm_phy_write(hw, port, 0x17, 0x2002);
                /* set page register to 0 */
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 0);
        } else if (hw->chip_id != CHIP_ID_YUKON_EX) {
                gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
@@ -1561,6 +1561,7 @@ static int sky2_down(struct net_device *dev)
        /* Stop more packets from being queued */
        netif_stop_queue(dev);
+        netif_carrier_off(dev);
        /* Disable port IRQ */
        imask = sky2_read32(hw, B0_IMSK);
@@ -3769,6 +3770,11 @@ static int sky2_resume(struct pci_dev *pdev)
                goto out;
        pci_enable_wake(pdev, PCI_D0, 0);
+        /* Re-enable all clocks */
+        if (hw->chip_id == CHIP_ID_YUKON_EX || hw->chip_id == CHIP_ID_YUKON_EC_U)
+                sky2_pci_write32(hw, PCI_DEV_REG3, 0);
        sky2_reset(hw);
        sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 0acee9f324e9..256969e1300c 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4834,8 +4834,10 @@ static int tg3_chip_reset(struct tg3 *tp)
         * sharing or irqpoll.
         */
        tp->tg3_flags |= TG3_FLAG_CHIP_RESETTING;
-        tp->hw_status->status = 0;
+        if (tp->hw_status) {
-        tp->hw_status->status_tag = 0;
+                tp->hw_status->status = 0;
+                tp->hw_status->status_tag = 0;
+        }
        tp->last_tag = 0;
        smp_mb();
        synchronize_irq(tp->pdev->irq);
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index d77f75129f8a..2df216b00817 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -202,15 +202,14 @@ static struct pccard_operations omap_cf_ops = {
 * "what chipselect is used".  Boards could want more.
 */
-static int __devinit omap_cf_probe(struct device *dev)
+static int __init omap_cf_probe(struct platform_device *pdev)
 {
        unsigned                seg;
        struct omap_cf_socket   *cf;
-        struct platform_device  *pdev = to_platform_device(dev);
        int                     irq;
        int                     status;
-        seg = (int) dev->platform_data;
+        seg = (int) pdev->dev.platform_data;
        if (seg == 0 || seg > 3)
                return -ENODEV;
@@ -227,7 +226,7 @@ static int __devinit omap_cf_probe(struct device *dev)
        cf->timer.data = (unsigned long) cf;
        cf->pdev = pdev;
-        dev_set_drvdata(dev, cf);
+        platform_set_drvdata(pdev, cf);
        /* this primarily just shuts up irq handling noise */
        status = request_irq(irq, omap_cf_irq, IRQF_SHARED,
@@ -291,7 +290,7 @@ static int __devinit omap_cf_probe(struct device *dev)
                omap_cf_present() ? "present" : "(not present)");
        cf->socket.owner = THIS_MODULE;
-        cf->socket.dev.parent = dev;
+        cf->socket.dev.parent = &pdev->dev;
        cf->socket.ops = &omap_cf_ops;
        cf->socket.resource_ops = &pccard_static_ops;
        cf->socket.features = SS_CAP_PCCARD | SS_CAP_STATIC_MAP
@@ -318,9 +317,9 @@ fail0:
        return status;
 }
-static int __devexit omap_cf_remove(struct device *dev)
+static int __exit omap_cf_remove(struct platform_device *pdev)
 {
-        struct omap_cf_socket *cf = dev_get_drvdata(dev);
+        struct omap_cf_socket *cf = platform_get_drvdata(pdev);
        cf->active = 0;
        pcmcia_unregister_socket(&cf->socket);
@@ -332,26 +331,36 @@ static int __devexit omap_cf_remove(struct device *dev)
        return 0;
 }
-static struct device_driver omap_cf_driver = {
+static int omap_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
-        .name           = (char *) driver_name,
+{
-        .bus            = &platform_bus_type,
+        return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
-        .probe          = omap_cf_probe,
+}
-        .remove         = __devexit_p(omap_cf_remove),
-        .suspend        = pcmcia_socket_dev_suspend,
+static int omap_cf_resume(struct platform_device *pdev)
-        .resume         = pcmcia_socket_dev_resume,
+{
+        return pcmcia_socket_dev_resume(&pdev->dev);
+}
+static struct platform_driver omap_cf_driver = {
+        .driver = {
+                .name   = (char *) driver_name,
+        },
+        .remove         = __exit_p(omap_cf_remove),
+        .suspend        = omap_cf_suspend,
+        .resume         = omap_cf_resume,
 };
 static int __init omap_cf_init(void)
 {
        if (cpu_is_omap16xx())
-                return driver_register(&omap_cf_driver);
+                return platform_driver_probe(&omap_cf_driver, omap_cf_probe);
        return -ENODEV;
 }
 static void __exit omap_cf_exit(void)
 {
        if (cpu_is_omap16xx())
-                driver_unregister(&omap_cf_driver);
+                platform_driver_unregister(&omap_cf_driver);
 }
 module_init(omap_cf_init);
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 406bf61ed510..8890eba1db52 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -195,7 +195,7 @@ static struct dentry_operations fuse_dentry_operations = {
        .d_revalidate   = fuse_dentry_revalidate,
 };
-static int valid_mode(int m)
+int fuse_valid_type(int m)
 {
        return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
                S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
@@ -248,7 +248,8 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
        fuse_put_request(fc, req);
        /* Zero nodeid is same as -ENOENT, but with valid timeout */
        if (!err && outarg.nodeid &&
-            (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))
+            (invalid_nodeid(outarg.nodeid) ||
+             !fuse_valid_type(outarg.attr.mode)))
                err = -EIO;
        if (!err && outarg.nodeid) {
                inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index b98b20de7405..68ae87cbafab 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -552,3 +552,8 @@ int fuse_ctl_add_conn(struct fuse_conn *fc);
 * Remove connection from control filesystem
 */
 void fuse_ctl_remove_conn(struct fuse_conn *fc);
+/**
+ * Is file type valid?
+ */
+int fuse_valid_type(int m);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 5ab8e50e7808..608db81219a0 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -330,6 +330,8 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev)
                case OPT_ROOTMODE:
                        if (match_octal(&args[0], &value))
                                return 0;
+                        if (!fuse_valid_type(value))
+                                return 0;
                        d->rootmode = value;
                        d->rootmode_present = 1;
                        break;
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 00c23433b39f..6d7e279b1490 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -180,6 +180,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #ifndef __HAVE_ARCH_ENTER_LAZY_MMU_MODE
 #define arch_enter_lazy_mmu_mode()      do {} while (0)
 #define arch_leave_lazy_mmu_mode()      do {} while (0)
+#define arch_flush_lazy_mmu_mode()      do {} while (0)
 #endif
 /*
@@ -193,6 +194,7 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #ifndef __HAVE_ARCH_ENTER_LAZY_CPU_MODE
 #define arch_enter_lazy_cpu_mode()      do {} while (0)
 #define arch_leave_lazy_cpu_mode()      do {} while (0)
+#define arch_flush_lazy_cpu_mode()      do {} while (0)
 #endif
 /*
diff --git a/include/asm-i386/paravirt.h b/include/asm-i386/paravirt.h
index 46dc34ca887a..e63f1e444fcf 100644
--- a/include/asm-i386/paravirt.h
+++ b/include/asm-i386/paravirt.h
@@ -421,14 +421,17 @@ static inline void pmd_clear(pmd_t *pmdp)
 #define PARAVIRT_LAZY_NONE 0
 #define PARAVIRT_LAZY_MMU  1
 #define PARAVIRT_LAZY_CPU  2
+#define PARAVIRT_LAZY_FLUSH 3
 #define  __HAVE_ARCH_ENTER_LAZY_CPU_MODE
 #define arch_enter_lazy_cpu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_CPU)
 #define arch_leave_lazy_cpu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_NONE)
+#define arch_flush_lazy_cpu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_FLUSH)
 #define  __HAVE_ARCH_ENTER_LAZY_MMU_MODE
 #define arch_enter_lazy_mmu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_MMU)
 #define arch_leave_lazy_mmu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_NONE)
+#define arch_flush_lazy_mmu_mode() paravirt_ops.set_lazy_mode(PARAVIRT_LAZY_FLUSH)
 /* These all sit in the .parainstructions section to tell us what to patch. */
 struct paravirt_patch {
diff --git a/include/asm-ia64/sn/pcibr_provider.h b/include/asm-ia64/sn/pcibr_provider.h
index 17cb6cc3f21a..da205b7cdaac 100644
--- a/include/asm-ia64/sn/pcibr_provider.h
+++ b/include/asm-ia64/sn/pcibr_provider.h
@@ -21,6 +21,7 @@
 #define IS_PCI_BRIDGE_ASIC(asic) (asic == PCIIO_ASIC_TYPE_PIC || \
                asic == PCIIO_ASIC_TYPE_TIOCP)
 #define IS_PIC_SOFT(ps)     (ps->pbi_bridge_type == PCIBR_BRIDGETYPE_PIC)
+#define IS_TIOCP_SOFT(ps)   (ps->pbi_bridge_type == PCIBR_BRIDGETYPE_TIOCP)
 /*
@@ -53,8 +54,8 @@
 * Bridge PMU Address Transaltion Entry Attibutes
 */
 #define PCI32_ATE_V                     (0x1 << 0)
-#define PCI32_ATE_CO                    (0x1 << 1)
+#define PCI32_ATE_CO                    (0x1 << 1)      /* PIC ASIC ONLY */
-#define PCI32_ATE_PREC                  (0x1 << 2)
+#define PCI32_ATE_PIO                   (0x1 << 1)      /* TIOCP ASIC ONLY */
 #define PCI32_ATE_MSI                   (0x1 << 2)
 #define PCI32_ATE_PREF                  (0x1 << 3)
 #define PCI32_ATE_BAR                   (0x1 << 4)
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 5bdbc744e773..17c29dca8354 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -206,6 +206,7 @@ struct hrtimer_cpu_base {
 struct clock_event_device;
 extern void clock_was_set(void);
+extern void hres_timers_resume(void);
 extern void hrtimer_interrupt(struct clock_event_device *dev);
 /*
@@ -236,6 +237,8 @@ static inline ktime_t hrtimer_cb_get_time(struct hrtimer *timer)
 */
 static inline void clock_was_set(void) { }
+static inline void hres_timers_resume(void) { }
 /*
 * In non high resolution mode the time reference is taken from
 * the base softirq time variable.
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 58564a199862..d3bbc7188b6a 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -861,6 +861,8 @@ typedef struct hwgroup_s {
        int (*expiry)(ide_drive_t *);
                /* ide_system_bus_speed */
        int pio_clock;
+        int req_gen;
+        int req_gen_timer;
        unsigned char cmd_buf[4];
 } ide_hwgroup_t;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 067ba2c05328..b74860aaf5f1 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -459,6 +459,18 @@ void clock_was_set(void)
 }
 /*
+ * During resume we might have to reprogram the high resolution timer
+ * interrupt (on the local CPU):
+ */
+void hres_timers_resume(void)
+{
+        WARN_ON_ONCE(num_online_cpus() > 1);
+        /* Retrigger the CPU local events: */
+        retrigger_next_event(NULL);
+}
+/*
 * Check, whether the timer is on the callback pending list
 */
 static inline int hrtimer_cb_pending(const struct hrtimer *timer)
diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
index 85a430da0fb6..d8ee241115f5 100644
--- a/kernel/irq/devres.c
+++ b/kernel/irq/devres.c
@@ -54,7 +54,7 @@ int devm_request_irq(struct device *dev, unsigned int irq,
        rc = request_irq(irq, handler, irqflags, devname, dev_id);
        if (rc) {
-                kfree(dr);
+                devres_free(dr);
                return rc;
        }
diff --git a/kernel/sched.c b/kernel/sched.c
index a4ca632c477c..b9a683730148 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4687,32 +4687,10 @@ out_unlock:
        return retval;
 }
-static inline struct task_struct *eldest_child(struct task_struct *p)
-{
-        if (list_empty(&p->children))
-                return NULL;
-        return list_entry(p->children.next,struct task_struct,sibling);
-}
-static inline struct task_struct *older_sibling(struct task_struct *p)
-{
-        if (p->sibling.prev==&p->parent->children)
-                return NULL;
-        return list_entry(p->sibling.prev,struct task_struct,sibling);
-}
-static inline struct task_struct *younger_sibling(struct task_struct *p)
-{
-        if (p->sibling.next==&p->parent->children)
-                return NULL;
-        return list_entry(p->sibling.next,struct task_struct,sibling);
-}
 static const char stat_nam[] = "RSDTtZX";
 static void show_task(struct task_struct *p)
 {
-        struct task_struct *relative;
        unsigned long free = 0;
        unsigned state;
@@ -4738,19 +4716,7 @@ static void show_task(struct task_struct *p)
                free = (unsigned long)n - (unsigned long)end_of_stack(p);
        }
 #endif
-        printk("%5lu %5d %6d ", free, p->pid, p->parent->pid);
+        printk("%5lu %5d %6d", free, p->pid, p->parent->pid);
-        if ((relative = eldest_child(p)))
-                printk("%5d ", relative->pid);
-        else
-                printk("      ");
-        if ((relative = younger_sibling(p)))
-                printk("%7d", relative->pid);
-        else
-                printk("       ");
-        if ((relative = older_sibling(p)))
-                printk(" %5d", relative->pid);
-        else
-                printk("      ");
        if (!p->mm)
                printk(" (L-TLB)\n");
        else
diff --git a/kernel/timer.c b/kernel/timer.c
index 440048acaea1..dd6c2c1c561b 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1016,7 +1016,7 @@ static int timekeeping_resume(struct sys_device *dev)
        clockevents_notify(CLOCK_EVT_NOTIFY_RESUME, NULL);
        /* Resume hrtimers */
-        clock_was_set();
+        hres_timers_resume();
        return 0;
 }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e965b333c997..42b08029e867 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -411,12 +411,10 @@ checkentry(const char *tablename,
                                       "has invalid config pointer!\n");
                                return 0;
                        }
-                        clusterip_config_entry_get(cipinfo->config);
                } else {
                        /* Case B: This is a new rule referring to an existing
                         * clusterip config. */
                        cipinfo->config = config;
-                        clusterip_config_entry_get(cipinfo->config);
                }
        } else {
                /* Case C: This is a completely new clusterip config */
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 688b95594f2e..3c24881f2a65 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -943,7 +943,8 @@ static void tcp_cwnd_validate(struct sock *sk, struct tcp_sock *tp)
                if (tp->packets_out > tp->snd_cwnd_used)
                        tp->snd_cwnd_used = tp->packets_out;
-                if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
+                if (sysctl_tcp_slow_start_after_idle &&
+                    (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
                        tcp_cwnd_application_limited(sk);
        }
 }
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 89cf59ea7bbe..f68dfd8a0f5c 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -42,10 +42,9 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
        skb->nh.raw = skb_push(skb, x->props.header_len + hdrlen);
        top_iph = skb->nh.iph;
-        hdrlen = iph->ihl * 4 - optlen;
+        skb->h.raw += sizeof(*iph) - hdrlen;
-        skb->h.raw += hdrlen;
-        memmove(top_iph, iph, hdrlen);
+        memmove(top_iph, iph, sizeof(*iph));
        if (unlikely(optlen)) {
                struct ip_beet_phdr *ph;
@@ -55,6 +54,8 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                ph->padlen = 4 - (optlen & 4);
                ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8;
                ph->nexthdr = top_iph->protocol;
+                if (ph->padlen)
+                        memset(ph + 1, IPOPT_NOP, ph->padlen);
                top_iph->protocol = IPPROTO_BEETPH;
                top_iph->ihl = sizeof(struct iphdr) / 4;
@@ -77,29 +78,32 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
        protocol = iph->protocol;
        if (unlikely(iph->protocol == IPPROTO_BEETPH)) {
-                struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(iph + 1);
+                struct ip_beet_phdr *ph;
                if (!pskb_may_pull(skb, sizeof(*ph)))
                        goto out;
+                ph = (struct ip_beet_phdr *)(skb->h.ipiph + 1);
-                phlen = ph->hdrlen * 8;
+                phlen = sizeof(*ph) + ph->padlen;
-                optlen = phlen - ph->padlen - sizeof(*ph);
+                optlen = ph->hdrlen * 8 - phlen;
                if (optlen < 0 || optlen & 3 || optlen > 250)
                        goto out;
-                if (!pskb_may_pull(skb, phlen))
+                if (!pskb_may_pull(skb, phlen + optlen))
                        goto out;
+                skb->len -= phlen + optlen;
                ph_nexthdr = ph->nexthdr;
        }
-        skb_push(skb, sizeof(*iph) - phlen + optlen);
+        skb->nh.raw = skb->data + (phlen - sizeof(*iph));
-        memmove(skb->data, skb->nh.raw, sizeof(*iph));
+        memmove(skb->nh.raw, iph, sizeof(*iph));
-        skb->nh.raw = skb->data;
+        skb->h.raw = skb->data + (phlen + optlen);
+        skb->data = skb->h.raw;
        iph = skb->nh.iph;
        iph->ihl = (sizeof(*iph) + optlen) / 4;
-        iph->tot_len = htons(skb->len);
+        iph->tot_len = htons(skb->len + iph->ihl * 4);
        iph->daddr = x->sel.daddr.a4;
        iph->saddr = x->sel.saddr.a4;
        if (ph_nexthdr)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3931b33b25e8..ad9b285692ba 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -311,21 +311,12 @@ static inline void rt6_probe(struct rt6_info *rt)
 static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
        struct net_device *dev = rt->rt6i_dev;
-        int ret = 0;
+        if (!oif || dev->ifindex == oif)
-        if (!oif)
-                return 2;
-        if (dev->flags & IFF_LOOPBACK) {
-                if (!WARN_ON(rt->rt6i_idev == NULL) &&
-                    rt->rt6i_idev->dev->ifindex == oif)
-                        ret = 1;
-                else
-                        return 0;
-        }
-        if (dev->ifindex == oif)
                return 2;
+        if ((dev->flags & IFF_LOOPBACK) &&
-        return ret;
+            rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
+                return 1;
+        return 0;
 }
 static inline int rt6_check_neigh(struct rt6_info *rt)
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 040e2d2d281a..7563fdcef4b7 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -245,9 +245,9 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
        }
        if (tb[TCA_TCINDEX_SHIFT-1]) {
-                if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(u16))
+                if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(int))
                        goto errout;
-                cp.shift = *(u16 *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
+                cp.shift = *(int *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
        }
        err = -EBUSY;