229 files changed, 4401 insertions, 1832 deletions

diff --git a/CREDITS b/CREDITS
index 939da46a87fb..2b39168c06aa 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3786,14 +3786,11 @@ S: The Netherlands
 
 N: David Woodhouse
 E: dwmw2@infradead.org
-D: ARCnet stuff, Applicom board driver, SO_BINDTODEVICE,
-D: some Alpha platform porting from 2.0, Memory Technology Devices,
-D: Acquire watchdog timer, PC speaker driver maintenance,
+D: JFFS2 file system, Memory Technology Device subsystem,
 D: various other stuff that annoyed me by not working.
-S: c/o Red Hat Engineering
-S: Rustat House
-S: 60 Clifton Road
-S: Cambridge. CB1 7EG
+S: c/o Intel Corporation
+S: Pipers Way
+S: Swindon. SN3 1RJ
 S: England
 
 N: Chris Wright
diff --git a/Documentation/DMA-API.txt b/Documentation/DMA-API.txt
index b462bb149543..52441694fe03 100644
--- a/Documentation/DMA-API.txt
+++ b/Documentation/DMA-API.txt
@@ -170,16 +170,15 @@ Returns: 0 if successful and a negative error if not.
 u64
 dma_get_required_mask(struct device *dev)
 
-After setting the mask with dma_set_mask(), this API returns the
-actual mask (within that already set) that the platform actually
-requires to operate efficiently.  Usually this means the returned mask
+This API returns the mask that the platform requires to
+operate efficiently.  Usually this means the returned mask
 is the minimum required to cover all of memory.  Examining the
 required mask gives drivers with variable descriptor sizes the
 opportunity to use smaller descriptors as necessary.
 
 Requesting the required mask does not alter the current mask.  If you
-wish to take advantage of it, you should issue another dma_set_mask()
-call to lower the mask again.
+wish to take advantage of it, you should issue a dma_set_mask()
+call to set the mask to the value returned.
 
 
 Part Id - Streaming DMA mappings
diff --git a/Documentation/accounting/getdelays.c b/Documentation/accounting/getdelays.c
index cc49400b4af8..7ea231172c85 100644
--- a/Documentation/accounting/getdelays.c
+++ b/Documentation/accounting/getdelays.c
@@ -392,6 +392,10 @@ int main(int argc, char *argv[])
                         goto err;
                 }
         }
+        if (!maskset && !tid && !containerset) {
+                usage();
+                goto err;
+        }
 
         do {
                 int i;
diff --git a/Documentation/cgroups/cgroups.txt b/Documentation/cgroups/cgroups.txt
index e33ee74eee77..d9e5d6f41b92 100644
--- a/Documentation/cgroups/cgroups.txt
+++ b/Documentation/cgroups/cgroups.txt
@@ -1,7 +1,8 @@
                                 CGROUPS
                                 -------
 
-Written by Paul Menage <menage@google.com> based on Documentation/cpusets.txt
+Written by Paul Menage <menage@google.com> based on
+Documentation/cgroups/cpusets.txt
 
 Original copyright statements from cpusets.txt:
 Portions Copyright (C) 2004 BULL SA.
@@ -68,7 +69,7 @@ On their own, the only use for cgroups is for simple job
 tracking. The intention is that other subsystems hook into the generic
 cgroup support to provide new attributes for cgroups, such as
 accounting/limiting the resources which processes in a cgroup can
-access. For example, cpusets (see Documentation/cpusets.txt) allows
+access. For example, cpusets (see Documentation/cgroups/cpusets.txt) allows
 you to associate a set of CPUs and a set of memory nodes with the
 tasks in each cgroup.
 
diff --git a/Documentation/controllers/cpuacct.txt b/Documentation/cgroups/cpuacct.txt
index bb775fbe43d7..bb775fbe43d7 100644
--- a/Documentation/controllers/cpuacct.txt
+++ b/Documentation/cgroups/cpuacct.txt
diff --git a/Documentation/cpusets.txt b/Documentation/cgroups/cpusets.txt
index 5c86c258c791..5c86c258c791 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cgroups/cpusets.txt
diff --git a/Documentation/controllers/devices.txt b/Documentation/cgroups/devices.txt
index 7cc6e6a60672..7cc6e6a60672 100644
--- a/Documentation/controllers/devices.txt
+++ b/Documentation/cgroups/devices.txt
diff --git a/Documentation/controllers/memcg_test.txt b/Documentation/cgroups/memcg_test.txt
index 08d4d3ea0d79..19533f93b7a2 100644
--- a/Documentation/controllers/memcg_test.txt
+++ b/Documentation/cgroups/memcg_test.txt
@@ -6,7 +6,7 @@ Because VM is getting complex (one of reasons is memcg...), memcg's behavior
 is complex. This is a document for memcg's internal behavior.
 Please note that implementation details can be changed.
 
-(*) Topics on API should be in Documentation/controllers/memory.txt)
+(*) Topics on API should be in Documentation/cgroups/memory.txt)
 
 0. How to record usage ?
    2 objects are used.
diff --git a/Documentation/controllers/memory.txt b/Documentation/cgroups/memory.txt
index e1501964df1e..e1501964df1e 100644
--- a/Documentation/controllers/memory.txt
+++ b/Documentation/cgroups/memory.txt
diff --git a/Documentation/controllers/resource_counter.txt b/Documentation/cgroups/resource_counter.txt
index f196ac1d7d25..f196ac1d7d25 100644
--- a/Documentation/controllers/resource_counter.txt
+++ b/Documentation/cgroups/resource_counter.txt
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index d105eb45282a..bbebc3a43ac0 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1371,292 +1371,8 @@ auto_msgmni default value is 1.
 2.4 /proc/sys/vm - The virtual memory subsystem
 -----------------------------------------------
 
-The files  in  this directory can be used to tune the operation of the virtual
-memory (VM)  subsystem  of  the  Linux  kernel.
-
-vfs_cache_pressure
-------------------
-
-Controls the tendency of the kernel to reclaim the memory which is used for
-caching of directory and inode objects.
-
-At the default value of vfs_cache_pressure=100 the kernel will attempt to
-reclaim dentries and inodes at a "fair" rate with respect to pagecache and
-swapcache reclaim.  Decreasing vfs_cache_pressure causes the kernel to prefer
-to retain dentry and inode caches.  Increasing vfs_cache_pressure beyond 100
-causes the kernel to prefer to reclaim dentries and inodes.
-
-dirty_background_bytes
-----------------------
-
-Contains the amount of dirty memory at which the pdflush background writeback
-daemon will start writeback.
-
-If dirty_background_bytes is written, dirty_background_ratio becomes a function
-of its value (dirty_background_bytes / the amount of dirtyable system memory).
-
-dirty_background_ratio
-----------------------
-
-Contains, as a percentage of the dirtyable system memory (free pages + mapped
-pages + file cache, not including locked pages and HugePages), the number of
-pages at which the pdflush background writeback daemon will start writing out
-dirty data.
-
-If dirty_background_ratio is written, dirty_background_bytes becomes a function
-of its value (dirty_background_ratio * the amount of dirtyable system memory).
-
-dirty_bytes
------------
-
-Contains the amount of dirty memory at which a process generating disk writes
-will itself start writeback.
-
-If dirty_bytes is written, dirty_ratio becomes a function of its value
-(dirty_bytes / the amount of dirtyable system memory).
-
-dirty_ratio
------------
-
-Contains, as a percentage of the dirtyable system memory (free pages + mapped
-pages + file cache, not including locked pages and HugePages), the number of
-pages at which a process which is generating disk writes will itself start
-writing out dirty data.
-
-If dirty_ratio is written, dirty_bytes becomes a function of its value
-(dirty_ratio * the amount of dirtyable system memory).
-
-dirty_writeback_centisecs
--------------------------
-
-The pdflush writeback daemons will periodically wake up and write `old' data
-out to disk.  This tunable expresses the interval between those wakeups, in
-100'ths of a second.
-
-Setting this to zero disables periodic writeback altogether.
-
-dirty_expire_centisecs
-----------------------
-
-This tunable is used to define when dirty data is old enough to be eligible
-for writeout by the pdflush daemons.  It is expressed in 100'ths of a second. 
-Data which has been dirty in-memory for longer than this interval will be
-written out next time a pdflush daemon wakes up.
-
-highmem_is_dirtyable
---------------------
-
-Only present if CONFIG_HIGHMEM is set.
-
-This defaults to 0 (false), meaning that the ratios set above are calculated
-as a percentage of lowmem only.  This protects against excessive scanning
-in page reclaim, swapping and general VM distress.
-
-Setting this to 1 can be useful on 32 bit machines where you want to make
-random changes within an MMAPed file that is larger than your available
-lowmem without causing large quantities of random IO.  Is is safe if the
-behavior of all programs running on the machine is known and memory will
-not be otherwise stressed.
-
-legacy_va_layout
-----------------
-
-If non-zero, this sysctl disables the new 32-bit mmap mmap layout - the kernel
-will use the legacy (2.4) layout for all processes.
-
-lowmem_reserve_ratio
----------------------
-
-For some specialised workloads on highmem machines it is dangerous for
-the kernel to allow process memory to be allocated from the "lowmem"
-zone.  This is because that memory could then be pinned via the mlock()
-system call, or by unavailability of swapspace.
-
-And on large highmem machines this lack of reclaimable lowmem memory
-can be fatal.
-
-So the Linux page allocator has a mechanism which prevents allocations
-which _could_ use highmem from using too much lowmem.  This means that
-a certain amount of lowmem is defended from the possibility of being
-captured into pinned user memory.
-
-(The same argument applies to the old 16 megabyte ISA DMA region.  This
-mechanism will also defend that region from allocations which could use
-highmem or lowmem).
-
-The `lowmem_reserve_ratio' tunable determines how aggressive the kernel is
-in defending these lower zones.
-
-If you have a machine which uses highmem or ISA DMA and your
-applications are using mlock(), or if you are running with no swap then
-you probably should change the lowmem_reserve_ratio setting.
-
-The lowmem_reserve_ratio is an array. You can see them by reading this file.
--
-% cat /proc/sys/vm/lowmem_reserve_ratio
-256     256     32
--
-Note: # of this elements is one fewer than number of zones. Because the highest
-      zone's value is not necessary for following calculation.
-
-But, these values are not used directly. The kernel calculates # of protection
-pages for each zones from them. These are shown as array of protection pages
-in /proc/zoneinfo like followings. (This is an example of x86-64 box).
-Each zone has an array of protection pages like this.
-
--
-Node 0, zone      DMA
-  pages free     1355
-        min      3
-        low      3
-        high     4
-        :
-        :
-    numa_other   0
-        protection: (0, 2004, 2004, 2004)
-        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-  pagesets
-    cpu: 0 pcp: 0
-        :
--
-These protections are added to score to judge whether this zone should be used
-for page allocation or should be reclaimed.
-
-In this example, if normal pages (index=2) are required to this DMA zone and
-pages_high is used for watermark, the kernel judges this zone should not be
-used because pages_free(1355) is smaller than watermark + protection[2]
-(4 + 2004 = 2008). If this protection value is 0, this zone would be used for
-normal page requirement. If requirement is DMA zone(index=0), protection[0]
-(=0) is used.
-
-zone[i]'s protection[j] is calculated by following expression.
-
-(i < j):
-  zone[i]->protection[j]
-  = (total sums of present_pages from zone[i+1] to zone[j] on the node)
-    / lowmem_reserve_ratio[i];
-(i = j):
-   (should not be protected. = 0;
-(i > j):
-   (not necessary, but looks 0)
-
-The default values of lowmem_reserve_ratio[i] are
-    256 (if zone[i] means DMA or DMA32 zone)
-    32  (others).
-As above expression, they are reciprocal number of ratio.
-256 means 1/256. # of protection pages becomes about "0.39%" of total present
-pages of higher zones on the node.
-
-If you would like to protect more pages, smaller values are effective.
-The minimum value is 1 (1/1 -> 100%).
-
-page-cluster
-------------
-
-page-cluster controls the number of pages which are written to swap in
-a single attempt.  The swap I/O size.
-
-It is a logarithmic value - setting it to zero means "1 page", setting
-it to 1 means "2 pages", setting it to 2 means "4 pages", etc.
-
-The default value is three (eight pages at a time).  There may be some
-small benefits in tuning this to a different value if your workload is
-swap-intensive.
-
-overcommit_memory
------------------
-
-Controls overcommit of system memory, possibly allowing processes
-to allocate (but not use) more memory than is actually available.
-
-
-0       -       Heuristic overcommit handling. Obvious overcommits of
-                address space are refused. Used for a typical system. It
-                ensures a seriously wild allocation fails while allowing
-                overcommit to reduce swap usage.  root is allowed to
-                allocate slightly more memory in this mode. This is the
-                default.
-
-1       -       Always overcommit. Appropriate for some scientific
-                applications.
-
-2       -       Don't overcommit. The total address space commit
-                for the system is not permitted to exceed swap plus a
-                configurable percentage (default is 50) of physical RAM.
-                Depending on the percentage you use, in most situations
-                this means a process will not be killed while attempting
-                to use already-allocated memory but will receive errors
-                on memory allocation as appropriate.
-
-overcommit_ratio
-----------------
-
-Percentage of physical memory size to include in overcommit calculations
-(see above.)
-
-Memory allocation limit = swapspace + physmem * (overcommit_ratio / 100)
-
-        swapspace = total size of all swap areas
-        physmem = size of physical memory in system
-
-nr_hugepages and hugetlb_shm_group
-----------------------------------
-
-nr_hugepages configures number of hugetlb page reserved for the system.
-
-hugetlb_shm_group contains group id that is allowed to create SysV shared
-memory segment using hugetlb page.
-
-hugepages_treat_as_movable
---------------------------
-
-This parameter is only useful when kernelcore= is specified at boot time to
-create ZONE_MOVABLE for pages that may be reclaimed or migrated. Huge pages
-are not movable so are not normally allocated from ZONE_MOVABLE. A non-zero
-value written to hugepages_treat_as_movable allows huge pages to be allocated
-from ZONE_MOVABLE.
-
-Once enabled, the ZONE_MOVABLE is treated as an area of memory the huge
-pages pool can easily grow or shrink within. Assuming that applications are
-not running that mlock() a lot of memory, it is likely the huge pages pool
-can grow to the size of ZONE_MOVABLE by repeatedly entering the desired value
-into nr_hugepages and triggering page reclaim.
-
-laptop_mode
------------
-
-laptop_mode is a knob that controls "laptop mode". All the things that are
-controlled by this knob are discussed in Documentation/laptops/laptop-mode.txt.
-
-block_dump
-----------
-
-block_dump enables block I/O debugging when set to a nonzero value. More
-information on block I/O debugging is in Documentation/laptops/laptop-mode.txt.
-
-swap_token_timeout
-------------------
-
-This file contains valid hold time of swap out protection token. The Linux
-VM has token based thrashing control mechanism and uses the token to prevent
-unnecessary page faults in thrashing situation. The unit of the value is
-second. The value would be useful to tune thrashing behavior.
-
-drop_caches
------------
-
-Writing to this will cause the kernel to drop clean caches, dentries and
-inodes from memory, causing that memory to become free.
-
-To free pagecache:
-        echo 1 > /proc/sys/vm/drop_caches
-To free dentries and inodes:
-        echo 2 > /proc/sys/vm/drop_caches
-To free pagecache, dentries and inodes:
-        echo 3 > /proc/sys/vm/drop_caches
-
-As this is a non-destructive operation and dirty objects are not freeable, the
-user should run `sync' first.
+Please see: Documentation/sysctls/vm.txt for a description of these
+entries.
 
 
 2.5 /proc/sys/dev - Device specific parameters
diff --git a/Documentation/hwmon/adt7475 b/Documentation/hwmon/adt7475
new file mode 100644
index 000000000000..a2b1abec850e
--- /dev/null
+++ b/Documentation/hwmon/adt7475
@@ -0,0 +1,87 @@
+This describes the interface for the ADT7475 driver:
+
+(there are 4 fans, numbered fan1 to fan4):
+
+fanX_input              Read the current speed of the fan (in RPMs)
+fanX_min                Read/write the minimum speed of the fan.  Dropping
+                        below this sets an alarm.
+
+(there are three PWMs, numbered pwm1 to pwm3):
+
+pwmX                    Read/write the current duty cycle of the PWM.  Writes
+                        only have effect when auto mode is turned off (see
+                        below).  Range is 0 - 255.
+
+pwmX_enable             Fan speed control method:
+
+                        0 - No control (fan at full speed)
+                        1 - Manual fan speed control (using pwm[1-*])
+                        2 - Automatic fan speed control
+
+pwmX_auto_channels_temp Select which channels affect this PWM
+
+                        1 - TEMP1 controls PWM
+                        2 - TEMP2 controls PWM
+                        4 - TEMP3 controls PWM
+                        6 - TEMP2 and TEMP3 control PWM
+                        7 - All three inputs control PWM
+
+pwmX_freq               Read/write the PWM frequency in Hz. The number
+                        should be one of the following:
+
+                        11 Hz
+                        14 Hz
+                        22 Hz
+                        29 Hz
+                        35 Hz
+                        44 Hz
+                        58 Hz
+                        88 Hz
+
+pwmX_auto_point1_pwm    Read/write the minimum PWM duty cycle in automatic mode
+
+pwmX_auto_point2_pwm    Read/write the maximum PWM duty cycle in automatic mode
+
+(there are three temperature settings numbered temp1 to temp3):
+
+tempX_input             Read the current temperature.  The value is in milli
+                        degrees of Celsius.
+
+tempX_max               Read/write the upper temperature limit - exceeding this
+                        will cause an alarm.
+
+tempX_min               Read/write the lower temperature limit - exceeding this
+                        will cause an alarm.
+
+tempX_offset            Read/write the temperature adjustment offset
+
+tempX_crit              Read/write the THERM limit for remote1.
+
+tempX_crit_hyst         Set the temperature value below crit where the
+                        fans will stay on - this helps drive the temperature
+                        low enough so it doesn't stay near the edge and
+                        cause THERM to keep tripping.
+
+tempX_auto_point1_temp  Read/write the minimum temperature where the fans will
+                        turn on in automatic mode.
+
+tempX_auto_point2_temp  Read/write the maximum temperature over which the fans
+                        will run in automatic mode.  tempX_auto_point1_temp
+                        and tempX_auto_point2_temp together define the
+                        range of automatic control.
+
+tempX_alarm             Read a 1 if the max/min alarm is set
+tempX_fault             Read a 1 if either temp1 or temp3 diode has a fault
+
+(There are two voltage settings, in1 and in2):
+
+inX_input               Read the current voltage on VCC.  Value is in
+                        millivolts.
+
+inX_min                 read/write the minimum voltage limit.
+                        Dropping below this causes an alarm.
+
+inX_max                 read/write the maximum voltage limit.
+                        Exceeding this causes an alarm.
+
+inX_alarm               Read a 1 if the max/min alarm is set.
diff --git a/Documentation/hwmon/lis3lv02d b/Documentation/hwmon/lis3lv02d
index 65dfb0c0fd67..0fcfc4a7ccdc 100644
--- a/Documentation/hwmon/lis3lv02d
+++ b/Documentation/hwmon/lis3lv02d
@@ -13,18 +13,21 @@ Author:
 Description
 -----------
 
-This driver provides support for the accelerometer found in various HP laptops
-sporting the feature officially called "HP Mobile Data Protection System 3D" or
-"HP 3D DriveGuard". It detect automatically laptops with this sensor. Known models
-(for now the HP 2133, nc6420, nc2510, nc8510, nc84x0, nw9440 and nx9420) will
-have their axis automatically oriented on standard way (eg: you can directly
-play neverball).  The accelerometer data is readable via
+This driver provides support for the accelerometer found in various HP
+laptops sporting the feature officially called "HP Mobile Data
+Protection System 3D" or "HP 3D DriveGuard". It detect automatically
+laptops with this sensor. Known models (for now the HP 2133, nc6420,
+nc2510, nc8510, nc84x0, nw9440 and nx9420) will have their axis
+automatically oriented on standard way (eg: you can directly play
+neverball).  The accelerometer data is readable via
 /sys/devices/platform/lis3lv02d.
 
 Sysfs attributes under /sys/devices/platform/lis3lv02d/:
 position - 3D position that the accelerometer reports. Format: "(x,y,z)"
-calibrate - read: values (x, y, z) that are used as the base for input class device operation.
-            write: forces the base to be recalibrated with the current position.
+calibrate - read: values (x, y, z) that are used as the base for input
+                  class device operation.
+            write: forces the base to be recalibrated with the current
+                  position.
 rate - reports the sampling rate of the accelerometer device in HZ
 
 This driver also provides an absolute input class device, allowing
@@ -39,11 +42,12 @@ the accelerometer are converted into a "standard" organisation of the axes
  * When the laptop is horizontal the position reported is about 0 for X and Y
 and a positive value for Z
  * If the left side is elevated, X increases (becomes positive)
- * If the front side (where the touchpad is) is elevated, Y decreases (becomes negative)
+ * If the front side (where the touchpad is) is elevated, Y decreases
+        (becomes negative)
  * If the laptop is put upside-down, Z becomes negative
 
-If your laptop model is not recognized (cf "dmesg"), you can send an email to the
-authors to add it to the database.  When reporting a new laptop, please include
-the output of "dmidecode" plus the value of /sys/devices/platform/lis3lv02d/position
-in these four cases.
+If your laptop model is not recognized (cf "dmesg"), you can send an
+email to the authors to add it to the database.  When reporting a new
+laptop, please include the output of "dmidecode" plus the value of
+/sys/devices/platform/lis3lv02d/position in these four cases.
 
diff --git a/Documentation/scheduler/sched-design-CFS.txt b/Documentation/scheduler/sched-design-CFS.txt
index 8398ca4ff4ed..6f33593e59e2 100644
--- a/Documentation/scheduler/sched-design-CFS.txt
+++ b/Documentation/scheduler/sched-design-CFS.txt
@@ -231,7 +231,7 @@ CPU bandwidth control purposes:
 
    This options needs CONFIG_CGROUPS to be defined, and lets the administrator
    create arbitrary groups of tasks, using the "cgroup" pseudo filesystem.  See
-   Documentation/cgroups.txt for more information about this filesystem.
+   Documentation/cgroups/cgroups.txt for more information about this filesystem.
 
 Only one of these options to group tasks can be chosen and not both.
 
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 4b7ac21ea9eb..64eb1100eec1 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -275,7 +275,8 @@ STAC9200
   dell-m25      Dell Inspiron E1505n
   dell-m26      Dell Inspiron 1501
   dell-m27      Dell Inspiron E1705/9400
-  gateway       Gateway laptops with EAPD control
+  gateway-m4    Gateway laptops with EAPD control
+  gateway-m4-2  Gateway laptops with EAPD control
   panasonic     Panasonic CF-74
 
 STAC9205/9254
@@ -302,6 +303,7 @@ STAC9220/9221
   macbook-pro   Intel Mac Book Pro 2nd generation (eq. type 3)
   imac-intel    Intel iMac (eq. type 2)
   imac-intel-20 Intel iMac (newer version) (eq. type 3)
+  ecs202        ECS/PC chips
   dell-d81      Dell (unknown)
   dell-d82      Dell (unknown)
   dell-m81      Dell (unknown)
@@ -310,9 +312,13 @@ STAC9220/9221
 STAC9202/9250/9251
 ==================
   ref           Reference board, base config
+  m1            Some Gateway MX series laptops (NX560XL)
+  m1-2          Some Gateway MX series laptops (MX6453)
+  m2            Some Gateway MX series laptops (M255)
   m2-2          Some Gateway MX series laptops
+  m3            Some Gateway MX series laptops
+  m5            Some Gateway MX series laptops (MP6954)
   m6            Some Gateway NX series laptops
-  pa6           Gateway NX860 series
 
 STAC9227/9228/9229/927x
 =======================
@@ -329,6 +335,7 @@ STAC92HD71B*
   dell-m4-1     Dell desktops
   dell-m4-2     Dell desktops
   dell-m4-3     Dell desktops
+  hp-m4         HP dv laptops
 
 STAC92HD73*
 ===========
@@ -337,6 +344,7 @@ STAC92HD73*
   dell-m6-amic  Dell desktops/laptops with analog mics
   dell-m6-dmic  Dell desktops/laptops with digital mics
   dell-m6       Dell desktops/laptops with both type of mics
+  dell-eq       Dell desktops/laptops
 
 STAC92HD83*
 ===========
diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index a3415070bcac..3197fc83bc51 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt
@@ -1,12 +1,13 @@
-Documentation for /proc/sys/vm/*        kernel version 2.2.10
+Documentation for /proc/sys/vm/*        kernel version 2.6.29
         (c) 1998, 1999,  Rik van Riel <riel@nl.linux.org>
+        (c) 2008         Peter W. Morreale <pmorreale@novell.com>
 
 For general info and legal blurb, please look in README.
 
 ==============================================================
 
 This file contains the documentation for the sysctl files in
-/proc/sys/vm and is valid for Linux kernel version 2.2.
+/proc/sys/vm and is valid for Linux kernel version 2.6.29.
 
 The files in this directory can be used to tune the operation
 of the virtual memory (VM) subsystem of the Linux kernel and
@@ -16,180 +17,274 @@ Default values and initialization routines for most of these
 files can be found in mm/swap.c.
 
 Currently, these files are in /proc/sys/vm:
-- overcommit_memory
-- page-cluster
-- dirty_ratio
+
+- block_dump
+- dirty_background_bytes
 - dirty_background_ratio
+- dirty_bytes
 - dirty_expire_centisecs
+- dirty_ratio
 - dirty_writeback_centisecs
-- highmem_is_dirtyable   (only if CONFIG_HIGHMEM set)
+- drop_caches
+- hugepages_treat_as_movable
+- hugetlb_shm_group
+- laptop_mode
+- legacy_va_layout
+- lowmem_reserve_ratio
 - max_map_count
 - min_free_kbytes
-- laptop_mode
-- block_dump
-- drop-caches
-- zone_reclaim_mode
-- min_unmapped_ratio
 - min_slab_ratio
-- panic_on_oom
-- oom_dump_tasks
-- oom_kill_allocating_task
-- mmap_min_address
-- numa_zonelist_order
+- min_unmapped_ratio
+- mmap_min_addr
 - nr_hugepages
 - nr_overcommit_hugepages
-- nr_trim_pages         (only if CONFIG_MMU=n)
+- nr_pdflush_threads
+- nr_trim_pages         (only if CONFIG_MMU=n)
+- numa_zonelist_order
+- oom_dump_tasks
+- oom_kill_allocating_task
+- overcommit_memory
+- overcommit_ratio
+- page-cluster
+- panic_on_oom
+- percpu_pagelist_fraction
+- stat_interval
+- swappiness
+- vfs_cache_pressure
+- zone_reclaim_mode
+
 
 ==============================================================
 
-dirty_bytes, dirty_ratio, dirty_background_bytes,
-dirty_background_ratio, dirty_expire_centisecs,
-dirty_writeback_centisecs, highmem_is_dirtyable,
-vfs_cache_pressure, laptop_mode, block_dump, swap_token_timeout,
-drop-caches, hugepages_treat_as_movable:
+block_dump
 
-See Documentation/filesystems/proc.txt
+block_dump enables block I/O debugging when set to a nonzero value. More
+information on block I/O debugging is in Documentation/laptops/laptop-mode.txt.
 
 ==============================================================
 
-overcommit_memory:
+dirty_background_bytes
 
-This value contains a flag that enables memory overcommitment.
+Contains the amount of dirty memory at which the pdflush background writeback
+daemon will start writeback.
 
-When this flag is 0, the kernel attempts to estimate the amount
-of free memory left when userspace requests more memory.
+If dirty_background_bytes is written, dirty_background_ratio becomes a function
+of its value (dirty_background_bytes / the amount of dirtyable system memory).
 
-When this flag is 1, the kernel pretends there is always enough
-memory until it actually runs out.
+==============================================================
 
-When this flag is 2, the kernel uses a "never overcommit"
-policy that attempts to prevent any overcommit of memory.  
+dirty_background_ratio
 
-This feature can be very useful because there are a lot of
-programs that malloc() huge amounts of memory "just-in-case"
-and don't use much of it.
+Contains, as a percentage of total system memory, the number of pages at which
+the pdflush background writeback daemon will start writing out dirty data.
 
-The default value is 0.
+==============================================================
 
-See Documentation/vm/overcommit-accounting and
-security/commoncap.c::cap_vm_enough_memory() for more information.
+dirty_bytes
+
+Contains the amount of dirty memory at which a process generating disk writes
+will itself start writeback.
+
+If dirty_bytes is written, dirty_ratio becomes a function of its value
+(dirty_bytes / the amount of dirtyable system memory).
 
 ==============================================================
 
-overcommit_ratio:
+dirty_expire_centisecs
 
-When overcommit_memory is set to 2, the committed address
-space is not permitted to exceed swap plus this percentage
-of physical RAM.  See above.
+This tunable is used to define when dirty data is old enough to be eligible
+for writeout by the pdflush daemons.  It is expressed in 100'ths of a second.
+Data which has been dirty in-memory for longer than this interval will be
+written out next time a pdflush daemon wakes up.
+
+==============================================================
+
+dirty_ratio
+
+Contains, as a percentage of total system memory, the number of pages at which
+a process which is generating disk writes will itself start writing out dirty
+data.
 
 ==============================================================
 
-page-cluster:
+dirty_writeback_centisecs
 
-The Linux VM subsystem avoids excessive disk seeks by reading
-multiple pages on a page fault. The number of pages it reads
-is dependent on the amount of memory in your machine.
+The pdflush writeback daemons will periodically wake up and write `old' data
+out to disk.  This tunable expresses the interval between those wakeups, in
+100'ths of a second.
 
-The number of pages the kernel reads in at once is equal to
-2 ^ page-cluster. Values above 2 ^ 5 don't make much sense
-for swap because we only cluster swap data in 32-page groups.
+Setting this to zero disables periodic writeback altogether.
 
 ==============================================================
 
-max_map_count:
+drop_caches
 
-This file contains the maximum number of memory map areas a process
-may have. Memory map areas are used as a side-effect of calling
-malloc, directly by mmap and mprotect, and also when loading shared
-libraries.
+Writing to this will cause the kernel to drop clean caches, dentries and
+inodes from memory, causing that memory to become free.
 
-While most applications need less than a thousand maps, certain
-programs, particularly malloc debuggers, may consume lots of them,
-e.g., up to one or two maps per allocation.
+To free pagecache:
+        echo 1 > /proc/sys/vm/drop_caches
+To free dentries and inodes:
+        echo 2 > /proc/sys/vm/drop_caches
+To free pagecache, dentries and inodes:
+        echo 3 > /proc/sys/vm/drop_caches
 
-The default value is 65536.
+As this is a non-destructive operation and dirty objects are not freeable, the
+user should run `sync' first.
 
 ==============================================================
 
-min_free_kbytes:
+hugepages_treat_as_movable
 
-This is used to force the Linux VM to keep a minimum number 
-of kilobytes free.  The VM uses this number to compute a pages_min
-value for each lowmem zone in the system.  Each lowmem zone gets 
-a number of reserved free pages based proportionally on its size.
+This parameter is only useful when kernelcore= is specified at boot time to
+create ZONE_MOVABLE for pages that may be reclaimed or migrated. Huge pages
+are not movable so are not normally allocated from ZONE_MOVABLE. A non-zero
+value written to hugepages_treat_as_movable allows huge pages to be allocated
+from ZONE_MOVABLE.
 
-Some minimal amount of memory is needed to satisfy PF_MEMALLOC
-allocations; if you set this to lower than 1024KB, your system will
-become subtly broken, and prone to deadlock under high loads.
-
-Setting this too high will OOM your machine instantly.
+Once enabled, the ZONE_MOVABLE is treated as an area of memory the huge
+pages pool can easily grow or shrink within. Assuming that applications are
+not running that mlock() a lot of memory, it is likely the huge pages pool
+can grow to the size of ZONE_MOVABLE by repeatedly entering the desired value
+into nr_hugepages and triggering page reclaim.
 
 ==============================================================
 
-percpu_pagelist_fraction
+hugetlb_shm_group
 
-This is the fraction of pages at most (high mark pcp->high) in each zone that
-are allocated for each per cpu page list.  The min value for this is 8.  It
-means that we don't allow more than 1/8th of pages in each zone to be
-allocated in any single per_cpu_pagelist.  This entry only changes the value
-of hot per cpu pagelists.  User can specify a number like 100 to allocate
-1/100th of each zone to each per cpu page list.
+hugetlb_shm_group contains group id that is allowed to create SysV
+shared memory segment using hugetlb page.
 
-The batch value of each per cpu pagelist is also updated as a result.  It is
-set to pcp->high/4.  The upper limit of batch is (PAGE_SHIFT * 8)
+==============================================================
 
-The initial value is zero.  Kernel does not use this value at boot time to set
-the high water marks for each per cpu page list.
+laptop_mode
 
-===============================================================
+laptop_mode is a knob that controls "laptop mode". All the things that are
+controlled by this knob are discussed in Documentation/laptops/laptop-mode.txt.
 
-zone_reclaim_mode:
+==============================================================
 
-Zone_reclaim_mode allows someone to set more or less aggressive approaches to
-reclaim memory when a zone runs out of memory. If it is set to zero then no
-zone reclaim occurs. Allocations will be satisfied from other zones / nodes
-in the system.
+legacy_va_layout
 
-This is value ORed together of
+If non-zero, this sysctl disables the new 32-bit mmap mmap layout - the kernel
+will use the legacy (2.4) layout for all processes.
 
-1       = Zone reclaim on
-2       = Zone reclaim writes dirty pages out
-4       = Zone reclaim swaps pages
+==============================================================
 
-zone_reclaim_mode is set during bootup to 1 if it is determined that pages
-from remote zones will cause a measurable performance reduction. The
-page allocator will then reclaim easily reusable pages (those page
-cache pages that are currently not used) before allocating off node pages.
+lowmem_reserve_ratio
+
+For some specialised workloads on highmem machines it is dangerous for
+the kernel to allow process memory to be allocated from the "lowmem"
+zone.  This is because that memory could then be pinned via the mlock()
+system call, or by unavailability of swapspace.
+
+And on large highmem machines this lack of reclaimable lowmem memory
+can be fatal.
+
+So the Linux page allocator has a mechanism which prevents allocations
+which _could_ use highmem from using too much lowmem.  This means that
+a certain amount of lowmem is defended from the possibility of being
+captured into pinned user memory.
+
+(The same argument applies to the old 16 megabyte ISA DMA region.  This
+mechanism will also defend that region from allocations which could use
+highmem or lowmem).
+
+The `lowmem_reserve_ratio' tunable determines how aggressive the kernel is
+in defending these lower zones.
+
+If you have a machine which uses highmem or ISA DMA and your
+applications are using mlock(), or if you are running with no swap then
+you probably should change the lowmem_reserve_ratio setting.
+
+The lowmem_reserve_ratio is an array. You can see them by reading this file.
+-
+% cat /proc/sys/vm/lowmem_reserve_ratio
+256     256     32
+-
+Note: # of this elements is one fewer than number of zones. Because the highest
+      zone's value is not necessary for following calculation.
+
+But, these values are not used directly. The kernel calculates # of protection
+pages for each zones from them. These are shown as array of protection pages
+in /proc/zoneinfo like followings. (This is an example of x86-64 box).
+Each zone has an array of protection pages like this.
+
+-
+Node 0, zone      DMA
+  pages free     1355
+        min      3
+        low      3
+        high     4
+        :
+        :
+    numa_other   0
+        protection: (0, 2004, 2004, 2004)
+        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  pagesets
+    cpu: 0 pcp: 0
+        :
+-
+These protections are added to score to judge whether this zone should be used
+for page allocation or should be reclaimed.
+
+In this example, if normal pages (index=2) are required to this DMA zone and
+pages_high is used for watermark, the kernel judges this zone should not be
+used because pages_free(1355) is smaller than watermark + protection[2]
+(4 + 2004 = 2008). If this protection value is 0, this zone would be used for
+normal page requirement. If requirement is DMA zone(index=0), protection[0]
+(=0) is used.
+
+zone[i]'s protection[j] is calculated by following expression.
+
+(i < j):
+  zone[i]->protection[j]
+  = (total sums of present_pages from zone[i+1] to zone[j] on the node)
+    / lowmem_reserve_ratio[i];
+(i = j):
+   (should not be protected. = 0;
+(i > j):
+   (not necessary, but looks 0)
+
+The default values of lowmem_reserve_ratio[i] are
+    256 (if zone[i] means DMA or DMA32 zone)
+    32  (others).
+As above expression, they are reciprocal number of ratio.
+256 means 1/256. # of protection pages becomes about "0.39%" of total present
+pages of higher zones on the node.
+
+If you would like to protect more pages, smaller values are effective.
+The minimum value is 1 (1/1 -> 100%).
 
-It may be beneficial to switch off zone reclaim if the system is
-used for a file server and all of memory should be used for caching files
-from disk. In that case the caching effect is more important than
-data locality.
+==============================================================
 
-Allowing zone reclaim to write out pages stops processes that are
-writing large amounts of data from dirtying pages on other nodes. Zone
-reclaim will write out dirty pages if a zone fills up and so effectively
-throttle the process. This may decrease the performance of a single process
-since it cannot use all of system memory to buffer the outgoing writes
-anymore but it preserve the memory on other nodes so that the performance
-of other processes running on other nodes will not be affected.
+max_map_count:
 
-Allowing regular swap effectively restricts allocations to the local
-node unless explicitly overridden by memory policies or cpuset
-configurations.
+This file contains the maximum number of memory map areas a process
+may have. Memory map areas are used as a side-effect of calling
+malloc, directly by mmap and mprotect, and also when loading shared
+libraries.
 
-=============================================================
+While most applications need less than a thousand maps, certain
+programs, particularly malloc debuggers, may consume lots of them,
+e.g., up to one or two maps per allocation.
 
-min_unmapped_ratio:
+The default value is 65536.
 
-This is available only on NUMA kernels.
+==============================================================
 
-A percentage of the total pages in each zone.  Zone reclaim will only
-occur if more than this percentage of pages are file backed and unmapped.
-This is to insure that a minimal amount of local pages is still available for
-file I/O even if the node is overallocated.
+min_free_kbytes:
 
-The default is 1 percent.
+This is used to force the Linux VM to keep a minimum number
+of kilobytes free.  The VM uses this number to compute a pages_min
+value for each lowmem zone in the system.  Each lowmem zone gets
+a number of reserved free pages based proportionally on its size.
+
+Some minimal amount of memory is needed to satisfy PF_MEMALLOC
+allocations; if you set this to lower than 1024KB, your system will
+become subtly broken, and prone to deadlock under high loads.
+
+Setting this too high will OOM your machine instantly.
 
 =============================================================
 
@@ -211,82 +306,73 @@ and may not be fast.
 
 =============================================================
 
-panic_on_oom
+min_unmapped_ratio:
 
-This enables or disables panic on out-of-memory feature.
+This is available only on NUMA kernels.
 
-If this is set to 0, the kernel will kill some rogue process,
-called oom_killer.  Usually, oom_killer can kill rogue processes and
-system will survive.
+A percentage of the total pages in each zone.  Zone reclaim will only
+occur if more than this percentage of pages are file backed and unmapped.
+This is to insure that a minimal amount of local pages is still available for
+file I/O even if the node is overallocated.
 
-If this is set to 1, the kernel panics when out-of-memory happens.
-However, if a process limits using nodes by mempolicy/cpusets,
-and those nodes become memory exhaustion status, one process
-may be killed by oom-killer. No panic occurs in this case.
-Because other nodes' memory may be free. This means system total status
-may be not fatal yet.
+The default is 1 percent.
 
-If this is set to 2, the kernel panics compulsorily even on the
-above-mentioned.
+==============================================================
 
-The default value is 0.
-1 and 2 are for failover of clustering. Please select either
-according to your policy of failover.
+mmap_min_addr
 
-=============================================================
+This file indicates the amount of address space  which a user process will
+be restricted from mmaping.  Since kernel null dereference bugs could
+accidentally operate based on the information in the first couple of pages
+of memory userspace processes should not be allowed to write to them.  By
+default this value is set to 0 and no protections will be enforced by the
+security module.  Setting this value to something like 64k will allow the
+vast majority of applications to work correctly and provide defense in depth
+against future potential kernel bugs.
 
-oom_dump_tasks
+==============================================================
 
-Enables a system-wide task dump (excluding kernel threads) to be
-produced when the kernel performs an OOM-killing and includes such
-information as pid, uid, tgid, vm size, rss, cpu, oom_adj score, and
-name.  This is helpful to determine why the OOM killer was invoked
-and to identify the rogue task that caused it.
+nr_hugepages
 
-If this is set to zero, this information is suppressed.  On very
-large systems with thousands of tasks it may not be feasible to dump
-the memory state information for each one.  Such systems should not
-be forced to incur a performance penalty in OOM conditions when the
-information may not be desired.
+Change the minimum size of the hugepage pool.
 
-If this is set to non-zero, this information is shown whenever the
-OOM killer actually kills a memory-hogging task.
+See Documentation/vm/hugetlbpage.txt
 
-The default value is 0.
+==============================================================
 
-=============================================================
+nr_overcommit_hugepages
 
-oom_kill_allocating_task
+Change the maximum size of the hugepage pool. The maximum is
+nr_hugepages + nr_overcommit_hugepages.
 
-This enables or disables killing the OOM-triggering task in
-out-of-memory situations.
+See Documentation/vm/hugetlbpage.txt
 
-If this is set to zero, the OOM killer will scan through the entire
-tasklist and select a task based on heuristics to kill.  This normally
-selects a rogue memory-hogging task that frees up a large amount of
-memory when killed.
+==============================================================
 
-If this is set to non-zero, the OOM killer simply kills the task that
-triggered the out-of-memory condition.  This avoids the expensive
-tasklist scan.
+nr_pdflush_threads
 
-If panic_on_oom is selected, it takes precedence over whatever value
-is used in oom_kill_allocating_task.
+The current number of pdflush threads.  This value is read-only.
+The value changes according to the number of dirty pages in the system.
 
-The default value is 0.
+When neccessary, additional pdflush threads are created, one per second, up to
+nr_pdflush_threads_max.
 
 ==============================================================
 
-mmap_min_addr
+nr_trim_pages
 
-This file indicates the amount of address space  which a user process will
-be restricted from mmaping.  Since kernel null dereference bugs could
-accidentally operate based on the information in the first couple of pages
-of memory userspace processes should not be allowed to write to them.  By
-default this value is set to 0 and no protections will be enforced by the
-security module.  Setting this value to something like 64k will allow the
-vast majority of applications to work correctly and provide defense in depth
-against future potential kernel bugs.
+This is available only on NOMMU kernels.
+
+This value adjusts the excess page trimming behaviour of power-of-2 aligned
+NOMMU mmap allocations.
+
+A value of 0 disables trimming of allocations entirely, while a value of 1
+trims excess pages aggressively. Any value >= 1 acts as the watermark where
+trimming of allocations is initiated.
+
+The default value is 1.
+
+See Documentation/nommu-mmap.txt for more information.
 
 ==============================================================
 
@@ -335,34 +421,199 @@ this is causing problems for your system/application.
 
 ==============================================================
 
-nr_hugepages
+oom_dump_tasks
 
-Change the minimum size of the hugepage pool.
+Enables a system-wide task dump (excluding kernel threads) to be
+produced when the kernel performs an OOM-killing and includes such
+information as pid, uid, tgid, vm size, rss, cpu, oom_adj score, and
+name.  This is helpful to determine why the OOM killer was invoked
+and to identify the rogue task that caused it.
 
-See Documentation/vm/hugetlbpage.txt
+If this is set to zero, this information is suppressed.  On very
+large systems with thousands of tasks it may not be feasible to dump
+the memory state information for each one.  Such systems should not
+be forced to incur a performance penalty in OOM conditions when the
+information may not be desired.
+
+If this is set to non-zero, this information is shown whenever the
+OOM killer actually kills a memory-hogging task.
+
+The default value is 0.
 
 ==============================================================
 
-nr_overcommit_hugepages
+oom_kill_allocating_task
 
-Change the maximum size of the hugepage pool. The maximum is
-nr_hugepages + nr_overcommit_hugepages.
+This enables or disables killing the OOM-triggering task in
+out-of-memory situations.
 
-See Documentation/vm/hugetlbpage.txt
+If this is set to zero, the OOM killer will scan through the entire
+tasklist and select a task based on heuristics to kill.  This normally
+selects a rogue memory-hogging task that frees up a large amount of
+memory when killed.
+
+If this is set to non-zero, the OOM killer simply kills the task that
+triggered the out-of-memory condition.  This avoids the expensive
+tasklist scan.
+
+If panic_on_oom is selected, it takes precedence over whatever value
+is used in oom_kill_allocating_task.
+
+The default value is 0.
 
 ==============================================================
 
-nr_trim_pages
+overcommit_memory:
 
-This is available only on NOMMU kernels.
+This value contains a flag that enables memory overcommitment.
 
-This value adjusts the excess page trimming behaviour of power-of-2 aligned
-NOMMU mmap allocations.
+When this flag is 0, the kernel attempts to estimate the amount
+of free memory left when userspace requests more memory.
 
-A value of 0 disables trimming of allocations entirely, while a value of 1
-trims excess pages aggressively. Any value >= 1 acts as the watermark where
-trimming of allocations is initiated.
+When this flag is 1, the kernel pretends there is always enough
+memory until it actually runs out.
 
-The default value is 1.
+When this flag is 2, the kernel uses a "never overcommit"
+policy that attempts to prevent any overcommit of memory.
 
-See Documentation/nommu-mmap.txt for more information.
+This feature can be very useful because there are a lot of
+programs that malloc() huge amounts of memory "just-in-case"
+and don't use much of it.
+
+The default value is 0.
+
+See Documentation/vm/overcommit-accounting and
+security/commoncap.c::cap_vm_enough_memory() for more information.
+
+==============================================================
+
+overcommit_ratio:
+
+When overcommit_memory is set to 2, the committed address
+space is not permitted to exceed swap plus this percentage
+of physical RAM.  See above.
+
+==============================================================
+
+page-cluster
+
+page-cluster controls the number of pages which are written to swap in
+a single attempt.  The swap I/O size.
+
+It is a logarithmic value - setting it to zero means "1 page", setting
+it to 1 means "2 pages", setting it to 2 means "4 pages", etc.
+
+The default value is three (eight pages at a time).  There may be some
+small benefits in tuning this to a different value if your workload is
+swap-intensive.
+
+=============================================================
+
+panic_on_oom
+
+This enables or disables panic on out-of-memory feature.
+
+If this is set to 0, the kernel will kill some rogue process,
+called oom_killer.  Usually, oom_killer can kill rogue processes and
+system will survive.
+
+If this is set to 1, the kernel panics when out-of-memory happens.
+However, if a process limits using nodes by mempolicy/cpusets,
+and those nodes become memory exhaustion status, one process
+may be killed by oom-killer. No panic occurs in this case.
+Because other nodes' memory may be free. This means system total status
+may be not fatal yet.
+
+If this is set to 2, the kernel panics compulsorily even on the
+above-mentioned.
+
+The default value is 0.
+1 and 2 are for failover of clustering. Please select either
+according to your policy of failover.
+
+=============================================================
+
+percpu_pagelist_fraction
+
+This is the fraction of pages at most (high mark pcp->high) in each zone that
+are allocated for each per cpu page list.  The min value for this is 8.  It
+means that we don't allow more than 1/8th of pages in each zone to be
+allocated in any single per_cpu_pagelist.  This entry only changes the value
+of hot per cpu pagelists.  User can specify a number like 100 to allocate
+1/100th of each zone to each per cpu page list.
+
+The batch value of each per cpu pagelist is also updated as a result.  It is
+set to pcp->high/4.  The upper limit of batch is (PAGE_SHIFT * 8)
+
+The initial value is zero.  Kernel does not use this value at boot time to set
+the high water marks for each per cpu page list.
+
+==============================================================
+
+stat_interval
+
+The time interval between which vm statistics are updated.  The default
+is 1 second.
+
+==============================================================
+
+swappiness
+
+This control is used to define how aggressive the kernel will swap
+memory pages.  Higher values will increase agressiveness, lower values
+descrease the amount of swap.
+
+The default value is 60.
+
+==============================================================
+
+vfs_cache_pressure
+------------------
+
+Controls the tendency of the kernel to reclaim the memory which is used for
+caching of directory and inode objects.
+
+At the default value of vfs_cache_pressure=100 the kernel will attempt to
+reclaim dentries and inodes at a "fair" rate with respect to pagecache and
+swapcache reclaim.  Decreasing vfs_cache_pressure causes the kernel to prefer
+to retain dentry and inode caches.  Increasing vfs_cache_pressure beyond 100
+causes the kernel to prefer to reclaim dentries and inodes.
+
+==============================================================
+
+zone_reclaim_mode:
+
+Zone_reclaim_mode allows someone to set more or less aggressive approaches to
+reclaim memory when a zone runs out of memory. If it is set to zero then no
+zone reclaim occurs. Allocations will be satisfied from other zones / nodes
+in the system.
+
+This is value ORed together of
+
+1       = Zone reclaim on
+2       = Zone reclaim writes dirty pages out
+4       = Zone reclaim swaps pages
+
+zone_reclaim_mode is set during bootup to 1 if it is determined that pages
+from remote zones will cause a measurable performance reduction. The
+page allocator will then reclaim easily reusable pages (those page
+cache pages that are currently not used) before allocating off node pages.
+
+It may be beneficial to switch off zone reclaim if the system is
+used for a file server and all of memory should be used for caching files
+from disk. In that case the caching effect is more important than
+data locality.
+
+Allowing zone reclaim to write out pages stops processes that are
+writing large amounts of data from dirtying pages on other nodes. Zone
+reclaim will write out dirty pages if a zone fills up and so effectively
+throttle the process. This may decrease the performance of a single process
+since it cannot use all of system memory to buffer the outgoing writes
+anymore but it preserve the memory on other nodes so that the performance
+of other processes running on other nodes will not be affected.
+
+Allowing regular swap effectively restricts allocations to the local
+node unless explicitly overridden by memory policies or cpuset
+configurations.
+
+============ End of Document =================================
diff --git a/Documentation/sysrq.txt b/Documentation/sysrq.txt
index 10a0263ebb3f..9e592c718afb 100644
--- a/Documentation/sysrq.txt
+++ b/Documentation/sysrq.txt
@@ -1,6 +1,5 @@
 Linux Magic System Request Key Hacks
 Documentation for sysrq.c
-Last update: 2007-AUG-04
 
 *  What is the magic SysRq key?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -211,6 +210,24 @@ within a function called by handle_sysrq, you must be aware that you are in
 a lock (you are also in an interrupt handler, which means don't sleep!), so
 you must call __handle_sysrq_nolock instead.
 
+*  When I hit a SysRq key combination only the header appears on the console?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Sysrq output is subject to the same console loglevel control as all
+other console output.  This means that if the kernel was booted 'quiet'
+as is common on distro kernels the output may not appear on the actual
+console, even though it will appear in the dmesg buffer, and be accessible
+via the dmesg command and to the consumers of /proc/kmsg.  As a specific
+exception the header line from the sysrq command is passed to all console
+consumers as if the current loglevel was maximum.  If only the header
+is emitted it is almost certain that the kernel loglevel is too low.
+Should you require the output on the console channel then you will need
+to temporarily up the console loglevel using alt-sysrq-8 or:
+
+    echo 8 > /proc/sysrq-trigger
+
+Remember to return the loglevel to normal after triggering the sysrq
+command you are interested in.
+
 *  I have more questions, who can I ask?
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 And I'll answer any questions about the registration system you got, also
diff --git a/MAINTAINERS b/MAINTAINERS
index 3f6ef02ad681..3fe4dc2c2564 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1581,6 +1581,13 @@ L:	bluesmoke-devel@lists.sourceforge.net
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 
+EDAC-I5400
+P:      Mauro Carvalho Chehab
+M:      mchehab@redhat.com
+L:      bluesmoke-devel@lists.sourceforge.net
+W:      bluesmoke.sourceforge.net
+S:      Maintained
+
 EDAC-I82975X
 P:      Ranganathan Desikan
 P:      Arvind R.
@@ -1814,6 +1821,14 @@ M:	hch@infradead.org
 W:      ftp://ftp.openlinux.org/pub/people/hch/vxfs
 S:      Maintained
 
+FREEZER
+P:      Pavel Machek
+M:      pavel@suse.cz
+P:      Rafael J. Wysocki
+M:      rjw@sisk.pl
+L:      linux-pm@lists.linux-foundation.org
+S:      Supported
+
 FTRACE
 P:      Steven Rostedt
 M:      rostedt@goodmis.org
diff --git a/arch/alpha/include/asm/machvec.h b/arch/alpha/include/asm/machvec.h
index a86c083cdf7f..fea4ea75b79d 100644
--- a/arch/alpha/include/asm/machvec.h
+++ b/arch/alpha/include/asm/machvec.h
@@ -21,6 +21,7 @@ struct pci_dev;
 struct pci_ops;
 struct pci_controller;
 struct _alpha_agp_info;
+struct rtc_time;
 
 struct alpha_machine_vector
 {
@@ -94,6 +95,9 @@ struct alpha_machine_vector
 
         struct _alpha_agp_info *(*agp_info)(void);
 
+        unsigned int (*rtc_get_time)(struct rtc_time *);
+        int (*rtc_set_time)(struct rtc_time *);
+
         const char *vector_name;
 
         /* NUMA information */
diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
index fd090155dccd..bc2a0daf2d92 100644
--- a/arch/alpha/include/asm/pgalloc.h
+++ b/arch/alpha/include/asm/pgalloc.h
@@ -50,7 +50,12 @@ pmd_free(struct mm_struct *mm, pmd_t *pmd)
         free_page((unsigned long)pmd);
 }
 
-extern pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr);
+static inline pte_t *
+pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
+{
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        return pte;
+}
 
 static inline void
 pte_free_kernel(struct mm_struct *mm, pte_t *pte)
diff --git a/arch/alpha/include/asm/rtc.h b/arch/alpha/include/asm/rtc.h
index 4e854b1333eb..1f7fba671ae6 100644
--- a/arch/alpha/include/asm/rtc.h
+++ b/arch/alpha/include/asm/rtc.h
@@ -1,9 +1,15 @@
 #ifndef _ALPHA_RTC_H
 #define _ALPHA_RTC_H
 
-/*
- * Alpha uses the default access methods for the RTC.
- */
+#if defined(CONFIG_ALPHA_GENERIC)
+# define get_rtc_time           alpha_mv.rtc_get_time
+# define set_rtc_time           alpha_mv.rtc_set_time
+#else
+# if defined(CONFIG_ALPHA_MARVEL) && defined(CONFIG_SMP)
+#  define get_rtc_time          marvel_get_rtc_time
+#  define set_rtc_time          marvel_set_rtc_time
+# endif
+#endif
 
 #include <asm-generic/rtc.h>
 
diff --git a/arch/alpha/kernel/.gitignore b/arch/alpha/kernel/.gitignore
new file mode 100644
index 000000000000..c5f676c3c224
--- /dev/null
+++ b/arch/alpha/kernel/.gitignore
@@ -0,0 +1 @@
+vmlinux.lds
diff --git a/arch/alpha/kernel/core_marvel.c b/arch/alpha/kernel/core_marvel.c
index 9cd8dca742a7..e302daecbe56 100644
--- a/arch/alpha/kernel/core_marvel.c
+++ b/arch/alpha/kernel/core_marvel.c
@@ -658,16 +658,8 @@ __marvel_rtc_io(u8 b, unsigned long addr, int write)
                 rtc_access.data = bcd2bin(b);
                 rtc_access.function = 0x48 + !write;    /* GET/PUT_TOY */
 
-#ifdef CONFIG_SMP
-                if (smp_processor_id() != boot_cpuid)
-                        smp_call_function_single(boot_cpuid,
-                                                 __marvel_access_rtc,
-                                                 &rtc_access, 1);
-                else
-                        __marvel_access_rtc(&rtc_access);
-#else
                 __marvel_access_rtc(&rtc_access);
-#endif
+
                 ret = bin2bcd(rtc_access.data);
                 break;
 
diff --git a/arch/alpha/kernel/irq_srm.c b/arch/alpha/kernel/irq_srm.c
index 32212014fbe9..a03fbca4940e 100644
--- a/arch/alpha/kernel/irq_srm.c
+++ b/arch/alpha/kernel/irq_srm.c
@@ -63,6 +63,8 @@ init_srm_irqs(long max, unsigned long ignore_mask)
 {
         long i;
 
+        if (NR_IRQS <= 16)
+                return;
         for (i = 16; i < max; ++i) {
                 if (i < 64 && ((ignore_mask >> i) & 1))
                         continue;
diff --git a/arch/alpha/kernel/machvec_impl.h b/arch/alpha/kernel/machvec_impl.h
index 466c9dff8181..512685f78097 100644
--- a/arch/alpha/kernel/machvec_impl.h
+++ b/arch/alpha/kernel/machvec_impl.h
@@ -40,7 +40,10 @@
 #define CAT1(x,y)  x##y
 #define CAT(x,y)   CAT1(x,y)
 
-#define DO_DEFAULT_RTC .rtc_port = 0x70
+#define DO_DEFAULT_RTC \
+        .rtc_port = 0x70, \
+        .rtc_get_time = common_get_rtc_time, \
+        .rtc_set_time = common_set_rtc_time
 
 #define DO_EV4_MMU                                                      \
         .max_asn =                      EV4_MAX_ASN,                    \
diff --git a/arch/alpha/kernel/proto.h b/arch/alpha/kernel/proto.h
index 708d5ca87782..fe14c6747cd6 100644
--- a/arch/alpha/kernel/proto.h
+++ b/arch/alpha/kernel/proto.h
@@ -145,6 +145,8 @@ extern void smp_percpu_timer_interrupt(struct pt_regs *);
 extern irqreturn_t timer_interrupt(int irq, void *dev);
 extern void common_init_rtc(void);
 extern unsigned long est_cycle_freq;
+extern unsigned int common_get_rtc_time(struct rtc_time *time);
+extern int common_set_rtc_time(struct rtc_time *time);
 
 /* smc37c93x.c */
 extern void SMC93x_Init(void);
diff --git a/arch/alpha/kernel/sys_jensen.c b/arch/alpha/kernel/sys_jensen.c
index 2c3de97de46c..e2516f9a8967 100644
--- a/arch/alpha/kernel/sys_jensen.c
+++ b/arch/alpha/kernel/sys_jensen.c
@@ -261,6 +261,8 @@ struct alpha_machine_vector jensen_mv __initmv = {
         .machine_check          = jensen_machine_check,
         .max_isa_dma_address    = ALPHA_MAX_ISA_DMA_ADDRESS,
         .rtc_port               = 0x170,
+        .rtc_get_time           = common_get_rtc_time,
+        .rtc_set_time           = common_set_rtc_time,
 
         .nr_irqs                = 16,
         .device_interrupt       = jensen_device_interrupt,
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index 828449cd2636..c5a1a2438c67 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -23,6 +23,7 @@
 #include <asm/hwrpb.h>
 #include <asm/tlbflush.h>
 #include <asm/vga.h>
+#include <asm/rtc.h>
 
 #include "proto.h"
 #include "err_impl.h"
@@ -426,6 +427,57 @@ marvel_init_rtc(void)
         init_rtc_irq();
 }
 
+struct marvel_rtc_time {
+        struct rtc_time *time;
+        int retval;
+};
+
+#ifdef CONFIG_SMP
+static void
+smp_get_rtc_time(void *data)
+{
+        struct marvel_rtc_time *mrt = data;
+        mrt->retval = __get_rtc_time(mrt->time);
+}
+
+static void
+smp_set_rtc_time(void *data)
+{
+        struct marvel_rtc_time *mrt = data;
+        mrt->retval = __set_rtc_time(mrt->time);
+}
+#endif
+
+static unsigned int
+marvel_get_rtc_time(struct rtc_time *time)
+{
+#ifdef CONFIG_SMP
+        struct marvel_rtc_time mrt;
+
+        if (smp_processor_id() != boot_cpuid) {
+                mrt.time = time;
+                smp_call_function_single(boot_cpuid, smp_get_rtc_time, &mrt, 1);
+                return mrt.retval;
+        }
+#endif
+        return __get_rtc_time(time);
+}
+
+static int
+marvel_set_rtc_time(struct rtc_time *time)
+{
+#ifdef CONFIG_SMP
+        struct marvel_rtc_time mrt;
+
+        if (smp_processor_id() != boot_cpuid) {
+                mrt.time = time;
+                smp_call_function_single(boot_cpuid, smp_set_rtc_time, &mrt, 1);
+                return mrt.retval;
+        }
+#endif
+        return __set_rtc_time(time);
+}
+
 static void
 marvel_smp_callin(void)
 {
@@ -466,7 +518,9 @@ marvel_smp_callin(void)
 struct alpha_machine_vector marvel_ev7_mv __initmv = {
         .vector_name            = "MARVEL/EV7",
         DO_EV7_MMU,
-        DO_DEFAULT_RTC,
+        .rtc_port               = 0x70,
+        .rtc_get_time           = marvel_get_rtc_time,
+        .rtc_set_time           = marvel_set_rtc_time,
         DO_MARVEL_IO,
         .machine_check          = marvel_machine_check,
         .max_isa_dma_address    = ALPHA_MAX_ISA_DMA_ADDRESS,
diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
index a7f23b5ab814..99c0f46f6b9c 100644
--- a/arch/alpha/kernel/sys_nautilus.c
+++ b/arch/alpha/kernel/sys_nautilus.c
@@ -245,6 +245,10 @@ nautilus_init_pci(void)
                 IRONGATE0->pci_mem = pci_mem;
 
         pci_bus_assign_resources(bus);
+
+        /* pci_common_swizzle() relies on bus->self being NULL
+           for the root bus, so just clear it. */
+        bus->self = NULL;
         pci_fixup_irqs(alpha_mv.pci_swizzle, alpha_mv.pci_map_irq);
 }
 
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index e6a231435cba..b04e2cbf23a4 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -46,6 +46,7 @@
 #include <asm/io.h>
 #include <asm/hwrpb.h>
 #include <asm/8253pit.h>
+#include <asm/rtc.h>
 
 #include <linux/mc146818rtc.h>
 #include <linux/time.h>
@@ -180,6 +181,15 @@ common_init_rtc(void)
         init_rtc_irq();
 }
 
+unsigned int common_get_rtc_time(struct rtc_time *time)
+{
+        return __get_rtc_time(time);
+}
+
+int common_set_rtc_time(struct rtc_time *time)
+{
+        return __set_rtc_time(time);
+}
 
 /* Validate a computed cycle counter result against the known bounds for
    the given processor core.  There's too much brokenness in the way of
diff --git a/arch/alpha/mm/init.c b/arch/alpha/mm/init.c
index 234e42b8ee74..5d7a16eab312 100644
--- a/arch/alpha/mm/init.c
+++ b/arch/alpha/mm/init.c
@@ -59,13 +59,6 @@ pgd_alloc(struct mm_struct *mm)
         return ret;
 }
 
-pte_t *
-pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
-{
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
-        return pte;
-}
-
 
 /*
  * BAD_PAGE is the page that is used for page faults when linux
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 3d31636cbafb..6183aeccecf1 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -17,6 +17,7 @@ config IA64
         select ACPI if (!IA64_HP_SIM)
         select PM if (!IA64_HP_SIM)
         select ARCH_SUPPORTS_MSI
+        select HAVE_UNSTABLE_SCHED_CLOCK
         select HAVE_IDE
         select HAVE_OPROFILE
         select HAVE_KPROBES
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 27eb67604c53..a109db30ce55 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -578,7 +578,7 @@ CONFIG_ATA_PIIX=y
 # CONFIG_SATA_SIS is not set
 # CONFIG_SATA_ULI is not set
 # CONFIG_SATA_VIA is not set
-# CONFIG_SATA_VITESSE is not set
+CONFIG_SATA_VITESSE=y
 # CONFIG_SATA_INIC162X is not set
 # CONFIG_PATA_ACPI is not set
 # CONFIG_PATA_ALI is not set
diff --git a/arch/ia64/include/asm/dma-mapping.h b/arch/ia64/include/asm/dma-mapping.h
index bbab7e2b0fc9..1f912d927585 100644
--- a/arch/ia64/include/asm/dma-mapping.h
+++ b/arch/ia64/include/asm/dma-mapping.h
@@ -9,6 +9,8 @@
 #include <linux/scatterlist.h>
 #include <asm/swiotlb.h>
 
+#define ARCH_HAS_DMA_GET_REQUIRED_MASK
+
 struct dma_mapping_ops {
         int             (*mapping_error)(struct device *dev,
                                          dma_addr_t dma_addr);
diff --git a/arch/ia64/include/asm/machvec.h b/arch/ia64/include/asm/machvec.h
index 59c17e446683..fe87b2121707 100644
--- a/arch/ia64/include/asm/machvec.h
+++ b/arch/ia64/include/asm/machvec.h
@@ -62,6 +62,7 @@ typedef dma_addr_t ia64_mv_dma_map_single_attrs (struct device *, void *, size_t
 typedef void ia64_mv_dma_unmap_single_attrs (struct device *, dma_addr_t, size_t, int, struct dma_attrs *);
 typedef int ia64_mv_dma_map_sg_attrs (struct device *, struct scatterlist *, int, int, struct dma_attrs *);
 typedef void ia64_mv_dma_unmap_sg_attrs (struct device *, struct scatterlist *, int, int, struct dma_attrs *);
+typedef u64 ia64_mv_dma_get_required_mask (struct device *);
 
 /*
  * WARNING: The legacy I/O space is _architected_.  Platforms are
@@ -159,6 +160,7 @@ extern void machvec_tlb_migrate_finish (struct mm_struct *);
 #  define platform_dma_sync_sg_for_device ia64_mv.dma_sync_sg_for_device
 #  define platform_dma_mapping_error            ia64_mv.dma_mapping_error
 #  define platform_dma_supported        ia64_mv.dma_supported
+#  define platform_dma_get_required_mask ia64_mv.dma_get_required_mask
 #  define platform_irq_to_vector        ia64_mv.irq_to_vector
 #  define platform_local_vector_to_irq  ia64_mv.local_vector_to_irq
 #  define platform_pci_get_legacy_mem   ia64_mv.pci_get_legacy_mem
@@ -213,6 +215,7 @@ struct ia64_machine_vector {
         ia64_mv_dma_sync_sg_for_device *dma_sync_sg_for_device;
         ia64_mv_dma_mapping_error *dma_mapping_error;
         ia64_mv_dma_supported *dma_supported;
+        ia64_mv_dma_get_required_mask *dma_get_required_mask;
         ia64_mv_irq_to_vector *irq_to_vector;
         ia64_mv_local_vector_to_irq *local_vector_to_irq;
         ia64_mv_pci_get_legacy_mem_t *pci_get_legacy_mem;
@@ -263,6 +266,7 @@ struct ia64_machine_vector {
         platform_dma_sync_sg_for_device,        \
         platform_dma_mapping_error,                     \
         platform_dma_supported,                 \
+        platform_dma_get_required_mask,         \
         platform_irq_to_vector,                 \
         platform_local_vector_to_irq,           \
         platform_pci_get_legacy_mem,            \
@@ -366,6 +370,9 @@ extern void machvec_init_from_cmdline(const char *cmdline);
 #ifndef platform_dma_supported
 # define  platform_dma_supported        swiotlb_dma_supported
 #endif
+#ifndef platform_dma_get_required_mask
+# define  platform_dma_get_required_mask        ia64_dma_get_required_mask
+#endif
 #ifndef platform_irq_to_vector
 # define platform_irq_to_vector         __ia64_irq_to_vector
 #endif
diff --git a/arch/ia64/include/asm/machvec_init.h b/arch/ia64/include/asm/machvec_init.h
index ef964b286842..37a469849ab9 100644
--- a/arch/ia64/include/asm/machvec_init.h
+++ b/arch/ia64/include/asm/machvec_init.h
@@ -3,6 +3,7 @@
 
 extern ia64_mv_send_ipi_t ia64_send_ipi;
 extern ia64_mv_global_tlb_purge_t ia64_global_tlb_purge;
+extern ia64_mv_dma_get_required_mask ia64_dma_get_required_mask;
 extern ia64_mv_irq_to_vector __ia64_irq_to_vector;
 extern ia64_mv_local_vector_to_irq __ia64_local_vector_to_irq;
 extern ia64_mv_pci_get_legacy_mem_t ia64_pci_get_legacy_mem;
diff --git a/arch/ia64/include/asm/machvec_sn2.h b/arch/ia64/include/asm/machvec_sn2.h
index 781308ea7b88..f1a6e0d6dfa5 100644
--- a/arch/ia64/include/asm/machvec_sn2.h
+++ b/arch/ia64/include/asm/machvec_sn2.h
@@ -67,6 +67,7 @@ extern ia64_mv_dma_sync_single_for_device sn_dma_sync_single_for_device;
 extern ia64_mv_dma_sync_sg_for_device   sn_dma_sync_sg_for_device;
 extern ia64_mv_dma_mapping_error        sn_dma_mapping_error;
 extern ia64_mv_dma_supported            sn_dma_supported;
+extern ia64_mv_dma_get_required_mask    sn_dma_get_required_mask;
 extern ia64_mv_migrate_t                sn_migrate;
 extern ia64_mv_kernel_launch_event_t    sn_kernel_launch_event;
 extern ia64_mv_setup_msi_irq_t          sn_setup_msi_irq;
@@ -123,6 +124,7 @@ extern ia64_mv_pci_fixup_bus_t		sn_pci_fixup_bus;
 #define platform_dma_sync_sg_for_device sn_dma_sync_sg_for_device
 #define platform_dma_mapping_error              sn_dma_mapping_error
 #define platform_dma_supported          sn_dma_supported
+#define platform_dma_get_required_mask  sn_dma_get_required_mask
 #define platform_migrate                sn_migrate
 #define platform_kernel_launch_event    sn_kernel_launch_event
 #ifdef CONFIG_PCI_MSI
diff --git a/arch/ia64/kernel/unaligned.c b/arch/ia64/kernel/unaligned.c
index ff0e7c10faa7..6db08599ebbc 100644
--- a/arch/ia64/kernel/unaligned.c
+++ b/arch/ia64/kernel/unaligned.c
@@ -59,6 +59,7 @@ dump (const char *str, void *vp, size_t len)
  *  (i.e. don't allow attacker to fill up logs with unaligned accesses).
  */
 int no_unaligned_warning;
+int unaligned_dump_stack;
 static int noprint_warning;
 
 /*
@@ -1371,9 +1372,12 @@ ia64_handle_unaligned (unsigned long ifa, struct pt_regs *regs)
                         }
                 }
         } else {
-                if (within_logging_rate_limit())
+                if (within_logging_rate_limit()) {
                         printk(KERN_WARNING "kernel unaligned access to 0x%016lx, ip=0x%016lx\n",
                                ifa, regs->cr_iip + ipsr->ri);
+                        if (unaligned_dump_stack)
+                                dump_stack();
+                }
                 set_fs(KERNEL_DS);
         }
 
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index 211fcfd115f9..61f1af5c23c1 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -19,6 +19,7 @@
 #include <linux/ioport.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/bootmem.h>
 
 #include <asm/machvec.h>
 #include <asm/page.h>
@@ -748,6 +749,32 @@ static void __init set_pci_cacheline_size(void)
         pci_cache_line_size = (1 << cci.pcci_line_size) / 4;
 }
 
+u64 ia64_dma_get_required_mask(struct device *dev)
+{
+        u32 low_totalram = ((max_pfn - 1) << PAGE_SHIFT);
+        u32 high_totalram = ((max_pfn - 1) >> (32 - PAGE_SHIFT));
+        u64 mask;
+
+        if (!high_totalram) {
+                /* convert to mask just covering totalram */
+                low_totalram = (1 << (fls(low_totalram) - 1));
+                low_totalram += low_totalram - 1;
+                mask = low_totalram;
+        } else {
+                high_totalram = (1 << (fls(high_totalram) - 1));
+                high_totalram += high_totalram - 1;
+                mask = (((u64)high_totalram) << 32) + 0xffffffff;
+        }
+        return mask;
+}
+EXPORT_SYMBOL_GPL(ia64_dma_get_required_mask);
+
+u64 dma_get_required_mask(struct device *dev)
+{
+        return platform_dma_get_required_mask(dev);
+}
+EXPORT_SYMBOL_GPL(dma_get_required_mask);
+
 static int __init pcibios_init(void)
 {
         set_pci_cacheline_size();
diff --git a/arch/ia64/sn/pci/pci_dma.c b/arch/ia64/sn/pci/pci_dma.c
index 53ebb6484495..863f5017baae 100644
--- a/arch/ia64/sn/pci/pci_dma.c
+++ b/arch/ia64/sn/pci/pci_dma.c
@@ -356,6 +356,12 @@ int sn_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 }
 EXPORT_SYMBOL(sn_dma_mapping_error);
 
+u64 sn_dma_get_required_mask(struct device *dev)
+{
+        return DMA_64BIT_MASK;
+}
+EXPORT_SYMBOL_GPL(sn_dma_get_required_mask);
+
 char *sn_pci_get_legacy_mem(struct pci_bus *bus)
 {
         if (!SN_PCIBUS_BUSSOFT(bus))
diff --git a/arch/ia64/xen/time.c b/arch/ia64/xen/time.c
index d15a94c330fb..68d6204c3f16 100644
--- a/arch/ia64/xen/time.c
+++ b/arch/ia64/xen/time.c
@@ -129,8 +129,8 @@ consider_steal_time(unsigned long new_itm)
                 blocked = stolentick;
 
         if (stolen > 0 || blocked > 0) {
-                account_steal_time(NULL, jiffies_to_cputime(stolen));
-                account_steal_time(idle_task(cpu), jiffies_to_cputime(blocked));
+                account_steal_ticks(stolen);
+                account_idle_ticks(blocked);
                 run_local_timers();
 
                 if (rcu_pending(cpu))
diff --git a/arch/sparc/kernel/sparc_ksyms_64.c b/arch/sparc/kernel/sparc_ksyms_64.c
index da8f804feb49..0f26066a08d9 100644
--- a/arch/sparc/kernel/sparc_ksyms_64.c
+++ b/arch/sparc/kernel/sparc_ksyms_64.c
@@ -9,7 +9,6 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 
-#include <asm/spinlock.h>
 #include <asm/system.h>
 #include <asm/cpudata.h>
 #include <asm/uaccess.h>
@@ -23,16 +22,6 @@ struct poll {
         short revents;
 };
 
-/* used by various drivers */
-#ifdef CONFIG_SMP
-/* Out of line rw-locking implementation. */
-EXPORT_SYMBOL(__read_lock);
-EXPORT_SYMBOL(__read_unlock);
-EXPORT_SYMBOL(__write_lock);
-EXPORT_SYMBOL(__write_unlock);
-EXPORT_SYMBOL(__write_trylock);
-#endif /* CONFIG_SMP */
-
 /* from helpers.S */
 EXPORT_SYMBOL(__flushw_user);
 EXPORT_SYMBOL_GPL(real_hard_smp_processor_id);
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 4cf30dee8161..e89d24815f26 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -555,12 +555,10 @@ repeat:
         if (!pte_val(old_pte)) {
                 if (!primary)
                         return 0;
-
-                /*
-                 *  Special error value returned, indicating that the mapping
-                 * did not exist at this address.
-                 */
-                return -EFAULT;
+                WARN(1, KERN_WARNING "CPA: called for zero pte. "
+                       "vaddr = %lx cpa->vaddr = %lx\n", address,
+                       *cpa->vaddr);
+                return -EINVAL;
         }
 
         if (level == PG_LEVEL_4K) {
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 160c42d3eb8f..8b08fb955274 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -505,35 +505,6 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 }
 #endif /* CONFIG_STRICT_DEVMEM */
 
-/*
- * Change the memory type for the physial address range in kernel identity
- * mapping space if that range is a part of identity map.
- */
-static int kernel_map_sync_memtype(u64 base, unsigned long size,
-                                        unsigned long flags)
-{
-        unsigned long id_sz;
-        int ret;
-
-        if (!pat_enabled || base >= __pa(high_memory))
-                return 0;
-
-        id_sz = (__pa(high_memory) < base + size) ?
-                                                __pa(high_memory) - base :
-                                                size;
-
-        ret = ioremap_change_attr((unsigned long)__va(base), id_sz, flags);
-        /*
-         * -EFAULT return means that the addr was not valid and did not have
-         * any identity mapping. That case is a success for
-         * kernel_map_sync_memtype.
-         */
-        if (ret == -EFAULT)
-                ret = 0;
-
-        return ret;
-}
-
 int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
                                 unsigned long size, pgprot_t *vma_prot)
 {
@@ -584,7 +555,9 @@ int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
         if (retval < 0)
                 return 0;
 
-        if (kernel_map_sync_memtype(offset, size, flags)) {
+        if (((pfn < max_low_pfn_mapped) ||
+             (pfn >= (1UL<<(32 - PAGE_SHIFT)) && pfn < max_pfn_mapped)) &&
+            ioremap_change_attr((unsigned long)__va(offset), size, flags) < 0) {
                 free_memtype(offset, offset + size);
                 printk(KERN_INFO
                 "%s:%d /dev/mem ioremap_change_attr failed %s for %Lx-%Lx\n",
@@ -632,7 +605,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
                                 int strict_prot)
 {
         int is_ram = 0;
-        int ret;
+        int id_sz, ret;
         unsigned long flags;
         unsigned long want_flags = (pgprot_val(*vma_prot) & _PAGE_CACHE_MASK);
 
@@ -673,7 +646,15 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
                                      flags);
         }
 
-        if (kernel_map_sync_memtype(paddr, size, flags)) {
+        /* Need to keep identity mapping in sync */
+        if (paddr >= __pa(high_memory))
+                return 0;
+
+        id_sz = (__pa(high_memory) < paddr + size) ?
+                                __pa(high_memory) - paddr :
+                                size;
+
+        if (ioremap_change_attr((unsigned long)__va(paddr), id_sz, flags) < 0) {
                 free_memtype(paddr, paddr + size);
                 printk(KERN_ERR
                         "%s:%d reserve_pfn_range ioremap_change_attr failed %s "
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 7bcc1d8bc967..34f80fa6fed1 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -406,6 +406,7 @@ static int nbd_do_it(struct nbd_device *lo)
         ret = sysfs_create_file(&disk_to_dev(lo->disk)->kobj, &pid_attr.attr);
         if (ret) {
                 printk(KERN_ERR "nbd: sysfs_create_file failed!");
+                lo->pid = 0;
                 return ret;
         }
 
@@ -413,6 +414,7 @@ static int nbd_do_it(struct nbd_device *lo)
                 nbd_end_request(req);
 
         sysfs_remove_file(&disk_to_dev(lo->disk)->kobj, &pid_attr.attr);
+        lo->pid = 0;
         return 0;
 }
 
@@ -648,6 +650,8 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
                 set_capacity(lo->disk, lo->bytesize >> 9);
                 return 0;
         case NBD_DO_IT:
+                if (lo->pid)
+                        return -EBUSY;
                 if (!lo->file)
                         return -EINVAL;
                 thread = kthread_create(nbd_thread, lo, lo->disk->disk_name);
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 53544e21f191..f329f459817c 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -1,6 +1,4 @@
 /*
- * $Id: synclink_gt.c,v 4.50 2007/07/25 19:29:25 paulkf Exp $
- *
  * Device driver for Microgate SyncLink GT serial adapters.
  *
  * written by Paul Fulghum for Microgate Corporation
@@ -91,7 +89,6 @@
  * module identification
  */
 static char *driver_name     = "SyncLink GT";
-static char *driver_version  = "$Revision: 4.50 $";
 static char *tty_driver_name = "synclink_gt";
 static char *tty_dev_prefix  = "ttySLG";
 MODULE_LICENSE("GPL");
@@ -1309,7 +1306,7 @@ static int read_proc(char *page, char **start, off_t off, int count,
         off_t   begin = 0;
         struct slgt_info *info;
 
-        len += sprintf(page, "synclink_gt driver:%s\n", driver_version);
+        len += sprintf(page, "synclink_gt driver\n");
 
         info = slgt_device_list;
         while( info ) {
@@ -2441,7 +2438,7 @@ static void program_hw(struct slgt_info *info)
         info->ri_chkcount = 0;
         info->dsr_chkcount = 0;
 
-        slgt_irq_on(info, IRQ_DCD | IRQ_CTS | IRQ_DSR);
+        slgt_irq_on(info, IRQ_DCD | IRQ_CTS | IRQ_DSR | IRQ_RI);
         get_signals(info);
 
         if (info->netcount ||
@@ -3576,7 +3573,7 @@ static void slgt_cleanup(void)
         struct slgt_info *info;
         struct slgt_info *tmp;
 
-        printk("unload %s %s\n", driver_name, driver_version);
+        printk(KERN_INFO "unload %s\n", driver_name);
 
         if (serial_driver) {
                 for (info=slgt_device_list ; info != NULL ; info=info->next_device)
@@ -3619,7 +3616,7 @@ static int __init slgt_init(void)
 {
         int rc;
 
-        printk("%s %s\n", driver_name, driver_version);
+        printk(KERN_INFO "%s\n", driver_name);
 
         serial_driver = alloc_tty_driver(MAX_DEVICES);
         if (!serial_driver) {
@@ -3650,9 +3647,8 @@ static int __init slgt_init(void)
                 goto error;
         }
 
-        printk("%s %s, tty major#%d\n",
-                driver_name, driver_version,
-                serial_driver->major);
+        printk(KERN_INFO "%s, tty major#%d\n",
+               driver_name, serial_driver->major);
 
         slgt_device_count = 0;
         if ((rc = pci_register_driver(&pci_driver)) < 0) {
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index d41b9f6f7903..33a9351c896d 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -473,6 +473,12 @@ void __handle_sysrq(int key, struct tty_struct *tty, int check_mask)
         unsigned long flags;
 
         spin_lock_irqsave(&sysrq_key_table_lock, flags);
+        /*
+         * Raise the apparent loglevel to maximum so that the sysrq header
+         * is shown to provide the user with positive feedback.  We do not
+         * simply emit this at KERN_EMERG as that would change message
+         * routing in the consumers of /proc/kmsg.
+         */
         orig_log_level = console_loglevel;
         console_loglevel = 7;
         printk(KERN_INFO "SysRq : ");
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index a408c8e487ec..6f4c7d0a53bf 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -1057,7 +1057,7 @@ int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
         if (retval)
                 return retval;
 
-        ld = tty_ldisc_ref(tty);
+        ld = tty_ldisc_ref_wait(tty);
         switch (arg) {
         case TCIFLUSH:
                 if (ld && ld->ops->flush_buffer)
diff --git a/drivers/gpio/max7301.c b/drivers/gpio/max7301.c
index 8b24d784db93..3e7f4e06386e 100644
--- a/drivers/gpio/max7301.c
+++ b/drivers/gpio/max7301.c
@@ -217,8 +217,10 @@ static int __devinit max7301_probe(struct spi_device *spi)
         int i, ret;
 
         pdata = spi->dev.platform_data;
-        if (!pdata || !pdata->base)
-                return -ENODEV;
+        if (!pdata || !pdata->base) {
+                dev_dbg(&spi->dev, "incorrect or missing platform data\n");
+                return -EINVAL;
+        }
 
         /*
          * bits_per_word cannot be configured in platform data
diff --git a/drivers/gpio/max732x.c b/drivers/gpio/max732x.c
index 55ae9a41897a..f7868243af89 100644
--- a/drivers/gpio/max732x.c
+++ b/drivers/gpio/max732x.c
@@ -267,8 +267,10 @@ static int __devinit max732x_probe(struct i2c_client *client,
         int ret, nr_port;
 
         pdata = client->dev.platform_data;
-        if (pdata == NULL)
-                return -ENODEV;
+        if (pdata == NULL) {
+                dev_dbg(&client->dev, "no platform data\n");
+                return -EINVAL;
+        }
 
         chip = kzalloc(sizeof(struct max732x_chip), GFP_KERNEL);
         if (chip == NULL)
diff --git a/drivers/gpio/mcp23s08.c b/drivers/gpio/mcp23s08.c
index 89c1d222e9d1..f6fae0e50e65 100644
--- a/drivers/gpio/mcp23s08.c
+++ b/drivers/gpio/mcp23s08.c
@@ -310,8 +310,10 @@ static int mcp23s08_probe(struct spi_device *spi)
         unsigned                        base;
 
         pdata = spi->dev.platform_data;
-        if (!pdata || !gpio_is_valid(pdata->base))
-                return -ENODEV;
+        if (!pdata || !gpio_is_valid(pdata->base)) {
+                dev_dbg(&spi->dev, "invalid or missing platform data\n");
+                return -EINVAL;
+        }
 
         for (addr = 0; addr < 4; addr++) {
                 if (!pdata->chip[addr].is_present)
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 37f35388a2ae..8dc0164bd51e 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -202,8 +202,10 @@ static int __devinit pca953x_probe(struct i2c_client *client,
         int ret;
 
         pdata = client->dev.platform_data;
-        if (pdata == NULL)
-                return -ENODEV;
+        if (pdata == NULL) {
+                dev_dbg(&client->dev, "no platform data\n");
+                return -EINVAL;
+        }
 
         chip = kzalloc(sizeof(struct pca953x_chip), GFP_KERNEL);
         if (chip == NULL)
diff --git a/drivers/gpio/pcf857x.c b/drivers/gpio/pcf857x.c
index 4bc2070dd4a1..9525724be731 100644
--- a/drivers/gpio/pcf857x.c
+++ b/drivers/gpio/pcf857x.c
@@ -188,8 +188,10 @@ static int pcf857x_probe(struct i2c_client *client,
         int                             status;
 
         pdata = client->dev.platform_data;
-        if (!pdata)
-                return -ENODEV;
+        if (!pdata) {
+                dev_dbg(&client->dev, "no platform data\n");
+                return -EINVAL;
+        }
 
         /* Allocate, initialize, and register this gpio_chip. */
         gpio = kzalloc(sizeof *gpio, GFP_KERNEL);
@@ -248,8 +250,10 @@ static int pcf857x_probe(struct i2c_client *client,
                 else
                         status = i2c_read_le16(client);
 
-        } else
-                status = -ENODEV;
+        } else {
+                dev_dbg(&client->dev, "unsupported number of gpios\n");
+                status = -EINVAL;
+        }
 
         if (status < 0)
                 goto fail;
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index d8a982b71296..964c5eb1fada 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -36,7 +36,7 @@
 /*
  * Detailed mode info for 800x600@60Hz
  */
-static struct drm_display_mode std_mode[] = {
+static struct drm_display_mode std_modes[] = {
         { DRM_MODE("800x600", DRM_MODE_TYPE_DEFAULT, 40000, 800, 840,
                    968, 1056, 0, 600, 601, 605, 628, 0,
                    DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
@@ -60,15 +60,18 @@ static struct drm_display_mode std_mode[] = {
  * changes have occurred.
  *
  * FIXME: take into account monitor limits
+ *
+ * RETURNS:
+ * Number of modes found on @connector.
  */
-void drm_helper_probe_single_connector_modes(struct drm_connector *connector,
-                                             uint32_t maxX, uint32_t maxY)
+int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
+                                            uint32_t maxX, uint32_t maxY)
 {
         struct drm_device *dev = connector->dev;
         struct drm_display_mode *mode, *t;
         struct drm_connector_helper_funcs *connector_funcs =
                 connector->helper_private;
-        int ret;
+        int count = 0;
 
         DRM_DEBUG("%s\n", drm_get_connector_name(connector));
         /* set all modes to the unverified state */
@@ -81,14 +84,14 @@ void drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                 DRM_DEBUG("%s is disconnected\n",
                           drm_get_connector_name(connector));
                 /* TODO set EDID to NULL */
-                return;
+                return 0;
         }
 
-        ret = (*connector_funcs->get_modes)(connector);
+        count = (*connector_funcs->get_modes)(connector);
+        if (!count)
+                return 0;
 
-        if (ret) {
-                drm_mode_connector_list_update(connector);
-        }
+        drm_mode_connector_list_update(connector);
 
         if (maxX && maxY)
                 drm_mode_validate_size(dev, &connector->modes, maxX,
@@ -102,25 +105,8 @@ void drm_helper_probe_single_connector_modes(struct drm_connector *connector,
 
         drm_mode_prune_invalid(dev, &connector->modes, true);
 
-        if (list_empty(&connector->modes)) {
-                struct drm_display_mode *stdmode;
-
-                DRM_DEBUG("No valid modes on %s\n",
-                          drm_get_connector_name(connector));
-
-                /* Should we do this here ???
-                 * When no valid EDID modes are available we end up
-                 * here and bailed in the past, now we add a standard
-                 * 640x480@60Hz mode and carry on.
-                 */
-                stdmode = drm_mode_duplicate(dev, &std_mode[0]);
-                drm_mode_probed_add(connector, stdmode);
-                drm_mode_list_concat(&connector->probed_modes,
-                                     &connector->modes);
-
-                DRM_DEBUG("Adding standard 640x480 @ 60Hz to %s\n",
-                          drm_get_connector_name(connector));
-        }
+        if (list_empty(&connector->modes))
+                return 0;
 
         drm_mode_sort(&connector->modes);
 
@@ -131,20 +117,58 @@ void drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                 drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
                 drm_mode_debug_printmodeline(mode);
         }
+
+        return count;
 }
 EXPORT_SYMBOL(drm_helper_probe_single_connector_modes);
 
-void drm_helper_probe_connector_modes(struct drm_device *dev, uint32_t maxX,
+int drm_helper_probe_connector_modes(struct drm_device *dev, uint32_t maxX,
                                       uint32_t maxY)
 {
         struct drm_connector *connector;
+        int count = 0;
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                drm_helper_probe_single_connector_modes(connector, maxX, maxY);
+                count += drm_helper_probe_single_connector_modes(connector,
+                                                                 maxX, maxY);
         }
+
+        return count;
 }
 EXPORT_SYMBOL(drm_helper_probe_connector_modes);
 
+static void drm_helper_add_std_modes(struct drm_device *dev,
+                                     struct drm_connector *connector)
+{
+        struct drm_display_mode *mode, *t;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(std_modes); i++) {
+                struct drm_display_mode *stdmode;
+
+                /*
+                 * When no valid EDID modes are available we end up
+                 * here and bailed in the past, now we add some standard
+                 * modes and move on.
+                 */
+                stdmode = drm_mode_duplicate(dev, &std_modes[i]);
+                drm_mode_probed_add(connector, stdmode);
+                drm_mode_list_concat(&connector->probed_modes,
+                                     &connector->modes);
+
+                DRM_DEBUG("Adding mode %s to %s\n", stdmode->name,
+                          drm_get_connector_name(connector));
+        }
+        drm_mode_sort(&connector->modes);
+
+        DRM_DEBUG("Added std modes on %s\n", drm_get_connector_name(connector));
+        list_for_each_entry_safe(mode, t, &connector->modes, head) {
+                mode->vrefresh = drm_mode_vrefresh(mode);
+
+                drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
+                drm_mode_debug_printmodeline(mode);
+        }
+}
 
 /**
  * drm_helper_crtc_in_use - check if a given CRTC is in a mode_config
@@ -237,6 +261,8 @@ static void drm_enable_connectors(struct drm_device *dev, bool *enabled)
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 enabled[i] = drm_connector_enabled(connector, true);
+                DRM_DEBUG("connector %d enabled? %s\n", connector->base.id,
+                          enabled[i] ? "yes" : "no");
                 any_enabled |= enabled[i];
                 i++;
         }
@@ -265,11 +291,17 @@ static bool drm_target_preferred(struct drm_device *dev,
                         continue;
                 }
 
+                DRM_DEBUG("looking for preferred mode on connector %d\n",
+                          connector->base.id);
+
                 modes[i] = drm_has_preferred_mode(connector, width, height);
-                if (!modes[i]) {
+                /* No preferred modes, pick one off the list */
+                if (!modes[i] && !list_empty(&connector->modes)) {
                         list_for_each_entry(modes[i], &connector->modes, head)
                                 break;
                 }
+                DRM_DEBUG("found mode %s\n", modes[i] ? modes[i]->name :
+                          "none");
                 i++;
         }
         return true;
@@ -369,6 +401,8 @@ static void drm_setup_crtcs(struct drm_device *dev)
         int width, height;
         int i, ret;
 
+        DRM_DEBUG("\n");
+
         width = dev->mode_config.max_width;
         height = dev->mode_config.max_height;
 
@@ -390,6 +424,8 @@ static void drm_setup_crtcs(struct drm_device *dev)
         if (!ret)
                 DRM_ERROR("Unable to find initial modes\n");
 
+        DRM_DEBUG("picking CRTCs for %dx%d config\n", width, height);
+
         drm_pick_crtcs(dev, crtcs, modes, 0, width, height);
 
         i = 0;
@@ -403,6 +439,8 @@ static void drm_setup_crtcs(struct drm_device *dev)
                 }
 
                 if (mode && crtc) {
+                        DRM_DEBUG("desired mode %s set on crtc %d\n",
+                                  mode->name, crtc->base.id);
                         crtc->desired_mode = mode;
                         connector->encoder->crtc = crtc;
                 } else
@@ -442,6 +480,7 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         int saved_x, saved_y;
         struct drm_encoder *encoder;
         bool ret = true;
+        bool depth_changed, bpp_changed;
 
         adjusted_mode = drm_mode_duplicate(dev, mode);
 
@@ -450,6 +489,15 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         if (!crtc->enabled)
                 return true;
 
+        if (old_fb && crtc->fb) {
+                depth_changed = (old_fb->depth != crtc->fb->depth);
+                bpp_changed = (old_fb->bits_per_pixel !=
+                               crtc->fb->bits_per_pixel);
+        } else {
+                depth_changed = true;
+                bpp_changed = true;
+        }
+
         saved_mode = crtc->mode;
         saved_x = crtc->x;
         saved_y = crtc->y;
@@ -462,7 +510,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         crtc->y = y;
 
         if (drm_mode_equal(&saved_mode, &crtc->mode)) {
-                if (saved_x != crtc->x || saved_y != crtc->y) {
+                if (saved_x != crtc->x || saved_y != crtc->y ||
+                    depth_changed || bpp_changed) {
                         crtc_funcs->mode_set_base(crtc, crtc->x, crtc->y,
                                                   old_fb);
                         goto done;
@@ -568,8 +617,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
         struct drm_encoder **save_encoders, *new_encoder;
         struct drm_framebuffer *old_fb;
         bool save_enabled;
-        bool changed = false;
-        bool flip_or_move = false;
+        bool mode_changed = false;
+        bool fb_changed = false;
         struct drm_connector *connector;
         int count = 0, ro, fail = 0;
         struct drm_crtc_helper_funcs *crtc_funcs;
@@ -597,7 +646,10 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
         /* save previous config */
         save_enabled = set->crtc->enabled;
 
-        /* this is meant to be num_connector not num_crtc */
+        /*
+         * We do mode_config.num_connectors here since we'll look at the
+         * CRTC and encoder associated with each connector later.
+         */
         save_crtcs = kzalloc(dev->mode_config.num_connector *
                              sizeof(struct drm_crtc *), GFP_KERNEL);
         if (!save_crtcs)
@@ -613,21 +665,25 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
         /* We should be able to check here if the fb has the same properties
          * and then just flip_or_move it */
         if (set->crtc->fb != set->fb) {
-                /* if we have no fb then its a change not a flip */
+                /* If we have no fb then treat it as a full mode set */
                 if (set->crtc->fb == NULL)
-                        changed = true;
+                        mode_changed = true;
+                else if ((set->fb->bits_per_pixel !=
+                         set->crtc->fb->bits_per_pixel) ||
+                         set->fb->depth != set->crtc->fb->depth)
+                        fb_changed = true;
                 else
-                        flip_or_move = true;
+                        fb_changed = true;
         }
 
         if (set->x != set->crtc->x || set->y != set->crtc->y)
-                flip_or_move = true;
+                fb_changed = true;
 
         if (set->mode && !drm_mode_equal(set->mode, &set->crtc->mode)) {
                 DRM_DEBUG("modes are different\n");
                 drm_mode_debug_printmodeline(&set->crtc->mode);
                 drm_mode_debug_printmodeline(set->mode);
-                changed = true;
+                mode_changed = true;
         }
 
         /* a) traverse passed in connector list and get encoders for them */
@@ -650,7 +706,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 }
 
                 if (new_encoder != connector->encoder) {
-                        changed = true;
+                        mode_changed = true;
                         connector->encoder = new_encoder;
                 }
         }
@@ -677,16 +733,16 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                                 new_crtc = set->crtc;
                 }
                 if (new_crtc != connector->encoder->crtc) {
-                        changed = true;
+                        mode_changed = true;
                         connector->encoder->crtc = new_crtc;
                 }
         }
 
         /* mode_set_base is not a required function */
-        if (flip_or_move && !crtc_funcs->mode_set_base)
-                changed = true;
+        if (fb_changed && !crtc_funcs->mode_set_base)
+                mode_changed = true;
 
-        if (changed) {
+        if (mode_changed) {
                 old_fb = set->crtc->fb;
                 set->crtc->fb = set->fb;
                 set->crtc->enabled = (set->mode != NULL);
@@ -705,7 +761,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                         set->crtc->desired_mode = set->mode;
                 }
                 drm_helper_disable_unused_functions(dev);
-        } else if (flip_or_move) {
+        } else if (fb_changed) {
                 old_fb = set->crtc->fb;
                 if (set->crtc->fb != set->fb)
                         set->crtc->fb = set->fb;
@@ -764,10 +820,31 @@ bool drm_helper_plugged_event(struct drm_device *dev)
  */
 bool drm_helper_initial_config(struct drm_device *dev, bool can_grow)
 {
-        int ret = false;
+        struct drm_connector *connector;
+        int count = 0;
 
-        drm_helper_plugged_event(dev);
-        return ret;
+        count = drm_helper_probe_connector_modes(dev,
+                                                 dev->mode_config.max_width,
+                                                 dev->mode_config.max_height);
+
+        /*
+         * None of the available connectors had any modes, so add some
+         * and try to light them up anyway
+         */
+        if (!count) {
+                DRM_ERROR("connectors have no modes, using standard modes\n");
+                list_for_each_entry(connector,
+                                    &dev->mode_config.connector_list,
+                                    head)
+                        drm_helper_add_std_modes(dev, connector);
+        }
+
+        drm_setup_crtcs(dev);
+
+        /* alert the driver fb layer */
+        dev->mode_config.funcs->fb_changed(dev);
+
+        return 0;
 }
 EXPORT_SYMBOL(drm_helper_initial_config);
 
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 724e505873cf..477caa1b1e4b 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -267,7 +267,8 @@ EXPORT_SYMBOL(drm_irq_install);
  */
 int drm_irq_uninstall(struct drm_device * dev)
 {
-        int irq_enabled;
+        unsigned long irqflags;
+        int irq_enabled, i;
 
         if (!drm_core_check_feature(dev, DRIVER_HAVE_IRQ))
                 return -EINVAL;
@@ -277,6 +278,16 @@ int drm_irq_uninstall(struct drm_device * dev)
         dev->irq_enabled = 0;
         mutex_unlock(&dev->struct_mutex);
 
+        /*
+         * Wake up any waiters so they don't hang.
+         */
+        spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        for (i = 0; i < dev->num_crtcs; i++) {
+                DRM_WAKEUP(&dev->vbl_queue[i]);
+                dev->vblank_enabled[i] = 0;
+        }
+        spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+
         if (!irq_enabled)
                 return -EINVAL;
 
@@ -652,8 +663,9 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
                           vblwait->request.sequence, crtc);
                 dev->last_vblank_wait[crtc] = vblwait->request.sequence;
                 DRM_WAIT_ON(ret, dev->vbl_queue[crtc], 3 * DRM_HZ,
-                            ((drm_vblank_count(dev, crtc)
-                              - vblwait->request.sequence) <= (1 << 23)));
+                            (((drm_vblank_count(dev, crtc) -
+                               vblwait->request.sequence) <= (1 << 23)) ||
+                             !dev->irq_enabled));
 
                 if (ret != -EINTR) {
                         struct timeval now;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 62a4bf7b49df..bbadf1c04142 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -177,6 +177,14 @@ static int i915_initialize(struct drm_device * dev, drm_i915_init_t * init)
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
 
+        master_priv->sarea = drm_getsarea(dev);
+        if (master_priv->sarea) {
+                master_priv->sarea_priv = (drm_i915_sarea_t *)
+                        ((u8 *)master_priv->sarea->handle + init->sarea_priv_offset);
+        } else {
+                DRM_DEBUG("sarea not found assuming DRI2 userspace\n");
+        }
+
         if (init->ring_size != 0) {
                 if (dev_priv->ring.ring_obj != NULL) {
                         i915_dma_cleanup(dev);
@@ -1152,6 +1160,8 @@ int i915_driver_unload(struct drm_device *dev)
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
                 intel_modeset_cleanup(dev);
 
+                i915_gem_free_all_phys_object(dev);
+
                 mutex_lock(&dev->struct_mutex);
                 i915_gem_cleanup_ringbuffer(dev);
                 mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 563de18063fd..e13518252007 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -72,6 +72,18 @@ enum pipe {
 #define WATCH_INACTIVE  0
 #define WATCH_PWRITE    0
 
+#define I915_GEM_PHYS_CURSOR_0 1
+#define I915_GEM_PHYS_CURSOR_1 2
+#define I915_GEM_PHYS_OVERLAY_REGS 3
+#define I915_MAX_PHYS_OBJECT (I915_GEM_PHYS_OVERLAY_REGS)
+
+struct drm_i915_gem_phys_object {
+        int id;
+        struct page **page_list;
+        drm_dma_handle_t *handle;
+        struct drm_gem_object *cur_obj;
+};
+
 typedef struct _drm_i915_ring_buffer {
         int tail_mask;
         unsigned long Size;
@@ -358,6 +370,9 @@ typedef struct drm_i915_private {
                 uint32_t bit_6_swizzle_x;
                 /** Bit 6 swizzling required for Y tiling */
                 uint32_t bit_6_swizzle_y;
+
+                /* storage for physical objects */
+                struct drm_i915_gem_phys_object *phys_objs[I915_MAX_PHYS_OBJECT];
         } mm;
 } drm_i915_private_t;
 
@@ -436,6 +451,9 @@ struct drm_i915_gem_object {
         /** User space pin count and filp owning the pin */
         uint32_t user_pin_count;
         struct drm_file *pin_filp;
+
+        /** for phy allocated objects */
+        struct drm_i915_gem_phys_object *phys_obj;
 };
 
 /**
@@ -598,6 +616,11 @@ int i915_gem_do_init(struct drm_device *dev, unsigned long start,
 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
 int i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj,
                                       int write);
+int i915_gem_attach_phys_object(struct drm_device *dev,
+                                struct drm_gem_object *obj, int id);
+void i915_gem_detach_phys_object(struct drm_device *dev,
+                                 struct drm_gem_object *obj);
+void i915_gem_free_all_phys_object(struct drm_device *dev);
 
 /* i915_gem_tiling.c */
 void i915_gem_detect_bit_6_swizzle(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 1384d6686555..96316fd47233 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -55,6 +55,9 @@ static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
 static void i915_gem_object_get_fence_reg(struct drm_gem_object *obj);
 static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
 static int i915_gem_evict_something(struct drm_device *dev);
+static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
+                                struct drm_i915_gem_pwrite *args,
+                                struct drm_file *file_priv);
 
 int i915_gem_do_init(struct drm_device *dev, unsigned long start,
                      unsigned long end)
@@ -386,8 +389,10 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
          * pread/pwrite currently are reading and writing from the CPU
          * perspective, requiring manual detiling by the client.
          */
-        if (obj_priv->tiling_mode == I915_TILING_NONE &&
-            dev->gtt_total != 0)
+        if (obj_priv->phys_obj)
+                ret = i915_gem_phys_pwrite(dev, obj, args, file_priv);
+        else if (obj_priv->tiling_mode == I915_TILING_NONE &&
+                 dev->gtt_total != 0)
                 ret = i915_gem_gtt_pwrite(dev, obj, args, file_priv);
         else
                 ret = i915_gem_shmem_pwrite(dev, obj, args, file_priv);
@@ -2858,6 +2863,9 @@ void i915_gem_free_object(struct drm_gem_object *obj)
         while (obj_priv->pin_count > 0)
                 i915_gem_object_unpin(obj);
 
+        if (obj_priv->phys_obj)
+                i915_gem_detach_phys_object(dev, obj);
+
         i915_gem_object_unbind(obj);
 
         list = &obj->map_list;
@@ -3293,3 +3301,180 @@ i915_gem_load(struct drm_device *dev)
 
         i915_gem_detect_bit_6_swizzle(dev);
 }
+
+/*
+ * Create a physically contiguous memory object for this object
+ * e.g. for cursor + overlay regs
+ */
+int i915_gem_init_phys_object(struct drm_device *dev,
+                              int id, int size)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_phys_object *phys_obj;
+        int ret;
+
+        if (dev_priv->mm.phys_objs[id - 1] || !size)
+                return 0;
+
+        phys_obj = drm_calloc(1, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
+        if (!phys_obj)
+                return -ENOMEM;
+
+        phys_obj->id = id;
+
+        phys_obj->handle = drm_pci_alloc(dev, size, 0, 0xffffffff);
+        if (!phys_obj->handle) {
+                ret = -ENOMEM;
+                goto kfree_obj;
+        }
+#ifdef CONFIG_X86
+        set_memory_wc((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
+#endif
+
+        dev_priv->mm.phys_objs[id - 1] = phys_obj;
+
+        return 0;
+kfree_obj:
+        drm_free(phys_obj, sizeof(struct drm_i915_gem_phys_object), DRM_MEM_DRIVER);
+        return ret;
+}
+
+void i915_gem_free_phys_object(struct drm_device *dev, int id)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_phys_object *phys_obj;
+
+        if (!dev_priv->mm.phys_objs[id - 1])
+                return;
+
+        phys_obj = dev_priv->mm.phys_objs[id - 1];
+        if (phys_obj->cur_obj) {
+                i915_gem_detach_phys_object(dev, phys_obj->cur_obj);
+        }
+
+#ifdef CONFIG_X86
+        set_memory_wb((unsigned long)phys_obj->handle->vaddr, phys_obj->handle->size / PAGE_SIZE);
+#endif
+        drm_pci_free(dev, phys_obj->handle);
+        kfree(phys_obj);
+        dev_priv->mm.phys_objs[id - 1] = NULL;
+}
+
+void i915_gem_free_all_phys_object(struct drm_device *dev)
+{
+        int i;
+
+        for (i = 0; i < I915_MAX_PHYS_OBJECT; i++)
+                i915_gem_free_phys_object(dev, i);
+}
+
+void i915_gem_detach_phys_object(struct drm_device *dev,
+                                 struct drm_gem_object *obj)
+{
+        struct drm_i915_gem_object *obj_priv;
+        int i;
+        int ret;
+        int page_count;
+
+        obj_priv = obj->driver_private;
+        if (!obj_priv->phys_obj)
+                return;
+
+        ret = i915_gem_object_get_page_list(obj);
+        if (ret)
+                goto out;
+
+        page_count = obj->size / PAGE_SIZE;
+
+        for (i = 0; i < page_count; i++) {
+                char *dst = kmap_atomic(obj_priv->page_list[i], KM_USER0);
+                char *src = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
+
+                memcpy(dst, src, PAGE_SIZE);
+                kunmap_atomic(dst, KM_USER0);
+        }
+        drm_clflush_pages(obj_priv->page_list, page_count);
+        drm_agp_chipset_flush(dev);
+out:
+        obj_priv->phys_obj->cur_obj = NULL;
+        obj_priv->phys_obj = NULL;
+}
+
+int
+i915_gem_attach_phys_object(struct drm_device *dev,
+                            struct drm_gem_object *obj, int id)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_gem_object *obj_priv;
+        int ret = 0;
+        int page_count;
+        int i;
+
+        if (id > I915_MAX_PHYS_OBJECT)
+                return -EINVAL;
+
+        obj_priv = obj->driver_private;
+
+        if (obj_priv->phys_obj) {
+                if (obj_priv->phys_obj->id == id)
+                        return 0;
+                i915_gem_detach_phys_object(dev, obj);
+        }
+
+
+        /* create a new object */
+        if (!dev_priv->mm.phys_objs[id - 1]) {
+                ret = i915_gem_init_phys_object(dev, id,
+                                                obj->size);
+                if (ret) {
+                        DRM_ERROR("failed to init phys object %d size: %d\n", id, obj->size);
+                        goto out;
+                }
+        }
+
+        /* bind to the object */
+        obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
+        obj_priv->phys_obj->cur_obj = obj;
+
+        ret = i915_gem_object_get_page_list(obj);
+        if (ret) {
+                DRM_ERROR("failed to get page list\n");
+                goto out;
+        }
+
+        page_count = obj->size / PAGE_SIZE;
+
+        for (i = 0; i < page_count; i++) {
+                char *src = kmap_atomic(obj_priv->page_list[i], KM_USER0);
+                char *dst = obj_priv->phys_obj->handle->vaddr + (i * PAGE_SIZE);
+
+                memcpy(dst, src, PAGE_SIZE);
+                kunmap_atomic(src, KM_USER0);
+        }
+
+        return 0;
+out:
+        return ret;
+}
+
+static int
+i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
+                     struct drm_i915_gem_pwrite *args,
+                     struct drm_file *file_priv)
+{
+        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        void *obj_addr;
+        int ret;
+        char __user *user_data;
+
+        user_data = (char __user *) (uintptr_t) args->data_ptr;
+        obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
+
+        DRM_ERROR("obj_addr %p, %lld\n", obj_addr, args->size);
+        ret = copy_from_user(obj_addr, user_data, args->size);
+        if (ret)
+                return -EFAULT;
+
+        drm_agp_chipset_flush(dev);
+        return 0;
+}
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 0cadafbef411..6290219de6c8 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -411,6 +411,12 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         unsigned long irqflags;
+        int pipeconf_reg = (pipe == 0) ? PIPEACONF : PIPEBCONF;
+        u32 pipeconf;
+
+        pipeconf = I915_READ(pipeconf_reg);
+        if (!(pipeconf & PIPEACONF_ENABLE))
+                return -EINVAL;
 
         spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
         if (IS_I965G(dev))
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 8ccb9c3ab868..31c3732b7a69 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -401,6 +401,8 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
         I915_WRITE(dspstride, crtc->fb->pitch);
 
         dspcntr = I915_READ(dspcntr_reg);
+        /* Mask out pixel format bits in case we change it */
+        dspcntr &= ~DISPPLANE_PIXFORMAT_MASK;
         switch (crtc->fb->bits_per_pixel) {
         case 8:
                 dspcntr |= DISPPLANE_8BPP;
@@ -1014,21 +1016,25 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 
         if (bo->size < width * height * 4) {
                 DRM_ERROR("buffer is to small\n");
-                drm_gem_object_unreference(bo);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
-        if (dev_priv->cursor_needs_physical) {
-                addr = dev->agp->base + obj_priv->gtt_offset;
-        } else {
+        /* we only need to pin inside GTT if cursor is non-phy */
+        if (!dev_priv->cursor_needs_physical) {
+                ret = i915_gem_object_pin(bo, PAGE_SIZE);
+                if (ret) {
+                        DRM_ERROR("failed to pin cursor bo\n");
+                        goto fail;
+                }
                 addr = obj_priv->gtt_offset;
-        }
-
-        ret = i915_gem_object_pin(bo, PAGE_SIZE);
-        if (ret) {
-                DRM_ERROR("failed to pin cursor bo\n");
-                drm_gem_object_unreference(bo);
-                return ret;
+        } else {
+                ret = i915_gem_attach_phys_object(dev, bo, (pipe == 0) ? I915_GEM_PHYS_CURSOR_0 : I915_GEM_PHYS_CURSOR_1);
+                if (ret) {
+                        DRM_ERROR("failed to attach phys object\n");
+                        goto fail;
+                }
+                addr = obj_priv->phys_obj->handle->busaddr;
         }
 
         temp = 0;
@@ -1041,14 +1047,25 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         I915_WRITE(base, addr);
 
         if (intel_crtc->cursor_bo) {
-                i915_gem_object_unpin(intel_crtc->cursor_bo);
+                if (dev_priv->cursor_needs_physical) {
+                        if (intel_crtc->cursor_bo != bo)
+                                i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
+                } else
+                        i915_gem_object_unpin(intel_crtc->cursor_bo);
+                mutex_lock(&dev->struct_mutex);
                 drm_gem_object_unreference(intel_crtc->cursor_bo);
+                mutex_unlock(&dev->struct_mutex);
         }
 
         intel_crtc->cursor_addr = addr;
         intel_crtc->cursor_bo = bo;
 
         return 0;
+fail:
+        mutex_lock(&dev->struct_mutex);
+        drm_gem_object_unreference(bo);
+        mutex_unlock(&dev->struct_mutex);
+        return ret;
 }
 
 static int intel_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index ccecfaf6307b..2fafdcc108fe 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -456,6 +456,13 @@ void intel_lvds_init(struct drm_device *dev)
                 dev_priv->panel_fixed_mode =
                         drm_mode_duplicate(dev, dev_priv->vbt_mode);
                 mutex_unlock(&dev->mode_config.mutex);
+                if (dev_priv->panel_fixed_mode) {
+                        dev_priv->panel_fixed_mode->type |=
+                                DRM_MODE_TYPE_PREFERRED;
+                        drm_mode_probed_add(connector,
+                                            dev_priv->panel_fixed_mode);
+                        goto out;
+                }
         }
 
         /*
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 4b33bc82cc24..b84bf066879b 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -189,6 +189,16 @@ config SENSORS_ADT7473
           This driver can also be built as a module. If so, the module
           will be called adt7473.
 
+config SENSORS_ADT7475
+        tristate "Analog Devices ADT7475"
+        depends on I2C && EXPERIMENTAL
+        help
+          If you say yes here you get support for the Analog Devices
+          ADT7475 hardware monitoring chips.
+
+          This driver can also be build as a module.  If so, the module
+          will be called adt7475.
+
 config SENSORS_K8TEMP
         tristate "AMD Athlon64/FX or Opteron temperature sensor"
         depends on X86 && PCI && EXPERIMENTAL
@@ -861,6 +871,8 @@ config SENSORS_HDAPS
 config SENSORS_LIS3LV02D
         tristate "STMicroeletronics LIS3LV02Dx three-axis digital accelerometer"
         depends on ACPI && INPUT
+        select NEW_LEDS
+        select LEDS_CLASS
         default n
         help
           This driver provides support for the LIS3LV02Dx accelerometer. In
@@ -872,10 +884,16 @@ config SENSORS_LIS3LV02D
           /sys/devices/platform/lis3lv02d.
 
           This driver also provides an absolute input class device, allowing
-          the laptop to act as a pinball machine-esque joystick.
+          the laptop to act as a pinball machine-esque joystick. On HP laptops,
+          if the led infrastructure is activated, support for a led indicating
+          disk protection will be provided as hp:red:hddprotection.
 
-          This driver can also be built as a module.  If so, the module
-          will be called lis3lv02d.
+          This driver can also be built as modules.  If so, the core module
+          will be called lis3lv02d and a specific module for HP laptops will be
+          called hp_accel.
+
+          Say Y here if you have an applicable laptop and want to experience
+          the awesome power of lis3lv02d.
 
 config SENSORS_APPLESMC
         tristate "Apple SMC (Motion sensor, light sensor, keyboard backlight)"
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 19cb1ace3eb4..2e80f37f39eb 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -28,6 +28,8 @@ obj-$(CONFIG_SENSORS_ADS7828)	+= ads7828.o
 obj-$(CONFIG_SENSORS_ADT7462)   += adt7462.o
 obj-$(CONFIG_SENSORS_ADT7470)   += adt7470.o
 obj-$(CONFIG_SENSORS_ADT7473)   += adt7473.o
+obj-$(CONFIG_SENSORS_ADT7475)   += adt7475.o
+
 obj-$(CONFIG_SENSORS_APPLESMC)  += applesmc.o
 obj-$(CONFIG_SENSORS_AMS)       += ams/
 obj-$(CONFIG_SENSORS_ATXP1)     += atxp1.o
diff --git a/drivers/hwmon/abituguru3.c b/drivers/hwmon/abituguru3.c
index 70bb854086df..e52b38806d03 100644
--- a/drivers/hwmon/abituguru3.c
+++ b/drivers/hwmon/abituguru3.c
@@ -279,7 +279,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "OTES1 Fan",          36, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x0011, "AT8 32X(ATI RD580-ULI M1575)", {
+        { 0x0011, "AT8 32X", {
                 { "CPU Core",            0, 0, 10, 1, 0 },
                 { "DDR",                 1, 0, 20, 1, 0 },
                 { "DDR VTT",             2, 0, 10, 1, 0 },
@@ -402,7 +402,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "AUX3 Fan",           36, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x0016, "AW9D-MAX       (Intel i975-ICH7)", {
+        { 0x0016, "AW9D-MAX", {
                 { "CPU Core",            0, 0, 10, 1, 0 },
                 { "DDR2",                1, 0, 20, 1, 0 },
                 { "DDR2 VTT",            2, 0, 10, 1, 0 },
@@ -482,7 +482,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "AUX3 Fan",           36, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x0019, NULL /* Unknown, need DMI string */, {
+        { 0x0019, "IN9 32X MAX", {
                 { "CPU Core",            7, 0, 10, 1, 0 },
                 { "DDR2",               13, 0, 20, 1, 0 },
                 { "DDR2 VTT",           14, 0, 10, 1, 0 },
@@ -509,7 +509,7 @@ static const struct abituguru3_motherboard_info abituguru3_motherboards[] = {
                 { "AUX3 FAN",           36, 2, 60, 1, 0 },
                 { NULL, 0, 0, 0, 0, 0 } }
         },
-        { 0x001A, "IP35 Pro(Intel P35-ICH9R)", {
+        { 0x001A, "IP35 Pro", {
                 { "CPU Core",            0, 0, 10, 1, 0 },
                 { "DDR2",                1, 0, 20, 1, 0 },
                 { "DDR2 VTT",            2, 0, 10, 1, 0 },
@@ -1128,6 +1128,7 @@ static int __init abituguru3_dmi_detect(void)
 {
         const char *board_vendor, *board_name;
         int i, err = (force) ? 1 : -ENODEV;
+        size_t sublen;
 
         board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
         if (!board_vendor || strcmp(board_vendor, "http://www.abit.com.tw/"))
@@ -1137,9 +1138,20 @@ static int __init abituguru3_dmi_detect(void)
         if (!board_name)
                 return err;
 
+        /* At the moment, we don't care about the part of the vendor
+         * DMI string contained in brackets. Truncate the string at
+         * the first occurrence of a bracket. Trim any trailing space
+         * from the substring.
+         */
+        sublen = strcspn(board_name, "(");
+        while (sublen > 0 && board_name[sublen - 1] == ' ')
+                sublen--;
+
         for (i = 0; abituguru3_motherboards[i].id; i++) {
                 const char *dmi_name = abituguru3_motherboards[i].dmi_name;
-                if (dmi_name && !strcmp(dmi_name, board_name))
+                if (!dmi_name || strlen(dmi_name) != sublen)
+                        continue;
+                if (!strncasecmp(board_name, dmi_name, sublen))
                         break;
         }
 
@@ -1153,7 +1165,7 @@ static int __init abituguru3_dmi_detect(void)
 
 static inline int abituguru3_dmi_detect(void)
 {
-        return -ENODEV;
+        return 1;
 }
 
 #endif /* CONFIG_DMI */
diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
new file mode 100644
index 000000000000..d39877a7da63
--- /dev/null
+++ b/drivers/hwmon/adt7475.c
@@ -0,0 +1,1221 @@
+/*
+ * adt7475 - Thermal sensor driver for the ADT7475 chip and derivatives
+ * Copyright (C) 2007-2008, Advanced Micro Devices, Inc.
+ * Copyright (C) 2008 Jordan Crouse <jordan@cosmicpenguin.net>
+ * Copyright (C) 2008 Hans de Goede <hdegoede@redhat.com>
+
+ * Derived from the lm83 driver by Jean Delvare
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+
+/* Indexes for the sysfs hooks */
+
+#define INPUT           0
+#define MIN             1
+#define MAX             2
+#define CONTROL         3
+#define OFFSET          3
+#define AUTOMIN         4
+#define THERM           5
+#define HYSTERSIS       6
+
+/* These are unique identifiers for the sysfs functions - unlike the
+   numbers above, these are not also indexes into an array
+*/
+
+#define ALARM           9
+#define FAULT           10
+
+/* 7475 Common Registers */
+
+#define REG_VOLTAGE_BASE        0x21
+#define REG_TEMP_BASE           0x25
+#define REG_TACH_BASE           0x28
+#define REG_PWM_BASE            0x30
+#define REG_PWM_MAX_BASE        0x38
+
+#define REG_DEVID               0x3D
+#define REG_VENDID              0x3E
+
+#define REG_STATUS1             0x41
+#define REG_STATUS2             0x42
+
+#define REG_VOLTAGE_MIN_BASE    0x46
+#define REG_VOLTAGE_MAX_BASE    0x47
+
+#define REG_TEMP_MIN_BASE       0x4E
+#define REG_TEMP_MAX_BASE       0x4F
+
+#define REG_TACH_MIN_BASE       0x54
+
+#define REG_PWM_CONFIG_BASE     0x5C
+
+#define REG_TEMP_TRANGE_BASE    0x5F
+
+#define REG_PWM_MIN_BASE        0x64
+
+#define REG_TEMP_TMIN_BASE      0x67
+#define REG_TEMP_THERM_BASE     0x6A
+
+#define REG_REMOTE1_HYSTERSIS   0x6D
+#define REG_REMOTE2_HYSTERSIS   0x6E
+
+#define REG_TEMP_OFFSET_BASE    0x70
+
+#define REG_EXTEND1             0x76
+#define REG_EXTEND2             0x77
+#define REG_CONFIG5             0x7C
+
+#define CONFIG5_TWOSCOMP        0x01
+#define CONFIG5_TEMPOFFSET      0x02
+
+/* ADT7475 Settings */
+
+#define ADT7475_VOLTAGE_COUNT   2
+#define ADT7475_TEMP_COUNT      3
+#define ADT7475_TACH_COUNT      4
+#define ADT7475_PWM_COUNT       3
+
+/* Macro to read the registers */
+
+#define adt7475_read(reg) i2c_smbus_read_byte_data(client, (reg))
+
+/* Macros to easily index the registers */
+
+#define TACH_REG(idx) (REG_TACH_BASE + ((idx) * 2))
+#define TACH_MIN_REG(idx) (REG_TACH_MIN_BASE + ((idx) * 2))
+
+#define PWM_REG(idx) (REG_PWM_BASE + (idx))
+#define PWM_MAX_REG(idx) (REG_PWM_MAX_BASE + (idx))
+#define PWM_MIN_REG(idx) (REG_PWM_MIN_BASE + (idx))
+#define PWM_CONFIG_REG(idx) (REG_PWM_CONFIG_BASE + (idx))
+
+#define VOLTAGE_REG(idx) (REG_VOLTAGE_BASE + (idx))
+#define VOLTAGE_MIN_REG(idx) (REG_VOLTAGE_MIN_BASE + ((idx) * 2))
+#define VOLTAGE_MAX_REG(idx) (REG_VOLTAGE_MAX_BASE + ((idx) * 2))
+
+#define TEMP_REG(idx) (REG_TEMP_BASE + (idx))
+#define TEMP_MIN_REG(idx) (REG_TEMP_MIN_BASE + ((idx) * 2))
+#define TEMP_MAX_REG(idx) (REG_TEMP_MAX_BASE + ((idx) * 2))
+#define TEMP_TMIN_REG(idx) (REG_TEMP_TMIN_BASE + (idx))
+#define TEMP_THERM_REG(idx) (REG_TEMP_THERM_BASE + (idx))
+#define TEMP_OFFSET_REG(idx) (REG_TEMP_OFFSET_BASE + (idx))
+#define TEMP_TRANGE_REG(idx) (REG_TEMP_TRANGE_BASE + (idx))
+
+static unsigned short normal_i2c[] = { 0x2e, I2C_CLIENT_END };
+
+I2C_CLIENT_INSMOD_1(adt7475);
+
+static const struct i2c_device_id adt7475_id[] = {
+        { "adt7475", adt7475 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, adt7475_id);
+
+struct adt7475_data {
+        struct device *hwmon_dev;
+        struct mutex lock;
+
+        unsigned long measure_updated;
+        unsigned long limits_updated;
+        char valid;
+
+        u8 config5;
+        u16 alarms;
+        u16 voltage[3][3];
+        u16 temp[7][3];
+        u16 tach[2][4];
+        u8 pwm[4][3];
+        u8 range[3];
+        u8 pwmctl[3];
+        u8 pwmchan[3];
+};
+
+static struct i2c_driver adt7475_driver;
+static struct adt7475_data *adt7475_update_device(struct device *dev);
+static void adt7475_read_hystersis(struct i2c_client *client);
+static void adt7475_read_pwm(struct i2c_client *client, int index);
+
+/* Given a temp value, convert it to register value */
+
+static inline u16 temp2reg(struct adt7475_data *data, long val)
+{
+        u16 ret;
+
+        if (!(data->config5 & CONFIG5_TWOSCOMP)) {
+                val = SENSORS_LIMIT(val, -64000, 191000);
+                ret = (val + 64500) / 1000;
+        } else {
+                val = SENSORS_LIMIT(val, -128000, 127000);
+                if (val < -500)
+                        ret = (256500 + val) / 1000;
+                else
+                        ret = (val + 500) / 1000;
+        }
+
+        return ret << 2;
+}
+
+/* Given a register value, convert it to a real temp value */
+
+static inline int reg2temp(struct adt7475_data *data, u16 reg)
+{
+        if (data->config5 & CONFIG5_TWOSCOMP) {
+                if (reg >= 512)
+                        return (reg - 1024) * 250;
+                else
+                        return reg * 250;
+        } else
+                return (reg - 256) * 250;
+}
+
+static inline int tach2rpm(u16 tach)
+{
+        if (tach == 0 || tach == 0xFFFF)
+                return 0;
+
+        return (90000 * 60) / tach;
+}
+
+static inline u16 rpm2tach(unsigned long rpm)
+{
+        if (rpm == 0)
+                return 0;
+
+        return SENSORS_LIMIT((90000 * 60) / rpm, 1, 0xFFFF);
+}
+
+static inline int reg2vcc(u16 reg)
+{
+        return (4296 * reg) / 1000;
+}
+
+static inline int reg2vccp(u16 reg)
+{
+        return (2929 * reg) / 1000;
+}
+
+static inline u16 vcc2reg(long vcc)
+{
+        vcc = SENSORS_LIMIT(vcc, 0, 4396);
+        return (vcc * 1000) / 4296;
+}
+
+static inline u16 vccp2reg(long vcc)
+{
+        vcc = SENSORS_LIMIT(vcc, 0, 2998);
+        return (vcc * 1000) / 2929;
+}
+
+static u16 adt7475_read_word(struct i2c_client *client, int reg)
+{
+        u16 val;
+
+        val = i2c_smbus_read_byte_data(client, reg);
+        val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
+
+        return val;
+}
+
+static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
+{
+        i2c_smbus_write_byte_data(client, reg + 1, val >> 8);
+        i2c_smbus_write_byte_data(client, reg, val & 0xFF);
+}
+
+/* Find the nearest value in a table - used for pwm frequency and
+   auto temp range */
+static int find_nearest(long val, const int *array, int size)
+{
+        int i;
+
+        if (val < array[0])
+                return 0;
+
+        if (val > array[size - 1])
+                return size - 1;
+
+        for (i = 0; i < size - 1; i++) {
+                int a, b;
+
+                if (val > array[i + 1])
+                        continue;
+
+                a = val - array[i];
+                b = array[i + 1] - val;
+
+                return (a <= b) ? i : i + 1;
+        }
+
+        return 0;
+}
+
+static ssize_t show_voltage(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        unsigned short val;
+
+        switch (sattr->nr) {
+        case ALARM:
+                return sprintf(buf, "%d\n",
+                               (data->alarms >> (sattr->index + 1)) & 1);
+        default:
+                val = data->voltage[sattr->nr][sattr->index];
+                return sprintf(buf, "%d\n",
+                               sattr->index ==
+                               0 ? reg2vccp(val) : reg2vcc(val));
+        }
+}
+
+static ssize_t set_voltage(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        unsigned char reg;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+
+        data->voltage[sattr->nr][sattr->index] =
+                sattr->index ? vcc2reg(val) : vccp2reg(val);
+
+        if (sattr->nr == MIN)
+                reg = VOLTAGE_MIN_REG(sattr->index);
+        else
+                reg = VOLTAGE_MAX_REG(sattr->index);
+
+        i2c_smbus_write_byte_data(client, reg,
+                                  data->voltage[sattr->nr][sattr->index] >> 2);
+        mutex_unlock(&data->lock);
+
+        return count;
+}
+
+static ssize_t show_temp(struct device *dev, struct device_attribute *attr,
+                         char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        int out;
+
+        switch (sattr->nr) {
+        case HYSTERSIS:
+                mutex_lock(&data->lock);
+                out = data->temp[sattr->nr][sattr->index];
+                if (sattr->index != 1)
+                        out = (out >> 4) & 0xF;
+                else
+                        out = (out & 0xF);
+                /* Show the value as an absolute number tied to
+                 * THERM */
+                out = reg2temp(data, data->temp[THERM][sattr->index]) -
+                        out * 1000;
+                mutex_unlock(&data->lock);
+                break;
+
+        case OFFSET:
+                /* Offset is always 2's complement, regardless of the
+                 * setting in CONFIG5 */
+                mutex_lock(&data->lock);
+                out = (s8)data->temp[sattr->nr][sattr->index];
+                if (data->config5 & CONFIG5_TEMPOFFSET)
+                        out *= 1000;
+                else
+                        out *= 500;
+                mutex_unlock(&data->lock);
+                break;
+
+        case ALARM:
+                out = (data->alarms >> (sattr->index + 4)) & 1;
+                break;
+
+        case FAULT:
+                /* Note - only for remote1 and remote2 */
+                out = data->alarms & (sattr->index ? 0x8000 : 0x4000);
+                out = out ? 0 : 1;
+                break;
+
+        default:
+                /* All other temp values are in the configured format */
+                out = reg2temp(data, data->temp[sattr->nr][sattr->index]);
+        }
+
+        return sprintf(buf, "%d\n", out);
+}
+
+static ssize_t set_temp(struct device *dev, struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        unsigned char reg = 0;
+        u8 out;
+        int temp;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+
+        /* We need the config register in all cases for temp <-> reg conv. */
+        data->config5 = adt7475_read(REG_CONFIG5);
+
+        switch (sattr->nr) {
+        case OFFSET:
+                if (data->config5 & CONFIG5_TEMPOFFSET) {
+                        val = SENSORS_LIMIT(val, -63000, 127000);
+                        out = data->temp[OFFSET][sattr->index] = val / 1000;
+                } else {
+                        val = SENSORS_LIMIT(val, -63000, 64000);
+                        out = data->temp[OFFSET][sattr->index] = val / 500;
+                }
+                break;
+
+        case HYSTERSIS:
+                /* The value will be given as an absolute value, turn it
+                   into an offset based on THERM */
+
+                /* Read fresh THERM and HYSTERSIS values from the chip */
+                data->temp[THERM][sattr->index] =
+                        adt7475_read(TEMP_THERM_REG(sattr->index)) << 2;
+                adt7475_read_hystersis(client);
+
+                temp = reg2temp(data, data->temp[THERM][sattr->index]);
+                val = SENSORS_LIMIT(val, temp - 15000, temp);
+                val = (temp - val) / 1000;
+
+                if (sattr->index != 1) {
+                        data->temp[HYSTERSIS][sattr->index] &= 0xF0;
+                        data->temp[HYSTERSIS][sattr->index] |= (val & 0xF) << 4;
+                } else {
+                        data->temp[HYSTERSIS][sattr->index] &= 0x0F;
+                        data->temp[HYSTERSIS][sattr->index] |= (val & 0xF);
+                }
+
+                out = data->temp[HYSTERSIS][sattr->index];
+                break;
+
+        default:
+                data->temp[sattr->nr][sattr->index] = temp2reg(data, val);
+
+                /* We maintain an extra 2 digits of precision for simplicity
+                 * - shift those back off before writing the value */
+                out = (u8) (data->temp[sattr->nr][sattr->index] >> 2);
+        }
+
+        switch (sattr->nr) {
+        case MIN:
+                reg = TEMP_MIN_REG(sattr->index);
+                break;
+        case MAX:
+                reg = TEMP_MAX_REG(sattr->index);
+                break;
+        case OFFSET:
+                reg = TEMP_OFFSET_REG(sattr->index);
+                break;
+        case AUTOMIN:
+                reg = TEMP_TMIN_REG(sattr->index);
+                break;
+        case THERM:
+                reg = TEMP_THERM_REG(sattr->index);
+                break;
+        case HYSTERSIS:
+                if (sattr->index != 2)
+                        reg = REG_REMOTE1_HYSTERSIS;
+                else
+                        reg = REG_REMOTE2_HYSTERSIS;
+
+                break;
+        }
+
+        i2c_smbus_write_byte_data(client, reg, out);
+
+        mutex_unlock(&data->lock);
+        return count;
+}
+
+/* Table of autorange values - the user will write the value in millidegrees,
+   and we'll convert it */
+static const int autorange_table[] = {
+        2000, 2500, 3330, 4000, 5000, 6670, 8000,
+        10000, 13330, 16000, 20000, 26670, 32000, 40000,
+        53330, 80000
+};
+
+static ssize_t show_point2(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        int out, val;
+
+        mutex_lock(&data->lock);
+        out = (data->range[sattr->index] >> 4) & 0x0F;
+        val = reg2temp(data, data->temp[AUTOMIN][sattr->index]);
+        mutex_unlock(&data->lock);
+
+        return sprintf(buf, "%d\n", val + autorange_table[out]);
+}
+
+static ssize_t set_point2(struct device *dev, struct device_attribute *attr,
+                          const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        int temp;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+
+        /* Get a fresh copy of the needed registers */
+        data->config5 = adt7475_read(REG_CONFIG5);
+        data->temp[AUTOMIN][sattr->index] =
+                adt7475_read(TEMP_TMIN_REG(sattr->index)) << 2;
+        data->range[sattr->index] =
+                adt7475_read(TEMP_TRANGE_REG(sattr->index));
+
+        /* The user will write an absolute value, so subtract the start point
+           to figure the range */
+        temp = reg2temp(data, data->temp[AUTOMIN][sattr->index]);
+        val = SENSORS_LIMIT(val, temp + autorange_table[0],
+                temp + autorange_table[ARRAY_SIZE(autorange_table) - 1]);
+        val -= temp;
+
+        /* Find the nearest table entry to what the user wrote */
+        val = find_nearest(val, autorange_table, ARRAY_SIZE(autorange_table));
+
+        data->range[sattr->index] &= ~0xF0;
+        data->range[sattr->index] |= val << 4;
+
+        i2c_smbus_write_byte_data(client, TEMP_TRANGE_REG(sattr->index),
+                                  data->range[sattr->index]);
+
+        mutex_unlock(&data->lock);
+        return count;
+}
+
+static ssize_t show_tach(struct device *dev, struct device_attribute *attr,
+                         char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        int out;
+
+        if (sattr->nr == ALARM)
+                out = (data->alarms >> (sattr->index + 10)) & 1;
+        else
+                out = tach2rpm(data->tach[sattr->nr][sattr->index]);
+
+        return sprintf(buf, "%d\n", out);
+}
+
+static ssize_t set_tach(struct device *dev, struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+
+        data->tach[MIN][sattr->index] = rpm2tach(val);
+
+        adt7475_write_word(client, TACH_MIN_REG(sattr->index),
+                           data->tach[MIN][sattr->index]);
+
+        mutex_unlock(&data->lock);
+        return count;
+}
+
+static ssize_t show_pwm(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+
+        return sprintf(buf, "%d\n", data->pwm[sattr->nr][sattr->index]);
+}
+
+static ssize_t show_pwmchan(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+
+        return sprintf(buf, "%d\n", data->pwmchan[sattr->index]);
+}
+
+static ssize_t show_pwmctrl(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+
+        return sprintf(buf, "%d\n", data->pwmctl[sattr->index]);
+}
+
+static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
+                       const char *buf, size_t count)
+{
+
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        unsigned char reg = 0;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+
+        switch (sattr->nr) {
+        case INPUT:
+                /* Get a fresh value for CONTROL */
+                data->pwm[CONTROL][sattr->index] =
+                        adt7475_read(PWM_CONFIG_REG(sattr->index));
+
+                /* If we are not in manual mode, then we shouldn't allow
+                 * the user to set the pwm speed */
+                if (((data->pwm[CONTROL][sattr->index] >> 5) & 7) != 7) {
+                        mutex_unlock(&data->lock);
+                        return count;
+                }
+
+                reg = PWM_REG(sattr->index);
+                break;
+
+        case MIN:
+                reg = PWM_MIN_REG(sattr->index);
+                break;
+
+        case MAX:
+                reg = PWM_MAX_REG(sattr->index);
+                break;
+        }
+
+        data->pwm[sattr->nr][sattr->index] = SENSORS_LIMIT(val, 0, 0xFF);
+        i2c_smbus_write_byte_data(client, reg,
+                                  data->pwm[sattr->nr][sattr->index]);
+
+        mutex_unlock(&data->lock);
+
+        return count;
+}
+
+/* Called by set_pwmctrl and set_pwmchan */
+
+static int hw_set_pwm(struct i2c_client *client, int index,
+                      unsigned int pwmctl, unsigned int pwmchan)
+{
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        long val = 0;
+
+        switch (pwmctl) {
+        case 0:
+                val = 0x03;     /* Run at full speed */
+                break;
+        case 1:
+                val = 0x07;     /* Manual mode */
+                break;
+        case 2:
+                switch (pwmchan) {
+                case 1:
+                        /* Remote1 controls PWM */
+                        val = 0x00;
+                        break;
+                case 2:
+                        /* local controls PWM */
+                        val = 0x01;
+                        break;
+                case 4:
+                        /* remote2 controls PWM */
+                        val = 0x02;
+                        break;
+                case 6:
+                        /* local/remote2 control PWM */
+                        val = 0x05;
+                        break;
+                case 7:
+                        /* All three control PWM */
+                        val = 0x06;
+                        break;
+                default:
+                        return -EINVAL;
+                }
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        data->pwmctl[index] = pwmctl;
+        data->pwmchan[index] = pwmchan;
+
+        data->pwm[CONTROL][index] &= ~0xE0;
+        data->pwm[CONTROL][index] |= (val & 7) << 5;
+
+        i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
+                                  data->pwm[CONTROL][index]);
+
+        return 0;
+}
+
+static ssize_t set_pwmchan(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        int r;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+        /* Read Modify Write PWM values */
+        adt7475_read_pwm(client, sattr->index);
+        r = hw_set_pwm(client, sattr->index, data->pwmctl[sattr->index], val);
+        if (r)
+                count = r;
+        mutex_unlock(&data->lock);
+
+        return count;
+}
+
+static ssize_t set_pwmctrl(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        int r;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        mutex_lock(&data->lock);
+        /* Read Modify Write PWM values */
+        adt7475_read_pwm(client, sattr->index);
+        r = hw_set_pwm(client, sattr->index, val, data->pwmchan[sattr->index]);
+        if (r)
+                count = r;
+        mutex_unlock(&data->lock);
+
+        return count;
+}
+
+/* List of frequencies for the PWM */
+static const int pwmfreq_table[] = {
+        11, 14, 22, 29, 35, 44, 58, 88
+};
+
+static ssize_t show_pwmfreq(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct adt7475_data *data = adt7475_update_device(dev);
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+
+        return sprintf(buf, "%d\n",
+                       pwmfreq_table[data->range[sattr->index] & 7]);
+}
+
+static ssize_t set_pwmfreq(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        int out;
+        long val;
+
+        if (strict_strtol(buf, 10, &val))
+                return -EINVAL;
+
+        out = find_nearest(val, pwmfreq_table, ARRAY_SIZE(pwmfreq_table));
+
+        mutex_lock(&data->lock);
+
+        data->range[sattr->index] =
+                adt7475_read(TEMP_TRANGE_REG(sattr->index));
+        data->range[sattr->index] &= ~7;
+        data->range[sattr->index] |= out;
+
+        i2c_smbus_write_byte_data(client, TEMP_TRANGE_REG(sattr->index),
+                                  data->range[sattr->index]);
+
+        mutex_unlock(&data->lock);
+        return count;
+}
+
+static SENSOR_DEVICE_ATTR_2(in1_input, S_IRUGO, show_voltage, NULL, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(in1_max, S_IRUGO | S_IWUSR, show_voltage,
+                            set_voltage, MAX, 0);
+static SENSOR_DEVICE_ATTR_2(in1_min, S_IRUGO | S_IWUSR, show_voltage,
+                            set_voltage, MIN, 0);
+static SENSOR_DEVICE_ATTR_2(in1_alarm, S_IRUGO, show_voltage, NULL, ALARM, 0);
+static SENSOR_DEVICE_ATTR_2(in2_input, S_IRUGO, show_voltage, NULL, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(in2_max, S_IRUGO | S_IWUSR, show_voltage,
+                            set_voltage, MAX, 1);
+static SENSOR_DEVICE_ATTR_2(in2_min, S_IRUGO | S_IWUSR, show_voltage,
+                            set_voltage, MIN, 1);
+static SENSOR_DEVICE_ATTR_2(in2_alarm, S_IRUGO, show_voltage, NULL, ALARM, 1);
+static SENSOR_DEVICE_ATTR_2(temp1_input, S_IRUGO, show_temp, NULL, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_alarm, S_IRUGO, show_temp, NULL, ALARM, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_fault, S_IRUGO, show_temp, NULL, FAULT, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_max, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            MAX, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_min, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            MIN, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_offset, S_IRUGO | S_IWUSR, show_temp,
+                            set_temp, OFFSET, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_auto_point1_temp, S_IRUGO | S_IWUSR,
+                            show_temp, set_temp, AUTOMIN, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_auto_point2_temp, S_IRUGO | S_IWUSR,
+                            show_point2, set_point2, 0, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_crit, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            THERM, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_crit_hyst, S_IRUGO | S_IWUSR, show_temp,
+                            set_temp, HYSTERSIS, 0);
+static SENSOR_DEVICE_ATTR_2(temp2_input, S_IRUGO, show_temp, NULL, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_alarm, S_IRUGO, show_temp, NULL, ALARM, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_max, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            MAX, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_min, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            MIN, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_offset, S_IRUGO | S_IWUSR, show_temp,
+                            set_temp, OFFSET, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_auto_point1_temp, S_IRUGO | S_IWUSR,
+                            show_temp, set_temp, AUTOMIN, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_auto_point2_temp, S_IRUGO | S_IWUSR,
+                            show_point2, set_point2, 0, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_crit, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            THERM, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_crit_hyst, S_IRUGO | S_IWUSR, show_temp,
+                            set_temp, HYSTERSIS, 1);
+static SENSOR_DEVICE_ATTR_2(temp3_input, S_IRUGO, show_temp, NULL, INPUT, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_alarm, S_IRUGO, show_temp, NULL, ALARM, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_fault, S_IRUGO, show_temp, NULL, FAULT, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_max, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            MAX, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_min, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            MIN, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_offset, S_IRUGO | S_IWUSR, show_temp,
+                            set_temp, OFFSET, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_auto_point1_temp, S_IRUGO | S_IWUSR,
+                            show_temp, set_temp, AUTOMIN, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_auto_point2_temp, S_IRUGO | S_IWUSR,
+                            show_point2, set_point2, 0, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_crit, S_IRUGO | S_IWUSR, show_temp, set_temp,
+                            THERM, 2);
+static SENSOR_DEVICE_ATTR_2(temp3_crit_hyst, S_IRUGO | S_IWUSR, show_temp,
+                            set_temp, HYSTERSIS, 2);
+static SENSOR_DEVICE_ATTR_2(fan1_input, S_IRUGO, show_tach, NULL, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(fan1_min, S_IRUGO | S_IWUSR, show_tach, set_tach,
+                            MIN, 0);
+static SENSOR_DEVICE_ATTR_2(fan1_alarm, S_IRUGO, show_tach, NULL, ALARM, 0);
+static SENSOR_DEVICE_ATTR_2(fan2_input, S_IRUGO, show_tach, NULL, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(fan2_min, S_IRUGO | S_IWUSR, show_tach, set_tach,
+                            MIN, 1);
+static SENSOR_DEVICE_ATTR_2(fan2_alarm, S_IRUGO, show_tach, NULL, ALARM, 1);
+static SENSOR_DEVICE_ATTR_2(fan3_input, S_IRUGO, show_tach, NULL, INPUT, 2);
+static SENSOR_DEVICE_ATTR_2(fan3_min, S_IRUGO | S_IWUSR, show_tach, set_tach,
+                            MIN, 2);
+static SENSOR_DEVICE_ATTR_2(fan3_alarm, S_IRUGO, show_tach, NULL, ALARM, 2);
+static SENSOR_DEVICE_ATTR_2(fan4_input, S_IRUGO, show_tach, NULL, INPUT, 3);
+static SENSOR_DEVICE_ATTR_2(fan4_min, S_IRUGO | S_IWUSR, show_tach, set_tach,
+                            MIN, 3);
+static SENSOR_DEVICE_ATTR_2(fan4_alarm, S_IRUGO, show_tach, NULL, ALARM, 3);
+static SENSOR_DEVICE_ATTR_2(pwm1, S_IRUGO | S_IWUSR, show_pwm, set_pwm, INPUT,
+                            0);
+static SENSOR_DEVICE_ATTR_2(pwm1_freq, S_IRUGO | S_IWUSR, show_pwmfreq,
+                            set_pwmfreq, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(pwm1_enable, S_IRUGO | S_IWUSR, show_pwmctrl,
+                            set_pwmctrl, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(pwm1_auto_channel_temp, S_IRUGO | S_IWUSR,
+                            show_pwmchan, set_pwmchan, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(pwm1_auto_point1_pwm, S_IRUGO | S_IWUSR, show_pwm,
+                            set_pwm, MIN, 0);
+static SENSOR_DEVICE_ATTR_2(pwm1_auto_point2_pwm, S_IRUGO | S_IWUSR, show_pwm,
+                            set_pwm, MAX, 0);
+static SENSOR_DEVICE_ATTR_2(pwm2, S_IRUGO | S_IWUSR, show_pwm, set_pwm, INPUT,
+                            1);
+static SENSOR_DEVICE_ATTR_2(pwm2_freq, S_IRUGO | S_IWUSR, show_pwmfreq,
+                            set_pwmfreq, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(pwm2_enable, S_IRUGO | S_IWUSR, show_pwmctrl,
+                            set_pwmctrl, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(pwm2_auto_channel_temp, S_IRUGO | S_IWUSR,
+                            show_pwmchan, set_pwmchan, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(pwm2_auto_point1_pwm, S_IRUGO | S_IWUSR, show_pwm,
+                            set_pwm, MIN, 1);
+static SENSOR_DEVICE_ATTR_2(pwm2_auto_point2_pwm, S_IRUGO | S_IWUSR, show_pwm,
+                            set_pwm, MAX, 1);
+static SENSOR_DEVICE_ATTR_2(pwm3, S_IRUGO | S_IWUSR, show_pwm, set_pwm, INPUT,
+                            2);
+static SENSOR_DEVICE_ATTR_2(pwm3_freq, S_IRUGO | S_IWUSR, show_pwmfreq,
+                            set_pwmfreq, INPUT, 2);
+static SENSOR_DEVICE_ATTR_2(pwm3_enable, S_IRUGO | S_IWUSR, show_pwmctrl,
+                            set_pwmctrl, INPUT, 2);
+static SENSOR_DEVICE_ATTR_2(pwm3_auto_channel_temp, S_IRUGO | S_IWUSR,
+                            show_pwmchan, set_pwmchan, INPUT, 2);
+static SENSOR_DEVICE_ATTR_2(pwm3_auto_point1_pwm, S_IRUGO | S_IWUSR, show_pwm,
+                            set_pwm, MIN, 2);
+static SENSOR_DEVICE_ATTR_2(pwm3_auto_point2_pwm, S_IRUGO | S_IWUSR, show_pwm,
+                            set_pwm, MAX, 2);
+
+static struct attribute *adt7475_attrs[] = {
+        &sensor_dev_attr_in1_input.dev_attr.attr,
+        &sensor_dev_attr_in1_max.dev_attr.attr,
+        &sensor_dev_attr_in1_min.dev_attr.attr,
+        &sensor_dev_attr_in1_alarm.dev_attr.attr,
+        &sensor_dev_attr_in2_input.dev_attr.attr,
+        &sensor_dev_attr_in2_max.dev_attr.attr,
+        &sensor_dev_attr_in2_min.dev_attr.attr,
+        &sensor_dev_attr_in2_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp1_input.dev_attr.attr,
+        &sensor_dev_attr_temp1_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp1_fault.dev_attr.attr,
+        &sensor_dev_attr_temp1_max.dev_attr.attr,
+        &sensor_dev_attr_temp1_min.dev_attr.attr,
+        &sensor_dev_attr_temp1_offset.dev_attr.attr,
+        &sensor_dev_attr_temp1_auto_point1_temp.dev_attr.attr,
+        &sensor_dev_attr_temp1_auto_point2_temp.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr,
+        &sensor_dev_attr_temp2_input.dev_attr.attr,
+        &sensor_dev_attr_temp2_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp2_max.dev_attr.attr,
+        &sensor_dev_attr_temp2_min.dev_attr.attr,
+        &sensor_dev_attr_temp2_offset.dev_attr.attr,
+        &sensor_dev_attr_temp2_auto_point1_temp.dev_attr.attr,
+        &sensor_dev_attr_temp2_auto_point2_temp.dev_attr.attr,
+        &sensor_dev_attr_temp2_crit.dev_attr.attr,
+        &sensor_dev_attr_temp2_crit_hyst.dev_attr.attr,
+        &sensor_dev_attr_temp3_input.dev_attr.attr,
+        &sensor_dev_attr_temp3_fault.dev_attr.attr,
+        &sensor_dev_attr_temp3_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp3_max.dev_attr.attr,
+        &sensor_dev_attr_temp3_min.dev_attr.attr,
+        &sensor_dev_attr_temp3_offset.dev_attr.attr,
+        &sensor_dev_attr_temp3_auto_point1_temp.dev_attr.attr,
+        &sensor_dev_attr_temp3_auto_point2_temp.dev_attr.attr,
+        &sensor_dev_attr_temp3_crit.dev_attr.attr,
+        &sensor_dev_attr_temp3_crit_hyst.dev_attr.attr,
+        &sensor_dev_attr_fan1_input.dev_attr.attr,
+        &sensor_dev_attr_fan1_min.dev_attr.attr,
+        &sensor_dev_attr_fan1_alarm.dev_attr.attr,
+        &sensor_dev_attr_fan2_input.dev_attr.attr,
+        &sensor_dev_attr_fan2_min.dev_attr.attr,
+        &sensor_dev_attr_fan2_alarm.dev_attr.attr,
+        &sensor_dev_attr_fan3_input.dev_attr.attr,
+        &sensor_dev_attr_fan3_min.dev_attr.attr,
+        &sensor_dev_attr_fan3_alarm.dev_attr.attr,
+        &sensor_dev_attr_fan4_input.dev_attr.attr,
+        &sensor_dev_attr_fan4_min.dev_attr.attr,
+        &sensor_dev_attr_fan4_alarm.dev_attr.attr,
+        &sensor_dev_attr_pwm1.dev_attr.attr,
+        &sensor_dev_attr_pwm1_freq.dev_attr.attr,
+        &sensor_dev_attr_pwm1_enable.dev_attr.attr,
+        &sensor_dev_attr_pwm1_auto_channel_temp.dev_attr.attr,
+        &sensor_dev_attr_pwm1_auto_point1_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm1_auto_point2_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm2.dev_attr.attr,
+        &sensor_dev_attr_pwm2_freq.dev_attr.attr,
+        &sensor_dev_attr_pwm2_enable.dev_attr.attr,
+        &sensor_dev_attr_pwm2_auto_channel_temp.dev_attr.attr,
+        &sensor_dev_attr_pwm2_auto_point1_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm2_auto_point2_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm3.dev_attr.attr,
+        &sensor_dev_attr_pwm3_freq.dev_attr.attr,
+        &sensor_dev_attr_pwm3_enable.dev_attr.attr,
+        &sensor_dev_attr_pwm3_auto_channel_temp.dev_attr.attr,
+        &sensor_dev_attr_pwm3_auto_point1_pwm.dev_attr.attr,
+        &sensor_dev_attr_pwm3_auto_point2_pwm.dev_attr.attr,
+        NULL,
+};
+
+struct attribute_group adt7475_attr_group = { .attrs = adt7475_attrs };
+
+static int adt7475_detect(struct i2c_client *client, int kind,
+                          struct i2c_board_info *info)
+{
+        struct i2c_adapter *adapter = client->adapter;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+                return -ENODEV;
+
+        if (kind <= 0) {
+                if (adt7475_read(REG_VENDID) != 0x41 ||
+                    adt7475_read(REG_DEVID) != 0x75) {
+                        dev_err(&adapter->dev,
+                                "Couldn't detect a adt7475 part at 0x%02x\n",
+                                (unsigned int)client->addr);
+                        return -ENODEV;
+                }
+        }
+
+        strlcpy(info->type, adt7475_id[0].name, I2C_NAME_SIZE);
+
+        return 0;
+}
+
+static int adt7475_probe(struct i2c_client *client,
+                         const struct i2c_device_id *id)
+{
+        struct adt7475_data *data;
+        int i, ret = 0;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (data == NULL)
+                return -ENOMEM;
+
+        mutex_init(&data->lock);
+        i2c_set_clientdata(client, data);
+
+        /* Call adt7475_read_pwm for all pwm's as this will reprogram any
+           pwm's which are disabled to manual mode with 0% duty cycle */
+        for (i = 0; i < ADT7475_PWM_COUNT; i++)
+                adt7475_read_pwm(client, i);
+
+        ret = sysfs_create_group(&client->dev.kobj, &adt7475_attr_group);
+        if (ret)
+                goto efree;
+
+        data->hwmon_dev = hwmon_device_register(&client->dev);
+        if (IS_ERR(data->hwmon_dev)) {
+                ret = PTR_ERR(data->hwmon_dev);
+                goto eremove;
+        }
+
+        return 0;
+
+eremove:
+        sysfs_remove_group(&client->dev.kobj, &adt7475_attr_group);
+efree:
+        kfree(data);
+        return ret;
+}
+
+static int adt7475_remove(struct i2c_client *client)
+{
+        struct adt7475_data *data = i2c_get_clientdata(client);
+
+        hwmon_device_unregister(data->hwmon_dev);
+        sysfs_remove_group(&client->dev.kobj, &adt7475_attr_group);
+        kfree(data);
+
+        return 0;
+}
+
+static struct i2c_driver adt7475_driver = {
+        .class          = I2C_CLASS_HWMON,
+        .driver = {
+                .name   = "adt7475",
+        },
+        .probe          = adt7475_probe,
+        .remove         = adt7475_remove,
+        .id_table       = adt7475_id,
+        .detect         = adt7475_detect,
+        .address_data   = &addr_data,
+};
+
+static void adt7475_read_hystersis(struct i2c_client *client)
+{
+        struct adt7475_data *data = i2c_get_clientdata(client);
+
+        data->temp[HYSTERSIS][0] = (u16) adt7475_read(REG_REMOTE1_HYSTERSIS);
+        data->temp[HYSTERSIS][1] = data->temp[HYSTERSIS][0];
+        data->temp[HYSTERSIS][2] = (u16) adt7475_read(REG_REMOTE2_HYSTERSIS);
+}
+
+static void adt7475_read_pwm(struct i2c_client *client, int index)
+{
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        unsigned int v;
+
+        data->pwm[CONTROL][index] = adt7475_read(PWM_CONFIG_REG(index));
+
+        /* Figure out the internal value for pwmctrl and pwmchan
+           based on the current settings */
+        v = (data->pwm[CONTROL][index] >> 5) & 7;
+
+        if (v == 3)
+                data->pwmctl[index] = 0;
+        else if (v == 7)
+                data->pwmctl[index] = 1;
+        else if (v == 4) {
+                /* The fan is disabled - we don't want to
+                   support that, so change to manual mode and
+                   set the duty cycle to 0 instead
+                */
+                data->pwm[INPUT][index] = 0;
+                data->pwm[CONTROL][index] &= ~0xE0;
+                data->pwm[CONTROL][index] |= (7 << 5);
+
+                i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
+                                          data->pwm[INPUT][index]);
+
+                i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index),
+                                          data->pwm[CONTROL][index]);
+
+                data->pwmctl[index] = 1;
+        } else {
+                data->pwmctl[index] = 2;
+
+                switch (v) {
+                case 0:
+                        data->pwmchan[index] = 1;
+                        break;
+                case 1:
+                        data->pwmchan[index] = 2;
+                        break;
+                case 2:
+                        data->pwmchan[index] = 4;
+                        break;
+                case 5:
+                        data->pwmchan[index] = 6;
+                        break;
+                case 6:
+                        data->pwmchan[index] = 7;
+                        break;
+                }
+        }
+}
+
+static struct adt7475_data *adt7475_update_device(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct adt7475_data *data = i2c_get_clientdata(client);
+        u8 ext;
+        int i;
+
+        mutex_lock(&data->lock);
+
+        /* Measurement values update every 2 seconds */
+        if (time_after(jiffies, data->measure_updated + HZ * 2) ||
+            !data->valid) {
+                data->alarms = adt7475_read(REG_STATUS2) << 8;
+                data->alarms |= adt7475_read(REG_STATUS1);
+
+                ext = adt7475_read(REG_EXTEND1);
+                for (i = 0; i < ADT7475_VOLTAGE_COUNT; i++)
+                        data->voltage[INPUT][i] =
+                                (adt7475_read(VOLTAGE_REG(i)) << 2) |
+                                ((ext >> ((i + 1) * 2)) & 3);
+
+                ext = adt7475_read(REG_EXTEND2);
+                for (i = 0; i < ADT7475_TEMP_COUNT; i++)
+                        data->temp[INPUT][i] =
+                                (adt7475_read(TEMP_REG(i)) << 2) |
+                                ((ext >> ((i + 1) * 2)) & 3);
+
+                for (i = 0; i < ADT7475_TACH_COUNT; i++)
+                        data->tach[INPUT][i] =
+                                adt7475_read_word(client, TACH_REG(i));
+
+                /* Updated by hw when in auto mode */
+                for (i = 0; i < ADT7475_PWM_COUNT; i++)
+                        data->pwm[INPUT][i] = adt7475_read(PWM_REG(i));
+
+                data->measure_updated = jiffies;
+        }
+
+        /* Limits and settings, should never change update every 60 seconds */
+        if (time_after(jiffies, data->limits_updated + HZ * 2) ||
+            !data->valid) {
+                data->config5 = adt7475_read(REG_CONFIG5);
+
+                for (i = 0; i < ADT7475_VOLTAGE_COUNT; i++) {
+                        /* Adjust values so they match the input precision */
+                        data->voltage[MIN][i] =
+                                adt7475_read(VOLTAGE_MIN_REG(i)) << 2;
+                        data->voltage[MAX][i] =
+                                adt7475_read(VOLTAGE_MAX_REG(i)) << 2;
+                }
+
+                for (i = 0; i < ADT7475_TEMP_COUNT; i++) {
+                        /* Adjust values so they match the input precision */
+                        data->temp[MIN][i] =
+                                adt7475_read(TEMP_MIN_REG(i)) << 2;
+                        data->temp[MAX][i] =
+                                adt7475_read(TEMP_MAX_REG(i)) << 2;
+                        data->temp[AUTOMIN][i] =
+                                adt7475_read(TEMP_TMIN_REG(i)) << 2;
+                        data->temp[THERM][i] =
+                                adt7475_read(TEMP_THERM_REG(i)) << 2;
+                        data->temp[OFFSET][i] =
+                                adt7475_read(TEMP_OFFSET_REG(i));
+                }
+                adt7475_read_hystersis(client);
+
+                for (i = 0; i < ADT7475_TACH_COUNT; i++)
+                        data->tach[MIN][i] =
+                                adt7475_read_word(client, TACH_MIN_REG(i));
+
+                for (i = 0; i < ADT7475_PWM_COUNT; i++) {
+                        data->pwm[MAX][i] = adt7475_read(PWM_MAX_REG(i));
+                        data->pwm[MIN][i] = adt7475_read(PWM_MIN_REG(i));
+                        /* Set the channel and control information */
+                        adt7475_read_pwm(client, i);
+                }
+
+                data->range[0] = adt7475_read(TEMP_TRANGE_REG(0));
+                data->range[1] = adt7475_read(TEMP_TRANGE_REG(1));
+                data->range[2] = adt7475_read(TEMP_TRANGE_REG(2));
+
+                data->limits_updated = jiffies;
+                data->valid = 1;
+        }
+
+        mutex_unlock(&data->lock);
+
+        return data;
+}
+
+static int __init sensors_adt7475_init(void)
+{
+        return i2c_add_driver(&adt7475_driver);
+}
+
+static void __exit sensors_adt7475_exit(void)
+{
+        i2c_del_driver(&adt7475_driver);
+}
+
+MODULE_AUTHOR("Advanced Micro Devices, Inc");
+MODULE_DESCRIPTION("adt7475 driver");
+MODULE_LICENSE("GPL");
+
+module_init(sensors_adt7475_init);
+module_exit(sensors_adt7475_exit);
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index dca47a591baf..e30186236588 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -590,6 +590,11 @@ static ssize_t applesmc_light_show(struct device *dev,
         }
 
         ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length);
+        /* newer macbooks report a single 10-bit bigendian value */
+        if (data_length == 10) {
+                left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2;
+                goto out;
+        }
         left = buffer[2];
         if (ret)
                 goto out;
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index bf8d40580577..03705240000f 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -3,7 +3,7 @@
  *
  *  Copyright (C) 2007-2008 Yan Burman
  *  Copyright (C) 2008 Eric Piel
- *  Copyright (C) 2008 Pavel Machek
+ *  Copyright (C) 2008-2009 Pavel Machek
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -36,6 +36,7 @@
 #include <linux/freezer.h>
 #include <linux/version.h>
 #include <linux/uaccess.h>
+#include <linux/leds.h>
 #include <acpi/acpi_drivers.h>
 #include <asm/atomic.h>
 #include "lis3lv02d.h"
@@ -43,6 +44,36 @@
 #define DRIVER_NAME     "lis3lv02d"
 #define ACPI_MDPS_CLASS "accelerometer"
 
+/* Delayed LEDs infrastructure ------------------------------------ */
+
+/* Special LED class that can defer work */
+struct delayed_led_classdev {
+        struct led_classdev led_classdev;
+        struct work_struct work;
+        enum led_brightness new_brightness;
+
+        unsigned int led;               /* For driver */
+        void (*set_brightness)(struct delayed_led_classdev *data, enum led_brightness value);
+};
+
+static inline void delayed_set_status_worker(struct work_struct *work)
+{
+        struct delayed_led_classdev *data =
+                        container_of(work, struct delayed_led_classdev, work);
+
+        data->set_brightness(data, data->new_brightness);
+}
+
+static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
+                              enum led_brightness brightness)
+{
+        struct delayed_led_classdev *data = container_of(led_cdev,
+                             struct delayed_led_classdev, led_classdev);
+        data->new_brightness = brightness;
+        schedule_work(&data->work);
+}
+
+/* HP-specific accelerometer driver ------------------------------------ */
 
 /* For automatic insertion of the module */
 static struct acpi_device_id lis3lv02d_device_ids[] = {
@@ -154,10 +185,33 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
  */
 };
 
+static void hpled_set(struct delayed_led_classdev *led_cdev, enum led_brightness value)
+{
+        acpi_handle handle = adev.device->handle;
+        unsigned long long ret; /* Not used when writing */
+        union acpi_object in_obj[1];
+        struct acpi_object_list args = { 1, in_obj };
+
+        in_obj[0].type          = ACPI_TYPE_INTEGER;
+        in_obj[0].integer.value = !!value;
+
+        acpi_evaluate_integer(handle, "ALED", &args, &ret);
+}
+
+static struct delayed_led_classdev hpled_led = {
+        .led_classdev = {
+                .name                   = "hp::hddprotect",
+                .default_trigger        = "none",
+                .brightness_set         = delayed_sysfs_set,
+                .flags                  = LED_CORE_SUSPENDRESUME,
+        },
+        .set_brightness = hpled_set,
+};
 
 static int lis3lv02d_add(struct acpi_device *device)
 {
         u8 val;
+        int ret;
 
         if (!device)
                 return -EINVAL;
@@ -183,7 +237,19 @@ static int lis3lv02d_add(struct acpi_device *device)
                 adev.ac = lis3lv02d_axis_normal;
         }
 
-        return lis3lv02d_init_device(&adev);
+        INIT_WORK(&hpled_led.work, delayed_set_status_worker);
+        ret = led_classdev_register(NULL, &hpled_led.led_classdev);
+        if (ret)
+                return ret;
+
+        ret = lis3lv02d_init_device(&adev);
+        if (ret) {
+                flush_work(&hpled_led.work);
+                led_classdev_unregister(&hpled_led.led_classdev);
+                return ret;
+        }
+
+        return ret;
 }
 
 static int lis3lv02d_remove(struct acpi_device *device, int type)
@@ -194,6 +260,9 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
         lis3lv02d_joystick_disable();
         lis3lv02d_poweroff(device->handle);
 
+        flush_work(&hpled_led.work);
+        led_classdev_unregister(&hpled_led.led_classdev);
+
         return lis3lv02d_remove_fs();
 }
 
@@ -256,7 +325,7 @@ static void __exit lis3lv02d_exit_module(void)
         acpi_bus_unregister_driver(&lis3lv02d_driver);
 }
 
-MODULE_DESCRIPTION("Glue between LIS3LV02Dx and HP ACPI BIOS");
+MODULE_DESCRIPTION("Glue between LIS3LV02Dx and HP ACPI BIOS and support for disk protection LED.");
 MODULE_AUTHOR("Yan Burman, Eric Piel, Pavel Machek");
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index bd2bde0ef95e..1fe995111841 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -31,6 +31,7 @@
 #include <linux/hwmon-sysfs.h>
 #include <linux/err.h>
 #include <linux/mutex.h>
+#include <asm/processor.h>
 
 #define TEMP_FROM_REG(val)      (((((val) >> 16) & 0xff) - 49) * 1000)
 #define REG_TEMP        0xe4
@@ -47,6 +48,8 @@ struct k8temp_data {
         /* registers values */
         u8 sensorsp;            /* sensor presence bits - SEL_CORE & SEL_PLACE */
         u32 temp[2][2];         /* core, place */
+        u8 swap_core_select;    /* meaning of SEL_CORE is inverted */
+        u32 temp_offset;
 };
 
 static struct k8temp_data *k8temp_update_device(struct device *dev)
@@ -114,10 +117,15 @@ static ssize_t show_temp(struct device *dev,
             to_sensor_dev_attr_2(devattr);
         int core = attr->nr;
         int place = attr->index;
+        int temp;
         struct k8temp_data *data = k8temp_update_device(dev);
 
-        return sprintf(buf, "%d\n",
-                       TEMP_FROM_REG(data->temp[core][place]));
+        if (data->swap_core_select)
+                core = core ? 0 : 1;
+
+        temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset;
+
+        return sprintf(buf, "%d\n", temp);
 }
 
 /* core, place */
@@ -141,20 +149,49 @@ static int __devinit k8temp_probe(struct pci_dev *pdev,
         int err;
         u8 scfg;
         u32 temp;
+        u8 model, stepping;
         struct k8temp_data *data;
-        u32 cpuid = cpuid_eax(1);
-
-        /* this feature should be available since SH-C0 core */
-        if ((cpuid == 0xf40) || (cpuid == 0xf50) || (cpuid == 0xf51)) {
-                err = -ENODEV;
-                goto exit;
-        }
 
         if (!(data = kzalloc(sizeof(struct k8temp_data), GFP_KERNEL))) {
                 err = -ENOMEM;
                 goto exit;
         }
 
+        model = boot_cpu_data.x86_model;
+        stepping = boot_cpu_data.x86_mask;
+
+        switch (boot_cpu_data.x86) {
+        case 0xf:
+                /* feature available since SH-C0, exclude older revisions */
+                if (((model == 4) && (stepping == 0)) ||
+                    ((model == 5) && (stepping <= 1))) {
+                        err = -ENODEV;
+                        goto exit_free;
+                }
+
+                /*
+                 * AMD NPT family 0fh, i.e. RevF and RevG:
+                 * meaning of SEL_CORE bit is inverted
+                 */
+                if (model >= 0x40) {
+                        data->swap_core_select = 1;
+                        dev_warn(&pdev->dev, "Temperature readouts might be "
+                                 "wrong - check erratum #141\n");
+                }
+
+                if ((model >= 0x69) &&
+                    !(model == 0xc1 || model == 0x6c || model == 0x7c)) {
+                        /*
+                         * RevG desktop CPUs (i.e. no socket S1G1 parts)
+                         * need additional offset, otherwise reported
+                         * temperature is below ambient temperature
+                         */
+                        data->temp_offset = 21000;
+                }
+
+                break;
+        }
+
         pci_read_config_byte(pdev, REG_TEMP, &scfg);
         scfg &= ~(SEL_PLACE | SEL_CORE);                /* Select sensor 0, core0 */
         pci_write_config_byte(pdev, REG_TEMP, scfg);
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 7c5f97033b9f..cb8943da4f12 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -292,7 +292,9 @@ isdn_net_unbind_channel(isdn_net_local * lp)
         lp->dialstate = 0;
         dev->rx_netdev[isdn_dc2minor(lp->isdn_device, lp->isdn_channel)] = NULL;
         dev->st_netdev[isdn_dc2minor(lp->isdn_device, lp->isdn_channel)] = NULL;
-        isdn_free_channel(lp->isdn_device, lp->isdn_channel, ISDN_USAGE_NET);
+        if (lp->isdn_device != -1 && lp->isdn_channel != -1)
+                isdn_free_channel(lp->isdn_device, lp->isdn_channel,
+                                  ISDN_USAGE_NET);
         lp->flags &= ~ISDN_NET_CONNECTED;
         lp->isdn_device = -1;
         lp->isdn_channel = -1;
@@ -2513,7 +2515,6 @@ static const struct net_device_ops isdn_netdev_ops = {
         .ndo_stop             = isdn_net_close,
         .ndo_do_ioctl         = isdn_net_ioctl,
 
-        .ndo_validate_addr    = NULL,
         .ndo_start_xmit       = isdn_net_start_xmit,
         .ndo_get_stats        = isdn_net_get_stats,
         .ndo_tx_timeout       = isdn_net_tx_timeout,
@@ -2528,12 +2529,8 @@ static void _isdn_setup(struct net_device *dev)
 
         ether_setup(dev);
 
-        dev->flags = IFF_NOARP | IFF_POINTOPOINT;
         /* Setup the generic properties */
-        dev->mtu = 1500;
         dev->flags = IFF_NOARP|IFF_POINTOPOINT;
-        dev->type = ARPHRD_ETHER;
-        dev->addr_len = ETH_ALEN;
         dev->header_ops = NULL;
         dev->netdev_ops = &isdn_netdev_ops;
 
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index a4a1ae214630..742713611bc5 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -119,13 +119,6 @@ config LEDS_GPIO
           outputs. To be useful the particular board must have LEDs
           and they must be connected to the GPIO lines.
 
-config LEDS_HP_DISK
-        tristate "LED Support for disk protection LED on HP notebooks"
-        depends on LEDS_CLASS && ACPI
-        help
-          This option enable support for disk protection LED, found on
-          newer HP notebooks.
-
 config LEDS_CLEVO_MAIL
         tristate "Mail LED on Clevo notebook (EXPERIMENTAL)"
         depends on LEDS_CLASS && X86 && SERIO_I8042 && DMI && EXPERIMENTAL
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index bc247cb02e82..9d76f0f160a4 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -23,7 +23,6 @@ obj-$(CONFIG_LEDS_HP6XX)		+= leds-hp6xx.o
 obj-$(CONFIG_LEDS_FSG)                  += leds-fsg.o
 obj-$(CONFIG_LEDS_PCA955X)              += leds-pca955x.o
 obj-$(CONFIG_LEDS_DA903X)               += leds-da903x.o
-obj-$(CONFIG_LEDS_HP_DISK)              += leds-hp-disk.o
 obj-$(CONFIG_LEDS_WM8350)               += leds-wm8350.o
 
 # LED Triggers
diff --git a/drivers/leds/leds-hp-disk.c b/drivers/leds/leds-hp-disk.c
deleted file mode 100644
index d786adc8c5e3..000000000000
--- a/drivers/leds/leds-hp-disk.c
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- *  leds-hp-disk.c - driver for HP "hard disk protection" LED
- *
- *  Copyright (C) 2008 Pavel Machek
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/dmi.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/platform_device.h>
-#include <linux/interrupt.h>
-#include <linux/input.h>
-#include <linux/kthread.h>
-#include <linux/leds.h>
-#include <acpi/acpi_drivers.h>
-
-#define DRIVER_NAME     "leds-hp-disk"
-#define ACPI_MDPS_CLASS "led"
-
-/* For automatic insertion of the module */
-static struct acpi_device_id hpled_device_ids[] = {
-        {"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
-        {"", 0},
-};
-MODULE_DEVICE_TABLE(acpi, hpled_device_ids);
-
-struct acpi_hpled {
-        struct acpi_device      *device;   /* The ACPI device */
-};
-
-static struct acpi_hpled adev;
-
-static acpi_status hpled_acpi_write(acpi_handle handle, int reg)
-{
-        unsigned long long ret; /* Not used when writing */
-        union acpi_object in_obj[1];
-        struct acpi_object_list args = { 1, in_obj };
-
-        in_obj[0].type          = ACPI_TYPE_INTEGER;
-        in_obj[0].integer.value = reg;
-
-        return acpi_evaluate_integer(handle, "ALED", &args, &ret);
-}
-
-static void hpled_set(struct led_classdev *led_cdev,
-                               enum led_brightness value)
-{
-        hpled_acpi_write(adev.device->handle, !!value);
-}
-
-static struct led_classdev hpled_led = {
-        .name                   = "hp:red:hddprotection",
-        .default_trigger        = "heartbeat",
-        .brightness_set         = hpled_set,
-        .flags                  = LED_CORE_SUSPENDRESUME,
-};
-
-static int hpled_add(struct acpi_device *device)
-{
-        int ret;
-
-        if (!device)
-                return -EINVAL;
-
-        adev.device = device;
-        strcpy(acpi_device_name(device), DRIVER_NAME);
-        strcpy(acpi_device_class(device), ACPI_MDPS_CLASS);
-        device->driver_data = &adev;
-
-        ret = led_classdev_register(NULL, &hpled_led);
-        return ret;
-}
-
-static int hpled_remove(struct acpi_device *device, int type)
-{
-        if (!device)
-                return -EINVAL;
-
-        led_classdev_unregister(&hpled_led);
-        return 0;
-}
-
-
-
-static struct acpi_driver leds_hp_driver = {
-        .name  = DRIVER_NAME,
-        .class = ACPI_MDPS_CLASS,
-        .ids   = hpled_device_ids,
-        .ops = {
-                .add     = hpled_add,
-                .remove  = hpled_remove,
-        }
-};
-
-static int __init hpled_init_module(void)
-{
-        int ret;
-
-        if (acpi_disabled)
-                return -ENODEV;
-
-        ret = acpi_bus_register_driver(&leds_hp_driver);
-        if (ret < 0)
-                return ret;
-
-        printk(KERN_INFO DRIVER_NAME " driver loaded.\n");
-
-        return 0;
-}
-
-static void __exit hpled_exit_module(void)
-{
-        acpi_bus_unregister_driver(&leds_hp_driver);
-}
-
-MODULE_DESCRIPTION("Driver for HP disk protection LED");
-MODULE_AUTHOR("Pavel Machek <pavel@suse.cz>");
-MODULE_LICENSE("GPL");
-
-module_init(hpled_init_module);
-module_exit(hpled_exit_module);
diff --git a/drivers/message/fusion/lsi/mpi.h b/drivers/message/fusion/lsi/mpi.h
index 10b6ef758725..11c0f461320e 100644
--- a/drivers/message/fusion/lsi/mpi.h
+++ b/drivers/message/fusion/lsi/mpi.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Message independent structures and definitions
  *  Creation Date:  July 27, 2000
  *
- *    mpi.h Version:  01.05.13
+ *    mpi.h Version:  01.05.16
  *
  *  Version History
  *  ---------------
@@ -79,6 +79,9 @@
  *  03-27-06  01.05.11  Bumped MPI_HEADER_VERSION_UNIT.
  *  10-11-06  01.05.12  Bumped MPI_HEADER_VERSION_UNIT.
  *  05-24-07  01.05.13  Bumped MPI_HEADER_VERSION_UNIT.
+ *  08-07-07  01.05.14  Bumped MPI_HEADER_VERSION_UNIT.
+ *  01-15-08  01.05.15  Bumped MPI_HEADER_VERSION_UNIT.
+ *  03-28-08  01.05.16  Bumped MPI_HEADER_VERSION_UNIT.
  *  --------------------------------------------------------------------------
  */
 
@@ -109,7 +112,7 @@
 /* Note: The major versions of 0xe0 through 0xff are reserved */
 
 /* versioning for this MPI header set */
-#define MPI_HEADER_VERSION_UNIT             (0x10)
+#define MPI_HEADER_VERSION_UNIT             (0x13)
 #define MPI_HEADER_VERSION_DEV              (0x00)
 #define MPI_HEADER_VERSION_UNIT_MASK        (0xFF00)
 #define MPI_HEADER_VERSION_UNIT_SHIFT       (8)
diff --git a/drivers/message/fusion/lsi/mpi_cnfg.h b/drivers/message/fusion/lsi/mpi_cnfg.h
index b2db3330c591..013c7d881948 100644
--- a/drivers/message/fusion/lsi/mpi_cnfg.h
+++ b/drivers/message/fusion/lsi/mpi_cnfg.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Config message, structures, and Pages
  *  Creation Date:  July 27, 2000
  *
- *    mpi_cnfg.h Version:  01.05.15
+ *    mpi_cnfg.h Version:  01.05.18
  *
  *  Version History
  *  ---------------
@@ -308,6 +308,20 @@
  *                      Expander Page 0 Flags field.
  *                      Fixed define for
  *                      MPI_SAS_EXPANDER1_DISCINFO_BAD_PHY_DISABLED.
+ *  08-07-07  01.05.16  Added MPI_IOCPAGE6_CAP_FLAGS_MULTIPORT_DRIVE_SUPPORT
+ *                      define.
+ *                      Added BIOS Page 4 structure.
+ *                      Added MPI_RAID_PHYS_DISK1_PATH_MAX define for RAID
+ *                      Physcial Disk Page 1.
+ *  01-15-07  01.05.17  Added additional bit defines for ExtFlags field of
+ *                      Manufacturing Page 4.
+ *                      Added Solid State Drives Supported bit to IOC Page 6
+ *                      Capabilities Flags.
+ *                      Added new value for AccessStatus field of SAS Device
+ *                      Page 0 (_SATA_NEEDS_INITIALIZATION).
+ *  03-28-08  01.05.18  Defined new bits in Manufacturing Page 4 ExtFlags field
+ *                      to control coercion size and the mixing of SAS and SATA
+ *                      SSD drives.
  *  --------------------------------------------------------------------------
  */
 
@@ -686,6 +700,14 @@ typedef struct _CONFIG_PAGE_MANUFACTURING_4
 #define MPI_MANPAGE4_IR_NO_MIX_SAS_SATA                 (0x01)
 
 /* defines for the ExtFlags field */
+#define MPI_MANPAGE4_EXTFLAGS_MASK_COERCION_SIZE        (0x0180)
+#define MPI_MANPAGE4_EXTFLAGS_SHIFT_COERCION_SIZE       (7)
+#define MPI_MANPAGE4_EXTFLAGS_1GB_COERCION_SIZE         (0)
+#define MPI_MANPAGE4_EXTFLAGS_128MB_COERCION_SIZE       (1)
+
+#define MPI_MANPAGE4_EXTFLAGS_NO_MIX_SSD_SAS_SATA       (0x0040)
+#define MPI_MANPAGE4_EXTFLAGS_MIX_SSD_AND_NON_SSD       (0x0020)
+#define MPI_MANPAGE4_EXTFLAGS_DUAL_PORT_SUPPORT         (0x0010)
 #define MPI_MANPAGE4_EXTFLAGS_HIDE_NON_IR_METADATA      (0x0008)
 #define MPI_MANPAGE4_EXTFLAGS_SAS_CACHE_DISABLE         (0x0004)
 #define MPI_MANPAGE4_EXTFLAGS_SATA_CACHE_DISABLE        (0x0002)
@@ -1159,6 +1181,8 @@ typedef struct _CONFIG_PAGE_IOC_6
 
 /* IOC Page 6 Capabilities Flags */
 
+#define MPI_IOCPAGE6_CAP_FLAGS_SSD_SUPPORT              (0x00000020)
+#define MPI_IOCPAGE6_CAP_FLAGS_MULTIPORT_DRIVE_SUPPORT  (0x00000010)
 #define MPI_IOCPAGE6_CAP_FLAGS_DISABLE_SMART_POLLING    (0x00000008)
 
 #define MPI_IOCPAGE6_CAP_FLAGS_MASK_METADATA_SIZE       (0x00000006)
@@ -1428,6 +1452,15 @@ typedef struct _CONFIG_PAGE_BIOS_2
 #define MPI_BIOSPAGE2_FORM_SAS_WWN                      (0x05)
 #define MPI_BIOSPAGE2_FORM_ENCLOSURE_SLOT               (0x06)
 
+typedef struct _CONFIG_PAGE_BIOS_4
+{
+    CONFIG_PAGE_HEADER      Header;                     /* 00h */
+    U64                     ReassignmentBaseWWID;       /* 04h */
+} CONFIG_PAGE_BIOS_4, MPI_POINTER PTR_CONFIG_PAGE_BIOS_4,
+  BIOSPage4_t, MPI_POINTER pBIOSPage4_t;
+
+#define MPI_BIOSPAGE4_PAGEVERSION                       (0x00)
+
 
 /****************************************************************************
 *   SCSI Port Config Pages
@@ -2419,6 +2452,15 @@ typedef struct _RAID_PHYS_DISK1_PATH
 #define MPI_RAID_PHYSDISK1_FLAG_BROKEN          (0x0002)
 #define MPI_RAID_PHYSDISK1_FLAG_INVALID         (0x0001)
 
+
+/*
+ * Host code (drivers, BIOS, utilities, etc.) should leave this define set to
+ * one and check Header.PageLength or NumPhysDiskPaths at runtime.
+ */
+#ifndef MPI_RAID_PHYS_DISK1_PATH_MAX
+#define MPI_RAID_PHYS_DISK1_PATH_MAX    (1)
+#endif
+
 typedef struct _CONFIG_PAGE_RAID_PHYS_DISK_1
 {
     CONFIG_PAGE_HEADER              Header;             /* 00h */
@@ -2426,7 +2468,7 @@ typedef struct _CONFIG_PAGE_RAID_PHYS_DISK_1
     U8                              PhysDiskNum;        /* 05h */
     U16                             Reserved2;          /* 06h */
     U32                             Reserved1;          /* 08h */
-    RAID_PHYS_DISK1_PATH            Path[1];            /* 0Ch */
+    RAID_PHYS_DISK1_PATH            Path[MPI_RAID_PHYS_DISK1_PATH_MAX];/* 0Ch */
 } CONFIG_PAGE_RAID_PHYS_DISK_1, MPI_POINTER PTR_CONFIG_PAGE_RAID_PHYS_DISK_1,
   RaidPhysDiskPage1_t, MPI_POINTER pRaidPhysDiskPage1_t;
 
@@ -2844,6 +2886,7 @@ typedef struct _CONFIG_PAGE_SAS_DEVICE_0
 #define MPI_SAS_DEVICE0_ASTATUS_SATA_INIT_FAILED            (0x01)
 #define MPI_SAS_DEVICE0_ASTATUS_SATA_CAPABILITY_FAILED      (0x02)
 #define MPI_SAS_DEVICE0_ASTATUS_SATA_AFFILIATION_CONFLICT   (0x03)
+#define MPI_SAS_DEVICE0_ASTATUS_SATA_NEEDS_INITIALIZATION   (0x04)
 /* specific values for SATA Init failures */
 #define MPI_SAS_DEVICE0_ASTATUS_SIF_UNKNOWN                 (0x10)
 #define MPI_SAS_DEVICE0_ASTATUS_SIF_AFFILIATION_CONFLICT    (0x11)
diff --git a/drivers/message/fusion/lsi/mpi_fc.h b/drivers/message/fusion/lsi/mpi_fc.h
index 627acfbb8623..7d663ce76f8c 100644
--- a/drivers/message/fusion/lsi/mpi_fc.h
+++ b/drivers/message/fusion/lsi/mpi_fc.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2000-2004 LSI Corporation.
+ *  Copyright (c) 2000-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_fc.h
diff --git a/drivers/message/fusion/lsi/mpi_history.txt b/drivers/message/fusion/lsi/mpi_history.txt
index 3f15fcfe4a2e..693e4b511354 100644
--- a/drivers/message/fusion/lsi/mpi_history.txt
+++ b/drivers/message/fusion/lsi/mpi_history.txt
@@ -3,28 +3,28 @@
  MPI Header File Change History
  ==============================
 
- Copyright (c) 2000-2007 LSI Corporation.
+ Copyright (c) 2000-2008 LSI Corporation.
 
  ---------------------------------------
- Header Set Release Version:    01.05.16
- Header Set Release Date:       05-24-07
+ Header Set Release Version:    01.05.19
+ Header Set Release Date:       03-28-08
  ---------------------------------------
 
  Filename               Current version     Prior version
  ----------             ---------------     -------------
- mpi.h                  01.05.13            01.05.12
- mpi_ioc.h              01.05.14            01.05.13
- mpi_cnfg.h             01.05.15            01.05.14
+ mpi.h                  01.05.16            01.05.15
+ mpi_ioc.h              01.05.16            01.05.15
+ mpi_cnfg.h             01.05.18            01.05.17
  mpi_init.h             01.05.09            01.05.09
  mpi_targ.h             01.05.06            01.05.06
  mpi_fc.h               01.05.01            01.05.01
  mpi_lan.h              01.05.01            01.05.01
- mpi_raid.h             01.05.03            01.05.03
+ mpi_raid.h             01.05.05            01.05.05
  mpi_tool.h             01.05.03            01.05.03
  mpi_inb.h              01.05.01            01.05.01
- mpi_sas.h              01.05.04            01.05.04
+ mpi_sas.h              01.05.05            01.05.05
  mpi_type.h             01.05.02            01.05.02
- mpi_history.txt        01.05.14            01.05.14
+ mpi_history.txt        01.05.19            01.05.18
 
 
  *  Date      Version   Description
@@ -96,6 +96,9 @@ mpi.h
  *  03-27-06  01.05.11  Bumped MPI_HEADER_VERSION_UNIT.
  *  10-11-06  01.05.12  Bumped MPI_HEADER_VERSION_UNIT.
  *  05-24-07  01.05.13  Bumped MPI_HEADER_VERSION_UNIT.
+ *  08-07-07  01.05.14  Bumped MPI_HEADER_VERSION_UNIT.
+ *  01-15-08  01.05.15  Bumped MPI_HEADER_VERSION_UNIT.
+ *  03-28-08  01.05.16  Bumped MPI_HEADER_VERSION_UNIT.
  *  --------------------------------------------------------------------------
 
 mpi_ioc.h
@@ -127,7 +130,7 @@ mpi_ioc.h
  *  08-08-01  01.02.01  Original release for v1.2 work.
  *                      New format for FWVersion and ProductId in
  *                      MSG_IOC_FACTS_REPLY and MPI_FW_HEADER.
- *  08-31-01  01.02.02  Added event MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE and
+ *  08-31-01  01.02.02  Addded event MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE and
  *                      related structure and defines.
  *                      Added event MPI_EVENT_ON_BUS_TIMER_EXPIRED.
  *                      Added MPI_IOCINIT_FLAGS_DISCARD_FW_IMAGE.
@@ -187,7 +190,7 @@ mpi_ioc.h
  *  10-11-06  01.05.12  Added MPI_IOCFACTS_EXCEPT_METADATA_UNSUPPORTED.
  *                      Added MaxInitiators field to PortFacts reply.
  *                      Added SAS Device Status Change ReasonCode for
- *                      asynchronous notification.
+ *                      asynchronous notificaiton.
  *                      Added MPI_EVENT_SAS_EXPANDER_STATUS_CHANGE and event
  *                      data structure.
  *                      Added new ImageType values for FWDownload and FWUpload
@@ -199,6 +202,16 @@ mpi_ioc.h
  *                      added _MULTI_PORT_DOMAIN.
  *  05-24-07  01.05.14  Added Common Boot Block type to FWDownload Request.
  *                      Added Common Boot Block type to FWUpload Request.
+ *  08-07-07  01.05.15  Added MPI_EVENT_SAS_INIT_RC_REMOVED define.
+ *                      Added MPI_EVENT_IR2_RC_DUAL_PORT_ADDED and
+ *                      MPI_EVENT_IR2_RC_DUAL_PORT_REMOVED for IR2 event data.
+ *                      Added SASAddress field to SAS Initiator Device Table
+ *                      Overflow event data structure.
+ *  03-28-08  01.05.16  Added two new ReasonCode values to SAS Device Status
+ *                      Change Event data to indicate completion of internally
+ *                      generated task management.
+ *                      Added MPI_EVENT_DSCVRY_ERR_DS_SATA_INIT_FAILURE define.
+ *                      Added MPI_EVENT_SAS_INIT_RC_INACCESSIBLE define.
  *  --------------------------------------------------------------------------
 
 mpi_cnfg.h
@@ -213,7 +226,7 @@ mpi_cnfg.h
  *                      Added _RESPONSE_ID_MASK definition to SCSI_PORT_1
  *                      page and updated the page version.
  *                      Added Information field and _INFO_PARAMS_NEGOTIATED
- *                      definition to SCSI_DEVICE_0 page.
+ *                      definitionto SCSI_DEVICE_0 page.
  *  06-22-00  01.00.03  Removed batch controls from LAN_0 page and updated the
  *                      page version.
  *                      Added BucketsRemaining to LAN_1 page, redefined the
@@ -496,6 +509,20 @@ mpi_cnfg.h
  *                      Expander Page 0 Flags field.
  *                      Fixed define for
  *                      MPI_SAS_EXPANDER1_DISCINFO_BAD_PHY_DISABLED.
+ *  08-07-07  01.05.16  Added MPI_IOCPAGE6_CAP_FLAGS_MULTIPORT_DRIVE_SUPPORT
+ *                      define.
+ *                      Added BIOS Page 4 structure.
+ *                      Added MPI_RAID_PHYS_DISK1_PATH_MAX define for RAID
+ *                      Physcial Disk Page 1.
+ *  01-15-07  01.05.17  Added additional bit defines for ExtFlags field of
+ *                      Manufacturing Page 4.
+ *                      Added Solid State Drives Supported bit to IOC Page 6
+ *                      Capabilities Flags.
+ *                      Added new value for AccessStatus field of SAS Device
+ *                      Page 0 (_SATA_NEEDS_INITIALIZATION).
+ *  03-28-08  01.05.18  Defined new bits in Manufacturing Page 4 ExtFlags field
+ *                      to control coercion size and the mixing of SAS and SATA
+ *                      SSD drives.
  *  --------------------------------------------------------------------------
 
 mpi_init.h
@@ -661,6 +688,9 @@ mpi_raid.h
  *                      _SET_RESYNC_RATE and _SET_DATA_SCRUB_RATE.
  *  02-28-07  01.05.03  Added new RAID Action, Device FW Update Mode, and
  *                      associated defines.
+ *  08-07-07  01.05.04  Added Disable Full Rebuild bit to the ActionDataWord
+ *                      for the RAID Action MPI_RAID_ACTION_DISABLE_VOLUME.
+ *  01-15-08  01.05.05  Added define for MPI_RAID_ACTION_SET_VOLUME_NAME.
  *  --------------------------------------------------------------------------
 
 mpi_tool.h
@@ -694,6 +724,10 @@ mpi_sas.h
  *                      reply.
  *  10-11-06  01.05.04  Fixed the name of a define for Operation field of SAS IO
  *                      Unit Control request.
+ *  01-15-08  01.05.05  Added support for MPI_SAS_OP_SET_IOC_PARAMETER,
+ *                      including adding IOCParameter and IOCParameter value
+ *                      fields to SAS IO Unit Control Request.
+ *                      Added MPI_SAS_DEVICE_INFO_PRODUCT_SPECIFIC define.
  *  --------------------------------------------------------------------------
 
 mpi_type.h
@@ -709,20 +743,20 @@ mpi_type.h
 
 mpi_history.txt         Parts list history
 
-Filename    01.05.15   01.05.15
-----------  --------   --------
-mpi.h       01.05.12   01.05.13
-mpi_ioc.h   01.05.13   01.05.14
-mpi_cnfg.h  01.05.14   01.05.15
-mpi_init.h  01.05.09   01.05.09
-mpi_targ.h  01.05.06   01.05.06
-mpi_fc.h    01.05.01   01.05.01
-mpi_lan.h   01.05.01   01.05.01
-mpi_raid.h  01.05.03   01.05.03
-mpi_tool.h  01.05.03   01.05.03
-mpi_inb.h   01.05.01   01.05.01
-mpi_sas.h   01.05.04   01.05.04
-mpi_type.h  01.05.02   01.05.02
+Filename    01.05.19   01.05.18   01.05.17   01.05.16   01.05.15
+----------  --------   --------   --------   --------   --------
+mpi.h       01.05.16   01.05.15   01.05.14   01.05.13   01.05.12
+mpi_ioc.h   01.05.16   01.05.15   01.05.15   01.05.14   01.05.13
+mpi_cnfg.h  01.05.18   01.05.17   01.05.16   01.05.15   01.05.14
+mpi_init.h  01.05.09   01.05.09   01.05.09   01.05.09   01.05.09
+mpi_targ.h  01.05.06   01.05.06   01.05.06   01.05.06   01.05.06
+mpi_fc.h    01.05.01   01.05.01   01.05.01   01.05.01   01.05.01
+mpi_lan.h   01.05.01   01.05.01   01.05.01   01.05.01   01.05.01
+mpi_raid.h  01.05.05   01.05.05   01.05.04   01.05.03   01.05.03
+mpi_tool.h  01.05.03   01.05.03   01.05.03   01.05.03   01.05.03
+mpi_inb.h   01.05.01   01.05.01   01.05.01   01.05.01   01.05.01
+mpi_sas.h   01.05.05   01.05.05   01.05.04   01.05.04   01.05.04
+mpi_type.h  01.05.02   01.05.02   01.05.02   01.05.02   01.05.02
 
 Filename    01.05.14   01.05.13   01.05.12   01.05.11   01.05.10   01.05.09
 ----------  --------   --------   --------   --------   --------   --------
diff --git a/drivers/message/fusion/lsi/mpi_init.h b/drivers/message/fusion/lsi/mpi_init.h
index a9e3693601a7..4295d062caa7 100644
--- a/drivers/message/fusion/lsi/mpi_init.h
+++ b/drivers/message/fusion/lsi/mpi_init.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2000-2007 LSI Corporation.
+ *  Copyright (c) 2000-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_init.h
diff --git a/drivers/message/fusion/lsi/mpi_ioc.h b/drivers/message/fusion/lsi/mpi_ioc.h
index 5cbb6bd048e1..8faa4fab7b89 100644
--- a/drivers/message/fusion/lsi/mpi_ioc.h
+++ b/drivers/message/fusion/lsi/mpi_ioc.h
@@ -1,12 +1,12 @@
 /*
- *  Copyright (c) 2000-2007 LSI Corporation.
+ *  Copyright (c) 2000-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_ioc.h
  *          Title:  MPI IOC, Port, Event, FW Download, and FW Upload messages
  *  Creation Date:  August 11, 2000
  *
- *    mpi_ioc.h Version:  01.05.14
+ *    mpi_ioc.h Version:  01.05.16
  *
  *  Version History
  *  ---------------
@@ -113,6 +113,16 @@
  *                      added _MULTI_PORT_DOMAIN.
  *  05-24-07  01.05.14  Added Common Boot Block type to FWDownload Request.
  *                      Added Common Boot Block type to FWUpload Request.
+ *  08-07-07  01.05.15  Added MPI_EVENT_SAS_INIT_RC_REMOVED define.
+ *                      Added MPI_EVENT_IR2_RC_DUAL_PORT_ADDED and
+ *                      MPI_EVENT_IR2_RC_DUAL_PORT_REMOVED for IR2 event data.
+ *                      Added SASAddress field to SAS Initiator Device Table
+ *                      Overflow event data structure.
+ *  03-28-08  01.05.16  Added two new ReasonCode values to SAS Device Status
+ *                      Change Event data to indicate completion of internally
+ *                      generated task management.
+ *                      Added MPI_EVENT_DSCVRY_ERR_DS_SATA_INIT_FAILURE define.
+ *                      Added MPI_EVENT_SAS_INIT_RC_INACCESSIBLE define.
  *  --------------------------------------------------------------------------
  */
 
@@ -612,6 +622,8 @@ typedef struct _EVENT_DATA_SAS_DEVICE_STATUS_CHANGE
 #define MPI_EVENT_SAS_DEV_STAT_RC_CLEAR_TASK_SET_INTERNAL   (0x0B)
 #define MPI_EVENT_SAS_DEV_STAT_RC_QUERY_TASK_INTERNAL       (0x0C)
 #define MPI_EVENT_SAS_DEV_STAT_RC_ASYNC_NOTIFICATION        (0x0D)
+#define MPI_EVENT_SAS_DEV_STAT_RC_CMPL_INTERNAL_DEV_RESET   (0x0E)
+#define MPI_EVENT_SAS_DEV_STAT_RC_CMPL_TASK_ABORT_INTERNAL  (0x0F)
 
 
 /* SCSI Event data for Queue Full event */
@@ -708,6 +720,8 @@ typedef struct _MPI_EVENT_DATA_IR2
 #define MPI_EVENT_IR2_RC_PD_REMOVED                 (0x05)
 #define MPI_EVENT_IR2_RC_FOREIGN_CFG_DETECTED       (0x06)
 #define MPI_EVENT_IR2_RC_REBUILD_MEDIUM_ERROR       (0x07)
+#define MPI_EVENT_IR2_RC_DUAL_PORT_ADDED            (0x08)
+#define MPI_EVENT_IR2_RC_DUAL_PORT_REMOVED          (0x09)
 
 /* defines for logical disk states */
 #define MPI_LD_STATE_OPTIMAL                        (0x00)
@@ -867,6 +881,7 @@ typedef struct _EVENT_DATA_DISCOVERY_ERROR
 #define MPI_EVENT_DSCVRY_ERR_DS_UNSUPPORTED_DEVICE          (0x00000800)
 #define MPI_EVENT_DSCVRY_ERR_DS_MAX_SATA_TARGETS            (0x00001000)
 #define MPI_EVENT_DSCVRY_ERR_DS_MULTI_PORT_DOMAIN           (0x00002000)
+#define MPI_EVENT_DSCVRY_ERR_DS_SATA_INIT_FAILURE           (0x00004000)
 
 /* SAS SMP Error Event data */
 
@@ -902,6 +917,8 @@ typedef struct _EVENT_DATA_SAS_INIT_DEV_STATUS_CHANGE
 
 /* defines for the ReasonCode field of the SAS Initiator Device Status Change event */
 #define MPI_EVENT_SAS_INIT_RC_ADDED                 (0x01)
+#define MPI_EVENT_SAS_INIT_RC_REMOVED               (0x02)
+#define MPI_EVENT_SAS_INIT_RC_INACCESSIBLE          (0x03)
 
 /* SAS Initiator Device Table Overflow Event data */
 
@@ -910,6 +927,7 @@ typedef struct _EVENT_DATA_SAS_INIT_TABLE_OVERFLOW
     U8                      MaxInit;                    /* 00h */
     U8                      CurrentInit;                /* 01h */
     U16                     Reserved1;                  /* 02h */
+    U64                     SASAddress;                 /* 04h */
 } EVENT_DATA_SAS_INIT_TABLE_OVERFLOW,
   MPI_POINTER PTR_EVENT_DATA_SAS_INIT_TABLE_OVERFLOW,
   MpiEventDataSasInitTableOverflow_t,
diff --git a/drivers/message/fusion/lsi/mpi_lan.h b/drivers/message/fusion/lsi/mpi_lan.h
index 03253b53b785..f41fcb69b359 100644
--- a/drivers/message/fusion/lsi/mpi_lan.h
+++ b/drivers/message/fusion/lsi/mpi_lan.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2000-2004 LSI Corporation.
+ *  Copyright (c) 2000-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_lan.h
diff --git a/drivers/message/fusion/lsi/mpi_log_fc.h b/drivers/message/fusion/lsi/mpi_log_fc.h
index e4dafcefeecd..face6e7acc72 100644
--- a/drivers/message/fusion/lsi/mpi_log_fc.h
+++ b/drivers/message/fusion/lsi/mpi_log_fc.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2000-2001 LSI Corporation. All rights reserved.
+ *  Copyright (c) 2000-2008 LSI Corporation. All rights reserved.
  *
  *  NAME:           fc_log.h
  *  SUMMARY:        MPI IocLogInfo definitions for the SYMFC9xx chips
diff --git a/drivers/message/fusion/lsi/mpi_log_sas.h b/drivers/message/fusion/lsi/mpi_log_sas.h
index af9da03e95e5..691620dbedd2 100644
--- a/drivers/message/fusion/lsi/mpi_log_sas.h
+++ b/drivers/message/fusion/lsi/mpi_log_sas.h
@@ -1,6 +1,6 @@
 /***************************************************************************
  *                                                                         *
- *  Copyright 2003 LSI Corporation.  All rights reserved.            *
+ *  Copyright (c) 2000-2008 LSI Corporation.  All rights reserved.         *
  *                                                                         *
  * Description                                                             *
  * ------------                                                            *
@@ -73,6 +73,8 @@
 #define IOP_LOGINFO_CODE_TARGET_MODE_ABORT_EXACT_IO          (0x00070004)
 #define IOP_LOGINFO_CODE_TARGET_MODE_ABORT_EXACT_IO_REQ      (0x00070005)
 
+#define IOP_LOGINFO_CODE_LOG_TIMESTAMP_EVENT                 (0x00080000)
+
 /****************************************************************************/
 /* PL LOGINFO_CODE defines, valid if IOC_LOGINFO_ORIGINATOR = PL            */
 /****************************************************************************/
@@ -92,7 +94,7 @@
 #define PL_LOGINFO_SUB_CODE_OPEN_FAIL_OPEN_TIMEOUT_EXP       (0x0000000C)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAIL_UNUSED_0D              (0x0000000D)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAIL_DVTBLE_ACCSS_FAIL      (0x0000000E)
-#define PL_LOGINFO_SUB CODE_OPEN_FAIL_BAD_DEST               (0x00000011)
+#define PL_LOGINFO_SUB_CODE_OPEN_FAIL_BAD_DEST               (0x00000011)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAIL_RATE_NOT_SUPP          (0x00000012)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAIL_PROT_NOT_SUPP          (0x00000013)
 #define PL_LOGINFO_SUB_CODE_OPEN_FAIL_RESERVED_ABANDON0      (0x00000014)
@@ -159,10 +161,11 @@
 
 #define PL_LOGINFO_SUB_CODE_INVALID_SGL                      (0x00000200)
 #define PL_LOGINFO_SUB_CODE_WRONG_REL_OFF_OR_FRAME_LENGTH    (0x00000300)
-#define PL_LOGINFO_SUB_CODE_FRAME_XFER_ERROR                 (0x00000400) /* Bits 0-3 encode Transport Status Register (offset 0x08) */
-                                                                          /* Bit 0 is Status Bit 0: FrameXferErr */
-                                                                          /* Bit 1 & 2 are Status Bits 16 and 17: FrameXmitErrStatus */
-                                                                          /* Bit 3 is Status Bit 18 WriteDataLengthGTDataLengthErr */
+#define PL_LOGINFO_SUB_CODE_FRAME_XFER_ERROR                 (0x00000400)
+/* Bits 0-3 encode Transport Status Register (offset 0x08) */
+/* Bit 0 is Status Bit 0: FrameXferErr */
+/* Bit 1 & 2 are Status Bits 16 and 17: FrameXmitErrStatus */
+/* Bit 3 is Status Bit 18 WriteDataLenghtGTDataLengthErr */
 
 #define PL_LOGINFO_SUB_CODE_TX_FM_CONNECTED_LOW              (0x00000500)
 #define PL_LOGINFO_SUB_CODE_SATA_NON_NCQ_RW_ERR_BIT_SET      (0x00000600)
@@ -177,6 +180,11 @@
 #define PL_LOGINFO_SUB_CODE_DISCOVERY_REMOTE_SEP_RESET       (0x00000E01)
 #define PL_LOGINFO_SUB_CODE_SECOND_OPEN                      (0x00000F00)
 #define PL_LOGINFO_SUB_CODE_DSCVRY_SATA_INIT_TIMEOUT         (0x00001000)
+#define PL_LOGINFO_SUB_CODE_BREAK_ON_SATA_CONNECTION         (0x00002000)
+/* not currently used in mainline */
+#define PL_LOGINFO_SUB_CODE_BREAK_ON_STUCK_LINK              (0x00003000)
+#define PL_LOGINFO_SUB_CODE_BREAK_ON_STUCK_LINK_AIP          (0x00004000)
+#define PL_LOGINFO_SUB_CODE_BREAK_ON_INCOMPLETE_BREAK_RCVD   (0x00005000)
 
 #define PL_LOGINFO_CODE_ENCL_MGMT_SMP_FRAME_FAILURE          (0x00200000) /* Can't get SMP Frame */
 #define PL_LOGINFO_CODE_ENCL_MGMT_SMP_READ_ERROR             (0x00200010) /* Error occured on SMP Read */
@@ -243,6 +251,8 @@
 #define IR_LOGINFO_VOLUME_ACTIVATE_VOLUME_FAILED               (0x00010014)
 /* Activation failed trying to import the volume */
 #define IR_LOGINFO_VOLUME_ACTIVATING_IMPORT_VOLUME_FAILED      (0x00010015)
+/* Activation failed trying to import the volume */
+#define IR_LOGINFO_VOLUME_ACTIVATING_TOO_MANY_PHYS_DISKS       (0x00010016)
 
 /* Phys Disk failed, too many phys disks */
 #define IR_LOGINFO_PHYSDISK_CREATE_TOO_MANY_DISKS              (0x00010020)
@@ -285,6 +295,21 @@
 /* Compatibility Error : IME size limited to < 2TB */
 #define IR_LOGINFO_COMPAT_ERROR_IME_VOL_NOT_CURRENTLY_SUPPORTED (0x0001003D)
 
+/* Device Firmware Update: DFU can only be started once */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_DFU_IN_PROGRESS            (0x00010050)
+/* Device Firmware Update: Volume must be Optimal/Active/non-Quiesced */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_DEVICE_IN_INVALID_STATE    (0x00010051)
+/* Device Firmware Update: DFU Timeout cannot be zero */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_INVALID_TIMEOUT            (0x00010052)
+/* Device Firmware Update: CREATE TIMER FAILED */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_NO_TIMERS                  (0x00010053)
+/* Device Firmware Update: Failed to read SAS_IO_UNIT_PG_1 */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_READING_CFG_PAGE           (0x00010054)
+/* Device Firmware Update: Invalid SAS_IO_UNIT_PG_1 value(s) */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_PORT_IO_TIMEOUTS_REQUIRED  (0x00010055)
+/* Device Firmware Update: Unable to allocate memory for page */
+#define IR_LOGINFO_DEV_FW_UPDATE_ERR_ALLOC_CFG_PAGE             (0x00010056)
+
 
 /****************************************************************************/
 /* Defines for convenience                                                  */
diff --git a/drivers/message/fusion/lsi/mpi_raid.h b/drivers/message/fusion/lsi/mpi_raid.h
index 2856108421d7..add60cc85be1 100644
--- a/drivers/message/fusion/lsi/mpi_raid.h
+++ b/drivers/message/fusion/lsi/mpi_raid.h
@@ -1,12 +1,12 @@
 /*
- *  Copyright (c) 2001-2007 LSI Corporation.
+ *  Copyright (c) 2001-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_raid.h
  *          Title:  MPI RAID message and structures
  *  Creation Date:  February 27, 2001
  *
- *    mpi_raid.h Version:  01.05.03
+ *    mpi_raid.h Version:  01.05.05
  *
  *  Version History
  *  ---------------
@@ -34,6 +34,9 @@
  *                      _SET_RESYNC_RATE and _SET_DATA_SCRUB_RATE.
  *  02-28-07  01.05.03  Added new RAID Action, Device FW Update Mode, and
  *                      associated defines.
+ *  08-07-07  01.05.04  Added Disable Full Rebuild bit to the ActionDataWord
+ *                      for the RAID Action MPI_RAID_ACTION_DISABLE_VOLUME.
+ *  01-15-08  01.05.05  Added define for MPI_RAID_ACTION_SET_VOLUME_NAME.
  *  --------------------------------------------------------------------------
  */
 
@@ -93,6 +96,7 @@ typedef struct _MSG_RAID_ACTION
 #define MPI_RAID_ACTION_SET_RESYNC_RATE             (0x13)
 #define MPI_RAID_ACTION_SET_DATA_SCRUB_RATE         (0x14)
 #define MPI_RAID_ACTION_DEVICE_FW_UPDATE_MODE       (0x15)
+#define MPI_RAID_ACTION_SET_VOLUME_NAME             (0x16)
 
 /* ActionDataWord defines for use with MPI_RAID_ACTION_CREATE_VOLUME action */
 #define MPI_RAID_ACTION_ADATA_DO_NOT_SYNC           (0x00000001)
@@ -105,6 +109,9 @@ typedef struct _MSG_RAID_ACTION
 #define MPI_RAID_ACTION_ADATA_KEEP_LBA0             (0x00000000)
 #define MPI_RAID_ACTION_ADATA_ZERO_LBA0             (0x00000002)
 
+/* ActionDataWord defines for use with MPI_RAID_ACTION_DISABLE_VOLUME action */
+#define MPI_RAID_ACTION_ADATA_DISABLE_FULL_REBUILD  (0x00000001)
+
 /* ActionDataWord defines for use with MPI_RAID_ACTION_ACTIVATE_VOLUME action */
 #define MPI_RAID_ACTION_ADATA_INACTIVATE_ALL        (0x00000001)
 
diff --git a/drivers/message/fusion/lsi/mpi_sas.h b/drivers/message/fusion/lsi/mpi_sas.h
index 33fca83cefc2..ab410036bbfc 100644
--- a/drivers/message/fusion/lsi/mpi_sas.h
+++ b/drivers/message/fusion/lsi/mpi_sas.h
@@ -1,12 +1,12 @@
 /*
- *  Copyright (c) 2004-2006 LSI Corporation.
+ *  Copyright (c) 2004-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_sas.h
  *          Title:  MPI Serial Attached SCSI structures and definitions
  *  Creation Date:  August 19, 2004
  *
- *    mpi_sas.h Version:  01.05.04
+ *    mpi_sas.h Version:  01.05.05
  *
  *  Version History
  *  ---------------
@@ -23,6 +23,10 @@
  *                      reply.
  *  10-11-06  01.05.04  Fixed the name of a define for Operation field of SAS IO
  *                      Unit Control request.
+ *  01-15-08  01.05.05  Added support for MPI_SAS_OP_SET_IOC_PARAMETER,
+ *                      including adding IOCParameter and IOCParameter value
+ *                      fields to SAS IO Unit Control Request.
+ *                      Added MPI_SAS_DEVICE_INFO_PRODUCT_SPECIFIC define.
  *  --------------------------------------------------------------------------
  */
 
@@ -60,6 +64,8 @@
  * Values for the SAS DeviceInfo field used in SAS Device Status Change Event
  * data and SAS IO Unit Configuration pages.
  */
+#define MPI_SAS_DEVICE_INFO_PRODUCT_SPECIFIC    (0xF0000000)
+
 #define MPI_SAS_DEVICE_INFO_SEP                 (0x00004000)
 #define MPI_SAS_DEVICE_INFO_ATAPI_DEVICE        (0x00002000)
 #define MPI_SAS_DEVICE_INFO_LSI_DEVICE          (0x00001000)
@@ -216,7 +222,7 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REQUEST
     U8                      ChainOffset;        /* 02h */
     U8                      Function;           /* 03h */
     U16                     DevHandle;          /* 04h */
-    U8                      Reserved3;          /* 06h */
+    U8                      IOCParameter;       /* 06h */
     U8                      MsgFlags;           /* 07h */
     U32                     MsgContext;         /* 08h */
     U8                      TargetID;           /* 0Ch */
@@ -225,7 +231,7 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REQUEST
     U8                      PrimFlags;          /* 0Fh */
     U32                     Primitive;          /* 10h */
     U64                     SASAddress;         /* 14h */
-    U32                     Reserved4;          /* 1Ch */
+    U32                     IOCParameterValue;  /* 1Ch */
 } MSG_SAS_IOUNIT_CONTROL_REQUEST, MPI_POINTER PTR_MSG_SAS_IOUNIT_CONTROL_REQUEST,
   SasIoUnitControlRequest_t, MPI_POINTER pSasIoUnitControlRequest_t;
 
@@ -241,6 +247,8 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REQUEST
 #define MPI_SAS_OP_TRANSMIT_PORT_SELECT_SIGNAL  (0x0C)
 #define MPI_SAS_OP_TRANSMIT_REMOVE_DEVICE       (0x0D)  /* obsolete name */
 #define MPI_SAS_OP_REMOVE_DEVICE                (0x0D)
+#define MPI_SAS_OP_SET_IOC_PARAMETER            (0x0E)
+#define MPI_SAS_OP_PRODUCT_SPECIFIC_MIN         (0x80)
 
 /* values for the PrimFlags field */
 #define MPI_SAS_PRIMFLAGS_SINGLE                (0x08)
@@ -256,7 +264,7 @@ typedef struct _MSG_SAS_IOUNIT_CONTROL_REPLY
     U8                      MsgLength;          /* 02h */
     U8                      Function;           /* 03h */
     U16                     DevHandle;          /* 04h */
-    U8                      Reserved3;          /* 06h */
+    U8                      IOCParameter;       /* 06h */
     U8                      MsgFlags;           /* 07h */
     U32                     MsgContext;         /* 08h */
     U16                     Reserved4;          /* 0Ch */
diff --git a/drivers/message/fusion/lsi/mpi_targ.h b/drivers/message/fusion/lsi/mpi_targ.h
index ff8c37d3fdcb..c3dea7f6909d 100644
--- a/drivers/message/fusion/lsi/mpi_targ.h
+++ b/drivers/message/fusion/lsi/mpi_targ.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2000-2004 LSI Corporation.
+ *  Copyright (c) 2000-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_targ.h
diff --git a/drivers/message/fusion/lsi/mpi_tool.h b/drivers/message/fusion/lsi/mpi_tool.h
index 8834ae6ce0f2..53cd715aa7e4 100644
--- a/drivers/message/fusion/lsi/mpi_tool.h
+++ b/drivers/message/fusion/lsi/mpi_tool.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (c) 2001-2005 LSI Corporation.
+ *  Copyright (c) 2001-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_tool.h
diff --git a/drivers/message/fusion/lsi/mpi_type.h b/drivers/message/fusion/lsi/mpi_type.h
index 08dad9c1e446..888b26dbc413 100644
--- a/drivers/message/fusion/lsi/mpi_type.h
+++ b/drivers/message/fusion/lsi/mpi_type.h
@@ -1,12 +1,12 @@
 /*
- *  Copyright (c) 2000-2004 LSI Corporation.
+ *  Copyright (c) 2000-2008 LSI Corporation.
  *
  *
  *           Name:  mpi_type.h
  *          Title:  MPI Basic type definitions
  *  Creation Date:  June 6, 2000
  *
- *    mpi_type.h Version:  01.05.01
+ *    mpi_type.h Version:  01.05.02
  *
  *  Version History
  *  ---------------
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index c4e8b9aa3827..96ac88317b8e 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -79,9 +79,22 @@ MODULE_VERSION(my_VERSION);
 /*
  *  cmd line parameters
  */
-static int mpt_msi_enable = -1;
-module_param(mpt_msi_enable, int, 0);
-MODULE_PARM_DESC(mpt_msi_enable, " MSI Support Enable (default=0)");
+
+static int mpt_msi_enable_spi;
+module_param(mpt_msi_enable_spi, int, 0);
+MODULE_PARM_DESC(mpt_msi_enable_spi, " Enable MSI Support for SPI \
+                controllers (default=0)");
+
+static int mpt_msi_enable_fc;
+module_param(mpt_msi_enable_fc, int, 0);
+MODULE_PARM_DESC(mpt_msi_enable_fc, " Enable MSI Support for FC \
+                controllers (default=0)");
+
+static int mpt_msi_enable_sas;
+module_param(mpt_msi_enable_sas, int, 1);
+MODULE_PARM_DESC(mpt_msi_enable_sas, " Enable MSI Support for SAS \
+                controllers (default=1)");
+
 
 static int mpt_channel_mapping;
 module_param(mpt_channel_mapping, int, 0);
@@ -91,7 +104,17 @@ static int mpt_debug_level;
 static int mpt_set_debug_level(const char *val, struct kernel_param *kp);
 module_param_call(mpt_debug_level, mpt_set_debug_level, param_get_int,
                   &mpt_debug_level, 0600);
-MODULE_PARM_DESC(mpt_debug_level, " debug level - refer to mptdebug.h - (default=0)");
+MODULE_PARM_DESC(mpt_debug_level, " debug level - refer to mptdebug.h \
+        - (default=0)");
+
+int mpt_fwfault_debug;
+EXPORT_SYMBOL(mpt_fwfault_debug);
+module_param_call(mpt_fwfault_debug, param_set_int, param_get_int,
+          &mpt_fwfault_debug, 0600);
+MODULE_PARM_DESC(mpt_fwfault_debug, "Enable detection of Firmware fault"
+        " and halt Firmware on fault - (default=0)");
+
+
 
 #ifdef MFCNT
 static int mfcounter = 0;
@@ -1751,16 +1774,25 @@ mpt_attach(struct pci_dev *pdev, const struct pci_device_id *id)
                 ioc->bus_type = SAS;
         }
 
-        if (mpt_msi_enable == -1) {
-                /* Enable on SAS, disable on FC and SPI */
-                if (ioc->bus_type == SAS)
-                        ioc->msi_enable = 1;
-                else
-                        ioc->msi_enable = 0;
-        } else
-                /* follow flag: 0 - disable; 1 - enable */
-                ioc->msi_enable = mpt_msi_enable;
 
+        switch (ioc->bus_type) {
+
+        case SAS:
+                ioc->msi_enable = mpt_msi_enable_sas;
+                break;
+
+        case SPI:
+                ioc->msi_enable = mpt_msi_enable_spi;
+                break;
+
+        case FC:
+                ioc->msi_enable = mpt_msi_enable_fc;
+                break;
+
+        default:
+                ioc->msi_enable = 0;
+                break;
+        }
         if (ioc->errata_flag_1064)
                 pci_disable_io_access(pdev);
 
@@ -6313,6 +6345,33 @@ mpt_print_ioc_summary(MPT_ADAPTER *ioc, char *buffer, int *size, int len, int sh
         *size = y;
 }
 
+
+/**
+ *      mpt_halt_firmware - Halts the firmware if it is operational and panic
+ *      the kernel
+ *      @ioc: Pointer to MPT_ADAPTER structure
+ *
+ **/
+void
+mpt_halt_firmware(MPT_ADAPTER *ioc)
+{
+        u32      ioc_raw_state;
+
+        ioc_raw_state = mpt_GetIocState(ioc, 0);
+
+        if ((ioc_raw_state & MPI_IOC_STATE_MASK) == MPI_IOC_STATE_FAULT) {
+                printk(MYIOC_s_ERR_FMT "IOC is in FAULT state (%04xh)!!!\n",
+                        ioc->name, ioc_raw_state & MPI_DOORBELL_DATA_MASK);
+                panic("%s: IOC Fault (%04xh)!!!\n", ioc->name,
+                        ioc_raw_state & MPI_DOORBELL_DATA_MASK);
+        } else {
+                CHIPREG_WRITE32(&ioc->chip->Doorbell, 0xC0FFEE00);
+                panic("%s: Firmware is halted due to command timeout\n",
+                        ioc->name);
+        }
+}
+EXPORT_SYMBOL(mpt_halt_firmware);
+
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *      Reset Handling
@@ -6345,6 +6404,8 @@ mpt_HardResetHandler(MPT_ADAPTER *ioc, int sleepFlag)
         printk(MYIOC_s_INFO_FMT "HardResetHandler Entered!\n", ioc->name);
         printk("MF count 0x%x !\n", ioc->mfcnt);
 #endif
+        if (mpt_fwfault_debug)
+                mpt_halt_firmware(ioc);
 
         /* Reset the adapter. Prevent more than 1 call to
          * mpt_do_ioc_recovery at any instant in time.
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index dff048cfa101..b3e981d2a506 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -922,11 +922,14 @@ extern void	 mpt_free_fw_memory(MPT_ADAPTER *ioc);
 extern int       mpt_findImVolumes(MPT_ADAPTER *ioc);
 extern int       mptbase_sas_persist_operation(MPT_ADAPTER *ioc, u8 persist_opcode);
 extern int       mpt_raid_phys_disk_pg0(MPT_ADAPTER *ioc, u8 phys_disk_num, pRaidPhysDiskPage0_t phys_disk);
+extern void     mpt_halt_firmware(MPT_ADAPTER *ioc);
+
 
 /*
  *  Public data decl's...
  */
 extern struct list_head   ioc_list;
+extern int mpt_fwfault_debug;
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 #endif          /* } __KERNEL__ */
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index ee090413e598..e62c6bc4ad33 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -1846,6 +1846,9 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
         if (hd->timeouts < -1)
                 hd->timeouts++;
 
+        if (mpt_fwfault_debug)
+                mpt_halt_firmware(ioc);
+
         /* Most important!  Set TaskMsgContext to SCpnt's MsgContext!
          * (the IO to be ABORT'd)
          *
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 73b7fb8de47a..82fb9958f22f 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -899,7 +899,7 @@ xpc_update_partition_info_sn2(struct xpc_partition *part, u8 remote_rp_version,
         dev_dbg(xpc_part, "  remote_vars_pa = 0x%016lx\n",
                 part_sn2->remote_vars_pa);
 
-        part->last_heartbeat = remote_vars->heartbeat;
+        part->last_heartbeat = remote_vars->heartbeat - 1;
         dev_dbg(xpc_part, "  last_heartbeat = 0x%016lx\n",
                 part->last_heartbeat);
 
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index 745ac188babe..d15d8b79d8e5 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -646,7 +646,7 @@ static const struct net_device_ops etherh_netdev_ops = {
         .ndo_get_stats          = ei_get_stats,
         .ndo_set_multicast_list = ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_addr       = eth_set_mac_addr,
+        .ndo_set_mac_address    = eth_set_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ei_poll,
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 337488ec707c..a4eb6c40678c 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -37,7 +37,10 @@ static int phy_debug = 0;
 #define __ei_open       ax_ei_open
 #define __ei_close      ax_ei_close
 #define __ei_poll       ax_ei_poll
+#define __ei_start_xmit ax_ei_start_xmit
 #define __ei_tx_timeout ax_ei_tx_timeout
+#define __ei_get_stats  ax_ei_get_stats
+#define __ei_set_multicast_list ax_ei_set_multicast_list
 #define __ei_interrupt  ax_ei_interrupt
 #define ____alloc_ei_netdev ax__alloc_ei_netdev
 #define __NS8390_init   ax_NS8390_init
@@ -623,6 +626,23 @@ static void ax_eeprom_register_write(struct eeprom_93cx6 *eeprom)
 }
 #endif
 
+static const struct net_device_ops ax_netdev_ops = {
+        .ndo_open               = ax_open,
+        .ndo_stop               = ax_close,
+        .ndo_do_ioctl           = ax_ioctl,
+
+        .ndo_start_xmit         = ax_ei_start_xmit,
+        .ndo_tx_timeout         = ax_ei_tx_timeout,
+        .ndo_get_stats          = ax_ei_get_stats,
+        .ndo_set_multicast_list = ax_ei_set_multicast_list,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_change_mtu         = eth_change_mtu,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = ax_ei_poll,
+#endif
+};
+
 /* setup code */
 
 static void ax_initial_setup(struct net_device *dev, struct ei_device *ei_local)
@@ -738,9 +758,7 @@ static int ax_init_dev(struct net_device *dev, int first_init)
         ei_status.get_8390_hdr  = &ax_get_8390_hdr;
         ei_status.priv = 0;
 
-        dev->open               = ax_open;
-        dev->stop               = ax_close;
-        dev->do_ioctl           = ax_ioctl;
+        dev->netdev_ops         = &ax_netdev_ops;
         dev->ethtool_ops        = &ax_ethtool_ops;
 
         ax->msg_enable          = NETIF_MSG_LINK;
@@ -753,9 +771,6 @@ static int ax_init_dev(struct net_device *dev, int first_init)
         ax->mii.mdio_write      = ax_phy_write;
         ax->mii.dev             = dev;
 
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = ax_ei_poll;
-#endif
         ax_NS8390_init(dev, 0);
 
         if (first_init)
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 5ae131c147f9..c38512ebcea6 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -679,6 +679,7 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                         dev_kfree_skb_any(skb);
                         return -ENOMEM;
                 }
+                bp->force_copybreak = 1;
         }
 
         rh = (struct rx_header *) skb->data;
@@ -800,7 +801,7 @@ static int b44_rx(struct b44 *bp, int budget)
                 /* Omit CRC. */
                 len -= 4;
 
-                if (len > RX_COPY_THRESHOLD) {
+                if (!bp->force_copybreak && len > RX_COPY_THRESHOLD) {
                         int skb_size;
                         skb_size = b44_alloc_rx_skb(bp, cons, bp->rx_prod);
                         if (skb_size < 0)
@@ -2152,6 +2153,7 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
         bp = netdev_priv(dev);
         bp->sdev = sdev;
         bp->dev = dev;
+        bp->force_copybreak = 0;
 
         bp->msg_enable = netif_msg_init(b44_debug, B44_DEF_MSG_ENABLE);
 
diff --git a/drivers/net/b44.h b/drivers/net/b44.h
index 7db0c84a7950..e678498de6db 100644
--- a/drivers/net/b44.h
+++ b/drivers/net/b44.h
@@ -395,7 +395,7 @@ struct b44 {
         u32                     rx_pending;
         u32                     tx_pending;
         u8                      phy_addr;
-
+        u8                      force_copybreak;
         struct mii_if_info      mii_if;
 };
 
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index fd705d1295a7..6fcccef4cf3d 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -20,6 +20,11 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
+#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+#define BCM_VLAN                        1
+#endif
+
+
 /* error/debug prints */
 
 #define DRV_MODULE_NAME         "bnx2x"
@@ -78,11 +83,6 @@
 #endif
 
 
-#ifdef NETIF_F_HW_VLAN_TX
-#define BCM_VLAN                        1
-#endif
-
-
 #define U64_LO(x)                       (u32)(((u64)(x)) & 0xffffffff)
 #define U64_HI(x)                       (u32)(((u64)(x)) >> 32)
 #define HILO_U64(hi, lo)                ((((u64)(hi)) << 32) + (lo))
@@ -150,6 +150,9 @@ struct sw_rx_page {
 
 #define PAGES_PER_SGE_SHIFT             0
 #define PAGES_PER_SGE                   (1 << PAGES_PER_SGE_SHIFT)
+#define SGE_PAGE_SIZE                   PAGE_SIZE
+#define SGE_PAGE_SHIFT                  PAGE_SHIFT
+#define SGE_PAGE_ALIGN(addr)            PAGE_ALIGN(addr)
 
 #define BCM_RX_ETH_PAYLOAD_ALIGN        64
 
@@ -736,7 +739,7 @@ struct bnx2x {
         struct bnx2x_fastpath   fp[MAX_CONTEXT];
         void __iomem            *regview;
         void __iomem            *doorbells;
-#define BNX2X_DB_SIZE           (16*2048)
+#define BNX2X_DB_SIZE           (16*BCM_PAGE_SIZE)
 
         struct net_device       *dev;
         struct pci_dev          *pdev;
@@ -801,6 +804,8 @@ struct bnx2x {
 #define TPA_ENABLE_FLAG                 0x80
 #define NO_MCP_FLAG                     0x100
 #define BP_NOMCP(bp)                    (bp->flags & NO_MCP_FLAG)
+#define HW_VLAN_TX_FLAG                 0x400
+#define HW_VLAN_RX_FLAG                 0x800
 
         int                     func;
 #define BP_PORT(bp)                     (bp->func % PORT_MAX)
@@ -811,7 +816,7 @@ struct bnx2x {
         int                     pm_cap;
         int                     pcie_cap;
 
-        struct work_struct      sp_task;
+        struct delayed_work     sp_task;
         struct work_struct      reset_task;
 
         struct timer_list       timer;
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 4be05847f86f..7c533797c064 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -38,9 +38,7 @@
 #include <linux/time.h>
 #include <linux/ethtool.h>
 #include <linux/mii.h>
-#ifdef NETIF_F_HW_VLAN_TX
-        #include <linux/if_vlan.h>
-#endif
+#include <linux/if_vlan.h>
 #include <net/ip.h>
 #include <net/tcp.h>
 #include <net/checksum.h>
@@ -95,6 +93,7 @@ MODULE_PARM_DESC(debug, "default debug msglevel");
 module_param(use_multi, int, 0);
 MODULE_PARM_DESC(use_multi, "use per-CPU queues");
 #endif
+static struct workqueue_struct *bnx2x_wq;
 
 enum bnx2x_board_type {
         BCM57710 = 0,
@@ -671,7 +670,8 @@ static void bnx2x_int_disable_sync(struct bnx2x *bp, int disable_hw)
                 synchronize_irq(bp->pdev->irq);
 
         /* make sure sp_task is not running */
-        cancel_work_sync(&bp->sp_task);
+        cancel_delayed_work(&bp->sp_task);
+        flush_workqueue(bnx2x_wq);
 }
 
 /* fast path */
@@ -972,7 +972,7 @@ static inline void bnx2x_free_rx_sge(struct bnx2x *bp,
                 return;
 
         pci_unmap_page(bp->pdev, pci_unmap_addr(sw_buf, mapping),
-                       BCM_PAGE_SIZE*PAGES_PER_SGE, PCI_DMA_FROMDEVICE);
+                       SGE_PAGE_SIZE*PAGES_PER_SGE, PCI_DMA_FROMDEVICE);
         __free_pages(page, PAGES_PER_SGE_SHIFT);
 
         sw_buf->page = NULL;
@@ -1000,7 +1000,7 @@ static inline int bnx2x_alloc_rx_sge(struct bnx2x *bp,
         if (unlikely(page == NULL))
                 return -ENOMEM;
 
-        mapping = pci_map_page(bp->pdev, page, 0, BCM_PAGE_SIZE*PAGES_PER_SGE,
+        mapping = pci_map_page(bp->pdev, page, 0, SGE_PAGE_SIZE*PAGES_PER_SGE,
                                PCI_DMA_FROMDEVICE);
         if (unlikely(dma_mapping_error(&bp->pdev->dev, mapping))) {
                 __free_pages(page, PAGES_PER_SGE_SHIFT);
@@ -1096,9 +1096,9 @@ static void bnx2x_update_sge_prod(struct bnx2x_fastpath *fp,
                                   struct eth_fast_path_rx_cqe *fp_cqe)
 {
         struct bnx2x *bp = fp->bp;
-        u16 sge_len = BCM_PAGE_ALIGN(le16_to_cpu(fp_cqe->pkt_len) -
+        u16 sge_len = SGE_PAGE_ALIGN(le16_to_cpu(fp_cqe->pkt_len) -
                                      le16_to_cpu(fp_cqe->len_on_bd)) >>
-                      BCM_PAGE_SHIFT;
+                      SGE_PAGE_SHIFT;
         u16 last_max, last_elem, first_elem;
         u16 delta = 0;
         u16 i;
@@ -1203,22 +1203,22 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                                u16 cqe_idx)
 {
         struct sw_rx_page *rx_pg, old_rx_pg;
-        struct page *sge;
         u16 len_on_bd = le16_to_cpu(fp_cqe->len_on_bd);
         u32 i, frag_len, frag_size, pages;
         int err;
         int j;
 
         frag_size = le16_to_cpu(fp_cqe->pkt_len) - len_on_bd;
-        pages = BCM_PAGE_ALIGN(frag_size) >> BCM_PAGE_SHIFT;
+        pages = SGE_PAGE_ALIGN(frag_size) >> SGE_PAGE_SHIFT;
 
         /* This is needed in order to enable forwarding support */
         if (frag_size)
-                skb_shinfo(skb)->gso_size = min((u32)BCM_PAGE_SIZE,
+                skb_shinfo(skb)->gso_size = min((u32)SGE_PAGE_SIZE,
                                                max(frag_size, (u32)len_on_bd));
 
 #ifdef BNX2X_STOP_ON_ERROR
-        if (pages > 8*PAGES_PER_SGE) {
+        if (pages >
+            min((u32)8, (u32)MAX_SKB_FRAGS) * SGE_PAGE_SIZE * PAGES_PER_SGE) {
                 BNX2X_ERR("SGL length is too long: %d. CQE index is %d\n",
                           pages, cqe_idx);
                 BNX2X_ERR("fp_cqe->pkt_len = %d  fp_cqe->len_on_bd = %d\n",
@@ -1234,9 +1234,8 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
 
                 /* FW gives the indices of the SGE as if the ring is an array
                    (meaning that "next" element will consume 2 indices) */
-                frag_len = min(frag_size, (u32)(BCM_PAGE_SIZE*PAGES_PER_SGE));
+                frag_len = min(frag_size, (u32)(SGE_PAGE_SIZE*PAGES_PER_SGE));
                 rx_pg = &fp->rx_page_ring[sge_idx];
-                sge = rx_pg->page;
                 old_rx_pg = *rx_pg;
 
                 /* If we fail to allocate a substitute page, we simply stop
@@ -1249,7 +1248,7 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
 
                 /* Unmap the page as we r going to pass it to the stack */
                 pci_unmap_page(bp->pdev, pci_unmap_addr(&old_rx_pg, mapping),
-                              BCM_PAGE_SIZE*PAGES_PER_SGE, PCI_DMA_FROMDEVICE);
+                              SGE_PAGE_SIZE*PAGES_PER_SGE, PCI_DMA_FROMDEVICE);
 
                 /* Add one frag and update the appropriate fields in the skb */
                 skb_fill_page_desc(skb, j, old_rx_pg.page, 0, frag_len);
@@ -1282,6 +1281,13 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
         if (likely(new_skb)) {
                 /* fix ip xsum and give it to the stack */
                 /* (no need to map the new skb) */
+#ifdef BCM_VLAN
+                int is_vlan_cqe =
+                        (le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags) &
+                         PARSING_FLAGS_VLAN);
+                int is_not_hwaccel_vlan_cqe =
+                        (is_vlan_cqe && (!(bp->flags & HW_VLAN_RX_FLAG)));
+#endif
 
                 prefetch(skb);
                 prefetch(((char *)(skb)) + 128);
@@ -1306,6 +1312,12 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                         struct iphdr *iph;
 
                         iph = (struct iphdr *)skb->data;
+#ifdef BCM_VLAN
+                        /* If there is no Rx VLAN offloading -
+                           take VLAN tag into an account */
+                        if (unlikely(is_not_hwaccel_vlan_cqe))
+                                iph = (struct iphdr *)((u8 *)iph + VLAN_HLEN);
+#endif
                         iph->check = 0;
                         iph->check = ip_fast_csum((u8 *)iph, iph->ihl);
                 }
@@ -1313,9 +1325,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                 if (!bnx2x_fill_frag_skb(bp, fp, skb,
                                          &cqe->fast_path_cqe, cqe_idx)) {
 #ifdef BCM_VLAN
-                        if ((bp->vlgrp != NULL) &&
-                            (le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags) &
-                             PARSING_FLAGS_VLAN))
+                        if ((bp->vlgrp != NULL) && is_vlan_cqe &&
+                            (!is_not_hwaccel_vlan_cqe))
                                 vlan_hwaccel_receive_skb(skb, bp->vlgrp,
                                                 le16_to_cpu(cqe->fast_path_cqe.
                                                             vlan_tag));
@@ -1355,11 +1366,23 @@ static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
         rx_prods.cqe_prod = rx_comp_prod;
         rx_prods.sge_prod = rx_sge_prod;
 
+        /*
+         * Make sure that the BD and SGE data is updated before updating the
+         * producers since FW might read the BD/SGE right after the producer
+         * is updated.
+         * This is only applicable for weak-ordered memory model archs such
+         * as IA-64. The following barrier is also mandatory since FW will
+         * assumes BDs must have buffers.
+         */
+        wmb();
+
         for (i = 0; i < sizeof(struct tstorm_eth_rx_producers)/4; i++)
                 REG_WR(bp, BAR_TSTRORM_INTMEM +
                        TSTORM_RX_PRODS_OFFSET(BP_PORT(bp), FP_CL_ID(fp)) + i*4,
                        ((u32 *)&rx_prods)[i]);
 
+        mmiowb(); /* keep prod updates ordered */
+
         DP(NETIF_MSG_RX_STATUS,
            "Wrote: bd_prod %u  cqe_prod %u  sge_prod %u\n",
            bd_prod, rx_comp_prod, rx_sge_prod);
@@ -1415,7 +1438,7 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                 DP(NETIF_MSG_RX_STATUS, "CQE type %x  err %x  status %x"
                    "  queue %x  vlan %x  len %u\n", CQE_TYPE(cqe_fp_flags),
                    cqe_fp_flags, cqe->fast_path_cqe.status_flags,
-                   cqe->fast_path_cqe.rss_hash_result,
+                   le32_to_cpu(cqe->fast_path_cqe.rss_hash_result),
                    le16_to_cpu(cqe->fast_path_cqe.vlan_tag),
                    le16_to_cpu(cqe->fast_path_cqe.pkt_len));
 
@@ -1547,7 +1570,7 @@ reuse_rx:
                 }
 
 #ifdef BCM_VLAN
-                if ((bp->vlgrp != NULL) &&
+                if ((bp->vlgrp != NULL) && (bp->flags & HW_VLAN_RX_FLAG) &&
                     (le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags) &
                      PARSING_FLAGS_VLAN))
                         vlan_hwaccel_receive_skb(skb, bp->vlgrp,
@@ -1580,7 +1603,6 @@ next_cqe:
         /* Update producers */
         bnx2x_update_rx_prod(bp, fp, bd_prod_fw, sw_comp_prod,
                              fp->rx_sge_prod);
-        mmiowb(); /* keep prod updates ordered */
 
         fp->rx_pkt += rx_pkt;
         fp->rx_calls++;
@@ -1660,7 +1682,7 @@ static irqreturn_t bnx2x_interrupt(int irq, void *dev_instance)
 
 
         if (unlikely(status & 0x1)) {
-                schedule_work(&bp->sp_task);
+                queue_delayed_work(bnx2x_wq, &bp->sp_task, 0);
 
                 status &= ~0x1;
                 if (!status)
@@ -1887,7 +1909,8 @@ static int bnx2x_set_spio(struct bnx2x *bp, int spio_num, u32 mode)
 
 static void bnx2x_calc_fc_adv(struct bnx2x *bp)
 {
-        switch (bp->link_vars.ieee_fc) {
+        switch (bp->link_vars.ieee_fc &
+                MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_MASK) {
         case MDIO_COMBO_IEEE0_AUTO_NEG_ADV_PAUSE_NONE:
                 bp->port.advertising &= ~(ADVERTISED_Asym_Pause |
                                           ADVERTISED_Pause);
@@ -1957,10 +1980,11 @@ static u8 bnx2x_initial_phy_init(struct bnx2x *bp)
                 rc = bnx2x_phy_init(&bp->link_params, &bp->link_vars);
                 bnx2x_release_phy_lock(bp);
 
+                bnx2x_calc_fc_adv(bp);
+
                 if (bp->link_vars.link_up)
                         bnx2x_link_report(bp);
 
-                bnx2x_calc_fc_adv(bp);
 
                 return rc;
         }
@@ -2220,9 +2244,7 @@ static void bnx2x_link_attn(struct bnx2x *bp)
         /* Make sure that we are synced with the current statistics */
         bnx2x_stats_handle(bp, STATS_EVENT_STOP);
 
-        bnx2x_acquire_phy_lock(bp);
         bnx2x_link_update(&bp->link_params, &bp->link_vars);
-        bnx2x_release_phy_lock(bp);
 
         if (bp->link_vars.link_up) {
 
@@ -2471,6 +2493,8 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
         if (asserted & ATTN_HARD_WIRED_MASK) {
                 if (asserted & ATTN_NIG_FOR_FUNC) {
 
+                        bnx2x_acquire_phy_lock(bp);
+
                         /* save nig interrupt mask */
                         bp->nig_mask = REG_RD(bp, nig_int_mask_addr);
                         REG_WR(bp, nig_int_mask_addr, 0);
@@ -2526,8 +2550,10 @@ static void bnx2x_attn_int_asserted(struct bnx2x *bp, u32 asserted)
         REG_WR(bp, hc_addr, asserted);
 
         /* now set back the mask */
-        if (asserted & ATTN_NIG_FOR_FUNC)
+        if (asserted & ATTN_NIG_FOR_FUNC) {
                 REG_WR(bp, nig_int_mask_addr, bp->nig_mask);
+                bnx2x_release_phy_lock(bp);
+        }
 }
 
 static inline void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
@@ -2795,8 +2821,10 @@ static void bnx2x_attn_int_deasserted(struct bnx2x *bp, u32 deasserted)
 static void bnx2x_attn_int(struct bnx2x *bp)
 {
         /* read local copy of bits */
-        u32 attn_bits = bp->def_status_blk->atten_status_block.attn_bits;
-        u32 attn_ack = bp->def_status_blk->atten_status_block.attn_bits_ack;
+        u32 attn_bits = le32_to_cpu(bp->def_status_blk->atten_status_block.
+                                                                attn_bits);
+        u32 attn_ack = le32_to_cpu(bp->def_status_blk->atten_status_block.
+                                                                attn_bits_ack);
         u32 attn_state = bp->attn_state;
 
         /* look for changed bits */
@@ -2820,7 +2848,7 @@ static void bnx2x_attn_int(struct bnx2x *bp)
 
 static void bnx2x_sp_task(struct work_struct *work)
 {
-        struct bnx2x *bp = container_of(work, struct bnx2x, sp_task);
+        struct bnx2x *bp = container_of(work, struct bnx2x, sp_task.work);
         u16 status;
 
 
@@ -2844,7 +2872,7 @@ static void bnx2x_sp_task(struct work_struct *work)
         if (status & 0x2)
                 bp->stats_pending = 0;
 
-        bnx2x_ack_sb(bp, DEF_SB_ID, ATTENTION_ID, bp->def_att_idx,
+        bnx2x_ack_sb(bp, DEF_SB_ID, ATTENTION_ID, le16_to_cpu(bp->def_att_idx),
                      IGU_INT_NOP, 1);
         bnx2x_ack_sb(bp, DEF_SB_ID, USTORM_ID, le16_to_cpu(bp->def_u_idx),
                      IGU_INT_NOP, 1);
@@ -2875,7 +2903,7 @@ static irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance)
                 return IRQ_HANDLED;
 #endif
 
-        schedule_work(&bp->sp_task);
+        queue_delayed_work(bnx2x_wq, &bp->sp_task, 0);
 
         return IRQ_HANDLED;
 }
@@ -2892,7 +2920,7 @@ static irqreturn_t bnx2x_msix_sp_int(int irq, void *dev_instance)
 #define ADD_64(s_hi, a_hi, s_lo, a_lo) \
         do { \
                 s_lo += a_lo; \
-                s_hi += a_hi + (s_lo < a_lo) ? 1 : 0; \
+                s_hi += a_hi + ((s_lo < a_lo) ? 1 : 0); \
         } while (0)
 
 /* difference = minuend - subtrahend */
@@ -4496,7 +4524,7 @@ static void bnx2x_init_context(struct bnx2x *bp)
 
 static void bnx2x_init_ind_table(struct bnx2x *bp)
 {
-        int port = BP_PORT(bp);
+        int func = BP_FUNC(bp);
         int i;
 
         if (!is_multi(bp))
@@ -4505,10 +4533,8 @@ static void bnx2x_init_ind_table(struct bnx2x *bp)
         DP(NETIF_MSG_IFUP, "Initializing indirection table\n");
         for (i = 0; i < TSTORM_INDIRECTION_TABLE_SIZE; i++)
                 REG_WR8(bp, BAR_TSTRORM_INTMEM +
-                        TSTORM_INDIRECTION_TABLE_OFFSET(port) + i,
-                        i % bp->num_queues);
-
-        REG_WR(bp, PRS_REG_A_PRSU_20, 0xf);
+                        TSTORM_INDIRECTION_TABLE_OFFSET(func) + i,
+                        BP_CL_ID(bp) + (i % bp->num_queues));
 }
 
 static void bnx2x_set_client_config(struct bnx2x *bp)
@@ -4517,12 +4543,12 @@ static void bnx2x_set_client_config(struct bnx2x *bp)
         int port = BP_PORT(bp);
         int i;
 
-        tstorm_client.mtu = bp->dev->mtu + ETH_OVREHEAD;
+        tstorm_client.mtu = bp->dev->mtu;
         tstorm_client.statistics_counter_id = BP_CL_ID(bp);
         tstorm_client.config_flags =
                                 TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE;
 #ifdef BCM_VLAN
-        if (bp->rx_mode && bp->vlgrp) {
+        if (bp->rx_mode && bp->vlgrp && (bp->flags & HW_VLAN_RX_FLAG)) {
                 tstorm_client.config_flags |=
                                 TSTORM_ETH_CLIENT_CONFIG_VLAN_REMOVAL_ENABLE;
                 DP(NETIF_MSG_IFUP, "vlan removal enabled\n");
@@ -4531,7 +4557,7 @@ static void bnx2x_set_client_config(struct bnx2x *bp)
 
         if (bp->flags & TPA_ENABLE_FLAG) {
                 tstorm_client.max_sges_for_packet =
-                        BCM_PAGE_ALIGN(tstorm_client.mtu) >> BCM_PAGE_SHIFT;
+                        SGE_PAGE_ALIGN(tstorm_client.mtu) >> SGE_PAGE_SHIFT;
                 tstorm_client.max_sges_for_packet =
                         ((tstorm_client.max_sges_for_packet +
                           PAGES_PER_SGE - 1) & (~(PAGES_PER_SGE - 1))) >>
@@ -4714,10 +4740,11 @@ static void bnx2x_init_internal_func(struct bnx2x *bp)
                          bp->e1hov);
         }
 
-        /* Init CQ ring mapping and aggregation size */
-        max_agg_size = min((u32)(bp->rx_buf_size +
-                                 8*BCM_PAGE_SIZE*PAGES_PER_SGE),
-                           (u32)0xffff);
+        /* Init CQ ring mapping and aggregation size, the FW limit is 8 frags */
+        max_agg_size =
+                min((u32)(min((u32)8, (u32)MAX_SKB_FRAGS) *
+                          SGE_PAGE_SIZE * PAGES_PER_SGE),
+                    (u32)0xffff);
         for_each_queue(bp, i) {
                 struct bnx2x_fastpath *fp = &bp->fp[i];
 
@@ -4785,6 +4812,15 @@ static void bnx2x_nic_init(struct bnx2x *bp, u32 load_code)
         bnx2x_init_context(bp);
         bnx2x_init_internal(bp, load_code);
         bnx2x_init_ind_table(bp);
+        bnx2x_stats_init(bp);
+
+        /* At this point, we are ready for interrupts */
+        atomic_set(&bp->intr_sem, 0);
+
+        /* flush all before enabling interrupts */
+        mb();
+        mmiowb();
+
         bnx2x_int_enable(bp);
 }
 
@@ -5134,7 +5170,6 @@ static int bnx2x_init_common(struct bnx2x *bp)
         REG_WR(bp, PXP2_REG_RQ_SRC_ENDIAN_M, 1);
         REG_WR(bp, PXP2_REG_RQ_CDU_ENDIAN_M, 1);
         REG_WR(bp, PXP2_REG_RQ_DBG_ENDIAN_M, 1);
-        REG_WR(bp, PXP2_REG_RQ_HC_ENDIAN_M, 1);
 
 /*      REG_WR(bp, PXP2_REG_RD_PBF_SWAP_MODE, 1); */
         REG_WR(bp, PXP2_REG_RD_QM_SWAP_MODE, 1);
@@ -5212,6 +5247,7 @@ static int bnx2x_init_common(struct bnx2x *bp)
         }
 
         bnx2x_init_block(bp, PRS_COMMON_START, PRS_COMMON_END);
+        REG_WR(bp, PRS_REG_A_PRSU_20, 0xf);
         /* set NIC mode */
         REG_WR(bp, PRS_REG_NIC_MODE, 1);
         if (CHIP_IS_E1H(bp))
@@ -6393,17 +6429,8 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
                 }
         }
 
-        bnx2x_stats_init(bp);
-
         bp->state = BNX2X_STATE_OPENING_WAIT4_PORT;
 
-        /* Enable Rx interrupt handling before sending the ramrod
-           as it's completed on Rx FP queue */
-        bnx2x_napi_enable(bp);
-
-        /* Enable interrupt handling */
-        atomic_set(&bp->intr_sem, 0);
-
         rc = bnx2x_setup_leading(bp);
         if (rc) {
                 BNX2X_ERR("Setup leading failed!\n");
@@ -7501,7 +7528,7 @@ static int __devinit bnx2x_init_bp(struct bnx2x *bp)
 
         mutex_init(&bp->port.phy_mutex);
 
-        INIT_WORK(&bp->sp_task, bnx2x_sp_task);
+        INIT_DELAYED_WORK(&bp->sp_task, bnx2x_sp_task);
         INIT_WORK(&bp->reset_task, bnx2x_reset_task);
 
         rc = bnx2x_get_hwinfo(bp);
@@ -8727,6 +8754,8 @@ static int bnx2x_run_loopback(struct bnx2x *bp, int loopback_mode, u8 link_up)
         tx_bd->general_data = ((UNICAST_ADDRESS <<
                                 ETH_TX_BD_ETH_ADDR_TYPE_SHIFT) | 1);
 
+        wmb();
+
         fp->hw_tx_prods->bds_prod =
                 cpu_to_le16(le16_to_cpu(fp->hw_tx_prods->bds_prod) + 1);
         mb(); /* FW restriction: must not reorder writing nbd and packets */
@@ -8778,7 +8807,6 @@ test_loopback_rx_exit:
         /* Update producers */
         bnx2x_update_rx_prod(bp, fp, fp->rx_bd_prod, fp->rx_comp_prod,
                              fp->rx_sge_prod);
-        mmiowb(); /* keep prod updates ordered */
 
 test_loopback_exit:
         bp->link_params.loopback_mode = LOOPBACK_NONE;
@@ -9549,11 +9577,14 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
            "sending pkt %u @%p  next_idx %u  bd %u @%p\n",
            pkt_prod, tx_buf, fp->tx_pkt_prod, bd_prod, tx_bd);
 
-        if ((bp->vlgrp != NULL) && vlan_tx_tag_present(skb)) {
+#ifdef BCM_VLAN
+        if ((bp->vlgrp != NULL) && vlan_tx_tag_present(skb) &&
+            (bp->flags & HW_VLAN_TX_FLAG)) {
                 tx_bd->vlan = cpu_to_le16(vlan_tx_tag_get(skb));
                 tx_bd->bd_flags.as_bitfield |= ETH_TX_BD_FLAGS_VLAN_TAG;
                 vlan_off += 4;
         } else
+#endif
                 tx_bd->vlan = cpu_to_le16(pkt_prod);
 
         if (xmit_type) {
@@ -9705,6 +9736,15 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         DP(NETIF_MSG_TX_QUEUED, "doorbell: nbd %d  bd %u\n", nbd, bd_prod);
 
+        /*
+         * Make sure that the BD data is updated before updating the producer
+         * since FW might read the BD right after the producer is updated.
+         * This is only applicable for weak-ordered memory model archs such
+         * as IA-64. The following barrier is also mandatory since FW will
+         * assumes packets must have BDs.
+         */
+        wmb();
+
         fp->hw_tx_prods->bds_prod =
                 cpu_to_le16(le16_to_cpu(fp->hw_tx_prods->bds_prod) + nbd);
         mb(); /* FW restriction: must not reorder writing nbd and packets */
@@ -9718,6 +9758,9 @@ static int bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dev->trans_start = jiffies;
 
         if (unlikely(bnx2x_tx_avail(fp) < MAX_SKB_FRAGS + 3)) {
+                /* We want bnx2x_tx_int to "see" the updated tx_bd_prod
+                   if we put Tx into XOFF state. */
+                smp_mb();
                 netif_stop_queue(dev);
                 bp->eth_stats.driver_xoff++;
                 if (bnx2x_tx_avail(fp) >= MAX_SKB_FRAGS + 3)
@@ -9987,6 +10030,16 @@ static void bnx2x_vlan_rx_register(struct net_device *dev,
         struct bnx2x *bp = netdev_priv(dev);
 
         bp->vlgrp = vlgrp;
+
+        /* Set flags according to the required capabilities */
+        bp->flags &= ~(HW_VLAN_RX_FLAG | HW_VLAN_TX_FLAG);
+
+        if (dev->features & NETIF_F_HW_VLAN_TX)
+                bp->flags |= HW_VLAN_TX_FLAG;
+
+        if (dev->features & NETIF_F_HW_VLAN_RX)
+                bp->flags |= HW_VLAN_RX_FLAG;
+
         if (netif_running(dev))
                 bnx2x_set_client_config(bp);
 }
@@ -10143,6 +10196,7 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
                 dev->features |= NETIF_F_HIGHDMA;
 #ifdef BCM_VLAN
         dev->features |= (NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX);
+        bp->flags |= (HW_VLAN_RX_FLAG | HW_VLAN_TX_FLAG);
 #endif
         dev->features |= (NETIF_F_TSO | NETIF_F_TSO_ECN);
         dev->features |= NETIF_F_TSO6;
@@ -10519,12 +10573,20 @@ static struct pci_driver bnx2x_pci_driver = {
 
 static int __init bnx2x_init(void)
 {
+        bnx2x_wq = create_singlethread_workqueue("bnx2x");
+        if (bnx2x_wq == NULL) {
+                printk(KERN_ERR PFX "Cannot create workqueue\n");
+                return -ENOMEM;
+        }
+
         return pci_register_driver(&bnx2x_pci_driver);
 }
 
 static void __exit bnx2x_cleanup(void)
 {
         pci_unregister_driver(&bnx2x_pci_driver);
+
+        destroy_workqueue(bnx2x_wq);
 }
 
 module_init(bnx2x_init);
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index 4e6a9195fe5f..ce900e54d8d1 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -795,6 +795,7 @@ static int fs_enet_open(struct net_device *dev)
 
         err = fs_init_phy(dev);
         if (err) {
+                free_irq(fep->interrupt, dev);
                 if (fep->fpi->use_napi)
                         napi_disable(&fep->napi);
                 return err;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index efcbeb6c8673..ea530673236e 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1622,10 +1622,18 @@ static int gfar_clean_tx_ring(struct net_device *dev)
 static void gfar_schedule_cleanup(struct net_device *dev)
 {
         struct gfar_private *priv = netdev_priv(dev);
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->txlock, flags);
+        spin_lock(&priv->rxlock);
+
         if (netif_rx_schedule_prep(&priv->napi)) {
                 gfar_write(&priv->regs->imask, IMASK_RTX_DISABLED);
                 __netif_rx_schedule(&priv->napi);
         }
+
+        spin_unlock(&priv->rxlock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 }
 
 /* Interrupt Handler for Transmit complete */
diff --git a/drivers/net/ibm_newemac/mal.c b/drivers/net/ibm_newemac/mal.c
index ecf9798987fa..2a2fc17b2878 100644
--- a/drivers/net/ibm_newemac/mal.c
+++ b/drivers/net/ibm_newemac/mal.c
@@ -613,7 +613,9 @@ static int __devinit mal_probe(struct of_device *ofdev,
         INIT_LIST_HEAD(&mal->list);
         spin_lock_init(&mal->lock);
 
-        netif_napi_add(NULL, &mal->napi, mal_poll,
+        init_dummy_netdev(&mal->dummy_dev);
+
+        netif_napi_add(&mal->dummy_dev, &mal->napi, mal_poll,
                        CONFIG_IBM_NEW_EMAC_POLL_WEIGHT);
 
         /* Load power-on reset defaults */
diff --git a/drivers/net/ibm_newemac/mal.h b/drivers/net/ibm_newemac/mal.h
index 2f0a87360844..9ededfbf0726 100644
--- a/drivers/net/ibm_newemac/mal.h
+++ b/drivers/net/ibm_newemac/mal.h
@@ -214,6 +214,8 @@ struct mal_instance {
         int                     index;
         spinlock_t              lock;
 
+        struct net_device       dummy_dev;
+
         unsigned int features;
 };
 
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 29118f58a141..3a22dc41b656 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1073,7 +1073,7 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
 {
         unsigned int i;
         int ret;
-        char stir421x_fw_name[11];
+        char stir421x_fw_name[12];
         const struct firmware *fw;
         const unsigned char *fw_version_ptr; /* pointer to version string */
         unsigned long fw_version = 0;
diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 4a5580c1126a..1d6e48e13366 100644
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -84,7 +84,10 @@
 #define KORINA_NUM_RDS  64  /* number of receive descriptors */
 #define KORINA_NUM_TDS  64  /* number of transmit descriptors */
 
-#define KORINA_RBSIZE   536 /* size of one resource buffer = Ether MTU */
+/* KORINA_RBSIZE is the hardware's default maximum receive
+ * frame size in bytes. Having this hardcoded means that there
+ * is no support for MTU sizes greater than 1500. */
+#define KORINA_RBSIZE   1536 /* size of one resource buffer = Ether MTU */
 #define KORINA_RDS_MASK (KORINA_NUM_RDS - 1)
 #define KORINA_TDS_MASK (KORINA_NUM_TDS - 1)
 #define RD_RING_SIZE    (KORINA_NUM_RDS * sizeof(struct dma_desc))
@@ -196,7 +199,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
         struct korina_private *lp = netdev_priv(dev);
         unsigned long flags;
         u32 length;
-        u32 chain_index;
+        u32 chain_prev, chain_next;
         struct dma_desc *td;
 
         spin_lock_irqsave(&lp->lock, flags);
@@ -228,8 +231,8 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
         /* Setup the transmit descriptor. */
         dma_cache_inv((u32) td, sizeof(*td));
         td->ca = CPHYSADDR(skb->data);
-        chain_index = (lp->tx_chain_tail - 1) &
-                        KORINA_TDS_MASK;
+        chain_prev = (lp->tx_chain_tail - 1) & KORINA_TDS_MASK;
+        chain_next = (lp->tx_chain_tail + 1) & KORINA_TDS_MASK;
 
         if (readl(&(lp->tx_dma_regs->dmandptr)) == 0) {
                 if (lp->tx_chain_status == desc_empty) {
@@ -237,7 +240,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
                         td->control = DMA_COUNT(length) |
                                         DMA_DESC_COF | DMA_DESC_IOF;
                         /* Move tail */
-                        lp->tx_chain_tail = chain_index;
+                        lp->tx_chain_tail = chain_next;
                         /* Write to NDPTR */
                         writel(CPHYSADDR(&lp->td_ring[lp->tx_chain_head]),
                                         &lp->tx_dma_regs->dmandptr);
@@ -248,12 +251,12 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
                         td->control = DMA_COUNT(length) |
                                         DMA_DESC_COF | DMA_DESC_IOF;
                         /* Link to prev */
-                        lp->td_ring[chain_index].control &=
+                        lp->td_ring[chain_prev].control &=
                                         ~DMA_DESC_COF;
                         /* Link to prev */
-                        lp->td_ring[chain_index].link =  CPHYSADDR(td);
+                        lp->td_ring[chain_prev].link =  CPHYSADDR(td);
                         /* Move tail */
-                        lp->tx_chain_tail = chain_index;
+                        lp->tx_chain_tail = chain_next;
                         /* Write to NDPTR */
                         writel(CPHYSADDR(&lp->td_ring[lp->tx_chain_head]),
                                         &(lp->tx_dma_regs->dmandptr));
@@ -267,17 +270,16 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
                         td->control = DMA_COUNT(length) |
                                         DMA_DESC_COF | DMA_DESC_IOF;
                         /* Move tail */
-                        lp->tx_chain_tail = chain_index;
+                        lp->tx_chain_tail = chain_next;
                         lp->tx_chain_status = desc_filled;
-                        netif_stop_queue(dev);
                 } else {
                         /* Update tail */
                         td->control = DMA_COUNT(length) |
                                         DMA_DESC_COF | DMA_DESC_IOF;
-                        lp->td_ring[chain_index].control &=
+                        lp->td_ring[chain_prev].control &=
                                         ~DMA_DESC_COF;
-                        lp->td_ring[chain_index].link =  CPHYSADDR(td);
-                        lp->tx_chain_tail = chain_index;
+                        lp->td_ring[chain_prev].link =  CPHYSADDR(td);
+                        lp->tx_chain_tail = chain_next;
                 }
         }
         dma_cache_wback((u32) td, sizeof(*td));
@@ -327,13 +329,13 @@ static irqreturn_t korina_rx_dma_interrupt(int irq, void *dev_id)
 
         dmas = readl(&lp->rx_dma_regs->dmas);
         if (dmas & (DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR)) {
-                netif_rx_schedule_prep(&lp->napi);
-
                 dmasm = readl(&lp->rx_dma_regs->dmasm);
                 writel(dmasm | (DMA_STAT_DONE |
                                 DMA_STAT_HALT | DMA_STAT_ERR),
                                 &lp->rx_dma_regs->dmasm);
 
+                netif_rx_schedule(&lp->napi);
+
                 if (dmas & DMA_STAT_ERR)
                         printk(KERN_ERR DRV_NAME "%s: DMA error\n", dev->name);
 
@@ -350,15 +352,20 @@ static int korina_rx(struct net_device *dev, int limit)
         struct dma_desc *rd = &lp->rd_ring[lp->rx_next_done];
         struct sk_buff *skb, *skb_new;
         u8 *pkt_buf;
-        u32 devcs, pkt_len, dmas, rx_free_desc;
+        u32 devcs, pkt_len, dmas;
         int count;
 
         dma_cache_inv((u32)rd, sizeof(*rd));
 
         for (count = 0; count < limit; count++) {
+                skb = lp->rx_skb[lp->rx_next_done];
+                skb_new = NULL;
 
                 devcs = rd->devcs;
 
+                if ((KORINA_RBSIZE - (u32)DMA_COUNT(rd->control)) == 0)
+                        break;
+
                 /* Update statistics counters */
                 if (devcs & ETH_RX_CRC)
                         dev->stats.rx_crc_errors++;
@@ -381,63 +388,55 @@ static int korina_rx(struct net_device *dev, int limit)
                          * in Rc32434 (errata ref #077) */
                         dev->stats.rx_errors++;
                         dev->stats.rx_dropped++;
-                }
-
-                while ((rx_free_desc = KORINA_RBSIZE - (u32)DMA_COUNT(rd->control)) != 0) {
-                        /* init the var. used for the later
-                         * operations within the while loop */
-                        skb_new = NULL;
+                } else if ((devcs & ETH_RX_ROK)) {
                         pkt_len = RCVPKT_LENGTH(devcs);
-                        skb = lp->rx_skb[lp->rx_next_done];
-
-                        if ((devcs & ETH_RX_ROK)) {
-                                /* must be the (first and) last
-                                 * descriptor then */
-                                pkt_buf = (u8 *)lp->rx_skb[lp->rx_next_done]->data;
-
-                                /* invalidate the cache */
-                                dma_cache_inv((unsigned long)pkt_buf, pkt_len - 4);
-
-                                /* Malloc up new buffer. */
-                                skb_new = netdev_alloc_skb(dev, KORINA_RBSIZE + 2);
-
-                                if (!skb_new)
-                                        break;
-                                /* Do not count the CRC */
-                                skb_put(skb, pkt_len - 4);
-                                skb->protocol = eth_type_trans(skb, dev);
-
-                                /* Pass the packet to upper layers */
-                                netif_receive_skb(skb);
-                                dev->stats.rx_packets++;
-                                dev->stats.rx_bytes += pkt_len;
-
-                                /* Update the mcast stats */
-                                if (devcs & ETH_RX_MP)
-                                        dev->stats.multicast++;
-
-                                lp->rx_skb[lp->rx_next_done] = skb_new;
-                        }
-
-                        rd->devcs = 0;
-
-                        /* Restore descriptor's curr_addr */
-                        if (skb_new)
-                                rd->ca = CPHYSADDR(skb_new->data);
-                        else
-                                rd->ca = CPHYSADDR(skb->data);
-
-                        rd->control = DMA_COUNT(KORINA_RBSIZE) |
-                                DMA_DESC_COD | DMA_DESC_IOD;
-                        lp->rd_ring[(lp->rx_next_done - 1) &
-                                KORINA_RDS_MASK].control &=
-                                ~DMA_DESC_COD;
-
-                        lp->rx_next_done = (lp->rx_next_done + 1) & KORINA_RDS_MASK;
-                        dma_cache_wback((u32)rd, sizeof(*rd));
-                        rd = &lp->rd_ring[lp->rx_next_done];
-                        writel(~DMA_STAT_DONE, &lp->rx_dma_regs->dmas);
+
+                        /* must be the (first and) last
+                         * descriptor then */
+                        pkt_buf = (u8 *)lp->rx_skb[lp->rx_next_done]->data;
+
+                        /* invalidate the cache */
+                        dma_cache_inv((unsigned long)pkt_buf, pkt_len - 4);
+
+                        /* Malloc up new buffer. */
+                        skb_new = netdev_alloc_skb(dev, KORINA_RBSIZE + 2);
+
+                        if (!skb_new)
+                                break;
+                        /* Do not count the CRC */
+                        skb_put(skb, pkt_len - 4);
+                        skb->protocol = eth_type_trans(skb, dev);
+
+                        /* Pass the packet to upper layers */
+                        netif_receive_skb(skb);
+                        dev->stats.rx_packets++;
+                        dev->stats.rx_bytes += pkt_len;
+
+                        /* Update the mcast stats */
+                        if (devcs & ETH_RX_MP)
+                                dev->stats.multicast++;
+
+                        lp->rx_skb[lp->rx_next_done] = skb_new;
                 }
+
+                rd->devcs = 0;
+
+                /* Restore descriptor's curr_addr */
+                if (skb_new)
+                        rd->ca = CPHYSADDR(skb_new->data);
+                else
+                        rd->ca = CPHYSADDR(skb->data);
+
+                rd->control = DMA_COUNT(KORINA_RBSIZE) |
+                        DMA_DESC_COD | DMA_DESC_IOD;
+                lp->rd_ring[(lp->rx_next_done - 1) &
+                        KORINA_RDS_MASK].control &=
+                        ~DMA_DESC_COD;
+
+                lp->rx_next_done = (lp->rx_next_done + 1) & KORINA_RDS_MASK;
+                dma_cache_wback((u32)rd, sizeof(*rd));
+                rd = &lp->rd_ring[lp->rx_next_done];
+                writel(~DMA_STAT_DONE, &lp->rx_dma_regs->dmas);
         }
 
         dmas = readl(&lp->rx_dma_regs->dmas);
@@ -623,12 +622,12 @@ korina_tx_dma_interrupt(int irq, void *dev_id)
         dmas = readl(&lp->tx_dma_regs->dmas);
 
         if (dmas & (DMA_STAT_FINI | DMA_STAT_ERR)) {
-                korina_tx(dev);
-
                 dmasm = readl(&lp->tx_dma_regs->dmasm);
                 writel(dmasm | (DMA_STAT_FINI | DMA_STAT_ERR),
                                 &lp->tx_dma_regs->dmasm);
 
+                korina_tx(dev);
+
                 if (lp->tx_chain_status == desc_filled &&
                         (readl(&(lp->tx_dma_regs->dmandptr)) == 0)) {
                         writel(CPHYSADDR(&lp->td_ring[lp->tx_chain_head]),
@@ -901,6 +900,8 @@ static int korina_restart(struct net_device *dev)
 
         korina_free_ring(dev);
 
+        napi_disable(&lp->napi);
+
         ret = korina_init(dev);
         if (ret < 0) {
                 printk(KERN_ERR DRV_NAME "%s: cannot restart device\n",
@@ -999,14 +1000,14 @@ static int korina_open(struct net_device *dev)
          * that handles the Done Finished
          * Ovr and Und Events */
         ret = request_irq(lp->rx_irq, &korina_rx_dma_interrupt,
-                IRQF_SHARED | IRQF_DISABLED, "Korina ethernet Rx", dev);
+                        IRQF_DISABLED, "Korina ethernet Rx", dev);
         if (ret < 0) {
                 printk(KERN_ERR DRV_NAME "%s: unable to get Rx DMA IRQ %d\n",
                     dev->name, lp->rx_irq);
                 goto err_release;
         }
         ret = request_irq(lp->tx_irq, &korina_tx_dma_interrupt,
-                IRQF_SHARED | IRQF_DISABLED, "Korina ethernet Tx", dev);
+                        IRQF_DISABLED, "Korina ethernet Tx", dev);
         if (ret < 0) {
                 printk(KERN_ERR DRV_NAME "%s: unable to get Tx DMA IRQ %d\n",
                     dev->name, lp->tx_irq);
@@ -1015,7 +1016,7 @@ static int korina_open(struct net_device *dev)
 
         /* Install handler for overrun error. */
         ret = request_irq(lp->ovr_irq, &korina_ovr_interrupt,
-                        IRQF_SHARED | IRQF_DISABLED, "Ethernet Overflow", dev);
+                        IRQF_DISABLED, "Ethernet Overflow", dev);
         if (ret < 0) {
                 printk(KERN_ERR DRV_NAME"%s: unable to get OVR IRQ %d\n",
                     dev->name, lp->ovr_irq);
@@ -1024,7 +1025,7 @@ static int korina_open(struct net_device *dev)
 
         /* Install handler for underflow error. */
         ret = request_irq(lp->und_irq, &korina_und_interrupt,
-                        IRQF_SHARED | IRQF_DISABLED, "Ethernet Underflow", dev);
+                        IRQF_DISABLED, "Ethernet Underflow", dev);
         if (ret < 0) {
                 printk(KERN_ERR DRV_NAME "%s: unable to get UND IRQ %d\n",
                     dev->name, lp->und_irq);
@@ -1067,6 +1068,8 @@ static int korina_close(struct net_device *dev)
 
         korina_free_ring(dev);
 
+        napi_disable(&lp->napi);
+
         free_irq(lp->rx_irq, dev);
         free_irq(lp->tx_irq, dev);
         free_irq(lp->ovr_irq, dev);
@@ -1089,7 +1092,6 @@ static int korina_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
         SET_NETDEV_DEV(dev, &pdev->dev);
-        platform_set_drvdata(pdev, dev);
         lp = netdev_priv(dev);
 
         bif->dev = dev;
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index f8e601c51da7..c11c568fd7db 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -308,27 +308,16 @@ struct netxen_ring_ctx {
 #define netxen_set_cmd_desc_ctxid(cmd_desc, var)        \
         ((cmd_desc)->port_ctxid |= ((var) << 4 & 0xF0))
 
-#define netxen_set_cmd_desc_flags(cmd_desc, val)        \
-        (cmd_desc)->flags_opcode = ((cmd_desc)->flags_opcode & \
-                ~cpu_to_le16(0x7f)) | cpu_to_le16((val) & 0x7f)
-#define netxen_set_cmd_desc_opcode(cmd_desc, val)       \
-        (cmd_desc)->flags_opcode = ((cmd_desc)->flags_opcode & \
-                ~cpu_to_le16((u16)0x3f << 7)) | cpu_to_le16(((val) & 0x3f) << 7)
-
-#define netxen_set_cmd_desc_num_of_buff(cmd_desc, val)  \
-        (cmd_desc)->num_of_buffers_total_length = \
-                ((cmd_desc)->num_of_buffers_total_length & \
-                ~cpu_to_le32(0xff)) | cpu_to_le32((val) & 0xff)
-#define netxen_set_cmd_desc_totallength(cmd_desc, val)  \
-        (cmd_desc)->num_of_buffers_total_length = \
-                ((cmd_desc)->num_of_buffers_total_length & \
-                ~cpu_to_le32((u32)0xffffff << 8)) | \
-                cpu_to_le32(((val) & 0xffffff) << 8)
-
-#define netxen_get_cmd_desc_opcode(cmd_desc)    \
-        ((le16_to_cpu((cmd_desc)->flags_opcode) >> 7) & 0x003f)
-#define netxen_get_cmd_desc_totallength(cmd_desc)       \
-        ((le32_to_cpu((cmd_desc)->num_of_buffers_total_length) >> 8) & 0xffffff)
+#define netxen_set_tx_port(_desc, _port) \
+        (_desc)->port_ctxid = ((_port) & 0xf) | (((_port) << 4) & 0xf0)
+
+#define netxen_set_tx_flags_opcode(_desc, _flags, _opcode) \
+        (_desc)->flags_opcode = \
+        cpu_to_le16(((_flags) & 0x7f) | (((_opcode) & 0x3f) << 7))
+
+#define netxen_set_tx_frags_len(_desc, _frags, _len) \
+        (_desc)->num_of_buffers_total_length = \
+        cpu_to_le32(((_frags) & 0xff) | (((_len) & 0xffffff) << 8))
 
 struct cmd_desc_type0 {
         u8 tcp_hdr_offset;      /* For LSO only */
@@ -510,7 +499,8 @@ typedef enum {
         NETXEN_BRDTYPE_P3_10G_SFP_CT = 0x002a,
         NETXEN_BRDTYPE_P3_10G_SFP_QT = 0x002b,
         NETXEN_BRDTYPE_P3_10G_CX4 = 0x0031,
-        NETXEN_BRDTYPE_P3_10G_XFP = 0x0032
+        NETXEN_BRDTYPE_P3_10G_XFP = 0x0032,
+        NETXEN_BRDTYPE_P3_10G_TP = 0x0080
 
 } netxen_brdtype_t;
 
@@ -757,7 +747,7 @@ extern char netxen_nic_driver_name[];
  */
 struct netxen_skb_frag {
         u64 dma;
-        u32 length;
+        ulong length;
 };
 
 #define _netxen_set_bits(config_word, start, bits, val) {\
@@ -783,13 +773,7 @@ struct netxen_skb_frag {
 struct netxen_cmd_buffer {
         struct sk_buff *skb;
         struct netxen_skb_frag frag_array[MAX_BUFFERS_PER_CMD + 1];
-        u32 total_length;
-        u32 mss;
-        u16 port;
-        u8 cmd;
-        u8 frag_count;
-        unsigned long time_stamp;
-        u32 state;
+        u32 frag_count;
 };
 
 /* In rx_buffer, we do not need multiple fragments as is a single buffer */
@@ -876,7 +860,6 @@ struct nx_host_rds_ring {
         u32 skb_size;
         struct netxen_rx_buffer *rx_buf_arr;    /* rx buffers for receive   */
         struct list_head free_list;
-        int begin_alloc;
 };
 
 /*
@@ -995,31 +978,31 @@ struct netxen_recv_context {
  */
 
 typedef struct {
-        u64 host_phys_addr;     /* Ring base addr */
-        u32 ring_size;          /* Ring entries */
-        u16 msi_index;
-        u16 rsvd;               /* Padding */
+        __le64 host_phys_addr;  /* Ring base addr */
+        __le32 ring_size;               /* Ring entries */
+        __le16 msi_index;
+        __le16 rsvd;            /* Padding */
 } nx_hostrq_sds_ring_t;
 
 typedef struct {
-        u64 host_phys_addr;     /* Ring base addr */
-        u64 buff_size;          /* Packet buffer size */
-        u32 ring_size;          /* Ring entries */
-        u32 ring_kind;          /* Class of ring */
+        __le64 host_phys_addr;  /* Ring base addr */
+        __le64 buff_size;               /* Packet buffer size */
+        __le32 ring_size;               /* Ring entries */
+        __le32 ring_kind;               /* Class of ring */
 } nx_hostrq_rds_ring_t;
 
 typedef struct {
-        u64 host_rsp_dma_addr;  /* Response dma'd here */
-        u32 capabilities[4];    /* Flag bit vector */
-        u32 host_int_crb_mode;  /* Interrupt crb usage */
-        u32 host_rds_crb_mode;  /* RDS crb usage */
+        __le64 host_rsp_dma_addr;       /* Response dma'd here */
+        __le32 capabilities[4]; /* Flag bit vector */
+        __le32 host_int_crb_mode;       /* Interrupt crb usage */
+        __le32 host_rds_crb_mode;       /* RDS crb usage */
         /* These ring offsets are relative to data[0] below */
-        u32 rds_ring_offset;    /* Offset to RDS config */
-        u32 sds_ring_offset;    /* Offset to SDS config */
-        u16 num_rds_rings;      /* Count of RDS rings */
-        u16 num_sds_rings;      /* Count of SDS rings */
-        u16 rsvd1;              /* Padding */
-        u16 rsvd2;              /* Padding */
+        __le32 rds_ring_offset; /* Offset to RDS config */
+        __le32 sds_ring_offset; /* Offset to SDS config */
+        __le16 num_rds_rings;   /* Count of RDS rings */
+        __le16 num_sds_rings;   /* Count of SDS rings */
+        __le16 rsvd1;           /* Padding */
+        __le16 rsvd2;           /* Padding */
         u8  reserved[128];      /* reserve space for future expansion*/
         /* MUST BE 64-bit aligned.
            The following is packed:
@@ -1029,24 +1012,24 @@ typedef struct {
 } nx_hostrq_rx_ctx_t;
 
 typedef struct {
-        u32 host_producer_crb;  /* Crb to use */
-        u32 rsvd1;              /* Padding */
+        __le32 host_producer_crb;       /* Crb to use */
+        __le32 rsvd1;           /* Padding */
 } nx_cardrsp_rds_ring_t;
 
 typedef struct {
-        u32 host_consumer_crb;  /* Crb to use */
-        u32 interrupt_crb;      /* Crb to use */
+        __le32 host_consumer_crb;       /* Crb to use */
+        __le32 interrupt_crb;   /* Crb to use */
 } nx_cardrsp_sds_ring_t;
 
 typedef struct {
         /* These ring offsets are relative to data[0] below */
-        u32 rds_ring_offset;    /* Offset to RDS config */
-        u32 sds_ring_offset;    /* Offset to SDS config */
-        u32 host_ctx_state;     /* Starting State */
-        u32 num_fn_per_port;    /* How many PCI fn share the port */
-        u16 num_rds_rings;      /* Count of RDS rings */
-        u16 num_sds_rings;      /* Count of SDS rings */
-        u16 context_id;         /* Handle for context */
+        __le32 rds_ring_offset; /* Offset to RDS config */
+        __le32 sds_ring_offset; /* Offset to SDS config */
+        __le32 host_ctx_state;  /* Starting State */
+        __le32 num_fn_per_port; /* How many PCI fn share the port */
+        __le16 num_rds_rings;   /* Count of RDS rings */
+        __le16 num_sds_rings;   /* Count of SDS rings */
+        __le16 context_id;              /* Handle for context */
         u8  phys_port;          /* Physical id of port */
         u8  virt_port;          /* Virtual/Logical id of port */
         u8  reserved[128];      /* save space for future expansion */
@@ -1072,34 +1055,34 @@ typedef struct {
  */
 
 typedef struct {
-        u64 host_phys_addr;     /* Ring base addr */
-        u32 ring_size;          /* Ring entries */
-        u32 rsvd;               /* Padding */
+        __le64 host_phys_addr;  /* Ring base addr */
+        __le32 ring_size;               /* Ring entries */
+        __le32 rsvd;            /* Padding */
 } nx_hostrq_cds_ring_t;
 
 typedef struct {
-        u64 host_rsp_dma_addr;  /* Response dma'd here */
-        u64 cmd_cons_dma_addr;  /*  */
-        u64 dummy_dma_addr;     /*  */
-        u32 capabilities[4];    /* Flag bit vector */
-        u32 host_int_crb_mode;  /* Interrupt crb usage */
-        u32 rsvd1;              /* Padding */
-        u16 rsvd2;              /* Padding */
-        u16 interrupt_ctl;
-        u16 msi_index;
-        u16 rsvd3;              /* Padding */
+        __le64 host_rsp_dma_addr;       /* Response dma'd here */
+        __le64 cmd_cons_dma_addr;       /*  */
+        __le64 dummy_dma_addr;  /*  */
+        __le32 capabilities[4]; /* Flag bit vector */
+        __le32 host_int_crb_mode;       /* Interrupt crb usage */
+        __le32 rsvd1;           /* Padding */
+        __le16 rsvd2;           /* Padding */
+        __le16 interrupt_ctl;
+        __le16 msi_index;
+        __le16 rsvd3;           /* Padding */
         nx_hostrq_cds_ring_t cds_ring;  /* Desc of cds ring */
         u8  reserved[128];      /* future expansion */
 } nx_hostrq_tx_ctx_t;
 
 typedef struct {
-        u32 host_producer_crb;  /* Crb to use */
-        u32 interrupt_crb;      /* Crb to use */
+        __le32 host_producer_crb;       /* Crb to use */
+        __le32 interrupt_crb;   /* Crb to use */
 } nx_cardrsp_cds_ring_t;
 
 typedef struct {
-        u32 host_ctx_state;     /* Starting state */
-        u16 context_id;         /* Handle for context */
+        __le32 host_ctx_state;  /* Starting state */
+        __le16 context_id;              /* Handle for context */
         u8  phys_port;          /* Physical id of port */
         u8  virt_port;          /* Virtual/Logical id of port */
         nx_cardrsp_cds_ring_t cds_ring; /* Card cds settings */
@@ -1202,9 +1185,9 @@ enum {
 #define VPORT_MISS_MODE_ACCEPT_MULTI    2 /* accept unmatched multicast */
 
 typedef struct {
-        u64 qhdr;
-        u64 req_hdr;
-        u64 words[6];
+        __le64 qhdr;
+        __le64 req_hdr;
+        __le64 words[6];
 } nx_nic_req_t;
 
 typedef struct {
@@ -1486,8 +1469,6 @@ void netxen_release_tx_buffers(struct netxen_adapter *adapter);
 
 void netxen_initialize_adapter_ops(struct netxen_adapter *adapter);
 int netxen_init_firmware(struct netxen_adapter *adapter);
-void netxen_tso_check(struct netxen_adapter *adapter,
-                      struct cmd_desc_type0 *desc, struct sk_buff *skb);
 void netxen_nic_clear_stats(struct netxen_adapter *adapter);
 void netxen_watchdog_task(struct work_struct *work);
 void netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ctx,
@@ -1496,6 +1477,7 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter);
 u32 netxen_process_rcv_ring(struct netxen_adapter *adapter, int ctx, int max);
 void netxen_p2_nic_set_multi(struct net_device *netdev);
 void netxen_p3_nic_set_multi(struct net_device *netdev);
+void netxen_p3_free_mac_list(struct netxen_adapter *adapter);
 int netxen_p3_nic_set_promisc(struct netxen_adapter *adapter, u32);
 int netxen_config_intr_coalesce(struct netxen_adapter *adapter);
 
diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
index 64b51643c626..746bdb470418 100644
--- a/drivers/net/netxen/netxen_nic_ctx.c
+++ b/drivers/net/netxen/netxen_nic_ctx.c
@@ -76,7 +76,7 @@ netxen_api_unlock(struct netxen_adapter *adapter)
 static u32
 netxen_poll_rsp(struct netxen_adapter *adapter)
 {
-        u32 raw_rsp, rsp = NX_CDRP_RSP_OK;
+        u32 rsp = NX_CDRP_RSP_OK;
         int     timeout = 0;
 
         do {
@@ -86,10 +86,7 @@ netxen_poll_rsp(struct netxen_adapter *adapter)
                 if (++timeout > NX_OS_CRB_RETRY_COUNT)
                         return NX_CDRP_RSP_TIMEOUT;
 
-                netxen_nic_read_w1(adapter, NX_CDRP_CRB_OFFSET,
-                                &raw_rsp);
-
-                rsp = le32_to_cpu(raw_rsp);
+                netxen_nic_read_w1(adapter, NX_CDRP_CRB_OFFSET, &rsp);
         } while (!NX_CDRP_IS_RSP(rsp));
 
         return rsp;
@@ -109,20 +106,16 @@ netxen_issue_cmd(struct netxen_adapter *adapter,
         if (netxen_api_lock(adapter))
                 return NX_RCODE_TIMEOUT;
 
-        netxen_nic_write_w1(adapter, NX_SIGN_CRB_OFFSET,
-                        cpu_to_le32(signature));
+        netxen_nic_write_w1(adapter, NX_SIGN_CRB_OFFSET, signature);
 
-        netxen_nic_write_w1(adapter, NX_ARG1_CRB_OFFSET,
-                        cpu_to_le32(arg1));
+        netxen_nic_write_w1(adapter, NX_ARG1_CRB_OFFSET, arg1);
 
-        netxen_nic_write_w1(adapter, NX_ARG2_CRB_OFFSET,
-                        cpu_to_le32(arg2));
+        netxen_nic_write_w1(adapter, NX_ARG2_CRB_OFFSET, arg2);
 
-        netxen_nic_write_w1(adapter, NX_ARG3_CRB_OFFSET,
-                        cpu_to_le32(arg3));
+        netxen_nic_write_w1(adapter, NX_ARG3_CRB_OFFSET, arg3);
 
         netxen_nic_write_w1(adapter, NX_CDRP_CRB_OFFSET,
-                        cpu_to_le32(NX_CDRP_FORM_CMD(cmd)));
+                        NX_CDRP_FORM_CMD(cmd));
 
         rsp = netxen_poll_rsp(adapter);
 
@@ -133,7 +126,6 @@ netxen_issue_cmd(struct netxen_adapter *adapter,
                 rcode = NX_RCODE_TIMEOUT;
         } else if (rsp == NX_CDRP_RSP_FAIL) {
                 netxen_nic_read_w1(adapter, NX_ARG1_CRB_OFFSET, &rcode);
-                rcode = le32_to_cpu(rcode);
 
                 printk(KERN_ERR "%s: failed card response code:0x%x\n",
                                 netxen_nic_driver_name, rcode);
@@ -183,7 +175,7 @@ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
 
         int i, nrds_rings, nsds_rings;
         size_t rq_size, rsp_size;
-        u32 cap, reg;
+        u32 cap, reg, val;
 
         int err;
 
@@ -225,11 +217,14 @@ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
 
         prq->num_rds_rings = cpu_to_le16(nrds_rings);
         prq->num_sds_rings = cpu_to_le16(nsds_rings);
-        prq->rds_ring_offset = 0;
-        prq->sds_ring_offset = prq->rds_ring_offset +
+        prq->rds_ring_offset = cpu_to_le32(0);
+
+        val = le32_to_cpu(prq->rds_ring_offset) +
                 (sizeof(nx_hostrq_rds_ring_t) * nrds_rings);
+        prq->sds_ring_offset = cpu_to_le32(val);
 
-        prq_rds = (nx_hostrq_rds_ring_t *)(prq->data + prq->rds_ring_offset);
+        prq_rds = (nx_hostrq_rds_ring_t *)(prq->data +
+                        le32_to_cpu(prq->rds_ring_offset));
 
         for (i = 0; i < nrds_rings; i++) {
 
@@ -241,17 +236,14 @@ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
                 prq_rds[i].buff_size = cpu_to_le64(rds_ring->dma_size);
         }
 
-        prq_sds = (nx_hostrq_sds_ring_t *)(prq->data + prq->sds_ring_offset);
+        prq_sds = (nx_hostrq_sds_ring_t *)(prq->data +
+                        le32_to_cpu(prq->sds_ring_offset));
 
         prq_sds[0].host_phys_addr =
                 cpu_to_le64(recv_ctx->rcv_status_desc_phys_addr);
         prq_sds[0].ring_size = cpu_to_le32(adapter->max_rx_desc_count);
         /* only one msix vector for now */
-        prq_sds[0].msi_index = cpu_to_le32(0);
-
-        /* now byteswap offsets */
-        prq->rds_ring_offset = cpu_to_le32(prq->rds_ring_offset);
-        prq->sds_ring_offset = cpu_to_le32(prq->sds_ring_offset);
+        prq_sds[0].msi_index = cpu_to_le16(0);
 
         phys_addr = hostrq_phys_addr;
         err = netxen_issue_cmd(adapter,
@@ -269,9 +261,9 @@ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
 
 
         prsp_rds = ((nx_cardrsp_rds_ring_t *)
-                         &prsp->data[prsp->rds_ring_offset]);
+                         &prsp->data[le32_to_cpu(prsp->rds_ring_offset)]);
 
-        for (i = 0; i < le32_to_cpu(prsp->num_rds_rings); i++) {
+        for (i = 0; i < le16_to_cpu(prsp->num_rds_rings); i++) {
                 rds_ring = &recv_ctx->rds_rings[i];
 
                 reg = le32_to_cpu(prsp_rds[i].host_producer_crb);
@@ -279,7 +271,7 @@ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
         }
 
         prsp_sds = ((nx_cardrsp_sds_ring_t *)
-                        &prsp->data[prsp->sds_ring_offset]);
+                        &prsp->data[le32_to_cpu(prsp->sds_ring_offset)]);
         reg = le32_to_cpu(prsp_sds[0].host_consumer_crb);
         recv_ctx->crb_sts_consumer = NETXEN_NIC_REG(reg - 0x200);
 
@@ -288,7 +280,7 @@ nx_fw_cmd_create_rx_ctx(struct netxen_adapter *adapter)
 
         recv_ctx->state = le32_to_cpu(prsp->host_ctx_state);
         recv_ctx->context_id = le16_to_cpu(prsp->context_id);
-        recv_ctx->virt_port = le16_to_cpu(prsp->virt_port);
+        recv_ctx->virt_port = prsp->virt_port;
 
 out_free_rsp:
         pci_free_consistent(adapter->pdev, rsp_size, prsp, cardrsp_phys_addr);
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index e45ce2951729..c0bd40fcf708 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -136,11 +136,9 @@ netxen_nic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 
                 ecmd->port = PORT_TP;
 
-                if (netif_running(dev)) {
-                        ecmd->speed = adapter->link_speed;
-                        ecmd->duplex = adapter->link_duplex;
-                        ecmd->autoneg = adapter->link_autoneg;
-                }
+                ecmd->speed = adapter->link_speed;
+                ecmd->duplex = adapter->link_duplex;
+                ecmd->autoneg = adapter->link_autoneg;
 
         } else if (adapter->ahw.board_type == NETXEN_NIC_XGBE) {
                 u32 val;
@@ -171,7 +169,7 @@ netxen_nic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         } else
                 return -EIO;
 
-        ecmd->phy_address = adapter->portnum;
+        ecmd->phy_address = adapter->physical_port;
         ecmd->transceiver = XCVR_EXTERNAL;
 
         switch ((netxen_brdtype_t) boardinfo->board_type) {
@@ -180,13 +178,13 @@ netxen_nic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         case NETXEN_BRDTYPE_P3_REF_QG:
         case NETXEN_BRDTYPE_P3_4_GB:
         case NETXEN_BRDTYPE_P3_4_GB_MM:
-        case NETXEN_BRDTYPE_P3_10000_BASE_T:
 
                 ecmd->supported |= SUPPORTED_Autoneg;
                 ecmd->advertising |= ADVERTISED_Autoneg;
         case NETXEN_BRDTYPE_P2_SB31_10G_CX4:
         case NETXEN_BRDTYPE_P3_10G_CX4:
         case NETXEN_BRDTYPE_P3_10G_CX4_LP:
+        case NETXEN_BRDTYPE_P3_10000_BASE_T:
                 ecmd->supported |= SUPPORTED_TP;
                 ecmd->advertising |= ADVERTISED_TP;
                 ecmd->port = PORT_TP;
@@ -204,16 +202,33 @@ netxen_nic_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
                 ecmd->port = PORT_FIBRE;
                 ecmd->autoneg = AUTONEG_DISABLE;
                 break;
-        case NETXEN_BRDTYPE_P2_SB31_10G:
         case NETXEN_BRDTYPE_P3_10G_SFP_PLUS:
         case NETXEN_BRDTYPE_P3_10G_SFP_CT:
         case NETXEN_BRDTYPE_P3_10G_SFP_QT:
+                ecmd->advertising |= ADVERTISED_TP;
+                ecmd->supported |= SUPPORTED_TP;
+        case NETXEN_BRDTYPE_P2_SB31_10G:
         case NETXEN_BRDTYPE_P3_10G_XFP:
                 ecmd->supported |= SUPPORTED_FIBRE;
                 ecmd->advertising |= ADVERTISED_FIBRE;
                 ecmd->port = PORT_FIBRE;
                 ecmd->autoneg = AUTONEG_DISABLE;
                 break;
+        case NETXEN_BRDTYPE_P3_10G_TP:
+                if (adapter->ahw.board_type == NETXEN_NIC_XGBE) {
+                        ecmd->autoneg = AUTONEG_DISABLE;
+                        ecmd->supported |= (SUPPORTED_FIBRE | SUPPORTED_TP);
+                        ecmd->advertising |=
+                                (ADVERTISED_FIBRE | ADVERTISED_TP);
+                        ecmd->port = PORT_FIBRE;
+                } else {
+                        ecmd->autoneg = AUTONEG_ENABLE;
+                        ecmd->supported |= (SUPPORTED_TP |SUPPORTED_Autoneg);
+                        ecmd->advertising |=
+                                (ADVERTISED_TP | ADVERTISED_Autoneg);
+                        ecmd->port = PORT_TP;
+                }
+                break;
         default:
                 printk(KERN_ERR "netxen-nic: Unsupported board model %d\n",
                        (netxen_brdtype_t) boardinfo->board_type);
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index aa6e603bfcbf..821cff68b3f3 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -503,17 +503,15 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
 
         i = 0;
 
+        netif_tx_lock_bh(adapter->netdev);
+
         producer = adapter->cmd_producer;
         do {
                 cmd_desc = &cmd_desc_arr[i];
 
                 pbuf = &adapter->cmd_buf_arr[producer];
-                pbuf->mss = 0;
-                pbuf->total_length = 0;
                 pbuf->skb = NULL;
-                pbuf->cmd = 0;
                 pbuf->frag_count = 0;
-                pbuf->port = 0;
 
                 /* adapter->ahw.cmd_desc_head[producer] = *cmd_desc; */
                 memcpy(&adapter->ahw.cmd_desc_head[producer],
@@ -531,6 +529,8 @@ netxen_send_cmd_descs(struct netxen_adapter *adapter,
 
         netxen_nic_update_cmd_producer(adapter, adapter->cmd_producer);
 
+        netif_tx_unlock_bh(adapter->netdev);
+
         return 0;
 }
 
@@ -539,16 +539,19 @@ static int nx_p3_sre_macaddr_change(struct net_device *dev,
 {
         struct netxen_adapter *adapter = netdev_priv(dev);
         nx_nic_req_t req;
-        nx_mac_req_t mac_req;
+        nx_mac_req_t *mac_req;
+        u64 word;
         int rv;
 
         memset(&req, 0, sizeof(nx_nic_req_t));
-        req.qhdr |= (NX_NIC_REQUEST << 23);
-        req.req_hdr |= NX_MAC_EVENT;
-        req.req_hdr |= ((u64)adapter->portnum << 16);
-        mac_req.op = op;
-        memcpy(&mac_req.mac_addr, addr, 6);
-        req.words[0] = cpu_to_le64(*(u64 *)&mac_req);
+        req.qhdr = cpu_to_le64(NX_NIC_REQUEST << 23);
+
+        word = NX_MAC_EVENT | ((u64)adapter->portnum << 16);
+        req.req_hdr = cpu_to_le64(word);
+
+        mac_req = (nx_mac_req_t *)&req.words[0];
+        mac_req->op = op;
+        memcpy(mac_req->mac_addr, addr, 6);
 
         rv = netxen_send_cmd_descs(adapter, (struct cmd_desc_type0 *)&req, 1);
         if (rv != 0) {
@@ -612,18 +615,35 @@ send_fw_cmd:
 int netxen_p3_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
 {
         nx_nic_req_t req;
+        u64 word;
 
         memset(&req, 0, sizeof(nx_nic_req_t));
 
-        req.qhdr |= (NX_HOST_REQUEST << 23);
-        req.req_hdr |= NX_NIC_H2C_OPCODE_PROXY_SET_VPORT_MISS_MODE;
-        req.req_hdr |= ((u64)adapter->portnum << 16);
+        req.qhdr = cpu_to_le64(NX_HOST_REQUEST << 23);
+
+        word = NX_NIC_H2C_OPCODE_PROXY_SET_VPORT_MISS_MODE |
+                        ((u64)adapter->portnum << 16);
+        req.req_hdr = cpu_to_le64(word);
+
         req.words[0] = cpu_to_le64(mode);
 
         return netxen_send_cmd_descs(adapter,
                                 (struct cmd_desc_type0 *)&req, 1);
 }
 
+void netxen_p3_free_mac_list(struct netxen_adapter *adapter)
+{
+        nx_mac_list_t *cur, *next;
+
+        cur = adapter->mac_list;
+
+        while (cur) {
+                next = cur->next;
+                kfree(cur);
+                cur = next;
+        }
+}
+
 #define NETXEN_CONFIG_INTR_COALESCE     3
 
 /*
@@ -632,13 +652,15 @@ int netxen_p3_nic_set_promisc(struct netxen_adapter *adapter, u32 mode)
 int netxen_config_intr_coalesce(struct netxen_adapter *adapter)
 {
         nx_nic_req_t req;
+        u64 word;
         int rv;
 
         memset(&req, 0, sizeof(nx_nic_req_t));
 
-        req.qhdr |= (NX_NIC_REQUEST << 23);
-        req.req_hdr |= NETXEN_CONFIG_INTR_COALESCE;
-        req.req_hdr |= ((u64)adapter->portnum << 16);
+        req.qhdr = cpu_to_le64(NX_NIC_REQUEST << 23);
+
+        word = NETXEN_CONFIG_INTR_COALESCE | ((u64)adapter->portnum << 16);
+        req.req_hdr = cpu_to_le64(word);
 
         memcpy(&req.words[0], &adapter->coal, sizeof(adapter->coal));
 
@@ -772,13 +794,10 @@ int netxen_p3_get_mac_addr(struct netxen_adapter *adapter, __le64 *mac)
         adapter->hw_read_wx(adapter, crbaddr, &mac_lo, 4);
         adapter->hw_read_wx(adapter, crbaddr+4, &mac_hi, 4);
 
-        mac_hi = cpu_to_le32(mac_hi);
-        mac_lo = cpu_to_le32(mac_lo);
-
         if (pci_func & 1)
-                *mac = ((mac_lo >> 16) | ((u64)mac_hi << 16));
+                *mac = le64_to_cpu((mac_lo >> 16) | ((u64)mac_hi << 16));
         else
-                *mac = ((mac_lo) | ((u64)mac_hi << 32));
+                *mac = le64_to_cpu((u64)mac_lo | ((u64)mac_hi << 32));
 
         return 0;
 }
@@ -937,7 +956,7 @@ int netxen_load_firmware(struct netxen_adapter *adapter)
 {
         int i;
         u32 data, size = 0;
-        u32 flashaddr = NETXEN_BOOTLD_START, memaddr = NETXEN_BOOTLD_START;
+        u32 flashaddr = NETXEN_BOOTLD_START;
 
         size = (NETXEN_IMAGE_START - NETXEN_BOOTLD_START)/4;
 
@@ -949,10 +968,8 @@ int netxen_load_firmware(struct netxen_adapter *adapter)
                 if (netxen_rom_fast_read(adapter, flashaddr, (int *)&data) != 0)
                         return -EIO;
 
-                adapter->pci_mem_write(adapter, memaddr, &data, 4);
+                adapter->pci_mem_write(adapter, flashaddr, &data, 4);
                 flashaddr += 4;
-                memaddr += 4;
-                cond_resched();
         }
         msleep(1);
 
@@ -2034,7 +2051,13 @@ int netxen_nic_get_board_info(struct netxen_adapter *adapter)
                 rv = -1;
         }
 
-        DPRINTK(INFO, "Discovered board type:0x%x  ", boardinfo->board_type);
+        if (boardinfo->board_type == NETXEN_BRDTYPE_P3_4_GB_MM) {
+                u32 gpio = netxen_nic_reg_read(adapter,
+                                NETXEN_ROMUSB_GLB_PAD_GPIO_I);
+                if ((gpio & 0x8000) == 0)
+                        boardinfo->board_type = NETXEN_BRDTYPE_P3_10G_TP;
+        }
+
         switch ((netxen_brdtype_t) boardinfo->board_type) {
         case NETXEN_BRDTYPE_P2_SB35_4G:
                 adapter->ahw.board_type = NETXEN_NIC_GBE;
@@ -2053,7 +2076,6 @@ int netxen_nic_get_board_info(struct netxen_adapter *adapter)
         case NETXEN_BRDTYPE_P3_10G_SFP_QT:
         case NETXEN_BRDTYPE_P3_10G_XFP:
         case NETXEN_BRDTYPE_P3_10000_BASE_T:
-
                 adapter->ahw.board_type = NETXEN_NIC_XGBE;
                 break;
         case NETXEN_BRDTYPE_P1_BD:
@@ -2063,9 +2085,12 @@ int netxen_nic_get_board_info(struct netxen_adapter *adapter)
         case NETXEN_BRDTYPE_P3_REF_QG:
         case NETXEN_BRDTYPE_P3_4_GB:
         case NETXEN_BRDTYPE_P3_4_GB_MM:
-
                 adapter->ahw.board_type = NETXEN_NIC_GBE;
                 break;
+        case NETXEN_BRDTYPE_P3_10G_TP:
+                adapter->ahw.board_type = (adapter->portnum < 2) ?
+                        NETXEN_NIC_XGBE : NETXEN_NIC_GBE;
+                break;
         default:
                 printk("%s: Unknown(%x)\n", netxen_nic_driver_name,
                        boardinfo->board_type);
@@ -2110,12 +2135,16 @@ void netxen_nic_set_link_parameters(struct netxen_adapter *adapter)
 {
         __u32 status;
         __u32 autoneg;
-        __u32 mode;
         __u32 port_mode;
 
-        netxen_nic_read_w0(adapter, NETXEN_NIU_MODE, &mode);
-        if (netxen_get_niu_enable_ge(mode)) {   /* Gb 10/100/1000 Mbps mode */
+        if (!netif_carrier_ok(adapter->netdev)) {
+                adapter->link_speed   = 0;
+                adapter->link_duplex  = -1;
+                adapter->link_autoneg = AUTONEG_ENABLE;
+                return;
+        }
 
+        if (adapter->ahw.board_type == NETXEN_NIC_GBE) {
                 adapter->hw_read_wx(adapter,
                                 NETXEN_PORT_MODE_ADDR, &port_mode, 4);
                 if (port_mode == NETXEN_PORT_MODE_802_3_AP) {
@@ -2141,7 +2170,7 @@ void netxen_nic_set_link_parameters(struct netxen_adapter *adapter)
                                         adapter->link_speed = SPEED_1000;
                                         break;
                                 default:
-                                        adapter->link_speed = -1;
+                                        adapter->link_speed = 0;
                                         break;
                                 }
                                 switch (netxen_get_phy_duplex(status)) {
@@ -2164,7 +2193,7 @@ void netxen_nic_set_link_parameters(struct netxen_adapter *adapter)
                                 goto link_down;
                 } else {
                       link_down:
-                        adapter->link_speed = -1;
+                        adapter->link_speed = 0;
                         adapter->link_duplex = -1;
                 }
         }
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index d924468e506e..ca7c8d8050c9 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -308,7 +308,6 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
                         }
                         memset(rds_ring->rx_buf_arr, 0, RCV_BUFFSIZE);
                         INIT_LIST_HEAD(&rds_ring->free_list);
-                        rds_ring->begin_alloc = 0;
                         /*
                          * Now go through all of them, set reference handles
                          * and put them in the queues.
@@ -439,6 +438,8 @@ static int netxen_wait_rom_done(struct netxen_adapter *adapter)
         long timeout = 0;
         long done = 0;
 
+        cond_resched();
+
         while (done == 0) {
                 done = netxen_nic_reg_read(adapter, NETXEN_ROMUSB_GLB_STATUS);
                 done &= 2;
@@ -533,12 +534,9 @@ static int do_rom_fast_write(struct netxen_adapter *adapter, int addr,
 static int do_rom_fast_read(struct netxen_adapter *adapter,
                             int addr, int *valp)
 {
-        cond_resched();
-
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ADDRESS, addr);
-        netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 3);
-        udelay(100);            /* prevent bursting on CRB */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
+        netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 3);
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_INSTR_OPCODE, 0xb);
         if (netxen_wait_rom_done(adapter)) {
                 printk("Error waiting for rom done\n");
@@ -546,7 +544,7 @@ static int do_rom_fast_read(struct netxen_adapter *adapter,
         }
         /* reset abyte_cnt and dummy_byte_cnt */
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_ABYTE_CNT, 0);
-        udelay(100);            /* prevent bursting on CRB */
+        udelay(10);
         netxen_nic_reg_write(adapter, NETXEN_ROMUSB_ROM_DUMMY_BYTE_CNT, 0);
 
         *valp = netxen_nic_reg_read(adapter, NETXEN_ROMUSB_ROM_RDATA);
@@ -884,14 +882,16 @@ int netxen_flash_unlock(struct netxen_adapter *adapter)
 int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
 {
         int addr, val;
-        int i, init_delay = 0;
+        int i, n, init_delay = 0;
         struct crb_addr_pair *buf;
-        unsigned offset, n;
+        unsigned offset;
         u32 off;
 
         /* resetall */
+        rom_lock(adapter);
         netxen_crb_writelit_adapter(adapter, NETXEN_ROMUSB_GLB_SW_RESET,
                                     0xffffffff);
+        netxen_rom_unlock(adapter);
 
         if (verbose) {
                 if (netxen_rom_fast_read(adapter, NETXEN_BOARDTYPE, &val) == 0)
@@ -910,7 +910,7 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
 
         if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
                 if (netxen_rom_fast_read(adapter, 0, &n) != 0 ||
-                        (n != 0xcafecafeUL) ||
+                        (n != 0xcafecafe) ||
                         netxen_rom_fast_read(adapter, 4, &n) != 0) {
                         printk(KERN_ERR "%s: ERROR Reading crb_init area: "
                                         "n: %08x\n", netxen_nic_driver_name, n);
@@ -975,6 +975,14 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
                         /* do not reset PCI */
                         if (off == (ROMUSB_GLB + 0xbc))
                                 continue;
+                        if (off == (ROMUSB_GLB + 0xa8))
+                                continue;
+                        if (off == (ROMUSB_GLB + 0xc8)) /* core clock */
+                                continue;
+                        if (off == (ROMUSB_GLB + 0x24)) /* MN clock */
+                                continue;
+                        if (off == (ROMUSB_GLB + 0x1c)) /* MS clock */
+                                continue;
                         if (off == (NETXEN_CRB_PEG_NET_1 + 0x18))
                                 buf[i].data = 0x1020;
                         /* skip the function enable register */
@@ -992,23 +1000,21 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
                         continue;
                 }
 
+                init_delay = 1;
                 /* After writing this register, HW needs time for CRB */
                 /* to quiet down (else crb_window returns 0xffffffff) */
                 if (off == NETXEN_ROMUSB_GLB_SW_RESET) {
-                        init_delay = 1;
+                        init_delay = 1000;
                         if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
                                 /* hold xdma in reset also */
                                 buf[i].data = NETXEN_NIC_XDMA_RESET;
+                                buf[i].data = 0x8000ff;
                         }
                 }
 
                 adapter->hw_write_wx(adapter, off, &buf[i].data, 4);
 
-                if (init_delay == 1) {
-                        msleep(1000);
-                        init_delay = 0;
-                }
-                msleep(1);
+                msleep(init_delay);
         }
         kfree(buf);
 
@@ -1277,7 +1283,7 @@ static void netxen_process_rcv(struct netxen_adapter *adapter, int ctxid,
 
                 dev_kfree_skb_any(skb);
                 for (i = 0; i < nr_frags; i++) {
-                        index = frag_desc->frag_handles[i];
+                        index = le16_to_cpu(frag_desc->frag_handles[i]);
                         skb = netxen_process_rxbuf(adapter,
                                         rds_ring, index, cksum);
                         if (skb)
@@ -1428,7 +1434,6 @@ void netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ctx, u32 ringid)
         struct rcv_desc *pdesc;
         struct netxen_rx_buffer *buffer;
         int count = 0;
-        int index = 0;
         netxen_ctx_msg msg = 0;
         dma_addr_t dma;
         struct list_head *head;
@@ -1436,7 +1441,6 @@ void netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ctx, u32 ringid)
         rds_ring = &recv_ctx->rds_rings[ringid];
 
         producer = rds_ring->producer;
-        index = rds_ring->begin_alloc;
         head = &rds_ring->free_list;
 
         /* We can start writing rx descriptors into the phantom memory. */
@@ -1444,39 +1448,37 @@ void netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ctx, u32 ringid)
 
                 skb = dev_alloc_skb(rds_ring->skb_size);
                 if (unlikely(!skb)) {
-                        rds_ring->begin_alloc = index;
                         break;
                 }
 
+                if (!adapter->ahw.cut_through)
+                        skb_reserve(skb, 2);
+
+                dma = pci_map_single(pdev, skb->data,
+                                rds_ring->dma_size, PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(pdev, dma)) {
+                        dev_kfree_skb_any(skb);
+                        break;
+                }
+
+                count++;
                 buffer = list_entry(head->next, struct netxen_rx_buffer, list);
                 list_del(&buffer->list);
 
-                count++;        /* now there should be no failure */
-                pdesc = &rds_ring->desc_head[producer];
-
-                if (!adapter->ahw.cut_through)
-                        skb_reserve(skb, 2);
-                /* This will be setup when we receive the
-                 * buffer after it has been filled  FSL  TBD TBD
-                 * skb->dev = netdev;
-                 */
-                dma = pci_map_single(pdev, skb->data, rds_ring->dma_size,
-                                     PCI_DMA_FROMDEVICE);
-                pdesc->addr_buffer = cpu_to_le64(dma);
                 buffer->skb = skb;
                 buffer->state = NETXEN_BUFFER_BUSY;
                 buffer->dma = dma;
+
                 /* make a rcv descriptor  */
+                pdesc = &rds_ring->desc_head[producer];
+                pdesc->addr_buffer = cpu_to_le64(dma);
                 pdesc->reference_handle = cpu_to_le16(buffer->ref_handle);
                 pdesc->buffer_length = cpu_to_le32(rds_ring->dma_size);
-                DPRINTK(INFO, "done writing descripter\n");
-                producer =
-                    get_next_index(producer, rds_ring->max_rx_desc_count);
-                index = get_next_index(index, rds_ring->max_rx_desc_count);
+
+                producer = get_next_index(producer, rds_ring->max_rx_desc_count);
         }
         /* if we did allocate buffers, then write the count to Phantom */
         if (count) {
-                rds_ring->begin_alloc = index;
                 rds_ring->producer = producer;
                         /* Window = 1 */
                 adapter->pci_write_normalize(adapter,
@@ -1515,49 +1517,50 @@ static void netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter,
         struct rcv_desc *pdesc;
         struct netxen_rx_buffer *buffer;
         int count = 0;
-        int index = 0;
         struct list_head *head;
+        dma_addr_t dma;
 
         rds_ring = &recv_ctx->rds_rings[ringid];
 
         producer = rds_ring->producer;
-        index = rds_ring->begin_alloc;
         head = &rds_ring->free_list;
         /* We can start writing rx descriptors into the phantom memory. */
         while (!list_empty(head)) {
 
                 skb = dev_alloc_skb(rds_ring->skb_size);
                 if (unlikely(!skb)) {
-                        rds_ring->begin_alloc = index;
                         break;
                 }
 
+                if (!adapter->ahw.cut_through)
+                        skb_reserve(skb, 2);
+
+                dma = pci_map_single(pdev, skb->data,
+                                rds_ring->dma_size, PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(pdev, dma)) {
+                        dev_kfree_skb_any(skb);
+                        break;
+                }
+
+                count++;
                 buffer = list_entry(head->next, struct netxen_rx_buffer, list);
                 list_del(&buffer->list);
 
-                count++;        /* now there should be no failure */
-                pdesc = &rds_ring->desc_head[producer];
-                if (!adapter->ahw.cut_through)
-                        skb_reserve(skb, 2);
                 buffer->skb = skb;
                 buffer->state = NETXEN_BUFFER_BUSY;
-                buffer->dma = pci_map_single(pdev, skb->data,
-                                             rds_ring->dma_size,
-                                             PCI_DMA_FROMDEVICE);
+                buffer->dma = dma;
 
                 /* make a rcv descriptor  */
+                pdesc = &rds_ring->desc_head[producer];
                 pdesc->reference_handle = cpu_to_le16(buffer->ref_handle);
                 pdesc->buffer_length = cpu_to_le32(rds_ring->dma_size);
                 pdesc->addr_buffer = cpu_to_le64(buffer->dma);
-                producer =
-                    get_next_index(producer, rds_ring->max_rx_desc_count);
-                index = get_next_index(index, rds_ring->max_rx_desc_count);
-                buffer = &rds_ring->rx_buf_arr[index];
+
+                producer = get_next_index(producer, rds_ring->max_rx_desc_count);
         }
 
         /* if we did allocate buffers, then write the count to Phantom */
         if (count) {
-                rds_ring->begin_alloc = index;
                 rds_ring->producer = producer;
                         /* Window = 1 */
                 adapter->pci_write_normalize(adapter,
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index ba01524b5531..86867405a367 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -39,6 +39,7 @@
 #include "netxen_nic_phan_reg.h"
 
 #include <linux/dma-mapping.h>
+#include <linux/if_vlan.h>
 #include <net/ip.h>
 
 MODULE_DESCRIPTION("NetXen Multi port (1/10) Gigabit Network Driver");
@@ -242,7 +243,7 @@ static void netxen_check_options(struct netxen_adapter *adapter)
         case NETXEN_BRDTYPE_P3_4_GB:
         case NETXEN_BRDTYPE_P3_4_GB_MM:
                 adapter->msix_supported = !!use_msi_x;
-                adapter->max_rx_desc_count = MAX_RCV_DESCRIPTORS_10G;
+                adapter->max_rx_desc_count = MAX_RCV_DESCRIPTORS_1G;
                 break;
 
         case NETXEN_BRDTYPE_P2_SB35_4G:
@@ -251,6 +252,14 @@ static void netxen_check_options(struct netxen_adapter *adapter)
                 adapter->max_rx_desc_count = MAX_RCV_DESCRIPTORS_1G;
                 break;
 
+        case NETXEN_BRDTYPE_P3_10G_TP:
+                adapter->msix_supported = !!use_msi_x;
+                if (adapter->ahw.board_type == NETXEN_NIC_XGBE)
+                        adapter->max_rx_desc_count = MAX_RCV_DESCRIPTORS_10G;
+                else
+                        adapter->max_rx_desc_count = MAX_RCV_DESCRIPTORS_1G;
+                break;
+
         default:
                 adapter->msix_supported = 0;
                 adapter->max_rx_desc_count = MAX_RCV_DESCRIPTORS_1G;
@@ -271,10 +280,15 @@ static void netxen_check_options(struct netxen_adapter *adapter)
 static int
 netxen_check_hw_init(struct netxen_adapter *adapter, int first_boot)
 {
-        int ret = 0;
+        u32 val, timeout;
 
         if (first_boot == 0x55555555) {
                 /* This is the first boot after power up */
+                adapter->pci_write_normalize(adapter,
+                        NETXEN_CAM_RAM(0x1fc), NETXEN_BDINFO_MAGIC);
+
+                if (!NX_IS_REVISION_P2(adapter->ahw.revision_id))
+                        return 0;
 
                 /* PCI bus master workaround */
                 adapter->hw_read_wx(adapter,
@@ -294,18 +308,26 @@ netxen_check_hw_init(struct netxen_adapter *adapter, int first_boot)
                         /* clear the register for future unloads/loads */
                         adapter->pci_write_normalize(adapter,
                                         NETXEN_CAM_RAM(0x1fc), 0);
-                        ret = -1;
+                        return -EIO;
                 }
 
-                if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
-                        /* Start P2 boot loader */
-                        adapter->pci_write_normalize(adapter,
-                                NETXEN_CAM_RAM(0x1fc), NETXEN_BDINFO_MAGIC);
-                        adapter->pci_write_normalize(adapter,
-                                        NETXEN_ROMUSB_GLB_PEGTUNE_DONE, 1);
-                }
+                /* Start P2 boot loader */
+                val = adapter->pci_read_normalize(adapter,
+                                NETXEN_ROMUSB_GLB_PEGTUNE_DONE);
+                adapter->pci_write_normalize(adapter,
+                                NETXEN_ROMUSB_GLB_PEGTUNE_DONE, val | 0x1);
+                timeout = 0;
+                do {
+                        msleep(1);
+                        val = adapter->pci_read_normalize(adapter,
+                                        NETXEN_CAM_RAM(0x1fc));
+
+                        if (++timeout > 5000)
+                                return -EIO;
+
+                } while (val == NETXEN_BDINFO_MAGIC);
         }
-        return ret;
+        return 0;
 }
 
 static void netxen_set_port_mode(struct netxen_adapter *adapter)
@@ -784,8 +806,8 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                                                 CRB_CMDPEG_STATE, 0);
                         netxen_pinit_from_rom(adapter, 0);
                         msleep(1);
-                        netxen_load_firmware(adapter);
                 }
+                netxen_load_firmware(adapter);
 
                 if (NX_IS_REVISION_P3(revision_id))
                         netxen_pcie_strap_init(adapter);
@@ -801,13 +823,6 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
                 }
 
-                if ((first_boot == 0x55555555) &&
-                        (NX_IS_REVISION_P2(revision_id))) {
-                        /* Unlock the HW, prompting the boot sequence */
-                        adapter->pci_write_normalize(adapter,
-                                        NETXEN_ROMUSB_GLB_PEGTUNE_DONE, 1);
-                }
-
                 err = netxen_initialize_adapter_offload(adapter);
                 if (err)
                         goto err_out_iounmap;
@@ -821,7 +836,9 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->pci_write_normalize(adapter, CRB_DRIVER_VERSION, i);
 
                 /* Handshake with the card before we register the devices. */
-                netxen_phantom_init(adapter, NETXEN_NIC_PEG_TUNE);
+                err = netxen_phantom_init(adapter, NETXEN_NIC_PEG_TUNE);
+                if (err)
+                        goto err_out_free_offload;
 
         }       /* first_driver */
 
@@ -925,6 +942,7 @@ err_out_disable_msi:
         if (adapter->flags & NETXEN_NIC_MSI_ENABLED)
                 pci_disable_msi(pdev);
 
+err_out_free_offload:
         if (first_driver)
                 netxen_free_adapter_offload(adapter);
 
@@ -968,6 +986,9 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
                 netxen_free_hw_resources(adapter);
                 netxen_release_rx_buffers(adapter);
                 netxen_free_sw_resources(adapter);
+
+                if (NX_IS_REVISION_P3(adapter->ahw.revision_id))
+                        netxen_p3_free_mac_list(adapter);
         }
 
         if (adapter->portnum == 0)
@@ -1137,29 +1158,64 @@ static int netxen_nic_close(struct net_device *netdev)
         return 0;
 }
 
-void netxen_tso_check(struct netxen_adapter *adapter,
+static bool netxen_tso_check(struct net_device *netdev,
                       struct cmd_desc_type0 *desc, struct sk_buff *skb)
 {
-        if (desc->mss) {
-                desc->total_hdr_length = (sizeof(struct ethhdr) +
-                                          ip_hdrlen(skb) + tcp_hdrlen(skb));
+        bool tso = false;
+        u8 opcode = TX_ETHER_PKT;
 
-                if ((NX_IS_REVISION_P3(adapter->ahw.revision_id)) &&
-                                (skb->protocol == htons(ETH_P_IPV6)))
-                        netxen_set_cmd_desc_opcode(desc, TX_TCP_LSO6);
-                else
-                        netxen_set_cmd_desc_opcode(desc, TX_TCP_LSO);
+        if ((netdev->features & (NETIF_F_TSO | NETIF_F_TSO6)) &&
+                        skb_shinfo(skb)->gso_size > 0) {
+
+                desc->mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
+                desc->total_hdr_length =
+                        skb_transport_offset(skb) + tcp_hdrlen(skb);
+
+                opcode = (skb->protocol == htons(ETH_P_IPV6)) ?
+                                TX_TCP_LSO6 : TX_TCP_LSO;
+                tso = true;
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                if (ip_hdr(skb)->protocol == IPPROTO_TCP)
-                        netxen_set_cmd_desc_opcode(desc, TX_TCP_PKT);
-                else if (ip_hdr(skb)->protocol == IPPROTO_UDP)
-                        netxen_set_cmd_desc_opcode(desc, TX_UDP_PKT);
-                else
-                        return;
+                u8 l4proto;
+
+                if (skb->protocol == htons(ETH_P_IP)) {
+                        l4proto = ip_hdr(skb)->protocol;
+
+                        if (l4proto == IPPROTO_TCP)
+                                opcode = TX_TCP_PKT;
+                        else if(l4proto == IPPROTO_UDP)
+                                opcode = TX_UDP_PKT;
+                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                        l4proto = ipv6_hdr(skb)->nexthdr;
+
+                        if (l4proto == IPPROTO_TCP)
+                                opcode = TX_TCPV6_PKT;
+                        else if(l4proto == IPPROTO_UDP)
+                                opcode = TX_UDPV6_PKT;
+                }
         }
         desc->tcp_hdr_offset = skb_transport_offset(skb);
         desc->ip_hdr_offset = skb_network_offset(skb);
+        netxen_set_tx_flags_opcode(desc, 0, opcode);
+        return tso;
+}
+
+static void
+netxen_clean_tx_dma_mapping(struct pci_dev *pdev,
+                struct netxen_cmd_buffer *pbuf, int last)
+{
+        int k;
+        struct netxen_skb_frag *buffrag;
+
+        buffrag = &pbuf->frag_array[0];
+        pci_unmap_single(pdev, buffrag->dma,
+                        buffrag->length, PCI_DMA_TODEVICE);
+
+        for (k = 1; k < last; k++) {
+                buffrag = &pbuf->frag_array[k];
+                pci_unmap_page(pdev, buffrag->dma,
+                        buffrag->length, PCI_DMA_TODEVICE);
+        }
 }
 
 static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
@@ -1167,33 +1223,22 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         struct netxen_adapter *adapter = netdev_priv(netdev);
         struct netxen_hardware_context *hw = &adapter->ahw;
         unsigned int first_seg_len = skb->len - skb->data_len;
+        struct netxen_cmd_buffer *pbuf;
         struct netxen_skb_frag *buffrag;
-        unsigned int i;
+        struct cmd_desc_type0 *hwdesc;
+        struct pci_dev *pdev = adapter->pdev;
+        dma_addr_t temp_dma;
+        int i, k;
 
         u32 producer, consumer;
-        u32 saved_producer = 0;
-        struct cmd_desc_type0 *hwdesc;
-        int k;
-        struct netxen_cmd_buffer *pbuf = NULL;
-        int frag_count;
-        int no_of_desc;
+        int frag_count, no_of_desc;
         u32 num_txd = adapter->max_tx_desc_count;
+        bool is_tso = false;
 
         frag_count = skb_shinfo(skb)->nr_frags + 1;
 
         /* There 4 fragments per descriptor */
         no_of_desc = (frag_count + 3) >> 2;
-        if (netdev->features & (NETIF_F_TSO | NETIF_F_TSO6)) {
-                if (skb_shinfo(skb)->gso_size > 0) {
-
-                        no_of_desc++;
-                        if ((ip_hdrlen(skb) + tcp_hdrlen(skb) +
-                             sizeof(struct ethhdr)) >
-                            (sizeof(struct cmd_desc_type0) - 2)) {
-                                no_of_desc++;
-                        }
-                }
-        }
 
         producer = adapter->cmd_producer;
         smp_mb();
@@ -1205,34 +1250,26 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         }
 
         /* Copy the descriptors into the hardware    */
-        saved_producer = producer;
         hwdesc = &hw->cmd_desc_head[producer];
         memset(hwdesc, 0, sizeof(struct cmd_desc_type0));
         /* Take skb->data itself */
         pbuf = &adapter->cmd_buf_arr[producer];
-        if ((netdev->features & (NETIF_F_TSO | NETIF_F_TSO6)) &&
-                        skb_shinfo(skb)->gso_size > 0) {
-                pbuf->mss = skb_shinfo(skb)->gso_size;
-                hwdesc->mss = cpu_to_le16(skb_shinfo(skb)->gso_size);
-        } else {
-                pbuf->mss = 0;
-                hwdesc->mss = 0;
-        }
-        pbuf->total_length = skb->len;
+
+        is_tso = netxen_tso_check(netdev, hwdesc, skb);
+
         pbuf->skb = skb;
-        pbuf->cmd = TX_ETHER_PKT;
         pbuf->frag_count = frag_count;
-        pbuf->port = adapter->portnum;
         buffrag = &pbuf->frag_array[0];
-        buffrag->dma = pci_map_single(adapter->pdev, skb->data, first_seg_len,
+        temp_dma = pci_map_single(pdev, skb->data, first_seg_len,
                                       PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(pdev, temp_dma))
+                goto drop_packet;
+
+        buffrag->dma = temp_dma;
         buffrag->length = first_seg_len;
-        netxen_set_cmd_desc_totallength(hwdesc, skb->len);
-        netxen_set_cmd_desc_num_of_buff(hwdesc, frag_count);
-        netxen_set_cmd_desc_opcode(hwdesc, TX_ETHER_PKT);
+        netxen_set_tx_frags_len(hwdesc, frag_count, skb->len);
+        netxen_set_tx_port(hwdesc, adapter->portnum);
 
-        netxen_set_cmd_desc_port(hwdesc, adapter->portnum);
-        netxen_set_cmd_desc_ctxid(hwdesc, adapter->portnum);
         hwdesc->buffer1_length = cpu_to_le16(first_seg_len);
         hwdesc->addr_buffer1 = cpu_to_le64(buffrag->dma);
 
@@ -1240,7 +1277,6 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 struct skb_frag_struct *frag;
                 int len, temp_len;
                 unsigned long offset;
-                dma_addr_t temp_dma;
 
                 /* move to next desc. if there is a need */
                 if ((i & 0x3) == 0) {
@@ -1256,8 +1292,12 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 offset = frag->page_offset;
 
                 temp_len = len;
-                temp_dma = pci_map_page(adapter->pdev, frag->page, offset,
+                temp_dma = pci_map_page(pdev, frag->page, offset,
                                         len, PCI_DMA_TODEVICE);
+                if (pci_dma_mapping_error(pdev, temp_dma)) {
+                        netxen_clean_tx_dma_mapping(pdev, pbuf, i);
+                        goto drop_packet;
+                }
 
                 buffrag++;
                 buffrag->dma = temp_dma;
@@ -1285,16 +1325,12 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         }
         producer = get_next_index(producer, num_txd);
 
-        /* might change opcode to TX_TCP_LSO */
-        netxen_tso_check(adapter, &hw->cmd_desc_head[saved_producer], skb);
-
         /* For LSO, we need to copy the MAC/IP/TCP headers into
          * the descriptor ring
          */
-        if (netxen_get_cmd_desc_opcode(&hw->cmd_desc_head[saved_producer])
-            == TX_TCP_LSO) {
+        if (is_tso) {
                 int hdr_len, first_hdr_len, more_hdr;
-                hdr_len = hw->cmd_desc_head[saved_producer].total_hdr_length;
+                hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 if (hdr_len > (sizeof(struct cmd_desc_type0) - 2)) {
                         first_hdr_len = sizeof(struct cmd_desc_type0) - 2;
                         more_hdr = 1;
@@ -1336,6 +1372,11 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         netdev->trans_start = jiffies;
 
         return NETDEV_TX_OK;
+
+drop_packet:
+        adapter->stats.txdropped++;
+        dev_kfree_skb_any(skb);
+        return NETDEV_TX_OK;
 }
 
 static int netxen_nic_check_temp(struct netxen_adapter *adapter)
@@ -1407,6 +1448,8 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
                         netif_carrier_off(netdev);
                         netif_stop_queue(netdev);
                 }
+
+                netxen_nic_set_link_parameters(adapter);
         } else if (!adapter->ahw.linkup && linkup) {
                 printk(KERN_INFO "%s: %s NIC Link is up\n",
                        netxen_nic_driver_name, netdev->name);
@@ -1415,6 +1458,8 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
                         netif_carrier_on(netdev);
                         netif_wake_queue(netdev);
                 }
+
+                netxen_nic_set_link_parameters(adapter);
         }
 }
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index e35460165bf7..0a06e4fd37d9 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -231,15 +231,6 @@ struct phy_device * get_phy_device(struct mii_bus *bus, int addr)
         if ((phy_id & 0x1fffffff) == 0x1fffffff)
                 return NULL;
 
-        /*
-         * Broken hardware is sometimes missing the pull-up resistor on the
-         * MDIO line, which results in reads to non-existent devices returning
-         * 0 rather than 0xffff. Catch this here and treat 0 as a non-existent
-         * device as well.
-         */
-        if (phy_id == 0)
-                return NULL;
-
         dev = phy_device_create(bus, addr, phy_id);
 
         return dev;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 06b448285eb5..7b2728b8f1b7 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -250,6 +250,7 @@ static int ppp_connect_channel(struct channel *pch, int unit);
 static int ppp_disconnect_channel(struct channel *pch);
 static void ppp_destroy_channel(struct channel *pch);
 static int unit_get(struct idr *p, void *ptr);
+static int unit_set(struct idr *p, void *ptr, int n);
 static void unit_put(struct idr *p, int n);
 static void *unit_find(struct idr *p, int n);
 
@@ -2432,11 +2433,18 @@ ppp_create_interface(int unit, int *retp)
         } else {
                 if (unit_find(&ppp_units_idr, unit))
                         goto out2; /* unit already exists */
-                else {
-                        /* darn, someone is cheating us? */
-                        *retp = -EINVAL;
+                /*
+                 * if caller need a specified unit number
+                 * lets try to satisfy him, otherwise --
+                 * he should better ask us for new unit number
+                 *
+                 * NOTE: yes I know that returning EEXIST it's not
+                 * fair but at least pppd will ask us to allocate
+                 * new unit in this case so user is happy :)
+                 */
+                unit = unit_set(&ppp_units_idr, ppp, unit);
+                if (unit < 0)
                         goto out2;
-                }
         }
 
         /* Initialize the new ppp unit */
@@ -2677,14 +2685,37 @@ static void __exit ppp_cleanup(void)
  * by holding all_ppp_mutex
  */
 
+/* associate pointer with specified number */
+static int unit_set(struct idr *p, void *ptr, int n)
+{
+        int unit, err;
+
+again:
+        if (!idr_pre_get(p, GFP_KERNEL)) {
+                printk(KERN_ERR "PPP: No free memory for idr\n");
+                return -ENOMEM;
+        }
+
+        err = idr_get_new_above(p, ptr, n, &unit);
+        if (err == -EAGAIN)
+                goto again;
+
+        if (unit != n) {
+                idr_remove(p, unit);
+                return -EINVAL;
+        }
+
+        return unit;
+}
+
 /* get new free unit number and associate pointer with it */
 static int unit_get(struct idr *p, void *ptr)
 {
         int unit, err;
 
 again:
-        if (idr_pre_get(p, GFP_KERNEL) == 0) {
-                printk(KERN_ERR "Out of memory expanding drawable idr\n");
+        if (!idr_pre_get(p, GFP_KERNEL)) {
+                printk(KERN_ERR "PPP: No free memory for idr\n");
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index 6cbefcae9ac2..be4465bc0a69 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -509,10 +509,10 @@ static int __devinit sis900_probe(struct pci_dev *pci_dev,
         else
                 ret = sis900_get_mac_addr(pci_dev, net_dev);
 
-        if (ret == 0) {
-                printk(KERN_WARNING "%s: Cannot read MAC address.\n", dev_name);
-                ret = -ENODEV;
-                goto err_unmap_rx;
+        if (!ret || !is_valid_ether_addr(net_dev->dev_addr)) {
+                random_ether_addr(net_dev->dev_addr);
+                printk(KERN_WARNING "%s: Unreadable or invalid MAC address,"
+                                "using random generated one\n", dev_name);
         }
 
         /* 630ET : set the mii access mode as software-mode */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index c4918b86ed19..0d0fa91c0251 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1297,6 +1297,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
         /* setup */
         spin_lock_irq(&serial->serial_lock);
         tty->driver_data = serial;
+        tty_kref_put(serial->tty);
         serial->tty = tty_kref_get(tty);
         spin_unlock_irq(&serial->serial_lock);
 
@@ -1792,8 +1793,8 @@ static int mux_device_request(struct hso_serial *serial, u8 type, u16 port,
 
         /* initialize */
         ctrl_req->wValue = 0;
-        ctrl_req->wIndex = hso_port_to_mux(port);
-        ctrl_req->wLength = size;
+        ctrl_req->wIndex = cpu_to_le16(hso_port_to_mux(port));
+        ctrl_req->wLength = cpu_to_le16(size);
 
         if (type == USB_CDC_GET_ENCAPSULATED_RESPONSE) {
                 /* Reading command */
@@ -2043,9 +2044,8 @@ static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
                 return -2;
         }
 
-        spin_lock(&serial->serial_lock);
+        /* All callers to put_rxbuf_data hold serial_lock */
         tty = tty_kref_get(serial->tty);
-        spin_unlock(&serial->serial_lock);
 
         /* Push data to tty */
         if (tty) {
@@ -2053,8 +2053,10 @@ static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
                         serial->curr_rx_urb_offset;
                 D1("data to push to tty");
                 while (write_length_remaining) {
-                        if (test_bit(TTY_THROTTLED, &tty->flags))
+                        if (test_bit(TTY_THROTTLED, &tty->flags)) {
+                                tty_kref_put(tty);
                                 return -1;
+                        }
                         curr_write_len =  tty_insert_flip_string
                                 (tty, urb->transfer_buffer +
                                  serial->curr_rx_urb_offset,
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 2dc241689d37..0dbd85b0162d 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -622,7 +622,7 @@ static void hss_hdlc_rx_irq(void *pdev)
         printk(KERN_DEBUG "%s: hss_hdlc_rx_irq\n", dev->name);
 #endif
         qmgr_disable_irq(queue_ids[port->id].rx);
-        netif_rx_schedule(dev, &port->napi);
+        netif_rx_schedule(&port->napi);
 }
 
 static int hss_hdlc_poll(struct napi_struct *napi, int budget)
@@ -651,7 +651,7 @@ static int hss_hdlc_poll(struct napi_struct *napi, int budget)
                         printk(KERN_DEBUG "%s: hss_hdlc_poll"
                                " netif_rx_complete\n", dev->name);
 #endif
-                        netif_rx_complete(dev, napi);
+                        netif_rx_complete(napi);
                         qmgr_enable_irq(rxq);
                         if (!qmgr_stat_empty(rxq) &&
                             netif_rx_reschedule(napi)) {
@@ -1069,7 +1069,7 @@ static int hss_hdlc_open(struct net_device *dev)
         hss_start_hdlc(port);
 
         /* we may already have RX data, enables IRQ */
-        netif_rx_schedule(dev, &port->napi);
+        netif_rx_schedule(&port->napi);
         return 0;
 
 err_unlock:
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index ea543fcf2687..e4f9f747de88 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -111,7 +111,7 @@ config WLAN_80211
           lets you choose drivers.
 
 config PCMCIA_RAYCS
-        tristate "Aviator/Raytheon 2.4MHz wireless support"
+        tristate "Aviator/Raytheon 2.4GHz wireless support"
         depends on PCMCIA && WLAN_80211
         select WIRELESS_EXT
         ---help---
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 4af2607deec0..8ef87356e083 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -2644,7 +2644,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (skb_headroom(skb) < padsize) {
                         ATH5K_ERR(sc, "tx hdrlen not %%4: %d not enough"
                                   " headroom to pad %d\n", hdrlen, padsize);
-                        return -1;
+                        return NETDEV_TX_BUSY;
                 }
                 skb_push(skb, padsize);
                 memmove(skb->data, skb->data+padsize, hdrlen);
@@ -2655,7 +2655,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 ATH5K_ERR(sc, "no further txbuf available, dropping packet\n");
                 spin_unlock_irqrestore(&sc->txbuflock, flags);
                 ieee80211_stop_queue(hw, skb_get_queue_mapping(skb));
-                return -1;
+                return NETDEV_TX_BUSY;
         }
         bf = list_first_entry(&sc->txbuf, struct ath5k_buf, list);
         list_del(&bf->list);
@@ -2673,10 +2673,10 @@ ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 sc->txbuf_len++;
                 spin_unlock_irqrestore(&sc->txbuflock, flags);
                 dev_kfree_skb_any(skb);
-                return 0;
+                return NETDEV_TX_OK;
         }
 
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int
diff --git a/drivers/net/wireless/ath5k/pcu.c b/drivers/net/wireless/ath5k/pcu.c
index 0cac05c6a9ce..75eb9f43c741 100644
--- a/drivers/net/wireless/ath5k/pcu.c
+++ b/drivers/net/wireless/ath5k/pcu.c
@@ -65,7 +65,7 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
                 if (ah->ah_version == AR5K_AR5210)
                         pcu_reg |= AR5K_STA_ID1_NO_PSPOLL;
                 else
-                        AR5K_REG_DISABLE_BITS(ah, AR5K_CFG, AR5K_CFG_ADHOC);
+                        AR5K_REG_ENABLE_BITS(ah, AR5K_CFG, AR5K_CFG_IBSS);
                 break;
 
         case NL80211_IFTYPE_AP:
@@ -75,7 +75,7 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
                 if (ah->ah_version == AR5K_AR5210)
                         pcu_reg |= AR5K_STA_ID1_NO_PSPOLL;
                 else
-                        AR5K_REG_ENABLE_BITS(ah, AR5K_CFG, AR5K_CFG_ADHOC);
+                        AR5K_REG_DISABLE_BITS(ah, AR5K_CFG, AR5K_CFG_IBSS);
                 break;
 
         case NL80211_IFTYPE_STATION:
diff --git a/drivers/net/wireless/ath5k/reg.h b/drivers/net/wireless/ath5k/reg.h
index 91aaeaf88199..9189ab13286c 100644
--- a/drivers/net/wireless/ath5k/reg.h
+++ b/drivers/net/wireless/ath5k/reg.h
@@ -73,7 +73,7 @@
 #define AR5K_CFG_SWRD           0x00000004      /* Byte-swap RX descriptor */
 #define AR5K_CFG_SWRB           0x00000008      /* Byte-swap RX buffer */
 #define AR5K_CFG_SWRG           0x00000010      /* Byte-swap Register access */
-#define AR5K_CFG_ADHOC          0x00000020      /* AP/Adhoc indication [5211+] */
+#define AR5K_CFG_IBSS           0x00000020      /* 0-BSS, 1-IBSS [5211+] */
 #define AR5K_CFG_PHY_OK         0x00000100      /* [5211+] */
 #define AR5K_CFG_EEBS           0x00000200      /* EEPROM is busy */
 #define AR5K_CFG_CLKGD          0x00000400      /* Clock gated (Disable dynamic clock) */
diff --git a/drivers/net/wireless/ath9k/Kconfig b/drivers/net/wireless/ath9k/Kconfig
index c43bd321f97f..90a8dd873786 100644
--- a/drivers/net/wireless/ath9k/Kconfig
+++ b/drivers/net/wireless/ath9k/Kconfig
@@ -1,6 +1,7 @@
 config ATH9K
         tristate "Atheros 802.11n wireless cards support"
         depends on PCI && MAC80211 && WLAN_80211
+        depends on RFKILL || RFKILL=n
         select MAC80211_LEDS
         select LEDS_CLASS
         select NEW_LEDS
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 191eec50dc75..727f067aca4f 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -2164,13 +2164,13 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                                     conf->ht.channel_type);
                 }
 
+                ath_update_chainmask(sc, conf->ht.enabled);
+
                 if (ath_set_channel(sc, &sc->sc_ah->ah_channels[pos]) < 0) {
                         DPRINTF(sc, ATH_DBG_FATAL, "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
                         return -EINVAL;
                 }
-
-                ath_update_chainmask(sc, conf->ht.enabled);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER)
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 3bfc3b90f256..c92f0c6e4adc 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -126,15 +126,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->flags |= IEEE80211_TX_STAT_ACK;
         }
 
-        tx_info->status.rates[0].count = tx_status->retries;
-        if (tx_info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
-                /* Change idx from internal table index to MCS index */
-                int idx = tx_info->status.rates[0].idx;
-                struct ath_rate_table *rate_table = sc->cur_rate_table;
-                if (idx >= 0 && idx < rate_table->rate_cnt)
-                        tx_info->status.rates[0].idx =
-                                rate_table->info[idx].ratecode & 0x7f;
-        }
+        tx_info->status.rates[0].count = tx_status->retries + 1;
 
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
         padsize = hdrlen & 3;
@@ -264,25 +256,22 @@ static void assign_aggr_tid_seqno(struct sk_buff *skb,
         }
 
         /* Get seqno */
-
-        if (ieee80211_is_data(fc) && !is_pae(skb)) {
-                /* For HT capable stations, we save tidno for later use.
-                 * We also override seqno set by upper layer with the one
-                 * in tx aggregation state.
-                 *
-                 * If fragmentation is on, the sequence number is
-                 * not overridden, since it has been
-                 * incremented by the fragmentation routine.
-                 *
-                 * FIXME: check if the fragmentation threshold exceeds
-                 * IEEE80211 max.
-                 */
-                tid = ATH_AN_2_TID(an, bf->bf_tidno);
-                hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
-                                            IEEE80211_SEQ_SEQ_SHIFT);
-                bf->bf_seqno = tid->seq_next;
-                INCR(tid->seq_next, IEEE80211_SEQ_MAX);
-        }
+        /* For HT capable stations, we save tidno for later use.
+         * We also override seqno set by upper layer with the one
+         * in tx aggregation state.
+         *
+         * If fragmentation is on, the sequence number is
+         * not overridden, since it has been
+         * incremented by the fragmentation routine.
+         *
+         * FIXME: check if the fragmentation threshold exceeds
+         * IEEE80211 max.
+         */
+        tid = ATH_AN_2_TID(an, bf->bf_tidno);
+        hdr->seq_ctrl = cpu_to_le16(tid->seq_next <<
+                        IEEE80211_SEQ_SEQ_SHIFT);
+        bf->bf_seqno = tid->seq_next;
+        INCR(tid->seq_next, IEEE80211_SEQ_MAX);
 }
 
 static int setup_tx_flags(struct ath_softc *sc, struct sk_buff *skb,
@@ -1718,11 +1707,10 @@ static int ath_tx_setup_buffer(struct ath_softc *sc, struct ath_buf *bf,
 
         /* Assign seqno, tidno */
 
-        if (bf_isht(bf) && (sc->sc_flags & SC_OP_TXAGGR))
+        if (ieee80211_is_data_qos(fc) && (sc->sc_flags & SC_OP_TXAGGR))
                 assign_aggr_tid_seqno(skb, bf);
 
         /* DMA setup */
-
         bf->bf_mpdu = skb;
 
         bf->bf_dmacontext = pci_map_single(sc->pdev, skb->data,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 7b31a327b24a..c788bad10661 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3261,7 +3261,7 @@ static int b43_switch_band(struct b43_wl *wl, struct ieee80211_channel *chan)
         struct b43_wldev *down_dev;
         struct b43_wldev *d;
         int err;
-        bool gmode;
+        bool uninitialized_var(gmode);
         int prev_status;
 
         /* Find a device and PHY which supports the band. */
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c1324e31d2f6..fb996c27a19b 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2465,7 +2465,7 @@ static void b43legacy_put_phy_into_reset(struct b43legacy_wldev *dev)
 static int b43legacy_switch_phymode(struct b43legacy_wl *wl,
                                       unsigned int new_mode)
 {
-        struct b43legacy_wldev *up_dev;
+        struct b43legacy_wldev *uninitialized_var(up_dev);
         struct b43legacy_wldev *down_dev;
         int err;
         bool gmode = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 8fdb34222c0a..45cfa1cf194a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2219,7 +2219,7 @@ int iwl3945_txpower_set_from_eeprom(struct iwl3945_priv *priv)
                 /* set tx power value for all OFDM rates */
                 for (rate_index = 0; rate_index < IWL_OFDM_RATES;
                      rate_index++) {
-                        s32 power_idx;
+                        s32 uninitialized_var(power_idx);
                         int rc;
 
                         /* use channel group's clip-power table,
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 52966ffbef6e..ba997204c8d4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -255,7 +255,7 @@ struct iwl_cmd_header {
  *        0x3)  54 Mbps
  *
  * Legacy CCK rate format for bits 7:0 (bit 8 must be "0", bit 9 "1"):
- *  3-0:   10)  1 Mbps
+ *  6-0:   10)  1 Mbps
  *         20)  2 Mbps
  *         55)  5.5 Mbps
  *        110)  11 Mbps
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 01a2169cecec..8c71ad4f88c5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -51,6 +51,7 @@ const char *get_cmd_string(u8 cmd)
                 IWL_CMD(REPLY_REMOVE_STA);
                 IWL_CMD(REPLY_REMOVE_ALL_STA);
                 IWL_CMD(REPLY_WEPKEY);
+                IWL_CMD(REPLY_3945_RX);
                 IWL_CMD(REPLY_TX);
                 IWL_CMD(REPLY_RATE_SCALE);
                 IWL_CMD(REPLY_LEDS_CMD);
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index d1fc305de5fe..e7289e2e7f16 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -206,7 +206,7 @@ static int lbtf_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * there are no buffered multicast frames to send
          */
         ieee80211_stop_queues(priv->hw);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void lbtf_tx_work(struct work_struct *work)
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index bc84e2792f8a..c3bb85e0251e 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -1610,6 +1610,16 @@ static void orinoco_rx_isr_tasklet(unsigned long data)
         struct orinoco_rx_data *rx_data, *temp;
         struct hermes_rx_descriptor *desc;
         struct sk_buff *skb;
+        unsigned long flags;
+
+        /* orinoco_rx requires the driver lock, and we also need to
+         * protect priv->rx_list, so just hold the lock over the
+         * lot.
+         *
+         * If orinoco_lock fails, we've unplugged the card. In this
+         * case just abort. */
+        if (orinoco_lock(priv, &flags) != 0)
+                return;
 
         /* extract desc and skb from queue */
         list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
@@ -1622,6 +1632,8 @@ static void orinoco_rx_isr_tasklet(unsigned long data)
 
                 kfree(desc);
         }
+
+        orinoco_unlock(priv, &flags);
 }
 
 /********************************************************************/
@@ -3645,12 +3657,22 @@ struct net_device
 void free_orinocodev(struct net_device *dev)
 {
         struct orinoco_private *priv = netdev_priv(dev);
+        struct orinoco_rx_data *rx_data, *temp;
 
-        /* No need to empty priv->rx_list: if the tasklet is scheduled
-         * when we call tasklet_kill it will run one final time,
-         * emptying the list */
+        /* If the tasklet is scheduled when we call tasklet_kill it
+         * will run one final time. However the tasklet will only
+         * drain priv->rx_list if the hw is still available. */
         tasklet_kill(&priv->rx_tasklet);
 
+        /* Explicitly drain priv->rx_list */
+        list_for_each_entry_safe(rx_data, temp, &priv->rx_list, list) {
+                list_del(&rx_data->list);
+
+                dev_kfree_skb(rx_data->skb);
+                kfree(rx_data->desc);
+                kfree(rx_data);
+        }
+
         unregister_pm_notifier(&priv->pm_notifier);
         orinoco_uncache_fw(priv);
 
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index f127602670ec..0b32215d3f5d 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -435,6 +435,7 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002), /* Samsung SWL2000-N 11Mb/s WLAN Card */
         PCMCIA_DEVICE_MANF_CARD(0x0261, 0x0002), /* AirWay 802.11 Adapter (PCMCIA) */
         PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0001), /* ARtem Onair */
+        PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0003), /* ARtem Onair Comcard 11 */
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0305), /* Buffalo WLI-PCM-S11 */
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612), /* Linksys WPC11 Version 2.5 */
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1613), /* Linksys WPC11 Version 3 */
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 82354b974a04..c6a370fa9bcb 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -138,6 +138,7 @@ int p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw)
         u8 *fw_version = NULL;
         size_t len;
         int i;
+        int maxlen;
 
         if (priv->rx_start)
                 return 0;
@@ -195,6 +196,16 @@ int p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw)
                         else
                                 priv->rx_mtu = (size_t)
                                         0x620 - priv->tx_hdr_len;
+                        maxlen = priv->tx_hdr_len + /* USB devices */
+                                 sizeof(struct p54_rx_data) +
+                                 4 + /* rx alignment */
+                                 IEEE80211_MAX_FRAG_THRESHOLD;
+                        if (priv->rx_mtu > maxlen && PAGE_SIZE == 4096) {
+                                printk(KERN_INFO "p54: rx_mtu reduced from %d "
+                                                 "to %d\n", priv->rx_mtu,
+                                                 maxlen);
+                                priv->rx_mtu = maxlen;
+                        }
                         break;
                         }
                 case BR_CODE_EXPOSED_IF:
@@ -575,6 +586,7 @@ static int p54_rx_data(struct ieee80211_hw *dev, struct sk_buff *skb)
         u16 freq = le16_to_cpu(hdr->freq);
         size_t header_len = sizeof(*hdr);
         u32 tsf32;
+        u8 rate = hdr->rate & 0xf;
 
         /*
          * If the device is in a unspecified state we have to
@@ -603,8 +615,11 @@ static int p54_rx_data(struct ieee80211_hw *dev, struct sk_buff *skb)
         rx_status.qual = (100 * hdr->rssi) / 127;
         if (hdr->rate & 0x10)
                 rx_status.flag |= RX_FLAG_SHORTPRE;
-        rx_status.rate_idx = (dev->conf.channel->band == IEEE80211_BAND_2GHZ ?
-                        hdr->rate : (hdr->rate - 4)) & 0xf;
+        if (dev->conf.channel->band == IEEE80211_BAND_5GHZ)
+                rx_status.rate_idx = (rate < 4) ? 0 : rate - 4;
+        else
+                rx_status.rate_idx = rate;
+
         rx_status.freq = freq;
         rx_status.band =  dev->conf.channel->band;
         rx_status.antenna = hdr->antenna;
@@ -798,6 +813,16 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                         info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
                 info->status.ack_signal = p54_rssi_to_dbm(dev,
                                 (int)payload->ack_rssi);
+
+                if (entry_data->key_type == P54_CRYPTO_TKIPMICHAEL) {
+                        u8 *iv = (u8 *)(entry_data->align + pad +
+                                        entry_data->crypt_offset);
+
+                        /* Restore the original TKIP IV. */
+                        iv[2] = iv[0];
+                        iv[0] = iv[1];
+                        iv[1] = (iv[0] | 0x20) & 0x7f;  /* WEPSeed - 8.3.2.2 */
+                }
                 skb_pull(entry, sizeof(*hdr) + pad + sizeof(*entry_data));
                 ieee80211_tx_status_irqsafe(dev, entry);
                 goto out;
@@ -1383,7 +1408,6 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         hdr->tries = ridx;
         txhdr->rts_rate_idx = 0;
         if (info->control.hw_key) {
-                crypt_offset += info->control.hw_key->iv_len;
                 txhdr->key_type = p54_convert_algo(info->control.hw_key->alg);
                 txhdr->key_len = min((u8)16, info->control.hw_key->keylen);
                 memcpy(txhdr->key, info->control.hw_key->key, txhdr->key_len);
@@ -1397,6 +1421,8 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
                 }
                 /* reserve some space for ICV */
                 len += info->control.hw_key->icv_len;
+                memset(skb_put(skb, info->control.hw_key->icv_len), 0,
+                       info->control.hw_key->icv_len);
         } else {
                 txhdr->key_type = 0;
                 txhdr->key_len = 0;
@@ -1824,7 +1850,7 @@ static void p54_remove_interface(struct ieee80211_hw *dev,
 
 static int p54_config(struct ieee80211_hw *dev, u32 changed)
 {
-        int ret;
+        int ret = 0;
         struct p54_common *priv = dev->priv;
         struct ieee80211_conf *conf = &dev->conf;
 
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index c44a200059d2..6a6a72f6f82c 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -56,6 +56,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
+        {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
         {USB_DEVICE(0x0846, 0x4240)},   /* Netgear WG111 (v2) */
@@ -284,6 +285,7 @@ static void p54u_tx_lm87(struct ieee80211_hw *dev, struct sk_buff *skb)
         usb_fill_bulk_urb(data_urb, priv->udev,
                           usb_sndbulkpipe(priv->udev, P54U_PIPE_DATA),
                           skb->data, skb->len, p54u_tx_cb, skb);
+        data_urb->transfer_flags |= URB_ZERO_PACKET;
 
         usb_anchor_urb(data_urb, &priv->submitted);
         if (usb_submit_urb(data_urb, GFP_ATOMIC)) {
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 30028e2422fc..af6b5847be5c 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -38,7 +38,7 @@
 /*
  * Allow hardware encryption to be disabled.
  */
-static int modparam_nohwcrypt = 1;
+static int modparam_nohwcrypt = 0;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
@@ -376,11 +376,11 @@ static int rt2500usb_config_key(struct rt2x00_dev *rt2x00dev,
 
                 /*
                  * The driver does not support the IV/EIV generation
-                 * in hardware. However it doesn't support the IV/EIV
-                 * inside the ieee80211 frame either, but requires it
-                 * to be provided seperately for the descriptor.
-                 * rt2x00lib will cut the IV/EIV data out of all frames
-                 * given to us by mac80211, but we must tell mac80211
+                 * in hardware. However it demands the data to be provided
+                 * both seperately as well as inside the frame.
+                 * We already provided the CONFIG_CRYPTO_COPY_IV to rt2x00lib
+                 * to ensure rt2x00lib will not strip the data from the
+                 * frame after the copy, now we must tell mac80211
                  * to generate the IV/EIV data.
                  */
                 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
@@ -1181,7 +1181,7 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
-        rt2x00_set_field32(&word, TXD_W0_CIPHER, txdesc->cipher);
+        rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
         rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
         rt2x00_desc_write(txd, 0, word);
 }
@@ -1334,14 +1334,7 @@ static void rt2500usb_fill_rxdone(struct queue_entry *entry,
 
                 /* ICV is located at the end of frame */
 
-                /*
-                 * Hardware has stripped IV/EIV data from 802.11 frame during
-                 * decryption. It has provided the data seperately but rt2x00lib
-                 * should decide if it should be reinserted.
-                 */
-                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
-                if (rxdesc->cipher != CIPHER_TKIP)
-                        rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
+                rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
                 if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
                         rxdesc->flags |= RX_FLAG_DECRYPTED;
                 else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 6d92542fcf0d..87c0f2c83077 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -807,13 +807,11 @@ static void rt2x00lib_rate(struct ieee80211_rate *entry,
 {
         entry->flags = 0;
         entry->bitrate = rate->bitrate;
-        entry->hw_value = rt2x00_create_rate_hw_value(index, 0);
-        entry->hw_value_short = entry->hw_value;
+        entry->hw_value =index;
+        entry->hw_value_short = index;
 
-        if (rate->flags & DEV_RATE_SHORT_PREAMBLE) {
+        if (rate->flags & DEV_RATE_SHORT_PREAMBLE)
                 entry->flags |= IEEE80211_RATE_SHORT_PREAMBLE;
-                entry->hw_value_short |= rt2x00_create_rate_hw_value(index, 1);
-        }
 }
 
 static int rt2x00lib_probe_hw_modes(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.c b/drivers/net/wireless/rt2x00/rt2x00leds.c
index 68f4e0fc35b9..a0cd35b6beb5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00leds.c
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
@@ -97,7 +97,7 @@ void rt2x00leds_led_assoc(struct rt2x00_dev *rt2x00dev, bool enabled)
 
 void rt2x00leds_led_radio(struct rt2x00_dev *rt2x00dev, bool enabled)
 {
-        if (rt2x00dev->led_radio.type == LED_TYPE_ASSOC)
+        if (rt2x00dev->led_radio.type == LED_TYPE_RADIO)
                 rt2x00led_led_simple(&rt2x00dev->led_radio, enabled);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 03024327767b..86cd26fbf769 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -52,22 +52,11 @@ struct rt2x00_rate {
 
 extern const struct rt2x00_rate rt2x00_supported_rates[12];
 
-static inline u16 rt2x00_create_rate_hw_value(const u16 index,
-                                              const u16 short_preamble)
-{
-        return (short_preamble << 8) | (index & 0xff);
-}
-
 static inline const struct rt2x00_rate *rt2x00_get_rate(const u16 hw_value)
 {
         return &rt2x00_supported_rates[hw_value & 0xff];
 }
 
-static inline int rt2x00_get_rate_preamble(const u16 hw_value)
-{
-        return (hw_value & 0xff00);
-}
-
 /*
  * Radio control handlers.
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index eaec6bd93ed5..746a8f36b931 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -313,7 +313,7 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
                  * When preamble is enabled we should set the
                  * preamble bit for the signal.
                  */
-                if (rt2x00_get_rate_preamble(rate->hw_value))
+                if (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
                         txdesc->signal |= 0x08;
         }
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 83df312ac56f..0b29d767a258 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -434,11 +434,11 @@ static int rt2x00usb_find_endpoints(struct rt2x00_dev *rt2x00dev)
 
                 if (usb_endpoint_is_bulk_in(ep_desc)) {
                         rt2x00usb_assign_endpoint(rt2x00dev->rx, ep_desc);
-                } else if (usb_endpoint_is_bulk_out(ep_desc)) {
+                } else if (usb_endpoint_is_bulk_out(ep_desc) &&
+                           (queue != queue_end(rt2x00dev))) {
                         rt2x00usb_assign_endpoint(queue, ep_desc);
+                        queue = queue_next(queue);
 
-                        if (queue != queue_end(rt2x00dev))
-                                queue = queue_next(queue);
                         tx_ep_desc = ep_desc;
                 }
         }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index d638a8a59370..96a8d69f8790 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2321,6 +2321,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         /* Linksys */
         { USB_DEVICE(0x13b1, 0x0020), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x13b1, 0x0023), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x13b1, 0x0028), USB_DEVICE_DATA(&rt73usb_ops) },
         /* MSI */
         { USB_DEVICE(0x0db0, 0x6877), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0x6874), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 5f887fb137a9..387c133ec0f2 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -897,6 +897,7 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                      IEEE80211_HW_RX_INCLUDES_FCS |
                      IEEE80211_HW_SIGNAL_UNSPEC;
+        dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
         dev->queues = 1;
         dev->max_signal = 65;
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 00ce3ef39abe..6ad6bac37706 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -213,7 +213,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urb) {
                 kfree_skb(skb);
-                return -ENOMEM;
+                return NETDEV_TX_OK;
         }
 
         flags = skb->len;
@@ -281,7 +281,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         }
         usb_free_urb(urb);
 
-        return rc;
+        return NETDEV_TX_OK;
 }
 
 static void rtl8187_rx_cb(struct urb *urb)
@@ -1471,6 +1471,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
         ieee80211_unregister_hw(dev);
 
         priv = dev->priv;
+        usb_reset_device(priv->udev);
         usb_put_dev(interface_to_usbdev(intf));
         ieee80211_free_hw(dev);
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index c12f6c790698..e491fdedf705 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1260,15 +1260,14 @@ void pci_pm_init(struct pci_dev *dev)
         /* find PCI PM capability in list */
         pm = pci_find_capability(dev, PCI_CAP_ID_PM);
         if (!pm)
-                goto Exit;
-
+                return;
         /* Check device's ability to generate PME# */
         pci_read_config_word(dev, pm + PCI_PM_PMC, &pmc);
 
         if ((pmc & PCI_PM_CAP_VER_MASK) > 3) {
                 dev_err(&dev->dev, "unsupported PM cap regs version (%u)\n",
                         pmc & PCI_PM_CAP_VER_MASK);
-                goto Exit;
+                return;
         }
 
         dev->pm_cap = pm;
@@ -1307,9 +1306,6 @@ void pci_pm_init(struct pci_dev *dev)
         } else {
                 dev->pme_support = 0;
         }
-
- Exit:
-        pci_update_current_state(dev, PCI_D0);
 }
 
 /**
diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c
index cc7eb8767b82..bd56a033bfd0 100644
--- a/drivers/rtc/rtc-pxa.c
+++ b/drivers/rtc/rtc-pxa.c
@@ -27,6 +27,8 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 
+#include <mach/hardware.h>
+
 #define TIMER_FREQ              CLOCK_TICK_RATE
 #define RTC_DEF_DIVIDER         (32768 - 1)
 #define RTC_DEF_TRIM            0
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl4030.c
index 8ce5f74ee45b..ad35f76c46b7 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl4030.c
@@ -120,7 +120,7 @@ static int twl4030_rtc_write_u8(u8 data, u8 reg)
 static unsigned char rtc_irq_bits;
 
 /*
- * Enable timer and/or alarm interrupts.
+ * Enable 1/second update and/or alarm interrupts.
  */
 static int set_rtc_irq_bit(unsigned char bit)
 {
@@ -128,6 +128,7 @@ static int set_rtc_irq_bit(unsigned char bit)
         int ret;
 
         val = rtc_irq_bits | bit;
+        val &= ~BIT_RTC_INTERRUPTS_REG_EVERY_M;
         ret = twl4030_rtc_write_u8(val, REG_RTC_INTERRUPTS_REG);
         if (ret == 0)
                 rtc_irq_bits = val;
@@ -136,7 +137,7 @@ static int set_rtc_irq_bit(unsigned char bit)
 }
 
 /*
- * Disable timer and/or alarm interrupts.
+ * Disable update and/or alarm interrupts.
  */
 static int mask_rtc_irq_bit(unsigned char bit)
 {
@@ -151,7 +152,7 @@ static int mask_rtc_irq_bit(unsigned char bit)
         return ret;
 }
 
-static inline int twl4030_rtc_alarm_irq_set_state(int enabled)
+static int twl4030_rtc_alarm_irq_enable(struct device *dev, unsigned enabled)
 {
         int ret;
 
@@ -163,7 +164,7 @@ static inline int twl4030_rtc_alarm_irq_set_state(int enabled)
         return ret;
 }
 
-static inline int twl4030_rtc_irq_set_state(int enabled)
+static int twl4030_rtc_update_irq_enable(struct device *dev, unsigned enabled)
 {
         int ret;
 
@@ -292,7 +293,7 @@ static int twl4030_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
         unsigned char alarm_data[ALL_TIME_REGS + 1];
         int ret;
 
-        ret = twl4030_rtc_alarm_irq_set_state(0);
+        ret = twl4030_rtc_alarm_irq_enable(dev, 0);
         if (ret)
                 goto out;
 
@@ -312,35 +313,11 @@ static int twl4030_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
         }
 
         if (alm->enabled)
-                ret = twl4030_rtc_alarm_irq_set_state(1);
+                ret = twl4030_rtc_alarm_irq_enable(dev, 1);
 out:
         return ret;
 }
 
-#ifdef  CONFIG_RTC_INTF_DEV
-
-static int twl4030_rtc_ioctl(struct device *dev, unsigned int cmd,
-                             unsigned long arg)
-{
-        switch (cmd) {
-        case RTC_AIE_OFF:
-                return twl4030_rtc_alarm_irq_set_state(0);
-        case RTC_AIE_ON:
-                return twl4030_rtc_alarm_irq_set_state(1);
-        case RTC_UIE_OFF:
-                return twl4030_rtc_irq_set_state(0);
-        case RTC_UIE_ON:
-                return twl4030_rtc_irq_set_state(1);
-
-        default:
-                return -ENOIOCTLCMD;
-        }
-}
-
-#else
-#define twl4030_rtc_ioctl       NULL
-#endif
-
 static irqreturn_t twl4030_rtc_interrupt(int irq, void *rtc)
 {
         unsigned long events = 0;
@@ -400,11 +377,12 @@ out:
 }
 
 static struct rtc_class_ops twl4030_rtc_ops = {
-        .ioctl          = twl4030_rtc_ioctl,
         .read_time      = twl4030_rtc_read_time,
         .set_time       = twl4030_rtc_set_time,
         .read_alarm     = twl4030_rtc_read_alarm,
         .set_alarm      = twl4030_rtc_set_alarm,
+        .alarm_irq_enable = twl4030_rtc_alarm_irq_enable,
+        .update_irq_enable = twl4030_rtc_update_irq_enable,
 };
 
 /*----------------------------------------------------------------------*/
@@ -422,7 +400,7 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
         rtc = rtc_device_register(pdev->name,
                                   &pdev->dev, &twl4030_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc)) {
-                ret = -EINVAL;
+                ret = PTR_ERR(rtc);
                 dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
                         PTR_ERR(rtc));
                 goto out0;
@@ -432,7 +410,6 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, rtc);
 
         ret = twl4030_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
-
         if (ret < 0)
                 goto out1;
 
@@ -475,7 +452,6 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
 
         return ret;
 
-
 out2:
         free_irq(irq, rtc);
 out1:
@@ -506,8 +482,9 @@ static int __devexit twl4030_rtc_remove(struct platform_device *pdev)
 
 static void twl4030_rtc_shutdown(struct platform_device *pdev)
 {
-        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M |
-                         BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
+        /* mask timer interrupts, but leave alarm interrupts on to enable
+           power-on when alarm is triggered */
+        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index a745f91d2928..e7705d3532c9 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -177,7 +177,6 @@ int iscsi_tcp_segment_done(struct iscsi_tcp_conn *tcp_conn,
                            struct iscsi_segment *segment, int recv,
                            unsigned copied)
 {
-        static unsigned char padbuf[ISCSI_PAD_LEN];
         struct scatterlist sg;
         unsigned int pad;
 
@@ -233,7 +232,7 @@ int iscsi_tcp_segment_done(struct iscsi_tcp_conn *tcp_conn,
                         debug_tcp("consume %d pad bytes\n", pad);
                         segment->total_size += pad;
                         segment->size = pad;
-                        segment->data = padbuf;
+                        segment->data = segment->padbuf;
                         return 0;
                 }
         }
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 2d4f32b4df5c..9ad4d0968e5c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1258,35 +1258,48 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
 {
         int     rval;
         unsigned long flags = 0;
-        int cnt;
+        int cnt, que;
         struct qla_hw_data *ha = vha->hw;
-        struct req_que *req = ha->req_q_map[0];
-        struct rsp_que *rsp = ha->rsp_q_map[0];
+        struct req_que *req;
+        struct rsp_que *rsp;
+        struct scsi_qla_host *vp;
         struct mid_init_cb_24xx *mid_init_cb =
             (struct mid_init_cb_24xx *) ha->init_cb;
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
 
         /* Clear outstanding commands array. */
-        for (cnt = 0; cnt < MAX_OUTSTANDING_COMMANDS; cnt++)
-                req->outstanding_cmds[cnt] = NULL;
+        for (que = 0; que < ha->max_queues; que++) {
+                req = ha->req_q_map[que];
+                if (!req)
+                        continue;
+                for (cnt = 0; cnt < MAX_OUTSTANDING_COMMANDS; cnt++)
+                        req->outstanding_cmds[cnt] = NULL;
 
-        req->current_outstanding_cmd = 0;
+                req->current_outstanding_cmd = 0;
 
-        /* Clear RSCN queue. */
-        vha->rscn_in_ptr = 0;
-        vha->rscn_out_ptr = 0;
+                /* Initialize firmware. */
+                req->ring_ptr  = req->ring;
+                req->ring_index    = 0;
+                req->cnt      = req->length;
+        }
 
-        /* Initialize firmware. */
-        req->ring_ptr  = req->ring;
-        req->ring_index    = 0;
-        req->cnt      = req->length;
-        rsp->ring_ptr = rsp->ring;
-        rsp->ring_index    = 0;
+        for (que = 0; que < ha->max_queues; que++) {
+                rsp = ha->rsp_q_map[que];
+                if (!rsp)
+                        continue;
+                rsp->ring_ptr = rsp->ring;
+                rsp->ring_index    = 0;
 
-        /* Initialize response queue entries */
-        qla2x00_init_response_q_entries(rsp);
+                /* Initialize response queue entries */
+                qla2x00_init_response_q_entries(rsp);
+        }
 
+        /* Clear RSCN queue. */
+        list_for_each_entry(vp, &ha->vp_list, list) {
+                vp->rscn_in_ptr = 0;
+                vp->rscn_out_ptr = 0;
+        }
         ha->isp_ops->config_rings(vha);
 
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
@@ -3212,8 +3225,8 @@ qla2x00_loop_resync(scsi_qla_host_t *vha)
         int rval = QLA_SUCCESS;
         uint32_t wait_time;
         struct qla_hw_data *ha = vha->hw;
-        struct req_que *req = ha->req_q_map[0];
-        struct rsp_que *rsp = ha->rsp_q_map[0];
+        struct req_que *req = ha->req_q_map[vha->req_ques[0]];
+        struct rsp_que *rsp = req->rsp;
 
         atomic_set(&vha->loop_state, LOOP_UPDATE);
         clear_bit(ISP_ABORT_RETRY, &vha->dpc_flags);
@@ -3492,6 +3505,7 @@ qla25xx_init_queues(struct qla_hw_data *ha)
                 }
                 req = ha->req_q_map[i];
                 if (req) {
+                /* Clear outstanding commands array. */
                         req->options &= ~BIT_0;
                         ret = qla25xx_init_req_que(base_vha, req, req->options);
                         if (ret != QLA_SUCCESS)
@@ -3500,7 +3514,7 @@ qla25xx_init_queues(struct qla_hw_data *ha)
                                                 req->id));
                         else
                                 DEBUG2_17(printk(KERN_WARNING
-                                        "%s Rsp que:%d inited\n", __func__,
+                                        "%s Req que:%d inited\n", __func__,
                                                 req->id));
                 }
         }
@@ -4151,8 +4165,8 @@ qla24xx_configure_vhba(scsi_qla_host_t *vha)
         uint16_t mb[MAILBOX_REGISTER_COUNT];
         struct qla_hw_data *ha = vha->hw;
         struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
-        struct req_que *req = ha->req_q_map[0];
-        struct rsp_que *rsp = ha->rsp_q_map[0];
+        struct req_que *req = ha->req_q_map[vha->req_ques[0]];
+        struct rsp_que *rsp = req->rsp;
 
         if (!vha->vp_idx)
                 return -EINVAL;
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index 886323130fcc..f53179c46423 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -629,6 +629,7 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options,
         req->ring_index = 0;
         req->cnt = req->length;
         req->id = que_id;
+        req->max_q_depth = ha->req_q_map[0]->max_q_depth;
         mutex_unlock(&ha->vport_lock);
 
         ret = qla25xx_init_req_que(base_vha, req, options);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4a71f522f925..cf32653fe01a 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1158,8 +1158,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
         struct req_que *req;
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
-        for (que = 0; que < QLA_MAX_HOST_QUES; que++) {
-                req = ha->req_q_map[vha->req_ques[que]];
+        for (que = 0; que < ha->max_queues; que++) {
+                req = ha->req_q_map[que];
                 if (!req)
                         continue;
                 for (cnt = 1; cnt < MAX_OUTSTANDING_COMMANDS; cnt++) {
@@ -1193,7 +1193,7 @@ qla2xxx_slave_configure(struct scsi_device *sdev)
         scsi_qla_host_t *vha = shost_priv(sdev->host);
         struct qla_hw_data *ha = vha->hw;
         struct fc_rport *rport = starget_to_rport(sdev->sdev_target);
-        struct req_que *req = ha->req_q_map[0];
+        struct req_que *req = ha->req_q_map[vha->req_ques[0]];
 
         if (sdev->tagged_supported)
                 scsi_activate_tcq(sdev, req->max_q_depth);
@@ -1998,7 +1998,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         return 0;
 
 probe_failed:
-        qla2x00_free_que(ha, req, rsp);
         qla2x00_free_device(base_vha);
 
         scsi_host_put(base_vha->host);
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 42e72a2c1f98..cbcd3f681b62 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1095,7 +1095,8 @@ EXPORT_SYMBOL(__starget_for_each_device);
  * Description: Looks up the scsi_device with the specified @lun for a given
  * @starget.  The returned scsi_device does not have an additional
  * reference.  You must hold the host's host_lock over this call and
- * any access to the returned scsi_device.
+ * any access to the returned scsi_device. A scsi_device in state
+ * SDEV_DEL is skipped.
  *
  * Note:  The only reason why drivers should use this is because
  * they need to access the device list in irq context.  Otherwise you
@@ -1107,6 +1108,8 @@ struct scsi_device *__scsi_device_lookup_by_target(struct scsi_target *starget,
         struct scsi_device *sdev;
 
         list_for_each_entry(sdev, &starget->devices, same_target_siblings) {
+                if (sdev->sdev_state == SDEV_DEL)
+                        continue;
                 if (sdev->lun ==lun)
                         return sdev;
         }
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 4969e4ec75ea..099b5455bbce 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -224,6 +224,7 @@ static struct {
         {"SGI", "TP9100", "*", BLIST_REPORTLUN2},
         {"SGI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index c088146b7513..2a3671233b15 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -602,6 +602,10 @@ static int pci_netmos_init(struct pci_dev *dev)
         /* subdevice 0x00PS means <P> parallel, <S> serial */
         unsigned int num_serial = dev->subsystem_device & 0xf;
 
+        if (dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
+                        dev->subsystem_device == 0x0299)
+                return 0;
+
         if (num_serial == 0)
                 return -ENODEV;
         return num_serial;
@@ -3096,6 +3100,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                 0,
                 pbn_b0_8_115200 },
 
+        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
+                PCI_VENDOR_ID_IBM, 0x0299,
+                0, 0, pbn_b0_bt_2_115200 },
+
         /*
          * These entries match devices with class COMMUNICATION_SERIAL,
          * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index fde7f9ccf57e..bbcfc26a3b6d 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -270,6 +270,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
         {       "RSS0250",              0       },
         /* SupraExpress 28.8 Data/Fax PnP modem */
         {       "SUP1310",              0       },
+        /* SupraExpress 336i PnP Voice Modem */
+        {       "SUP1381",              0       },
         /* SupraExpress 33.6 Data/Fax PnP modem */
         {       "SUP1421",              0       },
         /* SupraExpress 33.6 Data/Fax PnP modem */
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index d5efd6c77904..89362d733d62 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -579,7 +579,7 @@ static void atmel_tx_dma(struct uart_port *port)
         /* disable PDC transmit */
         UART_PUT_PTCR(port, ATMEL_PDC_TXTDIS);
 
-        if (!uart_circ_empty(xmit)) {
+        if (!uart_circ_empty(xmit) && !uart_tx_stopped(port)) {
                 dma_sync_single_for_device(port->dev,
                                            pdc->dma_addr,
                                            pdc->dma_size,
diff --git a/drivers/serial/pnx8xxx_uart.c b/drivers/serial/pnx8xxx_uart.c
index 22e30d21225e..1bb8f1b45767 100644
--- a/drivers/serial/pnx8xxx_uart.c
+++ b/drivers/serial/pnx8xxx_uart.c
@@ -187,7 +187,7 @@ static void pnx8xxx_rx_chars(struct pnx8xxx_port *sport)
         status = FIFO_TO_SM(serial_in(sport, PNX8XXX_FIFO)) |
                  ISTAT_TO_SM(serial_in(sport, PNX8XXX_ISTAT));
         while (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFIFO)) {
-                ch = serial_in(sport, PNX8XXX_FIFO);
+                ch = serial_in(sport, PNX8XXX_FIFO) & 0xff;
 
                 sport->port.icount.rx++;
 
@@ -198,9 +198,16 @@ static void pnx8xxx_rx_chars(struct pnx8xxx_port *sport)
                  * out of the main execution path
                  */
                 if (status & (FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE |
-                                        PNX8XXX_UART_FIFO_RXPAR) |
+                                        PNX8XXX_UART_FIFO_RXPAR |
+                                        PNX8XXX_UART_FIFO_RXBRK) |
                               ISTAT_TO_SM(PNX8XXX_UART_INT_RXOVRN))) {
-                        if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR))
+                        if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXBRK)) {
+                                status &= ~(FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
+                                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR));
+                                sport->port.icount.brk++;
+                                if (uart_handle_break(&sport->port))
+                                        goto ignore_char;
+                        } else if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR))
                                 sport->port.icount.parity++;
                         else if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE))
                                 sport->port.icount.frame++;
@@ -284,14 +291,8 @@ static irqreturn_t pnx8xxx_int(int irq, void *dev_id)
         /* Get the interrupts */
         status  = serial_in(sport, PNX8XXX_ISTAT) & serial_in(sport, PNX8XXX_IEN);
 
-        /* Break signal received */
-        if (status & PNX8XXX_UART_INT_BREAK) {
-                sport->port.icount.brk++;
-                uart_handle_break(&sport->port);
-        }
-
-        /* Byte received */
-        if (status & PNX8XXX_UART_INT_RX)
+        /* Byte or break signal received */
+        if (status & (PNX8XXX_UART_INT_RX | PNX8XXX_UART_INT_BREAK))
                 pnx8xxx_rx_chars(sport);
 
         /* TX holding register empty - transmit a byte */
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 5e39bac9c51b..56ff3e6864ea 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -670,8 +670,7 @@ static int atmel_spi_transfer(struct spi_device *spi, struct spi_message *msg)
         dev_dbg(controller, "new message %p submitted for %s\n",
                         msg, spi->dev.bus_id);
 
-        if (unlikely(list_empty(&msg->transfers)
-                        || !spi->max_speed_hz))
+        if (unlikely(list_empty(&msg->transfers)))
                 return -EINVAL;
 
         if (as->stopping)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index d5d0e40b1e2d..94d5ee263c20 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1554,7 +1554,7 @@ static int usb_configure_device_otg(struct usb_device *udev)
                  * (Includes HNP test device.)
                  */
                 if (udev->bus->b_hnp_enable || udev->bus->is_b_host) {
-                        err = usb_port_suspend(udev);
+                        err = usb_port_suspend(udev, PMSG_SUSPEND);
                         if (err < 0)
                                 dev_dbg(&udev->dev, "HNP fail, %d\n", err);
                 }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ef6cfa5a447f..c70a8f667d85 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2030,7 +2030,7 @@ static void ftdi_process_read(struct work_struct *work)
                         spin_unlock_irqrestore(&priv->rx_lock, flags);
                         dbg("%s - deferring remainder until unthrottled",
                                         __func__);
-                        return;
+                        goto out;
                 }
                 spin_unlock_irqrestore(&priv->rx_lock, flags);
                 /* if the port is closed stop trying to read */
diff --git a/drivers/video/bf54x-lq043fb.c b/drivers/video/bf54x-lq043fb.c
index 7644ed249564..37e60b1d2ed9 100644
--- a/drivers/video/bf54x-lq043fb.c
+++ b/drivers/video/bf54x-lq043fb.c
@@ -335,7 +335,20 @@ static int bfin_bf54x_fb_check_var(struct fb_var_screeninfo *var,
                                    struct fb_info *info)
 {
 
-        if (var->bits_per_pixel != LCD_BPP) {
+        switch (var->bits_per_pixel) {
+        case 24:/* TRUECOLOUR, 16m */
+                var->red.offset = 16;
+                var->green.offset = 8;
+                var->blue.offset = 0;
+                var->red.length = var->green.length = var->blue.length = 8;
+                var->transp.offset = 0;
+                var->transp.length = 0;
+                var->transp.msb_right = 0;
+                var->red.msb_right = 0;
+                var->green.msb_right = 0;
+                var->blue.msb_right = 0;
+                break;
+        default:
                 pr_debug("%s: depth not supported: %u BPP\n", __func__,
                          var->bits_per_pixel);
                 return -EINVAL;
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index a9b3ada05d99..2a423d3a2a8e 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -254,7 +254,20 @@ static int bfin_t350mcqb_fb_check_var(struct fb_var_screeninfo *var,
                                    struct fb_info *info)
 {
 
-        if (var->bits_per_pixel != LCD_BPP) {
+        switch (var->bits_per_pixel) {
+        case 24:/* TRUECOLOUR, 16m */
+                var->red.offset = 0;
+                var->green.offset = 8;
+                var->blue.offset = 16;
+                var->red.length = var->green.length = var->blue.length = 8;
+                var->transp.offset = 0;
+                var->transp.length = 0;
+                var->transp.msb_right = 0;
+                var->red.msb_right = 0;
+                var->green.msb_right = 0;
+                var->blue.msb_right = 0;
+                break;
+        default:
                 pr_debug("%s: depth not supported: %u BPP\n", __func__,
                          var->bits_per_pixel);
                 return -EINVAL;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 0a14b495532f..7256cf242eb0 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -38,6 +38,7 @@
 #include <linux/namei.h>
 #include <linux/miscdevice.h>
 #include <linux/version.h>
+#include <linux/magic.h>
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -51,7 +52,6 @@
 #include "export.h"
 #include "compression.h"
 
-#define BTRFS_SUPER_MAGIC 0x9123683E
 
 static struct super_operations btrfs_super_ops;
 
diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
index 9a0fc400f91c..2999d72153b7 100644
--- a/fs/ext2/dir.c
+++ b/fs/ext2/dir.c
@@ -95,10 +95,13 @@ static int ext2_commit_chunk(struct page *page, loff_t pos, unsigned len)
                 mark_inode_dirty(dir);
         }
 
-        if (IS_DIRSYNC(dir))
+        if (IS_DIRSYNC(dir)) {
                 err = write_one_page(page, 1);
-        else
+                if (!err)
+                        err = ext2_sync_inode(dir);
+        } else {
                 unlock_page(page);
+        }
 
         return err;
 }
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index 6840da1bf21e..283daafc568e 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -26,7 +26,6 @@
 #define SQUASHFS_CACHED_FRAGMENTS       CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE
 #define SQUASHFS_MAJOR                  4
 #define SQUASHFS_MINOR                  0
-#define SQUASHFS_MAGIC                  0x73717368
 #define SQUASHFS_START                  0
 
 /* size of metadata (inode and directory) blocks */
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index a0466d7467b2..071df5b5b491 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -35,6 +35,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/zlib.h>
+#include <linux/magic.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
diff --git a/include/asm-generic/rtc.h b/include/asm-generic/rtc.h
index 89061c1a67d4..763e3b060f43 100644
--- a/include/asm-generic/rtc.h
+++ b/include/asm-generic/rtc.h
@@ -42,7 +42,7 @@ static inline unsigned char rtc_is_updating(void)
         return uip;
 }
 
-static inline unsigned int get_rtc_time(struct rtc_time *time)
+static inline unsigned int __get_rtc_time(struct rtc_time *time)
 {
         unsigned char ctrl;
         unsigned long flags;
@@ -108,8 +108,12 @@ static inline unsigned int get_rtc_time(struct rtc_time *time)
         return RTC_24H;
 }
 
+#ifndef get_rtc_time
+#define get_rtc_time    __get_rtc_time
+#endif
+
 /* Set the current date and time in the real time clock. */
-static inline int set_rtc_time(struct rtc_time *time)
+static inline int __set_rtc_time(struct rtc_time *time)
 {
         unsigned long flags;
         unsigned char mon, day, hrs, min, sec;
@@ -190,11 +194,15 @@ static inline int set_rtc_time(struct rtc_time *time)
         return 0;
 }
 
+#ifndef set_rtc_time
+#define set_rtc_time    __set_rtc_time
+#endif
+
 static inline unsigned int get_rtc_ss(void)
 {
         struct rtc_time h;
 
-        get_rtc_time(&h);
+        __get_rtc_time(&h);
         return h.tm_sec;
 }
 
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 0acb07f31fa4..47809ac94bc3 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -395,7 +395,7 @@ struct drm_connector_funcs {
         void (*save)(struct drm_connector *connector);
         void (*restore)(struct drm_connector *connector);
         enum drm_connector_status (*detect)(struct drm_connector *connector);
-        void (*fill_modes)(struct drm_connector *connector, uint32_t max_width, uint32_t max_height);
+        int (*fill_modes)(struct drm_connector *connector, uint32_t max_width, uint32_t max_height);
         int (*set_property)(struct drm_connector *connector, struct drm_property *property,
                              uint64_t val);
         void (*destroy)(struct drm_connector *connector);
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index 4bc04cf460a7..0c6f0e11b41b 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -88,7 +88,7 @@ struct drm_connector_helper_funcs {
         struct drm_encoder *(*best_encoder)(struct drm_connector *connector);
 };
 
-extern void drm_helper_probe_single_connector_modes(struct drm_connector *connector, uint32_t maxX, uint32_t maxY);
+extern int drm_helper_probe_single_connector_modes(struct drm_connector *connector, uint32_t maxX, uint32_t maxY);
 extern void drm_helper_disable_unused_functions(struct drm_device *dev);
 extern int drm_helper_hotplug_stage_two(struct drm_device *dev);
 extern bool drm_helper_initial_config(struct drm_device *dev, bool can_grow);
diff --git a/include/linux/agpgart.h b/include/linux/agpgart.h
index c8fdb6e658e1..110c600c885f 100644
--- a/include/linux/agpgart.h
+++ b/include/linux/agpgart.h
@@ -52,7 +52,6 @@
 
 #ifndef __KERNEL__
 #include <linux/types.h>
-#include <asm/types.h>
 
 struct agp_version {
         __u16 major;
diff --git a/include/linux/atm_idt77105.h b/include/linux/atm_idt77105.h
index 05621cf20709..8b724000aa50 100644
--- a/include/linux/atm_idt77105.h
+++ b/include/linux/atm_idt77105.h
@@ -7,7 +7,7 @@
 #ifndef LINUX_ATM_IDT77105_H
 #define LINUX_ATM_IDT77105_H
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <linux/atmioc.h>
 #include <linux/atmdev.h>
 
diff --git a/include/linux/capi.h b/include/linux/capi.h
index fdebaaa9f66e..65100d6cb89b 100644
--- a/include/linux/capi.h
+++ b/include/linux/capi.h
@@ -12,7 +12,7 @@
 #ifndef __LINUX_CAPI_H__
 #define __LINUX_CAPI_H__
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <linux/ioctl.h>
 #ifndef __KERNEL__
 #include <linux/kernelcapi.h>
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 5c7f9468f753..34f2789d9b9b 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -22,7 +22,7 @@
 #ifndef __CONNECTOR_H
 #define __CONNECTOR_H
 
-#include <asm/types.h>
+#include <linux/types.h>
 
 #define CN_IDX_CONNECTOR                0xffffffff
 #define CN_VAL_CONNECTOR                0xffffffff
diff --git a/include/linux/cyclades.h b/include/linux/cyclades.h
index 2d3d1e04ba92..d06fbf286346 100644
--- a/include/linux/cyclades.h
+++ b/include/linux/cyclades.h
@@ -150,8 +150,6 @@ struct CYZ_BOOT_CTRL {
  *      architectures and compilers.
  */
 
-#include <asm/types.h>
-
 typedef __u64  ucdouble;                /* 64 bits, unsigned */
 typedef __u32  uclong;                  /* 32 bits, unsigned */
 typedef __u16  ucshort;         /* 16 bits, unsigned */
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 1ee63df5be92..818fe21257e8 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -1,7 +1,7 @@
 #ifndef _LINUX_FB_H
 #define _LINUX_FB_H
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <linux/i2c.h>
 
 struct dentry;
diff --git a/include/linux/if_pppol2tp.h b/include/linux/if_pppol2tp.h
index a7d6a2234b31..c7a66882b6d0 100644
--- a/include/linux/if_pppol2tp.h
+++ b/include/linux/if_pppol2tp.h
@@ -15,7 +15,7 @@
 #ifndef __LINUX_IF_PPPOL2TP_H
 #define __LINUX_IF_PPPOL2TP_H
 
-#include <asm/types.h>
+#include <linux/types.h>
 
 #ifdef __KERNEL__
 #include <linux/in.h>
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 6fb7f1788570..30c88b2245ff 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -17,7 +17,7 @@
 #define __LINUX_IF_PPPOX_H
 
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <asm/byteorder.h>
 
 #ifdef  __KERNEL__
diff --git a/include/linux/input.h b/include/linux/input.h
index 9a6355f74db2..1249a0c20a38 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -16,7 +16,7 @@
 #include <sys/time.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
-#include <asm/types.h>
+#include <linux/types.h>
 #endif
 
 /*
diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index f6bb2ca8e3ba..32e4b2f72294 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -143,7 +143,8 @@ static inline unsigned long resource_type(struct resource *res)
 
 extern struct resource * __request_region(struct resource *,
                                         resource_size_t start,
-                                        resource_size_t n, const char *name, int relaxed);
+                                        resource_size_t n,
+                                        const char *name, int flags);
 
 /* Compatibility cruft */
 #define release_region(start,n) __release_region(&ioport_resource, (start), (n))
diff --git a/include/linux/jbd.h b/include/linux/jbd.h
index 6384b19efe64..64246dce5663 100644
--- a/include/linux/jbd.h
+++ b/include/linux/jbd.h
@@ -614,6 +614,8 @@ struct transaction_s
  * @j_wbufsize: maximum number of buffer_heads allowed in j_wbuf, the
  *      number that will fit in j_blocksize
  * @j_last_sync_writer: most recent pid which did a synchronous write
+ * @j_average_commit_time: the average amount of time in nanoseconds it
+ *      takes to commit a transaction to the disk.
  * @j_private: An opaque pointer to fs-private information.
  */
 
diff --git a/include/linux/joystick.h b/include/linux/joystick.h
index b5e051295a67..9e20c29c1e14 100644
--- a/include/linux/joystick.h
+++ b/include/linux/joystick.h
@@ -27,7 +27,7 @@
  * Vojtech Pavlik, Ucitelska 1576, Prague 8, 182 00 Czech Republic
  */
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <linux/input.h>
 
 /*
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index 35525ac63337..5715f1907601 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -7,7 +7,7 @@
  * Note: you must update KVM_API_VERSION if you change this interface.
  */
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <linux/compiler.h>
 #include <linux/ioctl.h>
 #include <asm/kvm.h>
diff --git a/include/linux/loop.h b/include/linux/loop.h
index 46169a7b559b..6ffd6db5bb0d 100644
--- a/include/linux/loop.h
+++ b/include/linux/loop.h
@@ -80,7 +80,7 @@ enum {
 };
 
 #include <asm/posix_types.h>    /* for __kernel_old_dev_t */
-#include <asm/types.h>          /* for __u64 */
+#include <linux/types.h>        /* for __u64 */
 
 /* Backwards compatibility version */
 struct loop_info {
diff --git a/include/linux/magic.h b/include/linux/magic.h
index 439f6f3cb0c4..0b4df7eba852 100644
--- a/include/linux/magic.h
+++ b/include/linux/magic.h
@@ -10,11 +10,13 @@
 #define SYSFS_MAGIC             0x62656572
 #define SECURITYFS_MAGIC        0x73636673
 #define TMPFS_MAGIC             0x01021994
+#define SQUASHFS_MAGIC          0x73717368
 #define EFS_SUPER_MAGIC         0x414A53
 #define EXT2_SUPER_MAGIC        0xEF53
 #define EXT3_SUPER_MAGIC        0xEF53
 #define XENFS_SUPER_MAGIC       0xabba1974
 #define EXT4_SUPER_MAGIC        0xEF53
+#define BTRFS_SUPER_MAGIC       0x9123683E
 #define HPFS_SUPER_MAGIC        0xf995e849
 #define ISOFS_SUPER_MAGIC       0x9660
 #define JFFS2_SUPER_MAGIC       0x72b6
diff --git a/include/linux/matroxfb.h b/include/linux/matroxfb.h
index ae5b09493062..404f678e734b 100644
--- a/include/linux/matroxfb.h
+++ b/include/linux/matroxfb.h
@@ -2,7 +2,7 @@
 #define __LINUX_MATROXFB_H__
 
 #include <asm/ioctl.h>
-#include <asm/types.h>
+#include <linux/types.h>
 #include <linux/videodev2.h>
 
 struct matroxioc_output_mode {
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f24556813375..ec54785d34f9 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -467,7 +467,7 @@ struct netdev_queue {
  *     This function is called when network device transistions to the down
  *     state.
  *
- * int (*ndo_hard_start_xmit)(struct sk_buff *skb, struct net_device *dev);
+ * int (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev);
  *      Called when a packet needs to be transmitted.
  *      Must return NETDEV_TX_OK , NETDEV_TX_BUSY, or NETDEV_TX_LOCKED,
  *      Required can not be NULL.
@@ -795,6 +795,7 @@ struct net_device
                NETREG_UNREGISTERING,    /* called unregister_netdevice */
                NETREG_UNREGISTERED,     /* completed unregister todo */
                NETREG_RELEASED,         /* called free_netdev */
+               NETREG_DUMMY,            /* dummy device for NAPI poll */
         } reg_state;
 
         /* Called from unregister, can be used to call free_netdev */
@@ -1077,6 +1078,8 @@ extern void		free_netdev(struct net_device *dev);
 extern void             synchronize_net(void);
 extern int              register_netdevice_notifier(struct notifier_block *nb);
 extern int              unregister_netdevice_notifier(struct notifier_block *nb);
+extern int              init_dummy_netdev(struct net_device *dev);
+
 extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 extern struct net_device        *dev_get_by_index(struct net *net, int ifindex);
 extern struct net_device        *__dev_get_by_index(struct net *net, int ifindex);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index e52ce475d19f..c7ee8744d26b 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -270,6 +270,7 @@ struct xt_match
         struct list_head list;
 
         const char name[XT_FUNCTION_MAXNAMELEN-1];
+        u_int8_t revision;
 
         /* Return true or false: return FALSE and set *hotdrop = 1 to
            force immediate packet drop. */
@@ -302,7 +303,6 @@ struct xt_match
         unsigned short proto;
 
         unsigned short family;
-        u_int8_t revision;
 };
 
 /* Registration hooks for targets. */
diff --git a/include/linux/phantom.h b/include/linux/phantom.h
index 02268c54c250..94dd6645c60a 100644
--- a/include/linux/phantom.h
+++ b/include/linux/phantom.h
@@ -10,7 +10,7 @@
 #ifndef __PHANTOM_H
 #define __PHANTOM_H
 
-#include <asm/types.h>
+#include <linux/types.h>
 
 /* PHN_(G/S)ET_REG param */
 struct phm_reg {
diff --git a/include/linux/radeonfb.h b/include/linux/radeonfb.h
index 5bd8975ed78e..8c4bbdecc44f 100644
--- a/include/linux/radeonfb.h
+++ b/include/linux/radeonfb.h
@@ -2,7 +2,7 @@
 #define __LINUX_RADEONFB_H__
 
 #include <asm/ioctl.h>
-#include <asm/types.h>
+#include <linux/types.h>
 
 #define ATY_RADEON_LCD_ON       0x00000001
 #define ATY_RADEON_CRT_ON       0x00000002
diff --git a/include/linux/res_counter.h b/include/linux/res_counter.h
index dede0a2cfc45..4c5bcf6ca7e8 100644
--- a/include/linux/res_counter.h
+++ b/include/linux/res_counter.h
@@ -9,7 +9,7 @@
  *
  * Author: Pavel Emelianov <xemul@openvz.org>
  *
- * See Documentation/controllers/resource_counter.txt for more
+ * See Documentation/cgroups/resource_counter.txt for more
  * info about what this counter is.
  */
 
diff --git a/include/scsi/libiscsi_tcp.h b/include/scsi/libiscsi_tcp.h
index 83e32f6d7859..9e3182e659db 100644
--- a/include/scsi/libiscsi_tcp.h
+++ b/include/scsi/libiscsi_tcp.h
@@ -39,6 +39,7 @@ struct iscsi_segment {
         unsigned int            total_copied;
 
         struct hash_desc        *hash;
+        unsigned char           padbuf[ISCSI_PAD_LEN];
         unsigned char           recv_digest[ISCSI_DIGEST_SIZE];
         unsigned char           digest[ISCSI_DIGEST_SIZE];
         unsigned int            digest_len;
diff --git a/init/Kconfig b/init/Kconfig
index a724a149bf3f..2af83825634e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -323,26 +323,26 @@ config CGROUP_SCHED
           This option allows you to create arbitrary task groups
           using the "cgroup" pseudo filesystem and control
           the cpu bandwidth allocated to each such task group.
-          Refer to Documentation/cgroups.txt for more information
-          on "cgroup" pseudo filesystem.
+          Refer to Documentation/cgroups/cgroups.txt for more
+          information on "cgroup" pseudo filesystem.
 
 endchoice
 
-menu "Control Group support"
-config CGROUPS
-        bool "Control Group support"
+menuconfig CGROUPS
+        boolean "Control Group support"
         help
-          This option add support for grouping sets of processes together, for
+          This option adds support for grouping sets of processes together, for
           use with process control subsystems such as Cpusets, CFS, memory
           controls or device isolation.
           See
-                - Documentation/cpusets.txt     (Cpusets)
                 - Documentation/scheduler/sched-design-CFS.txt  (CFS)
-                - Documentation/cgroups/ (features for grouping, isolation)
-                - Documentation/controllers/ (features for resource control)
+                - Documentation/cgroups/ (features for grouping, isolation
+                                          and resource control)
 
           Say N if unsure.
 
+if CGROUPS
+
 config CGROUP_DEBUG
         bool "Example debug cgroup subsystem"
         depends on CGROUPS
@@ -350,24 +350,24 @@ config CGROUP_DEBUG
         help
           This option enables a simple cgroup subsystem that
           exports useful debugging information about the cgroups
-          framework
+          framework.
 
-          Say N if unsure
+          Say N if unsure.
 
 config CGROUP_NS
-        bool "Namespace cgroup subsystem"
-        depends on CGROUPS
-        help
-          Provides a simple namespace cgroup subsystem to
-          provide hierarchical naming of sets of namespaces,
-          for instance virtual servers and checkpoint/restart
-          jobs.
+        bool "Namespace cgroup subsystem"
+        depends on CGROUPS
+        help
+          Provides a simple namespace cgroup subsystem to
+          provide hierarchical naming of sets of namespaces,
+          for instance virtual servers and checkpoint/restart
+          jobs.
 
 config CGROUP_FREEZER
-        bool "control group freezer subsystem"
-        depends on CGROUPS
-        help
-          Provides a way to freeze and unfreeze all tasks in a
+        bool "Freezer cgroup subsystem"
+        depends on CGROUPS
+        help
+          Provides a way to freeze and unfreeze all tasks in a
           cgroup.
 
 config CGROUP_DEVICE
@@ -388,18 +388,23 @@ config CPUSETS
 
           Say N if unsure.
 
+config PROC_PID_CPUSET
+        bool "Include legacy /proc/<pid>/cpuset file"
+        depends on CPUSETS
+        default y
+
 config CGROUP_CPUACCT
         bool "Simple CPU accounting cgroup subsystem"
         depends on CGROUPS
         help
           Provides a simple Resource Controller for monitoring the
-          total CPU consumed by the tasks in a cgroup
+          total CPU consumed by the tasks in a cgroup.
 
 config RESOURCE_COUNTERS
         bool "Resource counters"
         help
           This option enables controller independent resource accounting
-          infrastructure that works with cgroups
+          infrastructure that works with cgroups.
         depends on CGROUPS
 
 config CGROUP_MEM_RES_CTLR
@@ -425,9 +430,6 @@ config CGROUP_MEM_RES_CTLR
           This config option also selects MM_OWNER config option, which
           could in turn add some fork/exit overhead.
 
-config MM_OWNER
-        bool
-
 config CGROUP_MEM_RES_CTLR_SWAP
         bool "Memory Resource Controller Swap Extension(EXPERIMENTAL)"
         depends on CGROUP_MEM_RES_CTLR && SWAP && EXPERIMENTAL
@@ -444,8 +446,10 @@ config CGROUP_MEM_RES_CTLR_SWAP
           there will be no overhead from this. Even when you set this config=y,
           if boot option "noswapaccount" is set, swap will not be accounted.
 
+endif # CGROUPS
 
-endmenu
+config MM_OWNER
+        bool
 
 config SYSFS_DEPRECATED
         bool
@@ -483,11 +487,6 @@ config SYSFS_DEPRECATED_V2
           if the original kernel, that came with your distribution, has
           this option set to N.
 
-config PROC_PID_CPUSET
-        bool "Include legacy /proc/<pid>/cpuset file"
-        depends on CPUSETS
-        default y
-
 config RELAY
         bool "Kernel->user space relay support (formerly relayfs)"
         help
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 647c77a88fcb..a85678865c5e 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -568,7 +568,7 @@ update_domain_attr_tree(struct sched_domain_attr *dattr, struct cpuset *c)
  * load balancing domains (sched domains) as specified by that partial
  * partition.
  *
- * See "What is sched_load_balance" in Documentation/cpusets.txt
+ * See "What is sched_load_balance" in Documentation/cgroups/cpusets.txt
  * for a background explanation of this.
  *
  * Does not return errors, on the theory that the callers of this
diff --git a/kernel/resource.c b/kernel/resource.c
index ca6a1536b205..fd5d7d574bb9 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -620,6 +620,7 @@ resource_size_t resource_alignment(struct resource *res)
  * @start: resource start address
  * @n: resource region size
  * @name: reserving caller's ID string
+ * @flags: IO resource flags
  */
 struct resource * __request_region(struct resource *parent,
                                    resource_size_t start, resource_size_t n,
diff --git a/kernel/sched.c b/kernel/sched.c
index eb1931eef587..52bbf1c842a8 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -1323,8 +1323,8 @@ static inline void update_load_sub(struct load_weight *lw, unsigned long dec)
  * slice expiry etc.
  */
 
-#define WEIGHT_IDLEPRIO         2
-#define WMULT_IDLEPRIO          (1 << 31)
+#define WEIGHT_IDLEPRIO                3
+#define WMULT_IDLEPRIO         1431655765
 
 /*
  * Nice levels are multiplicative, with a gentle 10% change for every
@@ -4440,7 +4440,7 @@ void __kprobes sub_preempt_count(int val)
         /*
          * Underflow?
          */
-       if (DEBUG_LOCKS_WARN_ON(val > preempt_count() - (!!kernel_locked())))
+        if (DEBUG_LOCKS_WARN_ON(val > preempt_count()))
                 return;
         /*
          * Is the spinlock portion underflowing?
@@ -9050,6 +9050,13 @@ static int tg_schedulable(struct task_group *tg, void *data)
                 runtime = d->rt_runtime;
         }
 
+#ifdef CONFIG_USER_SCHED
+        if (tg == &root_task_group) {
+                period = global_rt_period();
+                runtime = global_rt_runtime();
+        }
+#endif
+
         /*
          * Cannot have more runtime than the period.
          */
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 8e1352c75557..5cc1c162044f 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -283,7 +283,7 @@ static void update_min_vruntime(struct cfs_rq *cfs_rq)
                                                    struct sched_entity,
                                                    run_node);
 
-                if (vruntime == cfs_rq->min_vruntime)
+                if (!cfs_rq->curr)
                         vruntime = se->vruntime;
                 else
                         vruntime = min_vruntime(vruntime, se->vruntime);
@@ -429,7 +429,10 @@ static u64 sched_slice(struct cfs_rq *cfs_rq, struct sched_entity *se)
         u64 slice = __sched_period(cfs_rq->nr_running + !se->on_rq);
 
         for_each_sched_entity(se) {
-                struct load_weight *load = &cfs_rq->load;
+                struct load_weight *load;
+
+                cfs_rq = cfs_rq_of(se);
+                load = &cfs_rq->load;
 
                 if (unlikely(!se->on_rq)) {
                         struct load_weight lw = cfs_rq->load;
@@ -677,9 +680,13 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
                         unsigned long thresh = sysctl_sched_latency;
 
                         /*
-                         * convert the sleeper threshold into virtual time
+                         * Convert the sleeper threshold into virtual time.
+                         * SCHED_IDLE is a special sub-class.  We care about
+                         * fairness only relative to other SCHED_IDLE tasks,
+                         * all of which have the same weight.
                          */
-                        if (sched_feat(NORMALIZED_SLEEPER))
+                        if (sched_feat(NORMALIZED_SLEEPER) &&
+                                        task_of(se)->policy != SCHED_IDLE)
                                 thresh = calc_delta_fair(thresh, se);
 
                         vruntime -= thresh;
@@ -1340,14 +1347,18 @@ wakeup_preempt_entity(struct sched_entity *curr, struct sched_entity *se)
 
 static void set_last_buddy(struct sched_entity *se)
 {
-        for_each_sched_entity(se)
-                cfs_rq_of(se)->last = se;
+        if (likely(task_of(se)->policy != SCHED_IDLE)) {
+                for_each_sched_entity(se)
+                        cfs_rq_of(se)->last = se;
+        }
 }
 
 static void set_next_buddy(struct sched_entity *se)
 {
-        for_each_sched_entity(se)
-                cfs_rq_of(se)->next = se;
+        if (likely(task_of(se)->policy != SCHED_IDLE)) {
+                for_each_sched_entity(se)
+                        cfs_rq_of(se)->next = se;
+        }
 }
 
 /*
@@ -1393,12 +1404,18 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int sync)
                 return;
 
         /*
-         * Batch tasks do not preempt (their preemption is driven by
+         * Batch and idle tasks do not preempt (their preemption is driven by
          * the tick):
          */
-        if (unlikely(p->policy == SCHED_BATCH))
+        if (unlikely(p->policy != SCHED_NORMAL))
                 return;
 
+        /* Idle tasks are by definition preempted by everybody. */
+        if (unlikely(curr->policy == SCHED_IDLE)) {
+                resched_task(curr);
+                return;
+        }
+
         if (!sched_feat(WAKEUP_PREEMPT))
                 return;
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 3e38b74b6124..368d1638ee78 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -144,6 +144,7 @@ extern int acct_parm[];
 
 #ifdef CONFIG_IA64
 extern int no_unaligned_warning;
+extern int unaligned_dump_stack;
 #endif
 
 #ifdef CONFIG_RT_MUTEXES
@@ -781,6 +782,14 @@ static struct ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
         },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "unaligned-dump-stack",
+                .data           = &unaligned_dump_stack,
+                .maxlen         = sizeof (int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
 #endif
 #ifdef CONFIG_DETECT_SOFTLOCKUP
         {
diff --git a/lib/idr.c b/lib/idr.c
index 1c4f9281f412..c11c5765cdef 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -121,7 +121,7 @@ int idr_pre_get(struct idr *idp, gfp_t gfp_mask)
 {
         while (idp->id_free_cnt < IDR_FREE_MAX) {
                 struct idr_layer *new;
-                new = kmem_cache_alloc(idr_layer_cache, gfp_mask);
+                new = kmem_cache_zalloc(idr_layer_cache, gfp_mask);
                 if (new == NULL)
                         return (0);
                 move_to_free_list(idp, new);
@@ -292,7 +292,7 @@ static int idr_get_new_above_int(struct idr *idp, void *ptr, int starting_id)
  * and go back to the idr_pre_get() call.  If the idr is full, it will
  * return -ENOSPC.
  *
- * @id returns a value in the range 0 ... 0x7fffffff
+ * @id returns a value in the range @starting_id ... 0x7fffffff
  */
 int idr_get_new_above(struct idr *idp, void *ptr, int starting_id, int *id)
 {
@@ -623,16 +623,10 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
 }
 EXPORT_SYMBOL(idr_replace);
 
-static void idr_cache_ctor(void *idr_layer)
-{
-        memset(idr_layer, 0, sizeof(struct idr_layer));
-}
-
 void __init idr_init_cache(void)
 {
         idr_layer_cache = kmem_cache_create("idr_layer_cache",
-                                sizeof(struct idr_layer), 0, SLAB_PANIC,
-                                idr_cache_ctor);
+                                sizeof(struct idr_layer), 0, SLAB_PANIC, NULL);
 }
 
 /**
@@ -723,7 +717,7 @@ EXPORT_SYMBOL(ida_pre_get);
  * and go back to the ida_pre_get() call.  If the ida is full, it will
  * return -ENOSPC.
  *
- * @p_id returns a value in the range 0 ... 0x7fffffff.
+ * @p_id returns a value in the range @starting_id ... 0x7fffffff.
  */
 int ida_get_new_above(struct ida *ida, int starting_id, int *p_id)
 {
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index e2996b80601f..4d0ea3ceba6d 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -358,6 +358,10 @@ void mem_cgroup_rotate_lru_list(struct page *page, enum lru_list lru)
                 return;
 
         pc = lookup_page_cgroup(page);
+        /*
+         * Used bit is set without atomic ops but after smp_wmb().
+         * For making pc->mem_cgroup visible, insert smp_rmb() here.
+         */
         smp_rmb();
         /* unused page is not rotated. */
         if (!PageCgroupUsed(pc))
@@ -374,7 +378,10 @@ void mem_cgroup_add_lru_list(struct page *page, enum lru_list lru)
         if (mem_cgroup_disabled())
                 return;
         pc = lookup_page_cgroup(page);
-        /* barrier to sync with "charge" */
+        /*
+         * Used bit is set without atomic ops but after smp_wmb().
+         * For making pc->mem_cgroup visible, insert smp_rmb() here.
+         */
         smp_rmb();
         if (!PageCgroupUsed(pc))
                 return;
@@ -559,6 +566,14 @@ mem_cgroup_get_reclaim_stat_from_page(struct page *page)
                 return NULL;
 
         pc = lookup_page_cgroup(page);
+        /*
+         * Used bit is set without atomic ops but after smp_wmb().
+         * For making pc->mem_cgroup visible, insert smp_rmb() here.
+         */
+        smp_rmb();
+        if (!PageCgroupUsed(pc))
+                return NULL;
+
         mz = page_cgroup_zoneinfo(pc);
         if (!mz)
                 return NULL;
@@ -618,7 +633,7 @@ unsigned long mem_cgroup_isolate_pages(unsigned long nr_to_scan,
  * called with hierarchy_mutex held
  */
 static struct mem_cgroup *
-mem_cgroup_get_next_node(struct mem_cgroup *curr, struct mem_cgroup *root_mem)
+__mem_cgroup_get_next_node(struct mem_cgroup *curr, struct mem_cgroup *root_mem)
 {
         struct cgroup *cgroup, *curr_cgroup, *root_cgroup;
 
@@ -629,19 +644,16 @@ mem_cgroup_get_next_node(struct mem_cgroup *curr, struct mem_cgroup *root_mem)
                 /*
                  * Walk down to children
                  */
-                mem_cgroup_put(curr);
                 cgroup = list_entry(curr_cgroup->children.next,
                                                 struct cgroup, sibling);
                 curr = mem_cgroup_from_cont(cgroup);
-                mem_cgroup_get(curr);
                 goto done;
         }
 
 visit_parent:
         if (curr_cgroup == root_cgroup) {
-                mem_cgroup_put(curr);
-                curr = root_mem;
-                mem_cgroup_get(curr);
+                /* caller handles NULL case */
+                curr = NULL;
                 goto done;
         }
 
@@ -649,11 +661,9 @@ visit_parent:
          * Goto next sibling
          */
         if (curr_cgroup->sibling.next != &curr_cgroup->parent->children) {
-                mem_cgroup_put(curr);
                 cgroup = list_entry(curr_cgroup->sibling.next, struct cgroup,
                                                 sibling);
                 curr = mem_cgroup_from_cont(cgroup);
-                mem_cgroup_get(curr);
                 goto done;
         }
 
@@ -664,7 +674,6 @@ visit_parent:
         goto visit_parent;
 
 done:
-        root_mem->last_scanned_child = curr;
         return curr;
 }
 
@@ -674,40 +683,46 @@ done:
  * that to reclaim free pages from.
  */
 static struct mem_cgroup *
-mem_cgroup_get_first_node(struct mem_cgroup *root_mem)
+mem_cgroup_get_next_node(struct mem_cgroup *root_mem)
 {
         struct cgroup *cgroup;
-        struct mem_cgroup *ret;
+        struct mem_cgroup *orig, *next;
         bool obsolete;
 
-        obsolete = mem_cgroup_is_obsolete(root_mem->last_scanned_child);
-
         /*
          * Scan all children under the mem_cgroup mem
          */
         mutex_lock(&mem_cgroup_subsys.hierarchy_mutex);
+
+        orig = root_mem->last_scanned_child;
+        obsolete = mem_cgroup_is_obsolete(orig);
+
         if (list_empty(&root_mem->css.cgroup->children)) {
-                ret = root_mem;
+                /*
+                 * root_mem might have children before and last_scanned_child
+                 * may point to one of them. We put it later.
+                 */
+                if (orig)
+                        VM_BUG_ON(!obsolete);
+                next = NULL;
                 goto done;
         }
 
-        if (!root_mem->last_scanned_child || obsolete) {
-
-                if (obsolete && root_mem->last_scanned_child)
-                        mem_cgroup_put(root_mem->last_scanned_child);
-
+        if (!orig || obsolete) {
                 cgroup = list_first_entry(&root_mem->css.cgroup->children,
                                 struct cgroup, sibling);
-                ret = mem_cgroup_from_cont(cgroup);
-                mem_cgroup_get(ret);
+                next = mem_cgroup_from_cont(cgroup);
         } else
-                ret = mem_cgroup_get_next_node(root_mem->last_scanned_child,
-                                                root_mem);
+                next = __mem_cgroup_get_next_node(orig, root_mem);
 
 done:
-        root_mem->last_scanned_child = ret;
+        if (next)
+                mem_cgroup_get(next);
+        root_mem->last_scanned_child = next;
+        if (orig)
+                mem_cgroup_put(orig);
         mutex_unlock(&mem_cgroup_subsys.hierarchy_mutex);
-        return ret;
+        return (next) ? next : root_mem;
 }
 
 static bool mem_cgroup_check_under_limit(struct mem_cgroup *mem)
@@ -758,28 +773,25 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
          * but there might be left over accounting, even after children
          * have left.
          */
-        ret = try_to_free_mem_cgroup_pages(root_mem, gfp_mask, noswap,
+        ret += try_to_free_mem_cgroup_pages(root_mem, gfp_mask, noswap,
                                            get_swappiness(root_mem));
         if (mem_cgroup_check_under_limit(root_mem))
-                return 0;
+                return 1;       /* indicate reclaim has succeeded */
         if (!root_mem->use_hierarchy)
                 return ret;
 
-        next_mem = mem_cgroup_get_first_node(root_mem);
+        next_mem = mem_cgroup_get_next_node(root_mem);
 
         while (next_mem != root_mem) {
                 if (mem_cgroup_is_obsolete(next_mem)) {
-                        mem_cgroup_put(next_mem);
-                        next_mem = mem_cgroup_get_first_node(root_mem);
+                        next_mem = mem_cgroup_get_next_node(root_mem);
                         continue;
                 }
-                ret = try_to_free_mem_cgroup_pages(next_mem, gfp_mask, noswap,
+                ret += try_to_free_mem_cgroup_pages(next_mem, gfp_mask, noswap,
                                                    get_swappiness(next_mem));
                 if (mem_cgroup_check_under_limit(root_mem))
-                        return 0;
-                mutex_lock(&mem_cgroup_subsys.hierarchy_mutex);
-                next_mem = mem_cgroup_get_next_node(next_mem, root_mem);
-                mutex_unlock(&mem_cgroup_subsys.hierarchy_mutex);
+                        return 1;       /* indicate reclaim has succeeded */
+                next_mem = mem_cgroup_get_next_node(root_mem);
         }
         return ret;
 }
@@ -863,6 +875,8 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
 
                 ret = mem_cgroup_hierarchical_reclaim(mem_over_limit, gfp_mask,
                                                         noswap);
+                if (ret)
+                        continue;
 
                 /*
                  * try_to_free_mem_cgroup_pages() might not give us a full
@@ -979,14 +993,15 @@ static int mem_cgroup_move_account(struct page_cgroup *pc,
         if (pc->mem_cgroup != from)
                 goto out;
 
-        css_put(&from->css);
         res_counter_uncharge(&from->res, PAGE_SIZE);
         mem_cgroup_charge_statistics(from, pc, false);
         if (do_swap_account)
                 res_counter_uncharge(&from->memsw, PAGE_SIZE);
+        css_put(&from->css);
+
+        css_get(&to->css);
         pc->mem_cgroup = to;
         mem_cgroup_charge_statistics(to, pc, true);
-        css_get(&to->css);
         ret = 0;
 out:
         unlock_page_cgroup(pc);
@@ -1019,8 +1034,10 @@ static int mem_cgroup_move_parent(struct page_cgroup *pc,
         if (ret || !parent)
                 return ret;
 
-        if (!get_page_unless_zero(page))
-                return -EBUSY;
+        if (!get_page_unless_zero(page)) {
+                ret = -EBUSY;
+                goto uncharge;
+        }
 
         ret = isolate_lru_page(page);
 
@@ -1029,19 +1046,23 @@ static int mem_cgroup_move_parent(struct page_cgroup *pc,
 
         ret = mem_cgroup_move_account(pc, child, parent);
 
-        /* drop extra refcnt by try_charge() (move_account increment one) */
-        css_put(&parent->css);
         putback_lru_page(page);
         if (!ret) {
                 put_page(page);
+                /* drop extra refcnt by try_charge() */
+                css_put(&parent->css);
                 return 0;
         }
-        /* uncharge if move fails */
+
 cancel:
+        put_page(page);
+uncharge:
+        /* drop extra refcnt by try_charge() */
+        css_put(&parent->css);
+        /* uncharge if move fails */
         res_counter_uncharge(&parent->res, PAGE_SIZE);
         if (do_swap_account)
                 res_counter_uncharge(&parent->memsw, PAGE_SIZE);
-        put_page(page);
         return ret;
 }
 
@@ -1971,6 +1992,7 @@ static int mem_cgroup_swappiness_write(struct cgroup *cgrp, struct cftype *cft,
 {
         struct mem_cgroup *memcg = mem_cgroup_from_cont(cgrp);
         struct mem_cgroup *parent;
+
         if (val > 100)
                 return -EINVAL;
 
@@ -1978,15 +2000,22 @@ static int mem_cgroup_swappiness_write(struct cgroup *cgrp, struct cftype *cft,
                 return -EINVAL;
 
         parent = mem_cgroup_from_cont(cgrp->parent);
+
+        cgroup_lock();
+
         /* If under hierarchy, only empty-root can set this value */
         if ((parent->use_hierarchy) ||
-            (memcg->use_hierarchy && !list_empty(&cgrp->children)))
+            (memcg->use_hierarchy && !list_empty(&cgrp->children))) {
+                cgroup_unlock();
                 return -EINVAL;
+        }
 
         spin_lock(&memcg->reclaim_param_lock);
         memcg->swappiness = val;
         spin_unlock(&memcg->reclaim_param_lock);
 
+        cgroup_unlock();
+
         return 0;
 }
 
@@ -2181,7 +2210,7 @@ static void __init enable_swap_cgroup(void)
 }
 #endif
 
-static struct cgroup_subsys_state *
+static struct cgroup_subsys_state * __ref
 mem_cgroup_create(struct cgroup_subsys *ss, struct cgroup *cont)
 {
         struct mem_cgroup *mem, *parent;
@@ -2232,7 +2261,14 @@ static void mem_cgroup_pre_destroy(struct cgroup_subsys *ss,
 static void mem_cgroup_destroy(struct cgroup_subsys *ss,
                                 struct cgroup *cont)
 {
-        mem_cgroup_put(mem_cgroup_from_cont(cont));
+        struct mem_cgroup *mem = mem_cgroup_from_cont(cont);
+        struct mem_cgroup *last_scanned_child = mem->last_scanned_child;
+
+        if (last_scanned_child) {
+                VM_BUG_ON(!mem_cgroup_is_obsolete(last_scanned_child));
+                mem_cgroup_put(last_scanned_child);
+        }
+        mem_cgroup_put(mem);
 }
 
 static int mem_cgroup_populate(struct cgroup_subsys *ss,
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index c5db9a7264d9..75f49d312e8c 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -14,7 +14,6 @@
 #include <linux/highmem.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
-#include <linux/mutex.h>
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -24,6 +23,7 @@
 #include <linux/rbtree.h>
 #include <linux/radix-tree.h>
 #include <linux/rcupdate.h>
+#include <linux/bootmem.h>
 
 #include <asm/atomic.h>
 #include <asm/uaccess.h>
@@ -495,7 +495,7 @@ static atomic_t vmap_lazy_nr = ATOMIC_INIT(0);
 static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
                                         int sync, int force_flush)
 {
-        static DEFINE_MUTEX(purge_lock);
+        static DEFINE_SPINLOCK(purge_lock);
         LIST_HEAD(valist);
         struct vmap_area *va;
         int nr = 0;
@@ -506,10 +506,10 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
          * the case that isn't actually used at the moment anyway.
          */
         if (!sync && !force_flush) {
-                if (!mutex_trylock(&purge_lock))
+                if (!spin_trylock(&purge_lock))
                         return;
         } else
-                mutex_lock(&purge_lock);
+                spin_lock(&purge_lock);
 
         rcu_read_lock();
         list_for_each_entry_rcu(va, &vmap_area_list, list) {
@@ -541,7 +541,7 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
                         __free_vmap_area(va);
                 spin_unlock(&vmap_area_lock);
         }
-        mutex_unlock(&purge_lock);
+        spin_unlock(&purge_lock);
 }
 
 /*
@@ -984,6 +984,8 @@ EXPORT_SYMBOL(vm_map_ram);
 
 void __init vmalloc_init(void)
 {
+        struct vmap_area *va;
+        struct vm_struct *tmp;
         int i;
 
         for_each_possible_cpu(i) {
@@ -996,6 +998,14 @@ void __init vmalloc_init(void)
                 vbq->nr_dirty = 0;
         }
 
+        /* Import existing vmlist entries. */
+        for (tmp = vmlist; tmp; tmp = tmp->next) {
+                va = alloc_bootmem(sizeof(struct vmap_area));
+                va->flags = tmp->flags | VM_VM_AREA;
+                va->va_start = (unsigned long)tmp->addr;
+                va->va_end = va->va_start + tmp->size;
+                __insert_vmap_area(va);
+        }
         vmap_initialized = true;
 }
 
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index 0663f99e977a..7ed75c7bd5d1 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -23,7 +23,7 @@ config NET_9P_VIRTIO
           guest partitions and a host partition.
 
 config NET_9P_RDMA
-        depends on INET && INFINIBAND && EXPERIMENTAL
+        depends on INET && INFINIBAND && INFINIBAND_ADDR_TRANS && EXPERIMENTAL
         tristate "9P RDMA Transport (Experimental)"
         help
           This builds support for an RDMA transport.
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index a65e43a17fbb..cf754ace0b75 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -58,11 +58,11 @@ static struct ctl_table_header *brnf_sysctl_header;
 static int brnf_call_iptables __read_mostly = 1;
 static int brnf_call_ip6tables __read_mostly = 1;
 static int brnf_call_arptables __read_mostly = 1;
-static int brnf_filter_vlan_tagged __read_mostly = 1;
-static int brnf_filter_pppoe_tagged __read_mostly = 1;
+static int brnf_filter_vlan_tagged __read_mostly = 0;
+static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #else
-#define brnf_filter_vlan_tagged 1
-#define brnf_filter_pppoe_tagged 1
+#define brnf_filter_vlan_tagged 0
+#define brnf_filter_pppoe_tagged 0
 #endif
 
 static inline __be16 vlan_proto(const struct sk_buff *skb)
@@ -686,8 +686,11 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
         if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
             IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else
+        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+                 IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
+        else
+                return NF_ACCEPT;
 
         nf_bridge_pull_encap_header(skb);
 
@@ -828,8 +831,11 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
         if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
             IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else
+        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+                 IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
+        else
+                return NF_ACCEPT;
 
 #ifdef CONFIG_NETFILTER_DEBUG
         if (skb->dst == NULL) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 8a8743d7d6e7..820252aee81f 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -79,7 +79,7 @@ static inline int ebt_do_match (struct ebt_entry_match *m,
 {
         par->match     = m->u.match;
         par->matchinfo = m->data;
-        return m->u.match->match(skb, par);
+        return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
 }
 
 static inline int ebt_dev_check(char *entry, const struct net_device *device)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 1649c8ab2c2f..b7c7d4651136 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -347,51 +347,54 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
         struct bcm_op *op = (struct bcm_op *)data;
         struct bcm_msg_head msg_head;
 
-        /* create notification to user */
-        msg_head.opcode  = TX_EXPIRED;
-        msg_head.flags   = op->flags;
-        msg_head.count   = op->count;
-        msg_head.ival1   = op->ival1;
-        msg_head.ival2   = op->ival2;
-        msg_head.can_id  = op->can_id;
-        msg_head.nframes = 0;
-
-        bcm_send_to_user(op, &msg_head, NULL, 0);
-}
-
-/*
- * bcm_tx_timeout_handler - performes cyclic CAN frame transmissions
- */
-static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
-{
-        struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
-        enum hrtimer_restart ret = HRTIMER_NORESTART;
-
         if (op->kt_ival1.tv64 && (op->count > 0)) {
 
                 op->count--;
-                if (!op->count && (op->flags & TX_COUNTEVT))
-                        tasklet_schedule(&op->tsklet);
+                if (!op->count && (op->flags & TX_COUNTEVT)) {
+
+                        /* create notification to user */
+                        msg_head.opcode  = TX_EXPIRED;
+                        msg_head.flags   = op->flags;
+                        msg_head.count   = op->count;
+                        msg_head.ival1   = op->ival1;
+                        msg_head.ival2   = op->ival2;
+                        msg_head.can_id  = op->can_id;
+                        msg_head.nframes = 0;
+
+                        bcm_send_to_user(op, &msg_head, NULL, 0);
+                }
         }
 
         if (op->kt_ival1.tv64 && (op->count > 0)) {
 
                 /* send (next) frame */
                 bcm_can_tx(op);
-                hrtimer_forward(hrtimer, ktime_get(), op->kt_ival1);
-                ret = HRTIMER_RESTART;
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
 
         } else {
                 if (op->kt_ival2.tv64) {
 
                         /* send (next) frame */
                         bcm_can_tx(op);
-                        hrtimer_forward(hrtimer, ktime_get(), op->kt_ival2);
-                        ret = HRTIMER_RESTART;
+                        hrtimer_start(&op->timer,
+                                      ktime_add(ktime_get(), op->kt_ival2),
+                                      HRTIMER_MODE_ABS);
                 }
         }
+}
 
-        return ret;
+/*
+ * bcm_tx_timeout_handler - performes cyclic CAN frame transmissions
+ */
+static enum hrtimer_restart bcm_tx_timeout_handler(struct hrtimer *hrtimer)
+{
+        struct bcm_op *op = container_of(hrtimer, struct bcm_op, timer);
+
+        tasklet_schedule(&op->tsklet);
+
+        return HRTIMER_NORESTART;
 }
 
 /*
diff --git a/net/core/dev.c b/net/core/dev.c
index b715a55cccc4..8d675975d85b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2392,6 +2392,9 @@ int dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
         if (!(skb->dev->features & NETIF_F_GRO))
                 goto normal;
 
+        if (skb_is_gso(skb) || skb_shinfo(skb)->frag_list)
+                goto normal;
+
         rcu_read_lock();
         list_for_each_entry_rcu(ptype, head, list) {
                 struct sk_buff *p;
@@ -2488,12 +2491,6 @@ EXPORT_SYMBOL(napi_gro_receive);
 
 void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
-        skb_shinfo(skb)->nr_frags = 0;
-
-        skb->len -= skb->data_len;
-        skb->truesize -= skb->data_len;
-        skb->data_len = 0;
-
         __skb_pull(skb, skb_headlen(skb));
         skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
 
@@ -4434,6 +4431,45 @@ err_uninit:
 }
 
 /**
+ *      init_dummy_netdev       - init a dummy network device for NAPI
+ *      @dev: device to init
+ *
+ *      This takes a network device structure and initialize the minimum
+ *      amount of fields so it can be used to schedule NAPI polls without
+ *      registering a full blown interface. This is to be used by drivers
+ *      that need to tie several hardware interfaces to a single NAPI
+ *      poll scheduler due to HW limitations.
+ */
+int init_dummy_netdev(struct net_device *dev)
+{
+        /* Clear everything. Note we don't initialize spinlocks
+         * are they aren't supposed to be taken by any of the
+         * NAPI code and this dummy netdev is supposed to be
+         * only ever used for NAPI polls
+         */
+        memset(dev, 0, sizeof(struct net_device));
+
+        /* make sure we BUG if trying to hit standard
+         * register/unregister code path
+         */
+        dev->reg_state = NETREG_DUMMY;
+
+        /* initialize the ref count */
+        atomic_set(&dev->refcnt, 1);
+
+        /* NAPI wants this */
+        INIT_LIST_HEAD(&dev->napi_list);
+
+        /* a dummy interface is started by default */
+        set_bit(__LINK_STATE_PRESENT, &dev->state);
+        set_bit(__LINK_STATE_START, &dev->state);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(init_dummy_netdev);
+
+
+/**
  *      register_netdev - register a network device
  *      @dev: device to register
  *
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5110b359c758..65eac7739033 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2602,6 +2602,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                        skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
 
                 skb_shinfo(p)->nr_frags += skb_shinfo(skb)->nr_frags;
+                skb_shinfo(skb)->nr_frags = 0;
+
+                skb->truesize -= skb->data_len;
+                skb->len -= skb->data_len;
+                skb->data_len = 0;
+
                 NAPI_GRO_CB(skb)->free = 1;
                 goto done;
         }
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index c9224310ebae..52cb6939d093 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -93,13 +93,8 @@ ipt_local_out_hook(unsigned int hook,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("iptable_filter: ignoring short SOCK_RAW "
-                               "packet.\n");
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
-
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_filter);
 }
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 69f2c4287146..3929d20b9e45 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -132,12 +132,8 @@ ipt_local_hook(unsigned int hook,
 
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("iptable_mangle: ignoring short SOCK_RAW "
-                               "packet.\n");
+            || ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
 
         /* Save things which could affect route */
         mark = skb->mark;
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 8faebfe638f1..7f65d18333e3 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -65,12 +65,8 @@ ipt_local_hook(unsigned int hook,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("iptable_raw: ignoring short SOCK_RAW "
-                               "packet.\n");
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_raw);
 }
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 36f3be3cc428..a52a35f4a584 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -96,12 +96,8 @@ ipt_local_out_hook(unsigned int hook,
 {
         /* Somebody is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk(KERN_INFO "iptable_security: ignoring short "
-                               "SOCK_RAW packet.\n");
+            || ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
         return ipt_do_table(skb, hook, in, out,
                             dev_net(out)->ipv4.iptable_security);
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index b2141e11575e..4beb04fac588 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -145,11 +145,8 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("ipt_hook: happy cracking.\n");
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
-        }
         return nf_conntrack_in(dev_net(out), PF_INET, hooknum, skb);
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 1fd3ef7718b6..2a8bee26f43d 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -20,7 +20,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_log.h>
 
-static unsigned long nf_ct_icmp_timeout __read_mostly = 30*HZ;
+static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
 
 static bool icmp_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
                               struct nf_conntrack_tuple *tuple)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ce572f9dff02..0cd71b84e483 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -522,8 +522,12 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
                                 unsigned int offset, size_t len)
 {
         struct tcp_splice_state *tss = rd_desc->arg.data;
+        int ret;
 
-        return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
+        ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
+        if (ret > 0)
+                rd_desc->count -= ret;
+        return ret;
 }
 
 static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
@@ -531,6 +535,7 @@ static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
         /* Store TCP splice context information in read_descriptor_t. */
         read_descriptor_t rd_desc = {
                 .arg.data = tss,
+                .count    = tss->len,
         };
 
         return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
@@ -611,11 +616,13 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                 tss.len -= ret;
                 spliced += ret;
 
+                if (!timeo)
+                        break;
                 release_sock(sk);
                 lock_sock(sk);
 
                 if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
-                    (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
+                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
                     signal_pending(current))
                         break;
         }
@@ -2382,7 +2389,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         unsigned int seq;
         __be32 delta;
         unsigned int oldlen;
-        unsigned int len;
+        unsigned int mss;
 
         if (!pskb_may_pull(skb, sizeof(*th)))
                 goto out;
@@ -2398,10 +2405,13 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         oldlen = (u16)~skb->len;
         __skb_pull(skb, thlen);
 
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
         if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
                 /* Packet is from an untrusted source, reset gso_segs. */
                 int type = skb_shinfo(skb)->gso_type;
-                int mss;
 
                 if (unlikely(type &
                              ~(SKB_GSO_TCPV4 |
@@ -2412,7 +2422,6 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                              !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))
                         goto out;
 
-                mss = skb_shinfo(skb)->gso_size;
                 skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
 
                 segs = NULL;
@@ -2423,8 +2432,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
         if (IS_ERR(segs))
                 goto out;
 
-        len = skb_shinfo(skb)->gso_size;
-        delta = htonl(oldlen + (thlen + len));
+        delta = htonl(oldlen + (thlen + mss));
 
         skb = segs;
         th = tcp_hdr(skb);
@@ -2440,7 +2448,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
                              csum_fold(csum_partial(skb_transport_header(skb),
                                                     thlen, skb->csum));
 
-                seq += len;
+                seq += mss;
                 skb = skb->next;
                 th = tcp_hdr(skb);
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 29c7c99e69f7..52ee1dced2ff 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -298,6 +298,10 @@ static void fib6_dump_end(struct netlink_callback *cb)
         struct fib6_walker_t *w = (void*)cb->args[2];
 
         if (w) {
+                if (cb->args[4]) {
+                        cb->args[4] = 0;
+                        fib6_walker_unlink(w);
+                }
                 cb->args[2] = 0;
                 kfree(w);
         }
@@ -330,15 +334,12 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
                 read_lock_bh(&table->tb6_lock);
                 res = fib6_walk_continue(w);
                 read_unlock_bh(&table->tb6_lock);
-                if (res != 0) {
-                        if (res < 0)
-                                fib6_walker_unlink(w);
-                        goto end;
+                if (res <= 0) {
+                        fib6_walker_unlink(w);
+                        cb->args[4] = 0;
                 }
-                fib6_walker_unlink(w);
-                cb->args[4] = 0;
         }
-end:
+
         return res;
 }
 
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index bd52151d31e9..c455cf4ee756 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -26,7 +26,7 @@
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 #include <net/netfilter/nf_log.h>
 
-static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
+static unsigned int nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 
 static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 5f510a13b9f0..c5c0c5271096 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -469,7 +469,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
         struct ieee80211_sub_if_data *sdata;
         u16 start_seq_num;
         u8 *state;
-        int ret;
+        int ret = 0;
 
         if ((tid >= STA_TID_NUM) || !(hw->flags & IEEE80211_HW_AMPDU_AGGREGATION))
                 return -EINVAL;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5abbc3f07dd6..b9074824862a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -699,7 +699,8 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                 return 0;
 
         /* Setting ad-hoc mode on non-IBSS channel is not supported. */
-        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS)
+        if (sdata->local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS &&
+            type == NL80211_IFTYPE_ADHOC)
                 return -EOPNOTSUPP;
 
         /*
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 929ba542fd72..1159bdb4119c 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -107,6 +107,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
 
         sta->flags = WLAN_STA_AUTHORIZED;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
+        rate_control_rate_init(sta);
 
         return sta;
 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 2b3b490a6073..3824990d340b 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -395,13 +395,15 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
-        struct minstrel_rate *mr_ctl;
+        struct ieee80211_local *local = hw_to_local(mp->hw);
+        struct ieee80211_rate *ctl_rate;
         unsigned int i, n = 0;
         unsigned int t_slot = 9; /* FIXME: get real slot time */
 
         mi->lowest_rix = rate_lowest_index(sband, sta);
-        mr_ctl = &mi->r[rix_to_ndx(mi, mi->lowest_rix)];
-        mi->sp_ack_dur = mr_ctl->ack_time;
+        ctl_rate = &sband->bitrates[mi->lowest_rix];
+        mi->sp_ack_dur = ieee80211_frame_duration(local, 10, ctl_rate->bitrate,
+                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
 
         for (i = 0; i < sband->n_bitrates; i++) {
                 struct minstrel_rate *mr = &mi->r[n];
@@ -416,7 +418,7 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
 
                 mr->rix = i;
                 mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(mi, hw_to_local(mp->hw), mr,
+                calc_rate_durations(mi, local, mr,
                                 &sband->bitrates[i]);
 
                 /* calculate maximum number of retransmissions before
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7e83f74cd5de..90ce9ddb9451 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -469,7 +469,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
                                    const struct nf_conntrack_tuple *repl,
                                    gfp_t gfp)
 {
-        struct nf_conn *ct = NULL;
+        struct nf_conn *ct;
 
         if (unlikely(!nf_conntrack_hash_rnd_initted)) {
                 get_random_bytes(&nf_conntrack_hash_rnd, 4);
@@ -551,7 +551,7 @@ init_conntrack(struct net *net,
         }
 
         ct = nf_conntrack_alloc(net, tuple, &repl_tuple, GFP_ATOMIC);
-        if (ct == NULL || IS_ERR(ct)) {
+        if (IS_ERR(ct)) {
                 pr_debug("Can't allocate conntrack.\n");
                 return (struct nf_conntrack_tuple_hash *)ct;
         }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 00e8c27130ff..3dddec6d2f7e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1134,7 +1134,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         struct nf_conntrack_helper *helper;
 
         ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
-        if (ct == NULL || IS_ERR(ct))
+        if (IS_ERR(ct))
                 return -ENOMEM;
 
         if (!cda[CTA_TIMEOUT])
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 89837a4eef76..bfbf521f6ea5 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -273,6 +273,10 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp)
                                 have_rev = 1;
                 }
         }
+
+        if (af != NFPROTO_UNSPEC && !have_rev)
+                return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
+
         return have_rev;
 }
 
@@ -289,6 +293,10 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp)
                                 have_rev = 1;
                 }
         }
+
+        if (af != NFPROTO_UNSPEC && !have_rev)
+                return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
+
         return have_rev;
 }
 
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index 29375ba8db73..93acaa59d108 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -243,6 +243,17 @@ static struct xt_match xt_time_mt_reg __read_mostly = {
 
 static int __init time_mt_init(void)
 {
+        int minutes = sys_tz.tz_minuteswest;
+
+        if (minutes < 0) /* east of Greenwich */
+                printk(KERN_INFO KBUILD_MODNAME
+                       ": kernel timezone is +%02d%02d\n",
+                       -minutes / 60, -minutes % 60);
+        else /* west of Greenwich */
+                printk(KERN_INFO KBUILD_MODNAME
+                       ": kernel timezone is -%02d%02d\n",
+                       minutes / 60, minutes % 60);
+
         return xt_register_match(&xt_time_mt_reg);
 }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 5070643ce534..2f0f0b04d3fb 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -661,12 +661,13 @@ static void htb_charge_class(struct htb_sched *q, struct htb_class *cl,
  * next pending event (0 for no event in pq).
  * Note: Applied are events whose have cl->pq_key <= q->now.
  */
-static psched_time_t htb_do_events(struct htb_sched *q, int level)
+static psched_time_t htb_do_events(struct htb_sched *q, int level,
+                                   unsigned long start)
 {
         /* don't run for longer than 2 jiffies; 2 is used instead of
            1 to simplify things when jiffy is going to be incremented
            too soon */
-        unsigned long stop_at = jiffies + 2;
+        unsigned long stop_at = start + 2;
         while (time_before(jiffies, stop_at)) {
                 struct htb_class *cl;
                 long diff;
@@ -685,8 +686,8 @@ static psched_time_t htb_do_events(struct htb_sched *q, int level)
                 if (cl->cmode != HTB_CAN_SEND)
                         htb_add_to_wait_tree(q, cl, diff);
         }
-        /* too much load - let's continue on next jiffie */
-        return q->now + PSCHED_TICKS_PER_SEC / HZ;
+        /* too much load - let's continue on next jiffie (including above) */
+        return q->now + 2 * PSCHED_TICKS_PER_SEC / HZ;
 }
 
 /* Returns class->node+prio from id-tree where classe's id is >= id. NULL
@@ -845,6 +846,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         struct htb_sched *q = qdisc_priv(sch);
         int level;
         psched_time_t next_event;
+        unsigned long start_at;
 
         /* try to dequeue direct packets as high prio (!) to minimize cpu work */
         skb = __skb_dequeue(&q->direct_queue);
@@ -857,6 +859,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         if (!sch->q.qlen)
                 goto fin;
         q->now = psched_get_time();
+        start_at = jiffies;
 
         next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
 
@@ -866,14 +869,14 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                 psched_time_t event;
 
                 if (q->now >= q->near_ev_cache[level]) {
-                        event = htb_do_events(q, level);
+                        event = htb_do_events(q, level, start_at);
                         if (!event)
                                 event = q->now + PSCHED_TICKS_PER_SEC;
                         q->near_ev_cache[level] = event;
                 } else
                         event = q->near_ev_cache[level];
 
-                if (event && next_event > event)
+                if (next_event > event)
                         next_event = event;
 
                 m = ~q->row_mask[level];
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b95a2d64eb59..7877e7975dae 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1914,10 +1914,17 @@ static int xfrm_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
 }
 #endif
 
+/* For the xfrm_usersa_info cases we have to work around some 32-bit vs.
+ * 64-bit compatability issues.  On 32-bit the structure is 220 bytes, but
+ * for 64-bit it gets padded out to 224 bytes.  Those bytes are just
+ * padding and don't have any content we care about.  Therefore as long
+ * as we have enough bytes for the content we can make both cases work.
+ */
+
 #define XMSGSIZE(type) sizeof(struct type)
 
 static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
-        [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
+        [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = 220, /* see above */
         [XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
         [XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
         [XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
@@ -1927,7 +1934,7 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
         [XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
         [XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
         [XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
-        [XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
+        [XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = 220, /* see above */
         [XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
         [XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
         [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = 0,
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 7bed4ed2c519..45eb0ae98eba 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -10,7 +10,7 @@ use strict;
 my $P = $0;
 $P =~ s@.*/@@g;
 
-my $V = '0.26';
+my $V = '0.27';
 
 use Getopt::Long qw(:config no_auto_abbrev);
 
@@ -411,13 +411,15 @@ sub ctx_statement_block {
 
         my $type = '';
         my $level = 0;
-        my @stack = ([$type, $level]);
+        my @stack = ();
         my $p;
         my $c;
         my $len = 0;
 
         my $remainder;
         while (1) {
+                @stack = (['', 0]) if ($#stack == -1);
+
                 #warn "CSB: blk<$blk> remain<$remain>\n";
                 # If we are about to drop off the end, pull in more
                 # context.
@@ -1663,7 +1665,7 @@ sub process {
                         # Should not end with a space.
                         $to =~ s/\s+$//;
                         # '*'s should not have spaces between.
-                        while ($to =~ s/(.)\s\*/$1\*/) {
+                        while ($to =~ s/\*\s+\*/\*\*/) {
                         }
 
                         #print "from<$from> to<$to>\n";
@@ -1678,7 +1680,7 @@ sub process {
                         # Should not end with a space.
                         $to =~ s/\s+$//;
                         # '*'s should not have spaces between.
-                        while ($to =~ s/(.)\s\*/$1\*/) {
+                        while ($to =~ s/\*\s+\*/\*\*/) {
                         }
                         # Modifiers should have spaces.
                         $to =~ s/(\b$Modifier$)/$1 /;
@@ -2014,7 +2016,11 @@ sub process {
 
                         # Flatten any parentheses
                         $value =~ s/\)\(/\) \(/g;
-                        while ($value !~ /(?:$Ident|-?$Constant)\s*$Compare\s*(?:$Ident|-?$Constant)/ && $value =~ s/\([^\(\)]*\)/1/) {
+                        while ($value =~ s/\[[^\{\}]*\]/1/ ||
+                               $value !~ /(?:$Ident|-?$Constant)\s*
+                                             $Compare\s*
+                                             (?:$Ident|-?$Constant)/x &&
+                               $value =~ s/\([^\(\)]*\)/1/) {
                         }
 
                         if ($value =~ /^(?:$Ident|-?$Constant)$/) {
@@ -2102,6 +2108,11 @@ sub process {
                                 ERROR("trailing statements should be on next line\n" . $herecurr);
                         }
                 }
+# if should not continue a brace
+                if ($line =~ /}\s*if\b/) {
+                        ERROR("trailing statements should be on next line\n" .
+                                $herecurr);
+                }
 # case and default should not have general statements after them
                 if ($line =~ /^.\s*(?:case\s*.*|default\s*):/g &&
                     $line !~ /\G(?:
@@ -2516,9 +2527,10 @@ sub process {
                         WARN("please use device_initcall() instead of __initcall()\n" . $herecurr);
                 }
 # check for struct file_operations, ensure they are const.
-                if ($line =~ /\bstruct\s+file_operations\b/ &&
-                    $line !~ /\bconst\b/) {
-                        WARN("struct file_operations should normally be const\n" . $herecurr);
+                if ($line !~ /\bconst\b/ &&
+                    $line =~ /\bstruct\s+(file_operations|seq_operations)\b/) {
+                        WARN("struct $1 should normally be const\n" .
+                                $herecurr);
                 }
 
 # use of NR_CPUS is usually wrong
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 3c596da2b9b5..b7bba7dc7cf1 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2724,6 +2724,67 @@ int snd_hda_check_board_config(struct hda_codec *codec,
 EXPORT_SYMBOL_HDA(snd_hda_check_board_config);
 
 /**
+ * snd_hda_check_board_codec_sid_config - compare the current codec
+                                          subsystem ID with the
+                                          config table
+
+           This is important for Gateway notebooks with SB450 HDA Audio
+           where the vendor ID of the PCI device is:
+                ATI Technologies Inc SB450 HDA Audio [1002:437b]
+           and the vendor/subvendor are found only at the codec.
+
+ * @codec: the HDA codec
+ * @num_configs: number of config enums
+ * @models: array of model name strings
+ * @tbl: configuration table, terminated by null entries
+ *
+ * Compares the modelname or PCI subsystem id of the current codec with the
+ * given configuration table.  If a matching entry is found, returns its
+ * config value (supposed to be 0 or positive).
+ *
+ * If no entries are matching, the function returns a negative value.
+ */
+int snd_hda_check_board_codec_sid_config(struct hda_codec *codec,
+                               int num_configs, const char **models,
+                               const struct snd_pci_quirk *tbl)
+{
+        const struct snd_pci_quirk *q;
+
+        /* Search for codec ID */
+        for (q = tbl; q->subvendor; q++) {
+                unsigned long vendorid = (q->subdevice) | (q->subvendor << 16);
+
+                if (vendorid == codec->subsystem_id)
+                        break;
+        }
+
+        if (!q->subvendor)
+                return -1;
+
+        tbl = q;
+
+        if (tbl->value >= 0 && tbl->value < num_configs) {
+#ifdef CONFIG_SND_DEBUG_DETECT
+                char tmp[10];
+                const char *model = NULL;
+                if (models)
+                        model = models[tbl->value];
+                if (!model) {
+                        sprintf(tmp, "#%d", tbl->value);
+                        model = tmp;
+                }
+                snd_printdd(KERN_INFO "hda_codec: model '%s' is selected "
+                            "for config %x:%x (%s)\n",
+                            model, tbl->subvendor, tbl->subdevice,
+                            (tbl->name ? tbl->name : "Unknown device"));
+#endif
+                return tbl->value;
+        }
+        return -1;
+}
+EXPORT_SYMBOL_HDA(snd_hda_check_board_codec_sid_config);
+
+/**
  * snd_hda_add_new_ctls - create controls from the array
  * @codec: the HDA codec
  * @knew: the array of struct snd_kcontrol_new
@@ -2815,7 +2876,7 @@ void snd_hda_power_down(struct hda_codec *codec)
                 return;
         if (power_save(codec)) {
                 codec->power_transition = 1; /* avoid reentrance */
-                schedule_delayed_work(&codec->power_work,
+                queue_delayed_work(codec->bus->workq, &codec->power_work,
                                 msecs_to_jiffies(power_save(codec) * 1000));
         }
 }
diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
index 6f2fe0f9fdd8..1dd8716c387f 100644
--- a/sound/pci/hda/hda_local.h
+++ b/sound/pci/hda/hda_local.h
@@ -296,6 +296,9 @@ void snd_print_pcm_bits(int pcm, char *buf, int buflen);
 int snd_hda_check_board_config(struct hda_codec *codec, int num_configs,
                                const char **modelnames,
                                const struct snd_pci_quirk *pci_list);
+int snd_hda_check_board_codec_sid_config(struct hda_codec *codec,
+                               int num_configs, const char **models,
+                               const struct snd_pci_quirk *tbl);
 int snd_hda_add_new_ctls(struct hda_codec *codec,
                          struct snd_kcontrol_new *knew);
 
diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
index 96952a37d884..d57d8132a06e 100644
--- a/sound/pci/hda/patch_nvhdmi.c
+++ b/sound/pci/hda/patch_nvhdmi.c
@@ -160,6 +160,7 @@ static int patch_nvhdmi(struct hda_codec *codec)
  */
 static struct hda_codec_preset snd_hda_preset_nvhdmi[] = {
         { .id = 0x10de0002, .name = "MCP78 HDMI", .patch = patch_nvhdmi },
+        { .id = 0x10de0006, .name = "MCP78 HDMI", .patch = patch_nvhdmi },
         { .id = 0x10de0007, .name = "MCP7A HDMI", .patch = patch_nvhdmi },
         { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi },
         { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi },
@@ -167,6 +168,7 @@ static struct hda_codec_preset snd_hda_preset_nvhdmi[] = {
 };
 
 MODULE_ALIAS("snd-hda-codec-id:10de0002");
+MODULE_ALIAS("snd-hda-codec-id:10de0006");
 MODULE_ALIAS("snd-hda-codec-id:10de0007");
 MODULE_ALIAS("snd-hda-codec-id:10de0067");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ea4c88fe05c4..82dd08431970 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10573,6 +10573,7 @@ static struct snd_pci_quirk alc262_cfg_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FUJITSU),
         SND_PCI_QUIRK(0x144d, 0xc032, "Samsung Q1 Ultra", ALC262_ULTRA),
         SND_PCI_QUIRK(0x144d, 0xc039, "Samsung Q1U EL", ALC262_ULTRA),
+        SND_PCI_QUIRK(0x144d, 0xc510, "Samsung Q45", ALC262_HIPPO),
         SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000 y410", ALC262_LENOVO_3000),
         SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_BENQ_ED8),
         SND_PCI_QUIRK(0x17ff, 0x058d, "Benq T31-16", ALC262_BENQ_T31),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 35b83dc6e19e..c39deebb588f 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -55,7 +55,8 @@ enum {
         STAC_9200_DELL_M25,
         STAC_9200_DELL_M26,
         STAC_9200_DELL_M27,
-        STAC_9200_GATEWAY,
+        STAC_9200_M4,
+        STAC_9200_M4_2,
         STAC_9200_PANASONIC,
         STAC_9200_MODELS
 };
@@ -89,14 +90,19 @@ enum {
         STAC_DELL_M4_2,
         STAC_DELL_M4_3,
         STAC_HP_M4,
+        STAC_HP_DV5,
         STAC_92HD71BXX_MODELS
 };
 
 enum {
         STAC_925x_REF,
+        STAC_M1,
+        STAC_M1_2,
+        STAC_M2,
         STAC_M2_2,
-        STAC_MA6,
-        STAC_PA6,
+        STAC_M3,
+        STAC_M5,
+        STAC_M6,
         STAC_925x_MODELS
 };
 
@@ -331,6 +337,10 @@ static unsigned int stac92hd83xxx_pwr_mapping[4] = {
         0x03, 0x0c, 0x10, 0x40,
 };
 
+static hda_nid_t stac92hd83xxx_amp_nids[1] = {
+        0xc,
+};
+
 static hda_nid_t stac92hd71bxx_pwr_nids[3] = {
         0x0a, 0x0d, 0x0f
 };
@@ -875,6 +885,8 @@ static struct hda_verb stac92hd71bxx_analog_core_init[] = {
 static struct hda_verb stac925x_core_init[] = {
         /* set dac0mux for dac converter */
         { 0x06, AC_VERB_SET_CONNECT_SEL, 0x00},
+        /* unmute and set max the selector */
+        { 0x0e, AC_VERB_SET_AMP_GAIN_MUTE, 0xb01f },
         {}
 };
 
@@ -1334,7 +1346,16 @@ static unsigned int ref9200_pin_configs[8] = {
         0x02a19020, 0x01a19021, 0x90100140, 0x01813122,
 };
 
-/* 
+static unsigned int gateway9200_m4_pin_configs[8] = {
+        0x400000fe, 0x404500f4, 0x400100f0, 0x90110010,
+        0x400100f1, 0x02a1902e, 0x500000f2, 0x500000f3,
+};
+static unsigned int gateway9200_m4_2_pin_configs[8] = {
+        0x400000fe, 0x404500f4, 0x400100f0, 0x90110010,
+        0x400100f1, 0x02a1902e, 0x500000f2, 0x500000f3,
+};
+
+/*
     STAC 9200 pin configs for
     102801A8
     102801DE
@@ -1464,6 +1485,8 @@ static unsigned int *stac9200_brd_tbl[STAC_9200_MODELS] = {
         [STAC_9200_DELL_M25] = dell9200_m25_pin_configs,
         [STAC_9200_DELL_M26] = dell9200_m26_pin_configs,
         [STAC_9200_DELL_M27] = dell9200_m27_pin_configs,
+        [STAC_9200_M4] = gateway9200_m4_pin_configs,
+        [STAC_9200_M4_2] = gateway9200_m4_2_pin_configs,
         [STAC_9200_PANASONIC] = ref9200_pin_configs,
 };
 
@@ -1480,7 +1503,8 @@ static const char *stac9200_models[STAC_9200_MODELS] = {
         [STAC_9200_DELL_M25] = "dell-m25",
         [STAC_9200_DELL_M26] = "dell-m26",
         [STAC_9200_DELL_M27] = "dell-m27",
-        [STAC_9200_GATEWAY] = "gateway",
+        [STAC_9200_M4] = "gateway-m4",
+        [STAC_9200_M4_2] = "gateway-m4-2",
         [STAC_9200_PANASONIC] = "panasonic",
 };
 
@@ -1550,11 +1574,9 @@ static struct snd_pci_quirk stac9200_cfg_tbl[] = {
         /* Panasonic */
         SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC),
         /* Gateway machines needs EAPD to be set on resume */
-        SND_PCI_QUIRK(0x107b, 0x0205, "Gateway S-7110M", STAC_9200_GATEWAY),
-        SND_PCI_QUIRK(0x107b, 0x0317, "Gateway MT3423, MX341*",
-                      STAC_9200_GATEWAY),
-        SND_PCI_QUIRK(0x107b, 0x0318, "Gateway ML3019, MT3707",
-                      STAC_9200_GATEWAY),
+        SND_PCI_QUIRK(0x107b, 0x0205, "Gateway S-7110M", STAC_9200_M4),
+        SND_PCI_QUIRK(0x107b, 0x0317, "Gateway MT3423, MX341*", STAC_9200_M4_2),
+        SND_PCI_QUIRK(0x107b, 0x0318, "Gateway ML3019, MT3707", STAC_9200_M4_2),
         /* OQO Mobile */
         SND_PCI_QUIRK(0x1106, 0x3288, "OQO Model 2", STAC_9200_OQO),
         {} /* terminator */
@@ -1565,44 +1587,85 @@ static unsigned int ref925x_pin_configs[8] = {
         0x90a70320, 0x02214210, 0x01019020, 0x9033032e,
 };
 
-static unsigned int stac925x_MA6_pin_configs[8] = {
-        0x40c003f0, 0x424503f2, 0x01813022, 0x02a19021,
-        0x90a70320, 0x90100211, 0x400003f1, 0x9033032e,
+static unsigned int stac925xM1_pin_configs[8] = {
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x9033032e,
 };
 
-static unsigned int stac925x_PA6_pin_configs[8] = {
-        0x40c003f0, 0x424503f2, 0x01813022, 0x02a19021,
-        0x50a103f0, 0x90100211, 0x400003f1, 0x9033032e,
+static unsigned int stac925xM1_2_pin_configs[8] = {
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x9033032e,
+};
+
+static unsigned int stac925xM2_pin_configs[8] = {
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x9033032e,
 };
 
 static unsigned int stac925xM2_2_pin_configs[8] = {
-        0x40c003f3, 0x424503f2, 0x04180011, 0x02a19020,
-        0x50a103f0, 0x90100212, 0x400003f1, 0x9033032e,
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x9033032e,
+};
+
+static unsigned int stac925xM3_pin_configs[8] = {
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x503303f3,
+};
+
+static unsigned int stac925xM5_pin_configs[8] = {
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x9033032e,
+};
+
+static unsigned int stac925xM6_pin_configs[8] = {
+        0x40c003f4, 0x424503f2, 0x400000f3, 0x02a19020,
+        0x40a000f0, 0x90100210, 0x400003f1, 0x90330320,
 };
 
 static unsigned int *stac925x_brd_tbl[STAC_925x_MODELS] = {
         [STAC_REF] = ref925x_pin_configs,
+        [STAC_M1] = stac925xM1_pin_configs,
+        [STAC_M1_2] = stac925xM1_2_pin_configs,
+        [STAC_M2] = stac925xM2_pin_configs,
         [STAC_M2_2] = stac925xM2_2_pin_configs,
-        [STAC_MA6] = stac925x_MA6_pin_configs,
-        [STAC_PA6] = stac925x_PA6_pin_configs,
+        [STAC_M3] = stac925xM3_pin_configs,
+        [STAC_M5] = stac925xM5_pin_configs,
+        [STAC_M6] = stac925xM6_pin_configs,
 };
 
 static const char *stac925x_models[STAC_925x_MODELS] = {
         [STAC_REF] = "ref",
+        [STAC_M1] = "m1",
+        [STAC_M1_2] = "m1-2",
+        [STAC_M2] = "m2",
         [STAC_M2_2] = "m2-2",
-        [STAC_MA6] = "m6",
-        [STAC_PA6] = "pa6",
+        [STAC_M3] = "m3",
+        [STAC_M5] = "m5",
+        [STAC_M6] = "m6",
+};
+
+static struct snd_pci_quirk stac925x_codec_id_cfg_tbl[] = {
+        SND_PCI_QUIRK(0x107b, 0x0316, "Gateway M255", STAC_M2),
+        SND_PCI_QUIRK(0x107b, 0x0366, "Gateway MP6954", STAC_M5),
+        SND_PCI_QUIRK(0x107b, 0x0461, "Gateway NX560XL", STAC_M1),
+        SND_PCI_QUIRK(0x107b, 0x0681, "Gateway NX860", STAC_M2),
+        SND_PCI_QUIRK(0x107b, 0x0367, "Gateway MX6453", STAC_M1_2),
+        /* Not sure about the brand name for those */
+        SND_PCI_QUIRK(0x107b, 0x0281, "Gateway mobile", STAC_M1),
+        SND_PCI_QUIRK(0x107b, 0x0507, "Gateway mobile", STAC_M3),
+        SND_PCI_QUIRK(0x107b, 0x0281, "Gateway mobile", STAC_M6),
+        SND_PCI_QUIRK(0x107b, 0x0685, "Gateway mobile", STAC_M2_2),
+        {} /* terminator */
 };
 
 static struct snd_pci_quirk stac925x_cfg_tbl[] = {
         /* SigmaTel reference board */
         SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668, "DFI LanParty", STAC_REF),
         SND_PCI_QUIRK(0x8384, 0x7632, "Stac9202 Reference Board", STAC_REF),
-        SND_PCI_QUIRK(0x107b, 0x0316, "Gateway M255", STAC_REF),
-        SND_PCI_QUIRK(0x107b, 0x0366, "Gateway MP6954", STAC_REF),
-        SND_PCI_QUIRK(0x107b, 0x0461, "Gateway NX560XL", STAC_MA6),
-        SND_PCI_QUIRK(0x107b, 0x0681, "Gateway NX860", STAC_PA6),
-        SND_PCI_QUIRK(0x1002, 0x437b, "Gateway MX6453", STAC_M2_2),
+
+        /* Default table for unknown ID */
+        SND_PCI_QUIRK(0x1002, 0x437b, "Gateway mobile", STAC_M2_2),
+
         {} /* terminator */
 };
 
@@ -1682,7 +1745,7 @@ static const char *stac92hd83xxx_models[STAC_92HD83XXX_MODELS] = {
 static struct snd_pci_quirk stac92hd83xxx_cfg_tbl[] = {
         /* SigmaTel reference board */
         SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668,
-                      "DFI LanParty", STAC_92HD71BXX_REF),
+                      "DFI LanParty", STAC_92HD83XXX_REF),
         {} /* terminator */
 };
 
@@ -1716,6 +1779,7 @@ static unsigned int *stac92hd71bxx_brd_tbl[STAC_92HD71BXX_MODELS] = {
         [STAC_DELL_M4_2]        = dell_m4_2_pin_configs,
         [STAC_DELL_M4_3]        = dell_m4_3_pin_configs,
         [STAC_HP_M4]            = NULL,
+        [STAC_HP_DV5]           = NULL,
 };
 
 static const char *stac92hd71bxx_models[STAC_92HD71BXX_MODELS] = {
@@ -1724,6 +1788,7 @@ static const char *stac92hd71bxx_models[STAC_92HD71BXX_MODELS] = {
         [STAC_DELL_M4_2] = "dell-m4-2",
         [STAC_DELL_M4_3] = "dell-m4-3",
         [STAC_HP_M4] = "hp-m4",
+        [STAC_HP_DV5] = "hp-dv5",
 };
 
 static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
@@ -1736,6 +1801,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
                       "HP dv7", STAC_HP_M4),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
                       "HP dv7", STAC_HP_M4),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3603,
+                      "HP dv5", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
                                 "unknown HP", STAC_HP_M4),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
@@ -4163,8 +4230,19 @@ static void stac92xx_hp_detect(struct hda_codec *codec)
                         continue;
                 if (presence)
                         stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
+#if 0 /* FIXME */
+/* Resetting the pinctl like below may lead to (a sort of) regressions
+ * on some devices since they use the HP pin actually for line/speaker
+ * outs although the default pin config shows a different pin (that is
+ * wrong and useless).
+ *
+ * So, it's basically a problem of default pin configs, likely a BIOS issue.
+ * But, disabling the code below just works around it, and I'm too tired of
+ * bug reports with such devices... 
+ */
                 else
                         stac92xx_reset_pinctl(codec, cfg->hp_pins[i], val);
+#endif /* FIXME */
         }
 } 
 
@@ -4390,7 +4468,8 @@ static int patch_stac9200(struct hda_codec *codec)
         spec->num_adcs = 1;
         spec->num_pwrs = 0;
 
-        if (spec->board_config == STAC_9200_GATEWAY ||
+        if (spec->board_config == STAC_9200_M4 ||
+            spec->board_config == STAC_9200_M4_2 ||
             spec->board_config == STAC_9200_OQO)
                 spec->init = stac9200_eapd_init;
         else
@@ -4408,6 +4487,12 @@ static int patch_stac9200(struct hda_codec *codec)
                 return err;
         }
 
+        /* CF-74 has no headphone detection, and the driver should *NOT*
+         * do detection and HP/speaker toggle because the hardware does it.
+         */
+        if (spec->board_config == STAC_9200_PANASONIC)
+                spec->hp_detect = 0;
+
         codec->patch_ops = stac92xx_patch_ops;
 
         return 0;
@@ -4425,12 +4510,22 @@ static int patch_stac925x(struct hda_codec *codec)
         codec->spec = spec;
         spec->num_pins = ARRAY_SIZE(stac925x_pin_nids);
         spec->pin_nids = stac925x_pin_nids;
-        spec->board_config = snd_hda_check_board_config(codec, STAC_925x_MODELS,
+
+        /* Check first for codec ID */
+        spec->board_config = snd_hda_check_board_codec_sid_config(codec,
+                                                        STAC_925x_MODELS,
+                                                        stac925x_models,
+                                                        stac925x_codec_id_cfg_tbl);
+
+        /* Now checks for PCI ID, if codec ID is not found */
+        if (spec->board_config < 0)
+                spec->board_config = snd_hda_check_board_config(codec,
+                                                        STAC_925x_MODELS,
                                                         stac925x_models,
                                                         stac925x_cfg_tbl);
  again:
         if (spec->board_config < 0) {
-                snd_printdd(KERN_INFO "hda_codec: Unknown model for STAC925x," 
+                snd_printdd(KERN_INFO "hda_codec: Unknown model for STAC925x,"
                                       "using BIOS defaults\n");
                 err = stac92xx_save_bios_config_regs(codec);
         } else
@@ -4672,6 +4767,7 @@ static int patch_stac92hd83xxx(struct hda_codec *codec)
         spec->dmux_nids = stac92hd83xxx_dmux_nids;
         spec->adc_nids = stac92hd83xxx_adc_nids;
         spec->pwr_nids = stac92hd83xxx_pwr_nids;
+        spec->amp_nids = stac92hd83xxx_amp_nids;
         spec->pwr_mapping = stac92hd83xxx_pwr_mapping;
         spec->num_pwrs = ARRAY_SIZE(stac92hd83xxx_pwr_nids);
         spec->multiout.dac_nids = spec->dac_nids;
@@ -4689,6 +4785,7 @@ static int patch_stac92hd83xxx(struct hda_codec *codec)
         spec->num_pins = ARRAY_SIZE(stac92hd83xxx_pin_nids);
         spec->num_dmuxes = ARRAY_SIZE(stac92hd83xxx_dmux_nids);
         spec->num_adcs = ARRAY_SIZE(stac92hd83xxx_adc_nids);
+        spec->num_amps = ARRAY_SIZE(stac92hd83xxx_amp_nids);
         spec->num_dmics = STAC92HD83XXX_NUM_DMICS;
         spec->dinput_mux = &stac92hd83xxx_dmux;
         spec->pin_nids = stac92hd83xxx_pin_nids;
diff --git a/sound/pci/oxygen/virtuoso.c b/sound/pci/oxygen/virtuoso.c
index 98c6a8c65d81..e9e829e83d7a 100644
--- a/sound/pci/oxygen/virtuoso.c
+++ b/sound/pci/oxygen/virtuoso.c
@@ -26,7 +26,7 @@
  * SPI 0 -> 1st PCM1796 (front)
  * SPI 1 -> 2nd PCM1796 (surround)
  * SPI 2 -> 3rd PCM1796 (center/LFE)
- * SPI 4 -> 4th PCM1796 (back)
+ * SPI 4 -> 4th PCM1796 (back) and EEPROM self-destruct (do not use!)
  *
  * GPIO 2 -> M0 of CS5381
  * GPIO 3 -> M1 of CS5381
@@ -207,6 +207,12 @@ static void xonar_gpio_changed(struct oxygen *chip);
 static inline void pcm1796_write_spi(struct oxygen *chip, unsigned int codec,
                                      u8 reg, u8 value)
 {
+        /*
+         * We don't want to do writes on SPI 4 because the EEPROM, which shares
+         * the same pin, might get confused and broken.  We'd better take care
+         * that the driver works with the default register values ...
+         */
+#if 0
         /* maps ALSA channel pair number to SPI output */
         static const u8 codec_map[4] = {
                 0, 1, 2, 4
@@ -217,6 +223,7 @@ static inline void pcm1796_write_spi(struct oxygen *chip, unsigned int codec,
                          (codec_map[codec] << OXYGEN_SPI_CODEC_SHIFT) |
                          OXYGEN_SPI_CEN_LATCH_CLOCK_HI,
                          (reg << 8) | value);
+#endif
 }
 
 static inline void pcm1796_write_i2c(struct oxygen *chip, unsigned int codec,
@@ -750,6 +757,9 @@ static const DECLARE_TLV_DB_SCALE(cs4362a_db_scale, -12700, 100, 0);
 
 static int xonar_d2_control_filter(struct snd_kcontrol_new *template)
 {
+        if (!strncmp(template->name, "Master Playback ", 16))
+                /* disable volume/mute because they would require SPI writes */
+                return 1;
         if (!strncmp(template->name, "CD Capture ", 11))
                 /* CD in is actually connected to the video in pin */
                 template->private_value ^= AC97_CD ^ AC97_VIDEO;
@@ -840,9 +850,8 @@ static const struct oxygen_model model_xonar_d2 = {
         .dac_volume_min = 0x0f,
         .dac_volume_max = 0xff,
         .misc_flags = OXYGEN_MISC_MIDI,
-        .function_flags = OXYGEN_FUNCTION_SPI |
-                          OXYGEN_FUNCTION_ENABLE_SPI_4_5,
-        .dac_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
+        .function_flags = OXYGEN_FUNCTION_SPI,
+        .dac_i2s_format = OXYGEN_I2S_FORMAT_I2S,
         .adc_i2s_format = OXYGEN_I2S_FORMAT_LJUST,
 };
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 493a4e8aa273..a2f1da8b4646 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -720,7 +720,8 @@ static int dapm_mux_update_power(struct snd_soc_dapm_widget *widget,
         struct snd_soc_dapm_path *path;
         int found = 0;
 
-        if (widget->id != snd_soc_dapm_mux)
+        if (widget->id != snd_soc_dapm_mux &&
+            widget->id != snd_soc_dapm_value_mux)
                 return -ENODEV;
 
         if (!snd_soc_test_bits(widget->codec, e->reg, mask, val))
diff --git a/sound/usb/usbquirks.h b/sound/usb/usbquirks.h
index 92115755d98e..5d8ef09b9dcc 100644
--- a/sound/usb/usbquirks.h
+++ b/sound/usb/usbquirks.h
@@ -128,6 +128,14 @@
         .bInterfaceClass = USB_CLASS_AUDIO,
         .bInterfaceSubClass = USB_SUBCLASS_AUDIO_CONTROL
 },
+{
+        USB_DEVICE(0x046d, 0x0990),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .vendor_name = "Logitech, Inc.",
+                .product_name = "QuickCam Pro 9000",
+                .ifnum = QUIRK_NO_INTERFACE
+        }
+},
 
 /*
  * Yamaha devices