205 files changed, 1836 insertions, 750 deletions

diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index fc8e7c7d182f..e8fb24671967 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -271,8 +271,6 @@ netlabel/
         - directory with information on the NetLabel subsystem.
 networking/
         - directory with info on various aspects of networking with Linux.
-nfsroot.txt
-        - short guide on setting up a diskless box with NFS root filesystem.
 nmi_watchdog.txt
         - info on NMI watchdog for SMP systems.
 nommu-mmap.txt
@@ -321,8 +319,6 @@ robust-futexes.txt
         - a description of what robust futexes are.
 rocket.txt
         - info on the Comtrol RocketPort multiport serial driver.
-rpc-cache.txt
-        - introduction to the caching mechanisms in the sunrpc layer.
 rt-mutex-design.txt
         - description of the RealTime mutex implementation design.
 rt-mutex.txt
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index 47a539c7642d..1fc4e7144dce 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -328,7 +328,7 @@ now, but you can do this to mark internal company procedures or just
 point out some special detail about the sign-off. 
 
 
-13) When to use Acked-by:
+13) When to use Acked-by: and Cc:
 
 The Signed-off-by: tag indicates that the signer was involved in the
 development of the patch, or that he/she was in the patch's delivery path.
@@ -349,11 +349,59 @@ Acked-by: does not necessarily indicate acknowledgement of the entire patch.
 For example, if a patch affects multiple subsystems and has an Acked-by: from
 one subsystem maintainer then this usually indicates acknowledgement of just
 the part which affects that maintainer's code.  Judgement should be used here.
- When in doubt people should refer to the original discussion in the mailing
+When in doubt people should refer to the original discussion in the mailing
 list archives.
 
+If a person has had the opportunity to comment on a patch, but has not
+provided such comments, you may optionally add a "Cc:" tag to the patch.
+This is the only tag which might be added without an explicit action by the
+person it names.  This tag documents that potentially interested parties
+have been included in the discussion
 
-14) The canonical patch format
+
+14) Using Test-by: and Reviewed-by:
+
+A Tested-by: tag indicates that the patch has been successfully tested (in
+some environment) by the person named.  This tag informs maintainers that
+some testing has been performed, provides a means to locate testers for
+future patches, and ensures credit for the testers.
+
+Reviewed-by:, instead, indicates that the patch has been reviewed and found
+acceptable according to the Reviewer's Statement:
+
+        Reviewer's statement of oversight
+
+        By offering my Reviewed-by: tag, I state that:
+
+         (a) I have carried out a technical review of this patch to
+             evaluate its appropriateness and readiness for inclusion into
+             the mainline kernel.
+
+         (b) Any problems, concerns, or questions relating to the patch
+             have been communicated back to the submitter.  I am satisfied
+             with the submitter's response to my comments.
+
+         (c) While there may be things that could be improved with this
+             submission, I believe that it is, at this time, (1) a
+             worthwhile modification to the kernel, and (2) free of known
+             issues which would argue against its inclusion.
+
+         (d) While I have reviewed the patch and believe it to be sound, I
+             do not (unless explicitly stated elsewhere) make any
+             warranties or guarantees that it will achieve its stated
+             purpose or function properly in any given situation.
+
+A Reviewed-by tag is a statement of opinion that the patch is an
+appropriate modification of the kernel without any remaining serious
+technical issues.  Any interested reviewer (who has done the work) can
+offer a Reviewed-by tag for a patch.  This tag serves to give credit to
+reviewers and to inform maintainers of the degree of review which has been
+done on the patch.  Reviewed-by: tags, when supplied by reviewers known to
+understand the subject area and to perform thorough reviews, will normally
+increase the liklihood of your patch getting into the kernel.
+
+
+15) The canonical patch format
 
 The canonical patch subject line is:
 
diff --git a/Documentation/filesystems/00-INDEX b/Documentation/filesystems/00-INDEX
index e68021c08fbd..52cd611277a3 100644
--- a/Documentation/filesystems/00-INDEX
+++ b/Documentation/filesystems/00-INDEX
@@ -66,6 +66,8 @@ mandatory-locking.txt
         - info on the Linux implementation of Sys V mandatory file locking.
 ncpfs.txt
         - info on Novell Netware(tm) filesystem using NCP protocol.
+nfsroot.txt
+        - short guide on setting up a diskless box with NFS root filesystem.
 ntfs.txt
         - info and mount options for the NTFS filesystem (Windows NT).
 ocfs2.txt
@@ -82,6 +84,10 @@ relay.txt
         - info on relay, for efficient streaming from kernel to user space.
 romfs.txt
         - description of the ROMFS filesystem.
+rpc-cache.txt
+        - introduction to the caching mechanisms in the sunrpc layer.
+seq_file.txt
+        - how to use the seq_file API
 sharedsubtree.txt
         - a description of shared subtrees for namespaces.
 smbfs.txt
diff --git a/Documentation/nfsroot.txt b/Documentation/filesystems/nfsroot.txt
index 31b329172343..31b329172343 100644
--- a/Documentation/nfsroot.txt
+++ b/Documentation/filesystems/nfsroot.txt
diff --git a/Documentation/rpc-cache.txt b/Documentation/filesystems/rpc-cache.txt
index 8a382bea6808..8a382bea6808 100644
--- a/Documentation/rpc-cache.txt
+++ b/Documentation/filesystems/rpc-cache.txt
diff --git a/Documentation/filesystems/seq_file.txt b/Documentation/filesystems/seq_file.txt
new file mode 100644
index 000000000000..cc6cdb95b73a
--- /dev/null
+++ b/Documentation/filesystems/seq_file.txt
@@ -0,0 +1,283 @@
+The seq_file interface
+
+        Copyright 2003 Jonathan Corbet <corbet@lwn.net>
+        This file is originally from the LWN.net Driver Porting series at
+        http://lwn.net/Articles/driver-porting/
+
+
+There are numerous ways for a device driver (or other kernel component) to
+provide information to the user or system administrator.  One useful
+technique is the creation of virtual files, in debugfs, /proc or elsewhere.
+Virtual files can provide human-readable output that is easy to get at
+without any special utility programs; they can also make life easier for
+script writers. It is not surprising that the use of virtual files has
+grown over the years.
+
+Creating those files correctly has always been a bit of a challenge,
+however. It is not that hard to make a virtual file which returns a
+string. But life gets trickier if the output is long - anything greater
+than an application is likely to read in a single operation.  Handling
+multiple reads (and seeks) requires careful attention to the reader's
+position within the virtual file - that position is, likely as not, in the
+middle of a line of output. The kernel has traditionally had a number of
+implementations that got this wrong.
+
+The 2.6 kernel contains a set of functions (implemented by Alexander Viro)
+which are designed to make it easy for virtual file creators to get it
+right.
+
+The seq_file interface is available via <linux/seq_file.h>. There are
+three aspects to seq_file:
+
+     * An iterator interface which lets a virtual file implementation
+       step through the objects it is presenting.
+
+     * Some utility functions for formatting objects for output without
+       needing to worry about things like output buffers.
+
+     * A set of canned file_operations which implement most operations on
+       the virtual file.
+
+We'll look at the seq_file interface via an extremely simple example: a
+loadable module which creates a file called /proc/sequence. The file, when
+read, simply produces a set of increasing integer values, one per line. The
+sequence will continue until the user loses patience and finds something
+better to do. The file is seekable, in that one can do something like the
+following:
+
+    dd if=/proc/sequence of=out1 count=1
+    dd if=/proc/sequence skip=1 out=out2 count=1
+
+Then concatenate the output files out1 and out2 and get the right
+result. Yes, it is a thoroughly useless module, but the point is to show
+how the mechanism works without getting lost in other details.  (Those
+wanting to see the full source for this module can find it at
+http://lwn.net/Articles/22359/).
+
+
+The iterator interface
+
+Modules implementing a virtual file with seq_file must implement a simple
+iterator object that allows stepping through the data of interest.
+Iterators must be able to move to a specific position - like the file they
+implement - but the interpretation of that position is up to the iterator
+itself. A seq_file implementation that is formatting firewall rules, for
+example, could interpret position N as the Nth rule in the chain.
+Positioning can thus be done in whatever way makes the most sense for the
+generator of the data, which need not be aware of how a position translates
+to an offset in the virtual file. The one obvious exception is that a
+position of zero should indicate the beginning of the file.
+
+The /proc/sequence iterator just uses the count of the next number it
+will output as its position.
+
+Four functions must be implemented to make the iterator work. The first,
+called start() takes a position as an argument and returns an iterator
+which will start reading at that position. For our simple sequence example,
+the start() function looks like:
+
+        static void *ct_seq_start(struct seq_file *s, loff_t *pos)
+        {
+                loff_t *spos = kmalloc(sizeof(loff_t), GFP_KERNEL);
+                if (! spos)
+                        return NULL;
+                *spos = *pos;
+                return spos;
+        }
+
+The entire data structure for this iterator is a single loff_t value
+holding the current position. There is no upper bound for the sequence
+iterator, but that will not be the case for most other seq_file
+implementations; in most cases the start() function should check for a
+"past end of file" condition and return NULL if need be.
+
+For more complicated applications, the private field of the seq_file
+structure can be used. There is also a special value whch can be returned
+by the start() function called SEQ_START_TOKEN; it can be used if you wish
+to instruct your show() function (described below) to print a header at the
+top of the output. SEQ_START_TOKEN should only be used if the offset is
+zero, however.
+
+The next function to implement is called, amazingly, next(); its job is to
+move the iterator forward to the next position in the sequence.  The
+example module can simply increment the position by one; more useful
+modules will do what is needed to step through some data structure. The
+next() function returns a new iterator, or NULL if the sequence is
+complete. Here's the example version:
+
+        static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
+        {
+                loff_t *spos = v;
+                *pos = ++*spos;
+                return spos;
+        }
+
+The stop() function is called when iteration is complete; its job, of
+course, is to clean up. If dynamic memory is allocated for the iterator,
+stop() is the place to free it.
+
+        static void ct_seq_stop(struct seq_file *s, void *v)
+        {
+                kfree(v);
+        }
+
+Finally, the show() function should format the object currently pointed to
+by the iterator for output. It should return zero, or an error code if
+something goes wrong. The example module's show() function is:
+
+        static int ct_seq_show(struct seq_file *s, void *v)
+        {
+                loff_t *spos = v;
+                seq_printf(s, "%lld\n", (long long)*spos);
+                return 0;
+        }
+
+We will look at seq_printf() in a moment. But first, the definition of the
+seq_file iterator is finished by creating a seq_operations structure with
+the four functions we have just defined:
+
+        static const struct seq_operations ct_seq_ops = {
+                .start = ct_seq_start,
+                .next  = ct_seq_next,
+                .stop  = ct_seq_stop,
+                .show  = ct_seq_show
+        };
+
+This structure will be needed to tie our iterator to the /proc file in
+a little bit.
+
+It's worth noting that the interator value returned by start() and
+manipulated by the other functions is considered to be completely opaque by
+the seq_file code. It can thus be anything that is useful in stepping
+through the data to be output. Counters can be useful, but it could also be
+a direct pointer into an array or linked list. Anything goes, as long as
+the programmer is aware that things can happen between calls to the
+iterator function. However, the seq_file code (by design) will not sleep
+between the calls to start() and stop(), so holding a lock during that time
+is a reasonable thing to do. The seq_file code will also avoid taking any
+other locks while the iterator is active.
+
+
+Formatted output
+
+The seq_file code manages positioning within the output created by the
+iterator and getting it into the user's buffer. But, for that to work, that
+output must be passed to the seq_file code. Some utility functions have
+been defined which make this task easy.
+
+Most code will simply use seq_printf(), which works pretty much like
+printk(), but which requires the seq_file pointer as an argument. It is
+common to ignore the return value from seq_printf(), but a function
+producing complicated output may want to check that value and quit if
+something non-zero is returned; an error return means that the seq_file
+buffer has been filled and further output will be discarded.
+
+For straight character output, the following functions may be used:
+
+        int seq_putc(struct seq_file *m, char c);
+        int seq_puts(struct seq_file *m, const char *s);
+        int seq_escape(struct seq_file *m, const char *s, const char *esc);
+
+The first two output a single character and a string, just like one would
+expect. seq_escape() is like seq_puts(), except that any character in s
+which is in the string esc will be represented in octal form in the output.
+
+There is also a function for printing filenames:
+
+        int seq_path(struct seq_file *m, struct path *path, char *esc);
+
+Here, path indicates the file of interest, and esc is a set of characters
+which should be escaped in the output.
+
+
+Making it all work
+
+So far, we have a nice set of functions which can produce output within the
+seq_file system, but we have not yet turned them into a file that a user
+can see. Creating a file within the kernel requires, of course, the
+creation of a set of file_operations which implement the operations on that
+file. The seq_file interface provides a set of canned operations which do
+most of the work. The virtual file author still must implement the open()
+method, however, to hook everything up. The open function is often a single
+line, as in the example module:
+
+        static int ct_open(struct inode *inode, struct file *file)
+        {
+                return seq_open(file, &ct_seq_ops);
+        }
+
+Here, the call to seq_open() takes the seq_operations structure we created
+before, and gets set up to iterate through the virtual file.
+
+On a successful open, seq_open() stores the struct seq_file pointer in
+file->private_data. If you have an application where the same iterator can
+be used for more than one file, you can store an arbitrary pointer in the
+private field of the seq_file structure; that value can then be retrieved
+by the iterator functions.
+
+The other operations of interest - read(), llseek(), and release() - are
+all implemented by the seq_file code itself. So a virtual file's
+file_operations structure will look like:
+
+        static const struct file_operations ct_file_ops = {
+                .owner   = THIS_MODULE,
+                .open    = ct_open,
+                .read    = seq_read,
+                .llseek  = seq_lseek,
+                .release = seq_release
+        };
+
+There is also a seq_release_private() which passes the contents of the
+seq_file private field to kfree() before releasing the structure.
+
+The final step is the creation of the /proc file itself. In the example
+code, that is done in the initialization code in the usual way:
+
+        static int ct_init(void)
+        {
+                struct proc_dir_entry *entry;
+
+                entry = create_proc_entry("sequence", 0, NULL);
+                if (entry)
+                        entry->proc_fops = &ct_file_ops;
+                return 0;
+        }
+
+        module_init(ct_init);
+
+And that is pretty much it.
+
+
+seq_list
+
+If your file will be iterating through a linked list, you may find these
+routines useful:
+
+        struct list_head *seq_list_start(struct list_head *head,
+                                         loff_t pos);
+        struct list_head *seq_list_start_head(struct list_head *head,
+                                              loff_t pos);
+        struct list_head *seq_list_next(void *v, struct list_head *head,
+                                        loff_t *ppos);
+
+These helpers will interpret pos as a position within the list and iterate
+accordingly.  Your start() and next() functions need only invoke the
+seq_list_* helpers with a pointer to the appropriate list_head structure.  
+
+
+The extra-simple version
+
+For extremely simple virtual files, there is an even easier interface.  A
+module can define only the show() function, which should create all the
+output that the virtual file will contain. The file's open() method then
+calls:
+
+        int single_open(struct file *file,
+                        int (*show)(struct seq_file *m, void *p),
+                        void *data);
+
+When output time comes, the show() function will be called once. The data
+value given to single_open() can be found in the private field of the
+seq_file structure. When using single_open(), the programmer should use
+single_release() instead of seq_release() in the file_operations structure
+to avoid a memory leak.
diff --git a/Documentation/hrtimers/highres.txt b/Documentation/hrtimers/highres.txt
index ce0e9a91e157..a73ecf5b4bdb 100644
--- a/Documentation/hrtimers/highres.txt
+++ b/Documentation/hrtimers/highres.txt
@@ -98,7 +98,7 @@ System-level global event devices are used for the Linux periodic tick. Per-CPU
 event devices are used to provide local CPU functionality such as process
 accounting, profiling, and high resolution timers.
 
-The management layer assignes one or more of the folliwing functions to a clock
+The management layer assigns one or more of the following functions to a clock
 event device:
       - system global periodic tick (jiffies update)
       - cpu local update_process_times
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 32e9297ef747..dafd001bf833 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -844,7 +844,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         arch/alpha/kernel/core_marvel.c.
 
         ip=             [IP_PNP]
-                        See Documentation/nfsroot.txt.
+                        See Documentation/filesystems/nfsroot.txt.
 
         ip2=            [HW] Set IO/IRQ pairs for up to 4 IntelliPort boards
                         See comment before ip2_setup() in
@@ -1198,10 +1198,10 @@ and is between 256 and 4096 characters. It is defined in the file
                         file if at all.
 
         nfsaddrs=       [NFS]
-                        See Documentation/nfsroot.txt.
+                        See Documentation/filesystems/nfsroot.txt.
 
         nfsroot=        [NFS] nfs root filesystem for disk-less boxes.
-                        See Documentation/nfsroot.txt.
+                        See Documentation/filesystems/nfsroot.txt.
 
         nfs.callback_tcpport=
                         [NFS] set the TCP port on which the NFSv4 callback
diff --git a/Documentation/scheduler/00-INDEX b/Documentation/scheduler/00-INDEX
index b5f5ca069b2d..fc234d093fbf 100644
--- a/Documentation/scheduler/00-INDEX
+++ b/Documentation/scheduler/00-INDEX
@@ -12,5 +12,7 @@ sched-domains.txt
         - information on scheduling domains.
 sched-nice-design.txt
         - How and why the scheduler's nice levels are implemented.
+sched-rt-group.txt
+        - real-time group scheduling.
 sched-stats.txt
         - information on schedstats (Linux Scheduler Statistics).
diff --git a/Documentation/sched-rt-group.txt b/Documentation/scheduler/sched-rt-group.txt
index 1c6332f4543c..1c6332f4543c 100644
--- a/Documentation/sched-rt-group.txt
+++ b/Documentation/scheduler/sched-rt-group.txt
diff --git a/Documentation/spinlocks.txt b/Documentation/spinlocks.txt
index 471e75389778..619699dde593 100644
--- a/Documentation/spinlocks.txt
+++ b/Documentation/spinlocks.txt
@@ -5,6 +5,28 @@ Please use DEFINE_SPINLOCK()/DEFINE_RWLOCK() or
 __SPIN_LOCK_UNLOCKED()/__RW_LOCK_UNLOCKED() as appropriate for static
 initialization.
 
+Most of the time, you can simply turn:
+
+        static spinlock_t xxx_lock = SPIN_LOCK_UNLOCKED;
+
+into:
+
+        static DEFINE_SPINLOCK(xxx_lock);
+
+Static structure member variables go from:
+
+        struct foo bar {
+                .lock   =       SPIN_LOCK_UNLOCKED;
+        };
+
+to:
+
+        struct foo bar {
+                .lock   =       __SPIN_LOCK_UNLOCKED(bar.lock);
+        };
+
+Declaration of static rw_locks undergo a similar transformation.
+
 Dynamic initialization, when necessary, may be performed as
 demonstrated below.
 
diff --git a/Makefile b/Makefile
index fec2a12710eb..21c76f715bf5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 25
-EXTRAVERSION = -rc8
+EXTRAVERSION = -rc9
 NAME = Funky Weasel is Jiggy wit it
 
 # *DOCUMENTATION*
diff --git a/arch/frv/kernel/entry-table.S b/arch/frv/kernel/entry-table.S
index d3b9253d862a..bf35f33e48c9 100644
--- a/arch/frv/kernel/entry-table.S
+++ b/arch/frv/kernel/entry-table.S
@@ -316,8 +316,14 @@ __trap_fixup_kernel_data_tlb_miss:
         .section        .trap.vector
         .org            TBR_TT_TRAP0 >> 2
         .long           system_call
-        .rept           126
+        .rept           119
         .long           __entry_unsupported_trap
         .endr
+
+        # userspace atomic op emulation, traps 120-126
+        .rept           7
+        .long           __entry_atomic_op
+        .endr
+        
         .org            TBR_TT_BREAK >> 2
         .long           __entry_debug_exception
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index f36d7f4a7c25..b8a4b94779b1 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -656,6 +656,26 @@ __entry_debug_exception:
 
 ###############################################################################
 #
+# handle atomic operation emulation for userspace
+#
+###############################################################################
+        .globl          __entry_atomic_op
+__entry_atomic_op:
+        LEDS            0x6012
+        sethi.p         %hi(atomic_operation),gr5
+        setlo           %lo(atomic_operation),gr5
+        movsg           esfr1,gr8
+        movsg           epcr0,gr9
+        movsg           esr0,gr10
+
+        # now that we've accessed the exception regs, we can enable exceptions
+        movsg           psr,gr4
+        ori             gr4,#PSR_ET,gr4
+        movgs           gr4,psr
+        jmpl            @(gr5,gr0)      ; call atomic_operation(esfr1,epcr0,esr0)
+
+###############################################################################
+#
 # handle media exception
 #
 ###############################################################################
diff --git a/arch/frv/kernel/head.inc b/arch/frv/kernel/head.inc
index d424cd2eb213..bff66628b99a 100644
--- a/arch/frv/kernel/head.inc
+++ b/arch/frv/kernel/head.inc
@@ -46,5 +46,5 @@
 #ifdef CONFIG_MMU
 __sdram_base = 0x00000000               /* base address to which SDRAM relocated */
 #else
-__sdram_base = 0xc0000000               /* base address to which SDRAM relocated */
+__sdram_base = __page_offset            /* base address to which SDRAM relocated */
 #endif
diff --git a/arch/frv/kernel/switch_to.S b/arch/frv/kernel/switch_to.S
index b5275fa9cd0d..b06668670fcc 100644
--- a/arch/frv/kernel/switch_to.S
+++ b/arch/frv/kernel/switch_to.S
@@ -102,13 +102,6 @@ __switch_to:
         movgs           gr14,lr
         bar
 
-        srli            gr15,#28,gr5
-        subicc          gr5,#0xc,gr0,icc0
-        beq             icc0,#0,111f
-        break
-        nop
-111:
-
         # jump to __switch_back or ret_from_fork as appropriate
         # - move prev to GR8
         movgs           gr4,psr
diff --git a/arch/frv/kernel/traps.c b/arch/frv/kernel/traps.c
index 2e6098c85578..7089c2428b3f 100644
--- a/arch/frv/kernel/traps.c
+++ b/arch/frv/kernel/traps.c
@@ -73,7 +73,7 @@ asmlinkage void illegal_instruction(unsigned long esfr1, unsigned long epcr0, un
                       epcr0, esr0, esfr1);
 
         info.si_errno   = 0;
-        info.si_addr    = (void *) ((epcr0 & EPCR0_PC) ? (epcr0 & EPCR0_PC) : __frame->pc);
+        info.si_addr    = (void *) ((epcr0 & EPCR0_V) ? (epcr0 & EPCR0_PC) : __frame->pc);
 
         switch (__frame->tbr & TBR_TT) {
         case TBR_TT_ILLEGAL_INSTR:
@@ -102,6 +102,233 @@ asmlinkage void illegal_instruction(unsigned long esfr1, unsigned long epcr0, un
 
 /*****************************************************************************/
 /*
+ * handle atomic operations with errors
+ * - arguments in gr8, gr9, gr10
+ * - original memory value placed in gr5
+ * - replacement memory value placed in gr9
+ */
+asmlinkage void atomic_operation(unsigned long esfr1, unsigned long epcr0,
+                                 unsigned long esr0)
+{
+        static DEFINE_SPINLOCK(atomic_op_lock);
+        unsigned long x, y, z, *p;
+        mm_segment_t oldfs;
+        siginfo_t info;
+        int ret;
+
+        y = 0;
+        z = 0;
+
+        oldfs = get_fs();
+        if (!user_mode(__frame))
+                set_fs(KERNEL_DS);
+
+        switch (__frame->tbr & TBR_TT) {
+                /* TIRA gr0,#120
+                 * u32 __atomic_user_cmpxchg32(u32 *ptr, u32 test, u32 new)
+                 */
+        case TBR_TT_ATOMIC_CMPXCHG32:
+                p = (unsigned long *) __frame->gr8;
+                x = __frame->gr9;
+                y = __frame->gr10;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        if (z != x)
+                                goto done;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                if (z != x)
+                                        goto done2;
+
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+                /* TIRA gr0,#121
+                 * u32 __atomic_kernel_xchg32(void *v, u32 new)
+                 */
+        case TBR_TT_ATOMIC_XCHG32:
+                p = (unsigned long *) __frame->gr8;
+                y = __frame->gr9;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+                /* TIRA gr0,#122
+                 * ulong __atomic_kernel_XOR_return(ulong i, ulong *v)
+                 */
+        case TBR_TT_ATOMIC_XOR:
+                p = (unsigned long *) __frame->gr8;
+                x = __frame->gr9;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                y = x ^ z;
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+                /* TIRA gr0,#123
+                 * ulong __atomic_kernel_OR_return(ulong i, ulong *v)
+                 */
+        case TBR_TT_ATOMIC_OR:
+                p = (unsigned long *) __frame->gr8;
+                x = __frame->gr9;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                y = x ^ z;
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+                /* TIRA gr0,#124
+                 * ulong __atomic_kernel_AND_return(ulong i, ulong *v)
+                 */
+        case TBR_TT_ATOMIC_AND:
+                p = (unsigned long *) __frame->gr8;
+                x = __frame->gr9;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                y = x & z;
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+                /* TIRA gr0,#125
+                 * int __atomic_user_sub_return(atomic_t *v, int i)
+                 */
+        case TBR_TT_ATOMIC_SUB:
+                p = (unsigned long *) __frame->gr8;
+                x = __frame->gr9;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                y = z - x;
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+                /* TIRA gr0,#126
+                 * int __atomic_user_add_return(atomic_t *v, int i)
+                 */
+        case TBR_TT_ATOMIC_ADD:
+                p = (unsigned long *) __frame->gr8;
+                x = __frame->gr9;
+
+                for (;;) {
+                        ret = get_user(z, p);
+                        if (ret < 0)
+                                goto error;
+
+                        spin_lock_irq(&atomic_op_lock);
+
+                        if (__get_user(z, p) == 0) {
+                                y = z + x;
+                                if (__put_user(y, p) == 0)
+                                        goto done2;
+                                goto error2;
+                        }
+
+                        spin_unlock_irq(&atomic_op_lock);
+                }
+
+        default:
+                BUG();
+        }
+
+done2:
+        spin_unlock_irq(&atomic_op_lock);
+done:
+        if (!user_mode(__frame))
+                set_fs(oldfs);
+        __frame->gr5 = z;
+        __frame->gr9 = y;
+        return;
+
+error2:
+        spin_unlock_irq(&atomic_op_lock);
+error:
+        if (!user_mode(__frame))
+                set_fs(oldfs);
+        __frame->pc -= 4;
+
+        die_if_kernel("-- Atomic Op Error --\n");
+
+        info.si_signo   = SIGSEGV;
+        info.si_code    = SEGV_ACCERR;
+        info.si_errno   = 0;
+        info.si_addr    = (void *) __frame->pc;
+
+        force_sig_info(info.si_signo, &info, current);
+}
+
+/*****************************************************************************/
+/*
  *
  */
 asmlinkage void media_exception(unsigned long msr0, unsigned long msr1)
diff --git a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c
index 5b54f11f4e59..7f44ae69b29e 100644
--- a/arch/sparc/kernel/ptrace.c
+++ b/arch/sparc/kernel/ptrace.c
@@ -325,7 +325,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
         const struct user_regset_view *view;
         int ret;
 
-        view = task_user_regset_view(child);
+        view = task_user_regset_view(current);
 
         switch(request) {
         case PTRACE_GETREGS: {
diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
index 7963595c77cc..e9fc0aa2da38 100644
--- a/arch/sparc64/kernel/ptrace.c
+++ b/arch/sparc64/kernel/ptrace.c
@@ -114,6 +114,85 @@ void flush_ptrace_access(struct vm_area_struct *vma, struct page *page,
         preempt_enable();
 }
 
+static int get_from_target(struct task_struct *target, unsigned long uaddr,
+                           void *kbuf, int len)
+{
+        if (target == current) {
+                if (copy_from_user(kbuf, (void __user *) uaddr, len))
+                        return -EFAULT;
+        } else {
+                int len2 = access_process_vm(target, uaddr, kbuf, len, 0);
+                if (len2 != len)
+                        return -EFAULT;
+        }
+        return 0;
+}
+
+static int set_to_target(struct task_struct *target, unsigned long uaddr,
+                         void *kbuf, int len)
+{
+        if (target == current) {
+                if (copy_to_user((void __user *) uaddr, kbuf, len))
+                        return -EFAULT;
+        } else {
+                int len2 = access_process_vm(target, uaddr, kbuf, len, 1);
+                if (len2 != len)
+                        return -EFAULT;
+        }
+        return 0;
+}
+
+static int regwindow64_get(struct task_struct *target,
+                           const struct pt_regs *regs,
+                           struct reg_window *wbuf)
+{
+        unsigned long rw_addr = regs->u_regs[UREG_I6];
+
+        if (test_tsk_thread_flag(current, TIF_32BIT)) {
+                struct reg_window32 win32;
+                int i;
+
+                if (get_from_target(target, rw_addr, &win32, sizeof(win32)))
+                        return -EFAULT;
+                for (i = 0; i < 8; i++)
+                        wbuf->locals[i] = win32.locals[i];
+                for (i = 0; i < 8; i++)
+                        wbuf->ins[i] = win32.ins[i];
+        } else {
+                rw_addr += STACK_BIAS;
+                if (get_from_target(target, rw_addr, wbuf, sizeof(*wbuf)))
+                        return -EFAULT;
+        }
+
+        return 0;
+}
+
+static int regwindow64_set(struct task_struct *target,
+                           const struct pt_regs *regs,
+                           struct reg_window *wbuf)
+{
+        unsigned long rw_addr = regs->u_regs[UREG_I6];
+
+        if (test_tsk_thread_flag(current, TIF_32BIT)) {
+                struct reg_window32 win32;
+                int i;
+
+                for (i = 0; i < 8; i++)
+                        win32.locals[i] = wbuf->locals[i];
+                for (i = 0; i < 8; i++)
+                        win32.ins[i] = wbuf->ins[i];
+
+                if (set_to_target(target, rw_addr, &win32, sizeof(win32)))
+                        return -EFAULT;
+        } else {
+                rw_addr += STACK_BIAS;
+                if (set_to_target(target, rw_addr, wbuf, sizeof(*wbuf)))
+                        return -EFAULT;
+        }
+
+        return 0;
+}
+
 enum sparc_regset {
         REGSET_GENERAL,
         REGSET_FP,
@@ -133,25 +212,13 @@ static int genregs64_get(struct task_struct *target,
         ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                   regs->u_regs,
                                   0, 16 * sizeof(u64));
-        if (!ret) {
-                unsigned long __user *reg_window = (unsigned long __user *)
-                        (regs->u_regs[UREG_I6] + STACK_BIAS);
-                unsigned long window[16];
-
-                if (target == current) {
-                        if (copy_from_user(window, reg_window, sizeof(window)))
-                                return -EFAULT;
-                } else {
-                        if (access_process_vm(target,
-                                              (unsigned long) reg_window,
-                                              window,
-                                              sizeof(window), 0) !=
-                            sizeof(window))
-                                return -EFAULT;
-                }
+        if (!ret && count && pos < (32 * sizeof(u64))) {
+                struct reg_window window;
 
+                if (regwindow64_get(target, regs, &window))
+                        return -EFAULT;
                 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
-                                          window,
+                                          &window,
                                           16 * sizeof(u64),
                                           32 * sizeof(u64));
         }
@@ -173,10 +240,11 @@ static int genregs64_get(struct task_struct *target,
                                           36 * sizeof(u64));
         }
 
-        if (!ret)
+        if (!ret) {
                 ret = user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf,
                                                36 * sizeof(u64), -1);
 
+        }
         return ret;
 }
 
@@ -194,42 +262,20 @@ static int genregs64_set(struct task_struct *target,
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  regs->u_regs,
                                  0, 16 * sizeof(u64));
-        if (!ret && count > 0) {
-                unsigned long __user *reg_window = (unsigned long __user *)
-                        (regs->u_regs[UREG_I6] + STACK_BIAS);
-                unsigned long window[16];
+        if (!ret && count && pos < (32 * sizeof(u64))) {
+                struct reg_window window;
 
-                if (target == current) {
-                        if (copy_from_user(window, reg_window, sizeof(window)))
-                                return -EFAULT;
-                } else {
-                        if (access_process_vm(target,
-                                              (unsigned long) reg_window,
-                                              window,
-                                              sizeof(window), 0) !=
-                            sizeof(window))
-                                return -EFAULT;
-                }
+                if (regwindow64_get(target, regs, &window))
+                        return -EFAULT;
 
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                         window,
+                                         &window,
                                          16 * sizeof(u64),
                                          32 * sizeof(u64));
-                if (!ret) {
-                        if (target == current) {
-                                if (copy_to_user(reg_window, window,
-                                                 sizeof(window)))
-                                        return -EFAULT;
-                        } else {
-                                if (access_process_vm(target,
-                                                      (unsigned long)
-                                                      reg_window,
-                                                      window,
-                                                      sizeof(window), 1) !=
-                                    sizeof(window))
-                                        return -EFAULT;
-                        }
-                }
+
+                if (!ret &&
+                    regwindow64_set(target, regs, &window))
+                        return -EFAULT;
         }
 
         if (!ret && count > 0) {
@@ -805,7 +851,7 @@ struct compat_fps {
 long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
                         compat_ulong_t caddr, compat_ulong_t cdata)
 {
-        const struct user_regset_view *view = task_user_regset_view(child);
+        const struct user_regset_view *view = task_user_regset_view(current);
         compat_ulong_t caddr2 = task_pt_regs(current)->u_regs[UREG_I4];
         struct pt_regs32 __user *pregs;
         struct compat_fps __user *fps;
@@ -913,7 +959,7 @@ struct fps {
 
 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 {
-        const struct user_regset_view *view = task_user_regset_view(child);
+        const struct user_regset_view *view = task_user_regset_view(current);
         unsigned long addr2 = task_pt_regs(current)->u_regs[UREG_I4];
         struct pt_regs __user *pregs;
         struct fps __user *fps;
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index be3c7a299f02..43930e73f657 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -82,7 +82,6 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
  */
 void (*pm_idle)(void);
 EXPORT_SYMBOL(pm_idle);
-static DEFINE_PER_CPU(unsigned int, cpu_idle_state);
 
 void disable_hlt(void)
 {
@@ -190,9 +189,6 @@ void cpu_idle(void)
                 while (!need_resched()) {
                         void (*idle)(void);
 
-                        if (__get_cpu_var(cpu_idle_state))
-                                __get_cpu_var(cpu_idle_state) = 0;
-
                         check_pgt_cache();
                         rmb();
                         idle = pm_idle;
@@ -220,40 +216,19 @@ static void do_nothing(void *unused)
 {
 }
 
+/*
+ * cpu_idle_wait - Used to ensure that all the CPUs discard old value of
+ * pm_idle and update to new pm_idle value. Required while changing pm_idle
+ * handler on SMP systems.
+ *
+ * Caller must have changed pm_idle to the new value before the call. Old
+ * pm_idle value will not be used by any CPU after the return of this function.
+ */
 void cpu_idle_wait(void)
 {
-        unsigned int cpu, this_cpu = get_cpu();
-        cpumask_t map, tmp = current->cpus_allowed;
-
-        set_cpus_allowed(current, cpumask_of_cpu(this_cpu));
-        put_cpu();
-
-        cpus_clear(map);
-        for_each_online_cpu(cpu) {
-                per_cpu(cpu_idle_state, cpu) = 1;
-                cpu_set(cpu, map);
-        }
-
-        __get_cpu_var(cpu_idle_state) = 0;
-
-        wmb();
-        do {
-                ssleep(1);
-                for_each_online_cpu(cpu) {
-                        if (cpu_isset(cpu, map) && !per_cpu(cpu_idle_state, cpu))
-                                cpu_clear(cpu, map);
-                }
-                cpus_and(map, map, cpu_online_map);
-                /*
-                 * We waited 1 sec, if a CPU still did not call idle
-                 * it may be because it is in idle and not waking up
-                 * because it has nothing to do.
-                 * Give all the remaining CPUS a kick.
-                 */
-                smp_call_function_mask(map, do_nothing, NULL, 0);
-        } while (!cpus_empty(map));
-
-        set_cpus_allowed(current, tmp);
+        smp_mb();
+        /* kick all the CPUs so that they exit out of pm_idle */
+        smp_call_function(do_nothing, NULL, 0, 1);
 }
 EXPORT_SYMBOL_GPL(cpu_idle_wait);
 
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 3baf9b9f4c87..46c4c546b499 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -63,7 +63,6 @@ EXPORT_SYMBOL(boot_option_idle_override);
  */
 void (*pm_idle)(void);
 EXPORT_SYMBOL(pm_idle);
-static DEFINE_PER_CPU(unsigned int, cpu_idle_state);
 
 static ATOMIC_NOTIFIER_HEAD(idle_notifier);
 
@@ -173,9 +172,6 @@ void cpu_idle(void)
                 while (!need_resched()) {
                         void (*idle)(void);
 
-                        if (__get_cpu_var(cpu_idle_state))
-                                __get_cpu_var(cpu_idle_state) = 0;
-
                         rmb();
                         idle = pm_idle;
                         if (!idle)
@@ -207,40 +203,19 @@ static void do_nothing(void *unused)
 {
 }
 
+/*
+ * cpu_idle_wait - Used to ensure that all the CPUs discard old value of
+ * pm_idle and update to new pm_idle value. Required while changing pm_idle
+ * handler on SMP systems.
+ *
+ * Caller must have changed pm_idle to the new value before the call. Old
+ * pm_idle value will not be used by any CPU after the return of this function.
+ */
 void cpu_idle_wait(void)
 {
-        unsigned int cpu, this_cpu = get_cpu();
-        cpumask_t map, tmp = current->cpus_allowed;
-
-        set_cpus_allowed(current, cpumask_of_cpu(this_cpu));
-        put_cpu();
-
-        cpus_clear(map);
-        for_each_online_cpu(cpu) {
-                per_cpu(cpu_idle_state, cpu) = 1;
-                cpu_set(cpu, map);
-        }
-
-        __get_cpu_var(cpu_idle_state) = 0;
-
-        wmb();
-        do {
-                ssleep(1);
-                for_each_online_cpu(cpu) {
-                        if (cpu_isset(cpu, map) && !per_cpu(cpu_idle_state, cpu))
-                                cpu_clear(cpu, map);
-                }
-                cpus_and(map, map, cpu_online_map);
-                /*
-                 * We waited 1 sec, if a CPU still did not call idle
-                 * it may be because it is in idle and not waking up
-                 * because it has nothing to do.
-                 * Give all the remaining CPUS a kick.
-                 */
-                smp_call_function_mask(map, do_nothing, 0, 0);
-        } while (!cpus_empty(map));
-
-        set_cpus_allowed(current, tmp);
+        smp_mb();
+        /* kick all the CPUs so that they exit out of pm_idle */
+        smp_call_function(do_nothing, NULL, 0, 1);
 }
 EXPORT_SYMBOL_GPL(cpu_idle_wait);
 
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
index 022bcaa3b42e..ab6bf375a307 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -92,7 +92,7 @@ int do_set_thread_area(struct task_struct *p, int idx,
 asmlinkage int sys_set_thread_area(struct user_desc __user *u_info)
 {
         int ret = do_set_thread_area(current, -1, u_info, 1);
-        prevent_tail_call(ret);
+        asmlinkage_protect(1, ret, u_info);
         return ret;
 }
 
@@ -142,7 +142,7 @@ int do_get_thread_area(struct task_struct *p, int idx,
 asmlinkage int sys_get_thread_area(struct user_desc __user *u_info)
 {
         int ret = do_get_thread_area(current, -1, u_info);
-        prevent_tail_call(ret);
+        asmlinkage_protect(1, ret, u_info);
         return ret;
 }
 
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index f26da2bfcc15..f4e1006c253d 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1214,6 +1214,8 @@ static void cfq_exit_cfqq(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
                                          struct cfq_io_context *cic)
 {
+        struct io_context *ioc = cic->ioc;
+
         list_del_init(&cic->queue_list);
 
         /*
@@ -1223,6 +1225,9 @@ static void __cfq_exit_single_io_context(struct cfq_data *cfqd,
         cic->dead_key = (unsigned long) cic->key;
         cic->key = NULL;
 
+        if (ioc->ioc_data == cic)
+                rcu_assign_pointer(ioc->ioc_data, NULL);
+
         if (cic->cfqq[ASYNC]) {
                 cfq_exit_cfqq(cfqd, cic->cfqq[ASYNC]);
                 cic->cfqq[ASYNC] = NULL;
@@ -1255,7 +1260,6 @@ static void cfq_exit_single_io_context(struct io_context *ioc,
  */
 static void cfq_exit_io_context(struct io_context *ioc)
 {
-        rcu_assign_pointer(ioc->ioc_data, NULL);
         call_for_each_cic(ioc, cfq_exit_single_io_context);
 }
 
@@ -1478,8 +1482,7 @@ cfq_drop_dead_cic(struct cfq_data *cfqd, struct io_context *ioc,
 
         spin_lock_irqsave(&ioc->lock, flags);
 
-        if (ioc->ioc_data == cic)
-                rcu_assign_pointer(ioc->ioc_data, NULL);
+        BUG_ON(ioc->ioc_data == cic);
 
         radix_tree_delete(&ioc->radix_root, (unsigned long) cfqd);
         hlist_del_rcu(&cic->cic_list);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 55bd35c0f082..9c9627e8e334 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -50,6 +50,7 @@
 #include <scsi/sg.h>
 #include <scsi/scsi_ioctl.h>
 #include <linux/cdrom.h>
+#include <linux/scatterlist.h>
 
 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
 #define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index cce5a614758d..fde26345a379 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -382,9 +382,8 @@ static irqreturn_t i2c_davinci_isr(int this_irq, void *dev_id)
                         break;
 
                 case DAVINCI_I2C_IVR_ARDY:
-                        w = davinci_i2c_read_reg(dev, DAVINCI_I2C_STR_REG);
-                        MOD_REG_BIT(w, DAVINCI_I2C_STR_ARDY, 1);
-                        davinci_i2c_write_reg(dev, DAVINCI_I2C_STR_REG, w);
+                        davinci_i2c_write_reg(dev,
+                                DAVINCI_I2C_STR_REG, DAVINCI_I2C_STR_ARDY);
                         complete(&dev->cmd_complete);
                         break;
 
@@ -397,12 +396,9 @@ static irqreturn_t i2c_davinci_isr(int this_irq, void *dev_id)
                                 if (dev->buf_len)
                                         continue;
 
-                                w = davinci_i2c_read_reg(dev,
-                                                         DAVINCI_I2C_STR_REG);
-                                MOD_REG_BIT(w, DAVINCI_I2C_IMR_RRDY, 0);
                                 davinci_i2c_write_reg(dev,
-                                                      DAVINCI_I2C_STR_REG,
-                                                      w);
+                                        DAVINCI_I2C_STR_REG,
+                                        DAVINCI_I2C_IMR_RRDY);
                         } else
                                 dev_err(dev->dev, "RDR IRQ while no "
                                         "data requested\n");
@@ -428,9 +424,8 @@ static irqreturn_t i2c_davinci_isr(int this_irq, void *dev_id)
                         break;
 
                 case DAVINCI_I2C_IVR_SCD:
-                        w = davinci_i2c_read_reg(dev, DAVINCI_I2C_STR_REG);
-                        MOD_REG_BIT(w, DAVINCI_I2C_STR_SCD, 1);
-                        davinci_i2c_write_reg(dev, DAVINCI_I2C_STR_REG, w);
+                        davinci_i2c_write_reg(dev,
+                                DAVINCI_I2C_STR_REG, DAVINCI_I2C_STR_SCD);
                         complete(&dev->cmd_complete);
                         break;
 
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 7c7eb0cfeceb..22bb247d0e60 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -55,7 +55,7 @@ MODULE_PARM_DESC(iic_force_poll, "Force polling mode");
 
 static int iic_force_fast;
 module_param(iic_force_fast, bool, 0);
-MODULE_PARM_DESC(iic_fast_poll, "Force fast mode (400 kHz)");
+MODULE_PARM_DESC(iic_force_fast, "Force fast mode (400 kHz)");
 
 #define DBG_LEVEL 0
 
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index cb9abe7565a7..b1c050ff311d 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -131,11 +131,15 @@ static const struct i2c_algorithm usb_algorithm = {
 
 /* ----- begin of usb layer ---------------------------------------------- */
 
-/* The usb i2c interface uses a vid/pid pair donated by */
-/* Future Technology Devices International Ltd. */
+/*
+ * Initially the usb i2c interface uses a vid/pid pair donated by
+ * Future Technology Devices International Ltd., later a pair was
+ * bought from EZPrototypes
+ */
 static struct usb_device_id i2c_tiny_usb_table [] = {
-        { USB_DEVICE(0x0403, 0xc631) },
-        { }                     /* Terminating entry */
+        { USB_DEVICE(0x0403, 0xc631) },   /* FTDI */
+        { USB_DEVICE(0x1c40, 0x0534) },   /* EZPrototypes */
+        { }                               /* Terminating entry */
 };
 
 MODULE_DEVICE_TABLE(usb, i2c_tiny_usb_table);
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index ced83c202cac..ef1a300068dc 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2010,6 +2010,7 @@ isdn_net_init(struct net_device *ndev)
         ndev->flags = IFF_NOARP|IFF_POINTOPOINT;
         ndev->type = ARPHRD_ETHER;
         ndev->addr_len = ETH_ALEN;
+        ndev->validate_addr = NULL;
 
         /* for clients with MPPP maybe higher values better */
         ndev->tx_queue_len = 30;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index c574cf5efb5c..b162b839a662 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2348,25 +2348,15 @@ static void handle_issuing_new_write_requests6(raid5_conf_t *conf,
 static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
                                 struct stripe_head_state *s, int disks)
 {
+        int canceled_check = 0;
+
         set_bit(STRIPE_HANDLE, &sh->state);
-        /* Take one of the following actions:
-         * 1/ start a check parity operation if (uptodate == disks)
-         * 2/ finish a check parity operation and act on the result
-         * 3/ skip to the writeback section if we previously
-         *    initiated a recovery operation
-         */
-        if (s->failed == 0 &&
-            !test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
-                if (!test_and_set_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
-                        BUG_ON(s->uptodate != disks);
-                        clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
-                        sh->ops.count++;
-                        s->uptodate--;
-                } else if (
-                       test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
-                        clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
-                        clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
 
+        /* complete a check operation */
+        if (test_and_clear_bit(STRIPE_OP_CHECK, &sh->ops.complete)) {
+            clear_bit(STRIPE_OP_CHECK, &sh->ops.ack);
+            clear_bit(STRIPE_OP_CHECK, &sh->ops.pending);
+                if (s->failed == 0) {
                         if (sh->ops.zero_sum_result == 0)
                                 /* parity is correct (on disc,
                                  * not in buffer any more)
@@ -2391,7 +2381,8 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
                                         s->uptodate++;
                                 }
                         }
-                }
+                } else
+                        canceled_check = 1; /* STRIPE_INSYNC is not set */
         }
 
         /* check if we can clear a parity disk reconstruct */
@@ -2404,12 +2395,28 @@ static void handle_parity_checks5(raid5_conf_t *conf, struct stripe_head *sh,
                 clear_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending);
         }
 
+        /* start a new check operation if there are no failures, the stripe is
+         * not insync, and a repair is not in flight
+         */
+        if (s->failed == 0 &&
+            !test_bit(STRIPE_INSYNC, &sh->state) &&
+            !test_bit(STRIPE_OP_MOD_REPAIR_PD, &sh->ops.pending)) {
+                if (!test_and_set_bit(STRIPE_OP_CHECK, &sh->ops.pending)) {
+                        BUG_ON(s->uptodate != disks);
+                        clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
+                        sh->ops.count++;
+                        s->uptodate--;
+                }
+        }
+
         /* Wait for check parity and compute block operations to complete
-         * before write-back
+         * before write-back.  If a failure occurred while the check operation
+         * was in flight we need to cycle this stripe through handle_stripe
+         * since the parity block may not be uptodate
          */
-        if (!test_bit(STRIPE_INSYNC, &sh->state) &&
-                !test_bit(STRIPE_OP_CHECK, &sh->ops.pending) &&
-                !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending)) {
+        if (!canceled_check && !test_bit(STRIPE_INSYNC, &sh->state) &&
+            !test_bit(STRIPE_OP_CHECK, &sh->ops.pending) &&
+            !test_bit(STRIPE_OP_COMPUTE_BLK, &sh->ops.pending)) {
                 struct r5dev *dev;
                 /* either failed parity check, or recovery is happening */
                 if (s->failed == 0)
diff --git a/drivers/net/bnx2x.c b/drivers/net/bnx2x.c
index de32b3fba322..7bdb5af35951 100644
--- a/drivers/net/bnx2x.c
+++ b/drivers/net/bnx2x.c
@@ -63,8 +63,8 @@
 #include "bnx2x.h"
 #include "bnx2x_init.h"
 
-#define DRV_MODULE_VERSION      "1.42.3"
-#define DRV_MODULE_RELDATE      "2008/3/9"
+#define DRV_MODULE_VERSION      "1.42.4"
+#define DRV_MODULE_RELDATE      "2008/4/9"
 #define BNX2X_BC_VER            0x040200
 
 /* Time in jiffies before concluding the transmitter is hung. */
@@ -6153,7 +6153,7 @@ static int bnx2x_function_init(struct bnx2x *bp, int mode)
                    func, mode);
                 REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET,
                        0xffffffff);
-                REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_1_SET,
+                REG_WR(bp, GRCBASE_MISC + MISC_REGISTERS_RESET_REG_2_SET,
                        0xfffc);
                 bnx2x_init_block(bp, MISC_COMMON_START, MISC_COMMON_END);
 
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 93b7fb246960..a8d3280923e8 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0089"
+#define DRV_VERSION     "EHEA_0090"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
@@ -371,6 +371,7 @@ struct ehea_port_res {
         struct ehea_q_skb_arr rq2_skba;
         struct ehea_q_skb_arr rq3_skba;
         struct ehea_q_skb_arr sq_skba;
+        int sq_skba_size;
         spinlock_t netif_queue;
         int queue_stopped;
         int swqe_refill_th;
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 07c742dd3f09..f460b623c077 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -349,7 +349,8 @@ static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
         pr->rq1_skba.os_skbs = 0;
 
         if (unlikely(test_bit(__EHEA_STOP_XFER, &ehea_driver_flags))) {
-                pr->rq1_skba.index = index;
+                if (nr_of_wqes > 0)
+                        pr->rq1_skba.index = index;
                 pr->rq1_skba.os_skbs = fill_wqes;
                 return;
         }
@@ -1464,7 +1465,9 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
                           init_attr->act_nr_rwqes_rq2,
                           init_attr->act_nr_rwqes_rq3);
 
-        ret = ehea_init_q_skba(&pr->sq_skba, init_attr->act_nr_send_wqes + 1);
+        pr->sq_skba_size = init_attr->act_nr_send_wqes + 1;
+
+        ret = ehea_init_q_skba(&pr->sq_skba, pr->sq_skba_size);
         ret |= ehea_init_q_skba(&pr->rq1_skba, init_attr->act_nr_rwqes_rq1 + 1);
         ret |= ehea_init_q_skba(&pr->rq2_skba, init_attr->act_nr_rwqes_rq2 + 1);
         ret |= ehea_init_q_skba(&pr->rq3_skba, init_attr->act_nr_rwqes_rq3 + 1);
@@ -2621,6 +2624,22 @@ void ehea_purge_sq(struct ehea_qp *orig_qp)
         }
 }
 
+void ehea_flush_sq(struct ehea_port *port)
+{
+        int i;
+
+        for (i = 0; i < port->num_def_qps + port->num_add_tx_qps; i++) {
+                struct ehea_port_res *pr = &port->port_res[i];
+                int swqe_max = pr->sq_skba_size - 2 - pr->swqe_ll_count;
+                int k = 0;
+                while (atomic_read(&pr->swqe_avail) < swqe_max) {
+                        msleep(5);
+                        if (++k == 20)
+                                break;
+                }
+        }
+}
+
 int ehea_stop_qps(struct net_device *dev)
 {
         struct ehea_port *port = netdev_priv(dev);
@@ -2845,6 +2864,7 @@ static void ehea_rereg_mrs(struct work_struct *work)
                                         if (dev->flags & IFF_UP) {
                                                 down(&port->port_lock);
                                                 netif_stop_queue(dev);
+                                                ehea_flush_sq(port);
                                                 ret = ehea_stop_qps(dev);
                                                 if (ret) {
                                                         up(&port->port_lock);
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 419f533006ab..9f088a47d8b1 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5316,8 +5316,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 
         /* check the workaround bit for correct mac address order */
         txreg = readl(base + NvRegTransmitPoll);
-        if ((txreg & NVREG_TRANSMITPOLL_MAC_ADDR_REV) ||
-            (id->driver_data & DEV_HAS_CORRECT_MACADDR)) {
+        if (id->driver_data & DEV_HAS_CORRECT_MACADDR) {
                 /* mac address is already in correct order */
                 dev->dev_addr[0] = (np->orig_mac[0] >>  0) & 0xff;
                 dev->dev_addr[1] = (np->orig_mac[0] >>  8) & 0xff;
@@ -5325,6 +5324,22 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 dev->dev_addr[3] = (np->orig_mac[0] >> 24) & 0xff;
                 dev->dev_addr[4] = (np->orig_mac[1] >>  0) & 0xff;
                 dev->dev_addr[5] = (np->orig_mac[1] >>  8) & 0xff;
+        } else if (txreg & NVREG_TRANSMITPOLL_MAC_ADDR_REV) {
+                /* mac address is already in correct order */
+                dev->dev_addr[0] = (np->orig_mac[0] >>  0) & 0xff;
+                dev->dev_addr[1] = (np->orig_mac[0] >>  8) & 0xff;
+                dev->dev_addr[2] = (np->orig_mac[0] >> 16) & 0xff;
+                dev->dev_addr[3] = (np->orig_mac[0] >> 24) & 0xff;
+                dev->dev_addr[4] = (np->orig_mac[1] >>  0) & 0xff;
+                dev->dev_addr[5] = (np->orig_mac[1] >>  8) & 0xff;
+                /*
+                 * Set orig mac address back to the reversed version.
+                 * This flag will be cleared during low power transition.
+                 * Therefore, we should always put back the reversed address.
+                 */
+                np->orig_mac[0] = (dev->dev_addr[5] << 0) + (dev->dev_addr[4] << 8) +
+                        (dev->dev_addr[3] << 16) + (dev->dev_addr[2] << 24);
+                np->orig_mac[1] = (dev->dev_addr[1] << 0) + (dev->dev_addr[0] << 8);
         } else {
                 /* need to reverse mac address to correct order */
                 dev->dev_addr[0] = (np->orig_mac[1] >>  8) & 0xff;
@@ -5595,7 +5610,9 @@ out:
 static int nv_resume(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
+        u8 __iomem *base = get_hwbase(dev);
         int rc = 0;
+        u32 txreg;
 
         if (!netif_running(dev))
                 goto out;
@@ -5606,6 +5623,11 @@ static int nv_resume(struct pci_dev *pdev)
         pci_restore_state(pdev);
         pci_enable_wake(pdev, PCI_D0, 0);
 
+        /* restore mac address reverse flag */
+        txreg = readl(base + NvRegTransmitPoll);
+        txreg |= NVREG_TRANSMITPOLL_MAC_ADDR_REV;
+        writel(txreg, base + NvRegTransmitPoll);
+
         rc = nv_open(dev);
 out:
         return rc;
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index af869cf9ae7d..940e2041ba38 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -835,7 +835,8 @@ static int fs_enet_close(struct net_device *dev)
 
         netif_stop_queue(dev);
         netif_carrier_off(dev);
-        napi_disable(&fep->napi);
+        if (fep->fpi->use_napi)
+                napi_disable(&fep->napi);
         phy_stop(fep->phydev);
 
         spin_lock_irqsave(&fep->lock, flags);
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 1d210ed46130..489c7c3b90d9 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -242,12 +242,12 @@ static int macb_mii_init(struct macb *bp)
         /* Enable managment port */
         macb_writel(bp, NCR, MACB_BIT(MPE));
 
-        bp->mii_bus.name = "MACB_mii_bus",
-        bp->mii_bus.read = &macb_mdio_read,
-        bp->mii_bus.write = &macb_mdio_write,
-        bp->mii_bus.reset = &macb_mdio_reset,
-        bp->mii_bus.id = bp->pdev->id,
-        bp->mii_bus.priv = bp,
+        bp->mii_bus.name = "MACB_mii_bus";
+        bp->mii_bus.read = &macb_mdio_read;
+        bp->mii_bus.write = &macb_mdio_write;
+        bp->mii_bus.reset = &macb_mdio_reset;
+        bp->mii_bus.id = bp->pdev->id;
+        bp->mii_bus.priv = bp;
         bp->mii_bus.dev = &bp->dev->dev;
         pdata = bp->pdev->dev.platform_data;
 
@@ -1257,6 +1257,8 @@ static int __exit macb_remove(struct platform_device *pdev)
 
         if (dev) {
                 bp = netdev_priv(dev);
+                if (bp->phy_dev)
+                        phy_disconnect(bp->phy_dev);
                 mdiobus_unregister(&bp->mii_bus);
                 kfree(bp->mii_bus.irq);
                 unregister_netdev(dev);
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 37b42394560d..15fcee55284e 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1446,6 +1446,7 @@ static int __devinit sc92031_probe(struct pci_dev *pdev,
         }
 
         pci_set_drvdata(pdev, dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
 
 #if SC92031_USE_BAR == 0
         dev->mem_start = pci_resource_start(pdev, SC92031_USE_BAR);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 853bce0ac478..f226bcac7d17 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -154,6 +154,7 @@ static const char *yukon2_name[] = {
         "EC",           /* 0xb6 */
         "FE",           /* 0xb7 */
         "FE+",          /* 0xb8 */
+        "Supreme",      /* 0xb9 */
 };
 
 static void sky2_set_multicast(struct net_device *dev);
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 4020e9e955b3..63a54e29d563 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -1326,9 +1326,11 @@ static irqreturn_t smc_interrupt(int irq, void *dev_id)
         SMC_SET_INT_MASK(mask);
         spin_unlock(&lp->lock);
 
+#ifndef CONFIG_NET_POLL_CONTROLLER
         if (timeout == MAX_IRQ_LOOPS)
                 PRINTK("%s: spurious interrupt (mask = 0x%02x)\n",
                        dev->name, mask);
+#endif
         DBG(3, "%s: Interrupt done (%d loops)\n",
                dev->name, MAX_IRQ_LOOPS - timeout);
 
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index c49214feae91..7b7b1717b0d1 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1472,13 +1472,12 @@ static int __netdev_rx(struct net_device *dev, int *quota)
 #ifndef final_version                   /* Remove after testing. */
                 /* You will want this info for the initial debug. */
                 if (debug > 5) {
-                        DECLARE_MAC_BUF(mac);
-                        DECLARE_MAC_BUF(mac2);
-
-                        printk(KERN_DEBUG "  Rx data %s %s"
+                        printk(KERN_DEBUG "  Rx data " MAC_FMT " " MAC_FMT
                                " %2.2x%2.2x.\n",
-                               print_mac(mac, &skb->data[0]),
-                               print_mac(mac2, &skb->data[6]),
+                               skb->data[0], skb->data[1], skb->data[2],
+                               skb->data[3], skb->data[4], skb->data[5],
+                               skb->data[6], skb->data[7], skb->data[8],
+                               skb->data[9], skb->data[10], skb->data[11],
                                skb->data[12], skb->data[13]);
                 }
 #endif
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index d4655b2d1f3f..96043c5746d0 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.89"
-#define DRV_MODULE_RELDATE      "April 03, 2008"
+#define DRV_MODULE_VERSION      "3.90"
+#define DRV_MODULE_RELDATE      "April 12, 2008"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -12578,7 +12578,8 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
         static int tg3_version_printed = 0;
-        unsigned long tg3reg_base, tg3reg_len;
+        resource_size_t tg3reg_base;
+        unsigned long tg3reg_len;
         struct net_device *dev;
         struct tg3 *tp;
         int err, pm_cap;
diff --git a/drivers/net/tokenring/olympic.c b/drivers/net/tokenring/olympic.c
index db4ca4f0b846..0ab51a0f35fc 100644
--- a/drivers/net/tokenring/olympic.c
+++ b/drivers/net/tokenring/olympic.c
@@ -1438,13 +1438,18 @@ static void olympic_arb_cmd(struct net_device *dev)
 
                 if (olympic_priv->olympic_network_monitor) { 
                         struct trh_hdr *mac_hdr;
-                        DECLARE_MAC_BUF(mac);
                         printk(KERN_WARNING "%s: Received MAC Frame, details: \n",dev->name);
                         mac_hdr = tr_hdr(mac_frame);
-                        printk(KERN_WARNING "%s: MAC Frame Dest. Addr: %s\n",
-                               dev->name, print_mac(mac, mac_hdr->daddr));
-                        printk(KERN_WARNING "%s: MAC Frame Srce. Addr: %s\n",
-                               dev->name, print_mac(mac, mac_hdr->saddr));
+                        printk(KERN_WARNING "%s: MAC Frame Dest. Addr: "
+                               MAC_FMT " \n", dev->name,
+                               mac_hdr->daddr[0], mac_hdr->daddr[1],
+                               mac_hdr->daddr[2], mac_hdr->daddr[3],
+                               mac_hdr->daddr[4], mac_hdr->daddr[5]);
+                        printk(KERN_WARNING "%s: MAC Frame Srce. Addr: "
+                               MAC_FMT " \n", dev->name,
+                               mac_hdr->saddr[0], mac_hdr->saddr[1],
+                               mac_hdr->saddr[2], mac_hdr->saddr[3],
+                               mac_hdr->saddr[4], mac_hdr->saddr[5]);
                 }
                 netif_rx(mac_frame);
                 dev->last_rx = jiffies;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7b816a032957..5b5d87585d91 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -67,9 +67,42 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
+/* Uncomment to enable debugging */
+/* #define TUN_DEBUG 1 */
+
 #ifdef TUN_DEBUG
 static int debug;
+
+#define DBG  if(tun->debug)printk
+#define DBG1 if(debug==2)printk
+#else
+#define DBG( a... )
+#define DBG1( a... )
+#endif
+
+struct tun_struct {
+        struct list_head        list;
+        unsigned long           flags;
+        int                     attached;
+        uid_t                   owner;
+        gid_t                   group;
+
+        wait_queue_head_t       read_wait;
+        struct sk_buff_head     readq;
+
+        struct net_device       *dev;
+
+        struct fasync_struct    *fasync;
+
+        unsigned long if_flags;
+        u8 dev_addr[ETH_ALEN];
+        u32 chr_filter[2];
+        u32 net_filter[2];
+
+#ifdef TUN_DEBUG
+        int debug;
 #endif
+};
 
 /* Network device part of the driver */
 
@@ -253,8 +286,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv,
                         return -EFAULT;
         }
 
-        if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV)
+        if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
                 align = NET_IP_ALIGN;
+                if (unlikely(len < ETH_HLEN))
+                        return -EINVAL;
+        }
 
         if (!(skb = alloc_skb(len + align, GFP_KERNEL))) {
                 tun->dev->stats.rx_dropped++;
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 8cc316653a39..0ee4c168e4c0 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3833,6 +3833,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         struct device_node *phy;
         int err, ucc_num, max_speed = 0;
         const phandle *ph;
+        const u32 *fixed_link;
         const unsigned int *prop;
         const char *sprop;
         const void *mac_addr;
@@ -3923,18 +3924,38 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 
         ug_info->uf_info.regs = res.start;
         ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
+        fixed_link = of_get_property(np, "fixed-link", NULL);
+        if (fixed_link) {
+                ug_info->mdio_bus = 0;
+                ug_info->phy_address = fixed_link[0];
+                phy = NULL;
+        } else {
+                ph = of_get_property(np, "phy-handle", NULL);
+                phy = of_find_node_by_phandle(*ph);
 
-        ph = of_get_property(np, "phy-handle", NULL);
-        phy = of_find_node_by_phandle(*ph);
+                if (phy == NULL)
+                        return -ENODEV;
 
-        if (phy == NULL)
-                return -ENODEV;
+                /* set the PHY address */
+                prop = of_get_property(phy, "reg", NULL);
+                if (prop == NULL)
+                        return -1;
+                ug_info->phy_address = *prop;
+
+                /* Set the bus id */
+                mdio = of_get_parent(phy);
+
+                if (mdio == NULL)
+                        return -1;
 
-        /* set the PHY address */
-        prop = of_get_property(phy, "reg", NULL);
-        if (prop == NULL)
-                return -1;
-        ug_info->phy_address = *prop;
+                err = of_address_to_resource(mdio, 0, &res);
+                of_node_put(mdio);
+
+                if (err)
+                        return -1;
+
+                ug_info->mdio_bus = res.start;
+        }
 
         /* get the phy interface type, or default to MII */
         prop = of_get_property(np, "phy-connection-type", NULL);
@@ -3979,20 +4000,6 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
                 ug_info->numThreadsRx = UCC_GETH_NUM_OF_THREADS_4;
         }
 
-        /* Set the bus id */
-        mdio = of_get_parent(phy);
-
-        if (mdio == NULL)
-                return -1;
-
-        err = of_address_to_resource(mdio, 0, &res);
-        of_node_put(mdio);
-
-        if (err)
-                return -1;
-
-        ug_info->mdio_bus = res.start;
-
         if (netif_msg_probe(&debug))
                 printk(KERN_INFO "ucc_geth: UCC%1d at 0x%8x (irq = %d) \n",
                         ug_info->uf_info.ucc_num + 1, ug_info->uf_info.regs,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d1a200ff5fd2..555b70c8b863 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -234,11 +234,12 @@ static int start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct scatterlist sg[1+MAX_SKB_FRAGS];
         struct virtio_net_hdr *hdr;
         const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
-        DECLARE_MAC_BUF(mac);
 
         sg_init_table(sg, 1+MAX_SKB_FRAGS);
 
-        pr_debug("%s: xmit %p %s\n", dev->name, skb, print_mac(mac, dest));
+        pr_debug("%s: xmit %p " MAC_FMT "\n", dev->name, skb,
+                 dest[0], dest[1], dest[2],
+                 dest[3], dest[4], dest[5]);
 
         /* Encode metadata header at front. */
         hdr = skb_vnet_hdr(skb);
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index a3df09ee729f..8005dd16fb4e 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -150,9 +150,13 @@ config HDLC_FR
 
 config HDLC_PPP
         tristate "Synchronous Point-to-Point Protocol (PPP) support"
-        depends on HDLC
+        depends on HDLC && BROKEN
         help
           Generic HDLC driver supporting PPP over WAN connections.
+          This module is currently broken and will cause a kernel panic
+          when a device configured in PPP mode is activated.
+
+          It will be replaced by new PPP implementation in Linux 2.6.26.
 
           If unsure, say N.
 
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 49978bdb4324..4fd73809602e 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -635,7 +635,6 @@ hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb,
 {
         struct ieee80211_hdr_4addr *hdr;
         int res, hdrlen;
-        DECLARE_MAC_BUF(mac);
 
         if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
                 return 0;
@@ -647,8 +646,10 @@ hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb,
             strcmp(crypt->ops->name, "TKIP") == 0) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
-                               "received packet from %s\n",
-                               local->dev->name, print_mac(mac, hdr->addr2));
+                               "received packet from " MAC_FMT "\n",
+                               local->dev->name,
+                               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
                 }
                 return -1;
         }
@@ -657,9 +658,12 @@ hostap_rx_frame_decrypt(local_info_t *local, struct sk_buff *skb,
         res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
         atomic_dec(&crypt->refcnt);
         if (res < 0) {
-                printk(KERN_DEBUG "%s: decryption failed (SA=%s"
+                printk(KERN_DEBUG "%s: decryption failed (SA=" MAC_FMT
                        ") res=%d\n",
-                       local->dev->name, print_mac(mac, hdr->addr2), res);
+                       local->dev->name,
+                       hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                       hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+                       res);
                 local->comm_tallies.rx_discards_wep_undecryptable++;
                 return -1;
         }
@@ -721,7 +725,6 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
         struct ieee80211_crypt_data *crypt = NULL;
         void *sta = NULL;
         int keyidx = 0;
-        DECLARE_MAC_BUF(mac);
 
         iface = netdev_priv(dev);
         local = iface->local;
@@ -798,8 +801,10 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                          * frames silently instead of filling system log with
                          * these reports. */
                         printk(KERN_DEBUG "%s: WEP decryption failed (not set)"
-                               " (SA=%s)\n",
-                               local->dev->name, print_mac(mac, hdr->addr2));
+                               " (SA=" MAC_FMT ")\n",
+                               local->dev->name,
+                               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
 #endif
                         local->comm_tallies.rx_discards_wep_undecryptable++;
                         goto rx_dropped;
@@ -813,8 +818,9 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                     (keyidx = hostap_rx_frame_decrypt(local, skb, crypt)) < 0)
                 {
                         printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
-                               "from %s\n", dev->name,
-                               print_mac(mac, hdr->addr2));
+                               "from " MAC_FMT "\n", dev->name,
+                               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
                         /* TODO: could inform hostapd about this so that it
                          * could send auth failure report */
                         goto rx_dropped;
@@ -982,8 +988,10 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                                "unencrypted EAPOL frame\n", local->dev->name);
                 } else {
                         printk(KERN_DEBUG "%s: encryption configured, but RX "
-                               "frame not encrypted (SA=%s)\n",
-                               local->dev->name, print_mac(mac, hdr->addr2));
+                               "frame not encrypted (SA=" MAC_FMT ")\n",
+                               local->dev->name,
+                               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
                         goto rx_dropped;
                 }
         }
@@ -992,9 +1000,10 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
             !hostap_is_eapol_frame(local, skb)) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: dropped unencrypted RX data "
-                               "frame from %s"
-                               " (drop_unencrypted=1)\n",
-                               dev->name, print_mac(mac, hdr->addr2));
+                               "frame from " MAC_FMT " (drop_unencrypted=1)\n",
+                               dev->name,
+                               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
                 }
                 goto rx_dropped;
         }
diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index e7afc3ec3e6d..921c984416f8 100644
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -314,7 +314,6 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
         struct ieee80211_hdr_4addr *hdr;
         u16 fc;
         int prefix_len, postfix_len, hdr_len, res;
-        DECLARE_MAC_BUF(mac);
 
         iface = netdev_priv(skb->dev);
         local = iface->local;
@@ -329,8 +328,10 @@ static struct sk_buff * hostap_tx_encrypt(struct sk_buff *skb,
                 hdr = (struct ieee80211_hdr_4addr *) skb->data;
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
-                               "TX packet to %s\n",
-                               local->dev->name, print_mac(mac, hdr->addr1));
+                               "TX packet to " MAC_FMT "\n",
+                               local->dev->name,
+                               hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                               hdr->addr1[3], hdr->addr1[4], hdr->addr1[5]);
                 }
                 kfree_skb(skb);
                 return NULL;
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index ad040a3bb8a7..0acd9589c48c 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -632,7 +632,6 @@ static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
         __le16 *pos;
         struct sta_info *sta = NULL;
         char *txt = NULL;
-        DECLARE_MAC_BUF(mac);
 
         if (ap->local->hostapd) {
                 dev_kfree_skb(skb);
@@ -684,10 +683,12 @@ static void hostap_ap_tx_cb_auth(struct sk_buff *skb, int ok, void *data)
         if (sta)
                 atomic_dec(&sta->users);
         if (txt) {
-                PDEBUG(DEBUG_AP, "%s: %s auth_cb - alg=%d "
+                PDEBUG(DEBUG_AP, "%s: " MAC_FMT " auth_cb - alg=%d "
                        "trans#=%d status=%d - %s\n",
-                       dev->name, print_mac(mac, hdr->addr1), auth_alg,
-                       auth_transaction, status, txt);
+                       dev->name,
+                       hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                       hdr->addr1[3], hdr->addr1[4], hdr->addr1[5],
+                       auth_alg, auth_transaction, status, txt);
         }
         dev_kfree_skb(skb);
 }
@@ -703,7 +704,6 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
         __le16 *pos;
         struct sta_info *sta = NULL;
         char *txt = NULL;
-        DECLARE_MAC_BUF(mac);
 
         if (ap->local->hostapd) {
                 dev_kfree_skb(skb);
@@ -754,8 +754,11 @@ static void hostap_ap_tx_cb_assoc(struct sk_buff *skb, int ok, void *data)
         if (sta)
                 atomic_dec(&sta->users);
         if (txt) {
-                PDEBUG(DEBUG_AP, "%s: %s assoc_cb - %s\n",
-                       dev->name, print_mac(mac, hdr->addr1), txt);
+                PDEBUG(DEBUG_AP, "%s: " MAC_FMT " assoc_cb - %s\n",
+                       dev->name,
+                       hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                       hdr->addr1[3], hdr->addr1[4], hdr->addr1[5],
+                       txt);
         }
         dev_kfree_skb(skb);
 }
@@ -767,7 +770,6 @@ static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data)
         struct ap_data *ap = data;
         struct ieee80211_hdr_4addr *hdr;
         struct sta_info *sta;
-        DECLARE_MAC_BUF(mac);
 
         if (skb->len < 24)
                 goto fail;
@@ -779,9 +781,11 @@ static void hostap_ap_tx_cb_poll(struct sk_buff *skb, int ok, void *data)
                         sta->flags &= ~WLAN_STA_PENDING_POLL;
                 spin_unlock(&ap->sta_table_lock);
         } else {
-                PDEBUG(DEBUG_AP, "%s: STA %s"
+                PDEBUG(DEBUG_AP, "%s: STA " MAC_FMT
                        " did not ACK activity poll frame\n",
-                       ap->local->dev->name, print_mac(mac, hdr->addr1));
+                       ap->local->dev->name,
+                       hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                       hdr->addr1[3], hdr->addr1[4], hdr->addr1[5]);
         }
 
  fail:
@@ -1306,7 +1310,6 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
         struct sta_info *sta = NULL;
         struct ieee80211_crypt_data *crypt;
         char *txt = "";
-        DECLARE_MAC_BUF(mac);
 
         len = skb->len - IEEE80211_MGMT_HDR_LEN;
 
@@ -1315,8 +1318,9 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
 
         if (len < 6) {
                 PDEBUG(DEBUG_AP, "%s: handle_authen - too short payload "
-                       "(len=%d) from %s\n", dev->name, len,
-                       print_mac(mac, hdr->addr2));
+                       "(len=%d) from " MAC_FMT "\n", dev->name, len,
+                       hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                       hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
                 return;
         }
 
@@ -1381,8 +1385,10 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
                 if (time_after(jiffies, sta->u.ap.last_beacon +
                                (10 * sta->listen_interval * HZ) / 1024)) {
                         PDEBUG(DEBUG_AP, "%s: no beacons received for a while,"
-                               " assuming AP %s is now STA\n",
-                               dev->name, print_mac(mac, sta->addr));
+                               " assuming AP " MAC_FMT " is now STA\n",
+                               dev->name,
+                               sta->addr[0], sta->addr[1], sta->addr[2],
+                               sta->addr[3], sta->addr[4], sta->addr[5]);
                         sta->ap = 0;
                         sta->flags = 0;
                         sta->u.sta.challenge = NULL;
@@ -1497,10 +1503,13 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
         }
 
         if (resp) {
-                PDEBUG(DEBUG_AP, "%s: %s auth (alg=%d "
+                PDEBUG(DEBUG_AP, "%s: " MAC_FMT " auth (alg=%d "
                        "trans#=%d stat=%d len=%d fc=%04x) ==> %d (%s)\n",
-                       dev->name, print_mac(mac, hdr->addr2), auth_alg,
-                       auth_transaction, status_code, len, fc, resp, txt);
+                       dev->name,
+                       hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                       hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+                       auth_alg, auth_transaction, status_code, len,
+                       fc, resp, txt);
         }
 }
 
@@ -1519,14 +1528,15 @@ static void handle_assoc(local_info_t *local, struct sk_buff *skb,
         int send_deauth = 0;
         char *txt = "";
         u8 prev_ap[ETH_ALEN];
-        DECLARE_MAC_BUF(mac);
 
         left = len = skb->len - IEEE80211_MGMT_HDR_LEN;
 
         if (len < (reassoc ? 10 : 4)) {
                 PDEBUG(DEBUG_AP, "%s: handle_assoc - too short payload "
-                       "(len=%d, reassoc=%d) from %s\n",
-                       dev->name, len, reassoc, print_mac(mac, hdr->addr2));
+                       "(len=%d, reassoc=%d) from " MAC_FMT "\n",
+                       dev->name, len, reassoc,
+                       hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                       hdr->addr2[3], hdr->addr2[4], hdr->addr2[5]);
                 return;
         }
 
@@ -1603,9 +1613,12 @@ static void handle_assoc(local_info_t *local, struct sk_buff *skb,
                 }
 
                 if (left > 0) {
-                        PDEBUG(DEBUG_AP, "%s: assoc from %s"
+                        PDEBUG(DEBUG_AP, "%s: assoc from " MAC_FMT
                                " with extra data (%d bytes) [",
-                               dev->name, print_mac(mac, hdr->addr2), left);
+                               dev->name,
+                               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+                               left);
                         while (left > 0) {
                                 PDEBUG2(DEBUG_AP, "<%02x>", *u);
                                 u++; left--;
@@ -1704,10 +1717,15 @@ static void handle_assoc(local_info_t *local, struct sk_buff *skb,
         }
 
 #if 0
-        PDEBUG(DEBUG_AP, "%s: %s %sassoc (len=%d "
-               "prev_ap=%s) => %d(%d) (%s)\n",
-               dev->name, print_mac(mac, hdr->addr2), reassoc ? "re" : "", len,
-               print_mac(mac, prev_ap), resp, send_deauth, txt);
+        PDEBUG(DEBUG_AP, "%s: " MAC_FMT" %sassoc (len=%d "
+               "prev_ap=" MAC_FMT") => %d(%d) (%s)\n",
+               dev->name,
+               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+               reassoc ? "re" : "", len,
+               prev_ap[0], prev_ap[1], prev_ap[2],
+               prev_ap[3], prev_ap[4], prev_ap[5],
+               resp, send_deauth, txt);
 #endif
 }
 
@@ -1735,9 +1753,11 @@ static void handle_deauth(local_info_t *local, struct sk_buff *skb,
         pos = (__le16 *) body;
         reason_code = le16_to_cpu(*pos);
 
-        PDEBUG(DEBUG_AP, "%s: deauthentication: %s len=%d, "
-               "reason_code=%d\n", dev->name, print_mac(mac, hdr->addr2), len,
-               reason_code);
+        PDEBUG(DEBUG_AP, "%s: deauthentication: " MAC_FMT " len=%d, "
+               "reason_code=%d\n", dev->name,
+               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+               len, reason_code);
 
         spin_lock_bh(&local->ap->sta_table_lock);
         sta = ap_get_sta(local->ap, hdr->addr2);
@@ -1748,9 +1768,11 @@ static void handle_deauth(local_info_t *local, struct sk_buff *skb,
         }
         spin_unlock_bh(&local->ap->sta_table_lock);
         if (sta == NULL) {
-                printk("%s: deauthentication from %s, "
+                printk("%s: deauthentication from " MAC_FMT ", "
                "reason_code=%d, but STA not authenticated\n", dev->name,
-                       print_mac(mac, hdr->addr2), reason_code);
+                       hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                       hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+                       reason_code);
         }
 }
 
@@ -1766,7 +1788,6 @@ static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
         u16 reason_code;
         __le16 *pos;
         struct sta_info *sta = NULL;
-        DECLARE_MAC_BUF(mac);
 
         len = skb->len - IEEE80211_MGMT_HDR_LEN;
 
@@ -1778,9 +1799,11 @@ static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
         pos = (__le16 *) body;
         reason_code = le16_to_cpu(*pos);
 
-        PDEBUG(DEBUG_AP, "%s: disassociation: %s len=%d, "
-               "reason_code=%d\n", dev->name, print_mac(mac, hdr->addr2), len,
-               reason_code);
+        PDEBUG(DEBUG_AP, "%s: disassociation: " MAC_FMT " len=%d, "
+               "reason_code=%d\n", dev->name,
+               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+               len, reason_code);
 
         spin_lock_bh(&local->ap->sta_table_lock);
         sta = ap_get_sta(local->ap, hdr->addr2);
@@ -1791,9 +1814,12 @@ static void handle_disassoc(local_info_t *local, struct sk_buff *skb,
         }
         spin_unlock_bh(&local->ap->sta_table_lock);
         if (sta == NULL) {
-                printk("%s: disassociation from %s, "
+                printk("%s: disassociation from " MAC_FMT ", "
                        "reason_code=%d, but STA not authenticated\n",
-                       dev->name, print_mac(mac, hdr->addr2), reason_code);
+                       dev->name,
+                       hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+                       hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
+                       reason_code);
         }
 }
 
@@ -1882,16 +1908,20 @@ static void handle_pspoll(local_info_t *local,
         struct sta_info *sta;
         u16 aid;
         struct sk_buff *skb;
-        DECLARE_MAC_BUF(mac);
 
-        PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=%s"
-               ", TA=%s PWRMGT=%d\n",
-               print_mac(mac, hdr->addr1), print_mac(mac, hdr->addr2),
+        PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=" MAC_FMT
+               ", TA=" MAC_FMT " PWRMGT=%d\n",
+               hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+               hdr->addr1[3], hdr->addr1[4], hdr->addr1[5],
+               hdr->addr2[0], hdr->addr2[1], hdr->addr2[2],
+               hdr->addr2[3], hdr->addr2[4], hdr->addr2[5],
                !!(le16_to_cpu(hdr->frame_ctl) & IEEE80211_FCTL_PM));
 
         if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
-                PDEBUG(DEBUG_AP, "handle_pspoll - addr1(BSSID)=%s"
-                       " not own MAC\n", print_mac(mac, hdr->addr1));
+                PDEBUG(DEBUG_AP, "handle_pspoll - addr1(BSSID)=" MAC_FMT
+                       " not own MAC\n",
+                       hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                       hdr->addr1[3], hdr->addr1[4], hdr->addr1[5]);
                 return;
         }
 
@@ -1969,7 +1999,6 @@ static void handle_wds_oper_queue(struct work_struct *work)
                                           wds_oper_queue);
         local_info_t *local = ap->local;
         struct wds_oper_data *entry, *prev;
-        DECLARE_MAC_BUF(mac);
 
         spin_lock_bh(&local->lock);
         entry = local->ap->wds_oper_entries;
@@ -1978,10 +2007,11 @@ static void handle_wds_oper_queue(struct work_struct *work)
 
         while (entry) {
                 PDEBUG(DEBUG_AP, "%s: %s automatic WDS connection "
-                       "to AP %s\n",
+                       "to AP " MAC_FMT "\n",
                        local->dev->name,
                        entry->type == WDS_ADD ? "adding" : "removing",
-                       print_mac(mac, entry->addr));
+                       entry->addr[0], entry->addr[1], entry->addr[2],
+                       entry->addr[3], entry->addr[4], entry->addr[5]);
                 if (entry->type == WDS_ADD)
                         prism2_wds_add(local, entry->addr, 0);
                 else if (entry->type == WDS_DEL)
@@ -2158,7 +2188,6 @@ static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
         u16 fc, type, stype;
         struct ieee80211_hdr_4addr *hdr;
-        DECLARE_MAC_BUF(mac);
 
         /* FIX: should give skb->len to handler functions and check that the
          * buffer is long enough */
@@ -2187,8 +2216,9 @@ static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
 
                 if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
                         PDEBUG(DEBUG_AP, "handle_ap_item - addr1(BSSID)="
-                               "%s not own MAC\n",
-                               print_mac(mac, hdr->addr1));
+                               MAC_FMT " not own MAC\n",
+                               hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                               hdr->addr1[3], hdr->addr1[4], hdr->addr1[5]);
                         goto done;
                 }
 
@@ -2224,14 +2254,18 @@ static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
         }
 
         if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
-                PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=%s"
-                       " not own MAC\n", print_mac(mac, hdr->addr1));
+                PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=" MAC_FMT
+                       " not own MAC\n",
+                       hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                       hdr->addr1[3], hdr->addr1[4], hdr->addr1[5]);
                 goto done;
         }
 
         if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN)) {
-                PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=%s"
-                       " not own MAC\n", print_mac(mac, hdr->addr3));
+                PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=" MAC_FMT
+                       " not own MAC\n",
+                       hdr->addr3[0], hdr->addr3[1], hdr->addr3[2],
+                       hdr->addr3[3], hdr->addr3[4], hdr->addr3[5]);
                 goto done;
         }
 
@@ -2312,7 +2346,6 @@ static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
         struct sk_buff *skb;
         struct ieee80211_hdr_4addr *hdr;
         struct hostap_80211_rx_status rx_stats;
-        DECLARE_MAC_BUF(mac);
 
         if (skb_queue_empty(&sta->tx_buf))
                 return;
@@ -2334,7 +2367,9 @@ static void schedule_packet_send(local_info_t *local, struct sta_info *sta)
         hdr->duration_id = cpu_to_le16(sta->aid | BIT(15) | BIT(14));
 
         PDEBUG(DEBUG_PS2, "%s: Scheduling buffered packet delivery for STA "
-               "%s\n", local->dev->name, print_mac(mac, sta->addr));
+               MAC_FMT "\n", local->dev->name,
+               sta->addr[0], sta->addr[1], sta->addr[2],
+               sta->addr[3], sta->addr[4], sta->addr[5]);
 
         skb->dev = local->dev;
 
@@ -2661,7 +2696,6 @@ static int ap_update_sta_tx_rate(struct sta_info *sta, struct net_device *dev)
         int ret = sta->tx_rate;
         struct hostap_interface *iface;
         local_info_t *local;
-        DECLARE_MAC_BUF(mac);
 
         iface = netdev_priv(dev);
         local = iface->local;
@@ -2689,9 +2723,12 @@ static int ap_update_sta_tx_rate(struct sta_info *sta, struct net_device *dev)
                         case 3: sta->tx_rate = 110; break;
                         default: sta->tx_rate = 0; break;
                         }
-                        PDEBUG(DEBUG_AP, "%s: STA %s"
+                        PDEBUG(DEBUG_AP, "%s: STA " MAC_FMT
                                " TX rate raised to %d\n",
-                               dev->name, print_mac(mac, sta->addr), sta->tx_rate);
+                               dev->name,
+                               sta->addr[0], sta->addr[1], sta->addr[2],
+                               sta->addr[3], sta->addr[4], sta->addr[5],
+                               sta->tx_rate);
                 }
                 sta->tx_since_last_failure = 0;
         }
@@ -2709,7 +2746,6 @@ ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
         int set_tim, ret;
         struct ieee80211_hdr_4addr *hdr;
         struct hostap_skb_tx_data *meta;
-        DECLARE_MAC_BUF(mac);
 
         meta = (struct hostap_skb_tx_data *) skb->cb;
         ret = AP_TX_CONTINUE;
@@ -2745,8 +2781,9 @@ ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
                  * print out any errors here. */
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "AP: drop packet to non-associated "
-                               "STA %s\n",
-                               print_mac(mac, hdr->addr1));
+                               "STA " MAC_FMT "\n",
+                               hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                               hdr->addr1[3], hdr->addr1[4], hdr->addr1[5]);
                 }
 #endif
                 local->ap->tx_drop_nonassoc++;
@@ -2784,9 +2821,11 @@ ap_tx_ret hostap_handle_sta_tx(local_info_t *local, struct hostap_tx_data *tx)
         }
 
         if (skb_queue_len(&sta->tx_buf) >= STA_MAX_TX_BUFFER) {
-                PDEBUG(DEBUG_PS, "%s: No more space in STA (%s"
+                PDEBUG(DEBUG_PS, "%s: No more space in STA (" MAC_FMT
                        ")'s PS mode buffer\n",
-                       local->dev->name, print_mac(mac, sta->addr));
+                       local->dev->name,
+                       sta->addr[0], sta->addr[1], sta->addr[2],
+                       sta->addr[3], sta->addr[4], sta->addr[5]);
                 /* Make sure that TIM is set for the station (it might not be
                  * after AP wlan hw reset). */
                 /* FIX: should fix hw reset to restore bits based on STA
@@ -2850,7 +2889,6 @@ void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
         struct sta_info *sta;
         struct ieee80211_hdr_4addr *hdr;
         struct hostap_skb_tx_data *meta;
-        DECLARE_MAC_BUF(mac);
 
         hdr = (struct ieee80211_hdr_4addr *) skb->data;
         meta = (struct hostap_skb_tx_data *) skb->cb;
@@ -2859,9 +2897,12 @@ void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
         sta = ap_get_sta(local->ap, hdr->addr1);
         if (!sta) {
                 spin_unlock(&local->ap->sta_table_lock);
-                PDEBUG(DEBUG_AP, "%s: Could not find STA %s"
+                PDEBUG(DEBUG_AP, "%s: Could not find STA " MAC_FMT
                        " for this TX error (@%lu)\n",
-                       local->dev->name, print_mac(mac, hdr->addr1), jiffies);
+                       local->dev->name,
+                       hdr->addr1[0], hdr->addr1[1], hdr->addr1[2],
+                       hdr->addr1[3], hdr->addr1[4], hdr->addr1[5],
+                       jiffies);
                 return;
         }
 
@@ -2888,9 +2929,11 @@ void hostap_handle_sta_tx_exc(local_info_t *local, struct sk_buff *skb)
                         case 3: sta->tx_rate = 110; break;
                         default: sta->tx_rate = 0; break;
                         }
-                        PDEBUG(DEBUG_AP, "%s: STA %s"
+                        PDEBUG(DEBUG_AP, "%s: STA " MAC_FMT
                                " TX rate lowered to %d\n",
-                               local->dev->name, print_mac(mac, sta->addr),
+                               local->dev->name,
+                               sta->addr[0], sta->addr[1], sta->addr[2],
+                               sta->addr[3], sta->addr[4], sta->addr[5],
                                sta->tx_rate);
                 }
                 sta->tx_consecutive_exc = 0;
@@ -2956,7 +2999,6 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
         struct sta_info *sta;
         u16 fc, type, stype;
         struct ieee80211_hdr_4addr *hdr;
-        DECLARE_MAC_BUF(mac);
 
         if (local->ap == NULL)
                 return AP_RX_CONTINUE;
@@ -2988,9 +3030,12 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                         } else {
                                 printk(KERN_DEBUG "%s: dropped received packet"
                                        " from non-associated STA "
-                                       "%s"
+                                       MAC_FMT
                                        " (type=0x%02x, subtype=0x%02x)\n",
-                                       dev->name, print_mac(mac, hdr->addr2),
+                                       dev->name,
+                                       hdr->addr2[0], hdr->addr2[1],
+                                       hdr->addr2[2], hdr->addr2[3],
+                                       hdr->addr2[4], hdr->addr2[5],
                                        type >> 2, stype >> 4);
                                 hostap_rx(dev, skb, rx_stats);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
@@ -3025,8 +3070,11 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                          * being associated. */
                         printk(KERN_DEBUG "%s: rejected received nullfunc "
                                "frame without ToDS from not associated STA "
-                               "%s\n",
-                               dev->name, print_mac(mac, hdr->addr2));
+                               MAC_FMT "\n",
+                               dev->name,
+                               hdr->addr2[0], hdr->addr2[1],
+                               hdr->addr2[2], hdr->addr2[3],
+                               hdr->addr2[4], hdr->addr2[5]);
                         hostap_rx(dev, skb, rx_stats);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
                 }
@@ -3043,9 +3091,12 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                  * If BSSID is own, report the dropping of this frame. */
                 if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
                         printk(KERN_DEBUG "%s: dropped received packet from "
-                               "%s with no ToDS flag "
+                               MAC_FMT " with no ToDS flag "
                                "(type=0x%02x, subtype=0x%02x)\n", dev->name,
-                               print_mac(mac, hdr->addr2), type >> 2, stype >> 4);
+                               hdr->addr2[0], hdr->addr2[1],
+                               hdr->addr2[2], hdr->addr2[3],
+                               hdr->addr2[4], hdr->addr2[5],
+                               type >> 2, stype >> 4);
                         hostap_dump_rx_80211(dev->name, skb, rx_stats);
                 }
                 ret = AP_RX_DROP;
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index a56d9fc6354f..98d6ff69d375 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -10192,7 +10192,6 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
         u8 id, hdr_len, unicast;
         u16 remaining_bytes;
         int fc;
-        DECLARE_MAC_BUF(mac);
 
         hdr_len = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
         switch (priv->ieee->iw_mode) {
@@ -10203,8 +10202,10 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct ieee80211_txb *txb,
                         id = ipw_add_station(priv, hdr->addr1);
                         if (id == IPW_INVALID_STATION) {
                                 IPW_WARNING("Attempt to send data to "
-                                            "invalid cell: %s\n",
-                                            print_mac(mac, hdr->addr1));
+                                            "invalid cell: " MAC_FMT "\n",
+                                            hdr->addr1[0], hdr->addr1[1],
+                                            hdr->addr1[2], hdr->addr1[3],
+                                            hdr->addr1[4], hdr->addr1[5]);
                                 goto drop;
                         }
                 }
@@ -11576,6 +11577,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
         priv->prom_priv->priv = priv;
 
         strcpy(priv->prom_net_dev->name, "rtap%d");
+        memcpy(priv->prom_net_dev->dev_addr, priv->mac_addr, ETH_ALEN);
 
         priv->prom_net_dev->type = ARPHRD_IEEE80211_RADIOTAP;
         priv->prom_net_dev->open = ipw_prom_open;
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index b79a35a40ab6..b54ff712e703 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -35,7 +35,6 @@ config IWL4965_HT
         bool "Enable 802.11n HT features in iwl4965 driver"
         depends on EXPERIMENTAL
         depends on IWL4965 && IWL4965_QOS
-        depends on n
         ---help---
           This option enables IEEE 802.11n High Throughput features
           for the iwl4965 driver.
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index 87e145ffe8f1..6a24ed6067e0 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -541,7 +541,7 @@ void lbs_association_worker(struct work_struct *work)
         }
 
         if (find_any_ssid) {
-                u8 new_mode;
+                u8 new_mode = assoc_req->mode;
 
                 ret = lbs_find_best_network_ssid(priv, assoc_req->ssid,
                                 &assoc_req->ssid_len, assoc_req->mode, &new_mode);
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 93ea212fedd5..ad2e7d53b3da 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2399,10 +2399,8 @@ static int rt61pci_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
          * beacon frame.
          */
         if (skb_headroom(skb) < TXD_DESC_SIZE) {
-                if (pskb_expand_head(skb, TXD_DESC_SIZE, 0, GFP_ATOMIC)) {
-                        dev_kfree_skb(skb);
+                if (pskb_expand_head(skb, TXD_DESC_SIZE, 0, GFP_ATOMIC))
                         return -ENOMEM;
-                }
         }
 
         /*
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 9e7de63b26ef..02a4c8cf2b2d 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -252,6 +252,7 @@ config RTC_DRV_TWL92330
 
 config RTC_DRV_S35390A
         tristate "Seiko Instruments S-35390A"
+        select BITREVERSE
         help
           If you say yes here you will get support for the Seiko
           Instruments S-35390A.
diff --git a/drivers/rtc/rtc-at32ap700x.c b/drivers/rtc/rtc-at32ap700x.c
index d3b9b14267ab..42244f14b41c 100644
--- a/drivers/rtc/rtc-at32ap700x.c
+++ b/drivers/rtc/rtc-at32ap700x.c
@@ -290,7 +290,7 @@ static int __exit at32_rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
-MODULE_ALIAS("at32ap700x_rtc");
+MODULE_ALIAS("platform:at32ap700x_rtc");
 
 static struct platform_driver at32_rtc_driver = {
         .remove         = __exit_p(at32_rtc_remove),
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index 33795e5a5595..52abffc86bcd 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -407,3 +407,4 @@ module_exit(at91_rtc_exit);
 MODULE_AUTHOR("Rick Bronson");
 MODULE_DESCRIPTION("RTC driver for Atmel AT91RM9200");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:at91_rtc");
diff --git a/drivers/rtc/rtc-bfin.c b/drivers/rtc/rtc-bfin.c
index d90ba860d216..4f28045d9ef2 100644
--- a/drivers/rtc/rtc-bfin.c
+++ b/drivers/rtc/rtc-bfin.c
@@ -470,3 +470,4 @@ module_exit(bfin_rtc_exit);
 MODULE_DESCRIPTION("Blackfin On-Chip Real Time Clock Driver");
 MODULE_AUTHOR("Mike Frysinger <vapier@gentoo.org>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:rtc-bfin");
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index f3ee2ad566b4..b48517021ee6 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -943,6 +943,9 @@ static void cmos_platform_shutdown(struct platform_device *pdev)
         cmos_do_shutdown();
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:rtc_cmos");
+
 static struct platform_driver cmos_platform_driver = {
         .remove         = __exit_p(cmos_platform_remove),
         .shutdown       = cmos_platform_shutdown,
diff --git a/drivers/rtc/rtc-ds1216.c b/drivers/rtc/rtc-ds1216.c
index 83efb88f8f23..0b17770b032b 100644
--- a/drivers/rtc/rtc-ds1216.c
+++ b/drivers/rtc/rtc-ds1216.c
@@ -221,6 +221,7 @@ MODULE_AUTHOR("Thomas Bogendoerfer <tsbogend@alpha.franken.de>");
 MODULE_DESCRIPTION("DS1216 RTC driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
+MODULE_ALIAS("platform:rtc-ds1216");
 
 module_init(ds1216_rtc_init);
 module_exit(ds1216_rtc_exit);
diff --git a/drivers/rtc/rtc-ds1511.c b/drivers/rtc/rtc-ds1511.c
index d74b8086fa31..d08912f18ddd 100644
--- a/drivers/rtc/rtc-ds1511.c
+++ b/drivers/rtc/rtc-ds1511.c
@@ -626,6 +626,9 @@ ds1511_rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:ds1511");
+
 static struct platform_driver ds1511_rtc_driver = {
         .probe          = ds1511_rtc_probe,
         .remove         = __devexit_p(ds1511_rtc_remove),
diff --git a/drivers/rtc/rtc-ds1553.c b/drivers/rtc/rtc-ds1553.c
index d9e848dcd450..a19f11415540 100644
--- a/drivers/rtc/rtc-ds1553.c
+++ b/drivers/rtc/rtc-ds1553.c
@@ -391,6 +391,9 @@ static int __devexit ds1553_rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:rtc-ds1553");
+
 static struct platform_driver ds1553_rtc_driver = {
         .probe          = ds1553_rtc_probe,
         .remove         = __devexit_p(ds1553_rtc_remove),
diff --git a/drivers/rtc/rtc-ds1742.c b/drivers/rtc/rtc-ds1742.c
index 2e73f0b183b2..24d35ede2dbf 100644
--- a/drivers/rtc/rtc-ds1742.c
+++ b/drivers/rtc/rtc-ds1742.c
@@ -276,3 +276,4 @@ MODULE_AUTHOR("Atsushi Nemoto <anemo@mba.ocn.ne.jp>");
 MODULE_DESCRIPTION("Dallas DS1742 RTC driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
+MODULE_ALIAS("platform:rtc-ds1742");
diff --git a/drivers/rtc/rtc-ep93xx.c b/drivers/rtc/rtc-ep93xx.c
index ef4f147f3c0c..1e99325270df 100644
--- a/drivers/rtc/rtc-ep93xx.c
+++ b/drivers/rtc/rtc-ep93xx.c
@@ -132,6 +132,9 @@ static int __devexit ep93xx_rtc_remove(struct platform_device *dev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:ep93xx-rtc");
+
 static struct platform_driver ep93xx_rtc_platform_driver = {
         .driver         = {
                 .name   = "ep93xx-rtc",
diff --git a/drivers/rtc/rtc-m48t59.c b/drivers/rtc/rtc-m48t59.c
index cd0bbc0e8038..013e6c103b9c 100644
--- a/drivers/rtc/rtc-m48t59.c
+++ b/drivers/rtc/rtc-m48t59.c
@@ -465,6 +465,9 @@ static int __devexit m48t59_rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:rtc-m48t59");
+
 static struct platform_driver m48t59_rtc_driver = {
         .driver         = {
                 .name   = "rtc-m48t59",
diff --git a/drivers/rtc/rtc-m48t86.c b/drivers/rtc/rtc-m48t86.c
index 8ff4a1221f59..3f7f99a5d96a 100644
--- a/drivers/rtc/rtc-m48t86.c
+++ b/drivers/rtc/rtc-m48t86.c
@@ -199,6 +199,7 @@ MODULE_AUTHOR("Alessandro Zummo <a.zummo@towertech.it>");
 MODULE_DESCRIPTION("M48T86 RTC driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
+MODULE_ALIAS("platform:rtc-m48t86");
 
 module_init(m48t86_rtc_init);
 module_exit(m48t86_rtc_exit);
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index a2f84f169588..58f81c774943 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -497,7 +497,7 @@ static void omap_rtc_shutdown(struct platform_device *pdev)
         rtc_write(0, OMAP_RTC_INTERRUPTS_REG);
 }
 
-MODULE_ALIAS("omap_rtc");
+MODULE_ALIAS("platform:omap_rtc");
 static struct platform_driver omap_rtc_driver = {
         .probe          = omap_rtc_probe,
         .remove         = __devexit_p(omap_rtc_remove),
diff --git a/drivers/rtc/rtc-rs5c313.c b/drivers/rtc/rtc-rs5c313.c
index 66eb133bf5fd..664e89a817ed 100644
--- a/drivers/rtc/rtc-rs5c313.c
+++ b/drivers/rtc/rtc-rs5c313.c
@@ -421,3 +421,4 @@ MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR("kogiidena , Nobuhiro Iwamatsu <iwamatsu@nigauri.org>");
 MODULE_DESCRIPTION("Ricoh RS5C313 RTC device driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 86766f1f2496..9f4d5129a496 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -592,3 +592,4 @@ module_exit(s3c_rtc_exit);
 MODULE_DESCRIPTION("Samsung S3C RTC Driver");
 MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:s3c2410-rtc");
diff --git a/drivers/rtc/rtc-sa1100.c b/drivers/rtc/rtc-sa1100.c
index ee253cc45de1..82f62d25f921 100644
--- a/drivers/rtc/rtc-sa1100.c
+++ b/drivers/rtc/rtc-sa1100.c
@@ -399,3 +399,4 @@ module_exit(sa1100_rtc_exit);
 MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
 MODULE_DESCRIPTION("SA11x0/PXA2xx Realtime Clock Driver (RTC)");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:sa1100-rtc");
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index c1d6a1880ccf..9e9caa5d7f5f 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -664,3 +664,4 @@ MODULE_DESCRIPTION("SuperH on-chip RTC driver");
 MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR("Paul Mundt <lethal@linux-sh.org>, Jamie Lenehan <lenehan@twibble.org>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/rtc/rtc-stk17ta8.c b/drivers/rtc/rtc-stk17ta8.c
index a265da7c6ff8..31d3c8c28588 100644
--- a/drivers/rtc/rtc-stk17ta8.c
+++ b/drivers/rtc/rtc-stk17ta8.c
@@ -394,6 +394,9 @@ static int __devexit stk17ta8_rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:stk17ta8");
+
 static struct platform_driver stk17ta8_rtc_driver = {
         .probe          = stk17ta8_rtc_probe,
         .remove         = __devexit_p(stk17ta8_rtc_remove),
diff --git a/drivers/rtc/rtc-v3020.c b/drivers/rtc/rtc-v3020.c
index a6b572978dc0..24203a06051a 100644
--- a/drivers/rtc/rtc-v3020.c
+++ b/drivers/rtc/rtc-v3020.c
@@ -264,3 +264,4 @@ module_exit(v3020_exit);
 MODULE_DESCRIPTION("V3020 RTC");
 MODULE_AUTHOR("Raphael Assenat");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:v3020");
diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
index ce2f78de7a80..be9c70d0b193 100644
--- a/drivers/rtc/rtc-vr41xx.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -422,6 +422,9 @@ static int __devexit rtc_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:RTC");
+
 static struct platform_driver rtc_platform_driver = {
         .probe          = rtc_probe,
         .remove         = __devexit_p(rtc_remove),
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 85687aaf9cab..1749a27be066 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -863,3 +863,4 @@ module_exit(atmel_spi_exit);
 MODULE_DESCRIPTION("Atmel AT32/AT91 SPI Controller driver");
 MODULE_AUTHOR("Haavard Skinnemoen <hskinnemoen@atmel.com>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:atmel_spi");
diff --git a/drivers/spi/au1550_spi.c b/drivers/spi/au1550_spi.c
index 41a3d00c4515..072c4a595334 100644
--- a/drivers/spi/au1550_spi.c
+++ b/drivers/spi/au1550_spi.c
@@ -958,6 +958,9 @@ static int __exit au1550_spi_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:au1550-spi");
+
 static struct platform_driver au1550_spi_drv = {
         .remove = __exit_p(au1550_spi_remove),
         .driver = {
diff --git a/drivers/spi/mpc52xx_psc_spi.c b/drivers/spi/mpc52xx_psc_spi.c
index a86315a0c5b8..90729469d481 100644
--- a/drivers/spi/mpc52xx_psc_spi.c
+++ b/drivers/spi/mpc52xx_psc_spi.c
@@ -500,6 +500,9 @@ static int __exit mpc52xx_psc_spi_remove(struct platform_device *dev)
         return mpc52xx_psc_spi_do_remove(&dev->dev);
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:mpc52xx-psc-spi");
+
 static struct platform_driver mpc52xx_psc_spi_platform_driver = {
         .remove = __exit_p(mpc52xx_psc_spi_remove),
         .driver = {
diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index a6ba11afb03f..b1cc148036c1 100644
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -1084,6 +1084,9 @@ static int __exit omap2_mcspi_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:omap2_mcspi");
+
 static struct platform_driver omap2_mcspi_driver = {
         .driver = {
                 .name =         "omap2_mcspi",
diff --git a/drivers/spi/omap_uwire.c b/drivers/spi/omap_uwire.c
index 8245b5153f30..5f00bd6500ef 100644
--- a/drivers/spi/omap_uwire.c
+++ b/drivers/spi/omap_uwire.c
@@ -537,10 +537,12 @@ static int __exit uwire_remove(struct platform_device *pdev)
         return status;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:omap_uwire");
+
 static struct platform_driver uwire_driver = {
         .driver = {
                 .name           = "omap_uwire",
-                .bus            = &platform_bus_type,
                 .owner          = THIS_MODULE,
         },
         .remove         = __exit_p(uwire_remove),
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 59deed79e0ab..147e26a78d64 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -44,6 +44,7 @@
 MODULE_AUTHOR("Stephen Street");
 MODULE_DESCRIPTION("PXA2xx SSP SPI Controller");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:pxa2xx-spi");
 
 #define MAX_BUSES 3
 
@@ -1581,7 +1582,6 @@ static int pxa2xx_spi_resume(struct platform_device *pdev)
 static struct platform_driver driver = {
         .driver = {
                 .name = "pxa2xx-spi",
-                .bus = &platform_bus_type,
                 .owner = THIS_MODULE,
         },
         .remove = pxa2xx_spi_remove,
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index 6635e15e5a7a..a9ac1fdb3094 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -1396,7 +1396,7 @@ static int bfin5xx_spi_resume(struct platform_device *pdev)
 #define bfin5xx_spi_resume NULL
 #endif                          /* CONFIG_PM */
 
-MODULE_ALIAS("bfin-spi-master");        /* for platform bus hotplug */
+MODULE_ALIAS("platform:bfin-spi");
 static struct platform_driver bfin5xx_spi_driver = {
         .driver = {
                 .name   = DRV_NAME,
diff --git a/drivers/spi/spi_imx.c b/drivers/spi/spi_imx.c
index 1b0647124933..d4ba640366b6 100644
--- a/drivers/spi/spi_imx.c
+++ b/drivers/spi/spi_imx.c
@@ -1722,10 +1722,12 @@ static int spi_imx_resume(struct platform_device *pdev)
 #define spi_imx_resume NULL
 #endif /* CONFIG_PM */
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:spi_imx");
+
 static struct platform_driver driver = {
         .driver = {
                 .name = "spi_imx",
-                .bus = &platform_bus_type,
                 .owner = THIS_MODULE,
         },
         .remove = __exit_p(spi_imx_remove),
diff --git a/drivers/spi/spi_mpc83xx.c b/drivers/spi/spi_mpc83xx.c
index 04f7cd9fc261..be15a6213205 100644
--- a/drivers/spi/spi_mpc83xx.c
+++ b/drivers/spi/spi_mpc83xx.c
@@ -523,11 +523,12 @@ static int __exit mpc83xx_spi_remove(struct platform_device *dev)
         return 0;
 }
 
-MODULE_ALIAS("mpc83xx_spi");                    /* for platform bus hotplug */
+MODULE_ALIAS("platform:mpc83xx_spi");
 static struct platform_driver mpc83xx_spi_driver = {
         .remove = __exit_p(mpc83xx_spi_remove),
         .driver = {
-                   .name = "mpc83xx_spi",
+                .name = "mpc83xx_spi",
+                .owner = THIS_MODULE,
         },
 };
 
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 6e834b8b9d27..e75103aac790 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -415,7 +415,7 @@ static int s3c24xx_spi_resume(struct platform_device *pdev)
 #define s3c24xx_spi_resume  NULL
 #endif
 
-MODULE_ALIAS("s3c2410_spi");                    /* for platform bus hotplug */
+MODULE_ALIAS("platform:s3c2410-spi");
 static struct platform_driver s3c24xx_spidrv = {
         .remove         = __exit_p(s3c24xx_spi_remove),
         .suspend        = s3c24xx_spi_suspend,
diff --git a/drivers/spi/spi_s3c24xx_gpio.c b/drivers/spi/spi_s3c24xx_gpio.c
index 82ae7d7eca38..e33f6145c560 100644
--- a/drivers/spi/spi_s3c24xx_gpio.c
+++ b/drivers/spi/spi_s3c24xx_gpio.c
@@ -168,6 +168,8 @@ static int s3c2410_spigpio_remove(struct platform_device *dev)
 #define s3c2410_spigpio_suspend NULL
 #define s3c2410_spigpio_resume NULL
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:spi_s3c24xx_gpio");
 
 static struct platform_driver s3c2410_spigpio_drv = {
         .probe          = s3c2410_spigpio_probe,
diff --git a/drivers/spi/spi_sh_sci.c b/drivers/spi/spi_sh_sci.c
index 3dbe71b16d60..7d36720eb982 100644
--- a/drivers/spi/spi_sh_sci.c
+++ b/drivers/spi/spi_sh_sci.c
@@ -203,3 +203,4 @@ module_exit(sh_sci_spi_exit);
 MODULE_DESCRIPTION("SH SCI SPI Driver");
 MODULE_AUTHOR("Magnus Damm <damm@opensource.se>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:spi_sh_sci");
diff --git a/drivers/spi/spi_txx9.c b/drivers/spi/spi_txx9.c
index 363ac8e68821..2296f37ea3c6 100644
--- a/drivers/spi/spi_txx9.c
+++ b/drivers/spi/spi_txx9.c
@@ -450,6 +450,9 @@ static int __exit txx9spi_remove(struct platform_device *dev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:spi_txx9");
+
 static struct platform_driver txx9spi_driver = {
         .remove = __exit_p(txx9spi_remove),
         .driver = {
diff --git a/drivers/spi/xilinx_spi.c b/drivers/spi/xilinx_spi.c
index 5d04f520c123..cf6aef34fe25 100644
--- a/drivers/spi/xilinx_spi.c
+++ b/drivers/spi/xilinx_spi.c
@@ -408,6 +408,9 @@ static int __devexit xilinx_spi_remove(struct platform_device *dev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:" XILINX_SPI_NAME);
+
 static struct platform_driver xilinx_spi_driver = {
         .probe  = xilinx_spi_probe,
         .remove = __devexit_p(xilinx_spi_remove),
diff --git a/drivers/ssb/driver_mipscore.c b/drivers/ssb/driver_mipscore.c
index 3d3dd32bf3ab..a9e7eb45b2e7 100644
--- a/drivers/ssb/driver_mipscore.c
+++ b/drivers/ssb/driver_mipscore.c
@@ -109,12 +109,13 @@ static void set_irq(struct ssb_device *dev, unsigned int irq)
                 clear_irq(bus, oldirq);
 
         /* assign the new one */
-        if (irq == 0)
-                ssb_write32(mdev, SSB_INTVEC, ((1 << irqflag) & ssb_read32(mdev, SSB_INTVEC)));
-
-        irqflag <<= ipsflag_irq_shift[irq];
-        irqflag |= (ssb_read32(mdev, SSB_IPSFLAG) & ~ipsflag_irq_mask[irq]);
-        ssb_write32(mdev, SSB_IPSFLAG, irqflag);
+        if (irq == 0) {
+                ssb_write32(mdev, SSB_INTVEC, ((1 << irqflag) | ssb_read32(mdev, SSB_INTVEC)));
+        } else {
+                irqflag <<= ipsflag_irq_shift[irq];
+                irqflag |= (ssb_read32(mdev, SSB_IPSFLAG) & ~ipsflag_irq_mask[irq]);
+                ssb_write32(mdev, SSB_IPSFLAG, irqflag);
+        }
 }
 
 static void ssb_mips_serial_init(struct ssb_mipscore *mcore)
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 74b9a8aea52b..5d777f211699 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -551,7 +551,7 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
                 } else {
                         tmp = ssb_read32(dev, SSB_TPSFLAG);
                         tmp &= SSB_TPSFLAG_BPFLAG;
-                        intvec |= tmp;
+                        intvec |= (1 << tmp);
                 }
                 ssb_write32(pdev, SSB_INTVEC, intvec);
         }
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index bedb2b4ee9d2..72017bf2e577 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -1044,6 +1044,12 @@ int ssb_bus_may_powerdown(struct ssb_bus *bus)
                 goto out;
 
         cc = &bus->chipco;
+
+        if (!cc->dev)
+                goto out;
+        if (cc->dev->id.revision < 5)
+                goto out;
+
         ssb_chipco_set_clockmode(cc, SSB_CLKMODE_SLOW);
         err = ssb_pci_xtal(bus, SSB_GPIO_XTAL | SSB_GPIO_PLL, 0);
         if (err)
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index a83e8b798ec9..fd15ced899d8 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1884,3 +1884,4 @@ module_exit(udc_exit_module);
 MODULE_DESCRIPTION("AT91 udc driver");
 MODULE_AUTHOR("Thomas Rathbone, David Brownell");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:at91_udc");
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index af8b2a3a2d4a..b0db4c31d018 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -2054,6 +2054,7 @@ static struct platform_driver udc_driver = {
         .remove         = __exit_p(usba_udc_remove),
         .driver         = {
                 .name           = "atmel_usba_udc",
+                .owner          = THIS_MODULE,
         },
 };
 
@@ -2072,3 +2073,4 @@ module_exit(udc_exit);
 MODULE_DESCRIPTION("Atmel USBA UDC driver");
 MODULE_AUTHOR("Haavard Skinnemoen <hskinnemoen@atmel.com>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:atmel_usba_udc");
diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
index 63e8fa3a69e1..254012ad2b91 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.c
+++ b/drivers/usb/gadget/fsl_usb2_udc.c
@@ -2475,3 +2475,4 @@ module_exit(udc_exit);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:fsl-usb2-udc");
diff --git a/drivers/usb/gadget/lh7a40x_udc.c b/drivers/usb/gadget/lh7a40x_udc.c
index 37243ef7104e..078f72467671 100644
--- a/drivers/usb/gadget/lh7a40x_udc.c
+++ b/drivers/usb/gadget/lh7a40x_udc.c
@@ -2146,3 +2146,4 @@ module_exit(udc_exit);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Mikko Lahteenmaki, Bo Henriksen");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:lh7a40x_udc");
diff --git a/drivers/usb/gadget/m66592-udc.c b/drivers/usb/gadget/m66592-udc.c
index 835948f0715a..ee6b35fa870f 100644
--- a/drivers/usb/gadget/m66592-udc.c
+++ b/drivers/usb/gadget/m66592-udc.c
@@ -35,6 +35,7 @@
 MODULE_DESCRIPTION("M66592 USB gadget driver");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yoshihiro Shimoda");
+MODULE_ALIAS("platform:m66592_udc");
 
 #define DRIVER_VERSION  "18 Oct 2007"
 
@@ -1671,6 +1672,7 @@ static struct platform_driver m66592_driver = {
         .remove =       __exit_p(m66592_remove),
         .driver         = {
                 .name = (char *) udc_name,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index e6d68bda428a..ee1e9a314cd1 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -3109,4 +3109,4 @@ module_exit(udc_exit);
 
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
-
+MODULE_ALIAS("platform:omap_udc");
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index 096c41cc40d1..c00cd8b9d3d1 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -2380,4 +2380,4 @@ module_exit(udc_exit);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Frank Becker, Robert Schwebel, David Brownell");
 MODULE_LICENSE("GPL");
-
+MODULE_ALIAS("platform:pxa2xx-udc");
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index aadc4204d6f9..6b1ef488043b 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -2047,3 +2047,5 @@ MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_VERSION(DRIVER_VERSION);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:s3c2410-usbgadget");
+MODULE_ALIAS("platform:s3c2440-usbgadget");
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index d7071c855758..203a3359a648 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -1684,14 +1684,18 @@ static int isp116x_resume(struct platform_device *dev)
 
 #endif
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:isp116x-hcd");
+
 static struct platform_driver isp116x_driver = {
         .probe = isp116x_probe,
         .remove = isp116x_remove,
         .suspend = isp116x_suspend,
         .resume = isp116x_resume,
         .driver = {
-                   .name = (char *)hcd_name,
-                   },
+                .name = (char *)hcd_name,
+                .owner  = THIS_MODULE,
+        },
 };
 
 /*-----------------------------------------------------------------*/
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 126fcbdd6408..d72dc07dda01 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -355,7 +355,7 @@ static int ohci_hcd_at91_drv_resume(struct platform_device *pdev)
 #define ohci_hcd_at91_drv_resume  NULL
 #endif
 
-MODULE_ALIAS("at91_ohci");
+MODULE_ALIAS("platform:at91_ohci");
 
 static struct platform_driver ohci_hcd_at91_driver = {
         .probe          = ohci_hcd_at91_drv_probe,
@@ -368,4 +368,3 @@ static struct platform_driver ohci_hcd_at91_driver = {
                 .owner  = THIS_MODULE,
         },
 };
-
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index 663a0600b6e7..f90fe0c7373f 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -345,3 +345,4 @@ static struct platform_driver ohci_hcd_au1xxx_driver = {
         },
 };
 
+MODULE_ALIAS("platform:au1xxx-ohci");
diff --git a/drivers/usb/host/ohci-ep93xx.c b/drivers/usb/host/ohci-ep93xx.c
index a68ce9d3c525..156e93a9d0df 100644
--- a/drivers/usb/host/ohci-ep93xx.c
+++ b/drivers/usb/host/ohci-ep93xx.c
@@ -211,6 +211,8 @@ static struct platform_driver ohci_hcd_ep93xx_driver = {
 #endif
         .driver         = {
                 .name   = "ep93xx-ohci",
+                .owner  = THIS_MODULE,
         },
 };
 
+MODULE_ALIAS("platform:ep93xx-ohci");
diff --git a/drivers/usb/host/ohci-lh7a404.c b/drivers/usb/host/ohci-lh7a404.c
index 4a043abd85ea..13c12ed22252 100644
--- a/drivers/usb/host/ohci-lh7a404.c
+++ b/drivers/usb/host/ohci-lh7a404.c
@@ -251,3 +251,4 @@ static struct platform_driver ohci_hcd_lh7a404_driver = {
         },
 };
 
+MODULE_ALIAS("platform:lh7a404-ohci");
diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
index 74e1f4be10bb..7bfca1ed1b58 100644
--- a/drivers/usb/host/ohci-omap.c
+++ b/drivers/usb/host/ohci-omap.c
@@ -544,3 +544,4 @@ static struct platform_driver ohci_hcd_omap_driver = {
         },
 };
 
+MODULE_ALIAS("platform:ohci");
diff --git a/drivers/usb/host/ohci-pnx4008.c b/drivers/usb/host/ohci-pnx4008.c
index 6c52c66b659f..28b458f20cc3 100644
--- a/drivers/usb/host/ohci-pnx4008.c
+++ b/drivers/usb/host/ohci-pnx4008.c
@@ -456,9 +456,13 @@ static int usb_hcd_pnx4008_remove(struct platform_device *pdev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:usb-ohci");
+
 static struct platform_driver usb_hcd_pnx4008_driver = {
         .driver = {
                 .name = "usb-ohci",
+                .owner  = THIS_MODULE,
         },
         .probe = usb_hcd_pnx4008_probe,
         .remove = usb_hcd_pnx4008_remove,
diff --git a/drivers/usb/host/ohci-pnx8550.c b/drivers/usb/host/ohci-pnx8550.c
index 85fdfd2a7ad0..605d59cba28e 100644
--- a/drivers/usb/host/ohci-pnx8550.c
+++ b/drivers/usb/host/ohci-pnx8550.c
@@ -230,11 +230,12 @@ static int ohci_hcd_pnx8550_drv_remove(struct platform_device *pdev)
         return 0;
 }
 
-MODULE_ALIAS("pnx8550-ohci");
+MODULE_ALIAS("platform:pnx8550-ohci");
 
 static struct platform_driver ohci_hcd_pnx8550_driver = {
         .driver = {
-                .name           = "pnx8550-ohci",
+                .name   = "pnx8550-ohci",
+                .owner  = THIS_MODULE,
         },
         .probe          = ohci_hcd_pnx8550_drv_probe,
         .remove         = ohci_hcd_pnx8550_drv_remove,
diff --git a/drivers/usb/host/ohci-ppc-soc.c b/drivers/usb/host/ohci-ppc-soc.c
index f95be1896b0d..523c30125577 100644
--- a/drivers/usb/host/ohci-ppc-soc.c
+++ b/drivers/usb/host/ohci-ppc-soc.c
@@ -213,3 +213,4 @@ static struct platform_driver ohci_hcd_ppc_soc_driver = {
         },
 };
 
+MODULE_ALIAS("platform:ppc-soc-ohci");
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index ff9a79843471..8ad9b3b604b5 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -364,6 +364,8 @@ static int ohci_hcd_pxa27x_drv_resume(struct platform_device *pdev)
 }
 #endif
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:pxa27x-ohci");
 
 static struct platform_driver ohci_hcd_pxa27x_driver = {
         .probe          = ohci_hcd_pxa27x_drv_probe,
@@ -375,6 +377,7 @@ static struct platform_driver ohci_hcd_pxa27x_driver = {
 #endif
         .driver         = {
                 .name   = "pxa27x-ohci",
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/usb/host/ohci-s3c2410.c b/drivers/usb/host/ohci-s3c2410.c
index 44b79e8a6e25..ead4772f0f27 100644
--- a/drivers/usb/host/ohci-s3c2410.c
+++ b/drivers/usb/host/ohci-s3c2410.c
@@ -501,3 +501,4 @@ static struct platform_driver ohci_hcd_s3c2410_driver = {
         },
 };
 
+MODULE_ALIAS("platform:s3c2410-ohci");
diff --git a/drivers/usb/host/ohci-sh.c b/drivers/usb/host/ohci-sh.c
index 5309ac039e15..e7ee607278fe 100644
--- a/drivers/usb/host/ohci-sh.c
+++ b/drivers/usb/host/ohci-sh.c
@@ -141,3 +141,4 @@ static struct platform_driver ohci_hcd_sh_driver = {
         },
 };
 
+MODULE_ALIAS("platform:sh_ohci");
diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
index a97070142869..4ea92762fb28 100644
--- a/drivers/usb/host/ohci-sm501.c
+++ b/drivers/usb/host/ohci-sm501.c
@@ -262,3 +262,4 @@ static struct platform_driver ohci_hcd_sm501_driver = {
                 .name   = "sm501-usb",
         },
 };
+MODULE_ALIAS("platform:sm501-usb");
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 0ce2fc5e396b..9f80e5285575 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -44,6 +44,7 @@
 MODULE_DESCRIPTION("R8A66597 USB Host Controller Driver");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yoshihiro Shimoda");
+MODULE_ALIAS("platform:r8a66597_hcd");
 
 #define DRIVER_VERSION  "29 May 2007"
 
@@ -2219,6 +2220,7 @@ static struct platform_driver r8a66597_driver = {
         .resume =       r8a66597_resume,
         .driver         = {
                 .name = (char *) hcd_name,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index 59be276ccd9d..629bca0ebe8f 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -58,6 +58,7 @@
 
 MODULE_DESCRIPTION("SL811HS USB Host Controller Driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:sl811-hcd");
 
 #define DRIVER_VERSION  "19 May 2005"
 
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
index 3033d6945202..8e117a795e93 100644
--- a/drivers/usb/host/u132-hcd.c
+++ b/drivers/usb/host/u132-hcd.c
@@ -3316,3 +3316,4 @@ static void __exit u132_hcd_exit(void)
 
 module_exit(u132_hcd_exit);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:u132_hcd");
diff --git a/drivers/watchdog/at32ap700x_wdt.c b/drivers/watchdog/at32ap700x_wdt.c
index fb5ed6478f78..ae0fca5e8749 100644
--- a/drivers/watchdog/at32ap700x_wdt.c
+++ b/drivers/watchdog/at32ap700x_wdt.c
@@ -418,6 +418,9 @@ static int at32_wdt_resume(struct platform_device *pdev)
 #define at32_wdt_resume NULL
 #endif
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:at32_wdt");
+
 static struct platform_driver at32_wdt_driver = {
         .remove         = __exit_p(at32_wdt_remove),
         .suspend        = at32_wdt_suspend,
diff --git a/drivers/watchdog/at91rm9200_wdt.c b/drivers/watchdog/at91rm9200_wdt.c
index a684b1e87372..9ff9a9565320 100644
--- a/drivers/watchdog/at91rm9200_wdt.c
+++ b/drivers/watchdog/at91rm9200_wdt.c
@@ -286,3 +286,4 @@ MODULE_AUTHOR("Andrew Victor");
 MODULE_DESCRIPTION("Watchdog driver for Atmel AT91RM9200");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:at91_wdt");
diff --git a/drivers/watchdog/davinci_wdt.c b/drivers/watchdog/davinci_wdt.c
index a61cbd48dc07..1782c79eff06 100644
--- a/drivers/watchdog/davinci_wdt.c
+++ b/drivers/watchdog/davinci_wdt.c
@@ -248,6 +248,7 @@ static int davinci_wdt_remove(struct platform_device *pdev)
 static struct platform_driver platform_wdt_driver = {
         .driver = {
                 .name = "watchdog",
+                .owner  = THIS_MODULE,
         },
         .probe = davinci_wdt_probe,
         .remove = davinci_wdt_remove,
@@ -277,3 +278,4 @@ MODULE_PARM_DESC(heartbeat,
 
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:watchdog");
diff --git a/drivers/watchdog/ks8695_wdt.c b/drivers/watchdog/ks8695_wdt.c
index e3a29c302309..df5a6b811ccd 100644
--- a/drivers/watchdog/ks8695_wdt.c
+++ b/drivers/watchdog/ks8695_wdt.c
@@ -306,3 +306,4 @@ MODULE_AUTHOR("Andrew Victor");
 MODULE_DESCRIPTION("Watchdog driver for KS8695");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:ks8695_wdt");
diff --git a/drivers/watchdog/mpc83xx_wdt.c b/drivers/watchdog/mpc83xx_wdt.c
index 6369f569517f..b16c5cd972eb 100644
--- a/drivers/watchdog/mpc83xx_wdt.c
+++ b/drivers/watchdog/mpc83xx_wdt.c
@@ -206,6 +206,7 @@ static struct platform_driver mpc83xx_wdt_driver = {
         .remove         = __devexit_p(mpc83xx_wdt_remove),
         .driver         = {
                 .name   = "mpc83xx_wdt",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -226,3 +227,4 @@ MODULE_AUTHOR("Dave Updegraff, Kumar Gala");
 MODULE_DESCRIPTION("Driver for watchdog timer in MPC83xx uProcessor");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:mpc83xx_wdt");
diff --git a/drivers/watchdog/mpcore_wdt.c b/drivers/watchdog/mpcore_wdt.c
index 0d2b27735419..009573b81496 100644
--- a/drivers/watchdog/mpcore_wdt.c
+++ b/drivers/watchdog/mpcore_wdt.c
@@ -392,6 +392,9 @@ static int __devexit mpcore_wdt_remove(struct platform_device *dev)
         return 0;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:mpcore_wdt");
+
 static struct platform_driver mpcore_wdt_driver = {
         .probe          = mpcore_wdt_probe,
         .remove         = __devexit_p(mpcore_wdt_remove),
diff --git a/drivers/watchdog/mtx-1_wdt.c b/drivers/watchdog/mtx-1_wdt.c
index 10b89f2703bd..a8e67383784e 100644
--- a/drivers/watchdog/mtx-1_wdt.c
+++ b/drivers/watchdog/mtx-1_wdt.c
@@ -243,6 +243,7 @@ static struct platform_driver mtx1_wdt = {
         .probe = mtx1_wdt_probe,
         .remove = mtx1_wdt_remove,
         .driver.name = "mtx1-wdt",
+        .driver.owner = THIS_MODULE,
 };
 
 static int __init mtx1_wdt_init(void)
@@ -262,3 +263,4 @@ MODULE_AUTHOR("Michael Stickel, Florian Fainelli");
 MODULE_DESCRIPTION("Driver for the MTX-1 watchdog");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:mtx1-wdt");
diff --git a/drivers/watchdog/mv64x60_wdt.c b/drivers/watchdog/mv64x60_wdt.c
index 0365c317f7e1..b59ca3273967 100644
--- a/drivers/watchdog/mv64x60_wdt.c
+++ b/drivers/watchdog/mv64x60_wdt.c
@@ -324,3 +324,4 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("MV64x60 watchdog driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:" MV64x60_WDT_NAME);
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index 635ca454f56b..74bc39aa1ce8 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -387,3 +387,4 @@ module_exit(omap_wdt_exit);
 MODULE_AUTHOR("George G. Davis");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:omap_wdt");
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index b04aa096a10a..6b8483d3c783 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -321,6 +321,7 @@ static int pnx4008_wdt_remove(struct platform_device *pdev)
 static struct platform_driver platform_wdt_driver = {
         .driver = {
                 .name = "watchdog",
+                .owner  = THIS_MODULE,
         },
         .probe = pnx4008_wdt_probe,
         .remove = pnx4008_wdt_remove,
@@ -354,3 +355,4 @@ MODULE_PARM_DESC(nowayout,
 
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:watchdog");
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 7645e8812156..98532c0e0689 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -561,3 +561,4 @@ MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>, "
 MODULE_DESCRIPTION("S3C2410 Watchdog Device Driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:s3c2410-wdt");
diff --git a/drivers/watchdog/txx9wdt.c b/drivers/watchdog/txx9wdt.c
index 328b3c7211ef..57cefef27ce3 100644
--- a/drivers/watchdog/txx9wdt.c
+++ b/drivers/watchdog/txx9wdt.c
@@ -274,3 +274,4 @@ module_exit(watchdog_exit);
 MODULE_DESCRIPTION("TXx9 Watchdog Driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:txx9wdt");
diff --git a/fs/Kconfig b/fs/Kconfig
index d7312825592b..c509123bea49 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -1744,10 +1744,10 @@ config ROOT_NFS
           If you want your Linux box to mount its whole root file system (the
           one containing the directory /) from some other computer over the
           net via NFS (presumably because your box doesn't have a hard disk),
-          say Y. Read <file:Documentation/nfsroot.txt> for details. It is
-          likely that in this case, you also want to say Y to "Kernel level IP
-          autoconfiguration" so that your box can discover its network address
-          at boot time.
+          say Y. Read <file:Documentation/filesystems/nfsroot.txt> for
+          details. It is likely that in this case, you also want to say Y to
+          "Kernel level IP autoconfiguration" so that your box can discover
+          its network address at boot time.
 
           Most people say N here.
 
diff --git a/fs/aio.c b/fs/aio.c
index 6af921940622..228368610dfa 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -936,14 +936,6 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
                 return 1;
         }
 
-        /*
-         * Check if the user asked us to deliver the result through an
-         * eventfd. The eventfd_signal() function is safe to be called
-         * from IRQ context.
-         */
-        if (!IS_ERR(iocb->ki_eventfd))
-                eventfd_signal(iocb->ki_eventfd, 1);
-
         info = &ctx->ring_info;
 
         /* add a completion event to the ring buffer.
@@ -992,6 +984,15 @@ int aio_complete(struct kiocb *iocb, long res, long res2)
         kunmap_atomic(ring, KM_IRQ1);
 
         pr_debug("added to ring %p at [%lu]\n", iocb, tail);
+
+        /*
+         * Check if the user asked us to deliver the result through an
+         * eventfd. The eventfd_signal() function is safe to be called
+         * from IRQ context.
+         */
+        if (!IS_ERR(iocb->ki_eventfd))
+                eventfd_signal(iocb->ki_eventfd, 1);
+
 put_rq:
         /* everything turned out well, dispose of the aiocb. */
         ret = __aio_put_req(ctx, iocb);
@@ -1790,6 +1791,7 @@ asmlinkage long sys_io_getevents(aio_context_t ctx_id,
                 put_ioctx(ioctx);
         }
 
+        asmlinkage_protect(5, ret, ctx_id, min_nr, nr, events, timeout);
         return ret;
 }
 
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 29683645fa0a..5f4023678251 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -340,16 +340,23 @@ static int hfsplus_unlink(struct inode *dir, struct dentry *dentry)
 
         if (inode->i_nlink > 0)
                 drop_nlink(inode);
-        hfsplus_delete_inode(inode);
-        if (inode->i_ino != cnid && !inode->i_nlink) {
-                if (!atomic_read(&HFSPLUS_I(inode).opencnt)) {
-                        res = hfsplus_delete_cat(inode->i_ino, HFSPLUS_SB(sb).hidden_dir, NULL);
-                        if (!res)
-                                hfsplus_delete_inode(inode);
+        if (inode->i_ino == cnid)
+                clear_nlink(inode);
+        if (!inode->i_nlink) {
+                if (inode->i_ino != cnid) {
+                        HFSPLUS_SB(sb).file_count--;
+                        if (!atomic_read(&HFSPLUS_I(inode).opencnt)) {
+                                res = hfsplus_delete_cat(inode->i_ino,
+                                                         HFSPLUS_SB(sb).hidden_dir,
+                                                         NULL);
+                                if (!res)
+                                        hfsplus_delete_inode(inode);
+                        } else
+                                inode->i_flags |= S_DEAD;
                 } else
-                        inode->i_flags |= S_DEAD;
+                        hfsplus_delete_inode(inode);
         } else
-                clear_nlink(inode);
+                HFSPLUS_SB(sb).file_count--;
         inode->i_ctime = CURRENT_TIME_SEC;
         mark_inode_dirty(inode);
 
diff --git a/fs/open.c b/fs/open.c
index a4b12022edaa..3fa4e4ffce4c 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -335,7 +335,7 @@ asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
 {
         long ret = do_sys_ftruncate(fd, length, 1);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(2, ret, fd, length);
         return ret;
 }
 
@@ -350,7 +350,7 @@ asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
 {
         long ret = do_sys_ftruncate(fd, length, 0);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(2, ret, fd, length);
         return ret;
 }
 #endif
@@ -1067,7 +1067,7 @@ asmlinkage long sys_open(const char __user *filename, int flags, int mode)
 
         ret = do_sys_open(AT_FDCWD, filename, flags, mode);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, filename, flags, mode);
         return ret;
 }
 
@@ -1081,7 +1081,7 @@ asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
 
         ret = do_sys_open(dfd, filename, flags, mode);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(4, ret, dfd, filename, flags, mode);
         return ret;
 }
 
diff --git a/fs/signalfd.c b/fs/signalfd.c
index cb2b63ae0bf4..8ead0db35933 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -111,9 +111,14 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
                 err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
                 err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
                 break;
-        default: /* this is just in case for now ... */
+        default:
+                /*
+                 * This case catches also the signals queued by sigqueue().
+                 */
                 err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
                 err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
+                err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
+                err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
                 break;
         }
 
diff --git a/fs/splice.c b/fs/splice.c
index a861bb318ac8..eeb1a86a7014 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -370,8 +370,10 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                          * for an in-flight io page
                          */
                         if (flags & SPLICE_F_NONBLOCK) {
-                                if (TestSetPageLocked(page))
+                                if (TestSetPageLocked(page)) {
+                                        error = -EAGAIN;
                                         break;
+                                }
                         } else
                                 lock_page(page);
 
@@ -479,9 +481,8 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
                                  struct pipe_inode_info *pipe, size_t len,
                                  unsigned int flags)
 {
-        ssize_t spliced;
-        int ret;
         loff_t isize, left;
+        int ret;
 
         isize = i_size_read(in->f_mapping->host);
         if (unlikely(*ppos >= isize))
@@ -491,29 +492,9 @@ ssize_t generic_file_splice_read(struct file *in, loff_t *ppos,
         if (unlikely(left < len))
                 len = left;
 
-        ret = 0;
-        spliced = 0;
-        while (len && !spliced) {
-                ret = __generic_file_splice_read(in, ppos, pipe, len, flags);
-
-                if (ret < 0)
-                        break;
-                else if (!ret) {
-                        if (spliced)
-                                break;
-                        if (flags & SPLICE_F_NONBLOCK) {
-                                ret = -EAGAIN;
-                                break;
-                        }
-                }
-
+        ret = __generic_file_splice_read(in, ppos, pipe, len, flags);
+        if (ret > 0)
                 *ppos += ret;
-                len -= ret;
-                spliced += ret;
-        }
-
-        if (spliced)
-                return spliced;
 
         return ret;
 }
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index a9952e490ac9..f34bd010eb51 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -732,7 +732,7 @@ xfs_ioctl(
                  * Only allow the sys admin to reserve space unless
                  * unwritten extents are enabled.
                  */
-                if (!XFS_SB_VERSION_HASEXTFLGBIT(&mp->m_sb) &&
+                if (!xfs_sb_version_hasextflgbit(&mp->m_sb) &&
                     !capable(CAP_SYS_ADMIN))
                         return -EPERM;
 
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 1f3da5b8657b..8e9c5ae6504d 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1405,13 +1405,13 @@ xfs_qm_qino_alloc(
 #if defined(DEBUG) && defined(XFS_LOUD_RECOVERY)
                 unsigned oldv = mp->m_sb.sb_versionnum;
 #endif
-                ASSERT(!XFS_SB_VERSION_HASQUOTA(&mp->m_sb));
+                ASSERT(!xfs_sb_version_hasquota(&mp->m_sb));
                 ASSERT((sbfields & (XFS_SB_VERSIONNUM | XFS_SB_UQUOTINO |
                                    XFS_SB_GQUOTINO | XFS_SB_QFLAGS)) ==
                        (XFS_SB_VERSIONNUM | XFS_SB_UQUOTINO |
                         XFS_SB_GQUOTINO | XFS_SB_QFLAGS));
 
-                XFS_SB_VERSION_ADDQUOTA(&mp->m_sb);
+                xfs_sb_version_addquota(&mp->m_sb);
                 mp->m_sb.sb_uquotino = NULLFSINO;
                 mp->m_sb.sb_gquotino = NULLFSINO;
 
@@ -1954,7 +1954,7 @@ xfs_qm_init_quotainos(
         /*
          * Get the uquota and gquota inodes
          */
-        if (XFS_SB_VERSION_HASQUOTA(&mp->m_sb)) {
+        if (xfs_sb_version_hasquota(&mp->m_sb)) {
                 if (XFS_IS_UQUOTA_ON(mp) &&
                     mp->m_sb.sb_uquotino != NULLFSINO) {
                         ASSERT(mp->m_sb.sb_uquotino > 0);
diff --git a/fs/xfs/quota/xfs_qm_bhv.c b/fs/xfs/quota/xfs_qm_bhv.c
index 97bb32937585..f4f6c4c861d7 100644
--- a/fs/xfs/quota/xfs_qm_bhv.c
+++ b/fs/xfs/quota/xfs_qm_bhv.c
@@ -118,7 +118,7 @@ xfs_qm_newmount(
         *quotaflags = 0;
         *needquotamount = B_FALSE;
 
-        quotaondisk = XFS_SB_VERSION_HASQUOTA(&mp->m_sb) &&
+        quotaondisk = xfs_sb_version_hasquota(&mp->m_sb) &&
                                 (mp->m_sb.sb_qflags & XFS_ALL_QUOTA_ACCT);
 
         if (quotaondisk) {
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 2cc5886cfe85..d2b8be7e75f9 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -377,7 +377,7 @@ xfs_qm_scall_trunc_qfiles(
         if (!capable(CAP_SYS_ADMIN))
                 return XFS_ERROR(EPERM);
         error = 0;
-        if (!XFS_SB_VERSION_HASQUOTA(&mp->m_sb) || flags == 0) {
+        if (!xfs_sb_version_hasquota(&mp->m_sb) || flags == 0) {
                 qdprintk("qtrunc flags=%x m_qflags=%x\n", flags, mp->m_qflags);
                 return XFS_ERROR(EINVAL);
         }
@@ -522,7 +522,7 @@ xfs_qm_scall_getqstat(
         memset(out, 0, sizeof(fs_quota_stat_t));
 
         out->qs_version = FS_QSTAT_VERSION;
-        if (! XFS_SB_VERSION_HASQUOTA(&mp->m_sb)) {
+        if (!xfs_sb_version_hasquota(&mp->m_sb)) {
                 out->qs_uquota.qfs_ino = NULLFSINO;
                 out->qs_gquota.qfs_ino = NULLFSINO;
                 return (0);
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index b08e2a2a8add..96ba6aa4ed8c 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -227,10 +227,10 @@ STATIC void
 xfs_sbversion_add_attr2(xfs_mount_t *mp, xfs_trans_t *tp)
 {
         if ((mp->m_flags & XFS_MOUNT_ATTR2) &&
-            !(XFS_SB_VERSION_HASATTR2(&mp->m_sb))) {
+            !(xfs_sb_version_hasattr2(&mp->m_sb))) {
                 spin_lock(&mp->m_sb_lock);
-                if (!XFS_SB_VERSION_HASATTR2(&mp->m_sb)) {
-                        XFS_SB_VERSION_ADDATTR2(&mp->m_sb);
+                if (!xfs_sb_version_hasattr2(&mp->m_sb)) {
+                        xfs_sb_version_addattr2(&mp->m_sb);
                         spin_unlock(&mp->m_sb_lock);
                         xfs_mod_sb(tp, XFS_SB_VERSIONNUM | XFS_SB_FEATURES2);
                 } else
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 1c0a5a585a82..2def273855a2 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -4047,17 +4047,17 @@ xfs_bmap_add_attrfork(
                 xfs_trans_log_inode(tp, ip, logflags);
         if (error)
                 goto error2;
-        if (!XFS_SB_VERSION_HASATTR(&mp->m_sb) ||
-           (!XFS_SB_VERSION_HASATTR2(&mp->m_sb) && version == 2)) {
+        if (!xfs_sb_version_hasattr(&mp->m_sb) ||
+           (!xfs_sb_version_hasattr2(&mp->m_sb) && version == 2)) {
                 __int64_t sbfields = 0;
 
                 spin_lock(&mp->m_sb_lock);
-                if (!XFS_SB_VERSION_HASATTR(&mp->m_sb)) {
-                        XFS_SB_VERSION_ADDATTR(&mp->m_sb);
+                if (!xfs_sb_version_hasattr(&mp->m_sb)) {
+                        xfs_sb_version_addattr(&mp->m_sb);
                         sbfields |= XFS_SB_VERSIONNUM;
                 }
-                if (!XFS_SB_VERSION_HASATTR2(&mp->m_sb) && version == 2) {
-                        XFS_SB_VERSION_ADDATTR2(&mp->m_sb);
+                if (!xfs_sb_version_hasattr2(&mp->m_sb) && version == 2) {
+                        xfs_sb_version_addattr2(&mp->m_sb);
                         sbfields |= (XFS_SB_VERSIONNUM | XFS_SB_FEATURES2);
                 }
                 if (sbfields) {
@@ -5043,7 +5043,7 @@ xfs_bmapi(
                          * A wasdelay extent has been initialized, so
                          * shouldn't be flagged as unwritten.
                          */
-                        if (wr && XFS_SB_VERSION_HASEXTFLGBIT(&mp->m_sb)) {
+                        if (wr && xfs_sb_version_hasextflgbit(&mp->m_sb)) {
                                 if (!wasdelay && (flags & XFS_BMAPI_PREALLOC))
                                         got.br_state = XFS_EXT_UNWRITTEN;
                         }
@@ -5483,7 +5483,7 @@ xfs_bunmapi(
                          * get rid of part of a realtime extent.
                          */
                         if (del.br_state == XFS_EXT_UNWRITTEN ||
-                            !XFS_SB_VERSION_HASEXTFLGBIT(&mp->m_sb)) {
+                            !xfs_sb_version_hasextflgbit(&mp->m_sb)) {
                                 /*
                                  * This piece is unwritten, or we're not
                                  * using unwritten extents.  Skip over it.
@@ -5535,7 +5535,7 @@ xfs_bunmapi(
                         } else if ((del.br_startoff == start &&
                                     (del.br_state == XFS_EXT_UNWRITTEN ||
                                      xfs_trans_get_block_res(tp) == 0)) ||
-                                   !XFS_SB_VERSION_HASEXTFLGBIT(&mp->m_sb)) {
+                                   !xfs_sb_version_hasextflgbit(&mp->m_sb)) {
                                 /*
                                  * Can't make it unwritten.  There isn't
                                  * a full extent here so just skip it.
diff --git a/fs/xfs/xfs_bmap_btree.h b/fs/xfs/xfs_bmap_btree.h
index 2d950e975918..cd0d4b4bb816 100644
--- a/fs/xfs/xfs_bmap_btree.h
+++ b/fs/xfs/xfs_bmap_btree.h
@@ -120,7 +120,7 @@ typedef enum {
  * Extent state and extent format macros.
  */
 #define XFS_EXTFMT_INODE(x)     \
-        (XFS_SB_VERSION_HASEXTFLGBIT(&((x)->i_mount->m_sb)) ? \
+        (xfs_sb_version_hasextflgbit(&((x)->i_mount->m_sb)) ? \
                 XFS_EXTFMT_HASSTATE : XFS_EXTFMT_NOSTATE)
 #define ISUNWRITTEN(x)  ((x)->br_state == XFS_EXT_UNWRITTEN)
 
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index be7c4251fa61..e92e73f0e6af 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -49,7 +49,7 @@ void
 xfs_dir_mount(
         xfs_mount_t     *mp)
 {
-        ASSERT(XFS_SB_VERSION_HASDIRV2(&mp->m_sb));
+        ASSERT(xfs_sb_version_hasdirv2(&mp->m_sb));
         ASSERT((1 << (mp->m_sb.sb_blocklog + mp->m_sb.sb_dirblklog)) <=
                XFS_MAX_BLOCKSIZE);
         mp->m_dirblksize = 1 << (mp->m_sb.sb_blocklog + mp->m_sb.sb_dirblklog);
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index eadc1591c795..d3a0f538d6a6 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -77,36 +77,36 @@ xfs_fs_geometry(
         if (new_version >= 3) {
                 geo->version = XFS_FSOP_GEOM_VERSION;
                 geo->flags =
-                        (XFS_SB_VERSION_HASATTR(&mp->m_sb) ?
+                        (xfs_sb_version_hasattr(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_ATTR : 0) |
-                        (XFS_SB_VERSION_HASNLINK(&mp->m_sb) ?
+                        (xfs_sb_version_hasnlink(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_NLINK : 0) |
-                        (XFS_SB_VERSION_HASQUOTA(&mp->m_sb) ?
+                        (xfs_sb_version_hasquota(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_QUOTA : 0) |
-                        (XFS_SB_VERSION_HASALIGN(&mp->m_sb) ?
+                        (xfs_sb_version_hasalign(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_IALIGN : 0) |
-                        (XFS_SB_VERSION_HASDALIGN(&mp->m_sb) ?
+                        (xfs_sb_version_hasdalign(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_DALIGN : 0) |
-                        (XFS_SB_VERSION_HASSHARED(&mp->m_sb) ?
+                        (xfs_sb_version_hasshared(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_SHARED : 0) |
-                        (XFS_SB_VERSION_HASEXTFLGBIT(&mp->m_sb) ?
+                        (xfs_sb_version_hasextflgbit(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_EXTFLG : 0) |
-                        (XFS_SB_VERSION_HASDIRV2(&mp->m_sb) ?
+                        (xfs_sb_version_hasdirv2(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_DIRV2 : 0) |
-                        (XFS_SB_VERSION_HASSECTOR(&mp->m_sb) ?
+                        (xfs_sb_version_hassector(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_SECTOR : 0) |
                         (xfs_sb_version_haslazysbcount(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_LAZYSB : 0) |
-                        (XFS_SB_VERSION_HASATTR2(&mp->m_sb) ?
+                        (xfs_sb_version_hasattr2(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_ATTR2 : 0);
-                geo->logsectsize = XFS_SB_VERSION_HASSECTOR(&mp->m_sb) ?
+                geo->logsectsize = xfs_sb_version_hassector(&mp->m_sb) ?
                                 mp->m_sb.sb_logsectsize : BBSIZE;
                 geo->rtsectsize = mp->m_sb.sb_blocksize;
                 geo->dirblocksize = mp->m_dirblksize;
         }
         if (new_version >= 4) {
                 geo->flags |=
-                        (XFS_SB_VERSION_HASLOGV2(&mp->m_sb) ?
+                        (xfs_sb_version_haslogv2(&mp->m_sb) ?
                                 XFS_FSOP_GEOM_FLAGS_LOGV2 : 0);
                 geo->logsunit = mp->m_sb.sb_logsunit;
         }
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index db9d5fa600af..5a146cb22980 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -191,7 +191,7 @@ xfs_ialloc_ag_alloc(
                         ASSERT(!(args.mp->m_flags & XFS_MOUNT_NOALIGN));
                         args.alignment = args.mp->m_dalign;
                         isaligned = 1;
-                } else if (XFS_SB_VERSION_HASALIGN(&args.mp->m_sb) &&
+                } else if (xfs_sb_version_hasalign(&args.mp->m_sb) &&
                            args.mp->m_sb.sb_inoalignmt >=
                            XFS_B_TO_FSBT(args.mp,
                                 XFS_INODE_CLUSTER_SIZE(args.mp)))
@@ -230,7 +230,7 @@ xfs_ialloc_ag_alloc(
                 args.agbno = be32_to_cpu(agi->agi_root);
                 args.fsbno = XFS_AGB_TO_FSB(args.mp,
                                 be32_to_cpu(agi->agi_seqno), args.agbno);
-                if (XFS_SB_VERSION_HASALIGN(&args.mp->m_sb) &&
+                if (xfs_sb_version_hasalign(&args.mp->m_sb) &&
                         args.mp->m_sb.sb_inoalignmt >=
                         XFS_B_TO_FSBT(args.mp, XFS_INODE_CLUSTER_SIZE(args.mp)))
                                 args.alignment = args.mp->m_sb.sb_inoalignmt;
@@ -271,7 +271,7 @@ xfs_ialloc_ag_alloc(
          * use the old version so that old kernels will continue to be
          * able to use the file system.
          */
-        if (XFS_SB_VERSION_HASNLINK(&args.mp->m_sb))
+        if (xfs_sb_version_hasnlink(&args.mp->m_sb))
                 version = XFS_DINODE_VERSION_2;
         else
                 version = XFS_DINODE_VERSION_1;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index a550546a7083..f43a6e01d68f 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1147,7 +1147,7 @@ xfs_ialloc(
          * the inode version number now.  This way we only do the conversion
          * here rather than here and in the flush/logging code.
          */
-        if (XFS_SB_VERSION_HASNLINK(&tp->t_mountp->m_sb) &&
+        if (xfs_sb_version_hasnlink(&tp->t_mountp->m_sb) &&
             ip->i_d.di_version == XFS_DINODE_VERSION_1) {
                 ip->i_d.di_version = XFS_DINODE_VERSION_2;
                 /*
@@ -3434,9 +3434,9 @@ xfs_iflush_int(
          * has been updated, then make the conversion permanent.
          */
         ASSERT(ip->i_d.di_version == XFS_DINODE_VERSION_1 ||
-               XFS_SB_VERSION_HASNLINK(&mp->m_sb));
+               xfs_sb_version_hasnlink(&mp->m_sb));
         if (ip->i_d.di_version == XFS_DINODE_VERSION_1) {
-                if (!XFS_SB_VERSION_HASNLINK(&mp->m_sb)) {
+                if (!xfs_sb_version_hasnlink(&mp->m_sb)) {
                         /*
                          * Convert it back.
                          */
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 034ca7202295..2c775b4ae9e6 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -296,9 +296,9 @@ xfs_inode_item_format(
          */
         mp = ip->i_mount;
         ASSERT(ip->i_d.di_version == XFS_DINODE_VERSION_1 ||
-               XFS_SB_VERSION_HASNLINK(&mp->m_sb));
+               xfs_sb_version_hasnlink(&mp->m_sb));
         if (ip->i_d.di_version == XFS_DINODE_VERSION_1) {
-                if (!XFS_SB_VERSION_HASNLINK(&mp->m_sb)) {
+                if (!xfs_sb_version_hasnlink(&mp->m_sb)) {
                         /*
                          * Convert it back.
                          */
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 658aab6b1bbf..f615e04364f4 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -45,7 +45,7 @@ xfs_internal_inum(
         xfs_ino_t       ino)
 {
         return (ino == mp->m_sb.sb_rbmino || ino == mp->m_sb.sb_rsumino ||
-                (XFS_SB_VERSION_HASQUOTA(&mp->m_sb) &&
+                (xfs_sb_version_hasquota(&mp->m_sb) &&
                  (ino == mp->m_sb.sb_uquotino || ino == mp->m_sb.sb_gquotino)));
 }
 
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index a75edca1860f..31f2b04f2c97 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -1090,7 +1090,7 @@ xlog_get_iclog_buffer_size(xfs_mount_t	*mp,
                         size >>= 1;
                 }
 
-                if (XFS_SB_VERSION_HASLOGV2(&mp->m_sb)) {
+                if (xfs_sb_version_haslogv2(&mp->m_sb)) {
                         /* # headers = size / 32K
                          * one header holds cycles from 32K of data
                          */
@@ -1186,13 +1186,13 @@ xlog_alloc_log(xfs_mount_t	*mp,
         log->l_grant_reserve_cycle = 1;
         log->l_grant_write_cycle = 1;
 
-        if (XFS_SB_VERSION_HASSECTOR(&mp->m_sb)) {
+        if (xfs_sb_version_hassector(&mp->m_sb)) {
                 log->l_sectbb_log = mp->m_sb.sb_logsectlog - BBSHIFT;
                 ASSERT(log->l_sectbb_log <= mp->m_sectbb_log);
                 /* for larger sector sizes, must have v2 or external log */
                 ASSERT(log->l_sectbb_log == 0 ||
                         log->l_logBBstart == 0 ||
-                        XFS_SB_VERSION_HASLOGV2(&mp->m_sb));
+                        xfs_sb_version_haslogv2(&mp->m_sb));
                 ASSERT(mp->m_sb.sb_logsectlog >= BBSHIFT);
         }
         log->l_sectbb_mask = (1 << log->l_sectbb_log) - 1;
@@ -1247,7 +1247,7 @@ xlog_alloc_log(xfs_mount_t	*mp,
                 memset(head, 0, sizeof(xlog_rec_header_t));
                 head->h_magicno = cpu_to_be32(XLOG_HEADER_MAGIC_NUM);
                 head->h_version = cpu_to_be32(
-                        XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb) ? 2 : 1);
+                        xfs_sb_version_haslogv2(&log->l_mp->m_sb) ? 2 : 1);
                 head->h_size = cpu_to_be32(log->l_iclog_size);
                 /* new fields */
                 head->h_fmt = cpu_to_be32(XLOG_FMT);
@@ -1402,7 +1402,7 @@ xlog_sync(xlog_t		*log,
         int             roundoff;       /* roundoff to BB or stripe */
         int             split = 0;      /* split write into two regions */
         int             error;
-        int             v2 = XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb);
+        int             v2 = xfs_sb_version_haslogv2(&log->l_mp->m_sb);
 
         XFS_STATS_INC(xs_log_writes);
         ASSERT(iclog->ic_refcnt == 0);
@@ -2881,7 +2881,7 @@ xlog_state_switch_iclogs(xlog_t		*log,
         log->l_curr_block += BTOBB(eventual_size)+BTOBB(log->l_iclog_hsize);
 
         /* Round up to next log-sunit */
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb) &&
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb) &&
             log->l_mp->m_sb.sb_logsunit > 1) {
                 __uint32_t sunit_bb = BTOBB(log->l_mp->m_sb.sb_logsunit);
                 log->l_curr_block = roundup(log->l_curr_block, sunit_bb);
@@ -3334,7 +3334,7 @@ xlog_ticket_get(xlog_t		*log,
         unit_bytes += sizeof(xlog_op_header_t) * num_headers;
 
         /* for roundoff padding for transaction data and one for commit record */
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb) &&
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb) &&
             log->l_mp->m_sb.sb_logsunit > 1) {
                 /* log su roundoff */
                 unit_bytes += 2*log->l_mp->m_sb.sb_logsunit;
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index e008233ee249..c6244cc733c0 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -49,10 +49,10 @@ struct xfs_mount;
 #define XLOG_HEADER_SIZE        512
 
 #define XLOG_REC_SHIFT(log) \
-        BTOBB(1 << (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb) ? \
+        BTOBB(1 << (xfs_sb_version_haslogv2(&log->l_mp->m_sb) ? \
          XLOG_MAX_RECORD_BSHIFT : XLOG_BIG_RECORD_BSHIFT))
 #define XLOG_TOTAL_REC_SHIFT(log) \
-        BTOBB(XLOG_MAX_ICLOGS << (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb) ? \
+        BTOBB(XLOG_MAX_ICLOGS << (xfs_sb_version_haslogv2(&log->l_mp->m_sb) ? \
          XLOG_MAX_RECORD_BSHIFT : XLOG_BIG_RECORD_BSHIFT))
 
 
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b82d5d4d2462..b2b70eba282c 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -478,7 +478,7 @@ xlog_find_verify_log_record(
          * reset last_blk.  Only when last_blk points in the middle of a log
          * record do we update last_blk.
          */
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb)) {
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb)) {
                 uint    h_size = be32_to_cpu(head->h_size);
 
                 xhdrs = h_size / XLOG_HEADER_CYCLE_SIZE;
@@ -888,7 +888,7 @@ xlog_find_tail(
          * unmount record if there is one, so we pass the lsn of the
          * unmount record rather than the block after it.
          */
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb)) {
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb)) {
                 int     h_size = be32_to_cpu(rhead->h_size);
                 int     h_version = be32_to_cpu(rhead->h_version);
 
@@ -1101,7 +1101,7 @@ xlog_add_record(
         recp->h_magicno = cpu_to_be32(XLOG_HEADER_MAGIC_NUM);
         recp->h_cycle = cpu_to_be32(cycle);
         recp->h_version = cpu_to_be32(
-                        XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb) ? 2 : 1);
+                        xfs_sb_version_haslogv2(&log->l_mp->m_sb) ? 2 : 1);
         recp->h_lsn = cpu_to_be64(xlog_assign_lsn(cycle, block));
         recp->h_tail_lsn = cpu_to_be64(xlog_assign_lsn(tail_cycle, tail_block));
         recp->h_fmt = cpu_to_be32(XLOG_FMT);
@@ -3348,7 +3348,7 @@ xlog_pack_data(
                 dp += BBSIZE;
         }
 
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb)) {
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb)) {
                 xhdr = (xlog_in_core_2_t *)&iclog->ic_header;
                 for ( ; i < BTOBB(size); i++) {
                         j = i / (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
@@ -3388,7 +3388,7 @@ xlog_unpack_data_checksum(
                             be32_to_cpu(rhead->h_chksum), chksum);
                     cmn_err(CE_DEBUG,
 "XFS: Disregard message if filesystem was created with non-DEBUG kernel");
-                    if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb)) {
+                    if (xfs_sb_version_haslogv2(&log->l_mp->m_sb)) {
                             cmn_err(CE_DEBUG,
                                 "XFS: LogR this is a LogV2 filesystem\n");
                     }
@@ -3415,7 +3415,7 @@ xlog_unpack_data(
                 dp += BBSIZE;
         }
 
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb)) {
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb)) {
                 xhdr = (xlog_in_core_2_t *)rhead;
                 for ( ; i < BTOBB(be32_to_cpu(rhead->h_len)); i++) {
                         j = i / (XLOG_HEADER_CYCLE_SIZE / BBSIZE);
@@ -3494,7 +3494,7 @@ xlog_do_recovery_pass(
          * Read the header of the tail block and get the iclog buffer size from
          * h_size.  Use this to tell how many sectors make up the log header.
          */
-        if (XFS_SB_VERSION_HASLOGV2(&log->l_mp->m_sb)) {
+        if (xfs_sb_version_haslogv2(&log->l_mp->m_sb)) {
                 /*
                  * When using variable length iclogs, read first sector of
                  * iclog header and extract the header size from it.  Get a
@@ -3838,7 +3838,7 @@ xlog_do_recover(
         sbp = &log->l_mp->m_sb;
         xfs_sb_from_disk(sbp, XFS_BUF_TO_SBP(bp));
         ASSERT(sbp->sb_magicnum == XFS_SB_MAGIC);
-        ASSERT(XFS_SB_GOOD_VERSION(sbp));
+        ASSERT(xfs_sb_good_version(sbp));
         xfs_buf_relse(bp);
 
         /* We've re-read the superblock so re-initialize per-cpu counters */
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 6409b3762995..8ed164eb9544 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -44,7 +44,7 @@
 #include "xfs_quota.h"
 #include "xfs_fsops.h"
 
-STATIC void     xfs_mount_log_sbunit(xfs_mount_t *, __int64_t);
+STATIC void     xfs_mount_log_sb(xfs_mount_t *, __int64_t);
 STATIC int      xfs_uuid_mount(xfs_mount_t *);
 STATIC void     xfs_uuid_unmount(xfs_mount_t *mp);
 STATIC void     xfs_unmountfs_wait(xfs_mount_t *);
@@ -119,6 +119,7 @@ static const struct {
     { offsetof(xfs_sb_t, sb_logsectsize),0 },
     { offsetof(xfs_sb_t, sb_logsunit),   0 },
     { offsetof(xfs_sb_t, sb_features2),  0 },
+    { offsetof(xfs_sb_t, sb_bad_features2), 0 },
     { sizeof(xfs_sb_t),                  0 }
 };
 
@@ -225,7 +226,7 @@ xfs_mount_validate_sb(
                 return XFS_ERROR(EWRONGFS);
         }
 
-        if (!XFS_SB_GOOD_VERSION(sbp)) {
+        if (!xfs_sb_good_version(sbp)) {
                 xfs_fs_mount_cmn_err(flags, "bad version");
                 return XFS_ERROR(EWRONGFS);
         }
@@ -300,7 +301,7 @@ xfs_mount_validate_sb(
         /*
          * Version 1 directory format has never worked on Linux.
          */
-        if (unlikely(!XFS_SB_VERSION_HASDIRV2(sbp))) {
+        if (unlikely(!xfs_sb_version_hasdirv2(sbp))) {
                 xfs_fs_mount_cmn_err(flags,
                         "file system using version 1 directory format");
                 return XFS_ERROR(ENOSYS);
@@ -449,6 +450,7 @@ xfs_sb_from_disk(
         to->sb_logsectsize = be16_to_cpu(from->sb_logsectsize);
         to->sb_logsunit = be32_to_cpu(from->sb_logsunit);
         to->sb_features2 = be32_to_cpu(from->sb_features2);
+        to->sb_bad_features2 = be32_to_cpu(from->sb_bad_features2);
 }
 
 /*
@@ -781,7 +783,7 @@ xfs_update_alignment(xfs_mount_t *mp, int mfsi_flags, __uint64_t *update_flags)
                  * Update superblock with new values
                  * and log changes
                  */
-                if (XFS_SB_VERSION_HASDALIGN(sbp)) {
+                if (xfs_sb_version_hasdalign(sbp)) {
                         if (sbp->sb_unit != mp->m_dalign) {
                                 sbp->sb_unit = mp->m_dalign;
                                 *update_flags |= XFS_SB_UNIT;
@@ -792,7 +794,7 @@ xfs_update_alignment(xfs_mount_t *mp, int mfsi_flags, __uint64_t *update_flags)
                         }
                 }
         } else if ((mp->m_flags & XFS_MOUNT_NOALIGN) != XFS_MOUNT_NOALIGN &&
-                    XFS_SB_VERSION_HASDALIGN(&mp->m_sb)) {
+                    xfs_sb_version_hasdalign(&mp->m_sb)) {
                         mp->m_dalign = sbp->sb_unit;
                         mp->m_swidth = sbp->sb_width;
         }
@@ -869,7 +871,7 @@ xfs_set_rw_sizes(xfs_mount_t *mp)
 STATIC void
 xfs_set_inoalignment(xfs_mount_t *mp)
 {
-        if (XFS_SB_VERSION_HASALIGN(&mp->m_sb) &&
+        if (xfs_sb_version_hasalign(&mp->m_sb) &&
             mp->m_sb.sb_inoalignmt >=
             XFS_B_TO_FSBT(mp, mp->m_inode_cluster_size))
                 mp->m_inoalign_mask = mp->m_sb.sb_inoalignmt - 1;
@@ -970,6 +972,38 @@ xfs_mountfs(
         xfs_mount_common(mp, sbp);
 
         /*
+         * Check for a mismatched features2 values.  Older kernels
+         * read & wrote into the wrong sb offset for sb_features2
+         * on some platforms due to xfs_sb_t not being 64bit size aligned
+         * when sb_features2 was added, which made older superblock
+         * reading/writing routines swap it as a 64-bit value.
+         *
+         * For backwards compatibility, we make both slots equal.
+         *
+         * If we detect a mismatched field, we OR the set bits into the
+         * existing features2 field in case it has already been modified; we
+         * don't want to lose any features.  We then update the bad location
+         * with the ORed value so that older kernels will see any features2
+         * flags, and mark the two fields as needing updates once the
+         * transaction subsystem is online.
+         */
+        if (xfs_sb_has_mismatched_features2(sbp)) {
+                cmn_err(CE_WARN,
+                        "XFS: correcting sb_features alignment problem");
+                sbp->sb_features2 |= sbp->sb_bad_features2;
+                sbp->sb_bad_features2 = sbp->sb_features2;
+                update_flags |= XFS_SB_FEATURES2 | XFS_SB_BAD_FEATURES2;
+
+                /*
+                 * Re-check for ATTR2 in case it was found in bad_features2
+                 * slot.
+                 */
+                if (xfs_sb_version_hasattr2(&mp->m_sb))
+                        mp->m_flags |= XFS_MOUNT_ATTR2;
+
+        }
+
+        /*
          * Check if sb_agblocks is aligned at stripe boundary
          * If sb_agblocks is NOT aligned turn off m_dalign since
          * allocator alignment is within an ag, therefore ag has
@@ -1159,11 +1193,10 @@ xfs_mountfs(
         }
 
         /*
-         * If fs is not mounted readonly, then update the superblock
-         * unit and width changes.
+         * If fs is not mounted readonly, then update the superblock changes.
          */
         if (update_flags && !(mp->m_flags & XFS_MOUNT_RDONLY))
-                xfs_mount_log_sbunit(mp, update_flags);
+                xfs_mount_log_sb(mp, update_flags);
 
         /*
          * Initialise the XFS quota management subsystem for this mount
@@ -1875,16 +1908,18 @@ xfs_uuid_unmount(
 
 /*
  * Used to log changes to the superblock unit and width fields which could
- * be altered by the mount options. Only the first superblock is updated.
+ * be altered by the mount options, as well as any potential sb_features2
+ * fixup. Only the first superblock is updated.
  */
 STATIC void
-xfs_mount_log_sbunit(
+xfs_mount_log_sb(
         xfs_mount_t     *mp,
         __int64_t       fields)
 {
         xfs_trans_t     *tp;
 
-        ASSERT(fields & (XFS_SB_UNIT|XFS_SB_WIDTH|XFS_SB_UUID));
+        ASSERT(fields & (XFS_SB_UNIT | XFS_SB_WIDTH | XFS_SB_UUID |
+                         XFS_SB_FEATURES2 | XFS_SB_BAD_FEATURES2));
 
         tp = xfs_trans_alloc(mp, XFS_TRANS_SB_UNIT);
         if (xfs_trans_reserve(tp, 0, mp->m_sb.sb_sectsize + 128, 0, 0,
diff --git a/fs/xfs/xfs_sb.h b/fs/xfs/xfs_sb.h
index 94660b1a6ccc..d904efe7f871 100644
--- a/fs/xfs/xfs_sb.h
+++ b/fs/xfs/xfs_sb.h
@@ -89,6 +89,7 @@ struct xfs_mount;
 
 /*
  * Superblock - in core version.  Must match the ondisk version below.
+ * Must be padded to 64 bit alignment.
  */
 typedef struct xfs_sb {
         __uint32_t      sb_magicnum;    /* magic number == XFS_SB_MAGIC */
@@ -145,10 +146,21 @@ typedef struct xfs_sb {
         __uint16_t      sb_logsectsize; /* sector size for the log, bytes */
         __uint32_t      sb_logsunit;    /* stripe unit size for the log */
         __uint32_t      sb_features2;   /* additional feature bits */
+
+        /*
+         * bad features2 field as a result of failing to pad the sb
+         * structure to 64 bits. Some machines will be using this field
+         * for features2 bits. Easiest just to mark it bad and not use
+         * it for anything else.
+         */
+        __uint32_t      sb_bad_features2;
+
+        /* must be padded to 64 bit alignment */
 } xfs_sb_t;
 
 /*
- * Superblock - on disk version.  Must match the in core version below.
+ * Superblock - on disk version.  Must match the in core version above.
+ * Must be padded to 64 bit alignment.
  */
 typedef struct xfs_dsb {
         __be32          sb_magicnum;    /* magic number == XFS_SB_MAGIC */
@@ -205,6 +217,15 @@ typedef struct xfs_dsb {
         __be16          sb_logsectsize; /* sector size for the log, bytes */
         __be32          sb_logsunit;    /* stripe unit size for the log */
         __be32          sb_features2;   /* additional feature bits */
+        /*
+         * bad features2 field as a result of failing to pad the sb
+         * structure to 64 bits. Some machines will be using this field
+         * for features2 bits. Easiest just to mark it bad and not use
+         * it for anything else.
+         */
+        __be32  sb_bad_features2;
+
+        /* must be padded to 64 bit alignment */
 } xfs_dsb_t;
 
 /*
@@ -223,7 +244,7 @@ typedef enum {
         XFS_SBS_GQUOTINO, XFS_SBS_QFLAGS, XFS_SBS_FLAGS, XFS_SBS_SHARED_VN,
         XFS_SBS_INOALIGNMT, XFS_SBS_UNIT, XFS_SBS_WIDTH, XFS_SBS_DIRBLKLOG,
         XFS_SBS_LOGSECTLOG, XFS_SBS_LOGSECTSIZE, XFS_SBS_LOGSUNIT,
-        XFS_SBS_FEATURES2,
+        XFS_SBS_FEATURES2, XFS_SBS_BAD_FEATURES2,
         XFS_SBS_FIELDCOUNT
 } xfs_sb_field_t;
 
@@ -248,13 +269,15 @@ typedef enum {
 #define XFS_SB_IFREE            XFS_SB_MVAL(IFREE)
 #define XFS_SB_FDBLOCKS         XFS_SB_MVAL(FDBLOCKS)
 #define XFS_SB_FEATURES2        XFS_SB_MVAL(FEATURES2)
+#define XFS_SB_BAD_FEATURES2    XFS_SB_MVAL(BAD_FEATURES2)
 #define XFS_SB_NUM_BITS         ((int)XFS_SBS_FIELDCOUNT)
 #define XFS_SB_ALL_BITS         ((1LL << XFS_SB_NUM_BITS) - 1)
 #define XFS_SB_MOD_BITS         \
         (XFS_SB_UUID | XFS_SB_ROOTINO | XFS_SB_RBMINO | XFS_SB_RSUMINO | \
          XFS_SB_VERSIONNUM | XFS_SB_UQUOTINO | XFS_SB_GQUOTINO | \
          XFS_SB_QFLAGS | XFS_SB_SHARED_VN | XFS_SB_UNIT | XFS_SB_WIDTH | \
-         XFS_SB_ICOUNT | XFS_SB_IFREE | XFS_SB_FDBLOCKS | XFS_SB_FEATURES2)
+         XFS_SB_ICOUNT | XFS_SB_IFREE | XFS_SB_FDBLOCKS | XFS_SB_FEATURES2 | \
+         XFS_SB_BAD_FEATURES2)
 
 
 /*
@@ -271,7 +294,6 @@ typedef enum {
 
 #define XFS_SB_VERSION_NUM(sbp) ((sbp)->sb_versionnum & XFS_SB_VERSION_NUMBITS)
 
-#define XFS_SB_GOOD_VERSION(sbp)        xfs_sb_good_version(sbp)
 #ifdef __KERNEL__
 static inline int xfs_sb_good_version(xfs_sb_t *sbp)
 {
@@ -297,7 +319,15 @@ static inline int xfs_sb_good_version(xfs_sb_t *sbp)
 }
 #endif /* __KERNEL__ */
 
-#define XFS_SB_VERSION_TONEW(v) xfs_sb_version_tonew(v)
+/*
+ * Detect a mismatched features2 field.  Older kernels read/wrote
+ * this into the wrong slot, so to be safe we keep them in sync.
+ */
+static inline int xfs_sb_has_mismatched_features2(xfs_sb_t *sbp)
+{
+        return (sbp->sb_bad_features2 != sbp->sb_features2);
+}
+
 static inline unsigned xfs_sb_version_tonew(unsigned v)
 {
         return ((((v) == XFS_SB_VERSION_1) ? \
@@ -308,7 +338,6 @@ static inline unsigned xfs_sb_version_tonew(unsigned v)
                 XFS_SB_VERSION_4);
 }
 
-#define XFS_SB_VERSION_TOOLD(v) xfs_sb_version_toold(v)
 static inline unsigned xfs_sb_version_toold(unsigned v)
 {
         return (((v) & (XFS_SB_VERSION_QUOTABIT | XFS_SB_VERSION_ALIGNBIT)) ? \
@@ -320,7 +349,6 @@ static inline unsigned xfs_sb_version_toold(unsigned v)
                                 XFS_SB_VERSION_1)));
 }
 
-#define XFS_SB_VERSION_HASATTR(sbp)     xfs_sb_version_hasattr(sbp)
 static inline int xfs_sb_version_hasattr(xfs_sb_t *sbp)
 {
         return ((sbp)->sb_versionnum == XFS_SB_VERSION_2) || \
@@ -329,7 +357,6 @@ static inline int xfs_sb_version_hasattr(xfs_sb_t *sbp)
                   ((sbp)->sb_versionnum & XFS_SB_VERSION_ATTRBIT));
 }
 
-#define XFS_SB_VERSION_ADDATTR(sbp)     xfs_sb_version_addattr(sbp)
 static inline void xfs_sb_version_addattr(xfs_sb_t *sbp)
 {
         (sbp)->sb_versionnum = (((sbp)->sb_versionnum == XFS_SB_VERSION_1) ? \
@@ -339,7 +366,6 @@ static inline void xfs_sb_version_addattr(xfs_sb_t *sbp)
                         (XFS_SB_VERSION_4 | XFS_SB_VERSION_ATTRBIT)));
 }
 
-#define XFS_SB_VERSION_HASNLINK(sbp)    xfs_sb_version_hasnlink(sbp)
 static inline int xfs_sb_version_hasnlink(xfs_sb_t *sbp)
 {
         return ((sbp)->sb_versionnum == XFS_SB_VERSION_3) || \
@@ -347,7 +373,6 @@ static inline int xfs_sb_version_hasnlink(xfs_sb_t *sbp)
                   ((sbp)->sb_versionnum & XFS_SB_VERSION_NLINKBIT));
 }
 
-#define XFS_SB_VERSION_ADDNLINK(sbp)    xfs_sb_version_addnlink(sbp)
 static inline void xfs_sb_version_addnlink(xfs_sb_t *sbp)
 {
         (sbp)->sb_versionnum = ((sbp)->sb_versionnum <= XFS_SB_VERSION_2 ? \
@@ -355,115 +380,63 @@ static inline void xfs_sb_version_addnlink(xfs_sb_t *sbp)
                 ((sbp)->sb_versionnum | XFS_SB_VERSION_NLINKBIT));
 }
 
-#define XFS_SB_VERSION_HASQUOTA(sbp)    xfs_sb_version_hasquota(sbp)
 static inline int xfs_sb_version_hasquota(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_QUOTABIT);
 }
 
-#define XFS_SB_VERSION_ADDQUOTA(sbp)    xfs_sb_version_addquota(sbp)
 static inline void xfs_sb_version_addquota(xfs_sb_t *sbp)
 {
         (sbp)->sb_versionnum = \
                  (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4 ? \
                         ((sbp)->sb_versionnum | XFS_SB_VERSION_QUOTABIT) : \
-                        (XFS_SB_VERSION_TONEW((sbp)->sb_versionnum) | \
+                        (xfs_sb_version_tonew((sbp)->sb_versionnum) | \
                          XFS_SB_VERSION_QUOTABIT));
 }
 
-#define XFS_SB_VERSION_HASALIGN(sbp)    xfs_sb_version_hasalign(sbp)
 static inline int xfs_sb_version_hasalign(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_ALIGNBIT);
 }
 
-#define XFS_SB_VERSION_SUBALIGN(sbp)    xfs_sb_version_subalign(sbp)
-static inline void xfs_sb_version_subalign(xfs_sb_t *sbp)
-{
-        (sbp)->sb_versionnum = \
-         XFS_SB_VERSION_TOOLD((sbp)->sb_versionnum & ~XFS_SB_VERSION_ALIGNBIT);
-}
-
-#define XFS_SB_VERSION_HASDALIGN(sbp)   xfs_sb_version_hasdalign(sbp)
 static inline int xfs_sb_version_hasdalign(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_DALIGNBIT);
 }
 
-#define XFS_SB_VERSION_ADDDALIGN(sbp)   xfs_sb_version_adddalign(sbp)
-static inline int xfs_sb_version_adddalign(xfs_sb_t *sbp)
-{
-        return (sbp)->sb_versionnum = \
-                ((sbp)->sb_versionnum | XFS_SB_VERSION_DALIGNBIT);
-}
-
-#define XFS_SB_VERSION_HASSHARED(sbp)   xfs_sb_version_hasshared(sbp)
 static inline int xfs_sb_version_hasshared(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_SHAREDBIT);
 }
 
-#define XFS_SB_VERSION_ADDSHARED(sbp)   xfs_sb_version_addshared(sbp)
-static inline int xfs_sb_version_addshared(xfs_sb_t *sbp)
-{
-        return (sbp)->sb_versionnum = \
-                ((sbp)->sb_versionnum | XFS_SB_VERSION_SHAREDBIT);
-}
-
-#define XFS_SB_VERSION_SUBSHARED(sbp)   xfs_sb_version_subshared(sbp)
-static inline int xfs_sb_version_subshared(xfs_sb_t *sbp)
-{
-        return (sbp)->sb_versionnum = \
-                ((sbp)->sb_versionnum & ~XFS_SB_VERSION_SHAREDBIT);
-}
-
-#define XFS_SB_VERSION_HASDIRV2(sbp)    xfs_sb_version_hasdirv2(sbp)
 static inline int xfs_sb_version_hasdirv2(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_DIRV2BIT);
 }
 
-#define XFS_SB_VERSION_HASLOGV2(sbp)   xfs_sb_version_haslogv2(sbp)
 static inline int xfs_sb_version_haslogv2(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_LOGV2BIT);
 }
 
-#define XFS_SB_VERSION_HASEXTFLGBIT(sbp)        xfs_sb_version_hasextflgbit(sbp)
 static inline int xfs_sb_version_hasextflgbit(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_EXTFLGBIT);
 }
 
-#define XFS_SB_VERSION_ADDEXTFLGBIT(sbp)        xfs_sb_version_addextflgbit(sbp)
-static inline int xfs_sb_version_addextflgbit(xfs_sb_t *sbp)
-{
-        return (sbp)->sb_versionnum = \
-                ((sbp)->sb_versionnum | XFS_SB_VERSION_EXTFLGBIT);
-}
-
-#define XFS_SB_VERSION_SUBEXTFLGBIT(sbp)        xfs_sb_version_subextflgbit(sbp)
-static inline int xfs_sb_version_subextflgbit(xfs_sb_t *sbp)
-{
-        return (sbp)->sb_versionnum = \
-                ((sbp)->sb_versionnum & ~XFS_SB_VERSION_EXTFLGBIT);
-}
-
-#define XFS_SB_VERSION_HASSECTOR(sbp)   xfs_sb_version_hassector(sbp)
 static inline int xfs_sb_version_hassector(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
                 ((sbp)->sb_versionnum & XFS_SB_VERSION_SECTORBIT);
 }
 
-#define XFS_SB_VERSION_HASMOREBITS(sbp) xfs_sb_version_hasmorebits(sbp)
 static inline int xfs_sb_version_hasmorebits(xfs_sb_t *sbp)
 {
         return (XFS_SB_VERSION_NUM(sbp) == XFS_SB_VERSION_4) && \
@@ -476,24 +449,22 @@ static inline int xfs_sb_version_hasmorebits(xfs_sb_t *sbp)
  * For example, for a bit defined as XFS_SB_VERSION2_FUNBIT, has a macro:
  *
  * SB_VERSION_HASFUNBIT(xfs_sb_t *sbp)
- *      ((XFS_SB_VERSION_HASMOREBITS(sbp) &&
+ *      ((xfs_sb_version_hasmorebits(sbp) &&
  *       ((sbp)->sb_features2 & XFS_SB_VERSION2_FUNBIT)
  */
 
 static inline int xfs_sb_version_haslazysbcount(xfs_sb_t *sbp)
 {
-        return (XFS_SB_VERSION_HASMOREBITS(sbp) &&      \
+        return (xfs_sb_version_hasmorebits(sbp) &&      \
                 ((sbp)->sb_features2 & XFS_SB_VERSION2_LAZYSBCOUNTBIT));
 }
 
-#define XFS_SB_VERSION_HASATTR2(sbp)    xfs_sb_version_hasattr2(sbp)
 static inline int xfs_sb_version_hasattr2(xfs_sb_t *sbp)
 {
-        return (XFS_SB_VERSION_HASMOREBITS(sbp)) &&     \
+        return (xfs_sb_version_hasmorebits(sbp)) &&     \
                 ((sbp)->sb_features2 & XFS_SB_VERSION2_ATTR2BIT);
 }
 
-#define XFS_SB_VERSION_ADDATTR2(sbp)    xfs_sb_version_addattr2(sbp)
 static inline void xfs_sb_version_addattr2(xfs_sb_t *sbp)
 {
         ((sbp)->sb_versionnum = \
diff --git a/fs/xfs/xfs_utils.c b/fs/xfs/xfs_utils.c
index 45d740df53b7..18a85e746680 100644
--- a/fs/xfs/xfs_utils.c
+++ b/fs/xfs/xfs_utils.c
@@ -339,10 +339,10 @@ xfs_bump_ino_vers2(
         ip->i_d.di_onlink = 0;
         memset(&(ip->i_d.di_pad[0]), 0, sizeof(ip->i_d.di_pad));
         mp = tp->t_mountp;
-        if (!XFS_SB_VERSION_HASNLINK(&mp->m_sb)) {
+        if (!xfs_sb_version_hasnlink(&mp->m_sb)) {
                 spin_lock(&mp->m_sb_lock);
-                if (!XFS_SB_VERSION_HASNLINK(&mp->m_sb)) {
-                        XFS_SB_VERSION_ADDNLINK(&mp->m_sb);
+                if (!xfs_sb_version_hasnlink(&mp->m_sb)) {
+                        xfs_sb_version_addnlink(&mp->m_sb);
                         spin_unlock(&mp->m_sb_lock);
                         xfs_mod_sb(tp, XFS_SB_VERSIONNUM);
                 } else {
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index 7321304a69cc..7094caff13cf 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -330,7 +330,7 @@ xfs_finish_flags(
         int                     ronly = (mp->m_flags & XFS_MOUNT_RDONLY);
 
         /* Fail a mount where the logbuf is smaller then the log stripe */
-        if (XFS_SB_VERSION_HASLOGV2(&mp->m_sb)) {
+        if (xfs_sb_version_haslogv2(&mp->m_sb)) {
                 if ((ap->logbufsize <= 0) &&
                     (mp->m_sb.sb_logsunit > XLOG_BIG_RECORD_BSIZE)) {
                         mp->m_logbsize = mp->m_sb.sb_logsunit;
@@ -349,9 +349,8 @@ xfs_finish_flags(
                 }
         }
 
-        if (XFS_SB_VERSION_HASATTR2(&mp->m_sb)) {
+        if (xfs_sb_version_hasattr2(&mp->m_sb))
                 mp->m_flags |= XFS_MOUNT_ATTR2;
-        }
 
         /*
          * prohibit r/w mounts of read-only filesystems
@@ -366,7 +365,7 @@ xfs_finish_flags(
          * check for shared mount.
          */
         if (ap->flags & XFSMNT_SHARED) {
-                if (!XFS_SB_VERSION_HASSHARED(&mp->m_sb))
+                if (!xfs_sb_version_hasshared(&mp->m_sb))
                         return XFS_ERROR(EINVAL);
 
                 /*
@@ -512,7 +511,7 @@ xfs_mount(
         if (!error && logdev && logdev != ddev) {
                 unsigned int    log_sector_size = BBSIZE;
 
-                if (XFS_SB_VERSION_HASSECTOR(&mp->m_sb))
+                if (xfs_sb_version_hassector(&mp->m_sb))
                         log_sector_size = mp->m_sb.sb_logsectsize;
                 error = xfs_setsize_buftarg(mp->m_logdev_targp,
                                             mp->m_sb.sb_blocksize,
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 51305242ff8c..64c5953feca4 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -4132,7 +4132,7 @@ xfs_free_file_space(
          * actually need to zero the extent edges.  Otherwise xfs_bunmapi
          * will take care of it for us.
          */
-        if (rt && !XFS_SB_VERSION_HASEXTFLGBIT(&mp->m_sb)) {
+        if (rt && !xfs_sb_version_hasextflgbit(&mp->m_sb)) {
                 nimap = 1;
                 error = xfs_bmapi(NULL, ip, startoffset_fsb,
                         1, 0, NULL, 0, &imap, &nimap, NULL, NULL);
diff --git a/include/asm-frv/mem-layout.h b/include/asm-frv/mem-layout.h
index 83532252b8be..734a1d0583b6 100644
--- a/include/asm-frv/mem-layout.h
+++ b/include/asm-frv/mem-layout.h
@@ -60,7 +60,7 @@
  */
 #define BRK_BASE                        __UL(2 * 1024 * 1024 + PAGE_SIZE)
 #define STACK_TOP                       __UL(2 * 1024 * 1024)
-#define STACK_TOP_MAX   STACK_TOP
+#define STACK_TOP_MAX                   __UL(0xc0000000)
 
 /* userspace process size */
 #ifdef CONFIG_MMU
diff --git a/include/asm-frv/pgtable.h b/include/asm-frv/pgtable.h
index 6c0682ed5fc9..4e219046fe42 100644
--- a/include/asm-frv/pgtable.h
+++ b/include/asm-frv/pgtable.h
@@ -507,13 +507,22 @@ static inline int pte_file(pte_t pte)
  */
 static inline void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t pte)
 {
+        struct mm_struct *mm;
         unsigned long ampr;
-        pgd_t *pge = pgd_offset(current->mm, address);
-        pud_t *pue = pud_offset(pge, address);
-        pmd_t *pme = pmd_offset(pue, address);
 
-        ampr = pme->ste[0] & 0xffffff00;
-        ampr |= xAMPRx_L | xAMPRx_SS_16Kb | xAMPRx_S | xAMPRx_C | xAMPRx_V;
+        mm = current->mm;
+        if (mm) {
+                pgd_t *pge = pgd_offset(mm, address);
+                pud_t *pue = pud_offset(pge, address);
+                pmd_t *pme = pmd_offset(pue, address);
+
+                ampr = pme->ste[0] & 0xffffff00;
+                ampr |= xAMPRx_L | xAMPRx_SS_16Kb | xAMPRx_S | xAMPRx_C |
+                        xAMPRx_V;
+        } else {
+                address = ULONG_MAX;
+                ampr = 0;
+        }
 
         asm volatile("movgs %0,scr0\n"
                      "movgs %0,scr1\n"
diff --git a/include/asm-frv/spr-regs.h b/include/asm-frv/spr-regs.h
index c2a541ef828d..01e6af5e99b8 100644
--- a/include/asm-frv/spr-regs.h
+++ b/include/asm-frv/spr-regs.h
@@ -99,9 +99,23 @@
 #define TBR_TT_TRAP1            (0x81 << 4)
 #define TBR_TT_TRAP2            (0x82 << 4)
 #define TBR_TT_TRAP3            (0x83 << 4)
+#define TBR_TT_TRAP120          (0xf8 << 4)
+#define TBR_TT_TRAP121          (0xf9 << 4)
+#define TBR_TT_TRAP122          (0xfa << 4)
+#define TBR_TT_TRAP123          (0xfb << 4)
+#define TBR_TT_TRAP124          (0xfc << 4)
+#define TBR_TT_TRAP125          (0xfd << 4)
 #define TBR_TT_TRAP126          (0xfe << 4)
 #define TBR_TT_BREAK            (0xff << 4)
 
+#define TBR_TT_ATOMIC_CMPXCHG32 TBR_TT_TRAP120
+#define TBR_TT_ATOMIC_XCHG32    TBR_TT_TRAP121
+#define TBR_TT_ATOMIC_XOR       TBR_TT_TRAP122
+#define TBR_TT_ATOMIC_OR        TBR_TT_TRAP123
+#define TBR_TT_ATOMIC_AND       TBR_TT_TRAP124
+#define TBR_TT_ATOMIC_SUB       TBR_TT_TRAP125
+#define TBR_TT_ATOMIC_ADD       TBR_TT_TRAP126
+
 #define __get_TBR()     ({ unsigned long x; asm volatile("movsg tbr,%0" : "=r"(x)); x; })
 
 /*
diff --git a/include/asm-frv/system.h b/include/asm-frv/system.h
index 2c57f4734746..30a67a9da11a 100644
--- a/include/asm-frv/system.h
+++ b/include/asm-frv/system.h
@@ -179,14 +179,23 @@ do {							\
 #define mb()                    asm volatile ("membar" : : :"memory")
 #define rmb()                   asm volatile ("membar" : : :"memory")
 #define wmb()                   asm volatile ("membar" : : :"memory")
-#define set_mb(var, value)      do { var = value; mb(); } while (0)
+#define read_barrier_depends()  barrier()
 
-#define smp_mb()                mb()
-#define smp_rmb()               rmb()
-#define smp_wmb()               wmb()
-
-#define read_barrier_depends()          do {} while(0)
+#ifdef CONFIG_SMP
+#define smp_mb()                        mb()
+#define smp_rmb()                       rmb()
+#define smp_wmb()                       wmb()
 #define smp_read_barrier_depends()      read_barrier_depends()
+#define set_mb(var, value) \
+        do { xchg(&var, (value)); } while (0)
+#else
+#define smp_mb()                        barrier()
+#define smp_rmb()                       barrier()
+#define smp_wmb()                       barrier()
+#define smp_read_barrier_depends()      do {} while(0)
+#define set_mb(var, value) \
+        do { var = (value); barrier(); } while (0)
+#endif
 
 #define HARD_RESET_NOW()                        \
 do {                                            \
diff --git a/include/asm-x86/linkage.h b/include/asm-x86/linkage.h
index 31739c7d66a9..c048353f4b85 100644
--- a/include/asm-x86/linkage.h
+++ b/include/asm-x86/linkage.h
@@ -8,12 +8,45 @@
 
 #ifdef CONFIG_X86_32
 #define asmlinkage CPP_ASMLINKAGE __attribute__((regparm(0)))
-#define prevent_tail_call(ret) __asm__ ("" : "=r" (ret) : "0" (ret))
 /*
  * For 32-bit UML - mark functions implemented in assembly that use
  * regparm input parameters:
  */
 #define asmregparm __attribute__((regparm(3)))
+
+/*
+ * Make sure the compiler doesn't do anything stupid with the
+ * arguments on the stack - they are owned by the *caller*, not
+ * the callee. This just fools gcc into not spilling into them,
+ * and keeps it from doing tailcall recursion and/or using the
+ * stack slots for temporaries, since they are live and "used"
+ * all the way to the end of the function.
+ *
+ * NOTE! On x86-64, all the arguments are in registers, so this
+ * only matters on a 32-bit kernel.
+ */
+#define asmlinkage_protect(n, ret, args...) \
+        __asmlinkage_protect##n(ret, ##args)
+#define __asmlinkage_protect_n(ret, args...) \
+        __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
+#define __asmlinkage_protect0(ret) \
+        __asmlinkage_protect_n(ret)
+#define __asmlinkage_protect1(ret, arg1) \
+        __asmlinkage_protect_n(ret, "g" (arg1))
+#define __asmlinkage_protect2(ret, arg1, arg2) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2))
+#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3))
+#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3), \
+                              "g" (arg4))
+#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3), \
+                              "g" (arg4), "g" (arg5))
+#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
+        __asmlinkage_protect_n(ret, "g" (arg1), "g" (arg2), "g" (arg3), \
+                              "g" (arg4), "g" (arg5), "g" (arg6))
+
 #endif
 
 #ifdef CONFIG_X86_ALIGNMENT_16
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 9cdd12a9e843..cedbbd806bf6 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -86,6 +86,7 @@ header-y += if_plip.h
 header-y += if_ppp.h
 header-y += if_slip.h
 header-y += if_strip.h
+header-y += if_tun.h
 header-y += if_tunnel.h
 header-y += in6.h
 header-y += in_route.h
@@ -229,7 +230,6 @@ unifdef-y += if_link.h
 unifdef-y += if_pppol2tp.h
 unifdef-y += if_pppox.h
 unifdef-y += if_tr.h
-unifdef-y += if_tun.h
 unifdef-y += if_vlan.h
 unifdef-y += if_wanpipe.h
 unifdef-y += igmp.h
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 72f1c5f47be3..8c71fe2fb1f5 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -18,47 +18,8 @@
 #ifndef __IF_TUN_H
 #define __IF_TUN_H
 
-/* Uncomment to enable debugging */
-/* #define TUN_DEBUG 1 */
-
 #include <linux/types.h>
 
-#ifdef __KERNEL__
-
-#ifdef TUN_DEBUG
-#define DBG  if(tun->debug)printk
-#define DBG1 if(debug==2)printk
-#else
-#define DBG( a... )
-#define DBG1( a... )
-#endif
-
-struct tun_struct {
-        struct list_head        list;
-        unsigned long           flags;
-        int                     attached;
-        uid_t                   owner;
-        gid_t                   group;
-
-        wait_queue_head_t       read_wait;
-        struct sk_buff_head     readq;
-
-        struct net_device       *dev;
-
-        struct fasync_struct    *fasync;
-
-        unsigned long if_flags;
-        u8 dev_addr[ETH_ALEN];
-        u32 chr_filter[2];
-        u32 net_filter[2];
-
-#ifdef TUN_DEBUG        
-        int debug;
-#endif  
-};
-
-#endif /* __KERNEL__ */
-
 /* Read queue size */
 #define TUN_READQ_SIZE  500
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 4aaefc349a4b..134c8e5cf07c 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -53,7 +53,7 @@ struct ipv6_opt_hdr {
         /* 
          * TLV encoded option data follows.
          */
-};
+} __attribute__ ((packed));     /* required for some archs */
 
 #define ipv6_destopt_hdr ipv6_opt_hdr
 #define ipv6_hopopt_hdr  ipv6_opt_hdr
diff --git a/include/linux/linkage.h b/include/linux/linkage.h
index 0592936344c4..2119610b24f8 100644
--- a/include/linux/linkage.h
+++ b/include/linux/linkage.h
@@ -17,8 +17,24 @@
 # define asmregparm
 #endif
 
-#ifndef prevent_tail_call
-# define prevent_tail_call(ret) do { } while (0)
+/*
+ * This is used by architectures to keep arguments on the stack
+ * untouched by the compiler by keeping them live until the end.
+ * The argument stack may be owned by the assembly-language
+ * caller, not the callee, and gcc doesn't always understand
+ * that.
+ *
+ * We have the return value, and a maximum of six arguments.
+ *
+ * This should always be followed by a "return ret" for the
+ * protection to work (ie no more work that the compiler might
+ * end up needing stack temporaries for).
+ */
+/* Assembly files may be compiled with -traditional .. */
+#ifndef __ASSEMBLY__
+#ifndef asmlinkage_protect
+# define asmlinkage_protect(n, ret, args...)    do { } while (0)
+#endif
 #endif
 
 #ifndef __ALIGN
diff --git a/include/linux/pnp.h b/include/linux/pnp.h
index 29dd55838e84..b2f05c230f4b 100644
--- a/include/linux/pnp.h
+++ b/include/linux/pnp.h
@@ -175,7 +175,7 @@ static inline void pnp_set_card_drvdata(struct pnp_card_link *pcard, void *data)
 struct pnp_dev {
         struct device dev;              /* Driver Model device interface */
         u64 dma_mask;
-        unsigned char number;           /* used as an index, must be unique */
+        unsigned int number;            /* used as an index, must be unique */
         int status;
 
         struct list_head global_list;   /* node in global list of devices */
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 576a5f77d3bd..1129ee0a7180 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -341,6 +341,9 @@ static inline void double_spin_unlock(spinlock_t *l1, spinlock_t *l2,
  * atomic_dec_and_lock - lock on reaching reference count zero
  * @atomic: the atomic counter
  * @lock: the spinlock in question
+ *
+ * Decrements @atomic by 1.  If the result is 0, returns true and locks
+ * @lock.  Returns false for all other cases.
  */
 extern int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock);
 #define atomic_dec_and_lock(atomic, lock) \
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index ba33db053854..7040a782c656 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -47,7 +47,7 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
     } while (0)
 
 #define IP6_ECN_flow_xmit(sk, label) do {                               \
-        if (INET_ECN_is_capable(inet_sk(sk)->tos))                      \
+        if (INET_ECN_is_capable(inet6_sk(sk)->tclass))                  \
                 (label) |= htonl(INET_ECN_ECT_0 << 20);                 \
     } while (0)
 
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 10ae2da6f93b..35b1e83fb96a 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -104,6 +104,7 @@ typedef enum {
         SCTP_CMD_ADAPTATION_IND, /* generate and send adaptation event */
         SCTP_CMD_ASSOC_SHKEY,    /* generate the association shared keys */
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
+        SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 9bcfc12275e8..7ea12e8e6676 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -67,7 +67,7 @@ struct sctp_ulpevent {
 };
 
 /* Retrieve the skb this event sits inside of. */
-static inline struct sk_buff *sctp_event2skb(struct sctp_ulpevent *ev)
+static inline struct sk_buff *sctp_event2skb(const struct sctp_ulpevent *ev)
 {
         return container_of((void *)ev, struct sk_buff, cb);
 }
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 7de4ea3a04d9..4fd3eb2f8ec2 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -752,6 +752,8 @@ static inline unsigned int tcp_packets_in_flight(const struct tcp_sock *tp)
         return tp->packets_out - tcp_left_out(tp) + tp->retrans_out;
 }
 
+extern int tcp_limit_reno_sacked(struct tcp_sock *tp);
+
 /* If cwnd > ssthresh, we may raise ssthresh to be half-way to cwnd.
  * The exception is rate halving phase, when cwnd is decreasing towards
  * ssthresh.
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 62f1a5231fe9..2727f9238359 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2569,6 +2569,7 @@ static int proc_cgroup_show(struct seq_file *m, void *v)
                 /* Skip this hierarchy if it has no active subsystems */
                 if (!root->actual_subsys_bits)
                         continue;
+                seq_printf(m, "%lu:", root->subsys_bits);
                 for_each_subsys(root, ss)
                         seq_printf(m, "%s%s", count++ ? "," : "", ss->name);
                 seq_putc(m, ':');
diff --git a/kernel/exit.c b/kernel/exit.c
index 53872bf993fa..073005b1cfb2 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1608,7 +1608,7 @@ asmlinkage long sys_waitid(int which, pid_t upid,
         put_pid(pid);
 
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(5, ret, which, upid, infop, options, ru);
         return ret;
 }
 
@@ -1640,7 +1640,7 @@ asmlinkage long sys_wait4(pid_t upid, int __user *stat_addr,
         put_pid(pid);
 
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(4, ret, upid, stat_addr, options, ru);
         return ret;
 }
 
diff --git a/kernel/uid16.c b/kernel/uid16.c
index dd308ba4e03b..3e41c1673e2f 100644
--- a/kernel/uid16.c
+++ b/kernel/uid16.c
@@ -21,7 +21,7 @@ asmlinkage long sys_chown16(const char __user * filename, old_uid_t user, old_gi
 {
         long ret = sys_chown(filename, low2highuid(user), low2highgid(group));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, filename, user, group);
         return ret;
 }
 
@@ -29,7 +29,7 @@ asmlinkage long sys_lchown16(const char __user * filename, old_uid_t user, old_g
 {
         long ret = sys_lchown(filename, low2highuid(user), low2highgid(group));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, filename, user, group);
         return ret;
 }
 
@@ -37,7 +37,7 @@ asmlinkage long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group)
 {
         long ret = sys_fchown(fd, low2highuid(user), low2highgid(group));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, fd, user, group);
         return ret;
 }
 
@@ -45,7 +45,7 @@ asmlinkage long sys_setregid16(old_gid_t rgid, old_gid_t egid)
 {
         long ret = sys_setregid(low2highgid(rgid), low2highgid(egid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(2, ret, rgid, egid);
         return ret;
 }
 
@@ -53,7 +53,7 @@ asmlinkage long sys_setgid16(old_gid_t gid)
 {
         long ret = sys_setgid(low2highgid(gid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(1, ret, gid);
         return ret;
 }
 
@@ -61,7 +61,7 @@ asmlinkage long sys_setreuid16(old_uid_t ruid, old_uid_t euid)
 {
         long ret = sys_setreuid(low2highuid(ruid), low2highuid(euid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(2, ret, ruid, euid);
         return ret;
 }
 
@@ -69,7 +69,7 @@ asmlinkage long sys_setuid16(old_uid_t uid)
 {
         long ret = sys_setuid(low2highuid(uid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(1, ret, uid);
         return ret;
 }
 
@@ -78,7 +78,7 @@ asmlinkage long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid)
         long ret = sys_setresuid(low2highuid(ruid), low2highuid(euid),
                                  low2highuid(suid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, ruid, euid, suid);
         return ret;
 }
 
@@ -98,7 +98,7 @@ asmlinkage long sys_setresgid16(old_gid_t rgid, old_gid_t egid, old_gid_t sgid)
         long ret = sys_setresgid(low2highgid(rgid), low2highgid(egid),
                                  low2highgid(sgid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, rgid, egid, sgid);
         return ret;
 }
 
@@ -117,7 +117,7 @@ asmlinkage long sys_setfsuid16(old_uid_t uid)
 {
         long ret = sys_setfsuid(low2highuid(uid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(1, ret, uid);
         return ret;
 }
 
@@ -125,7 +125,7 @@ asmlinkage long sys_setfsgid16(old_gid_t gid)
 {
         long ret = sys_setfsgid(low2highgid(gid));
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(1, ret, gid);
         return ret;
 }
 
diff --git a/lib/lzo/lzo1x_decompress.c b/lib/lzo/lzo1x_decompress.c
index 9dc7056e5520..77f0f9b775a9 100644
--- a/lib/lzo/lzo1x_decompress.c
+++ b/lib/lzo/lzo1x_decompress.c
@@ -158,7 +158,7 @@ match:
                                         t += 7 + *ip++;
                                 }
                                 m_pos -= le16_to_cpu(get_unaligned(
-                                        (const unsigned short *)ip) >> 2);
+                                        (const unsigned short *)ip)) >> 2;
                                 ip += 2;
                                 if (m_pos == op)
                                         goto eof_found;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index a2efa7ff41f1..3235c57615e4 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -266,7 +266,6 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
         char buf[300];
         int i = 0;
 #endif /* DUMP_PACKETS >0 */
-        DECLARE_MAC_BUF(mac);
 
         pr_debug("lec_start_xmit called\n");
         if (!priv->lecd) {
@@ -374,15 +373,19 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
                         pr_debug("%s:lec_start_xmit: queuing packet, ",
                                 dev->name);
-                        pr_debug("MAC address %s\n",
-                                 print_mac(mac, lec_h->h_dest));
+                        pr_debug("MAC address " MAC_FMT "\n",
+                                 lec_h->h_dest[0], lec_h->h_dest[1],
+                                 lec_h->h_dest[2], lec_h->h_dest[3],
+                                 lec_h->h_dest[4], lec_h->h_dest[5]);
                         skb_queue_tail(&entry->tx_wait, skb);
                 } else {
                         pr_debug
                             ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
                              dev->name);
-                        pr_debug("MAC address %s\n",
-                                 print_mac(mac, lec_h->h_dest));
+                        pr_debug("MAC address " MAC_FMT "\n",
+                                 lec_h->h_dest[0], lec_h->h_dest[1],
+                                 lec_h->h_dest[2], lec_h->h_dest[3],
+                                 lec_h->h_dest[4], lec_h->h_dest[5]);
                         priv->stats.tx_dropped++;
                         dev_kfree_skb(skb);
                 }
@@ -394,8 +397,10 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
                 pr_debug("lec.c: emptying tx queue, ");
-                pr_debug("MAC address %s\n",
-                         print_mac(mac, lec_h->h_dest));
+                pr_debug("MAC address " MAC_FMT "\n",
+                         lec_h->h_dest[0], lec_h->h_dest[1],
+                         lec_h->h_dest[2], lec_h->h_dest[3],
+                         lec_h->h_dest[4], lec_h->h_dest[5]);
                 lec_send(vcc, skb2, priv);
         }
 
@@ -449,7 +454,6 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
         struct lec_arp_table *entry;
         int i;
         char *tmp;              /* FIXME */
-        DECLARE_MAC_BUF(mac);
 
         atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
         mesg = (struct atmlec_msg *)skb->data;
@@ -536,9 +540,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                         struct net_bridge_fdb_entry *f;
 
                         pr_debug
-                            ("%s: bridge zeppelin asks about %s\n",
+                            ("%s: bridge zeppelin asks about " MAC_FMT "\n",
                              dev->name,
-                             print_mac(mac, mesg->content.proxy.mac_addr));
+                             mesg->content.proxy.mac_addr[0],
+                             mesg->content.proxy.mac_addr[1],
+                             mesg->content.proxy.mac_addr[2],
+                             mesg->content.proxy.mac_addr[3],
+                             mesg->content.proxy.mac_addr[4],
+                             mesg->content.proxy.mac_addr[5]);
 
                         if (br_fdb_get_hook == NULL || dev->br_port == NULL)
                                 break;
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 5f4eb73fb9d3..57aeba729bae 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -218,9 +218,11 @@ void __exit ax25_uid_free(void)
         struct hlist_node *node;
 
         write_lock(&ax25_uid_lock);
+again:
         ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                 hlist_del_init(&ax25_uid->uid_node);
                 ax25_uid_put(ax25_uid);
+                goto again;
         }
         write_unlock(&ax25_uid_lock);
 }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 1c0efd8ad9f3..af7e8be8d8d2 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -110,7 +110,8 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
  * ipt_REJECT needs it.  Future netfilter modules might
  * require us to fill additional fields. */
 static struct net_device __fake_net_device = {
-        .hard_header_len        = ETH_HLEN
+        .hard_header_len        = ETH_HLEN,
+        .nd_net                 = &init_net,
 };
 
 static struct rtable __fake_rtable = {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 0d0fd28a9041..608701339620 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2131,8 +2131,8 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
  *      @features: features for the output path (see dev->features)
  *
  *      This function performs segmentation on the given skb.  It returns
- *      the segment at the given position.  It returns NULL if there are
- *      no more segments to generate, or when an error is encountered.
+ *      a pointer to the first in a list of new skbs for the segments.
+ *      In case of error it returns ERR_PTR(err).
  */
 struct sk_buff *skb_segment(struct sk_buff *skb, int features)
 {
diff --git a/net/core/sock.c b/net/core/sock.c
index 2654c147c004..7a0567b4b2c9 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1725,7 +1725,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         sk->sk_rcvtimeo         =       MAX_SCHEDULE_TIMEOUT;
         sk->sk_sndtimeo         =       MAX_SCHEDULE_TIMEOUT;
 
-        sk->sk_stamp = ktime_set(-1L, -1L);
+        sk->sk_stamp = ktime_set(-1L, 0);
 
         atomic_set(&sk->sk_refcnt, 1);
         atomic_set(&sk->sk_drops, 0);
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 287a62bc2e0f..ba2ef94a2302 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -325,6 +325,12 @@ static inline int dccp_bad_service_code(const struct sock *sk,
  * This is used for transmission as well as for reception.
  */
 struct dccp_skb_cb {
+        union {
+                struct inet_skb_parm    h4;
+#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+                struct inet6_skb_parm   h6;
+#endif
+        } header;
         __u8  dccpd_type:4;
         __u8  dccpd_ccval:4;
         __u8  dccpd_reset_code,
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 474075adbde4..b33704415555 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -489,7 +489,6 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
 
                 dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->loc_addr,
                                                               ireq->rmt_addr);
-                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                             ireq->rmt_addr,
                                             ireq->opt);
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 3b763db3d863..3d7d628d870d 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -126,7 +126,6 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
-                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = icsk->icsk_af_ops->queue_xmit(skb, 0);
                 return net_xmit_eval(err);
         }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index e3f5d37b84be..c91d3c1fd30d 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1057,6 +1057,9 @@ static int __init dccp_init(void)
         int ehash_order, bhash_order, i;
         int rc = -ENOBUFS;
 
+        BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
+                     FIELD_SIZEOF(struct sk_buff, cb));
+
         dccp_hashinfo.bind_bucket_cachep =
                 kmem_cache_create("dccp_bind_bucket",
                                   sizeof(struct inet_bind_bucket), 0,
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index a7b417523e9b..a80839b02e3f 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -301,7 +301,7 @@ static int eth_change_mtu(struct net_device *dev, int new_mtu)
 static int eth_validate_addr(struct net_device *dev)
 {
         if (!is_valid_ether_addr(dev->dev_addr))
-                return -EINVAL;
+                return -EADDRNOTAVAIL;
 
         return 0;
 }
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 1e3f87c8c012..200ee1e63728 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -271,7 +271,6 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
 {
         struct ieee80211_hdr_3addr *hdr;
         int res, hdrlen;
-        DECLARE_MAC_BUF(mac);
 
         if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
                 return 0;
@@ -283,8 +282,12 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
         res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
         atomic_dec(&crypt->refcnt);
         if (res < 0) {
-                IEEE80211_DEBUG_DROP("decryption failed (SA=%s"
-                                     ") res=%d\n", print_mac(mac, hdr->addr2), res);
+                IEEE80211_DEBUG_DROP("decryption failed (SA=" MAC_FMT
+                                     ") res=%d\n",
+                                     hdr->addr2[0], hdr->addr2[1],
+                                     hdr->addr2[2], hdr->addr2[3],
+                                     hdr->addr2[4], hdr->addr2[5],
+                                     res);
                 if (res == -2)
                         IEEE80211_DEBUG_DROP("Decryption failed ICV "
                                              "mismatch (key %d)\n",
@@ -304,7 +307,6 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
 {
         struct ieee80211_hdr_3addr *hdr;
         int res, hdrlen;
-        DECLARE_MAC_BUF(mac);
 
         if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
                 return 0;
@@ -317,8 +319,12 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
         atomic_dec(&crypt->refcnt);
         if (res < 0) {
                 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
-                       " (SA=%s keyidx=%d)\n",
-                       ieee->dev->name, print_mac(mac, hdr->addr2), keyidx);
+                       " (SA=" MAC_FMT " keyidx=%d)\n",
+                       ieee->dev->name,
+                       hdr->addr2[0], hdr->addr2[1],
+                       hdr->addr2[2], hdr->addr2[3],
+                       hdr->addr2[4], hdr->addr2[5],
+                       keyidx);
                 return -1;
         }
 
@@ -462,8 +468,10 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                          * frames silently instead of filling system log with
                          * these reports. */
                         IEEE80211_DEBUG_DROP("Decryption failed (not set)"
-                                             " (SA=%s)\n",
-                                             print_mac(mac, hdr->addr2));
+                                             " (SA=" MAC_FMT ")\n",
+                                             hdr->addr2[0], hdr->addr2[1],
+                                             hdr->addr2[2], hdr->addr2[3],
+                                             hdr->addr2[4], hdr->addr2[5]);
                         ieee->ieee_stats.rx_discards_undecryptable++;
                         goto rx_dropped;
                 }
@@ -474,8 +482,10 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                     fc & IEEE80211_FCTL_PROTECTED && ieee->host_decrypt &&
                     (keyidx = hostap_rx_frame_decrypt(ieee, skb, crypt)) < 0) {
                         printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
-                               "from %s\n", dev->name,
-                               print_mac(mac, hdr->addr2));
+                               "from " MAC_FMT "\n", dev->name,
+                               hdr->addr2[0], hdr->addr2[1],
+                               hdr->addr2[2], hdr->addr2[3],
+                               hdr->addr2[4], hdr->addr2[5]);
                         /* TODO: could inform hostapd about this so that it
                          * could send auth failure report */
                         goto rx_dropped;
@@ -653,8 +663,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                          * configured */
                 } else {
                         IEEE80211_DEBUG_DROP("encryption configured, but RX "
-                                             "frame not encrypted (SA=%s"
-                                             ")\n", print_mac(mac, hdr->addr2));
+                                             "frame not encrypted (SA="
+                                             MAC_FMT ")\n",
+                                             hdr->addr2[0], hdr->addr2[1],
+                                             hdr->addr2[2], hdr->addr2[3],
+                                             hdr->addr2[4], hdr->addr2[5]);
                         goto rx_dropped;
                 }
         }
@@ -662,9 +675,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
         if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep &&
             !ieee80211_is_eapol_frame(ieee, skb)) {
                 IEEE80211_DEBUG_DROP("dropped unencrypted RX data "
-                                     "frame from %s"
+                                     "frame from " MAC_FMT
                                      " (drop_unencrypted=1)\n",
-                                     print_mac(mac, hdr->addr2));
+                                     hdr->addr2[0], hdr->addr2[1],
+                                     hdr->addr2[2], hdr->addr2[3],
+                                     hdr->addr2[4], hdr->addr2[5]);
                 goto rx_dropped;
         }
 
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 9c7e5ffb223d..4670683b4688 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -160,7 +160,7 @@ config IP_PNP_DHCP
 
           If unsure, say Y. Note that if you want to use DHCP, a DHCP server
           must be operating on your network.  Read
-          <file:Documentation/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfsroot.txt> for details.
 
 config IP_PNP_BOOTP
         bool "IP: BOOTP support"
@@ -175,7 +175,7 @@ config IP_PNP_BOOTP
           does BOOTP itself, providing all necessary information on the kernel
           command line, you can say N here. If unsure, say Y. Note that if you
           want to use BOOTP, a BOOTP server must be operating on your network.
-          Read <file:Documentation/nfsroot.txt> for details.
+          Read <file:Documentation/filesystems/nfsroot.txt> for details.
 
 config IP_PNP_RARP
         bool "IP: RARP support"
@@ -187,8 +187,8 @@ config IP_PNP_RARP
           discovered automatically at boot time using the RARP protocol (an
           older protocol which is being obsoleted by BOOTP and DHCP), say Y
           here. Note that if you want to use RARP, a RARP server must be
-          operating on your network. Read <file:Documentation/nfsroot.txt> for
-          details.
+          operating on your network. Read
+          <file:Documentation/filesystems/nfsroot.txt> for details.
 
 # not yet ready..
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP                
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 876169f3a528..717c411a5c6b 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -124,6 +124,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 tw->tw_hash         = sk->sk_hash;
                 tw->tw_ipv6only     = 0;
                 tw->tw_prot         = sk->sk_prot_creator;
+                tw->tw_net          = sk->sk_net;
                 atomic_set(&tw->tw_refcnt, 1);
                 inet_twsk_dead_node_init(tw);
                 __module_get(tw->tw_prot->owner);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index f72457b4b0a7..c2921d01e925 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1132,7 +1132,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         }
         release_sock(sk);
 
-        if (len < sizeof(int) && len > 0 && val>=0 && val<255) {
+        if (len < sizeof(int) && len > 0 && val>=0 && val<=255) {
                 unsigned char ucval = (unsigned char)val;
                 len = 1;
                 if (put_user(len, optlen))
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 7c992fbbc2c3..4824fe8996bf 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1411,7 +1411,7 @@ late_initcall(ip_auto_config);
 
 /*
  *  Decode any IP configuration options in the "ip=" or "nfsaddrs=" kernel
- *  command line parameter.  See Documentation/nfsroot.txt.
+ *  command line parameter.  See Documentation/filesystems/nfsroot.txt.
  */
 static int __init ic_proto_name(char *name)
 {
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 52926c8e3cc1..a12dd329e208 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -82,8 +82,8 @@ clusterip_config_put(struct clusterip_config *c)
 static inline void
 clusterip_config_entry_put(struct clusterip_config *c)
 {
+        write_lock_bh(&clusterip_lock);
         if (atomic_dec_and_test(&c->entries)) {
-                write_lock_bh(&clusterip_lock);
                 list_del(&c->list);
                 write_unlock_bh(&clusterip_lock);
 
@@ -96,7 +96,9 @@ clusterip_config_entry_put(struct clusterip_config *c)
 #ifdef CONFIG_PROC_FS
                 remove_proc_entry(c->pde->name, c->pde->parent);
 #endif
+                return;
         }
+        write_unlock_bh(&clusterip_lock);
 }
 
 static struct clusterip_config *
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 0d5fa3a54d04..36b4e3bb056f 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -629,6 +629,8 @@ static int __init nf_nat_init(void)
         size_t i;
         int ret;
 
+        need_ipv4_conntrack();
+
         ret = nf_ct_extend_register(&nat_extend);
         if (ret < 0) {
                 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7facdb0f6960..5119856017ab 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1625,13 +1625,11 @@ out:
         return flag;
 }
 
-/* If we receive more dupacks than we expected counting segments
- * in assumption of absent reordering, interpret this as reordering.
- * The only another reason could be bug in receiver TCP.
+/* Limits sacked_out so that sum with lost_out isn't ever larger than
+ * packets_out. Returns zero if sacked_out adjustement wasn't necessary.
  */
-static void tcp_check_reno_reordering(struct sock *sk, const int addend)
+int tcp_limit_reno_sacked(struct tcp_sock *tp)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
         u32 holes;
 
         holes = max(tp->lost_out, 1U);
@@ -1639,8 +1637,20 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)
 
         if ((tp->sacked_out + holes) > tp->packets_out) {
                 tp->sacked_out = tp->packets_out - holes;
-                tcp_update_reordering(sk, tp->packets_out + addend, 0);
+                return 1;
         }
+        return 0;
+}
+
+/* If we receive more dupacks than we expected counting segments
+ * in assumption of absent reordering, interpret this as reordering.
+ * The only another reason could be bug in receiver TCP.
+ */
+static void tcp_check_reno_reordering(struct sock *sk, const int addend)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        if (tcp_limit_reno_sacked(tp))
+                tcp_update_reordering(sk, tp->packets_out + addend, 0);
 }
 
 /* Emulate SACKs for SACKless connection: account for a new dupack. */
@@ -1681,11 +1691,16 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
 int tcp_use_frto(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
+        const struct inet_connection_sock *icsk = inet_csk(sk);
         struct sk_buff *skb;
 
         if (!sysctl_tcp_frto)
                 return 0;
 
+        /* MTU probe and F-RTO won't really play nicely along currently */
+        if (icsk->icsk_mtup.probe_size)
+                return 0;
+
         if (IsSackFrto())
                 return 1;
 
@@ -2134,11 +2149,13 @@ static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
 /* Mark head of queue up as lost. With RFC3517 SACK, the packets is
  * is against sacked "cnt", otherwise it's against facked "cnt"
  */
-static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit)
+static void tcp_mark_head_lost(struct sock *sk, int packets)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        int cnt;
+        int cnt, oldcnt;
+        int err;
+        unsigned int mss;
 
         BUG_TRAP(packets <= tp->packets_out);
         if (tp->lost_skb_hint) {
@@ -2157,13 +2174,25 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit)
                 tp->lost_skb_hint = skb;
                 tp->lost_cnt_hint = cnt;
 
+                if (after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
+                        break;
+
+                oldcnt = cnt;
                 if (tcp_is_fack(tp) || tcp_is_reno(tp) ||
                     (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                         cnt += tcp_skb_pcount(skb);
 
-                if (((!fast_rexmit || (tp->lost_out > 0)) && (cnt > packets)) ||
-                    after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
-                        break;
+                if (cnt > packets) {
+                        if (tcp_is_sack(tp) || (oldcnt >= packets))
+                                break;
+
+                        mss = skb_shinfo(skb)->gso_size;
+                        err = tcp_fragment(sk, skb, (packets - oldcnt) * mss, mss);
+                        if (err < 0)
+                                break;
+                        cnt = packets;
+                }
+
                 if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
                         TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                         tp->lost_out += tcp_skb_pcount(skb);
@@ -2180,17 +2209,17 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tcp_is_reno(tp)) {
-                tcp_mark_head_lost(sk, 1, fast_rexmit);
+                tcp_mark_head_lost(sk, 1);
         } else if (tcp_is_fack(tp)) {
                 int lost = tp->fackets_out - tp->reordering;
                 if (lost <= 0)
                         lost = 1;
-                tcp_mark_head_lost(sk, lost, fast_rexmit);
+                tcp_mark_head_lost(sk, lost);
         } else {
                 int sacked_upto = tp->sacked_out - tp->reordering;
-                if (sacked_upto < 0)
-                        sacked_upto = 0;
-                tcp_mark_head_lost(sk, sacked_upto, fast_rexmit);
+                if (sacked_upto < fast_rexmit)
+                        sacked_upto = fast_rexmit;
+                tcp_mark_head_lost(sk, sacked_upto);
         }
 
         /* New heuristics: it is possible only after we switched
@@ -2524,7 +2553,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
             before(tp->snd_una, tp->high_seq) &&
             icsk->icsk_ca_state != TCP_CA_Open &&
             tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0);
+                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering);
                 NET_INC_STATS_BH(LINUX_MIB_TCPLOSS);
         }
 
@@ -2586,6 +2615,8 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
         case TCP_CA_Loss:
                 if (flag & FLAG_DATA_ACKED)
                         icsk->icsk_retransmits = 0;
+                if (tcp_is_reno(tp) && flag & FLAG_SND_UNA_ADVANCED)
+                        tcp_reset_reno_sack(tp);
                 if (!tcp_try_undo_loss(sk)) {
                         tcp_moderate_cwnd(tp);
                         tcp_xmit_retransmit_queue(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 72b9350006fe..d29ef79c00ca 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1808,6 +1808,9 @@ void tcp_simple_retransmit(struct sock *sk)
         if (!lost)
                 return;
 
+        if (tcp_is_reno(tp))
+                tcp_limit_reno_sacked(tp);
+
         tcp_verify_left_out(tp);
 
         /* Don't muck with the congestion window here.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a65935a9afd9..e08955baedff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -371,25 +371,26 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
          */
         in6_dev_hold(ndev);
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
+        if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
+                printk(KERN_INFO
+                       "%s: Disabled Multicast RS\n",
+                       dev->name);
+                ndev->cnf.rtr_solicits = 0;
+        }
+#endif
+
 #ifdef CONFIG_IPV6_PRIVACY
         setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev);
         if ((dev->flags&IFF_LOOPBACK) ||
             dev->type == ARPHRD_TUNNEL ||
-#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
+            dev->type == ARPHRD_TUNNEL6 ||
             dev->type == ARPHRD_SIT ||
-#endif
             dev->type == ARPHRD_NONE) {
                 printk(KERN_INFO
                        "%s: Disabled Privacy Extensions\n",
                        dev->name);
                 ndev->cnf.use_tempaddr = -1;
-
-                if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
-                        printk(KERN_INFO
-                               "%s: Disabled Multicast RS\n",
-                               dev->name);
-                        ndev->cnf.rtr_solicits = 0;
-                }
         } else {
                 in6_dev_hold(ndev);
                 ipv6_regen_rndid((unsigned long) ndev);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8897ccf8086a..0a6fbc1d1a50 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -372,8 +372,10 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
         read_lock(&raw_v6_hashinfo.lock);
         sk = sk_head(&raw_v6_hashinfo.ht[hash]);
         if (sk != NULL) {
-                saddr = &ipv6_hdr(skb)->saddr;
-                daddr = &ipv6_hdr(skb)->daddr;
+                struct ipv6hdr *hdr = (struct ipv6hdr *) skb->data;
+
+                saddr = &hdr->saddr;
+                daddr = &hdr->daddr;
                 net = skb->dev->nd_net;
 
                 while ((sk = __raw_v6_lookup(net, sk, nexthdr, saddr, daddr,
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index e0c72d04584b..c1706855460a 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -312,14 +312,12 @@ static void ieee80211_sta_wmm_params(struct net_device *dev,
         }
 }
 
-
-static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
-                                   u8 erp_value)
+static u32 ieee80211_handle_protect_preamb(struct ieee80211_sub_if_data *sdata,
+                                           bool use_protection,
+                                           bool use_short_preamble)
 {
         struct ieee80211_bss_conf *bss_conf = &sdata->bss_conf;
         struct ieee80211_if_sta *ifsta = &sdata->u.sta;
-        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
-        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
         DECLARE_MAC_BUF(mac);
         u32 changed = 0;
 
@@ -350,6 +348,32 @@ static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
         return changed;
 }
 
+static u32 ieee80211_handle_erp_ie(struct ieee80211_sub_if_data *sdata,
+                                   u8 erp_value)
+{
+        bool use_protection = (erp_value & WLAN_ERP_USE_PROTECTION) != 0;
+        bool use_short_preamble = (erp_value & WLAN_ERP_BARKER_PREAMBLE) == 0;
+
+        return ieee80211_handle_protect_preamb(sdata,
+                        use_protection, use_short_preamble);
+}
+
+static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
+                                           struct ieee80211_sta_bss *bss)
+{
+        u32 changed = 0;
+
+        if (bss->has_erp_value)
+                changed |= ieee80211_handle_erp_ie(sdata, bss->erp_value);
+        else {
+                u16 capab = bss->capability;
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        }
+
+        return changed;
+}
+
 int ieee80211_ht_cap_ie_to_ht_info(struct ieee80211_ht_cap *ht_cap_ie,
                                    struct ieee80211_ht_info *ht_info)
 {
@@ -468,9 +492,7 @@ static void ieee80211_set_associated(struct net_device *dev,
                                            local->hw.conf.channel,
                                            ifsta->ssid, ifsta->ssid_len);
                 if (bss) {
-                        if (bss->has_erp_value)
-                                changed |= ieee80211_handle_erp_ie(
-                                                sdata, bss->erp_value);
+                        changed |= ieee80211_handle_bss_capability(sdata, bss);
                         ieee80211_rx_bss_put(dev, bss);
                 }
 
@@ -2116,6 +2138,11 @@ static void ieee80211_rx_mgmt_beacon(struct net_device *dev,
 
         if (elems.erp_info && elems.erp_info_len >= 1)
                 changed |= ieee80211_handle_erp_ie(sdata, elems.erp_info[0]);
+        else {
+                u16 capab = le16_to_cpu(mgmt->u.beacon.capab_info);
+                changed |= ieee80211_handle_protect_preamb(sdata, false,
+                                (capab & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0);
+        }
 
         if (elems.ht_cap_elem && elems.ht_info_elem &&
             elems.wmm_param && local->ops->conf_ht &&
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index dc29007c52cd..40d344b21453 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -466,38 +466,25 @@ static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
 
 static inline __be32 maskl(__be32 a, unsigned int l)
 {
-        return htonl(ntohl(a) & ~(~(u_int32_t)0 >> l));
+        return l ? htonl(ntohl(a) & ~0 << (32 - l)) : 0;
 }
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
 {
         switch (p) {
-        case 0:
-                i[0] = i[1] = 0;
-                i[2] = i[3] = 0;
-                break;
-        case 1 ... 31:
+        case 0 ... 31:
                 i[0] = maskl(i[0], p);
                 i[1] = i[2] = i[3] = 0;
                 break;
-        case 32:
-                i[1] = i[2] = i[3] = 0;
-                break;
-        case 33 ... 63:
+        case 32 ... 63:
                 i[1] = maskl(i[1], p - 32);
                 i[2] = i[3] = 0;
                 break;
-        case 64:
-                i[2] = i[3] = 0;
-                break;
-        case 65 ... 95:
+        case 64 ... 95:
                 i[2] = maskl(i[2], p - 64);
                 i[3] = 0;
-        case 96:
-                i[3] = 0;
-                break;
-        case 97 ... 127:
+        case 96 ... 127:
                 i[3] = maskl(i[3], p - 96);
                 break;
         case 128:
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index c5c16b4b6e98..4d755444c449 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -411,8 +411,10 @@ static void u32_destroy(struct tcf_proto *tp)
                         }
                 }
 
-                for (ht=tp_c->hlist; ht; ht = ht->next)
+                for (ht = tp_c->hlist; ht; ht = ht->next) {
+                        ht->refcnt--;
                         u32_clear_hnode(tp, ht);
+                }
 
                 while ((ht = tp_c->hlist) != NULL) {
                         tp_c->hlist = ht->next;
@@ -441,8 +443,12 @@ static int u32_delete(struct tcf_proto *tp, unsigned long arg)
         if (tp->root == ht)
                 return -EINVAL;
 
-        if (--ht->refcnt == 0)
+        if (ht->refcnt == 1) {
+                ht->refcnt--;
                 u32_destroy_hnode(tp, ht);
+        } else {
+                return -EBUSY;
+        }
 
         return 0;
 }
@@ -568,7 +574,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
                 if (ht == NULL)
                         return -ENOBUFS;
                 ht->tp_c = tp_c;
-                ht->refcnt = 0;
+                ht->refcnt = 1;
                 ht->divisor = divisor;
                 ht->handle = handle;
                 ht->prio = tp->prio;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index b1e05d719f9b..85f1495e0edc 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -110,8 +110,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                 spin_lock_bh(&sctp_local_addr_lock);
                 list_for_each_entry_safe(addr, temp,
                                         &sctp_local_addr_list, list) {
-                        if (ipv6_addr_equal(&addr->a.v6.sin6_addr,
-                                             &ifa->addr)) {
+                        if (addr->a.sa.sa_family == AF_INET6 &&
+                                        ipv6_addr_equal(&addr->a.v6.sin6_addr,
+                                                &ifa->addr)) {
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1bb3c5c35d2a..c0714469233c 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -793,6 +793,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         break;
 
                 case SCTP_CID_ABORT:
+                        if (sctp_test_T_bit(chunk)) {
+                                packet->vtag = asoc->c.my_vtag;
+                        }
                 case SCTP_CID_SACK:
                 case SCTP_CID_HEARTBEAT:
                 case SCTP_CID_HEARTBEAT_ACK:
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index f90091a1b9ce..c2dd65d9f38d 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -647,7 +647,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
                 spin_lock_bh(&sctp_local_addr_lock);
                 list_for_each_entry_safe(addr, temp,
                                         &sctp_local_addr_list, list) {
-                        if (addr->a.v4.sin_addr.s_addr == ifa->ifa_local) {
+                        if (addr->a.sa.sa_family == AF_INET &&
+                                        addr->a.v4.sin_addr.s_addr ==
+                                        ifa->ifa_local) {
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 578630e8e00d..36ebb392472e 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1982,7 +1982,10 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                                         struct sctp_chunk *chunk,
                                         struct sctp_chunk **err_chunk)
 {
+        struct sctp_hmac_algo_param *hmacs;
         int retval = SCTP_IERROR_NO_ERROR;
+        __u16 n_elt, id = 0;
+        int i;
 
         /* FIXME - This routine is not looking at each parameter per the
          * chunk type, i.e., unrecognized parameters should be further
@@ -2056,9 +2059,29 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_HMAC_ALGO:
-                if (sctp_auth_enable)
-                        break;
-                /* Fall Through */
+                if (!sctp_auth_enable)
+                        goto fallthrough;
+
+                hmacs = (struct sctp_hmac_algo_param *)param.p;
+                n_elt = (ntohs(param.p->length) - sizeof(sctp_paramhdr_t)) >> 1;
+
+                /* SCTP-AUTH: Section 6.1
+                 * The HMAC algorithm based on SHA-1 MUST be supported and
+                 * included in the HMAC-ALGO parameter.
+                 */
+                for (i = 0; i < n_elt; i++) {
+                        id = ntohs(hmacs->hmac_ids[i]);
+
+                        if (id == SCTP_AUTH_HMAC_ID_SHA1)
+                                break;
+                }
+
+                if (id != SCTP_AUTH_HMAC_ID_SHA1) {
+                        sctp_process_inv_paramlength(asoc, param.p, chunk,
+                                                     err_chunk);
+                        retval = SCTP_IERROR_ABORT;
+                }
+                break;
 fallthrough:
         default:
                 SCTP_DEBUG_PRINTK("Unrecognized param: %d for chunk %d.\n",
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 28eb38eb6083..a4763fd24fd8 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1536,6 +1536,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         error = sctp_auth_asoc_init_active_key(asoc,
                                                 GFP_ATOMIC);
                         break;
+                case SCTP_CMD_UPDATE_INITTAG:
+                        asoc->peer.i.init_tag = cmd->obj.u32;
+                        break;
 
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index f2ed6473feef..07194c2a32df 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4144,6 +4144,24 @@ static sctp_disposition_t sctp_sf_abort_violation(
                 goto nomem;
 
         if (asoc) {
+                /* Treat INIT-ACK as a special case during COOKIE-WAIT. */
+                if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
+                    !asoc->peer.i.init_tag) {
+                        sctp_initack_chunk_t *initack;
+
+                        initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
+                        if (!sctp_chunk_length_valid(chunk,
+                                                     sizeof(sctp_initack_chunk_t)))
+                                abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
+                        else {
+                                unsigned int inittag;
+
+                                inittag = ntohl(initack->init_hdr.init_tag);
+                                sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
+                                                SCTP_U32(inittag));
+                        }
+                }
+
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 
@@ -4349,6 +4367,7 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
                                        sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *repl;
+        struct sctp_association* my_asoc;
 
         /* The comment below says that we enter COOKIE-WAIT AFTER
          * sending the INIT, but that doesn't actually work in our
@@ -4372,8 +4391,8 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
         /* Cast away the const modifier, as we want to just
          * rerun it through as a sideffect.
          */
-        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC,
-                        SCTP_ASOC((struct sctp_association *) asoc));
+        my_asoc = (struct sctp_association *)asoc;
+        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
 
         /* Choose transport for INIT. */
         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d994d822900d..998e63a31311 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5868,11 +5868,12 @@ SCTP_STATIC int sctp_msghdr_parse(const struct msghdr *msg,
                                   sctp_cmsgs_t *cmsgs)
 {
         struct cmsghdr *cmsg;
+        struct msghdr *my_msg = (struct msghdr *)msg;
 
         for (cmsg = CMSG_FIRSTHDR(msg);
              cmsg != NULL;
-             cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) {
-                if (!CMSG_OK(msg, cmsg))
+             cmsg = CMSG_NXTHDR(my_msg, cmsg)) {
+                if (!CMSG_OK(my_msg, cmsg))
                         return -EINVAL;
 
                 /* Should we parse this header or ignore?  */
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index b43f1f110f87..ce6cda6b6994 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -859,7 +859,7 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
         union sctp_notification *notification;
         struct sk_buff *skb;
 
-        skb = sctp_event2skb((struct sctp_ulpevent *)event);
+        skb = sctp_event2skb(event);
         notification = (union sctp_notification *) skb->data;
         return notification->sn_header.sn_type;
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e3a214f63f91..f68a5c8f2147 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -945,7 +945,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
-        params.listen_interval = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
 
         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
                                 &params.station_flags))
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5d96f2728dc6..019d21de19b3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -288,7 +288,7 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
         memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
         x->props.flags = p->flags;
 
-        if (x->props.mode == XFRM_MODE_TRANSPORT)
+        if (!x->sel.family)
                 x->sel.family = p->family;
 
 }